CADA Won't Save You: Sovereign Cloud Is a Procurement Costume

I read the Computerworld piece on the EU's new Cloud and AI Development Act twice this morning before my coffee got cold, and both times I landed in the same place. CADA is a permission slip, not a wall. It tells you which vendors are allowed to say the word "sovereign" on a slide. It does nothing about the thing that actually determines whether your company can survive a pricing change, an API deprecation, or a geopolitical mood swing in Washington.

That thing is architecture. And architecture doesn't show up on a compliance rating.

The SEAL Rating Is Measuring the Wrong Thing

Here's what nobody wants to say out loud in a procurement meeting: you can be 100% CADA compliant and still be completely hostage to Azure, AWS, or GCP. Compliance checks legal jurisdiction, data residency paperwork, maybe a EU-based subsidiary structure. It does not check whether your entire stack is built on proprietary APIs that only one vendor speaks, whether your pricing is dictated by a roadmap decided in Redmond or Seattle, or whether migrating away would take eighteen months and cost more than your annual revenue.

Microsoft understands this better than the regulators writing the law. That's why their Microsoft Source pressroom is currently full of "sovereign cloud" announcements. New EU data boundary features. Confidential compute options. A local operations center with European staff who, functionally, still answer to US corporate structure and US law when it matters. None of that changes where the actual control plane sits. None of it changes who can flip a switch on your API access.

This is not a conspiracy. It's rational vendor behavior. If the EU builds a checkbox, hyperscalers will build a feature that checks the box without giving up an inch of architectural control. Computerworld called this exactly right: CADA "leaves room for US hyperscalers." Of course it does. It was negotiated by people who need Azure and AWS to keep functioning across the union tomorrow morning. You don't rip out the plumbing of a continent's digital economy with one act. You write a law that lets everyone claim victory.

Lime's Quiet Pivot Is the More Honest Signal

While Brussels drafts legal text, Lime Technologies in Lund is doing something more interesting. They're building a genuinely European CRM stack. Not "European-adjacent." Not "compliant with EU data residency rules while running on US-owned infrastructure." An actual alternative architecture, built and controlled inside Europe, with a company that answers to Swedish and EU jurisdiction in a way that isn't a legal fiction wrapped around a hyperscaler subsidiary. That is a Swedish SaaS company solving in code what regulators are still trying to solve with paperwork. I'd take that trade every time. Legislation moves at the speed of consensus among 27 member states. Code moves at the speed of a product team that actually feels the pain of vendor lock-in and decides to build the alternative instead of waiting for permission.

This is the actual lesson for every CTO reading this in Stockholm, Jönköping, or Malmö right now. Sovereignty isn't a status you achieve by picking a vendor with the right stamp. It's a property of your own custom SaaS development decisions. Where you put your data layer, how portable your integrations are, whether you can walk away from any single vendor inside a quarter. That's the real SEAL rating, and nobody is publishing it because it's uncomfortable and it requires actually looking at your own codebase instead of your vendor's certification page.

Sweden vs. The World: We're Better Positioned Than We Act

Here's the part that should annoy Swedish executives more than it currently does. We have one of the best conditions in Europe to build real sovereign infrastructure, and most companies here still default to "just spin it up on Azure" because it's the path of least resistance and every consultant tells you to do it. Compare us to the US, where nobody is even pretending sovereignty is a goal. Hyperscalers there answer to shareholders and the Cloud Act, full stop. Compare us to China, where sovereignty is enforced top-down through state control of the stack, which is its own kind of lock-in, just with a different landlord. Compare us to smaller EU states that don't have Sweden's engineering density, our history of building serious infrastructure (Ericsson, Spotify's early self-hosted years, Klarna's internal platform work), or the trust environment that lets a company like Lime make a bet like this and survive it. We have the talent. We have the trust. We have Dagens Industri readers who understand what "digital sovereignty" costs in real terms, not just geopolitics terms. What we don't have enough of is companies willing to do what Lime is doing: architect for independence before the law forces the issue, not after.

The Regulatory Gap Nobody Wants to Name

EU policy is not stupid. It's slow, and it's built by compromise, which means it will always lag two years behind the actual technical reality. CADA is a 2026 answer to a 2023 problem. By the time it's fully enforced, the hyperscalers will have already built the next layer of lock-in, probably through proprietary AI model APIs and agent orchestration platforms that make today's compute lock-in look quaint. Nobody in Brussels is regulating that yet because most of the regulators still think "cloud sovereignty" means "where the server physically sits." It doesn't. It means who controls the interface layer you build your entire business logic on top of.

Where This Goes: AGI Makes This Ten Times Worse

Now project this forward two to five years. If we get anywhere close to the AGI trajectory that OpenAI, Anthropic, and Google are all racing toward, the API surface you depend on today becomes the nervous system of your entire company tomorrow. Every workflow, every decision layer, every customer interaction routed through an agentic system built on someone else's foundation model, someone else's pricing, someone else's roadmap decisions about what capabilities get deprecated or rate-limited next quarter. If you think being locked into Azure's storage pricing is bad, imagine being locked into a foundation model provider's inference pricing when that model is running your customer service, your fraud detection, and your internal ops agents simultaneously. That's not a hypothetical. That's the default trajectory for any company building AI agents right now without thinking about portability. This is exactly why, at HEIMLANDR, when we build AI agents for clients, the first architectural conversation is never "which model." It's "how do we build this so the model is swappable." Same instinct that should drive your cloud decisions. Same instinct that should drive every AI solutions conversation happening in Swedish boardrooms this autumn. The regulatory gap will get wider, not narrower, because the technology moves faster than any legislative body can track. CADA v2 will address today's hyperscaler lock-in right around the time agentic AI lock-in becomes the dominant sovereignty risk. Regulators are always fighting the last war. Build like you know that.

What to Actually Look At

Stop reading vendor compliance pages and start looking at your own exit costs. Concretely:

• awesome-selfhosted: 316k stars and growing for a reason. Before you sign another SaaS contract, check if there's a self-hostable alternative that gives you architectural control. Not every workload needs it, but you'd be surprised how many do.
• n8n: fair-code automation you can self-host or run in the cloud, your choice, your exit path. If your automation layer is built on a proprietary no-code platform, that's a lock-in risk hiding in plain sight.
• Kubernetes: still the closest thing to a portable compute abstraction that actually works across clouds. If your workloads aren't containerized and orchestrated in a portable way, you've already made the lock-in decision, you just haven't paid the bill yet.
• Traefik: cloud native proxy that doesn't care which cloud you're native to. Small detail, but the small details are where sovereignty actually gets built or lost.

None of these tools give you sovereignty by themselves. But they're evidence of a mindset. Build things that can move. That's the whole game.

What To Actually Do About It

Audit your stack this month, not next quarter. Ask three questions: What happens to my business if this vendor doubles pricing in twelve months. What happens if this API gets deprecated with six months notice. Could I move this workload to a different provider in under a year without rebuilding from scratch. If the answer to any of those makes you uncomfortable, that's your actual sovereignty score, and it has nothing to do with CADA. If you're building new products, this is the moment to think about it at the foundation, not retrofit it later. That's true whether you're doing rapid MVP work to test a market or full fullstack development for a product you're betting the company on. Portability is cheap at the start and brutally expensive to add after the fact. This is also where blockchain development and smart contract development get interesting for the sovereignty conversation, decentralized infrastructure is one of the few genuine architectural answers to hyperscaler dependence, not a buzzword answer, an actual different control model. Software development in Sweden has the engineering culture to do this right. We just need more companies willing to spend the extra sprint on portability instead of the fastest path to a demo.

The Bottom Line

CADA will pass. Hyperscalers will comply. Everyone will issue a press release. And the actual sovereignty risk, the one that determines whether your company controls its own destiny or rents it monthly from Seattle, will remain exactly where it was before the law existed: in your architecture, your contracts, and your willingness to build things that can be moved. Lime figured this out without waiting for Brussels. That's the signal worth paying attention to. Not the law. The company that decided the law wasn't going to solve their problem, so they built the solution themselves.

Fredrik Brunnberg is the CEO of HEIMLANDR.IO, building AI and software solutions from Jönköping, Sweden. This is the daily HEIMLANDR briefing. If you found this valuable, share it with someone who builds things.