Summary As proposed, the Cloud and AI Development Act (CADA) is drafted to keep the "Union added value" criterion within the EU's commitments under the WTO Agreement on Government Procurement (GPA). The legal architecture has two strands. First, the structural conditions in Article 32(2) — linked to the subject matter, not conferring unrestricted freedom of choice, expressly published, and ancillary and not decisive — keep the criterion from operating as a disguised exclusion of non-EU bidders. Second, Recital 64 of the proposal expressly reserves the Union's right, in accordance with Article III:2(a) of the WTO GPA, to maintain measures necessary to protect public morals, order or safety. Recital 67 reinforces proportionality with an indicative ceiling of 15 out of 120 points. Whether any specific application complies would ultimately turn on how an authority applies the criterion.

Detail

The compatibility of the Union added value criterion with the WTO GPA is a genuine question for both procurers and non-EU providers. The GPA, to which the EU and its Member States are parties, embeds a national-treatment principle: once a covered procurement is open to suppliers of other GPA parties, those suppliers and their goods and services must be treated no less favourably than domestic ones. A criterion that explicitly favours EU-designed or manufactured hardware or software could, in principle, be challenged if it operated as a disguised restriction on trade.

The CADA proposal is drafted to stay on the right side of that line through structural design rather than blanket exception.

The structural conditions (Article 32(2))

Article 32(1) requires the non-price Union-added-value criterion in procurement of innovative cloud computing services and AI systems. Its legal defensibility rests on the four conditions in Article 32(2), which read as deliberate compatibility safeguards:

  1. Linked to the subject matter (Article 32(2)(a)). The criterion must be tied to the contract's subject matter — performance, supply-chain security or technological integration relevant to the service — not an abstract political preference. Linkage to the subject matter is a recognised feature of lawful award criteria in EU procurement law.

  2. No unrestricted freedom of choice (Article 32(2)(b)). The criterion must not confer unrestricted freedom of choice on the authority, requiring an objective, bounded and transparent evaluation rather than discretionary preference.

  3. Expressly set out (Article 32(2)(c)). The criterion must be published in the procurement documents or contract notice, giving all bidders — EU and non-EU alike — equal advance notice of how they will be scored.

  4. Ancillary and not decisive (Article 32(2)(d)). This is the linchpin of GPA compatibility. By keeping Union added value secondary to the core technical and financial merits, the proposal positions it as a differentiator rather than a barrier to entry.

Why "ancillary and not decisive" matters

In trade-law terms, a decisive criterion could amount to a de facto exclusion of foreign competitors, undercutting national treatment. An ancillary criterion that functions as a minor differentiator is far harder to characterise as a disguised restriction. Recital 67 carries this through: the European added value criterion "should not be decisive for award of the contract and should be applied in a manner that preserves the primacy of technical and financial criteria directly connected to the performance requirements," and authorities "could consider a maximum weighting of 15 out of 120 points" within the methodology. That indicative ceiling (12.5%) gives a concrete proportionality benchmark, leaving the large majority of the evaluation on objective performance metrics equally accessible to EU and non-EU providers. (Note: 15 out of 120 is an indicative figure suggested in a recital — "could consider" — not a binding cap in the enacting terms.)

The hardware fallback (Article 32(3)(d))

Article 32(3)(d) reinforces the non-exclusionary design: where EU-designed or manufactured critical hardware is not feasible, the criterion expressly allows third-country hardware that "contributes to strengthening the security of supply and the development of a European cloud and AI ecosystem." Because the dimension is framed around security of supply and ecosystem development rather than origin alone, it is harder to characterise as pure origin discrimination.

The public-order reservation (Recital 64 and the GPA)

Recital 64 makes the trade-law backdrop explicit. It records that the Union maintains an open and non-discriminatory framework for market access, subject to its international commitments — "including commitments under the World Trade Organization (WTO) Agreement on Government Procurement (GPA), as well as bilateral trade agreements." It then reserves that, "where necessary and in duly justified circumstances, the Union retains the right, in accordance with Article III:2(a) of the WTO GPA, to adopt or maintain measures necessary to protect public morals, order or safety," allowing necessary and proportionate restrictions on access to procurement procedures. The recital ties this to risks such as critical dependencies, unauthorised access to Union data, technology leakage, sabotage and espionage by third-country actors.

Two points of legal nuance. First, that public-order reservation in Recital 64 speaks primarily to the assurance-level procurement rules (Articles 29–30), which can lawfully restrict access for public-order activities — not to the softer Article 32 scoring criterion. For Article 32, the principal compatibility argument is structural (the Article 32(2) conditions), not the security exception. Second, invoking a GPA public-order or security exception is a high bar; the proposal's drafting suggests reliance is intended to be exceptional and duly justified rather than routine.

Beyond Article III:2(a), the proposal does not cite specific GPA article numbers for national treatment or for general or security exceptions; this article therefore describes those concepts rather than attributing article numbers the source does not state.

How the conditions map onto existing procurement law

The Article 32(2) conditions are not new inventions: they echo long-standing limits on award criteria in EU public-procurement law. Award criteria must be linked to the subject matter of the contract, must not give the contracting authority unrestricted freedom of choice, and must be published in advance — the same three ideas appear in Article 32(2)(a)–(c). What Article 32 adds is the explicit fourth condition that the criterion be ancillary and not decisive. By aligning Union added value with these established constraints, the proposal positions it as an ordinary, lawful quality sub-criterion rather than a novel trade measure. That alignment matters for the GPA analysis: a criterion that conforms to the EU's own internal-market and procurement disciplines — which themselves operate against a national-treatment backdrop within the single market — is more readily defended as consistent with the comparable national-treatment discipline in the GPA.

Two distinct legal mechanisms, two distinct risk profiles

It is important to keep Article 32 separate from CADA's assurance-level rules when assessing GPA exposure:

  • Article 32 (Union added value) is a scoring mechanism applied to innovative cloud and AI procurement. Because it is ancillary, capped in practice at an indicative ~12.5%, and allows qualifying third-country hardware, its national-treatment exposure is comparatively low; the principal defence is structural.
  • Articles 29–30 (assurance levels) are access rules: for public-order activities, only services recognised at levels 2, 3 or 4 may be procured, and Annex II conditions on third-country control can effectively narrow the field. These rules rely more directly on the Recital 64 public-order reservation under Article III:2(a) GPA, and would be the more likely focus of any serious trade-law challenge.

Conflating the two overstates Article 32's exposure and understates where the genuine national-treatment pressure sits.

Practical litigation posture

Because legality depends on application, the realistic risk is not an abstract challenge to Article 32 as such but a challenge to a specific tender — for example, where a bidder argues the added-value weighting was set so high, or applied so subjectively, that it became decisive (contrary to Article 32(2)(d)) or conferred unrestricted freedom of choice (contrary to Article 32(2)(b)). For procuring authorities, the defensive playbook is therefore documentary: a published, objective scoring scheme; a modest, recital-aligned weight; a clear subject-matter link; and a reasoned evaluation record. For non-EU bidders, the corresponding strategy is evidentiary: compete on the unconstrained 105-point core and contest only genuine misapplication of the four Article 32(2) conditions.

What this means for you

For in-house counsel at cloud and AI providers — especially those with non-EU headquarters or supply chains — the practical takeaway is that the criterion's existence is not itself a viable discrimination challenge; the design is engineered to fit within the GPA. Your focus should be on competing within its constraints and on policing misapplication.

If you are a procuring entity:

  • Implement Article 32 criteria in tenders for innovative cloud and AI services.
  • Respect proportionality — keep the criterion ancillary; the 15/120 indicative ceiling in Recital 67 is a sensible reference point.
  • Document linkage to the subject matter (Article 32(2)(a), (c)).
  • Avoid exclusionary use — the criterion belongs in the evaluation score, not as a pass/fail gate, which would invite a national-treatment challenge.

If you are a provider:

  • Map supply-chain origin for hardware and software (Article 32(3)(a), (d)); where you rely on non-EU hardware, be ready to show why EU alternatives are not feasible and how your solution still strengthens security of supply.
  • Highlight Union-developed technology and Union-funded R&D (Article 32(3)(b)).
  • Compete on the core criteria — assume up to roughly 12.5% of quality points may go to added value and ensure your technical and financial bid can carry the rest.
  • Watch for misapplication — if an authority applies the criterion in a way that is decisive or confers unrestricted freedom of choice, that conflicts with Article 32(2) and may ground a procurement-law challenge.

Common misconceptions

"Union added value criteria are illegal under the WTO GPA." Not as drafted. Article 32(2) is structured to keep the criterion ancillary, subject-matter-linked and not decisive; the proportionality benchmark in Recital 67 supports that design. Legality in any case would depend on application.

"Non-EU providers are excluded from bidding." No. Article 32 introduces a scoring criterion, not an exclusion. Non-EU providers can win on superior technical and financial offers or by demonstrating ecosystem contribution; Article 32(3)(d) even allows qualifying third-country hardware.

"The criteria apply to all public procurement." No. Article 32 applies to procurement of innovative cloud computing services and AI systems.

"'Ancillary and not decisive' means the criterion has no effect." No. Ancillary means secondary, not irrelevant; at an indicative ~12.5% weight it can be a differentiator in close bids, while never overriding core technical and financial merit.

Related

This is general information about a draft EU regulation, not legal advice.