Are CADA evaluation reports made public? Transparency under Article 47

Summary Yes, under the proposed Cloud and AI Development Act (CADA), the European Commission's evaluation reports would be made public. Article 47 of the proposal mandates that the Commission evaluate the regulation and submit a report to the European Parliament, the Council, and the European Economic and Social Committee. Crucially, the explanatory memorandum explicitly states: "These reports will be public and detail the effective application and enforcement of the proposed Regulation." This transparency mechanism ensures that the functioning of the EU's cloud sovereignty framework is subject to democratic scrutiny and provides stakeholders with clear insights into compliance, enforcement trends, and market impact.

Detail

The proposed Cloud and AI Development Act (CADA), COM(2026) 502 final, establishes a comprehensive governance framework to strengthen Europe's cloud and AI ecosystem. A cornerstone of this framework is the requirement for ongoing monitoring and evaluation to ensure the regulation achieves its objectives of increasing computing capacity, reducing third-country dependencies, and safeguarding public order. Article 47 serves as the legal anchor for this transparency, transforming what could have been an internal administrative exercise into a public record of the regulation's performance.

The Legal Obligation: Article 47

Article 47(1) of the proposal sets out the specific timing and recipients of the evaluation. It stipulates:

"By [date of entry into force plus 4 years], and every 5 years thereafter, the Commission shall evaluate this Regulation, and report to the European Parliament, the Council and the European Economic and Social Committee."

This provision creates a binding obligation for the Commission to assess the regulation's effectiveness at regular intervals. The first evaluation is scheduled for four years after the regulation enters into force, allowing sufficient time for the initial implementation of key measures—such as the designation of data centre acceleration zones, the recognition of Union assurance levels, and the establishment of the EuroCloud Federation—to take effect. Subsequent evaluations would occur every five years, ensuring continuous oversight throughout the lifecycle of the regulation.

The Transparency Mandate: Explanatory Memorandum

While Article 47 establishes the when and to whom, the explanatory memorandum clarifies the nature and accessibility of these reports. In the section titled "Implementation plans and monitoring, evaluation and reporting arrangements," the Commission states unequivocally:

"These reports will be public and detail the effective application and enforcement of the proposed Regulation."

This statement is critical. It confirms that the evaluation is not a confidential internal document but a public instrument. The phrase "effective application and enforcement" suggests that the reports would go beyond high-level summaries to include granular data on how Member States are implementing the sovereignty framework, how national competent authorities are exercising their powers, and whether cloud providers are meeting the Union assurance level criteria.

Recipients and Democratic Accountability

The reports are addressed to three key EU institutions:

The European Parliament: As the directly elected body representing EU citizens, the Parliament receives the report to exercise its democratic oversight function. This allows MEPs to question the Commission on implementation gaps, enforcement inconsistencies, or the need for legislative amendments.
The Council: Representing the Member States, the Council receives the report to assess how national authorities are applying the regulation and to coordinate policy responses across the Union.
The European Economic and Social Committee (EESC): This body represents organized civil society, including employers, workers, and other interest groups. Its inclusion ensures that the perspectives of the broader economic and social stakeholders are considered in the evaluation process.

By mandating reporting to these specific bodies, Article 47 embeds the evaluation within the EU's institutional architecture, ensuring that the findings are scrutinized by the bodies responsible for legislation, policy coordination, and civil society representation.

Content and Potential Amendments

Although Article 47(1) does not provide an exhaustive checklist of the report's contents, the requirement to detail "effective application and enforcement" implies a broad scope. Based on the structure of CADA, the reports would likely cover:

Market Dynamics: Data on the growth of EU cloud capacity, the market share of European providers, and the reduction of dependencies on third-country providers.
Sovereignty Framework Performance: Statistics on the number of cloud services recognized at Union assurance levels 1 through 4, and the uptake of these services by public sector bodies.
Enforcement and Penalties: Information on the penalties imposed by Member States under Article 24, including the nature of infringements and the effectiveness of the penalty regimes.
Data Centre Deployment: Progress on the designation of acceleration zones and the permitting timelines for strategic projects.

Furthermore, Article 47(2) adds a dynamic element to the reporting process:

"Where appropriate, the report referred to in paragraph 1 shall be accompanied by a proposal for amendment of this Regulation."

This provision ensures that the evaluation is not merely retrospective but forward-looking. If the Commission identifies that the regulation is not achieving its objectives, or if market conditions have shifted, it can propose legislative changes directly alongside the public report. This creates a feedback loop where public transparency drives legislative evolution.

The Rationale for Public Transparency

The decision to make these reports public is rooted in the broader EU principles of open governance and the specific policy goals of CADA. The explanatory memorandum notes that the proposal aims to create a "transparent, non-discriminatory blueprint for digital autonomy." Public reporting serves several strategic purposes:

Accountability: It holds Member States and the Commission accountable for the effective implementation of the sovereignty framework. By publishing enforcement data, the EU can highlight disparities in implementation and pressure lagging jurisdictions to align with Union standards.
Market Confidence: Investors, cloud providers, and public sector buyers need certainty. Transparent reporting on the progress of the EU's cloud ecosystem helps stakeholders make informed decisions about investment and procurement.
Democratic Scrutiny: As CADA touches on sensitive issues of public order, data sovereignty, and strategic autonomy, public access to evaluation reports ensures that these decisions remain subject to democratic debate and oversight.

What this means for you

For stakeholders ranging from public procurement officers to cloud service providers and civil society organizations, the public nature of CADA evaluation reports offers significant practical value:

Benchmarking and Strategy: Public procurement bodies can use the reports to benchmark their own compliance against EU-wide trends. If the reports reveal that many Member States are struggling with specific Union assurance level criteria, organizations can anticipate potential delays or adjust their procurement strategies accordingly.
Anticipating Legislative Change: Since Article 47(2) allows the Commission to propose amendments based on the review, monitoring these reports is essential for staying ahead of regulatory shifts. For instance, if a report highlights that the criteria for Level 3 assurance are too burdensome for certain sectors, stakeholders can prepare for potential amendments that might relax or refine these requirements.
Enforcement Intelligence: The reports will detail enforcement actions and penalties. By reviewing these, cloud providers can understand how national competent authorities are interpreting the rules, while public buyers can assess the compliance history of potential vendors.
Advocacy and Engagement: As the reports are public, they provide a factual basis for advocacy. If an organization faces specific challenges in implementing CADA, it can use the data in the public reports to advocate for clarifications, support, or legislative changes during subsequent consultations.

Common misconceptions

Misconception 1: The reports are internal administrative documents. Some may assume that regulatory evaluations are confidential internal memos. However, the explanatory memorandum explicitly states that the reports "will be public." This is a deliberate design choice to ensure transparency and accountability, not secrecy.

Misconception 2: The reports provide binding legal advice. While the reports detail the "effective application" of the regulation, they are general assessments of the regulation's functioning. They do not provide binding legal interpretations for specific procurement cases or individual disputes. Stakeholders should still rely on national competent authority guidance and legal counsel for case-specific advice.

Misconception 3: The reports are published annually. Article 47 sets a specific, less frequent schedule: the first review is four years after entry into force, followed by reviews every five years. Stakeholders should not expect annual comprehensive reports, although the Commission may publish other interim updates or guidance in the meantime.

Misconception 4: The reports only cover the public sector. While the public sector is a primary focus due to the procurement obligations in Article 30, CADA regulates the broader cloud and AI ecosystem. The reports will likely include data on the overall market, including private sector adoption of sovereign cloud services and the deployment of data centres, as these factors directly influence the public sector's ability to procure compliant services.

This is general information about a draft EU regulation, not legal advice.