Summary As proposed, a state-owned company is not automatically a "public sector body" under CADA just because the State holds its shares. As proposed in Article 2, point (6), "public sector body" is defined by reference to Article 2, point (1), of Directive (EU) 2019/1024 (the Open Data Directive). A state-owned entity typically qualifies only as a "body governed by public law," which requires a cumulative test: legal personality, establishment for the specific purpose of meeting needs in the general interest (not industrial or commercial), and significant public financing or control. A state-owned company operating on purely commercial terms may fall outside the definition.

Detail

As proposed, to decide whether a state-owned company is a "public sector body" under CADA you look to Article 2, point (6), which defines the term by reference to Article 2, point (1), of Directive (EU) 2019/1024 (the Open Data Directive). That definition covers the State, regional or local authorities, bodies governed by public law, and associations formed by such authorities or bodies.

For a state-owned company, the relevant route is usually "body governed by public law," which imports a well-established cumulative test. All elements must be present at once; if one is missing, the entity is not a body governed by public law.

The cumulative test

  1. Established for the specific purpose of meeting needs in the general interest, not having an industrial or commercial character. The entity's core mission must serve a public purpose (such as healthcare, education, transport or energy infrastructure) rather than competing for profit in the open market.
  2. Legal personality. The entity must be a distinct legal person, separate from the State administration — typically true of state-owned companies and public agencies.
  3. Public financing or control. The entity must be financed for the most part by, subject to management supervision by, or have a board more than half appointed by, public authorities or other bodies governed by public law. In practice this turns on whether the public authority can exercise decisive influence over the entity's strategic decisions.

Application to state-owned companies

For a state-owned company, legal personality is usually present. The decisive questions are the "general interest, non-commercial character" element and the financing/control element.

  • Control: Where the State appoints a majority of the board or holds strategic veto rights, the company is likely subject to significant public control.
  • Financing: Where public subsidies, grants or capital injections predominate, the financing element may be met.

The edge case: commercial public undertakings

A state-owned company operating in a fully competitive market — pursuing profit, competing with private rivals and deciding on market signals rather than a public-policy mandate — may fail the "general interest / non-commercial character" or the control element. In that case, even with State ownership, it functions as a private economic operator and would, as proposed, not be a public sector body under CADA. It would then be treated as a private entity. As proposed, private entities in NIS2 Annex I high-criticality sectors may carry out impact assessments similar to the Article 29 risk assessment on a voluntary basis under Article 31.

What this means for you

For procurement officers and legal teams, classification drives which CADA rules would apply.

1. Procurement and assurance levels. As proposed, Article 30 sets minimum Union assurance levels for the cloud services public buyers use: at least level 1 for non-public-order activities, and level 2, 3 or 4 for public-order activities identified under Article 29(1). If you procure from a state-owned company that is a public sector body, public-to-public arrangements — including the voluntary EuroCloud Federation under Articles 34–36 — may be relevant. If the state-owned company is not a public sector body, treat it as a private supplier whose service must still meet your required assurance level.

2. Risk assessments. As proposed, public sector bodies are part of the Article 29 risk-assessment process. When engaging a state-owned company classified as private, treat it as a third-party supplier: check its recognition status in the central repository of recognised services under Article 22 and confirm it holds the required conformity self-assessment (level 1) or independent audit (levels 2–4).

3. Open source. As proposed, Articles 41 and 42 promote open-source solutions and software reuse by Union entities and public sector bodies, including making software available in the proposal's open-source software catalogue. A state-owned company that is not a public sector body is not bound by these obligations; one that is a public sector body would be. Misclassification could mean missed reuse or non-compliance.

4. Verification steps. Before engaging a state-owned company, test it against the Open Data Directive criteria:

  • Does a public authority exercise decisive influence over its strategic decisions?
  • Is its purpose to meet needs in the general interest, without an industrial or commercial character?
  • Does it receive significant public financing, supervision or board appointment? If yes, treat it as a public sector body. If not, treat it as a private supplier and apply the Article 31 impact-assessment considerations where it operates in a high-criticality sector.

Common misconceptions

  • "State ownership equals public sector body." Incorrect. As proposed, ownership alone does not trigger the definition; the general-interest and control/financing elements must also be met. A commercially run state-owned airline might not qualify.
  • "All government bodies are public sector bodies." Most are, but the body-governed-by-public-law route requires legal personality. An internal division of a ministry without separate legal personality is part of a larger public sector body rather than one in its own right under that route.
  • "A private company with a public contract becomes a public sector body." No. Winning a public contract does not change a private company's status; it remains private, subject to the contract and any applicable private-sector impact-assessment considerations.

Related

This is general information about a draft EU regulation, not legal advice.