Summary Under the proposed Cloud and AI Development Act (CADA), CADA recognition serves as a standardized, EU-wide signal that a cloud service meets specific, graded criteria for sovereignty. For public buyers, this recognition validates that a provider has satisfied cumulative requirements for data localization, personnel screening, and protection against third-country control, ranging from basic Union establishment (Level 1) to strict operational autonomy (Level 4). Crucially, recognition at Level 2 and above requires independent third-party audits, moving beyond self-declaration. This system allows procurement officers to align cloud purchases with the specific risk levels identified in their national sovereignty risk assessments, ensuring public order and operational resilience as proposed.

Detail

The Cloud and AI Development Act (CADA), as proposed in COM(2026) 502 final, introduces a Union cloud computing sovereignty framework designed to mitigate the risks associated with the EU's heavy reliance on third-country cloud providers. As proposed, this framework is built on four distinct Union assurance levels (Levels 1 through 4), each representing a graduated tier of protection against foreign interference, data exfiltration, and service disruption.

For public-sector buyers, CADA recognition is the formal mechanism that validates a cloud computing service provider's compliance with these tiers. It is not merely a self-declaration; it is a legally recognized status that allows providers to bid for and supply services to Union entities and public sector bodies across the EU.

The Four Assurance Levels: A Graded Shield

Article 16 of the CADA proposal establishes the scope of this framework, defining the four assurance levels and referring to Annex II for the specific cumulative criteria that providers must meet. These criteria become increasingly stringent as the level rises, creating a "ladder of sovereignty":

  • Union Assurance Level 1 (Baseline): This is the entry-level tier. It requires that the cloud computing service provider is established in the Union, that its infrastructure and assets (including those of subcontractors) are located in the Union, and that customer data remains exclusively within the Union. It also requires state-of-the-art cybersecurity standards and transparency regarding subcontractors. Crucially, if the provider is subject to the control of a third country, it must guarantee that no existing laws in that third country require the reporting of software vulnerabilities to foreign authorities before those vulnerabilities are known to be exploited. This level relies on a conformity self-assessment by the provider.
  • Union Assurance Level 2 (Substantial Protection): This level introduces stricter controls and independent verification. It requires that both the audited provider and its subcontractors are established in the Union, and that all infrastructure, assets, and personnel are located in the Union. It mandates that data generated by the service is not used to train AI systems operated by third countries. Additionally, it requires a European cybersecurity certificate of at least 'substantial' assurance (once available) or equivalent national certification. If the provider is subject to third-country control, it must demonstrate robust legal, technical, and organizational measures to prevent that control from restricting service delivery, accessing customer data, or disrupting service continuity.
  • Union Assurance Level 3 (High Protection): This level is designed for higher-risk public sector activities. It requires that all personnel, including those of subcontractors, are Union citizens (conditional on public body requirements for lower tiers, but mandatory here). It also requires that technical and operational support is performed exclusively within the Union by Union residents and parties not subject to third-country control. A key differentiator is that, as a general rule, providers and subcontractors at this level must not be subject to the control of a third country. Exceptions are only possible if the Commission has adopted a specific implementing act recognizing a third country as providing sufficient safeguards (under Article 18, correcting the draft's potential cross-reference slip to Article 19).
  • Union Assurance Level 4 (Maximum Protection): This is the highest level of assurance, intended for the most critical public order activities. It shares many criteria with Level 3 but requires a European cybersecurity certificate of at least 'high' assurance. It also imposes stricter software supply chain measures, requiring providers to demonstrate that no third country holds effective control over the design, development, and evolution of critical software components.

The Recognition Process: From Self-Check to Independent Audit

Article 17 outlines the mechanism for obtaining this recognition. A cloud computing service provider must submit an application to the national competent authority of establishment (the Member State where the provider has its main establishment).

  • For Level 1: Providers carry out a conformity self-assessment (Article 19) and issue an EU statement of conformity. This statement is submitted to the competent authority. Notably, for Small and Medium-sized Enterprises (SMEs), this statement is directly and automatically recognized in all Member States without prior recognition by the authority.
  • For Levels 2, 3, and 4: Providers must undergo independent third-party audits (Article 20). They must submit the audit report and a 'positive' audit opinion to the competent authority. The audit must be performed by an independent organization that meets strict independence and competence requirements.

Once the evaluating national competent authority accepts the application, it has 60 days to assess the evidence. It then notifies other Member States' competent authorities for a 60-day review period. If no reasoned objections are raised, the service is recognized throughout the Union at the applicable assurance level. This mutual recognition means a provider recognized in one Member State is valid across the entire EU, simplifying cross-border procurement for public buyers.

What This Signals to Public Buyers

For a public procurement officer, CADA recognition provides a clear, auditable signal of a provider's sovereignty posture:

  1. Graded Protection Against Foreign Control: The levels signal increasing degrees of insulation from extraterritorial legal reach. Level 1 offers basic data residency and establishment guarantees. Levels 2 and 3 add personnel and operational support localization, while Level 3 and 4 largely exclude third-country control, ensuring that foreign governments cannot legally compel the provider to access data or disrupt services.
  2. Independent Verification: From Level 2 upwards, the recognition is backed by independent third-party audits. This reduces the risk of greenwashing or inaccurate self-assessments, providing buyers with higher confidence in the provider's claims.
  3. Alignment with Risk Assessments: CADA requires Member States and Union entities to conduct risk assessments (Article 29) to determine which public sector activities contribute to the preservation of public order. Based on these assessments, buyers must procure services that match the required assurance level. For example, if a risk assessment determines that a specific health data processing activity requires high protection, the buyer must procure a service recognized at Level 2, 3, or 4.

What this means for you

As a public-sector procurement officer, CADA recognition changes how you evaluate cloud vendors:

  • Check the Central Repository: The Commission will maintain a central repository of recognized services (Article 22). Before issuing a tender, you should consult this repository to identify providers who have already achieved the necessary Union assurance level.
  • Align with Your Risk Assessment: You cannot choose an assurance level arbitrarily. You must refer to your Member State's or Union entity's risk assessment under Article 29. If your activity is deemed low-risk, Level 1 may suffice. If it involves national security or critical infrastructure, you may be mandated to use Level 3 or 4.
  • Simplify Cross-Border Procurement: Because recognition is Union-wide, you can confidently award contracts to providers established in other Member States, provided they hold the appropriate recognition. This fosters competition and reduces fragmentation.
  • Monitor for Changes: Providers have transparency obligations (Article 23) to report material changes that could affect their recognition. You should monitor the central repository for any revocations or downgrades in a provider's status.

Common misconceptions

  • "CADA recognition replaces national security clearances." While CADA provides a standardized sovereignty framework, it does not replace specific national security clearances required for handling classified information. Level 3 and 4 criteria mention that personnel may need national security clearance when handling classified information, but the CADA recognition itself is a separate, EU-wide certification of sovereignty criteria.
  • "Level 1 providers are completely free from third-country influence." Level 1 allows providers to be subject to third-country control, provided they guarantee that no laws in that third country require the premature reporting of software vulnerabilities. It does not fully insulate against all forms of third-country legal reach, which is why Levels 2–4 are required for higher-risk activities.
  • "Only EU-based providers can get recognized." While the provider must be established in the Union, CADA allows for the possibility of recognizing cloud computing services controlled from a third country if the Commission determines that the third country provides sufficient safeguards (Article 18). This is currently limited to Level 3 and requires a specific Commission decision.
  • "Recognition is permanent." Recognition is not permanent. Providers must undergo annual reviews of their audit reports (for Levels 2–4) and must notify authorities of any material changes. Competent authorities can revoke recognition if a provider no longer meets the criteria.

Related

This is general information about a draft EU regulation, not legal advice.