EU Advances AI Act Oversight Bodies and Tech Sovereignty Package Toward Implementation

Following months of delay, the European Commission finalized membership of the AI Act's Advisory Forum (172 members) and Scientific Panel (60 independent experts) this month and published the final Code of Practice on marking and labelling AI-generated content, with OpenAI the first major provider to commit to signing it; in parallel, the Commission's Tech Sovereignty Package — including the Cloud and AI Development Act (CADA), Chips Act 2.0, and an EU Open Source Strategy — continues moving through the European Parliament and Council, with CADA proposing four sovereignty assurance levels and requirements that sensitive public-sector data be hosted on EU-controlled infrastructure. Regulatory and technology counsel should treat the convergence of AI Act enforcement infrastructure and CADA's data-localization requirements as a compounding compliance burden for global cloud and AI providers serving EU public-sector clients, since CADA's procurement rules could functionally exclude non-EU-controlled vendors from government contracts regardless of AI Act compliance status. The timing is notable: Ireland assumed the Council of the EU presidency on July 1, inheriting responsibility for shepherding both files through trilogue negotiations, and MEPs have already voiced concern that the package's aims are undercut by continued reliance on the now-contested EU-US Data Privacy Framework. Clients with EU cloud, AI, or public-sector exposure should begin sovereignty risk assessments now, given CADA's 18-24 month path to adoption is likely to compress once political momentum builds.