Europe's pharmaceutical industry is sounding an alarm about unintended consequences of the EU's proposed Cloud and AI Development Act (CADA), warning that overly strict sovereignty requirements could actually harm European competitiveness rather than strengthen it. The European Federation of Pharmaceutical Industries and Associations (EFPIA) has cautiously welcomed the initiative to expand European computing capacity, but argues that pursuing technological sovereignty must not become European isolation.

Why Are Pharma Companies Worried About AI Sovereignty Rules?

The concern centers on how CADA's sovereignty requirements could be interpreted and applied. EFPIA warns that measures designed to keep computing and data within Europe could restrict pharmaceutical companies' access to established global cloud and artificial intelligence (AI) providers, which are already deeply embedded in drug development workflows. Drug discovery, clinical trials, manufacturing, safety monitoring, and real-world evidence generation all rely on cloud technologies that often span multiple countries and jurisdictions.

The stakes are high. Nine leading European pharmaceutical executives recently issued an open letter warning that drug development is increasingly shifting toward the United States and China, which have announced more than $600 billion in pharmaceutical investment over the past two years. "In our boardrooms, we see Europe losing ground to global competition," the executives stated, urging governments to "create conditions that attract investment in next-generation medicines before it's too late".

What Specific Concerns Does EFPIA Have About CADA?

EFPIA has identified several ways that well-intentioned sovereignty rules could backfire on the pharmaceutical sector:

• Data Localization Risks: Requirements that force data to remain within European borders could fragment international research networks and increase operational costs for companies conducting multi-country clinical trials and research collaborations.
• Cross-Border Processing Restrictions: Constraints on moving data across borders for processing could isolate European researchers from global technology partners, hospitals, and manufacturing sites that are essential to modern drug development.
• Regulatory Overload: CADA joins an already crowded landscape of EU digital regulations including the AI Act, General Data Protection Regulation (GDPR), Data Act, Data Governance Act, NIS2, Cybersecurity Act, European Health Data Space, and pharmaceutical legislation, creating potential overlaps and contradictory requirements.

EFPIA is calling for a fundamentally different approach. The association argues that sovereignty requirements should remain risk-based, proportionate, and technology-neutral. While tighter requirements may be justified for certain public-sector or national-security applications, they should not automatically extend to pharmaceutical research and development, clinical development, manufacturing, pharmacovigilance, or evidence generation without a clearly demonstrated risk.

"European sovereignty must not become European isolation," EFPIA emphasized, noting that pharmaceuticals operate globally and cloud computing technologies are already embedded across the medicines lifecycle.

EFPIA, European Federation of Pharmaceutical Industries and Associations

How Can Policymakers Balance Sovereignty With Innovation?

EFPIA is urging EU lawmakers to take several concrete steps to ensure that CADA supports rather than hinders pharmaceutical innovation:

• Risk-Based Assessment: Evaluate sovereignty requirements based on actual security and strategic risks rather than applying blanket rules across all sectors and use cases.
• Technology Neutrality: Avoid prescribing specific technologies or infrastructure solutions, allowing companies to choose the most efficient and secure approaches for their needs.
• Regulatory Alignment: Ensure that CADA does not overlap with or contradict existing EU digital and pharmaceutical legislation, reducing compliance burden and confusion.
• Sector-Specific Flexibility: Recognize that pharmaceutical R&D, clinical development, and evidence generation have different risk profiles than critical infrastructure or defense applications and should not face identical requirements.

The timing of this warning is significant. The EU AI Act, which entered into force in 2024, already imposes strict requirements on high-risk AI applications, including those used in healthcare. CADA represents another layer of regulation specifically targeting cloud infrastructure and computing capacity. For pharmaceutical companies already navigating complex compliance requirements across multiple jurisdictions, the prospect of additional sovereignty-driven restrictions threatens to make Europe less attractive for investment and innovation.

The pharmaceutical industry's concerns reflect a broader tension in European technology policy. Policymakers want to reduce dependence on non-European cloud and AI providers and build sovereign computing capacity. However, the pharmaceutical sector argues that this goal should not come at the expense of the international collaboration that modern drug development requires. As EFPIA noted, the industry is calling for policymakers to ensure that rules do not overlap or create contradictory requirements that could push pharmaceutical investment and research to more permissive jurisdictions.