Summary Under the proposed Cloud and AI Development Act (CADA), the recognition of a cloud computing service as offering a specific "Union assurance level" is a Union-wide process managed by the national competent authority of the provider's establishment. However, this process includes a critical cross-border safeguard: a 60-day review period during which other Member States may intervene. If a Member State submits a reasoned objection or a request for clarification believing the draft decision violates the assurance criteria, the evaluating authority must assess it. If the evaluating authority maintains its draft decision despite the objection, the objecting authority may refer the matter to the European Commission. The Commission then adopts a binding decision determining whether the recognition can proceed, ensuring uniform application of sovereignty standards across the EU.

Detail

The proposed Cloud and AI Development Act (CADA), COM(2026) 502 final, establishes a harmonised framework for recognising cloud computing services at four distinct Union assurance levels (Levels 1 to 4). A cornerstone of this framework is the principle of mutual recognition: once a service is recognised by the competent authority of the Member State where the provider is established, that recognition is valid across the entire Union. However, to prevent regulatory fragmentation and ensure that sovereignty criteria are applied consistently, the proposal introduces a robust dispute-resolution mechanism.

This mechanism is detailed in Article 17 of the proposal, specifically in paragraphs 6 through 10. It creates a structured pathway for Member States to challenge draft recognition decisions, ensuring that no single authority can unilaterally impose a recognition that fails to meet Union-wide standards.

The 60-Day Review Period: A Window for Scrutiny

The process is triggered when the evaluating national competent authority (the authority in the Member State of establishment) accepts an application for recognition. Under Article 17(5), the evaluating authority has 60 days to assess the evidence submitted by the cloud computing service provider.

If the authority determines that the evidence is sufficient, it prepares a draft recognition decision. Crucially, this decision is not yet final. The evaluating authority must notify the competent authorities of all other Member States of this draft decision. This notification initiates a 60-day review period.

During this window, the draft decision remains in a state of suspension. It is open to scrutiny by other Member States who may identify specific concerns regarding the service's compliance with the Union assurance levels set out in Annex II. This period is designed to allow for the exchange of information and the identification of potential cross-border risks before the recognition becomes effective Union-wide.

Reasoned Objections and Requests for Clarification

Article 17(6) explicitly empowers national competent authorities of other Member States to intervene during the review period. They may submit either a "reasoned objection" or a "request for clarification."

  • Request for Clarification: This is a preliminary step. If an authority believes the draft decision lacks sufficient detail or contains ambiguities, it may request clarification. The evaluating authority must take due account of such requests. If the request necessitates further information from the applicant, the 60-day review clock may be suspended for up to 30 days, as provided under Article 17(5)(b). If the requesting authority remains unsatisfied after the clarification is provided, it may then escalate the matter to a formal reasoned objection.
  • Reasoned Objection: This is a formal legal challenge. To be valid, the objection must be "reasoned," meaning the objecting authority must provide specific grounds explaining why it considers the draft recognition decision does not comply with the applicable Union assurance level criteria. Arbitrary or political objections without a basis in the technical or legal criteria of Annex II are not supported by the text of the proposal.

Assessment and Response by the Evaluating Authority

Once a reasoned objection is submitted, the evaluating national competent authority is not compelled to automatically reject the application. Instead, Article 17(9) mandates a specific assessment procedure. The evaluating authority must evaluate the objection and has two distinct options:

  1. Revoke the Draft Decision: If the evaluating authority agrees with the objection and concludes that the draft decision indeed fails to comply with the applicable assurance level, it must revoke its draft decision. In this scenario, the provider would need to address the identified non-compliance issues and potentially reapply.
  2. Maintain the Draft Decision: If the evaluating authority disagrees with the objection and maintains that the service meets all criteria, it may choose to maintain its original draft decision.

If the evaluating authority decides to maintain its draft decision, it must inform the competent authorities of the other Member States within 15 days after the end of the review period (or within 15 days after receiving the reasoned objection if it followed a clarification request). This notification confirms that the evaluating authority stands by its assessment despite the challenge.

Escalation to the European Commission: The Binding Decision

If the evaluating authority maintains its draft decision despite a reasoned objection, the dispute is not yet resolved. The objecting Member State retains a final right of appeal to the Union level. Under Article 17(10), the "concerned national competent authority" (i.e., the one that raised the objection) may refer the matter to the European Commission.

The Commission then assumes the role of the ultimate arbiter in this administrative process. Its tasks, as defined in Article 17(10), include:

  • Assessing the referral: The Commission reviews the arguments presented by both the evaluating authority and the objecting authority.
  • Requesting Information: The Commission has the power to request any relevant information from the national competent authorities concerned to ensure a complete factual basis for its decision.
  • Adopting a Binding Decision: The Commission adopts a binding decision determining whether the evaluating national competent authority may adopt the recognition decision.

This binding decision is final for the purposes of the recognition procedure. It serves two critical functions: first, it prevents a single Member State from blocking a recognition indefinitely without a higher-level legal determination; second, it prevents an evaluating authority from ignoring legitimate sovereignty concerns raised by other Member States. The decision ensures that the Union assurance framework remains uniform and that the "single market" aspect of CADA is not undermined by divergent national interpretations.

Timeline and Procedural Efficiency

The proposal imposes strict timelines to prevent market delays while ensuring due process. The initial assessment is 60 days. The cross-border review period is 60 days. If an objection is raised, the evaluating authority has 15 days to respond. While Article 17 does not explicitly quantify the timeline for the Commission to adopt its binding decision, the overall structure is designed to provide legal certainty. The mechanism ensures that disputes are resolved through a defined administrative channel rather than leaving providers in a state of indefinite limbo.

What this means for you

For in-house counsel, compliance officers, and legal teams at cloud computing service providers, understanding this objection mechanism is critical for managing risk, timelines, and market entry strategies in the EU.

1. Prepare for Union-Wide Scrutiny, Not Just Local Compliance

When you apply for recognition in your Member State of establishment, you are not merely satisfying a local regulator. Your application and the draft recognition decision will be visible to all other Member States. You must ensure your documentation for Union Assurance Levels 2, 3, or 4 (which require independent third-party audits) is robust enough to withstand scrutiny from authorities in other jurisdictions. These authorities may have stricter interpretations of sovereignty criteria, such as data localisation, third-country control, or personnel requirements. A "reasoned objection" from a Member State with a different regulatory culture could trigger a Commission-level dispute.

2. Monitor the 60-Day Review Period Rigorously

Once your evaluating authority notifies other Member States, you must begin tracking the 60-day review clock. If no communication of objection is received after 60 days, your recognition is deemed accepted by all Member States under Article 17(7). However, if an objection is raised, the process pauses. Be prepared for your evaluating authority to request additional information from you, which can suspend the timeline for up to 30 days under Article 17(5)(b). Have your legal and technical teams ready to provide rapid, evidence-based responses to these requests to avoid further delays.

3. Engage Early with the Evaluating Authority

If you anticipate that certain Member States may object—perhaps due to the geopolitical nature of your ownership structure, the location of your data centres, or the involvement of third-country subsidiaries—engage with your evaluating authority early. While the proposal does not mandate pre-notification consultations, a transparent dialogue can help the evaluating authority draft a more robust initial assessment. This proactive approach can help address potential concerns before they crystallise into formal "reasoned objections" that trigger the escalation process.

4. Understand the Stakes of Commission Intervention

If a dispute escalates to the Commission, the process becomes more formal and potentially public. The Commission's binding decision will not only resolve the specific case but may also set a precedent for similar cases across the Union. Ensure your submission to the evaluating authority includes all necessary evidence to support a favourable outcome at the Commission level, as the Commission will rely heavily on the information provided by the national authorities. A negative binding decision could effectively block your service from being recognised at that assurance level across the entire EU.

5. Impact on Market Launch Timelines

The possibility of objections and Commission referrals introduces a layer of regulatory uncertainty into your go-to-market timeline. You must factor in potential delays of several months if an objection is raised and escalated. Plan your commercial contracts, service level agreements (SLAs), and public procurement bids with public sector customers to account for this regulatory latency. Do not promise immediate Union-wide availability if your recognition is still subject to a potential cross-border dispute.

Common misconceptions

Misconception 1: An objection automatically blocks recognition.

  • Reality: An objection does not automatically stop the recognition process. The evaluating authority must assess the objection and can choose to maintain its draft decision. The process only halts if the evaluating authority revokes its decision or if the Commission intervenes to issue a binding decision.

Misconception 2: Any Member State can object for any reason.

  • Reality: The objection must be "reasoned" and based on the belief that the draft decision does not comply with the applicable Union assurance level criteria set out in Annex II. Arbitrary, political, or protectionist objections without a legal grounding in the CADA criteria are not supported by the text. The evaluating authority and the Commission will assess the validity of the reasons provided.

Misconception 3: The Commission acts as an appellate court.

  • Reality: The Commission's role under Article 17(10) is to adopt a binding administrative decision on whether the recognition can proceed. It is a dispute-resolution mechanism within the regulatory framework, not a judicial appeal to the Court of Justice of the EU. However, decisions taken by national authorities and the Commission remain subject to judicial review under general EU law principles.

Misconception 4: Only the objecting Member State can refer the matter to the Commission.

  • Reality: Article 17(10) states that "the concerned national competent authority" may refer the matter. This refers specifically to the authority that submitted the reasoned objection. The evaluating authority cannot unilaterally refer the matter to the Commission to bypass its own assessment; the escalation is triggered by the dissatisfaction of the objecting authority.

Misconception 5: The Commission's decision timeline is fixed.

  • Reality: While Article 17 sets strict deadlines for the national authorities (60 days for review, 15 days for response), it does not specify a fixed number of days for the Commission to adopt its binding decision. The timeline will depend on the complexity of the case and the information exchange required, though the principle of good administration suggests it should be concluded without undue delay.

Related

This is general information about a draft EU regulation, not legal advice.