Summary Under the proposed Cloud and AI Development Act (CADA), the Union and Member States would "take the necessary measures to encourage" public bodies to use and reuse open standards and open-source components when building their cloud and AI stack — an "open source first" duty in Article 41 (as proposed). It is an encouragement balanced against functionalities (including security), total cost and other duly justified objective criteria — not a ban on proprietary software. Separately, Article 42 would require that when a public body makes software it owns available for reuse under an open-source licence, it must do so through a catalogue connected to the central EU OSS Catalogue (Article 43). CADA is a proposal (COM(2026) 502 final), not yet in force.
Detail
The CADA proposal would go beyond interoperability to promote open-source software in the public sector as a lever for technological sovereignty: access to source code aids auditability, reduces vendor lock-in and limits dependency on single suppliers. The relevant rules are Articles 41 to 44.
The "open source first" duty (Article 41)
Article 41, as proposed, provides that "the Union and Member States shall take the necessary measures to encourage Union entities and public sector bodies to use and facilitate the reuse of open standards and components released under an open source licence when building their cloud and AI ecosystem or stack, taking into account functionalities, including security, total cost, and other relevant, duly justified objective criteria."
Read carefully, this is an obligation to encourage, not a mandate to procure open source in every case. The balancing factors the source names are:
- Functionalities (including security): whether the solution meets the technical and security requirements. Note that, in the text, security is framed as part of functionalities rather than a separate criterion.
- Total cost: not just licence fees (which may be zero for open source) but implementation, maintenance, support and training.
- Other relevant, duly justified objective criteria: flexibility where a proprietary solution offers necessary capabilities not otherwise available.
The effect, as proposed, is to require public bodies to genuinely consider open-source options on these objective grounds rather than default to proprietary out of habit.
Share and reuse of public software (Article 42)
Article 42, as proposed, states: "When making software to which they hold intellectual property rights available for reuse under an open source licence, a Union entity or public sector body shall do so using a catalogue or repository that is connected to, and made accessible through, the EU OSS Catalogue referred to in Article 43."
This is conditional, not blanket: it bites only when a public body chooses to release software it owns for reuse. When it does, it cannot simply self-host on an isolated repository — the catalogue must connect to the central catalogue. Under Article 43, the Commission would provide and maintain the EU Open Source Solutions Catalogue (EU OSS Catalogue), hosted on the Interoperable Europe portal and accessible free of charge, and would decide on requests to connect a body's own catalogue. The aim is a "build once, reuse many" model that reduces duplication across the Union.
Comparison with default proprietary procurement
| Feature | Proprietary-first (default) | CADA open-source-first (Art 41) |
|---|---|---|
| Primary driver | Vendor support, familiarity, perceived ease. | Sovereignty, auditability, reduced lock-in. |
| Evaluation | Often licence cost and immediate function. | Functionalities (incl. security), total cost, other objective criteria. |
| Code access | Closed; at vendor discretion. | Open; independent audit and contribution possible. |
| Reuse of public software | No sharing obligation. | If released for reuse, must connect to the EU OSS Catalogue (Art 42). |
| Lock-in | Higher switching costs. | Mitigated via open standards and source access. |
As proposed, a procurement officer would need to weigh an open-source option on the Article 41 criteria before settling on proprietary; choosing proprietary should rest on objective grounds (e.g. better security, specific functional needs, lower total cost) rather than preference alone.
What this means for you
For public-sector procurement officers and IT decision-makers, CADA would bring concrete changes:
- Update procurement guidance. Revise internal policies to reflect the Article 41 duty, including evaluation criteria that weigh open-source factors such as auditability, community support and maintainability alongside the criteria the text names (functionalities including security, total cost, other objective criteria).
- Do real total-cost-of-ownership analysis. Compare bids beyond the licence line: integration, customisation, training and long-term support. Open source can be lower upfront but may need more in-house or third-party support.
- Plan for software reuse. If you commission custom software, decide early whether it can be released under an open-source licence. If you release it, Article 42 would require publishing via a catalogue connected to the EU OSS Catalogue — coordinate IP clearance and documentation with legal and IT.
- Engage the OSPO Network. Article 44 would have the Commission establish a network of Open Source Programme Offices (OSPO Network) to share best practice; public-sector and Union-entity OSPOs may request to join. Use it for guidance and templates.
Common misconceptions
- "CADA bans proprietary software."
- Correction: No. Article 41 requires encouraging open source by weighing it against proprietary options on objective criteria. Proprietary solutions remain available where objectively justified.
- "All publicly developed software must be open-sourced."
- Correction: No. Article 42 applies only when a public body chooses to make software it owns available for reuse. There is no blanket open-sourcing mandate — but if you do release it, it must go through the connected catalogue.
- "Open source is always cheaper."
- Correction: Licence costs are often lower, but total cost may be higher where significant internal resources are needed. Article 41 calls for a "total cost" assessment, not just initial price.
- "This only applies to large EU institutions."
- Correction: Article 41 covers "Union entities and public sector bodies," reaching national, regional and local authorities, not just central EU institutions.
Related
- CADA voluntary recognition vs mandatory procurement levels
- CADA Union added value criteria vs lowest-price procurement: what changes?
- CADA public-order-relevant vs ordinary cloud procurement
- Is CADA protectionist compared to the US open-market approach?
- Common procurement framework vs Member State procurement under CADA
This is general information about a draft EU regulation, not legal advice.