Summary If a national competent authority (NCA) intends to maintain a draft decision to recognise a cloud service despite a reasoned objection from another Member State, the process can be escalated to the European Commission. Under Article 17(10) of the proposed Cloud and AI Development Act (CADA), the "concerned national competent authority" (the objector) may refer the matter to the Commission. The Commission will then assess the referral and adopt a binding decision determining whether the evaluating NCA may proceed with the recognition. This mechanism ensures that cross-border recognition disputes do not stall the single market indefinitely.

Detail

The Cloud and AI Development Act (CADA), as proposed in COM(2026) 502 final, establishes a harmonised framework for recognising cloud computing services as offering specific "Union assurance levels" (1 to 4). This recognition is a prerequisite for public sector procurement, as contracting authorities are required to procure services meeting specific assurance levels based on their risk assessments. The recognition process, detailed in Article 17, is designed to be a Union-wide procedure managed by the "evaluating national competent authority" (the NCA of the provider's establishment) but subject to a review period where other Member States can intervene.

The Recognition Process and the Risk of Deadlock

The procedure begins when a cloud computing service provider submits an application for recognition to the evaluating NCA. Under Article 17(5), if the evidence is sufficient, the evaluating NCA prepares a draft recognition decision and notifies the competent authorities of all other Member States. This triggers a 60-day review period (Article 17(5)(a)).

During this period, other Member States may intervene if they believe the draft decision does not comply with the applicable Union assurance level criteria set out in Annex II. Article 17(6) allows a concerned NCA to submit a "reasoned objection" or a "request for clarification."

If a reasoned objection is submitted, the evaluating NCA must assess it. Under Article 17(9), the evaluating NCA has two choices:

  1. Revoke its original draft decision.
  2. Maintain its original draft decision.

If the evaluating NCA chooses to maintain its decision despite the objection, a regulatory deadlock occurs. The objecting Member State believes the service does not meet the sovereignty criteria, while the evaluating NCA insists it does. Without a higher-level resolution mechanism, the provider's recognitionβ€”and consequently their ability to sell to the public sector in the objecting Member Stateβ€”would remain in limbo, undermining the single market objective of CADA.

Escalation to the Commission: Article 17(10)

To resolve this specific type of deadlock, Article 17(10) provides a clear escalation path. The provision states:

"In case the evaluating national competent authority intends to maintain its draft decision, the concerned national competent authority may refer the matter to the Commission. The Commission shall assess the referral and may request information from the national competent authorities concerned. The Commission shall adopt a binding decision determining whether the evaluating national competent authority may adopt the recognition decision."

This mechanism is the final arbiter in the recognition process. Its key operational elements are:

  1. The Trigger: The escalation is triggered only when the evaluating NCA intends to maintain its draft decision after a reasoned objection has been lodged. It is not automatic; the objecting NCA must actively choose to refer the matter.
  2. The Actor: The right to refer belongs to the "concerned national competent authority" (the objector). The cloud provider themselves cannot directly trigger this referral under Article 17(10), though they are the subject of the dispute.
  3. The Commission's Powers: Upon referral, the Commission has the authority to assess the dispute. Crucially, Article 17(10) empowers the Commission to "request information from the national competent authorities concerned." This ensures the Commission can gather all necessary technical and legal facts to make an informed judgment.
  4. The Outcome: The Commission adopts a binding decision. This is not a recommendation or an opinion. The decision explicitly determines "whether the evaluating national competent authority may adopt the recognition decision."
    • If the Commission rules that the evaluating NCA may proceed, the recognition is valid across the Union.
    • If the Commission rules that the evaluating NCA may not proceed, the recognition is blocked, and the service cannot be recognised at that assurance level.

Procedural Context and Timelines

While Article 17(10) does not specify a strict deadline for the Commission's final decision, the surrounding procedural steps are time-bound to ensure efficiency.

  • Notification of Intent: Under Article 17(9), the evaluating NCA must inform the other competent authorities within 15 days after the end of the review period (or after receiving a reasoned objection) if it intends to maintain its draft decision.
  • The Referral Window: Once the evaluating NCA notifies its intent to maintain the decision, the concerned NCA can immediately refer the matter to the Commission.
  • Information Gathering: Under Article 17(13), the Commission may require NCAs to provide "any relevant information relating to the concerned cloud computing service provider and the application for recognition" within a reasonable period. This supports the assessment under paragraph 10.

The binding nature of the Commission's decision provides the necessary legal certainty to prevent a single Member State from blocking a recognition decision indefinitely without EU-level scrutiny, while also preventing an evaluating NCA from forcing a recognition that other Member States deem non-compliant.

Interaction with Other Provisions

The escalation mechanism under Article 17(10) operates within a broader framework of checks and balances:

  • Clarification vs. Objection: Before a reasoned objection leads to a referral, there is often a preliminary "request for clarification" under Article 17(8). The evaluating NCA must take this into account and may request new information from the applicant. If the requesting NCA is not satisfied with the clarification, it may then submit a formal reasoned objection. The escalation to the Commission only occurs after this objection has been maintained by the evaluating NCA.
  • Revocation for Incorrect Information: It is important to distinguish the Article 17(10) dispute resolution from Article 17(11). If an evaluating NCA finds that a provider "intentionally or negligently, supplied incorrect or misleading information," it may revoke the recognition. This is a separate enforcement action, not a dispute between Member States.
  • Audit and Evidence: The Commission's decision will ultimately rest on the evidence provided during the audit process. Under Article 20 and Annex II, the criteria for Union assurance levels are strict. The Commission's binding decision will effectively validate or invalidate the evaluating NCA's assessment of this evidence.

What this means for you

For in-house counsel, compliance officers, and cloud service providers, understanding this escalation path is critical for managing the timeline of your CADA recognition and anticipating potential bottlenecks.

  1. Prepare for Cross-Border Scrutiny: If your cloud service faces a reasoned objection from another Member State, do not assume the process is stalled indefinitely. The objecting NCA may escalate the matter to the Commission under Article 17(10). Be prepared to provide robust, documented evidence to both the evaluating NCA and, potentially, the Commission directly if requested.
  2. Document Your Compliance Rigorously: The Commission's assessment will rely heavily on the information provided by the NCAs. Ensure your application, your self-assessment (for Level 1), and your audit reports (for Levels 2–4) are thoroughly documented and legally sound. Any gaps in your evidence regarding sovereignty criteria (e.g., location of infrastructure, personnel citizenship, or third-country control) could lead the Commission to rule against recognition.
  3. Engage Proactively with the Evaluating NCA: The evaluating NCA is your primary advocate in this process. Maintain open communication with them to understand their position and ensure they have all necessary information to defend their draft decision if it is referred to the Commission. They are the ones who will be bound by the Commission's final decision.
  4. Monitor Timelines and Buffer Your Strategy: While Article 17(10) does not specify a deadline for the Commission's final ruling, the initial phases (60-day assessment, 60-day review) are strict. Plan your go-to-market strategy with significant buffer time for potential escalations. A referral to the Commission could extend the recognition timeline by months.
  5. Understand the Finality: The binding nature of the Commission's decision provides a clear, definitive endpoint to disputes. Once the Commission decides, the recognition status is settled across the Union. This prevents fragmented national outcomes and supports the single market objective of CADA, but it also means there is no further administrative appeal within the CADA framework once the Commission has ruled.

Common misconceptions

  • Misconception 1: The Commission automatically reviews all objections.
    • Reality: The Commission only becomes involved if the concerned NCA (the objector) actively refers the matter under Article 17(10). If the objecting NCA accepts the evaluating NCA's assessment or withdraws the objection, no referral occurs, and the process continues without Commission intervention.
  • Misconception 2: Providers can directly appeal to the Commission.
    • Reality: The referral right belongs exclusively to the "concerned national competent authority." Providers do not have a direct right to escalate a dispute under Article 17(10). However, providers can and should provide information to the NCAs and the Commission if requested to support their case.
  • Misconception 3: A reasoned objection automatically blocks recognition.
    • Reality: A reasoned objection triggers an assessment by the evaluating NCA. If the evaluating NCA maintains its decision, the recognition is not blocked immediately; it is pending the potential referral and the subsequent Commission decision. The process only stalls if the objector chooses to refer.
  • Misconception 4: The Commission's decision is advisory.
    • Reality: Article 17(10) explicitly states the Commission shall adopt a binding decision. This decision is final in the context of the recognition procedure and determines the legal outcome for the evaluating NCA.

Related

This is general information about a draft EU regulation, not legal advice.