Summary Under the proposed Cloud and AI Development Act (CADA), you do not upload software directly to the central EU Open Source Solutions Catalogue (EU OSS Catalogue). As proposed, Article 42 requires a Union entity or public sector body that makes software it owns available for reuse under an open source licence to publish it in its own catalogue or repository, and Article 43(3) lets the owner of that catalogue or repository request the Commission to connect it to the EU OSS Catalogue. The Commission decides on that request on the basis of objective and relevant criteria. CADA is still a proposal, so this process is not yet operational.

Detail

CADA (COM(2026) 502 final) promotes the sharing and reuse of public-sector software through a centralised catalogue, the EU OSS Catalogue, set out in the open source chapter (Chapter V of Title IV). For cloud service providers, data centre operators and software vendors working with the public sector, understanding how the catalogue works helps you support clients who fall under these proposed obligations.

A federated model, not a single upload server

CADA does not require public bodies to upload code to one central EU server. Under Article 42, when a Union entity or public sector body holds intellectual property rights in software and voluntarily decides to make it available for reuse under an open source licence, it must do so "using a catalogue or repository that is connected to, and made accessible through, the EU OSS Catalogue."

This federated design has two effects: reusable software is not lost in disconnected silos, and there is a single point through which the public sector can search and access it — while existing national and institutional repositories continue to be used.

The role of the EU OSS Catalogue (Article 43)

The EU OSS Catalogue is established under Article 43(1): the Commission "shall provide and maintain" it as a centralised catalogue to access software made available for reuse by Union entities and public sector bodies. Under Article 43(2), it is hosted on the Interoperable Europe portal referred to in Article 8 of Regulation (EU) 2024/903 (the Interoperable Europe Act) and is accessible electronically free of charge. Hosting it there is intended to link solutions to related information and training (Recital 83).

How software gets onto the catalogue: publish, then connect

For a public sector body or Union entity, getting software discoverable through the catalogue involves two steps:

  1. Publish. Publish the software in your own catalogue or repository, under an open source licence, where you hold the IP rights (or the authority to release it for reuse).
  2. Request connection. Request that the catalogue or repository be connected to the EU OSS Catalogue. Article 43(3) governs this: "the Commission shall, on the basis of objective and relevant criteria, decide on the request of any Union entity or public sector body owning or maintaining a catalogue or repository to have that catalogue or repository connected to and made accessible through the EU OSS Catalogue."

The decision is the Commission's and must rest on objective and relevant criteria. The specific technical criteria are not set out in Article 43; they would be determined when the framework is implemented. Note that connection operates at the level of a catalogue or repository, not each individual software project — so the unit being approved is the repository.

A practical workflow for public bodies

In practice, a body wishing to share software for reuse would likely:

  • Identify in-scope software — internally developed or contractor-developed code where the body holds the IP rights and that has reuse potential;
  • Choose a repository — one able to meet the technical expectations for connection (for example, the metadata and interoperability conventions of the Interoperable Europe portal);
  • Publish under an open source licence with complete documentation and licensing;
  • Submit a connection request to the Commission under Article 43(3);
  • Await the Commission's decision against its objective and relevant criteria; and
  • Go live — once connected, the software becomes discoverable through the EU OSS Catalogue for other public bodies across the Union.

Because the detailed criteria and any technical guidance are still to be defined, treat specific technical steps as expectations rather than settled requirements.

Support from the OSPO Network (Article 44)

CADA would also establish a Network of Open Source Programme Offices (OSPOs) under Article 44 to support implementation of the open source chapter — exchanging best practices and contributing non-binding guidance and templates on sharing and reuse. The OSPO Network does not approve catalogue connections (that is the Commission's role under Article 43(3)), but it can be a useful source of guidance for bodies preparing repositories for connection, and for the providers helping them.

What this means for you

As a cloud service provider or data centre operator serving the public sector, the Article 42 / 43 obligations fall on your public-sector clients, not on you directly. But your role can be pivotal in enabling their compliance:

  • Platform readiness. Clients may want repositories hosted in a way that eases connection to the EU OSS Catalogue. Supporting common APIs, metadata standards and security controls positions you to help — bearing in mind the Commission's criteria are not yet published.
  • Advisory services. There is likely demand for help auditing software portfolios, choosing open source licences and preparing repositories and connection requests.
  • Lifecycle services. As public bodies reuse catalogue software, demand for hosting, maintenance and support around that software may grow.

These are proposed measures; CADA must be adopted and apply before any of this is in force.

Common misconceptions

  • Misconception 1: You can upload software directly to the EU OSS Catalogue. No. Article 42 requires software to be published in a catalogue or repository connected to the EU OSS Catalogue. The central catalogue is an access/aggregation layer, not a direct hosting platform for individual projects.
  • Misconception 2: Any repository is connected automatically. No. Article 43(3) gives the Commission the power to decide connection requests on "objective and relevant criteria." Connection is a decision, not an entitlement.
  • Misconception 3: The Commission takes over the software. No. Public bodies retain control of their software and repositories; the Commission maintains the central catalogue and decides connections (Article 43(3)).
  • Misconception 4: This applies to all open-source software used by the public sector. No. Article 42 applies to software developed by or for Union entities and public sector bodies, where they hold the IP rights and voluntarily decide to make it available for reuse. It does not require every open-source tool the public sector uses to be listed.

Related

This is general information about a draft EU regulation, not legal advice.