Summary

• Eurelectric wants changes to the proposed Cloud and AI Development Act's four-level cloud sovereignty framework.
• It warns that broadly applying higher assurance levels could restrict access to software used for forecasting, network management, and maintenance.
• The association seeks proportionate requirements, clearer rules governing private operators, and safeguards against duplicating existing regulation.

European electricity industry association Eurelectric has called for changes to the EU’s proposed cloud sovereignty framework, warning that demanding requirements could restrict access to software used to manage electricity networks and increase costs ultimately recovered from consumers.

In recommendations published on 3 November, the association supports the European Commission’s intention to reduce dependence on overseas cloud providers but argues that the proposed rules must reflect the technology currently available to grid operators.

The intervention concerns the Cloud and AI Development Act, proposed in June 2026, which would establish four European assurance levels for cloud services. The framework is intended to help public authorities assess the degree of operational and legal control provided by different suppliers.

Eurelectric is particularly concerned about requirements associated with the higher assurance levels and the possibility of extending obligations to private infrastructure operators without sufficiently defined conditions. The legislation remains a proposal, and the final obligations will depend on negotiations between the European Parliament and Council.

Grid operations rely on cloud-based analysis

Electricity network operators use digital systems to understand changing demand, monitor equipment, manage outages, and determine how much power can be transported safely through existing infrastructure.

Cloud computing can support these activities by providing data storage, processing capacity, and software services that are difficult or expensive for every operator to maintain independently.

Eurelectric identifies forecasting, network state estimation, predictive maintenance, outage management, and dynamic line rating among the applications that could be affected by restrictive cloud purchasing requirements.

Forecasting systems help operators anticipate changes in electricity demand and generation, while network state estimation combines measurements and models to assess conditions across the grid. Maintenance software can identify equipment showing signs of deterioration, allowing engineers to investigate before a failure interrupts services.

Dynamic line rating provides another example. The method uses information about environmental and operating conditions to assess the capacity of overhead power lines, potentially allowing operators to make more effective use of existing infrastructure than would be possible using fixed capacity assumptions alone.

These applications serve different operational purposes, but they share a need for reliable information and suitably configured computing systems. Moving them between cloud providers may involve transferring data, rebuilding analytical processes, reconnecting applications, and verifying that the replacement delivers equivalent results.

The availability of a service marketed as sovereign does not establish that it can reproduce every function provided by an existing platform. Operators must also consider reliability, security, performance, and the costs associated with maintaining the replacement over time.

Electricity networks continue to use local operational technology and communications systems that must function when external connections are unavailable. Cloud infrastructure therefore supports particular operational activities within a wider control environment rather than replacing every system responsible for running the network.

Four assurance levels establish different conditions

The Commission’s proposal would introduce a common framework for assessing cloud sovereignty across the EU. The four assurance levels establish progressively stronger requirements concerning the location, ownership, legal control, and operational independence of cloud services.

Level one includes requirements for services to be operated through infrastructure within the Union, alongside other conditions affecting providers and their operations. Level two adds stronger requirements concerning independence from third-country influence, software supply chain transparency, and cybersecurity assurance.

Level three generally requires providers and relevant subcontractors to be established and controlled within the EU, with further conditions concerning personnel, infrastructure, and the handling of data. The proposal also provides a mechanism under which certain providers controlled from recognised third countries could qualify.

Level four introduces the strongest requirements for supply chain control and protection against interference from outside the Union.

The assurance framework is designed to apply different requirements according to the risks associated with particular public sector activities. It does not establish a blanket obligation for every private electricity operator to use level four services.

Eurelectric’s concern is that extensive application of levels three and four, and potentially level two in some circumstances, could make established cloud services unavailable or substantially more expensive before equivalent alternatives are ready.

The association does not provide a quantified estimate of the resulting costs. Its warning concerns the possible commercial and operational consequences of the proposed requirements, rather than an increase in electricity prices already attributable to the legislation.

Private-sector obligations require clearer boundaries

The proposed legislation contains mechanisms relating to cloud procurement and sovereignty assessments, while also providing for requirements that may extend beyond the public sector under defined circumstances.

Eurelectric argues that the scope of any extension needs to be established more precisely. It wants clarity over the conditions that would justify applying additional obligations to private operators, the evidence required to support that decision, and the time available for affected organisations to comply.

Its recommendations call for consultation with relevant industries before broader requirements are introduced, together with an assessment of whether suitable cloud services exist with comparable security, interoperability, and performance.

Without those safeguards, electricity operators could face a requirement to change providers before the replacement technology has been validated for their particular operational needs.

The consequences would depend on which applications were affected. A system used for administrative reporting may be easier to replace than software integrated with network forecasting or maintenance processes that support essential infrastructure.

The association also wants to avoid unnecessary duplication of obligations already imposed through other European legislation. Electricity operators are subject to sector-specific requirements, while cybersecurity and data protection rules impose further responsibilities according to the nature of their services and information.

Cloud sovereignty introduces distinct questions about legal control and dependence on overseas suppliers, but technical security and operational resilience must still be assessed separately.

A provider based in Europe may offer legal and commercial advantages without automatically having stronger cybersecurity than every international competitor. Conversely, a technically secure service can raise legitimate concerns where foreign legal powers or supplier dependencies affect an organisation’s control over critical operations.

Digital infrastructure depends on available electricity

The Commission’s wider Cloud and AI Development Act aims to strengthen European computing capacity, accelerate data centre development, and support adoption of AI and cloud services in strategically important sectors.

It seeks to at least triple EU data centre capacity within five to seven years, while addressing barriers involving electricity, land, water, and financing. Those ambitions increase the importance of electricity networks capable of supplying new computing facilities.

Grid operators face the task of connecting additional demand while continuing to support renewable generation, industrial electrification, and existing customers. Digital tools can help them model demand, monitor infrastructure, and manage available capacity, particularly where network expansion requires lengthy planning and construction work.

That creates a practical relationship between the EU’s computing ambitions and the technology used to operate electricity networks. Requirements affecting grid software may influence the same infrastructure operators expected to connect and support new data centres.

European cloud providers could benefit from common sovereignty standards if they create predictable procurement requirements and allow customers to assess services consistently. The effect will depend on whether qualified suppliers can deliver the applications and reliability required by critical infrastructure operators.

Eurelectric is seeking targeted amendments rather than abandonment of the Commission’s sovereignty objectives. Its recommendations ask legislators to retain the framework’s underlying direction while clarifying its scope and the conditions governing higher assurance levels.

The final legislative text will determine how those requirements apply to cloud purchasing and whether additional obligations extend to private electricity operators. For now, the association’s intervention identifies technical and commercial issues that lawmakers will need to consider as the proposal advances.