Oracle urges EU to recognize locally controlled clouds using international technology

Oracle wants European control of cloud and AI services to leave room for international technology. In a November 11, 2026 policy statement, it urged the EU to recognize locally controlled partner services with auditable safeguards. It also set out two routes toward proposed cloud assurance levels, while acknowledging that further development is needed.

The statement welcomes the European Commission’s proposed Cloud and AI Development Act, or CADA. Written by Oracle executives Cormac Watters and Matis Pellerin, it pairs support for a common EU sovereignty framework with recommendations about how that framework should work. Its central request is to judge services by the control and protection they deliver, rather than impose unnecessarily prescriptive implementation rules.

Two routes to EU control

According to Oracle’s description, CADA would introduce four Union Assurance Levels, from UAL-1 through UAL-4. These would match cloud sovereignty requirements to the sensitivity and risks of public-sector workloads. Oracle is pursuing different operating arrangements for two of those levels, rather than presenting one service as suitable for every workload.

Its own EU Sovereign Cloud provides the first foundation. Oracle says its Frankfurt and Madrid data centers are physically and logically separate from its commercial cloud regions. Dedicated Oracle legal entities incorporated in the EU own the infrastructure and operate the services. Operations and support are handled by EU residents located within the bloc.

The partner route uses Oracle Alloy, its private-label cloud platform. European partners can offer Oracle services under their own brands from data centers they operate. Partners manage customer relationships, customer-facing support and service delivery, with Oracle supplying technology and expertise. Oracle wants EU-controlled arrangements using international technology to qualify when they provide equivalent, auditable safeguards.

Ambitions, not completed qualifications

Those targets are not claims of completed qualification. Oracle explicitly says achieving them will require further development, with readiness judged against CADA’s final requirements. It says it is already assessing governance and controls, focusing on EU operational control, customer-data safeguards, EU-based support, software assurance and continuity of service.

The ambition also covers Oracle’s subscription business applications supporting public-sector operations and essential services, with requirements assessed for each offering. Its existing EU Sovereign Cloud already supports Fusion applications for finance, public procurement and workforce management, alongside sovereign AI workloads. The proposed readiness work therefore extends beyond the infrastructure hosting those services.

Safeguards without unnecessary restrictions

For UAL-2, Oracle favors operational safeguards that strengthen customer control and service continuity without rigid implementation rules. It argues that overly restrictive requirements could narrow customer choice and delay modernization without improving sovereignty. Its recommendations also address who must comply, how workloads are classified and how services receive recognition:

• Choose assurance levels by workload sensitivity and operational importance, supported by transparent risk assessments, rather than unnecessarily assigning workloads to higher levels.
• Keep mandatory sovereignty requirements anchored in public procurement. Let private organizations choose operating models according to their risks, legal obligations and business needs.
• Use independent audit evidence for consistent EU-wide recognition, without duplicative national reassessments, and establish clear service boundaries and assessment timelines.

Oracle also asks policymakers to distinguish the responsibilities of infrastructure, platform and application providers. Its argument for predictable assessment is partly about speed: cloud and AI services change quickly, and lengthy approval processes risk leaving requirements outdated before they are widely implemented.