Summary Under the proposed Cloud and AI Development Act (CADA), a public buyer may cite "disproportionate cost" to skip a required Union assurance level, but only as an exceptional and duly justified derogation. Article 30(4)(c) permits this exemption if applying the regulation's assurance level requirements would require procuring services at a disproportionate cost. This is not a blanket waiver for budget constraints; it requires a rigorous, documented cost analysis proving that the cost gap is genuine, significant, and not the result of artificial tender design.

Detail

The proposed Cloud and AI Development Act (CADA) establishes a rigorous framework for public procurement of cloud computing services, designed to safeguard the Union's public order and reduce strategic dependencies. The core procurement obligation is tiered based on risk. Article 30(2) mandates that public sector bodies whose activities are not identified as contributing to public order must procure services recognized at Union assurance level 1. Conversely, Article 30(3) requires that for activities identified as contributing to public order (e.g., national security, defense, law enforcement), contracting authorities must procure services recognized at Union assurance level 2, 3, or 4.

However, the proposal acknowledges that market maturity and specific procurement contexts may occasionally render strict compliance unfeasible. Article 30(4) provides a derogation mechanism, allowing contracting authorities to decide not to procure services recognized at the required Union assurance level. This derogation is strictly conditional: it applies on an "exceptional basis and where duly justified."

The Disproportionate Cost Derogation (Article 30(4)(c))

Among the three specific circumstances listed in Article 30(4), point (c) addresses cost. It states that a derogation may be granted where:

"applying the requirements of this Regulation would require the contracting authority to procure services at disproportionate cost."

This provision is a safety valve for situations where the market for sovereign cloud services is not yet competitive enough to offer reasonable pricing for specific, often niche, requirements. It recognizes that for smaller authorities or highly specialized use cases, the price premium for a compliant service might be so high relative to the contract value or the authority's budget that it becomes economically unviable.

However, the text is precise. The cost must be "disproportionate," not merely "higher" or "less competitive." A modest premium for sovereignty is an expected cost of the policy and does not trigger this derogation. The cost must be excessive to the point where it fundamentally distorts the procurement or exceeds the authority's financial capacity in an unreasonable way.

Strict Conditions for Application

To successfully invoke Article 30(4)(c), a public buyer must satisfy a cumulative set of conditions. The derogation is not automatic; it is a high-bar exception.

  1. Exceptional Basis: The situation must be an anomaly, not the norm. The authority cannot use this clause as a routine strategy to bypass sovereignty requirements. It applies only to specific procurement procedures where unique market conditions or technical constraints create an unavoidable cost disparity.
  2. Duly Justified: The authority bears the burden of proof. The decision must be supported by a robust, transparent justification. This implies a documented analysis that explains why the cost is disproportionate.
  3. No Artificial Narrowing (Cross-Reference): While Article 30(4)(a) deals with the absence of supply, the principle of avoiding artificial constraints applies to cost as well. The authority cannot design the tender specifications in a way that artificially excludes sovereign providers to create a false impression of high cost. The disproportionate cost must stem from genuine market realities, not from poorly drafted procurement documents that limit competition.

The Requirement to Document the Cost Analysis

Although Article 30 does not prescribe a specific template for the cost analysis, the requirement that the derogation be "duly justified" creates a mandatory obligation to document the decision-making process. Public buyers must retain evidence that demonstrates:

  • Market Consultation: Evidence that the authority actively sought recognized sovereign services (e.g., quotes, tender responses, market engagement records).
  • Comparative Analysis: A clear comparison between the cost of the required Union assurance level services and the cost of non-compliant alternatives.
  • Proportionality Assessment: An explanation of why the cost difference is "disproportionate." This might involve comparing the cost gap to the total contract value, the authority's annual IT budget, or the specific risk profile of the activity.
  • Exclusion of Alternatives: A demonstration that other derogation grounds (such as lack of supply under 4(a)) do not apply, or that the cost issue is distinct and primary.

This documentation is critical. Under Article 26, national competent authorities have investigative powers, including the power to require information and inspect premises. Under Article 23, providers must report material changes, and the framework relies on transparency. A failure to document the justification for a derogation could be viewed as a failure to comply with the "duly justified" condition, potentially rendering the procurement non-compliant.

What this means for you

For public-sector procurement officers and legal counsel, the Article 30(4)(c) derogation is a last resort, not a planning tool. Here is how to navigate it:

  • Conduct a Rigorous Pre-Market Analysis: Before considering a derogation, you must prove you have actively sought compliant solutions. Document all market consultations. If the cost difference is marginal, the derogation will likely fail the "duly justified" test. The term "disproportionate" implies a significant imbalance, not a simple preference for lower prices.
  • Avoid "Artificial" Cost Inflation: Ensure your technical specifications are broad and functional. If you narrow the scope of the tender so that only one expensive, non-sovereign provider can bid, you risk violating the spirit of the regulation. The high cost must be a result of genuine market immaturity or specific technical constraints, not poor procurement design.
  • Prepare for Scrutiny: National competent authorities will monitor compliance. Be prepared to present your cost analysis and justification. Your reasoning must clearly link the cost disparity to the specific procurement context and demonstrate that no other derogation applies.
  • Leverage Aggregation: If disproportionate cost is a recurring issue, consider whether joint procurement or aggregation with other public bodies (facilitated by the EuroCloud Federation under Article 34 or common procurement frameworks under Articles 37–40) could leverage economies of scale. This might reduce the unit cost of sovereign services, removing the need for a derogation entirely.
  • Document Everything: Create a dedicated file for the derogation decision. Include the cost analysis, market feedback, and the specific reasoning for why the cost is disproportionate. This record is your primary defense against future audits.

Common misconceptions

"Disproportionate cost means any price difference." Incorrect. The derogation is for exceptional cases. A modest price premium for sovereign services is expected and is part of the investment in EU technological sovereignty. The cost must be disproportionately high relative to the contract value or the authority's budget to justify skipping the sovereignty tier.

"I can use this derogation if I can't find a sovereign provider." No. If no recognized sovereign services are available, you should look to Article 30(4)(a), which addresses the absence of supply. Article 30(4)(c) specifically addresses cost. Using (4)(c) when the real issue is lack of supply may be considered an improper justification and could be challenged.

"The derogation is permanent." Incorrect. The derogation applies to a specific procurement procedure. It does not waive the requirement for future procurements. Each time you procure cloud services, you must reassess whether the derogation is still necessary and justified. Market conditions may change, making sovereign services more competitive over time.

"I don't need to document this if it's an internal decision." Given the regulatory focus on transparency and the potential for audits by national competent authorities (Article 26), failing to document the justification for a derogation is a significant compliance risk. The "duly justified" requirement implies a recordable rationale that can be reviewed.

Related

This is general information about a draft EU regulation, not legal advice.