Summary Yes, under the proposed Cloud and AI Development Act (CADA), Member States and public-sector bodies may maintain their own national or regional open source catalogues. However, to ensure EU-wide discoverability and compliance, any software made available for reuse must be hosted in a repository connected to the central EU Open Source Solutions Catalogue (EU OSS Catalogue). Article 43(3) explicitly allows national catalogues to request formal connection to this central hub, creating a federated system where national autonomy coexists with Union-level visibility. While the physical infrastructure can remain national, the metadata and access pathways must be federated to the central portal.

Detail

The Cloud and AI Development Act (CADA), as proposed in COM(2026) 502 final, introduces a structured approach to open source within the public sector. The primary objectives are to reduce vendor lock-in, enhance security, strengthen technological sovereignty, and maximize the value of public expenditure by fostering the reuse of software developed by or for public entities. A core component of this strategy is the establishment of a centralized EU Open Source Solutions Catalogue (EU OSS Catalogue).

Crucially, CADA does not mandate the dissolution of existing national, regional, or local repositories. Instead, it proposes a federated model. This approach leverages existing national infrastructure while ensuring a unified European discovery layer, preventing the fragmentation where software is often hosted in disparate, siloed repositories that hamper searchability and cross-border reuse.

The Central Hub: The EU OSS Catalogue

Under Article 43(1), the European Commission is tasked with providing and maintaining the EU OSS Catalogue. This serves as a centralised catalogue to access software made available for reuse by Union entities and public sector bodies. The legislative intent, as outlined in the explanatory memorandum, is to solve the current issue where software is often made available in different repositories, "hampering searchability, discoverability and, ultimately, reuse."

Article 43(2) further specifies that the EU OSS Catalogue shall be hosted on the Interoperable Europe portal referred to in Article 8 of Regulation (EU) 2024/903. This ensures that the catalogue is accessible electronically free of charge and is integrated into the broader EU interoperability framework, serving as the single point of entry for public administrations seeking reusable solutions.

Connecting National Catalogues: The Mechanism of Article 43(3)

The most critical provision for Member States wishing to maintain their own infrastructure is Article 43(3). It states:

"The Commission shall, on the basis of objective and relevant criteria, decide on the request of any Union entity or public sector body owning or maintaining a catalogue or repository to have that catalogue or repository connected to and made accessible through the EU OSS Catalogue."

This provision creates a clear, rights-based pathway for national autonomy. A Member State, or a specific public sector body within it, can continue to operate its own national open source catalogue. However, to comply with CADA's broader goals of transparency and reuse, that national catalogue must request to be connected to the central EU OSS Catalogue.

The mechanism implies a federated architecture rather than a monolithic one:

  1. Objective Criteria: The Commission will evaluate connection requests based on "objective and relevant criteria." While the specific technical parameters are not detailed in the primary text, they are expected to relate to data standards, API compatibility, metadata consistency, and security protocols to ensure smooth integration with the Interoperable Europe portal.
  2. Accessibility Through: Once approved, the national catalogue becomes "made accessible through" the EU OSS Catalogue. This suggests that users searching the central EU hub will be able to find and access software hosted in the national repository. It does not necessarily require the physical migration of all software code to a single EU server, but rather the synchronization of metadata and discovery layers.
  3. Mandatory Connection for Reuse: Article 42 reinforces this federation by stating that when a Union entity or public sector body makes software available for reuse under an open-source licence, it shall do so using a catalogue or repository that is connected to the EU OSS Catalogue. Therefore, while a national catalogue can exist, it cannot remain isolated if it is to host reusable public software. An isolated national catalogue would fail to meet the requirement that software be made accessible through the EU OSS Catalogue.

Member State Autonomy and Governance

CADA respects the decentralized nature of public administration in the EU. Member States are not forced to abandon their national digital strategies or existing IT infrastructures. The proposal recognizes that national catalogues may have specific local relevance, language settings, or integration with national procurement systems.

However, the "autonomy" is conditional on interoperability. By connecting to the EU OSS Catalogue, national bodies contribute to a pan-European pool of reusable assets. This aligns with Article 41, which encourages the use of open standards and components to build cloud and AI ecosystems. The federation ensures that a solution developed in one Member State can be discovered and potentially reused by another, maximizing the value of public expenditure and reducing duplication.

The Role of Open Source Programme Offices (OSPOs)

The effective connection and management of these catalogues are supported by the network of Open Source Programme Offices (OSPOs). Article 44 establishes a network of OSPOs to facilitate cooperation on the implementation of Chapter V (Open Source) obligations. These offices, established at local, regional, or national levels, will play a key role in ensuring that national catalogues meet the necessary standards for connection to the EU OSS Catalogue.

The OSPO network will facilitate the exchange of information, experience, and best practices between Member States and the Commission, particularly regarding technical, legal, and organisational challenges such as licensing, security, and maintenance. They will also contribute to the development of guidance and templates for the sharing and reuse of open-source software, ensuring that national catalogues can effectively integrate into the EU-wide ecosystem.

What this means for you

For public-sector procurement officers, IT managers, and national digital strategists, this framework offers both flexibility and a clear compliance roadmap.

  • You can keep your national catalogue: If your Member State or agency has invested in a national open source repository, you do not need to scrap it. You can continue to use it as your primary management tool for local governance and administration.
  • You must connect to the EU hub: To remain compliant with CADA, your national catalogue must be connected to the EU OSS Catalogue. You should prepare a request to the Commission under Article 43(3) to establish this connection. Ensure your catalogue meets the "objective and relevant criteria" likely to be defined in secondary legislation or technical guidelines.
  • Focus on metadata and standards: The success of the federation relies on high-quality metadata. Ensure that software listings in your national catalogue include standardized information on licensing, functionality, security assessments, and interoperability. This will make your assets discoverable across the EU.
  • Leverage the OSPO Network: Engage with your national or regional OSPO (as established under Article 44). They will be the primary point of contact for technical guidance on connecting your repository and for sharing best practices on open source governance.
  • Procurement Implications: When procuring software, consider solutions that are listed in the EU OSS Catalogue (including those federated from national catalogues). This aligns with the "open source first" principle encouraged in Article 41, which urges the use of open standards and components based on objective criteria such as security and total cost.

Common misconceptions

"We must migrate all code to a central EU server."

  • Reality: CADA proposes a federated model. Article 43(3) allows national catalogues to be "connected to and made accessible through" the EU OSS Catalogue. This typically means metadata synchronization and search federation, not necessarily the physical relocation of all software binaries to a single Commission-hosted server. The code can remain where it is; the discovery is centralized.

"National catalogues are optional and can remain isolated."

  • Reality: While maintaining a national catalogue is permitted, operating it in isolation is not compliant for reusable software. Article 42 mandates that software made available for reuse must be in a catalogue connected to the EU OSS Catalogue. An isolated national catalogue would fail to provide the required EU-wide discoverability and would not satisfy the legal requirement for public sector reuse.

"The Commission will force a specific technical platform on us."

  • Reality: The Commission will decide on connection requests based on "objective and relevant criteria." While technical interoperability is required, the proposal respects the existence of diverse national infrastructures. The focus is on the connection and accessibility, not on mandating a single underlying software platform for every Member State.

Related

This is general information about a draft EU regulation, not legal advice.