FISMA is a US federal law. It has no direct legal force in the EU. But it’s the reason AWS, Microsoft Azure, and Google Cloud can call themselves “federal-grade secure,” and that same credential is now the thing standing between them and the EU’s highest tier of cloud sovereignty certification.
The EU’s new Cloud and AI Development Act (CADA), proposed on 3 June 2026, sets a four-level assurance framework for cloud procurement, and its top tiers require immunity from non-EU legal access — the exact condition a FISMA-authorised, FedRAMP-certified US hyperscaler structurally cannot meet, because FISMA compliance is inseparable from being subject to US jurisdiction, including the US CLOUD Act. This isn’t two unrelated compliance regimes sitting side by side. It’s a genuine collision, and it’s playing out in European public procurement right now.
What FISMA Actually Does, Briefly
FISMA — the Federal Information Security Modernization Act of 2014, updating the original 2002 law — requires US federal agencies, and anyone operating a system on their behalf, to run a formal, NIST-based security programme and get a documented Authorization to Operate before a system can process federal information. For cloud specifically, that authorisation runs through FedRAMP, which applies the same NIST SP 800-53 control baseline to commercial cloud services sold to federal agencies.
FISMA and FedRAMP aren’t a general security certification a vendor picks up for credibility. They’re a legal relationship with the US federal government, assessed and enforced under US law, by US authorities, over a provider that remains a US legal entity — or a subsidiary of one — for the purposes of US jurisdiction.
Why This Matters in Europe: The CLOUD Act Problem
The US CLOUD Act lets US authorities compel a US company to produce data under its control, regardless of where that data is physically stored — including in an EU data centre. A FISMA-authorised US hyperscaler operating a European region is still, for CLOUD Act purposes, a US company. Physical data residency in Frankfurt or Dublin doesn’t change who the US government can legally compel.
European regulators have been aware of this for years, but it moved from a background concern to an explicit legal exclusion criterion with CADA.
CADA: The EU’s Answer, and Where FISMA-Certified Providers Hit a Wall
The European Commission published the proposed EU Cloud and AI Development Act on 3 June 2026, as part of a broader Tech Sovereignty Package alongside Chips Act 2.0 and the EU Open Source Strategy. CADA establishes a four-level assurance framework for cloud procurement, and it’s explicitly designed to supersede the earlier European Cybersecurity Certification Scheme for Cloud Services (EUCS), whose own “High” assurance tier triggered a transatlantic policy fight in 2024–2025 over the same underlying question: can a provider subject to a third country’s legal reach ever qualify as sovereign.
| CADA level | Core requirement | Can a FISMA/FedRAMP-authorised US hyperscaler meet it? |
|---|---|---|
| Level 1 | Baseline cloud security requirements | Yes |
| Level 2 | Supply-chain transparency, vendor risk assessment | Yes, generally |
| Level 3 | Structural and operational controls limiting third-country access | Only with significant restructuring — a legally distinct EU entity, EU-only personnel and control plane |
| Level 4 | Full transparency and control over the software supply chain, with no interference from a third country | Not while the provider remains subject to FISMA/FedRAMP oversight and US jurisdiction under the CLOUD Act |
CADA is currently in Parliament and Council negotiation, with final adoption targeted for late 2027. It has not yet been adopted, and the detail of Levels 3 and 4 could still shift before then.
The Numbers Behind the Policy
US hyperscalers — AWS, Microsoft Azure, and Google Cloud — control roughly 70% of the EU cloud market, according to Commission figures, against a European provider share of around 15%. The Commission has stated the EU relies on non-EU countries for more than 80% of its key digital products, services, infrastructure, and intellectual property. In April 2026, the Commission ran the first live test of sovereignty-based procurement, awarding a €180 million sovereign cloud contract to four European provider groups — the first procurement in EU history to apply explicit sovereignty criteria to cloud services rather than price or technical capability alone. Gartner projects European sovereign cloud spending will grow from €6.9 billion in 2025 to around €23.1 billion by 2027.
How Hyperscalers Are Trying to Thread the Needle
AWS launched a dedicated European Sovereign Cloud in January 2026 — a physically and logically separate offering with an EU-only data plane, EU-based personnel, and specific legal protections, distinct from AWS’s standard EU regions. Microsoft and Google have pursued comparable “sovereign” offerings. The open legal question these products haven’t settled is whether a nominally separate EU subsidiary genuinely removes the parent company’s CLOUD Act exposure, or whether US jurisdiction reaches through the corporate structure regardless of where the subsidiary is incorporated. Until that question is tested, CADA’s Level 3 and 4 assurance tiers remain the practical measure of whether regulators are satisfied, not the hyperscalers’ own marketing language.
US industry has pushed back directly. The Computer and Communications Industry Association, representing major US technology firms, has called the CADA framework “a dangerous recipe for progressive market shutdown” and described the Level 3 and 4 requirements as closed-market criteria that no international provider could satisfy by design.
The AI Angle
This collision reaches AI compliance through infrastructure, not through the AI Act’s text directly. The AI Act’s Article 9 risk management obligations for high-risk systems are broad enough that some analysts argue competent authorities may start treating infrastructure jurisdiction — where a high-risk AI system’s compute and data actually sit, and who can compel access to them — as part of the compliance evidence base, particularly for AI used in consequential contexts like biometric identification. This interpretation is not settled law. But it means an AI company running high-risk workloads on FISMA/FedRAMP-authorised US cloud infrastructure may face a harder sovereignty conversation with EU regulators than a company running the identical model on EU-sovereign infrastructure, even where both comply with the AI Act’s text equally well.
Key Facts
| Item | Detail |
|---|---|
| FISMA | US federal law (2002, modernised 2014) requiring federal information security programmes; no direct legal force in the EU |
| FedRAMP | The FISMA-aligned cloud authorisation programme that qualifies commercial cloud providers to serve US federal agencies |
| US CLOUD Act | US law allowing US authorities to compel a US company to produce data under its control, regardless of where it’s stored |
| EUCS | ENISA’s EU Cybersecurity Certification Scheme for Cloud Services, whose contentious sovereignty-based “High” tier CADA is designed to supersede |
| CADA | The EU Cloud and AI Development Act, proposed 3 June 2026, establishing a four-level cloud sovereignty assurance framework for EU procurement |
| EU hyperscaler market share (US providers) | Approximately 70% |
| EU hyperscaler market share (EU providers) | Approximately 15% |
| First sovereignty-criteria procurement | April 2026, €180 million contract awarded to four European provider groups |
| CADA adoption target | Late 2027, currently in Parliament and Council negotiation |
Where This Fits
This is a live case of two compliance regimes — one American, one European — pulling in opposite directions on the same underlying question: who can be compelled to hand over your data, and under whose law. An AI company choosing infrastructure today is making a decision that CADA, once adopted, may turn into a procurement-eligibility question rather than a technical preference. Mapping this alongside your AI Act, GDPR, and Data Act obligations before that shift happens is the difference between an infrastructure decision and an infrastructure problem.
FAQ
Does FISMA apply to companies in the EU?
No, not directly. FISMA is US federal law and governs US federal agencies and their contractors. Its relevance to the EU is indirect: FISMA and FedRAMP compliance is the credential US hyperscalers rely on globally, and that same compliance ties them to US jurisdiction in a way the EU’s own sovereignty framework now treats as a disqualifying factor at its highest assurance tiers.
What is CADA?
The Cloud and AI Development Act is a European Commission legislative proposal, published 3 June 2026 as part of the EU’s Tech Sovereignty Package, establishing a four-level assurance framework for cloud sovereignty in EU procurement. It is not yet adopted; Parliament and Council negotiation is ongoing, with adoption targeted for late 2027.
Why can’t a FedRAMP-authorised US hyperscaler qualify for CADA’s highest tier?
CADA’s Level 4 requires full transparency and control over the software supply chain with no interference from a third country. A FedRAMP-authorised provider is, by definition, subject to FISMA oversight and therefore to US jurisdiction, including the US CLOUD Act’s power to compel data disclosure regardless of physical location. Those two conditions are structurally difficult to satisfy simultaneously.
What is the US CLOUD Act and why does it matter here?
The CLOUD Act allows US authorities to compel a US company to produce data under its control, even where that data is stored outside the United States. For EU regulators, this means physical data residency in an EU data centre doesn’t, on its own, remove a US provider’s exposure to a US legal demand.
Do “sovereign cloud” offerings from AWS, Microsoft, or Google solve this?
They address parts of it — EU-only data planes, EU-based personnel, and separate legal entities reduce practical exposure. Whether they remove CLOUD Act exposure entirely is a genuinely unresolved legal question, not a settled fact each hyperscaler’s marketing implies.
Does this affect AI companies specifically?
Yes, through infrastructure choice. Where a high-risk AI system under the EU AI Act runs on FISMA/FedRAMP-authorised US cloud infrastructure versus EU-sovereign infrastructure may increasingly factor into how regulators assess Article 9 risk management compliance, though this connection is an emerging interpretive question rather than an explicit statutory requirement today.
Is CADA in force yet?
No. It was proposed on 3 June 2026 and is currently subject to negotiation between the European Parliament and Council, with final adoption targeted for late 2027. The detail of the higher assurance tiers could still change before then.
What’s the difference between EUCS and CADA?
EUCS is ENISA’s existing cybersecurity certification scheme for cloud services under the EU Cybersecurity Act, and its “High” assurance tier already included contentious sovereignty requirements before industry pressure softened them. CADA is designed to supersede EUCS with a more explicit, legally binding four-tier sovereignty framework tied directly to public procurement eligibility.
