Summary The Cloud and AI Development Act (CADA) proposal, COM(2026) 502 final, contains a numbering discontinuity in Article 2: the definitions jump from point (22) 'contracting authorities' to point (25) 'open source licence', omitting points (23) and (24). This appears to be a drafting artefact in the published proposal, not a substantive exclusion of any defined term. As CADA is only a proposal, in-house counsel should track the ordinary legislative procedure (2026/0138 (COD)) and rely on the final adopted regulation, not this draft anomaly, for compliance planning.

Detail

Article 2 of the proposed Cloud and AI Development Act (CADA) sets out the definitions that govern the interpretation of the whole regulation. As published in the Commission's proposal COM(2026) 502 final, the list runs sequentially from point (1) to point (22), then skips (23) and (24) and resumes at point (25), which defines 'open source licence'.

The end of the sequence in the proposal reads, verbatim:

(22) 'contracting authorities' means contracting authorities as defined in Article 2(1), point (1), of Directive 2014/24/EU; (25) 'open source licence' means open source licence as defined in Article 2, point (12), of Regulation (EU) 2024/903.

There is no point (23) or (24) in the published text. On its face this is a clerical discontinuity in the proposal stage. It does not indicate that points (23) and (24) are deliberately left blank, nor that any term is being excluded from the regulation's scope. In legislative drafting — especially in proposals that cross-reference many existing EU instruments — such gaps commonly arise when definitions are inserted, deleted or reordered during internal review before publication.

For context, most definitions in Article 2 are cross-references to existing EU law. For example, as proposed:

  • Point (1) defines 'cloud computing service' by reference to Directive (EU) 2022/2555 (the NIS2 Directive).
  • Point (3) defines 'AI system' by reference to Regulation (EU) 2024/1689 (the AI Act).
  • Point (25) defines 'open source licence' by reference to Regulation (EU) 2024/903 (the Interoperable Europe Act).

What points (23) and (24) might have contained is not recoverable from the published proposal, and any reconstruction would be speculation. The safe reading is simply that two numbers are absent from the list as published.

Because CADA is a proposal, the text remains subject to change throughout the ordinary legislative procedure (2026/0138 (COD)). The European Parliament and the Council will examine the proposal, and technical discontinuities of this kind are typically corrected — by renumbering or by filling the gap — in the final adopted text. The legal force of the definitions will rest on the version eventually published in the Official Journal, not on this draft.

What this means for you

For in-house counsel and compliance officers, the practical impact of the gap is negligible, but it is a useful reminder to track the live text rather than a snapshot.

  1. Do not build compliance frameworks on draft numbering. Your internal glossaries and compliance matrices should not try to reconstruct points (23) and (24). Flag the section as "pending final text" instead.
  2. Monitor the legislative procedure. The proposal is in the ordinary legislative procedure (2026/0138 (COD)). Amendments may renumber, add or delete definitions. Follow the file through the Parliament and Council, or via your legal-intelligence provider, for the final adopted text.
  3. Anchor on substance, not position. The substantive obligations for cloud computing service providers and public-sector bodies — such as the sovereignty framework in Article 16 or the procurement rules in Article 30 — turn on the content of the defined terms, not on their position in the list. Align your risk assessments with the meaning of each definition (for example, 'cloud computing service provider' in point (2)) rather than its number.
  4. Reconcile on adoption. Once the regulation is adopted, verify that every cross-reference in your contracts and internal policies maps to the final Article 2. If the final text fills (23) and (24) with new definitions, update your systems accordingly.

Common misconceptions

  • Misconception: the missing numbers mean certain terms are deliberately undefined.
    • Reality: the gap reads as a drafting artefact. No term is being affirmatively excluded by the absence of two numbers; the operative definitions are those actually present in the list.
  • Misconception: this error shows CADA is less rigorous than the AI Act.
    • Reality: the AI Act (Regulation (EU) 2024/1689) is an adopted law with a finalised text, whereas CADA is still a proposal. Technical discontinuities in proposals are common and say nothing about the eventual quality of the adopted regulation.
  • Misconception: the gap must be interpreted as a legal exclusion.
    • Reality: numbering gaps in a draft are not read as substantive exclusions. They are treated as clerical matters for the co-legislators to correct.

Official sources

Related

This is general information about a draft EU regulation, not legal advice.