Summary Under the proposed Cloud and AI Development Act (CADA), the cross-border review period for the recognition of a cloud computing service provider's Union assurance level is 60 days. Once the evaluating national competent authority prepares a draft recognition decision, it must notify the competent authorities of all other Member States. These authorities then have 60 days to review the evidence and submit any reasoned objections or requests for clarification if they believe the draft decision does not comply with the criteria in Annex II. If no objection is raised within this period, the recognition is deemed accepted across the Union. As proposed, this mechanism ensures a harmonized single market while preventing fragmentation of sovereignty standards.

Detail

The proposed Cloud and AI Development Act (CADA) establishes a unified framework for recognizing cloud computing services that meet specific "Union assurance levels" (sovereignty and security criteria). A core pillar of this framework is the cross-border recognition mechanism, designed to ensure that a service recognized in one Member State is automatically valid throughout the EU. However, to maintain the integrity of these high standards, the proposal includes a mandatory consultation period where other Member States can scrutinize the decision.

This process is governed primarily by Article 17 of the CADA proposal. The procedure is triggered after the "evaluating national competent authority" (the authority in the Member State where the cloud computing service provider is established) has assessed the provider's application and evidence.

The 60-Day Cross-Border Review Mechanism

The core of the cross-border recognition process is detailed in Article 17(5). The evaluating authority has an initial 60 days from accepting an application to assess the evidence. If the authority determines that the evidence is sufficient and intends to recognize the service, it must follow the specific procedure outlined in Article 17(5)(a):

"prepare a draft recognition decision and notify, as soon as possible, the competent authorities of the other Member States for a 60-day review period to confirm its intended recognition of the cloud computing service across the Union as offering the applicable Union assurance level."

This notification is a critical procedural step. It must include the evidence referred to in paragraphs 3 or 4 of Article 17, which varies by assurance level:

  • Level 1: The EU statement of conformity.
  • Levels 2, 3, and 4: The audit report, the 'positive' audit opinion, and all evidence provided to the auditing organisation.

Rights of Other Member States: Reasoned Objections

During this 60-day review period, the competent authorities of other Member States are not passive observers. They possess a statutory right to scrutinize the draft decision to ensure consistency with EU-wide standards. Article 17(6) explicitly grants this power:

"During the review period referred to in paragraph 5, point (a), the national competent authority of another Member State may submit a reasoned objection or request for clarification to the evaluating national competent authority, where it considers that the draft recognition decision does not comply with the applicable Union assurance level set out in Annex II."

This mechanism serves as a vital safeguard against regulatory arbitrage or inconsistent application of the sovereignty criteria. If another Member State believes the evaluating authority has misinterpreted the criteria in Annex II (e.g., regarding data localisation, personnel citizenship, or cybersecurity certification) or that the evidence is insufficient, it can formally object. Crucially, the objection must be "reasoned," meaning it must provide specific, substantive grounds for why the draft decision fails to meet the harmonized EU criteria. It cannot be based on national preferences or unrelated policy goals.

Outcomes of the Review Period

The legal consequences following the 60-day review depend entirely on whether objections or requests for clarification are submitted:

  1. Silence Equals Acceptance (Automatic Recognition): If the 60 days pass without any submission, Article 17(7) applies:

    "Where no reasoned objection or request for clarification is submitted within the review period... the conclusions by the evaluating national competent authority shall be deemed accepted by all Member States, the evaluating national competent authority shall adopt the recognition decision and the audited service shall be recognised throughout the Union at the appropriate Union assurance level."

    In this scenario, the recognition becomes automatic and EU-wide. The service can then be marketed to public sector bodies across the Union.

  2. Request for Clarification: If a Member State requests clarification under Article 17(8), the evaluating authority must take due account of the request. It may ask the applicant for new information (which can suspend the clock as per Article 17(5)(b)) or confirm/modify its draft decision. If the requesting authority remains unsatisfied after clarification, it may then submit a reasoned objection.

  3. Reasoned Objection and Assessment: If a reasoned objection is submitted under Article 17(9), the evaluating authority must assess it. It can either maintain or revoke its original draft decision. The evaluating authority must inform all other competent authorities within 15 days of the end of the review period (or 15 days after receiving the objection following the clarification procedure).

  4. Escalation to the Commission (Binding Decision): If the evaluating authority intends to maintain its draft decision despite the objection, the objecting Member State can refer the matter to the European Commission under Article 17(10). The Commission will then assess the referral and can request information from the concerned authorities. Ultimately, the Commission adopts a binding decision determining whether the evaluating authority may adopt the recognition decision. This ensures a final, Union-level arbiter for disputes.

Implications for the Timeline

It is important to distinguish between the initial assessment period and the cross-border review period. The evaluating authority has 60 days to assess the application initially (Article 17(5)). If it decides to proceed with recognition, it triggers the additional 60-day review period for other Member States. Therefore, the total time from application acceptance to final recognition can be at least 120 days, excluding any suspensions for requesting further information or time taken for Commission referrals.

What this means for you

For in-house counsel, compliance officers, and cloud computing service providers (CSPs) aiming to serve the EU public sector, understanding this cross-border review period is essential for managing stakeholder expectations and planning go-to-market strategies.

  1. Plan for a Minimum 4-Month Timeline: Do not assume that once you submit your evidence to your home Member State's competent authority, recognition will be swift. Even if your home authority is efficient, the mandatory 60-day review by all other Member States creates a hard floor on the timeline. Factor this into your product launch or contract negotiation schedules. As proposed, the clock starts only after the draft decision is notified, adding a significant buffer to the initial 60-day assessment.

  2. Prepare for Scrutiny from All Member States: Your audit evidence or conformity statement will not just be reviewed by your home authority. Competent authorities in other Member States have the right to object if they believe the criteria in Annex II are not met. Ensure your documentation is robust, clear, and strictly aligned with Annex II to minimize the risk of objections. Ambiguity in evidence regarding data localisation, personnel citizenship, or third-country control is a common trigger for reasoned objections.

  3. Monitor for Requests for Clarification: If a Member State requests clarification under Article 17(8), respond promptly. Delays in providing additional information can suspend the review clock (Article 17(5)(b)), potentially extending the timeline significantly. The suspension cannot exceed 30 days in total unless justified by the nature of the information or exceptional circumstances. Proactive communication with your evaluating authority is key to keeping the process moving.

  4. Engage with Your Evaluating Authority: Since the evaluating authority is the primary point of contact, maintain close communication. If another Member State raises an objection, your authority will assess it. Being prepared to provide supplementary evidence or explanations can help your authority maintain its draft decision and avoid escalation to the Commission.

  5. Understand the Finality of Commission Decisions: If a dispute arises and is referred to the Commission under Article 17(10), the Commission's decision is binding. This adds a layer of legal certainty but also means that the final arbiter of cross-border disagreements is the European Commission, not the national courts of the objecting Member State. This centralization is designed to prevent market fragmentation.

Common misconceptions

  • "Recognition is automatic once my home country approves it." This is incorrect. While the home country's approval is the first step, it is not final until the 60-day cross-border review period has passed without objection, or any objections have been resolved. The recognition is only deemed accepted by all Member States after this period (Article 17(7)).

  • "Any Member State can block recognition for any reason." No. Objections must be "reasoned" and specifically based on the belief that the draft decision "does not comply with the applicable Union assurance level set out in Annex II" (Article 17(6)). Member States cannot object based on national preferences, protectionist motives, or unrelated criteria; the objection must be grounded strictly in the harmonized EU criteria.

  • "The 60-day review period is flexible." The 60-day period is a statutory deadline for other Member States to submit objections or requests for clarification. If they do not act within this period, the recognition is deemed accepted. However, the clock can be suspended if the evaluating authority requests further information from the applicant (Article 17(5)(b)), which can extend the overall timeline.

  • "Only the home country's authority matters." While the home country's authority (the "evaluating national competent authority") leads the process, the involvement of other Member States is integral. Their ability to object and request clarification ensures a level of harmonization and prevents "forum shopping" where providers might seek recognition in the Member State with the most lenient interpretation of the rules.

Related

This is general information about a draft EU regulation, not legal advice.