Summary No, the proposed Cloud and AI Development Act (CADA) does not mandate that public-sector bodies must share their software. The obligation to share is entirely voluntary. However, if a public authority voluntarily decides to make software available for reuse under an open-source licence, CADA imposes a strict condition on how that sharing occurs: the software must be published via a catalogue or repository connected to the central EU Open Source Solutions Catalogue (Article 42). This rule ensures discoverability and prevents fragmented repositories, rather than forcing the release of code.

Detail

Under the proposed Cloud and AI Development Act (CADA), the relationship between public authorities and software reuse is defined by a critical legal distinction: the difference between the encouragement to use open source and the mechanism for sharing software. A common point of confusion is whether CADA creates a blanket duty to open-source all government-developed code. The text of the proposal makes it clear that it does not.

Voluntary Sharing vs. Mandatory Channels

The core provision governing this topic is Article 42 of the CADA proposal, titled "Share and reuse of software." The article states:

"When making software to which they hold intellectual property rights available for reuse under an open source licence, a Union entity or public sector body shall do so using a catalogue or repository that is connected to, and made accessible through, the EU OSS Catalogue referred to in Article 43."

The conditional phrasing "When making... available" is the legal key. This establishes that the obligation is triggered only by the prior, voluntary decision to release software. If a public sector body chooses to keep its software proprietary, or chooses not to release it for reuse at all, Article 42 imposes no requirement to do otherwise. The regulation does not compel the act of sharing; it only regulates the channel if the act is chosen.

This voluntary nature is explicitly reinforced by Recital 83 of the explanatory memorandum, which provides the policy context for Article 42. The recital acknowledges the current landscape:

"An increasing number of Union entities and public-sector bodies are sharing software developed by or for them and making it available for reuse under an open-source licence."

It then identifies the specific problem the regulation seeks to solve:

"However, software is often made available and accessible in different repositories or catalogues, hampering searchability, discoverability and, ultimately, reuse. It is therefore necessary to require Union entities and public-sector bodies that voluntarily decide to make software available for reuse to do so in a catalogue or repository that is connected to EU Open Source Solutions Catalogue..."

The recital explicitly frames the obligation as applying to those that "voluntarily decide to make software available." The legislative intent is to centralize discovery, not to compel disclosure. The goal is to maximize the value of public expenditure and foster innovation by making already-shared software easier to find, not to mandate the release of software that has not been designated for reuse.

The "Open Source First" Encouragement (Article 41)

While the act of sharing is voluntary, CADA does promote a significant cultural and policy shift toward open source through Article 41, titled "Promoting open source solutions and open source first."

Article 41 states:

"The Union and Member States shall take the necessary measures to encourage Union entities and public sector bodies to use and facilitate the reuse of open standards and components released under an open source licence when building their cloud and AI ecosystem or stack..."

The use of the word "encourage" rather than "require" or "shall use" is legally significant. It signals a policy preference and a directive for Member States to create supportive environments (such as through procurement guidelines, internal policies, or incentives) rather than a strict legal mandate for every individual software project to be released. This aligns with the broader EU Open Source Strategy, which aims to promote open European alternatives across the technology stack to boost technological sovereignty.

The distinction is clear: Article 41 sets the direction (encourage open source), while Article 42 sets the rule for those who follow that direction (use the EU OSS Catalogue).

The Role of the EU OSS Catalogue

The mechanism for compliance with Article 42 is the EU Open Source Solutions Catalogue (EU OSS Catalogue), established under Article 43. The Commission is tasked with providing and maintaining this centralised catalogue.

Article 43(1) states:

"The Commission shall provide and maintain an EU Open Source Solutions Catalogue ('EU OSS Catalogue') as a centralised catalogue to access software made available for reuse by Union entities and public sector bodies."

Article 43(2) specifies that the catalogue will be hosted on the Interoperable Europe portal and accessible electronically free of charge.

Article 43(3) grants the Commission the power to decide, based on objective and relevant criteria, whether a national or entity-specific catalogue can be connected to and made accessible through the EU OSS Catalogue. This allows for a federated approach where national catalogues can interoperate with the EU-level hub, rather than requiring every public body to upload directly to a single central server.

Network of Open Source Programme Offices (OSPOs)

To support the implementation of these voluntary sharing and reuse obligations, CADA establishes a Network of Open Source Programme Offices (OSPO Network) under Article 44.

Article 44(1) states:

"The Commission shall establish a network of Open Source Programme Offices ('OSPO Network') to facilitate cooperation on the implementation of the obligations under this Chapter."

The OSPO Network is designed to facilitate the exchange of information, experience, and best practices regarding licensing, security, maintenance, and procurement of open-source software. While the network itself is voluntary to join (Article 44(2)), it serves as the structural backbone for public authorities to coordinate their voluntary sharing activities and ensure that when they do share, they do so effectively and securely.

What this means for you

For public-sector procurement officers, IT directors, and policy makers, the practical implications of CADA's software provisions are focused on governance and discoverability rather than forced disclosure.

  1. Audit Your Current Sharing Practices: If your authority already releases software under open-source licences, you must ensure that the repository or catalogue where this software is hosted is connected to the EU OSS Catalogue. If your current internal repository is not connected, you will need to establish that link or migrate your listings to a connected platform once the technical specifications for connection are defined by the Commission.
  2. Review Internal Policies: While CADA does not mandate sharing, it strongly encourages an "open source first" approach via Article 41. You should review your internal software development and procurement policies to ensure they align with this encouragement. This may involve updating guidelines to prefer open-source components and considering the potential for reuse before finalizing a project.
  3. Engage with the OSPO Network: Consider whether your organization should join the OSPO Network established under Article 44. Participation can provide access to best practices on licensing, security, and maintenance, which can reduce the administrative burden of managing open-source software.
  4. Prepare for Interoperability: The EU OSS Catalogue will be hosted on the Interoperable Europe portal. Ensure that your IT infrastructure and cataloguing systems are prepared to interoperate with this portal, likely through APIs or standardized metadata formats, to ensure seamless discoverability of your shared assets.

Common misconceptions

Misconception 1: CADA forces all public software to be open-sourced. Correction: This is incorrect. Article 42 is conditional. It only applies "when making software... available for reuse." If a public body decides not to release its software, CADA imposes no penalty or requirement to do so. The obligation is about the channel of distribution, not the act of distribution itself.

Misconception 2: "Encouraging" open source in Article 41 is a soft suggestion with no legal weight. Correction: While Article 41 uses the word "encourage," it is a binding obligation on the Union and Member States to "take the necessary measures" to promote open source. This means national governments must implement policies, guidelines, or incentives that actively push public bodies toward open-source adoption. It is not merely a recommendation; it is a mandate for the state to foster an environment where open source is the preferred choice.

Misconception 3: You must upload all shared software directly to a single EU central server. Correction: Article 43 allows for a federated model. The Commission decides whether a national or entity-specific catalogue can be "connected to and made accessible through" the EU OSS Catalogue. This means you can likely maintain your own national repository, provided it meets the technical and objective criteria set by the Commission to interoperate with the central EU hub.

Misconception 4: CADA replaces existing national open-source policies. Correction: CADA complements existing frameworks, such as the EU Open Source Strategy and national digital strategies. It does not repeal national laws but adds a layer of EU-wide coordination for discoverability (the EU OSS Catalogue) and a unified encouragement mechanism (Article 41). National authorities remain responsible for implementing the "necessary measures" to encourage open source use.

Related

This is general information about a draft EU regulation, not legal advice.