Summary

  • Articles 29–30 of the proposed CADA create a risk-linked eligibility regime for public-sector cloud procurement within their stated scope. Article 32 does something different: in public procurement for innovative cloud services and AI systems, it requires non-price criteria for contribution to the European cloud and AI ecosystem, but expressly requires those criteria to remain contract-linked, constrained, disclosed, “ancillary and not decisive” in the award.
  • The most important accountability issue is therefore separation of decisions. Member States and Union entities classify activities and assurance needs; providers assemble conformity evidence; independent auditors assess levels 2–4; national competent authorities normally confer recognition; contracting authorities decide whether an Article 30 derogation is justified and, in Article 32 tenders, how published added-value criteria are scored. A later reviewer needs a record capable of testing each step on its own terms.

A procurement officer can face a deceptively simple situation. Two cloud offers both meet the minimum assurance requirement applicable to the public activity. One has passed the gate more comfortably, perhaps with extensive evidence about its Union-based operational arrangements. The other may offer a stronger technical proposition or price. A third consideration may be how much either tender contributes to Europe’s cloud and AI ecosystem.

CADA does not collapse those questions into one ranking. Under the Commission proposal, COM(2026) 502, assurance recognition is fundamentally about whether a service satisfies the conditions needed to be used in the relevant setting. Article 32’s “Union added value” is an award criterion for a narrower class of procurements. Passing the first test does not establish that a bidder should win the second; scoring well on the second does not cure failure at the first.

That distinction matters all the more because CADA remains a proposal. On 16 October 2026, the European Parliament’s procedure file for 2026/0138(COD) still records the measure as “Awaiting committee decision” under the ordinary legislative procedure. ITRE and IMCO are jointly responsible, and Parliament announced the committee referral on 17 September. None of the Commission text analysed here should therefore be presented as an operative EU procurement rule.

The Commission’s own CADA policy page places the proposal in a broader strategy of increasing European cloud and AI capacity, autonomy and resilience while keeping the market open to partners. That political objective explains why procurement appears on the demand side of the proposal. It does not, however, erase the legal distinctions the draft itself draws between risk assessment, recognition, derogation and award evaluation.

The assurance gate begins with the activity, not the tenderer

Article 29 starts upstream from procurement. Within one year of entry into force, and then every two years or whenever necessary, Member States and Union entities would have to assess public-sector activities that use or are expected to use cloud computing. The assessment identifies activities contributing to the preservation of public order in sectors covered by Annexes I and II of the NIS2 Directive and in specified fields including national security, internal security, external-border management, defence, justice and law enforcement.

For activities identified in this way, the assessor must determine whether Union assurance level 2, 3 or 4 is appropriate.

The relevant risk factors are substantive. Article 29 directs attention to the sensitivity, criticality and scale of non-personal data; the circumstances and rights risks surrounding personal-data processing; the risk and public-order impact of unlawful third-country access; and the consequences of possible service disruption. The unit of analysis is therefore the public activity and its exposure, rather than the nationality of a bidder considered in isolation.

Decision power is distributed. Member States and Union entities perform the assessments, but the Commission would specify the methodology, templates and relevant elements through implementing acts. That methodology must address use of the highest assurance level for the most critical public-sector activities. Member States must send assessment results to the Commission and identify departures from the implementing framework; if the Commission concludes that the level selected by a Member State is inappropriate or inadequate for the public-order concern, it may adopt an implementing act specifying the required level.

That is the first record an accountability system needs. A later reviewer should be able to reconstruct why this activity was classified as it was, what data and disruption scenarios were considered, which methodology was used, where national judgment departed from that methodology and, if the Commission intervened, why the higher or different level was considered necessary. Those record elements are an analytical implication of the proposed allocation of powers; CADA does not provide a single ready-made “accountability file” template for them.

Article 30 then converts risk classification into a procurement constraint. Its scope must be kept precise: it applies to contracting authorities procuring cloud computing services for their exclusive use, and expressly extends that rule to Union entities, subject to the Financial Regulation provision cited in Article 30(1). Within this scope, activities not identified under Article 29 as contributing to public order would use services recognised at Union assurance level 1. For identified activities in the listed sectors and fields, contracting authorities would be limited to services recognised at levels 2, 3 or 4.

This is an eligibility gate. It does not say that the highest-recognised bidder wins, nor that assurance recognition replaces the buyer’s ordinary assessment of price, functionality or other permissible award criteria. A recognised service has cleared a threshold relevant to the activity. It has not thereby acquired an entitlement to the contract.

The gate is also not absolute. Article 30(4) allows an exceptional, duly justified derogation where the subject matter cannot be supplied by a recognised service in the Article 22 repository and no adequate, reasonable or comparable alternative exists, provided the shortage was not produced by artificially narrowing the procurement parameters; where a similar procedure in the previous year produced no suitable tenders or participants; or where applying the requirements would entail disproportionate cost.

The governance consequence is significant. An Article 30 derogation is not a finding that the Article 29 risk has vanished. It is a buyer-side judgment that, despite the assurance requirement generated by the risk framework, specified procurement circumstances justify proceeding differently. The decision therefore needs its own evidence: what requirement could not be met, what alternatives were tested, what made them inadequate, what prior procedure failed, or how disproportionate cost was established. The proposal itself requires due justification but does not spell out that documentary architecture.

The European Data Protection Supervisor’s Opinion 14/2026 illustrates why this distinction is already attracting scrutiny. The EDPS recommends excluding or tightly conditioning and documenting the disproportionate-cost derogation for Article 30(3) activities. It further recommends requiring authorities invoking a derogation to identify the precise limb relied upon, document the steps taken and concrete evidence, manage and accept residual risk, notify the competent authority, and periodically recheck the market and repository. These are recommendations to the legislators, not requirements in the Commission proposal as it stands.

Recognition itself is another separate decision. Under Article 17, a cloud provider seeking a Union assurance level normally applies to the competent authority in its Member State of establishment. Level 1 rests on a provider conformity self-assessment and EU statement of conformity; for SMEs, that statement would be automatically recognised Union-wide without prior recognition by the national authority. Levels 2–4 are different: the provider must submit an independent audit report, a positive audit opinion and the evidence given to the auditor.

That distinction prevents a common analytical shortcut: not every recognised CADA service would have undergone an independent third-party audit. Levels 2–4 would; level 1 uses self-assessment, with the SME shortcut just described. For the audited levels, the provider pays for the audit, but the auditor does not itself grant regulatory recognition. The national authority evaluates the evidence, circulates a draft recognition to other Member States’ competent authorities, and deals with reasoned objections. If authorities cannot resolve a dispute, the matter may be referred to the Commission, which can issue a binding decision on whether the evaluating authority may recognise the service.

The proposal tries to manage the obvious incentive issue created by provider-funded audits without presuming misconduct. Auditing organisations must be independent and free of conflicts; specified related non-audit work is restricted; fees may not depend on the audit outcome; and auditors must demonstrate technical competence, objectivity and professional ethics. Reports must identify the scope, methodology, findings, third parties consulted and the positive or negative opinion, and explain aspects the auditor was unable to examine. Audited services then face annual review.

Nor is recognition meant to rest on a corporate assertion of “European sovereignty.” The proposal’s Annex III describes evidence such as company-registration material, premises and payroll records, precise infrastructure and data-storage locations, asset registers, network diagrams, deployment and configuration records, personnel records, access logs, support policies and data-flow diagrams. Annex III is explicitly indicative rather than exhaustive, and Article 21 requires evidence to be relevant, sufficient and reliable in the auditor’s professional judgment.

Recognition can subsequently change. The Commission would maintain a public central repository; audit or recognition revocations would remain published for five years; and providers must notify material changes that could affect an audit opinion or recognition. Auditors and national authorities then reassess whether their respective findings should be amended or revoked. Service recipients would also have a right, under Union and national law, to seek compensation for damage or loss caused by a provider’s infringement of its obligations under the relevant chapter.

That is not the same thing as an automatic right to recover every migration expense resulting from a policy or procurement decision.

The added-value score has a different and deliberately smaller job

Article 32 is not the second stage of Article 30. Its trigger is differently drafted: “public procurement procedures for innovative cloud computing services and AI systems.” In those procedures, contracting authorities must include non-price award criteria, as part of the tender’s quality evaluation, that enable assessment of the tenderer’s contribution to the development of a European cloud and AI ecosystem.

Four constraints immediately follow. The criteria must be linked to the subject matter of the contract; they must not give the contracting authority unrestricted freedom of choice; they must be expressly stated in the procurement documents or contract notice; and they must be “ancillary and not decisive in the award of the contract.” These are not incidental drafting details. They are the legal features that prevent Article 32 from becoming an unrestricted European-provider preference.

The substantive factors are likewise more precise than corporate origin. Buyers may evaluate the extent to which a tender strengthens the Union digital-technology supply chain, including Union-designed or manufactured software or hardware; integrates technologies developed in the Union, including results of EU-funded research; uses innovation that improves security of supply and the European ecosystem; and delivers the service, to the greatest extent feasible given market availability and technical requirements, using critical computing, storage and networking hardware designed or manufactured in the Union.

Where that last route is not feasible, Article 32 contemplates third-country hardware that contributes to security of supply and the European ecosystem.

This makes two simplifications untenable. First, Article 32 is not drafted as “EU-owned supplier equals points.” The evaluation must concern specified contributions and remain linked to the contract. Second, it does not state that a non-European-controlled company is incapable of making such a contribution. A bidder’s corporate control may matter elsewhere in CADA’s assurance architecture, depending on the level and circumstances, but Article 32’s award criteria have their own wording.

Article 18 even creates a route under which the Commission may identify associated third countries whose controlled providers can be audited against level-3 criteria, subject to a demanding list of conditions.

The evidence systems are also different. Annex II expressly says that hardware is outside the scope of the assurance criteria in Annexes II and III, even though Article 32 expressly refers to critical computing, storage and networking hardware origin in its added-value criterion. A buyer therefore cannot simply point to a service’s assurance recognition as proof that it satisfies an Article 32 hardware proposition. The tender needs evidence suited to the award criterion.

That is a useful example of why the gate and score must not be blended. The recognition file answers whether the audited service complies with the applicable assurance criteria. The Article 32 file must answer how this particular tender contributes to the ecosystem under the published criteria. Reusing factual evidence may be efficient, but reusing a conclusion is not necessarily legitimate.

Existing EU procurement law reinforces the distinction. Directive 2014/24/EU, where applicable, already structures award criteria around objective evaluation, constrains unrestricted discretion and requires contracting authorities to state the relative weighting of award criteria in the procurement documents, subject to the Directive’s rules. CADA’s Article 32 therefore sits within, rather than abolishes, the wider logic of transparent and reviewable tender evaluation.

The proposal nevertheless leaves a difficult interpretive question. Recital 67 says European added value should not decide the award and that technical and financial criteria directly connected to performance should retain primacy. It suggests that contracting authorities could consider a maximum weighting of 15 points out of 120 for European added value. That figure sits in a recital and is framed as an option, not as an operative statutory cap.

Nominal weight and actual decisiveness are not the same thing. Imagine two admissible tenders separated by three points on price and technical merit. An ancillary criterion worth ten points can still reverse their order. Article 32 does not explain whether “not decisive” means that Union added value may never be causally outcome-determinative in a close contest, or more broadly that it must not dominate the evaluation architecture or displace core performance criteria. That ambiguity is a governance issue because procurement officers must design a scoring model before bids arrive that can later survive review.

The EESC opinion adopted on 23 September 2026 takes an explicitly stronger demand-side position. It recommends giving the Article 32 criterion “significant weight” and, in its proposed amendment to recital 67, raising the illustrative allocation from 15 to 40 out of 120 points while retaining language that it should remain proportionate and subordinate to core award criteria. The Committee says the greater weight is intended to influence procurement outcomes more meaningfully. It is an institutional recommendation in the legislative process, not enacted law and not part of the Commission’s operative Article 32.

That recommendation sharpens rather than resolves the underlying problem. Forty points can still be described as a minority of the total, but it is plainly capable of affecting many rankings. If legislators want Article 32 both to alter demand materially and to remain “not decisive,” they may eventually need to say more clearly what non-decisiveness means in practice.

The accountability test is whether each decision can be reconstructed

CADA’s most important governance feature may therefore be its chain of distinct decision rights.

At the front of the chain, Member States and Union entities assess the public activity and select the necessary assurance level, under a Commission-defined methodology and subject to possible Commission intervention. The evidence is risk evidence: data sensitivity, public-order consequence, third-country access exposure and service-disruption impact.

Next comes service conformity. The provider bears responsibility for supplying evidence. At level 1 it self-assesses; at levels 2–4 an independent auditor tests the service, after which a national competent authority normally takes the recognition decision with cross-border review built into the procedure. The evidence is service-specific: establishment, operational location, control, personnel, data flows, software dependencies and other Annex II/III facts.

Then comes procurement eligibility. The contracting authority must establish that the service has the recognition required for the activity—or, exceptionally, record why Article 30(4) permits departure. The authority that invokes the derogation carries that procurement judgment even though it did not write the assurance criteria and may not have performed the underlying recognition audit.

Finally, where Article 32 applies, the contracting authority owns the award design and scoring decision. The tender documents must state the criteria; the buyer evaluates bid-specific evidence; and the criterion must remain ancillary. Unlike the levels 2–4 recognition process, Article 32 contains no separate central audit-and-recognition machinery for Union added-value claims. That places considerable importance on the precision of tender documents and the buyer’s evaluation record.

A strong ex-post file should therefore permit four separate questions: Was the activity classified rationally? Was the service genuinely recognised at the required level? Was any derogation actually within Article 30(4)? Did the award follow the disclosed Article 32 methodology without allowing the added-value criterion to swallow the core evaluation? Those are analytical review tests derived from the proposal’s distribution of authority, rather than additional statutory requirements invented outside it.

Continuity provides the most concrete reason to insist on that separation. If an Article 29 risk assessment requires migration to another cloud service, the proposal would require the Member State or Union entity to migrate within a reasonable transition period of no more than 12 months, taking account of technical feasibility, continuity and data portability. It must also consider whether a multi-vendor or multi-cloud strategy is appropriate. The text requires consideration; it does not mandate multi-cloud in every case.

The twelve-month provision should not be overextended. It expressly concerns migration required by the Article 29 risk assessment. Articles 22–23 separately contemplate later amendment or revocation of recognition, but the proposal does not simply say that every such revocation automatically receives the same twelve-month transition. That distinction may become operationally important because a public body can be contractually and technically dependent on a service even when the service’s formal eligibility changes quickly.

The costs are consequently distributed across actors. Providers fund higher-level audits and maintain conformity evidence; authorities fund risk assessment and procurement capability; buyers bear the practical work of transition planning; and disruption to public functions is experienced by administrations and the people relying on them. None of this implies bad faith by any participant. It means that the institution holding a formal decision right does not necessarily absorb all of the downside if the decision proves difficult to implement.

The EESC’s September opinion identifies a related institutional risk: erosion of the human and organisational ability to operate, supervise or restore public functions as reliance on digital systems deepens. It recommends adding that “absorption side” of technological adoption to monitoring and Article 29 risk assessment, including consideration of whether an entity retains independent human capacity to perform, verify or restore the supported function after loss or degradation of the service. Again, this is an EESC recommendation, not a requirement in the Commission text.

That idea supplies an important accountability distinction. Provider assurance is not institutional resilience. A service can comply fully with its recognised level while the customer has allowed its own architecture, documentation, staffing or operational knowledge to become too dependent on that service. Conversely, a buyer can maintain excellent exit capability without thereby proving that an unrecognised service satisfies an Article 30 gate. Both forms of resilience matter, but they answer different questions.

Article 33 would give policymakers some procurement-monitoring data if adopted. Member States would report annually on the size of participating economic operators, SME participation, contracts and value going to SMEs, available cross-border SME participation, and steps taken to improve access. The proposal also states an objective that at least 25% of Member States’ cloud and AI procurement be awarded to innovative SMEs. These indicators can reveal participation patterns; they cannot by themselves establish that buyers have multiple technically substitutable recognised services for a particular critical workload.

The difference between formal competition and usable alternatives is crucial. A repository containing many recognised services can coexist with a procurement in which only one service meets the actual technical requirement. Equally, a narrow eligible field does not by itself prove that the assurance gate is unjustified; it may reflect the risk standard CADA deliberately sets. Accountability requires observing both sides rather than assuming either that more recognition automatically creates resilience or that tighter qualification automatically destroys competition.

Primary sources: COM(2026) 502 on EUR-Lex; proposal text as transmitted to the Council; Annexes II–III; European Parliament procedure 2026/0138(COD); EESC opinion of 23 September 2026; EDPS Opinion 14/2026; Directive 2014/24/EU on public procurement; COM(2026) 502 proposal; CADA opinion adopted on 23 September 2026; Proposal library record; Proposal library record — Portuguese; Directive 89/665/EEC; Directive 2014/24/EU — Portuguese; Directive 2014/24/EU — German text; General Data Protection Regulation — German text; Digital Markets Act — German text; Digital Services Act — German text; Data Act — German text; COM(2026) 502 — German text; Directive 2014/24/EU — English; Directive 2014/24/EU — consolidated HTML; COM(2026) 502 — consolidated HTML; COM(2026) 502 — Portuguese; Legislative procedure 2026/138; Agency problem in internet governance — German; Working Party on Telecommunications and Information Society, September 2026; CADA commentary; Directive 2014/24/EU — Article 67 data.