What If the U.S. Demanded This? The Cloud Provider Conditions Behind Canada’s EU Digital Pivot

Geist reports that CADA, which the European Commission proposed in June as the foundation of its Tech Sovereignty Package, establishes four assurance levels for cloud services.[1] He writes that level three, which the proposal says should be able to host EU classified information, is off-limits to providers under the control of a third country.[1]According to Geist, Article 18 features a key exception, allowing the Commission to designate "associated third countries" whose providers may be audited at that level.[2]Geist writes that qualifying countries must hold an EU privacy adequacy decision and must grant EU providers equivalent access to public procurement[3]. He adds that the Computer & Communications Industry Association has argued that no major technology-producing country meets that standard[3]. He says that last year the RCMP obtained a court order requiring OVHcloud, a French provider, to disclose data based on its presence in Canada.[3] He also writes that "Buy Canadian" policies for cloud services[3] would face the procurement condition.Geist also argues that "the benefit for Canadian companies is more limited than the summit language suggests"[3], writing that the mechanism only applies to cloud providers and does not address AI regulation.[3]In Geist's view, associated status "would swap U.S. demands for European ones,"[2] leaving Canada's digital policy choices subject to someone else's approval.