Summary No, the proposed Cloud and AI Development Act (CADA) does not require public bodies to make third-party licensed software available for reuse. As proposed in Article 42, the obligation to publish software in the EU Open Source Solutions Catalogue is strictly conditional: it applies only to software "to which [the Union entity or public sector body] hold[s] intellectual property rights." If a public body merely licenses software from a vendor, the IP ownership remains with the vendor, placing the software outside the scope of CADA's reuse mandate. While CADA encourages open-source adoption generally, it does not override commercial license terms or compel the release of proprietary code owned by third parties.

Detail

The proposed Cloud and AI Development Act (CADA), COM(2026) 502 final, establishes a comprehensive framework to strengthen Europe's cloud and AI ecosystem. A key component of this framework is the promotion of open-source software (OSS) to reduce vendor lock-in, foster innovation, and enhance technological sovereignty. However, the specific obligation to share and reuse software is narrowly tailored to respect existing intellectual property (IP) regimes.

The Text and Trigger of Article 42

Article 42, titled "Share and reuse of software," sets the precise boundary for the reuse obligation. The provision states:

"When making software to which they hold intellectual property rights available for reuse under an open source licence, a Union entity or public sector body shall do so using a catalogue or repository that is connected to, and made accessible through, the EU OSS Catalogue referred to in Article 43."

This text establishes a two-part trigger for compliance:

  1. The Decision to Release: The public body must voluntarily decide to make the software available for reuse under an open-source licence. CADA does not mandate that all software must be open-sourced; it only regulates the method of release if that decision is made.
  2. The IP Ownership Condition: The software must be one "to which they hold intellectual property rights."

This second condition is the critical filter. It explicitly excludes software where the public body is merely a licensee. In a standard commercial licensing arrangement, the vendor retains the copyright and IP rights, while the public body acquires a limited right to use the software. Since the public body does not "hold" the IP rights in this scenario, the obligation under Article 42 never activates.

The IP Ownership Boundary: Licensed vs. Owned

For legal counsel and compliance officers, distinguishing between "owned" and "licensed" software is the primary compliance task under Article 42.

1. Third-Party Licensed Software (Exempt) When a public authority procures commercial off-the-shelf (COTS) software, enterprise resource planning (ERP) systems, or proprietary AI models via a license agreement, the IP rights remain with the vendor.

  • No Obligation to Release: Article 42 does not apply. The public body cannot legally publish the source code or make it available for reuse under an open-source licence without the vendor's consent, as doing so would constitute copyright infringement.
  • No Override of License Terms: CADA is a proposal for a Regulation but does not contain provisions that override existing copyright law or invalidate commercial license agreements. The "IP ownership boundary" ensures that CADA respects the proprietary nature of third-party software.
  • Scope of "Software": While CADA defines "software" broadly in Article 2(13) (referencing Regulation (EU) 2024/2847), the obligation in Article 42 is limited by the ownership clause. Therefore, the definition of software is irrelevant if the entity does not hold the rights to it.

2. In-House or Commissioned Development (In Scope) The obligation targets software developed by the public sector or commissioned by it where the contract stipulates that the public entity retains the IP.

  • Commissioned Projects: If a public body commissions a software development project and the contract assigns the resulting IP rights to the public body, that software falls within the scope of Article 42.
  • The "When" Condition: Even for owned software, the obligation is not automatic. It applies "When making software... available for reuse." If the public body decides to keep the software proprietary (e.g., for security, competitive advantage, or lack of resources to maintain an open-source project), Article 42 imposes no penalty. However, if the body chooses to open-source it, it must use the EU OSS Catalogue.

Interaction with Article 41 and Procurement

While Article 42 does not force the release of licensed software, it operates within a broader ecosystem of open-source promotion in CADA.

Article 41: Promoting Open Source Article 41 states that the Union and Member States shall "encourage Union entities and public sector bodies to use and facilitate the reuse of open standards and components released under an open source licence."

  • This is a general encouragement to prioritize open-source solutions when building new systems.
  • It does not create a retroactive obligation to open-source existing licensed software.
  • It supports the strategic goal of reducing dependency on proprietary vendors but stops short of mandating the release of code the public body does not own.

Article 32: Union Added Value in Procurement Article 32 requires contracting authorities to include "Union added value" criteria in public procurement for cloud and AI systems. This includes evaluating whether a tenderer contributes to strengthening the digital supply chain in the Union or uses hardware/software designed or manufactured in the Union.

  • While Article 32 encourages the procurement of solutions that align with sovereignty goals (which often includes open-source), it does not transform a licensed product into an owned asset.
  • A public body can procure a licensed European solution to meet Article 32 criteria without triggering the Article 42 reuse obligation, as the IP ownership remains with the vendor.

The Role of the EU OSS Catalogue

Article 43 establishes the EU Open Source Solutions Catalogue (EU OSS Catalogue) as a centralized hub hosted on the Interoperable Europe portal.

  • Mandatory Channel: For software that meets the Article 42 criteria (owned + voluntarily released), the public body must use a repository connected to this catalogue.
  • No Listing for Licensed Software: There is no requirement to list third-party licensed software in the catalogue. If a vendor chooses to open-source their product independently, that is a commercial decision outside the scope of CADA's obligations for public buyers.

What this means for you

For in-house counsel, procurement officers, and IT compliance teams in the public sector or Union entities, the implications of Article 42 are specific and manageable:

  • Conduct an IP Audit: Before attempting to comply with Article 42, you must categorize your software portfolio. Distinguish clearly between:
    • Owned IP: Software developed in-house or commissioned with IP transfer clauses.
    • Licensed IP: Software acquired via standard license agreements where the vendor retains ownership.
    • Conclusion: Article 42 applies only to the first category.
  • Review Commissioning Contracts: If your entity commissions new software, ensure the contract explicitly states that the public body holds the intellectual property rights. If the contract assigns IP to the vendor, the software will be exempt from the reuse mandate, even if developed specifically for the public body.
  • Respect the "When" Trigger: You are not forced to open-source owned software. The obligation is procedural: "When making software... available for reuse." If you decide to keep a proprietary solution, no action is required under Article 42.
  • No Reverse Engineering: You are under no obligation to attempt to extract, decompile, or publish code from commercially licensed third-party products. The IP boundary protects the public body from such requirements.
  • Prepare for the Catalogue: If you do decide to release owned software, ensure your technical teams are ready to integrate with the EU OSS Catalogue (Article 43). This involves connecting your internal repository to the Interoperable Europe portal.
  • Procurement Strategy: When drafting tenders, you may encourage vendors to open-source their code (to facilitate future reuse), but you cannot mandate it as a condition of the license unless the vendor agrees to transfer IP. Article 32 can be used to favor vendors who contribute to the European ecosystem, but this is distinct from the Article 42 reuse mandate.

Common misconceptions

"CADA forces all public sector software to be open-source."

  • Reality: CADA encourages open-source adoption (Article 41) and mandates the method of release for owned software that is voluntarily open-sourced (Article 42). It does not mandate that all software used by the public sector must be open-source, nor does it force the release of commercially licensed software.

"Licensing software from an EU vendor satisfies CADA's reuse rules."

  • Reality: Using European software may help meet "European added value" procurement criteria under Article 32, but it does not trigger Article 42's reuse obligation. If you do not own the IP, you cannot reuse it under this article, regardless of where the vendor is based.

"You must publish all software developed for the public sector."

  • Reality: Publication is conditional on the public body's decision to make the software available for reuse. If the public body decides to keep the software proprietary (e.g., for security reasons), Article 42 does not force publication. The obligation is procedural, not substantive regarding the act of open-sourcing itself.

"Article 42 applies to all software the public body uses."

  • Reality: The text is explicit: "software to which they hold intellectual property rights." Software used under a license where the vendor holds the IP is strictly outside the scope.

Related

This is general information about a draft EU regulation, not legal advice.