Cloud and AI Development Act (CADA)

1. This Article applies to contracting authorities  that procure cloud computing services for their exclusive use. Without prejudice to Article 136 of Regulation (EU, Euratom) 2024/2509, this Article also applies to Union entities that procure cloud computing services for their exclusive use.

2. Union entities and public sectors bodies whose public sector activities have not been identified as contributing to the preservation of public order under the risk assessment referred to in Article 29(1) shall use cloud computing services that have been recognised under Article 17 as having a Union assurance level 1.

3. Contracting authorities, including the entities acting on their behalf, whose activities have been identified as contributing to the preservation of public order under Article 29(1) in sectors falling under Annex I or II of Directive (EU) 2022/2555 and in the areas of national security, internal security, external border management, defence, justice or law enforcement, including the prevention, investigation, detection and prosecution of criminal offence, shall only procure cloud computing services that have been recognised as having a Union assurance level 2, 3 or 4.

4. By derogation from paragraphs 2 or 3, on an exceptional basis and where duly justified, contracting authorities may decide not to procure cloud computing services recognised as having a Union assurance level 1, 2, 3, or 4 where one or more of the following circumstances applies:

(a) the subject matter of the tender cannot be supplied by recognised cloud computing services available in the central repository referred to in Article 22, and no adequate or reasonable alternative or comparable cloud computing service exists, and such absence is not the result of an artificial narrowing down of the parameters of the public procurement procedure;

(b) the contracting authority has launched a similar procurement process within the previous year but did not receive any suitable tenders or suitable participants;

(a) applying the requirements of this Regulation would require the contracting authority to procure services at disproportionate cost.

1. Entities referred to in Annex I of Directive (EU) 2022/2555 who are not public sector bodies may carry out similar assessments as those set out in Article 29.
2. The Commission may issue guidance on the methodology for carrying out the impact assessments under this Article and possible mitigation measures to be adopted by private sector entities operating in sectors of high criticality.
3. Where, because of specific circumstances, and where duly justified and in consultation with the Member States, the Commission concludes that entities who are not public sector bodies operating in sectors of high criticality require an impact assessment, the Commission may adopt delegated acts to supplement this Regulation in accordance with Article 45 specifying the need for such impact assessment and the risk mitigation measures that those entities who are not public sector bodies shall take.

1. In public procurement procedures for innovative cloud computing services and AI systems, contracting authorities shall include, as part of the quality evaluation of the tender, non-price award criteria that allow them to evaluate the tenderer’s contribution to the development of a European cloud and AI ecosystem.
2. When applying non-price award criteria under paragraph 1, contracting authorities shall ensure that non-price award criteria are:
   1. linked to the subject matter of the contract;
   2. not conferring unrestricted freedom of choice on the contracting authority;
   3. expressly set out in the procurement documents or in the contract notice;
   4. ancillary and not decisive in the award of the contract.
3. Without affecting contracting authorities’ discretion to apply additional criteria, the non-price award criteria referred to in paragraph 1 shall enable contracting authorities to evaluate the extent to which:
   1. the tenderer contributes to strengthening the digital technology supply chain in the Union, including the use of software or hardware designed or manufactured in the Union;
   2. the tenderer has integrated technologies developed in the Union, including research and development results stemming from Union funded research and development programmes and makes use of tools, such as standards, specification, software, models or other technology developed in the Union;
   3. the innovation required to deliver the service contributes to strengthening the security of supply and the development of a European cloud and AI ecosystem;
   4. the service is delivered, to the greatest extent feasible with regard to market availability and technical requirements, through critical computing, storage and networking hardware components designed and/or manufactured in the Union, or, where this is not feasible, through hardware components from a third country that contributes to strengthening the security of supply and the development of a European cloud and AI ecosystem.

1. Member States shall monitor and report on their use of procurement of innovation in cloud computing services and AI systems.
2. Member States shall take appropriate measures to ensure that the monitoring and reporting referred to in paragraph 1 are actively used to identify barriers to SMEs participation in procurement procedures, to improve access of SMEs to procurement markets, support the design of simplified, proportionate and SME-friendly procurement strategies, including division into lots, where appropriate, promote the participation of SMEs in the innovation procedure foreseen under Directive 2014/24/EU and pre-commercial procurement of cloud computing services and AI systems.
3. Based on the monitoring referred to in paragraph 1, Member States shall inform the Commission, on a yearly basis, of the following information:
   1. the size of the economic operators participating in such procurement;
   2. SMEs participation trends, including the number of contracts awarded to SMEs, their share of the total contract value, as a percentage, and, where available, the share of cross-border SMEs participation;
   3. measures taken to improve SMEs access to public procurement procedures.
4. Member States shall pursue as objective that at least 25% of their procurement for cloud computing services and AI systems be awarded to innovative SMEs. Member States shall include, in their national strategies referred to in Article 7, plans on how they intend to achieve this objective.
5. Union entities and contracting authorities shall promote:
   1. preliminary market consultations;
   2. matchmaking between public buyers and innovative solutions provided by European SMEs and start-ups;
   3. development of public contract clauses that are favourable for innovative SMEs.