The planned Cloud and AI Development Act shifts compliance requirements from data residency to demonstrable European control over operations, ownership, and supply chain—yet uncontrolled workarounds dominate in practice.