Summary Under the proposed Cloud and AI Development Act (CADA), the European Commission would act as a central purchasing body to aggregate demand for cloud, AI, and data centre services across the EU. Article 39(1) establishes a "deemed compliance" mechanism: when participating entities acquire services via Commission-led framework contracts or dynamic purchasing systems (DPS), they are legally considered to have fulfilled their obligations under Union public procurement law. Furthermore, Article 39(3) mandates that any contracting authority acting as an intermediary must ensure that downstream buyers strictly adhere to the contractual requirements established by the Commission, preventing the dilution of standards in the supply chain.

Detail

The proposed Cloud and AI Development Act (CADA), COM(2026) 502 final, introduces a novel procurement architecture designed to overcome market fragmentation and leverage the collective purchasing power of the Union. While Article 37 empowers the Commission to carry out procurement activities for itself, Union entities, and Member State contracting authorities, Article 39 defines the specific legal framework and consequences of this centralised approach.

The Legal Mechanism of Deemed Compliance

The cornerstone of the central purchasing body's role is the legal certainty it provides to national and local public authorities. Article 39(1) of the proposal states:

"A participating entity shall be deemed to have fulfilled its obligations under applicable Union public procurement law where it acquires supplies or services by means of contracts awarded by the Commission under this Chapter, including through framework contracts concluded by or dynamic purchasing systems operated by the Commission acting as a central purchasing body, or any ancillary support services referred to in Article 37."

This provision creates a "safe harbour" for public buyers. In standard procurement, a national authority must conduct a full tender procedure to ensure compliance with the Public Procurement Directives. Under CADA, if a Member State's authority chooses to purchase through a framework or DPS established by the Commission, it bypasses the need to run its own parallel tender. The Commission's rigorous selection process satisfies the legal requirements for the participating entity. This mechanism is designed to reduce administrative burdens, accelerate the deployment of critical cloud infrastructure, and ensure that public bodies can access sovereign cloud services without navigating complex national procurement hurdles.

The Flow-Down Obligation: Article 39(3)

While the Commission manages the upstream procurement, the proposal ensures that the integrity of the contract is maintained throughout the distribution chain. Article 39(3) addresses scenarios where a contracting authority acts as an intermediary, acquiring services from the Commission and subsequently providing them to other entities.

The text mandates:

"A contracting authority that has acquired data centre services, cloud computing services, software and AI systems from the Commission as a central purchasing body shall ensure, in its agreements with the contracting authorities it serves, compliance with any contractual requirements by which it is itself bound."

This "flow-down" clause is critical for maintaining the sovereignty and security standards defined in the CADA framework. If a national authority purchases a sovereign cloud service (e.g., one recognised at Union assurance level 3 or 4) from the Commission, it cannot subsequently re-procure or re-allocate that service to a local municipality under looser terms. The intermediary authority is legally bound to replicate the Commission's contractual requirements in its own agreements with downstream users. This prevents a "race to the bottom" where local bodies might inadvertently compromise on security or sovereignty standards due to a lack of procurement expertise or resources.

Procedural Flexibility and Dynamic Purchasing Systems

The proposal recognises that demand for cloud and AI services is dynamic and that new entrants may wish to join procurement frameworks after they have been established. Article 39(5) introduces a specific derogation from the standard Financial Regulation to facilitate this.

It allows participating entities to request the possibility to participate in a dynamic purchasing system (DPS) throughout its period of validity. This request must be approved by the Commission, subject to a strict cap:

"Such request shall be approved by the Commission provided that the cumulative requests do not exceed 50% of the initial estimated quantities of the envisaged purchases."

This provision ensures that the central purchasing mechanism remains agile. New Member States or public bodies can join an existing DPS without triggering a new full tender process, provided the volume of new demand does not fundamentally alter the scale of the original procurement (capped at 50% of the initial estimate). This balances the need for inclusivity with the need to protect the integrity of the initial tender and the expectations of the winning bidders.

Governance and the Steering Committee

The central purchasing activities are not unilateral decisions by the Commission. Article 38 establishes a Steering Committee composed of the Commission and representatives of participating Member States. This body is responsible for the strategic oversight of procurement activities, including approving the strategic direction of each procurement procedure before it is launched. While the Commission retains operational responsibility for launching procedures and awarding contracts, the Steering Committee ensures that the central purchasing body acts in alignment with the collective interests of the Union and its Member States.

What this means for you

For public-sector procurement officers, legal counsels, and IT directors in Member States, the central purchasing body mechanism under CADA offers a streamlined path to sovereign cloud adoption, but it comes with specific responsibilities.

  • Simplified Compliance: If your organisation participates in a Commission-led framework or DPS, you do not need to conduct a separate full-scale tender. Your compliance with Union public procurement law is "deemed" fulfilled under Article 39(1). This significantly reduces the time and legal risk associated with procuring complex digital services.
  • Strict Contractual Adherence: You cannot treat Commission-procured services as generic commodities. If you act as an intermediary, Article 39(3) requires you to enforce the exact contractual terms set by the Commission on any downstream users. You are the guardian of the sovereignty and security standards established at the central level.
  • Strategic Participation: You have the opportunity to join existing procurement frameworks even if you missed the initial launch. Under Article 39(5), you can request to join a DPS, provided the total volume of new participants does not exceed 50% of the initial estimated quantities. This allows for late entry without disrupting the market.
  • Collective Bargaining Power: By participating, you benefit from the aggregated demand of the entire Union. This allows the Commission to negotiate better pricing, stronger service levels, and more robust sovereignty guarantees than any single Member State could achieve alone.

Common misconceptions

"The Commission replaces national procurement authorities." Reality: No. The Commission acts as a central purchasing body only for participating entities that choose to join its frameworks. National authorities retain full autonomy to run their own separate procurements if they prefer. The "deemed compliance" benefit applies exclusively to those who opt into the Commission's centralised system.

"Once I buy from the Commission, I can resell the service however I like." Reality: Incorrect. Article 39(3) explicitly forbids this. If you acquire services from the Commission, you must ensure that your agreements with the entities you serve comply with all contractual requirements you accepted from the Commission. You cannot dilute security or sovereignty standards downstream.

"Any entity can join a dynamic purchasing system at any time without limits." Reality: There is a strict volume cap. Article 39(5) limits the admission of new participants to ensure the cumulative requests do not exceed 50% of the initial estimated quantities. This protects the economic balance of the original tender and the interests of the winning suppliers.

"The Commission makes all strategic decisions alone." Reality: While the Commission manages the operational procurement, Article 38 establishes a Steering Committee with representatives from Member States. This committee provides strategic oversight and must approve the strategic direction of procurement procedures before they are launched.

Related

This is general information about a draft EU regulation, not legal advice.