Summary To list public-sector software on the EU Open Source Solutions Catalogue (EU OSS Catalogue), your entity must first make the software available for reuse under an open-source licence and host it in a catalogue or repository. Under Article 43 of the proposed Cloud and AI Development Act (CADA), the Commission maintains a centralised catalogue hosted on the Interoperable Europe portal, which is accessible free of charge. You do not upload software directly to the Commission's server; instead, you must submit a request to the Commission to have your existing catalogue or repository connected to and made accessible through the EU OSS Catalogue.

Detail

The proposed Cloud and AI Development Act (CADA) establishes a comprehensive framework to strengthen the European public sector's digital autonomy by promoting open standards and open-source solutions. A cornerstone of this framework is the creation of a unified discovery mechanism: the EU Open Source Solutions Catalogue. This initiative aims to solve the fragmentation problem where software developed by public bodies is often siloed in disparate, hard-to-find repositories.

The Legal Basis: Article 43

The specific mechanism for listing software is governed by Article 43 of the CADA proposal. This article mandates the Commission to "provide and maintain an EU Open Source Solutions Catalogue ('EU OSS Catalogue') as a centralised catalogue to access software made available for reuse by Union entities and public sector bodies."

It is crucial to understand the distinction between the software and the catalogue. The regulation does not create a central repository where entities dump their source code. Instead, it creates a centralised index or portal that points to software hosted elsewhere. As stated in Article 43(3), the Commission shall "decide on the request of any Union entity or public sector body owning or maintaining a catalogue or repository to have that catalogue or repository connected to and made accessible through the EU OSS Catalogue."

This federated approach ensures that entities retain control over their software assets while benefiting from the visibility provided by a Union-wide search interface.

Hosting and Accessibility Requirements

The proposal is explicit about where the central catalogue lives and how it is accessed. Article 43(2) stipulates that the "EU OSS Catalogue shall be hosted on the Interoperable Europe portal referred to in Article 8 of Regulation (EU) 2024/903." By anchoring the catalogue to the Interoperable Europe portal, CADA leverages existing EU digital infrastructure, ensuring alignment with broader interoperability standards and reducing the need for new, standalone technical systems.

Furthermore, the regulation removes financial barriers to entry for public authorities seeking to reuse solutions. Article 43(2) explicitly states that the catalogue "shall be accessible electronically free of charge." This ensures that any public sector body, regardless of budget constraints, can search for and evaluate software solutions developed by other Union entities or Member States without incurring licensing or access fees for the catalogue itself.

The Step-by-Step Listing Process

For a public-sector body or Union entity wishing to list its software, the process involves three distinct stages, driven by the interplay between Article 42 and Article 43.

1. Make Software Available for Reuse (Article 42)

Before a connection can be requested, the entity must decide to make software available for reuse. Article 42 states: "When making software to which they hold intellectual property rights available for reuse under an open-source licence, a Union entity or public sector body shall do so using a catalogue or repository that is connected to, and made accessible through, the EU OSS Catalogue."

This implies a conditional obligation: if you choose to release software under an open-source licence, you must do so via a connected repository. You cannot simply host it on a private server or a disconnected website if you intend to comply with the transparency and reuse objectives of CADA.

2. Prepare Your Repository

The software must be hosted in a catalogue or repository that you own or maintain. This could be:

  • An internal repository specific to your agency or ministry.
  • A national open-source repository managed by a Member State.
  • A repository managed by a network of Open Source Programme Offices (OSPOs).

The repository must be technically capable of being connected to the central EU system. While the specific technical criteria for connection are to be detailed in future implementing acts or guidelines, the entity must ensure that the software is properly licensed, documented, and that the repository structure allows for the necessary metadata exchange.

3. Request Connection to the EU OSS Catalogue (Article 43)

Once the software is ready and hosted, the entity must formally request integration. Article 43(3) provides the legal mechanism: "The Commission shall, on the basis of objective and relevant criteria, decide on the request of any Union entity or public sector body owning or maintaining a catalogue or repository to have that catalogue or repository connected to and made accessible through the EU OSS Catalogue."

Key steps in this request phase:

  • Submit the Request: The entity submits a formal request to the Commission.
  • Evaluation: The Commission evaluates the request based on "objective and relevant criteria." While the draft regulation does not list these criteria exhaustively, they will likely cover technical interoperability (e.g., API compatibility with the Interoperable Europe portal), security standards, the validity of open-source licences, and the quality of metadata.
  • Decision: The Commission makes a decision to approve or reject the connection. If approved, the entity's repository becomes a node in the EU OSS Catalogue, making its software discoverable across the Union.

Integration with the OSPO Network

This listing process is supported by the Network of Open Source Programme Offices (OSPO Network) established under Article 44. The OSPO Network is tasked with "facilitating the exchange of information, experience and best practices" and "promoting the sharing and reuse of open-source software."

Entities preparing to list software should engage with their national or entity-level OSPO. These offices will likely play a pivotal role in:

  • Advising on the "objective and relevant criteria" for connection.
  • Assisting with the technical setup of the repository.
  • Providing guidance on licensing and metadata standards.
  • Acting as a liaison with the Commission during the connection request process.

What this means for you

For public-sector IT managers, open-source coordinators, and procurement officers, Article 43 of the proposed CADA introduces a structured, albeit administrative, pathway for sharing software assets.

  • Shift from "Upload" to "Connect": You do not need to migrate your software to a central EU server. Your primary task is to ensure your existing repository is robust and then request a connection. This preserves your data sovereignty and operational control.
  • Prepare for Evaluation: Be ready to demonstrate that your repository meets the "objective and relevant criteria" the Commission will establish. This may involve standardising your metadata, ensuring your open-source licences are machine-readable, and verifying your security posture.
  • Leverage the Interoperable Europe Portal: Since the catalogue is hosted on the Interoperable Europe portal, aligning your repository's technical standards with the Interoperable Europe ecosystem (e.g., using standard APIs, adhering to the European Interoperability Framework) will significantly streamline the connection process.
  • Cost-Free Discovery: Remember that while you may incur costs to prepare your repository, the access to the catalogue for other public bodies is free of charge. This is a strategic advantage for promoting the reuse of your solutions across the EU.
  • Collaborate with OSPOs: Do not navigate this process alone. Engage early with your national OSPO or the OSPO Network. They will be the primary source of guidance on the technical and procedural requirements for listing software.

Common misconceptions

"I must upload my source code to the Commission's servers." Incorrect. Article 43 establishes a federated model. You host the software in your own or your entity's repository. The Commission's role is to maintain the central catalogue interface and connect your repository to it. The software remains in its original location.

"The connection is automatic once I host the software." Incorrect. Article 43(3) states the Commission shall "decide on the request." This implies a review process. Your repository must meet specific technical and quality criteria before it is connected. There is no automatic inclusion.

"I can list software without an open-source licence." Incorrect. Article 42 explicitly links the requirement to use a connected repository to the act of making software available for reuse "under an open-source licence." If the software is not open-source, it falls outside the scope of this specific listing mechanism.

"Only the Commission can add software to the catalogue." Incorrect. Article 43(3) empowers "any Union entity or public sector body owning or maintaining a catalogue or repository" to request connection. The Commission acts as the gatekeeper and facilitator, not the sole curator of the content.

"Listing software is optional even if I use open source." While the decision to make software available for reuse is voluntary (as per Article 42), if you do choose to make it available under an open-source licence, Article 42 mandates that you do so via a catalogue connected to the EU OSS Catalogue. You cannot bypass the centralised discovery mechanism if you intend to comply with the regulation's transparency goals.

Related

This is general information about a draft EU regulation, not legal advice.