Summary Under the proposed Cloud and AI Development Act (CADA), the recognition of a cloud computing service provider as offering a specific Union assurance level is a Union-wide process, not a purely national one. If a national competent authority in one Member State disagrees with a draft recognition decision made by another, it cannot unilaterally block it. Instead, the process follows a strict three-stage escalation: a request for clarification, a reasoned objection, and finally, a referral to the European Commission. The Commission then issues a binding decision determining whether the recognition can proceed, ensuring uniform application of sovereignty criteria across the EU.

Detail

The proposed Cloud and AI Development Act (CADA), COM(2026) 502 final, establishes a harmonised framework for cloud sovereignty. A core feature of this framework is that once a cloud computing service is recognised by a national competent authority in the Member State of establishment, that recognition is valid across the entire Union. To prevent fragmentation and ensure that all recognised services strictly meet the cumulative criteria in Annex II, the proposal includes a robust dispute resolution mechanism detailed in Article 17.

This mechanism is designed to balance the efficiency of mutual recognition with the necessity of rigorous oversight. It ensures that no single Member State can unilaterally veto a recognition without Union-level scrutiny, while also preventing an evaluating authority from ignoring legitimate sovereignty concerns raised by peers. The procedure unfolds in three distinct stages: clarification, reasoned objection, and Commission referral.

Stage 1: Request for Clarification

The process begins when an evaluating national competent authority (the authority in the Member State where the provider is established) prepares a draft recognition decision. Under Article 17(5)(a), this draft is notified to the competent authorities of all other Member States, triggering a 60-day review period.

During this period, if a competent authority in another Member State believes the draft decision does not comply with the applicable Union assurance level, it does not immediately issue a veto. Instead, Article 17(8) provides a preliminary step: the authority may submit a request for clarification to the evaluating authority.

Upon receiving such a request, the evaluating authority must take due account of it. It has two primary options to resolve the concern at this stage:

  1. Confirm or modify its original draft decision based on the clarification provided.
  2. Request new information from the applicant provider. If this occurs, the 60-day review period is suspended. Article 17(8) explicitly links this to the suspension mechanism in Article 17(5)(b), allowing the suspension to last up to 30 days in total, unless justified by the nature of the information or exceptional circumstances.

If the requesting authority is satisfied with the outcome of the clarification, the process proceeds. However, if the concerns persist, the mechanism escalates.

Stage 2: Reasoned Objection

If the clarification process fails to resolve the disagreement, the requesting competent authority may escalate the matter by submitting a reasoned objection to the evaluating national competent authority. This is governed by Article 17(8) and Article 17(9). The objection must be submitted within the 60-day review period or following the conclusion of the clarification procedure.

Upon receiving a reasoned objection, the evaluating national competent authority is required to assess the objection. It faces two possible outcomes:

  1. Revoke the draft decision: If the evaluating authority agrees that the service does not meet the criteria, it revokes the draft decision. The recognition process halts, and the provider must address the identified non-compliances.
  2. Maintain the draft decision: If the evaluating authority determines that the objection is unfounded and that the service fully complies with the criteria, it maintains its original draft decision.

Crucially, Article 17(9) mandates that the evaluating authority must inform the competent authorities of all other Member States of its decision (whether to maintain or revoke) within 15 days after the end of the review period or within 15 days after receiving the reasoned objection.

Stage 3: Commission Referral and Binding Decision

The critical safeguard in the CADA framework occurs when the evaluating authority decides to maintain its draft decision despite a reasoned objection. In this scenario, the concerned national competent authority (the one that lodged the objection) has the right to refer the matter to the European Commission.

This referral power is established in Article 17(10). Once the matter is referred, the Commission assumes the role of the ultimate arbiter to ensure a uniform interpretation of the sovereignty criteria across the EU. The Commission's process involves:

  • Assessment of the Referral: The Commission reviews the conflicting positions, the evidence submitted by the evaluating authority, and the grounds for the objection.
  • Request for Information: To aid its assessment, the Commission may request relevant information from the national competent authorities concerned. Article 17(13) empowers the Commission to require authorities to provide this information "as soon as possible and within a reasonable period."
  • Formal Information Requests: When making such requests, the Commission must state the purpose, specify the required information, and set a deadline for provision, as outlined in Article 17(14).
  • Issuing a Binding Decision: The Commission adopts a binding decision determining whether the evaluating national competent authority may adopt the recognition decision.

This binding decision is final within the context of the recognition procedure. If the Commission determines that the evaluating authority may proceed, the recognition is adopted and becomes valid across the Union. If the Commission determines that the evaluating authority cannot proceed, the recognition is blocked. This mechanism ensures that the sovereignty framework remains consistent, preventing a "race to the bottom" or the fragmentation of the single market through divergent national interpretations.

What this means for you

For in-house counsel, compliance officers, and cloud computing service providers, understanding this dispute resolution mechanism is critical for managing timeline risks and evidence preparation.

1. Prepare for Cross-Border Scrutiny Your application for recognition is not evaluated solely by your home authority. During the 60-day review period, authorities in all other Member States examine your evidence. If your service targets sectors with high public order relevance (e.g., defense, justice, critical infrastructure), expect rigorous scrutiny from authorities in those specific jurisdictions. Ensure your documentation for Annex II criteria is robust enough to withstand challenges from any Member State.

2. The "Clarification" Phase is Your First Line of Defense If an objection arises, the first step is a request for clarification. Use this phase proactively. Work closely with the evaluating authority to provide additional evidence or explanations that address the concerns of the objecting authority. A successful clarification can resolve the dispute without escalating to a binding Commission decision, saving significant time and resources.

3. Commission Referrals Are Rare but High-Stakes A referral to the Commission indicates a fundamental disagreement on the interpretation of sovereignty criteria. If your case reaches this stage, engage with the Commission early. The Commission has the power to request additional information from you indirectly through the authorities. Ensure your legal team is prepared to provide comprehensive, timely responses to any information requests to avoid delays or negative outcomes.

4. Impact on Time-to-Market The recognition process includes strict deadlines (60 days for review, 15 days for notifications). However, the clarification phase can suspend the review period for up to 30 days (or longer if justified). A Commission referral can extend the timeline further, as the Commission must assess the referral and potentially request additional information. Factor these potential delays into your go-to-market strategy, especially if you are targeting public sector contracts that require specific Union assurance levels.

5. Evidence Must Be Unambiguous To avoid objections, ensure that your audit reports (for levels 2–4) or self-assessment statements (for level 1) leave no room for ambiguity. The criteria in Annex II are cumulative; failure to meet any single criterion can trigger an objection. For example, if your infrastructure is not exclusively located in the Union, or if your personnel do not meet the citizenship requirements for higher assurance levels, these are clear grounds for objection. Document compliance meticulously to preempt challenges.

Common misconceptions

Misconception 1: Any Member State can veto a recognition. Reality: No single Member State has a unilateral veto. An objection must be "reasoned," and it only triggers a review by the evaluating authority. If the evaluating authority maintains its decision, the objecting state must refer the matter to the Commission. The Commission, not the objecting state, makes the final binding decision.

Misconception 2: The Commission automatically sides with the objecting authority. Reality: The Commission conducts an independent assessment. It may side with the evaluating authority, the objecting authority, or require further clarification. Its decision is based on a uniform interpretation of the CADA criteria across the EU, not on political pressure from any single Member State.

Misconception 3: The process is purely administrative with no legal recourse. Reality: While the CADA proposal outlines an administrative procedure, the binding decision of the Commission is a legal act. Providers and authorities may have rights to judicial review under EU law, although the proposal emphasizes the efficiency of the administrative process. The Commission's decision is binding on the national authorities, ensuring legal certainty.

Misconception 4: Only the home Member State's authority matters. Reality: Because recognition is EU-wide, any Member State's authority can challenge the recognition if they believe the service does not meet the sovereignty criteria. This is particularly relevant for providers operating in sectors with cross-border public order implications.

Related

This is general information about a draft EU regulation, not legal advice.