Summary Under the proposed Cloud and AI Development Act (CADA), recognition of cloud services at Union assurance levels is a cross-border process. If a Member State objects to a draft recognition decision, the evaluating National Competent Authority (NCA) must reassess and decide whether to maintain or revoke its draft. If the objecting State remains unsatisfied and the evaluating NCA maintains its decision, the matter is referred to the European Commission. The Commission then adopts a binding decision determining whether the recognition may proceed (Article 17(10)). This mechanism ensures uniform application of sovereignty criteria across the EU.
Detail
The proposed CADA establishes a harmonised framework for recognising cloud computing services as offering Union assurance levels 1 through 4. While the application is submitted to the NCA of the Member State where the provider is established (the "evaluating national competent authority"), the final recognition is intended to be valid across the entire Union. To prevent fragmentation and ensure that sovereignty criteria are applied consistently, Article 17 of the proposal institutes a rigorous cross-border review and dispute resolution mechanism.
The 60-Day Review Period
Once the evaluating NCA accepts an application and prepares a draft recognition decision, it must notify the competent authorities of all other Member States. This notification initiates a 60-day review period (Article 17(5)(a)). During this window, other Member States have the opportunity to scrutinise the evidence submitted by the cloud computing service provider (CSP) and the evaluating NCA's assessment.
If a Member State believes the draft decision does not comply with the applicable Union assurance level criteria set out in Annex II, it may intervene. The intervention can take two forms:
- Request for Clarification: Asking for further information to resolve uncertainties.
- Reasoned Objection: Submitting a formal objection stating that the draft decision does not comply with the criteria.
Step 1: Handling Requests for Clarification
If the initial intervention is a request for clarification, the evaluating NCA must take this into account. It may request additional information from the CSP applicant. Crucially, Article 17(5)(b) allows the evaluating NCA to suspend the 60-day review period while waiting for this information. The suspension shall not exceed 30 days in total, unless it is justified by the nature of the information requested or by exceptional circumstances.
If the requesting Member State is not satisfied with the evaluating NCA's response to the clarification, it may escalate the matter by submitting a formal reasoned objection (Article 17(8)).
Step 2: Reassessment Following a Reasoned Objection
When a reasoned objection is submitted—either directly during the review period or following an unsatisfactory clarification process—the evaluating NCA is legally obligated to assess the objection. Under Article 17(9), the evaluating NCA must decide whether to:
- Maintain its original draft decision (if it believes the objection is unfounded); or
- Revoke its original draft decision (if it agrees with the objection).
The evaluating NCA must inform the competent authorities of all other Member States of its conclusion within 15 days after the end of the review period or within 15 days of receiving the reasoned objection, whichever is applicable (Article 17(9)).
Step 3: Referral to the European Commission and Binding Decision
The most critical phase of the dispute resolution process occurs if the evaluating NCA decides to maintain its draft decision despite the reasoned objection. In this scenario, the objecting Member State has the right to refer the matter to the European Commission (Article 17(10)).
Upon referral, the Commission assumes the role of the ultimate arbiter. Article 17(10) explicitly states:
"The Commission shall assess the referral and may request information from the national competent authorities concerned. The Commission shall adopt a binding decision determining whether the evaluating national competent authority may adopt the recognition decision."
This provision is the cornerstone of the CADA's sovereignty framework. It ensures that a single Member State cannot unilaterally block a recognition that the evaluating NCA deems compliant, nor can an evaluating NCA force a recognition that a significant number of Member States deem non-compliant. The Commission's decision is final and binding on the national authorities involved.
The Role of the CSP in Objections
While the dispute resolution mechanism is primarily inter-governmental (between NCAs and the Commission), the CSP is directly affected. The evaluating NCA may request further information from the CSP to address the concerns raised by the objecting Member State. The CSP must cooperate fully; failure to provide necessary evidence can lead to the suspension of the procedure or the rejection of the application. However, the CSP does not have a direct right to appeal to the Commission; the referral is strictly a right of the objecting Member State.
What this means for you
For legal counsel, compliance officers, and cloud service providers, understanding this objection mechanism is essential for managing regulatory risk and market entry timelines.
1. Anticipate Cross-Border Scrutiny Your application is not merely a domestic filing. It is subject to peer review by all 27 Member States. Ensure your evidence package (whether a self-assessment for Level 1 or an independent audit for Levels 2–4) is meticulously prepared and explicitly maps to every criterion in Annex II. Ambiguities in data localisation proofs, personnel citizenship verification, or supply chain transparency are the most likely triggers for objections.
2. Plan for Timeline Volatility While the standard assessment timeline is 60 days, the objection process introduces significant uncertainty. The 60-day clock can be suspended for up to 30 days (or longer if justified) to gather additional evidence (Article 17(5)(b)). Furthermore, the referral to the Commission under Article 17(10) does not have a statutory deadline in the text, meaning the resolution could take months. If your business case relies on a specific date for EU-wide recognition to bid on public contracts, build in a substantial buffer.
3. Prepare for the "Maintain and Refer" Scenario If an objection is raised, your evaluating NCA may choose to maintain its decision. This does not mean the objection is ignored; it means the dispute escalates to the Commission. Be prepared to provide additional technical or legal arguments to your evaluating NCA to help them defend their position during the Commission's assessment.
4. Understand the Limits of Your Influence You cannot directly petition the Commission to override an objection. The process is driven by the objecting Member State. Your leverage lies in ensuring your evaluating NCA has all the necessary evidence to robustly defend its draft decision. Proactive communication with your home NCA is your primary tool for navigating this process.
5. Monitor Commission Precedents The first few binding decisions adopted by the Commission under Article 17(10) will set critical precedents for how sovereignty criteria are interpreted. These rulings will clarify the boundaries of "third-country control," "personnel citizenship," and "data localisation." Stay informed on these decisions as they will shape the market landscape for all CSPs.
Common misconceptions
Misconception 1: An objection automatically blocks the recognition. Correction: No. A reasoned objection triggers a mandatory reassessment by the evaluating NCA. The evaluating NCA can maintain its decision if it finds the objection unfounded. The process only stalls if the evaluating NCA maintains the decision and the objecting Member State refers the matter to the Commission. Even then, the Commission may rule in favour of the recognition.
Misconception 2: The CSP can appeal an objection directly to the Commission. Correction: The CADA framework designates the dispute resolution process as a matter between National Competent Authorities. The CSP interacts with the evaluating NCA. It is the objecting Member State that holds the right to refer the matter to the Commission under Article 17(10). The CSP's role is to supply evidence to the evaluating NCA.
Misconception 3: The 60-day review period is a fixed, unchangeable deadline. Correction: The 60-day clock is subject to suspension. If the evaluating NCA requests further information from the CSP to address an objection or clarify evidence, the period is suspended for up to 30 days, or longer if justified by the nature of the information or exceptional circumstances (Article 17(5)(b)).
Misconception 4: Objections are only about technical cybersecurity. Correction: Objections can be based on any criterion in the Union assurance levels. This includes data localisation, personnel citizenship requirements, supply chain transparency, and the absence of third-country control. Sovereignty concerns under CADA extend far beyond technical cybersecurity to include legal and operational autonomy.
Related
- CADA Member State obligations: strategies, zones, NCAs and penalties
- How does an SME rely on EU-wide CADA level 1 recognition across Member States?
- How does a Member State set CADA penalties for cloud providers?
- How does a Member State include cloud and AI procurement in its CADA national strategy?
- How does a Member State designate a national competent authority under CADA?
This is general information about a draft EU regulation, not legal advice.