EUROPEAN AI & CLOUD GOVERNANCE
The AI Act sets obligations. EN 18286 supports quality management for high-risk AI providers; ISO/IEC 42001 addresses the wider AI management system. ISO/IEC 27090:2026 guides AI-specific security threat detection and mitigation. The proposed Cloud and AI Development Act informs sovereignty choices. We connect these instruments to practical decisions and accountable delivery.
Discuss your environmentSTATUS / 19 OCTOBER 2026
01 / WHAT APPLIES, WHAT IS EMERGING
We distinguish legislation, harmonised standards,
management and security guidance, and proposed policy.
Regulation (EU) 2024/1689
Start with the AI system, its use case and your role in the value chain. From there, identify applicable duties, risk controls, evidence and accountable owners. The Act applies in phases, with exceptions to the general application date.
AI quality management · Article 17
Requirements and guidance for an AI quality management system, primarily for providers placing high-risk AI systems on the market or putting them into service. The reference was cited in the Official Journal on 14 October 2026.
Conformity with the standard supports presumption of conformity for the AI Act requirements it covers; it does not establish compliance with every obligation.
AI management system · 2023
A structured way to establish, run and improve an AI management system. It helps connect policy, risk, roles and review cycles across an organisation. It is a standard, not an EU law or a substitute for AI Act analysis.
AI system cybersecurity · 2026
Guidance on security threats and compromises specific to AI systems across their life cycle. It helps teams understand how data, models and workflows may be attacked, and how to detect and mitigate those threats alongside established information security practices.
CADA · COM(2026) 502 · 3 June 2026
The Commission proposal addresses EU cloud and AI capacity, autonomy and a common sovereignty assessment framework. Its provisions can change during the legislative process; they are not current legal obligations.
02 / SOVEREIGNTY ASSURANCE
From EU data location to deeper
control over providers and supply chains.
CADA proposes four assurance levels for cloud and AI sovereignty, intended for public-sector use based on risk assessment. These visual levels explain the proposal; they are not certification seals or credentials held by Luxora.
Processing and storage on infrastructure located in the Union.
Demonstrated independence from third countries and transparency of the software supply chain.
EU ownership and control, with additional criteria described in the proposal.
Full software supply-chain transparency and control, without third-country interference.
Summary of the European Commission's CADA explanation . Final wording and implementation may change.
03 / FROM FRAMEWORK TO WORK
We connect the regulatory and standards view with what is actually deployed: AI use cases, data paths, cloud contracts, security controls and the teams that own them.
Request a meetingIdentify systems, models, providers, data and use cases.
Distinguish binding requirements from proposed policy and voluntary standards.
Compare sovereignty options, assign control owners and execute the roadmap.