Summary You do not list your service yourself. As proposed in the Cloud and AI Development Act (CADA), once your service is recognised at a Union assurance level under Article 17, the national competent authority (NCA) of your establishment registers it in the central repository (Article 22(2)). The repository, established and maintained by the Commission under Article 22, is publicly available, lists services recognised at Levels 1 to 4, and shows revocations for five years. Your job is to secure recognition with accurate evidence and keep your service compliant; the NCA does the registering and updating.

Detail

CADA, as proposed, makes listing a consequence of recognition, not a separate application. As a provider you are the applicant for recognition; the NCA of establishment is the actor that registers the service.

The role of the central repository

Article 22(1) requires the Commission to establish and maintain a dedicated repository of cloud computing services recognised under Article 17. It is the single reference point for the Union's sovereign cloud framework, with three features worth noting:

  • Public availability (Article 22(4)): the repository is publicly available on a dedicated, easily accessible website, regularly updated by the Commission and the NCAs of establishment.
  • Scope of listings: it covers services recognised at any of the four Union assurance levels, so public buyers can distinguish baseline (Level 1) from higher-assurance sovereignty (Levels 2–4).
  • Revocation visibility (Article 22(3)): the revocation of an audit report and audit opinion by an auditing organisation, or of a recognition by a competent authority, is published in the repository and remains available there for five years.

From application to listing

Listing is the final administrative step of the Article 17 recognition procedure.

1. Apply to the NCA of establishment. Under Article 17(1), you submit your application to the national competent authority of your establishment — the authority in the Member State of your main establishment, defined in Article 25(4) as the place where principal financial functions and operational control are exercised.

2. Submit the right evidence.

  • Level 1: an EU statement of conformity (issued under Article 19) plus all necessary evidence. For SMEs, Article 17(3) provides that the statement is directly and automatically recognised in all Member States without prior recognition by the evaluating authority.
  • Levels 2, 3 and 4: an audit report and a "positive" audit opinion from an independent auditing organisation, with all the evidence given to the auditor (Article 17(4)).

3. Evaluation and recognition. The evaluating NCA has 60 days to assess the evidence (Article 17(5)); if it is sufficient, the authority drafts a recognition decision and notifies the other Member States for a 60-day review. Absent a sustained objection, the authority adopts the recognition decision (Article 17(7)).

4. Registration in the repository. Once recognition is adopted, the service is recognised across the Union. Article 22(2) provides that the NCA of establishment that recognised the service under Article 17 registers it in the central repository. Your responsibility ends at supplying accurate evidence and maintaining compliance; updating the repository is the NCA's task.

Why registration is the authority's task, not yours

The allocation of roles is deliberate. Article 22(2) places registration on the same authority that recognised the service — the NCA of establishment — so that the public record is created by the body that actually evaluated the evidence, rather than self-asserted by the provider. This matters for the repository's purpose: it is meant to be a reliable, single source of truth that public buyers and auditing organisations can rely on under Article 30 when they must confirm a service holds the required Union assurance level. A self-service listing would undercut that reliability. The corollary for you is that you cannot accelerate or bypass listing by going directly to the Commission; your only lever is a complete, accurate Article 17 application that lets the NCA reach — and then register — a recognition.

Transparency and ongoing obligations

Listing is not static. Under Article 23(1), a recognised provider that becomes aware of any information or material change in circumstances that may affect the audit report, the "positive" opinion (Article 20) or the recognition (Article 17) must notify the auditing organisation and the NCA of establishment as soon as possible. If the NCA then amends or revokes the recognition, that revocation is published in the repository for five years under Article 22(3) — so the public listing always reflects current status.

What this means for you

The mechanism shifts the data-entry burden to the regulator but keeps the burden of accuracy and maintenance on you.

Focus on the NCA relationship. You cannot self-register, so your route into the repository is a complete, accurate Article 17 application to the NCA of establishment. Any delay in providing evidence delays your appearance — and your eligibility for contracts that require a specific level.

Monitor your listing once it is live. Check that your service appears with the correct assurance level. If you spot an error, contact the NCA of establishment, which is responsible for the update under Article 22(2).

SMEs at Level 1. Note the automatic recognition of your EU statement of conformity under Article 17(3). Even so, registration in the repository is a formal act, so make sure your statement is issued correctly and the NCA has what it needs.

Maintain audit readiness. For Levels 2–4, your listing rests on a valid "positive" audit opinion. Keep your auditing organisation informed of material changes (Article 23). If an audit opinion is revoked, the NCA revokes the recognition, and the revocation stays visible in the repository for five years.

Common misconceptions

"I can register my service directly on the Commission's website." No. Article 22(2) assigns registration to the NCA of establishment. The Commission maintains the repository's infrastructure but does not register services on direct application from providers — you go through the national recognition process first.

"Only Level 4 services are listed." No. Article 22 covers services recognised at Levels 1, 2, 3 and 4, so buyers can see the full range across the framework.

"Once listed, my status is permanent." No. The repository is dynamic: under Article 22(3) revocations of recognition or audit opinions are published and remain visible for five years. Fail to report material changes under Article 23, or lose your audit opinion, and your recognition can be revoked.

"SMEs need not engage the NCA for listing." Not quite. SMEs benefit from automatic recognition of the statement of conformity (Article 17(3)), but registration in the repository is still a formal act by the competent authority — so the statement must be issued correctly and the NCA given the information it needs.

Related

This is general information about a draft EU regulation, not legal advice.