Summary The proposed Cloud and AI Development Act (CADA) establishes a Network of Open Source Programme Offices (OSPO Network) to ensure the "effective and consistent implementation across the Union" of open-source obligations. As proposed in Recital 84, this network is designed to coordinate existing and future Open Source Programme Offices at local, regional, national, and EU levels. Its primary function is to facilitate the exchange of information, best practices, and guidance on the assessment, sharing, and reuse of software, thereby preventing fragmentation in how public sector bodies adopt open-source solutions.

Detail

The proposed Cloud and AI Development Act (CADA), COM(2026) 502 final, introduces a comprehensive framework to strengthen Europe's cloud and AI ecosystem. A critical component of this framework is the promotion of open source as a lever for technological sovereignty, security, and innovation. To operationalise this, Article 44 of the proposal establishes a Network of Open Source Programme Offices (the "OSPO Network").

The Legislative Rationale: Recital 84

The necessity for a coordinated network is explicitly articulated in Recital 84 of the proposal. The recital states that "in order to ensure effective and consistent implementation across the Union of the obligations to conduct an open-source assessment and to make software available for reuse, it is necessary to set up a network of open-source programme offices."

Without such a network, the proposal anticipates that Member States and Union entities might develop divergent approaches to open-source governance. This fragmentation could hinder the cross-border sharing of software and create unnecessary administrative burdens. The OSPO Network is therefore the structural mechanism intended to harmonise practices, ensuring that the obligations under Article 41 (promoting open source) and Article 42 (sharing and reuse) are applied consistently.

Composition and Voluntary Participation

The OSPO Network is designed as an inclusive, multi-level governance structure. Under Article 44(2), participation is voluntary. The text specifies that "Open Source Programme Offices established by public sector bodies at local, regional or national level in a Member State, and those established by Union entities, may request from the Commission to join the OSPO Network."

This voluntary nature acknowledges that not all public sector bodies currently have dedicated OSPOs. However, by creating a formal channel for those that do (or those planning to establish one) to connect, the proposal aims to build a critical mass of expertise. The network bridges the gap between local municipalities, national administrations, and EU institutions, allowing insights from the ground level to inform broader strategies and vice versa.

Core Tasks and Functions

Article 44(3) delineates four specific tasks for the OSPO Network, which are strictly defined to support, rather than enforce, the regulatory framework:

  1. Facilitating Exchange of Information and Best Practices: The network serves as a forum for Member States and the Commission to exchange information, experience, and best practices. This includes discussing "common technical, legal and organisational challenges, including those related to licensing, security, maintenance and procurement of open-source software." By centralising these discussions, the network helps public bodies avoid repeating mistakes and accelerates the adoption of proven solutions.
  2. Promoting Sharing and Reuse: A primary objective is to actively "promote the sharing and reuse of open-source software by public sector bodies." This aligns with the broader CADA goal of reducing vendor lock-in and maximising the value of public expenditure by ensuring that software developed with public funds is available for reuse by others.
  3. Developing Guidance and Templates: On a "voluntary and non-binding basis," the network contributes to the development of "guidance, templates or recommendations on the sharing and reuse of open-source software." This task is crucial for standardising the practical application of CADA's obligations, providing public bodies with ready-to-use tools for compliance.
  4. Collaboration on Projects: The network facilitates the collaboration on and exchange of "open-source projects of common interest to Union entities and public sector bodies." This encourages joint development efforts, potentially leading to shared, high-quality software solutions that benefit the entire EU public sector.

The Commission's Coordinating Role

The European Commission acts as the central hub for the OSPO Network. Article 44(4) mandates that "The Commission shall support and coordinate the OSPO Network." This ensures that the network has the necessary administrative backing and strategic direction.

Furthermore, Article 44(5) imposes a specific operational requirement on the Commission: it "shall convene and chair a meeting of the members of the OSPO Network at least twice a year." The proposal explicitly notes that "The meetings of the OSPO Network may be organised online," ensuring that geographical distance does not hinder participation and that the network remains accessible to all members across the Union.

Connection to Other CADA Open-Source Measures

The OSPO Network does not operate in isolation; it is the operational engine supporting other key provisions in Title IV, Chapter V of the proposal:

  • Open Source Assessment (Article 41): Article 41 requires Union entities and public sector bodies to "encourage and facilitate their use of open-source solutions" when building their cloud and AI ecosystems. The OSPO Network supports this by providing the technical and legal guidance necessary to conduct these assessments effectively.
  • Software Reuse and the EU OSS Catalogue (Articles 42 & 43): Article 42 obliges public bodies making software available for reuse to do so via a catalogue connected to the EU Open Source Solutions Catalogue (established under Article 43). The OSPO Network facilitates the practical implementation of this requirement by promoting the sharing of software and helping bodies understand how to connect their repositories to the central EU catalogue.

What this means for you

For public-sector leaders, procurement officers, and IT managers, the OSPO Network represents a significant new resource for navigating the open-source landscape under the proposed CADA.

  • Access to Standardised Best Practices: If your organisation has an OSPO or is in the process of establishing one, joining the network provides a formal channel to share experiences and learn from peers across the EU. This is particularly valuable for resolving complex issues related to open-source licensing, security audits, and maintenance strategies.
  • Ready-to-Use Templates: Through the network's task of developing guidance, your organisation may gain access to standardised templates for open-source assessments and software reuse policies. This can significantly reduce the administrative burden of creating these frameworks from scratch, ensuring compliance with CADA's requirements more efficiently.
  • Strategic Alignment: The network helps ensure that your local or national open-source initiatives are aligned with broader EU strategies. This alignment can facilitate cross-border collaboration on open-source projects of common interest, potentially unlocking new opportunities for joint development and cost-sharing.
  • Voluntary but Strategic: While joining the network is not mandatory, participation is strategically advantageous for entities aiming to maximise the benefits of CADA's open-source provisions. It offers a structured way to stay updated on regulatory developments, technical standards, and emerging best practices in the EU public sector.

Common misconceptions

"The OSPO Network is a regulatory enforcement body." No. The OSPO Network is not an enforcement authority. Its role is strictly supportive and coordinative, focusing on the exchange of best practices and the development of voluntary guidance. It does not have the power to impose penalties or directly enforce compliance with CADA's open-source obligations. Enforcement remains the responsibility of national competent authorities and the Commission under other provisions of the regulation.

"All public sector bodies must join the OSPO Network." Participation is voluntary. While Article 44 encourages the establishment of OSPOs and their participation in the network, there is no mandatory requirement for every local, regional, or national authority to join. However, those that do join contribute to a more cohesive and effective EU-wide open-source ecosystem.

"The OSPO Network creates binding legal standards." The guidance, templates, and recommendations developed by the network are explicitly "voluntary and non-binding" under Article 44(3). They serve as practical aids to help public bodies implement the regulation but do not have the force of law. The legal obligations remain defined by the articles of CADA itself, such as the requirements for open-source assessments and software reuse.

Related

This is general information about a draft EU regulation, not legal advice.