Summary Yes, under the proposed Cloud and AI Development Act (CADA), a public body may rely on one or more of the derogation grounds listed in Article 30(4) simultaneously to justify not procuring a cloud service with a required Union assurance level. The regulation explicitly permits this where "one or more of the following circumstances applies." However, this flexibility does not lower the evidentiary bar: each ground invoked must be independently and duly justified. A public body cannot use the combination of grounds to bypass sovereignty requirements without robust, documented evidence for every specific circumstance cited. If one ground fails to meet the strict criteria, the derogation remains valid only if the remaining grounds are fully substantiated.

Detail

The proposed Cloud and AI Development Act (CADA) establishes a mandatory framework for public procurement of cloud computing services to safeguard the Union's public order and strategic autonomy. Under Article 30(2) and 30(3), contracting authorities are generally required to procure only cloud services recognised at Union assurance level 1 (for general activities) or levels 2, 3, or 4 (for activities contributing to public order).

However, Article 30(4) provides a narrow, exceptional derogation from these mandatory rules. The provision states that contracting authorities may decide not to procure recognised services "on an exceptional basis and where duly justified" where "one or more of the following circumstances applies."

The Legal Mechanics of Combining Grounds

The phrasing "one or more" in Article 30(4) is legally significant. It confirms that the grounds are not mutually exclusive. A contracting authority facing a complex procurement scenario may legitimately invoke multiple grounds simultaneously. For example, a public body might face a situation where:

  1. The specific subject matter cannot be supplied by recognised services in the central repository (Ground (a)); AND
  2. A similar procurement launched within the previous year failed to attract suitable tenders (Ground (b)); AND
  3. Adapting the requirements to find a sovereign solution would incur disproportionate costs (Ground (c)).

In such a scenario, the authority may cite all three grounds to strengthen its position. However, the regulation does not allow for a "weakest link" approach where the combination itself justifies the exception. Instead, each ground must stand on its own merits. The phrase "where duly justified" applies to the decision as a whole, but the justification must be granular. If an authority cites Ground (a) and Ground (c), it must provide distinct evidence streams proving both the unavailability of services and the disproportionality of cost.

The Three Grounds and Their Specific Evidentiary Burdens

To successfully combine grounds, a public body must satisfy the specific criteria for each sub-paragraph of Article 30(4):

Ground (a): Unavailability and Artificial Narrowing This ground applies if "the subject matter of the tender cannot be supplied by recognised cloud computing services available in the central repository referred to in Article 22."

  • The "No Alternative" Test: The authority must further demonstrate that "no adequate or reasonable alternative or comparable cloud computing service exists."
  • The Anti-Artificial Narrowing Rule: Crucially, the absence of recognised services must "not be the result of an artificial narrowing down of the parameters of the public procurement procedure." If a public body combines this with other grounds, it must prove that its technical specifications were drafted broadly enough to allow any recognised sovereign provider to bid. If the specifications were tailored to exclude sovereign providers, Ground (a) collapses, potentially invalidating the entire derogation.

Ground (b): Prior Procurement Failure This ground applies if "the contracting authority has launched a similar procurement process within the previous year but did not receive any suitable tenders or suitable participants."

  • The 12-Month Window: The failure must have occurred within the "previous year." A procurement failed 13 months ago does not qualify.
  • Consistency of Failure: If combined with Ground (a), the authority must show that the market failure is consistent. The previous failure must demonstrate that the market genuinely lacks the capacity to supply the required service, rather than a temporary or procedural issue.

Ground (c): Disproportionate Cost This ground applies if "applying the requirements of this Regulation would require the contracting authority to procure services at disproportionate cost."

  • High Threshold: "Disproportionate" is a strict legal standard. It does not mean the sovereign option is merely more expensive. The authority must demonstrate that the cost difference is excessive relative to the contract value and the public interest.
  • Interaction with Other Grounds: If combined with Ground (a), the authority must argue that not only is the service unavailable, but the cost of adapting the project or finding a workaround is disproportionately high. This requires a detailed cost-benefit analysis.

The Overarching Requirement: "Duly Justified"

The phrase "where duly justified" in Article 30(4) acts as the overarching constraint. Combining grounds does not create a "free pass." The justification must be recorded in the procurement file and must clearly link the evidence to each specific sub-paragraph.

Under Article 24, Member States must lay down rules on penalties for infringements of the sovereignty chapter. These penalties must be "effective, proportionate and dissuasive." A derogation based on a weak combination of grounds is vulnerable to challenge by national competent authorities or the Commission. If a public body fails to justify even one of the cited grounds, the derogation may be deemed invalid for that specific ground, though it might remain valid if the remaining grounds are robust. However, relying on a failed ground increases the risk of the entire decision being overturned.

What this means for you

For in-house counsel, procurement officers, and compliance teams, the ability to combine derogation grounds offers necessary flexibility but significantly increases documentation complexity and audit risk.

  1. Document Each Ground Separately: Do not treat the derogation as a single, blanket justification. If you cite Grounds (a) and (c), your procurement file must contain distinct evidence streams for each. For Ground (a), retain records of market consultations, searches of the central repository (Article 22), and proof that specifications were not artificially narrowed. For Ground (c), retain detailed cost comparisons, market analysis, and a formal cost-benefit analysis demonstrating disproportionality.
  2. Avoid Artificial Narrowing: When combining Ground (a) with others, ensure your technical specifications were broad enough to allow any recognised sovereign provider to bid. If you narrow parameters to exclude sovereign providers, you invalidate Ground (a), which could collapse your entire derogation argument even if Ground (c) is strong.
  3. Verify the Timeline for Ground (b): If using Ground (b), verify strictly that the "similar procurement process" occurred within the last 12 months. If it was 13 months ago, this ground is unavailable. You must rely solely on the remaining grounds, and your justification must reflect this.
  4. Prepare for Scrutiny: National competent authorities will scrutinise derogations. A combined justification is more vulnerable to challenge if any single component is weak. Ensure your "due justification" narrative clearly links the evidence to each specific sub-paragraph of Article 30(4). The narrative should explain why each circumstance applies independently.

Common misconceptions

"Combining grounds makes the justification easier." In reality, combining grounds makes it harder. You must satisfy the evidentiary threshold for each ground you invoke. If one ground is found to be unjustified, the derogation may still stand if the other ground is robust, but the overall risk of non-compliance increases because you have made more factual claims that must be proven. The "one or more" phrasing allows for cumulative arguments, not cumulative leniency.

"Disproportionate cost" means the sovereign option is simply more expensive. No. Ground (c) requires the cost to be disproportionate. A higher price for a sovereign service is not automatically disproportionate. The public body must demonstrate that the cost difference is excessive relative to the contract value and the public interest in sovereignty. Mere budget constraints are insufficient.

"The derogation applies to private sector entities." No. Article 30 applies to "contracting authorities" (public sector). Private sector entities operating in sectors of high criticality (listed in Annex I to the NIS2 Directive) are subject to Article 31, which allows them to carry out similar impact assessments but does not grant the same derogation from procurement rules, as they are not bound by public procurement directives in the same way.

"If I have two grounds, I only need to prove one." Incorrect. While the regulation allows you to rely on "one or more," if you invoke multiple grounds in your decision, you must justify all of them. If you state that both unavailability and cost are reasons, you must prove both. If you only prove one, you should have cited only that one.

Related

This is general information about a draft EU regulation, not legal advice.