TITLE IV / Chapter I – Cloud computing sovereignty framework (Art. 16-28)
Art. 16 Cloud and AI Development Act - Scope arrow_right_alt
- This Chapter establishes a Union cloud computing sovereignty framework comprising four Union assurance levels, the criteria for which are set out in Annex II, that cloud computing service providers shall meet in order to provide their cloud computing services to Union entities and public sector bodies.
- The Commission is empowered to adopt delegated acts in accordance with Article 45 to amend the Union assurance levels set out in Annex II and the evidence set out in Annex III.
- To ensure Annex II and Annex III remain up to date with new legal or technical developments, the Commission shall review them at least every 18 months.
Art. 17 Cloud and AI Development Act - Recognition of cloud computing service providers arrow_right_alt
- A cloud computing service provider that aims to be recognised as offering a Union assurance level, shall submit an application for recognition to the national competent authority of establishment. When submitting an application for recognition, the cloud computing service provider shall include all the relevant evidence required under paragraphs 3 or 4.
- The competent authority of establishment shall be the evaluating national competent authority. An evaluating national competent authority that has received an application for a candidate recognition, may, where necessary, request one or more competent authorities of the other Member States to collaborate in the procedure for a candidate recognition under this Article. Within 15 days of receiving such a request, the national authority that has received a request for collaboration shall either provide confirmation that it agrees to collaborate with the evaluating national competent authority or refuse the request.
- For Union assurance level 1, the candidate cloud computing service provider shall submit to the evaluating national competent authority the EU statement of conformity referred to in Article 19(2) and all the necessary evidence.
By way of derogation from the first subpragraph, the EU statement of conformity issued under Article 19(2) by cloud computing service providers that are SMEs shall be directly and automatically recognised in all Member States without the need for prior recognition by the evaluating national competent authority. - For Union assurance levels 2, 3 and 4, the candidate cloud computing service provider shall submit to the evaluating national competent authority the audit report, the ‘positive’ audit opinion referred to in Article 20 and all the evidence provided to the auditing organisation during the audit procedure.
- Within 60 days of accepting an application pursuant to paragraph 1, the evaluating national competent authority shall assess the evidence submitted pursuant to paragraphs 3 or 4 and shall either:
- prepare a draft recognition decision and notify, as soon as possible, the competent authorities of the other Member States for a 60-day review period to confirm its intended recognition of the cloud computing service across the Union as offering the applicable Union assurance level. The notification to the competent authorities of the other Member States of the review period shall include the evidence referred to in paragraphs 3 or 4; or
- where the evidence submitted is insufficient to allow the evaluating competent authority to recognise the cloud computing service, it may request further information from the applicant and request that the applicant submit such information within a specified time limit. The period of 60 days referred to in this paragraph shall be suspended from the date of issue of the request until the date the information is received. The suspension shall not exceed 30 days in total unless it is justified by the nature of the information requested or by exceptional circumstances; or
- reject the request for recognition. Prior to rejecting the request for recognition, the evaluating competent authority shall give the candidate cloud computing service provider the opportunity to provide written comments on the conclusions of the evaluation within 30 days. The evaluating competent authority shall take due account of those comments when finalising its conclusions.
- During the review period referred to in paragraph 5, point (a), the national competent authority of another Member State may submit a reasoned objection or request for clarification to the evaluating national competent authority, where it considers that the draft recognition decision does not comply with the applicable Union assurance level set out in Annex II.
- Where no reasoned objection or request for clarification is submitted within the review period referred to in paragraph 5, point (a), the conclusions by the evaluating national competent authority shall be deemed accepted by all Member States, the evaluating national competent authority shall adopt the recognition decision and the audited service shall be recognised throughout the Union at the appropriate Union assurance level.
- Where a request for clarification is submitted within the review period referred to in paragraph 5, point (a), the evaluating national competent authority shall take due account of such request and, where applicable, request new information from the applicant as per paragraph 5, point (b) or confirm or modify its original draft decision. Where the requesting competent authority is not satisfied, it may submit a reasoned objection.
- Where a reasoned objection is submitted within the review period referred to in paragraph 5, point (a), or following the procedure referred to in paragraph 8, the evaluating national competent authority shall assess the objection and shall either maintain or revoke its original draft decision. The evaluating national competent authority shall inform the competent authorities of the other Member States within 15 days after the end of the review perioed referred to in paragraph 5, point (a), or within 15 days after receiving the reasoned objection following the procedure referred to in paragraph 8, whichever is applicable.
- In case the evaluating national competent authority intends to maintain its draft decision, the concerned national competent authority may refer the matter to the Commission. The Commission shall assess the referral and may request information from the national competent authorities concerned. The Commission shall adopt a binding decision determining whether the evaluating national competent authority may adopt the recognition decision.
- The evaluating national competent authority may revoke its recognition where it finds that a cloud computing service provider, whose service was recognised across the Union as providing a specific Union assurance level, intentionally or negligently, supplied incorrect or misleading information.
- The Commission may adopt implementing acts concerning the practical arrangements for the procedures referred to in this Article. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 46(2).
- The Commission may, in order to carry out the tasks assigned to it under paragraph 10 , require that national competent authorities of establishment provide, as soon as possible and within a reasonable period, any relevant information relating to the concerned cloud computing service provider and the application for recognition.
- When sending a request for information, the Commission shall state the purpose of the request, specify what information is required and set the period within which the information is to be provided.
Art. 18 Cloud and AI Development Act - Associated third countries arrow_right_alt
- The Commission may adopt decisions, by means of implementing acts, identifying third countries for which cloud computing service providers subject to the control of that third country or a legal entity established in that third country may be audited against the criteria for Union assurance level 3 pursuant to Annex II, provided that that third country fulfils the following cumulative criteria:
- it is subject to a relevant adequacy decision adopted under Article 45 of Regulation (EU) 2016/679;
- it has no measures in place that enable it to exercise control over the cloud computing service provider in a way that would conflict with the requirements for lawful access to non-personal data set out in paragraphs 2 and 3 of Article 32 of Regulation (EU) 2023/2854;
- it has no measures in place to compel the cloud computing service provider to degrade or disrupt service continuity or provision. It also has no measures in place to oblige the cloud computing service provider to implement, enforce, give effect to, or comply with restrictive measures such as sanction regimes, embargoes, or any equivalent legal or administrative measures, unless these specific measures are legitimate under the national laws of Member States or Union law;
- it has no measures in place to impede the provision of state-of-the-art technologies and services provided by the cloud computing service provider;
- it maintains an open market to Union cloud computing services;
- the third country grants equivalent levels of access to public procurement procedures of cloud computing services subject to the control of a Union Member State or entity or a legal entity established in the Union.
Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 46(2)
- Where available information reveals that the third country no longer fulfils the requirements under paragraph 1, the Commission shall repeal, amend or suspend the decision referred to in paragraph 1.
- The Commission shall publish on its website a list of third countries that fulfil the requirements under paragraph 1 and those that no longer do so.
Art. 19 Cloud and AI Development Act - Conformity self-assessment arrow_right_alt
- Cloud computing service providers seeking recognition in accordance with Article 17 as offering Union assurance level 1, shall carry out a conformity self-assessment of compliance with the criteria for Union assurance level 1 set out in Annex II.
- Following the self-assessment referred to in paragraph 1, the cloud computing service provider shall issue an EU statement of conformity stating that compliance with the criteria for Union assurance level 1 have been demonstrated. By issuing such a statement, the cloud computing service provider shall assume responsibility for the compliance of the cloud computing service with the criteria for Union assurance level 1set out in Annex II.
- The cloud computing service provider shall make the EU statement of conformity publicly available.
Art. 20 Cloud and AI Development Act - Independent audit arrow_right_alt
- Cloud computing service providers seeking recognition in accordance with Article 17 as offering Union assurance level 2, 3, or 4, shall undergo at their own expense, independent third-party audits to obtain an audit report and an audit opinion from an auditing organisation. An audited provider undergoing an audit procedure at a higher Union assurance level shall satisfy all the applicable cumulative criteria under Annex II applicable to the lower Union assurance levels. Failure to meet any requirements of a lower assurance level shall preclude conformity with the higher Union assurance levels.
- Audited providers shall cooperate with auditing organisations and provide them assistance necessary to enable them to conduct those audits in an effective, efficient and timely manner, including by giving them access to all relevant data and premises and by answering oral or written questions. Audited providers shall refrain from hampering, unduly influencing or undermining the performance of the audit.
- Auditing organisations shall ensure an adequate level of confidentiality and professional secrecy in respect of the information obtained from the audited providers and third parties as part of the audits, including after the audits have ended. That requirement shall not adversely affect the performance of the audits and other provisions of this Regulation. Under Article 23, the auditing organisation shall only share information that are necessary for the reporting purposes and do not contain any information that could reasonably be considered confidential.
- Audits referred to paragraph 1 shall be performed by auditing organisations that:
- are independent from, and do not have any conflicts of interest with, the cloud computing service provider concerned, and any legal person connected to that provider, in particular:
- have not provided non-audit services related to the matters audited to the cloud computing service provider concerned or to any legal person connected to that provider in the 12-month period before the beginning of the audit, and have committed to not providing them with such services in the 12-month period after the completion of the audit;
- have not provided auditing services pursuant to this Article to the cloud computing service provider concerned or any legal person connected to that provider in the 10-year period before the beginning of the audit;
- are not performing the audit in return for fees that are contingent on the result of the audit;
- have proven expertise, technical competence and capabilities in auditing cloud computing services;
- have proven objectivity and professional ethics, based in particular on adherence to codes of practice or appropriate standards.
- are independent from, and do not have any conflicts of interest with, the cloud computing service provider concerned, and any legal person connected to that provider, in particular:
- Auditing organisations that perform the audits shall prepare an audit report for each audit. That report shall be substantiated, in writing, and shall include at least the following:
- the name, address and point of contact of the provider subject to the audit, and the period covered;
- the name and address of the auditing organisation or organisations performing the audit;
- a declaration of interests;
- a description of the specific aspects audited, and the methodology applied;
- a description and a summary of the main findings drawn from the audit;
- a list of the third parties consulted as part of the audit;
- a ‘positive’ or ‘negative’ audit opinion and any information on whether the audited service of the audited provider complies with the applicable audit criteria for Union assurance level 2, 3 or 4 pursuant to Annex II;
- where the audit opinion is ‘negative’, operational recommendations on specific measures to achieve compliance and the recommended timeframe to achieve compliance;
- where the audit opinion is ‘positive’, the Union assurance level that needs to be recognised under Article 17, issued to the audited service of the audited provider pursuant to the applicable criteria set out in Annex II.
- Where the auditing organisation was unable to audit certain aspects or to express an audit opinion based on its investigations, the audit report shall include an explanation of the circumstances and the reasons why those aspects could not be audited.
- The auditing organisation may revoke its audit report and audit opinion where the audited provider, intentionally or negligently, supplied incorrect or misleading audit evidence.
- The audited provider shall annually submit for review the audit report and the associated ‘positive’ audit opinion to the same or a different auditing organisation which shall assess the continued compliance of the audited service with the applicable criteria set out in Annex II. On the basis of the annual review, the auditing organisation may confirm, update, or revoke the initial audit report and audit opinion.
- The Commission is empowered to adopt delegated acts in accordance with Article 45 to supplement this Regulation by laying down rules on the performance of audits on the procedural steps, rules for auditing organisations and their technical competences, auditing methodologies and templates for the audit reports.
Art. 21 Cloud and AI Development Act - Content and quality of audit evidence arrow_right_alt
- To prepare the audit report and audit opinion, the auditing organisation shall assess the compliance of the audited service with the criteria set out in Annex II on the basis of the audit evidence listed in Annex III. The Commission is empowered to adopt delegated acts in accordance with Article 45 to amend Annex III by laying down the necessary evidence needed to assess the audit criteria under Annex II.
- The audit evidence shall be:
- relevant and sufficient to enable the auditing organisation to prepare an audit report and provide an audit opinion; and
- reliable, according to the auditing organisation’s professional judgment and scepticism.
Art. 22 Cloud and AI Development Act - Central repository of cloud computing services arrow_right_alt
- The Commission shall establish and maintain a dedicated repository of cloud computing services that have been recognised in accordance with Article 17 (‘central repository’).
- The national competent authority of establishment that recognised a cloud computing service under Article 17 shall register the cloud computing service in the central repository.
- The revocation of an audit report and audit opinion by an auditing organisation or the revocation of a recognition by a competent authority shall be published in the central repository and shall remain available there for five years.
- The central repository shall be publicly available and regularly updated by the Commission and the national competent authorities of establishment on a dedicated and easily accessible website.
Art. 23 Cloud and AI Development Act - Transparency obligations arrow_right_alt
- On becoming aware of any information or any material change in circumstances that may affect the audit report and the ‘positive’ opinion under Article 20 or the recognition under Article 17, the recognised cloud computing service provider shall, as soon as possible, notify the auditing organisation and the national competent authority of establishment.
- On the basis of the notification under paragraph 1, the auditing organisation shall assess whether the audit report or the audit opinion need to be amended or revoked. Where the auditing organisation amends or revokes the audit report or the audit opinion, it shall, as soon as possible, notify the national competent authority of establishment.
- On the basis of the notification referred to in paragraph 1 or 2, the national competent authority of establishment shall assess whether its recognition needs to be amended or revoked. Where the national competent authority of establishment amends or revokes it recognition of the cloud computing service, it shall, as soon as possible, notify the national competent authorities of the other Member States and the Commission.
Art. 24 Cloud and AI Development Act - Penalties and compensation arrow_right_alt
- Member States shall lay down the rules on penalties applicable to infringements of this Chapter by cloud computing service providers within their competence and shall take all measures necessary to ensure that they are implemented. The penalties provided for shall be effective, proportionate and dissuasive. Member States shall, as soon as possible, notify the Commission of those rules and of those measures and shall notify the Commission of any subsequent amendment affecting them.
- Member States shall take into account the following non-exhaustive criteria for the imposition of penalties for infringements of this Regulation:
- the nature, gravity, scale and duration of the infringement;
- any action taken by the infringing party to mitigate or remedy the damage caused by the infringement;
- any previous infringements by the infringing party;
- the financial benefits gained or losses avoided by the infringing party due to the infringement, insofar as such benefits or losses can be reliably established;
- any other aggravating or mitigating factor applicable to the circumstances of the case;
- infringing party’s annual turnover in the preceding financial year in the Union.
- Recipients of the cloud computing services shall have the right to seek, in accordance with Union and national law, compensation from cloud computing service providers for any damage or loss suffered due to an infringement by those providers of their obligations under this Chapter.
Art. 25 Cloud and AI Development Act - National competent authorities arrow_right_alt
- By [P.O. insert date of entry into force plus 1 year], Member States shall designate one or more national competent authorities responsible for enforcing this Chapter. To that effect, Member States may designate an existing authority or existing authorities (‘competent authorities’).
- Member States shall notify the Commission of the names of the competent authorities and of their tasks and powers. The Commission shall maintain a public register of those authorities.
- Member States shall ensure that their competent authorities perform their tasks under this Regulation in an impartial, transparent and timely manner. Member States shall ensure that their competent authorities have all necessary resources to carry out their tasks, including sufficient technical, financial and human resources to adequately supervise all cloud computing service providers within their competence.
- The Member State in which the cloud computing service provider has its main establishment, that is, where the cloud computing service provider has its head office or registered office from which the principal financial functions and operational control are exercised, shall have exclusive competence for enforcing this Chapter.
Art. 26 Cloud and AI Development Act - Powers of the national competent authorities arrow_right_alt
- Where needed to carry out their tasks under Article 17, competent authorities of establishment shall have the following investigative powers:
- the power to require any cloud computing service provider, as well as any other persons acting for purposes related to their trade, business, craft or profession, who may reasonably be expected to be aware of information relating to a suspected infringement of this Regulation, including auditing organisations, to provide that information as soon as possible;
- the power to carry out, or to request a judicial authority in their Member State to order, inspections of any premises that those providers or those persons acting for purposes related to their trade, business, craft or profession, use for purposes related to their trade, business, craft or profession, or to request other public authorities to do so, in order to examine, seize, take or obtain copies of information relating to a suspected infringement in any form, irrespective of the storage medium;
- the power to ask any member of staff or representative of those providers or those persons acting for purposes related to their trade, business, craft or profession, to give explanations in respect of any information relating to a suspected infringement and, with their consent, to record their answers by any technical means.
- Where needed to carry out their tasks under Article 17, national competent authorities of establishment shall have the following enforcement powers:
- the power to order the cessation of infringements and, where appropriate, to impose remedies proportionate to the infringement and necessary to bring the infringement effectively to an end, or to request a judicial authority in their Member State to do so;
- the power to impose fines, or to request a judicial authority in their Member State to do so, for failure to comply with this Regulation, including with any of the investigative orders issued pursuant to paragraph 1;
- the power to impose a periodic penalty payment, or to request a judicial authority in their Member State to do so, in accordance with Article 24 to ensure that an infringement is terminated in compliance with an order issued pursuant to point (a), or for failure to comply with any of the investigative orders issued pursuant to paragraph 1.
- Measures taken by national competent authorities of establishment in exercising their powers listed in paragraphs 1 and 2 shall be effective, dissuasive and proportionate, having regard, in particular, to the nature, gravity, recurrence and duration of the infringement or suspected infringement to which those measures relate, and, where relevant, the economic, technical and operational capacity of the service provider concerned.
- Member States shall set out specific rules and procedures for the exercise of the powers pursuant to paragraphs 1 and 2 and shall ensure that any exercise of those powers is subject to adequate safeguards under applicable national law in compliance with the general principles of Union law. Those measures shall be taken only in accordance with the right to respect for private life and the rights of defence, including the rights to be heard and to have access to the file, and shall be subject to the right of all affected parties to an effective judicial remedy.
Art. 27 Cloud and AI Development Act - Mutual assistance arrow_right_alt
- Competent authorities and the Commission shall cooperate closely and provide each other with mutual assistance to apply this Chapter in a consistent and efficient manner. Mutual assistance shall include the exchange of information.
- A competent authority may request other competent authorities to provide specific information in their possession relating to a specific cloud computing service provider to exercise its investigative powers under Article 26 regarding specific information located in their Member State. Where appropriate, the competent authority receiving the request may involve other competent authorities or other public authorities of the Member State in question.
- The competent authority receiving the request pursuant to paragraph 2 shall comply with such request and inform the competent authority of establishment about the action taken, as soon as possible and no later than two months after receipt of the request, unless duly justified.
Art. 28 Cloud and AI Development Act - Cross-border cooperation arrow_right_alt
- Where a competent authority of destination has reason to suspect that a cloud computing service provider no longer fulfils the requirement under Annex II to this Regulation, it may request the competent authority of establishment to assess the matter and to take the necessary investigatory and enforcement measures to ensure compliance.
- The Commission may also request the competent authority referred to in Article 25 to assess the matter and take the necessary investigatory and enforcement measures to ensure compliance.
- Requests pursuant to paragraph 1 or 2 shall be duly reasoned and shall be duly taken into account by the competent authority of establishment. Where the competent authority of establishment considers that the information provided is insufficient, it may either request additional information. The period set out in paragraph 4 shall be suspended until that additional information is provided
- The competent authority of establishment shall, as soon as possible and in any event not later than two months after receipt of the request pursuant to paragraph 1 or 2, communicate to the competent authority that sent the request, and the Commission, its assessment of the suspected infringement and an explanation of any investigatory or enforcement measures taken or envisaged in relation to the matter to ensure compliance with this Regulation.
