Technical

Cloud Service

On-demand computing services (IaaS, PaaS, SaaS).

How the laws define this

Both frameworks establish that a cloud service fundamentally centers on providing on-demand computing capabilities or resources, explicitly including Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS). However, the texts diverge in their specific descriptive criteria and operational focus. Regulation (EU) 2026/XXXX of the European Parliament and of the Council on harmonised rules for Cloud and Artificial Intelligence Development (Cloud and AI Development Act) explicitly characterizes these as digital services providing remote access to scalable and shareable computing resources, noting that this definition is crucial for applying the Act's sovereignty framework to a wide array of offerings. In contrast, the Cloud Computing Regulatory Framework (CCRF) — Version 3 (Communication and Information Technology Commission) defines the term as any service delivering on-demand computing capabilities over a network as defined by its framework, without incorporating explicit requirements regarding resource scalability, shareability, or an overarching regulatory sovereignty framework.

Synthesised from the 2 statutory definitions below. Each one is quoted in full, with its source.

How jurisdictions differ

What is distinctive in each definition, binding law in force first.

Jurisdiction	Instrument	Status	What is distinctive
European Union	Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL establishing a framework of measures for strengthening Europe's cloud and AI ecosystem (Cloud and AI Development Act)	Proposed	Adds that cloud services are crucial for applying the Act's sovereignty framework to a wide array of offerings.
Saudi Arabia	Cloud Computing Regulatory Framework (CCRF) — Version 3	Superseded	Explicitly limits the term to services as defined by the framework itself.

Definitions (2)

Any service that provides on‑demand computing capabilities delivered over a network and explicitly includes Infrastructure as a Service (IaaS), Platform as a Service (PaaS) and Software as a Service (SaaS) as defined by the framework.

Cloud Computing Regulatory Framework (CCRF) — Version 3 (Communication and Information Technology Commission)Definition 1 of 2

Encompasses digital services that provide on-demand remote access to scalable and shareable computing resources, including infrastructure as a service (IaaS), platform as a service (PaaS), and software as a service (SaaS), crucial for applying the Act's sovereignty framework to a wide array of offerings.

Regulation (EU) 2026/XXXX of the European Parliament and of the Council on harmonised rules for Cloud and Artificial Intelligence Development (Cloud and AI Development Act)Definition 2 of 2

Not to be confused with

public cloud

Public cloud refers specifically to cloud services provided to multiple tenants by external providers, while cloud service encompasses all IaaS, PaaS, and SaaS.

Cloud Service Provider (CSP)

Cloud Service Provider is the entity that provides cloud services and may control infrastructure, whereas cloud service is the service itself.

Questions and answers

What makes the EU definition of cloud service distinctive?

The EU definition emphasizes that cloud services are crucial for applying the Act's sovereignty framework to a wide array of offerings. It encompasses IaaS, PaaS, and SaaS under this context.

How does the Saudi CCRF define cloud service?

The Saudi CCRF defines it as any service providing on-demand computing capabilities over a network, explicitly including IaaS, PaaS, and SaaS as defined by the framework.

Are there duties triggered by these cloud service definitions?

No specific duties, prohibitions, exemptions, or classifications are stated in the provided definitions or instrument notes.