Summary Yes, as proposed under the Cloud and AI Development Act (CADA), the European Commission possesses the authority to overrule a national competent authority in a recognition dispute regarding Union assurance levels. If an evaluating Member State intends to maintain a draft recognition decision despite a reasoned objection from another Member State, the objecting authority may refer the matter to the Commission. Under Article 17(10), the Commission would then adopt a binding decision determining whether the evaluating authority may proceed with the recognition. This mechanism prevents national fragmentation and ensures the uniform application of the sovereignty framework across the Union.

Detail

The proposed Cloud and AI Development Act (CADA) establishes a harmonised "Union cloud computing sovereignty framework" designed to mitigate strategic dependencies and ensure operational autonomy. A cornerstone of this framework is the recognition of cloud computing services at one of four "Union assurance levels" (1 through 4). This recognition is a prerequisite for public sector bodies and Union entities to procure these services for activities contributing to public order.

While the primary assessment of applications is conducted at the national level, the proposal includes a robust dispute-resolution mechanism to handle cross-border disagreements. This ensures that a single Member State cannot unilaterally block a compliant service, nor can an evaluating authority ignore legitimate sovereignty concerns raised by peers without EU-level oversight.

The Recognition and Objection Mechanism

The process is anchored in Article 17 of the proposal. A cloud computing service provider submits an application for recognition to the national competent authority of its establishment, which acts as the "evaluating national competent authority."

The procedure follows a structured timeline:

  1. Initial Assessment: Within 60 days of accepting an application, the evaluating authority assesses the evidence. If sufficient, it prepares a draft recognition decision (Article 17(5)(a)).
  2. Notification and Review: The evaluating authority notifies all other Member States' competent authorities of its intended recognition. This triggers a 60-day review period (Article 17(5)(a)).
  3. Reasoned Objection: During this period, any other Member State may submit a reasoned objection if it believes the draft decision does not comply with the Union assurance level criteria set out in Annex II (Article 17(6)).

Escalation to the Commission: The Binding Decision

If an objection is raised, the evaluating authority must assess it and decide whether to maintain or revoke its draft decision (Article 17(9)). The critical escalation point occurs if the evaluating authority intends to maintain its draft decision despite the objection.

In this scenario, Article 17(10) provides the legal basis for Commission intervention:

"In case the evaluating national competent authority intends to maintain its draft decision, the concerned national competent authority may refer the matter to the Commission. The Commission shall assess the referral and may request information from the national competent authorities concerned. The Commission shall adopt a binding decision determining whether the evaluating national competent authority may adopt the recognition decision."

This provision grants the Commission the final say. The decision is not advisory; it is legally binding on the national authorities involved. If the Commission determines that the draft decision complies with the regulation, the evaluating authority may proceed, and the service is recognised Union-wide. Conversely, if the Commission finds non-compliance, the recognition is blocked.

Commission Information Powers

To ensure its binding decision is based on a complete factual record, the Commission is granted specific investigative powers. Article 17(13) states:

"The Commission may, in order to carry out the tasks assigned to it under paragraph 10, require that national competent authorities of establishment provide, as soon as possible and within a reasonable period, any relevant information relating to the concerned cloud computing service provider and the application for recognition."

Furthermore, Article 17(14) mandates procedural transparency in these requests:

"When sending a request for information, the Commission shall state the purpose of the request, specify what information is required and set the period within which the information is to be provided."

These powers ensure that the Commission can gather necessary evidence from national authorities to resolve the dispute effectively, without needing to bypass national sovereignty entirely but rather by compelling cooperation within the EU legal framework.

The Role of the Evaluating Authority

It is important to note that the Commission does not automatically review every application. Its intervention is conditional. The evaluating authority retains the primary responsibility for the assessment. The Commission only steps in when a deadlock occurs: specifically, when an objection is raised, the evaluating authority refuses to withdraw its draft, and the objecting authority exercises its right to refer the matter. This design preserves the "one-stop-shop" principle for the majority of cases while reserving EU-level arbitration for genuine conflicts.

What this means for you

For legal counsel, compliance officers, and public procurement teams, understanding this escalation path is critical for risk management and timeline planning.

1. Anticipate Cross-Border Scrutiny

When applying for Union assurance levels 2, 3, or 4, providers must assume that their application will be scrutinized by competent authorities across the EU, not just the home authority. A reasoned objection from a single Member State can trigger a Commission referral, potentially delaying recognition. Providers should ensure their audit reports and evidence packages are meticulously aligned with Annex II criteria to withstand cross-border challenges.

2. The "Binding" Nature of the Outcome

Unlike many EU consultation processes where opinions are non-binding, the outcome of an Article 17(10) referral is definitive. Once the Commission adopts its decision, national authorities must comply. This centralizes legal certainty but also means that a dispute can result in a Union-wide blockage of a service if the Commission sides with the objecting authority.

3. Strategic Implications for Public Procurement

Public sector bodies relying on specific cloud providers for public-order-relevant activities must monitor the status of recognition disputes. If a provider is involved in an Article 17(10) dispute, the procurement timeline may be extended indefinitely until the Commission issues its binding decision. Procurement strategies should include contingency plans for such regulatory delays.

4. Information Requests and Cooperation

Providers should be aware that while they do not directly petition the Commission under Article 17, the Commission can demand information from national authorities regarding their application. This may lead to additional requests for documentation or clarification from the evaluating authority, which the provider must be prepared to satisfy promptly to avoid further delays.

5. No Direct Provider Appeal

It is crucial to note that the right to refer a dispute to the Commission lies with the "concerned national competent authority" (the objector), not the cloud service provider itself. Providers cannot directly trigger the Commission's binding decision mechanism; they must rely on the objecting authority to exercise this right or on the evaluating authority to voluntarily withdraw the draft.

Common misconceptions

Misconception 1: The Commission reviews all CADA recognition applications. Correction: No. The Commission intervenes only in specific dispute scenarios under Article 17(10). This occurs exclusively when an evaluating authority intends to maintain a draft decision despite a reasoned objection from another Member State, and that objecting authority refers the matter. Most recognitions are resolved at the national level or through mutual acceptance if no objections are raised.

Misconception 2: A Member State's objection automatically blocks recognition. Correction: An objection does not automatically block recognition. The evaluating authority first assesses the objection and may decide to maintain its draft. Recognition is only blocked if the objecting authority refers the matter to the Commission, and the Commission subsequently adopts a binding decision against the draft.

Misconception 3: The Commission's decision is merely advisory. Correction: Article 17(10) explicitly states the Commission shall adopt a binding decision. National competent authorities are legally required to follow the Commission's determination on whether the recognition decision may be adopted.

Misconception 4: Providers can directly appeal to the Commission to resolve disputes. Correction: The referral mechanism in Article 17(10) is strictly between national competent authorities ("the concerned national competent authority may refer the matter to the Commission"). Providers do not have a direct right of referral under this article; they must rely on national authorities to escalate the dispute.

Related

This is general information about a draft EU regulation, not legal advice.