Summary As proposed in the Cloud and AI Development Act (CADA), the recognition procedure is time-bound to give providers commercial predictability. Under Article 17(5), the national competent authority (NCA) has 60 days to assess an application, suspendable for up to 30 days if it requests further information. A favourable assessment opens a 60-day cross-border review period in which other Member States may object; authorities then have 15-day notification windows for handling objections. For the audited tiers, recognition must be sustained by an annual audit review under Article 20(8). SMEs at Level 1 skip the assessment and review entirely (Article 17(3)).

Detail

The recognition timeline in Article 17 balances scrutiny with certainty. It applies whether the provider seeks Level 1 (self-assessment) or Levels 2–4 (independent audit), although SMEs at Level 1 are recognised automatically and so fall outside the clock.

The 60-day assessment window

The clock starts when the evaluating NCA accepts the application. Under Article 17(5), it then has 60 days to assess the evidence — the EU statement of conformity for Level 1, or the audit report and "positive" audit opinion for Levels 2–4. Within that window the authority may:

  1. Prepare a draft recognition decision if the evidence is sufficient, and notify the other Member States.
  2. Request further information if the evidence is insufficient. Article 17(5)(b) suspends the 60-day period from the date of the request until the information is received, capped at 30 days in total unless justified by the nature of the information or exceptional circumstances. This cap prevents indefinite delay but means total elapsed time can exceed 60 days.
  3. Reject the application — but only after giving the provider 30 days to comment in writing on the conclusions, which the authority must take due account of (Article 17(5)(c)).

The 60-day review period

If the authority prepares a draft recognition decision, it notifies the other Member States' authorities and a 60-day review period opens (Article 17(5)(a)). Three outcomes follow:

  • No objection: if no reasoned objection or request for clarification arrives within the 60 days, the conclusions are deemed accepted, the evaluating authority adopts the recognition decision, and the service is recognised throughout the Union (Article 17(7)).
  • Request for clarification: the evaluating authority must consider it and may seek new information (suspending time under Article 17(5)(b)) or confirm or modify its draft; an unsatisfied authority may then object (Article 17(8)).
  • Reasoned objection: the evaluating authority assesses it and either maintains or revokes its draft, informing the other authorities within 15 days of the end of the review period — or within 15 days of receiving the objection following the clarification procedure (Article 17(9)).

Escalation to the Commission

If the evaluating authority intends to maintain its draft over a reasoned objection, the concerned authority may refer the matter to the Commission. The Commission assesses the referral, may request information, and adopts a binding decision on whether recognition may be granted (Article 17(10)). This stops disputes from stalling the market indefinitely.

Annual audit reviews for Levels 2–4

Recognition at the audited tiers is not a one-off. Article 20(8) requires the audited provider to submit the audit report and the associated "positive" audit opinion annually to the same or a different auditing organisation, which assesses continued compliance with the Annex II criteria and may confirm, update or revoke the report and opinion. This annual cycle keeps the recognition valid.

Notification and transparency

Once recognised, the service is registered in the Commission's central repository by the NCA of establishment (Article 22(2)). If a recognition — or an audit report or opinion — is revoked, that revocation is published in the central repository and remains available there for five years (Article 22(3)).

Putting the periods together: a realistic end-to-end view

It is worth assembling these periods into a single picture, because the statutory deadlines are only part of the elapsed time. For an audited tier, the sequence is roughly: select a qualifying auditing organisation (Article 20(4)) and undergo the audit to obtain a "positive" opinion (Article 20) — time here is set by the audit, not by CADA — then submit; the evaluating authority's 60-day assessment begins on acceptance (Article 17(5)); that 60 days can be suspended for up to 30 days if information is requested; a draft decision opens a 60-day cross-border review (Article 17(5)(a)); and a clarification or objection adds 15-day notification windows and, if escalated, time for a binding Commission decision (Article 17(10)). Even a clean, uncontested application therefore spans well beyond 60 days once the pre-submission audit is counted. For a Level 1 SME, by contrast, recognition is immediate and Union-wide on issuing the EU statement of conformity (Article 17(3)). Build your commercial commitments and bid timelines around the realistic span, not the headline 60-day figure.

The deadlines bind the authority, not only the provider

A useful framing is that several of these periods are obligations on the authority designed to protect the provider from open-ended delay. The 60-day assessment, the 30-day cap on suspension (absent justification), the 30-day right to comment before rejection, and the 15-day notification windows all constrain how long an authority can take at each step, and the Commission tie-breaker stops a single objecting Member State from blocking a compliant service indefinitely. The deadlines that genuinely sit on you are the ones triggered by requests: respond promptly to a request for further information (or you extend your own suspension) and to a request for clarification during the review, and meet the annual review obligation under Article 20(8).

What this means for you

For CSPs, these deadlines drive project planning and commercial commitments.

  • Avoid triggering the suspension. The 30-day suspension cap for missing information can eat into your timeline. Submit a complete package — especially the audit evidence for Levels 2–4 — so the authority has no reason to stop the clock.
  • Plan for annual renewal. Treat the Article 20(8) annual review as a fixed item in your budget and compliance calendar. Missing it can lead to revocation of the audit opinion and, in turn, of the recognition.
  • Stay responsive during the review. During the 60-day cross-border review, answer clarification requests fast; delay extends the timeline.
  • Engage auditors early. For Levels 2–4, the quality of the audit report is decisive. A negative opinion blocks recognition, so make sure your auditing organisation understands the Annex II criteria.
  • SME advantage at Level 1. If you are an SME seeking Level 1, your EU statement of conformity is directly and automatically recognised in all Member States without prior NCA recognition (Article 17(3), second subparagraph) — bypassing both the 60-day assessment and the 60-day review.

Common misconceptions

"The 60-day assessment is a hard deadline regardless of delays." No. It can be suspended where the authority requests further information; even with the 30-day cap, total time from application to decision can exceed 60 days if documentation is incomplete.

"Recognition is permanent once granted." No. The audited tiers require an annual review (Article 20(8)), and recognition can be revoked at any time for intentionally or negligently supplied incorrect or misleading information (Article 17(11)).

"All assurance levels follow the same recognition timeline." No. Level 1 rests on self-assessment, and for SMEs it is automatic. Levels 2–4 require independent audits and run through the full Article 17 procedure.

"A single objection blocks recognition indefinitely." No. A reasoned objection triggers assessment; if the evaluating authority disagrees, the matter is referred to the Commission, which issues a binding decision (Article 17(10)).

Related

This is general information about a draft EU regulation, not legal advice.