TITLE IV / Chapter I – Cloud computing sovereignty framework (Art. 16-28)

Art. 16 Cloud and AI Development Act - Scope arrow_right_alt

Art. 17 Cloud and AI Development Act - Recognition of cloud computing service providers arrow_right_alt

A cloud computing service provider that aims to be recognised as offering a Union assurance level, shall submit an application for recognition to the national competent authority of establishment. When submitting an application for recognition, the cloud computing service provider shall include all the relevant evidence required under paragraphs 3 or 4.
The competent authority of establishment shall be the evaluating national competent authority. An evaluating national competent authority that has received an application for a candidate recognition, may, where necessary, request one or more competent authorities of the other Member States to collaborate in the procedure for a candidate recognition under this Article. Within 15 days of receiving such a request, the national authority that has received a request for collaboration shall either provide confirmation that it agrees to collaborate with the evaluating national competent authority or refuse the request.
For Union assurance level 1, the candidate cloud computing service provider shall submit to the evaluating national competent authority the EU statement of conformity referred to in Article 19(2) and all the necessary evidence.
By way of derogation from the first subpragraph, the EU statement of conformity issued under Article 19(2) by cloud computing service providers that are SMEs shall be directly and automatically recognised in all Member States without the need for prior recognition by the evaluating national competent authority.
For Union assurance levels 2, 3 and 4, the candidate cloud computing service provider shall submit to the evaluating national competent authority the audit report, the ‘positive’ audit opinion referred to in Article 20 and all the evidence provided to the auditing organisation during the audit procedure.
Within 60 days of accepting an application pursuant to paragraph 1, the evaluating national competent authority shall assess the evidence submitted pursuant to paragraphs 3 or 4 and shall either:
1. prepare a draft recognition decision and notify, as soon as possible, the competent authorities of the other Member States for a 60-day review period to confirm its intended recognition of the cloud computing service across the Union as offering the applicable Union assurance level. The notification to the competent authorities of the other Member States of the review period shall include the evidence referred to in paragraphs 3 or 4; or
2. where the evidence submitted is insufficient to allow the evaluating competent authority to recognise the cloud computing service, it may request further information from the applicant and request that the applicant submit such information within a specified time limit. The period of 60 days referred to in this paragraph shall be suspended from the date of issue of the request until the date the information is received. The suspension shall not exceed 30 days in total unless it is justified by the nature of the information requested or by exceptional circumstances; or
3. reject the request for recognition. Prior to rejecting the request for recognition, the evaluating competent authority shall give the candidate cloud computing service provider the opportunity to provide written comments on the conclusions of the evaluation within 30 days. The evaluating competent authority shall take due account of those comments when finalising its conclusions.
During the review period referred to in paragraph 5, point (a), the national competent authority of another Member State may submit a reasoned objection or request for clarification to the evaluating national competent authority, where it considers that the draft recognition decision does not comply with the applicable Union assurance level set out in Annex II.
Where no reasoned objection or request for clarification is submitted within the review period referred to in paragraph 5, point (a), the conclusions by the evaluating national competent authority shall be deemed accepted by all Member States, the evaluating national competent authority shall adopt the recognition decision and the audited service shall be recognised throughout the Union at the appropriate Union assurance level.
Where a request for clarification is submitted within the review period referred to in paragraph 5, point (a), the evaluating national competent authority shall take due account of such request and, where applicable, request new information from the applicant as per paragraph 5, point (b) or confirm or modify its original draft decision. Where the requesting competent authority is not satisfied, it may submit a reasoned objection.
Where a reasoned objection is submitted within the review period referred to in paragraph 5, point (a), or following the procedure referred to in paragraph 8, the evaluating national competent authority shall assess the objection and shall either maintain or revoke its original draft decision. The evaluating national competent authority shall inform the competent authorities of the other Member States within 15 days after the end of the review perioed referred to in paragraph 5, point (a), or within 15 days after receiving the reasoned objection following the procedure referred to in paragraph 8, whichever is applicable.
In case the evaluating national competent authority intends to maintain its draft decision, the concerned national competent authority may refer the matter to the Commission. The Commission shall assess the referral and may request information from the national competent authorities concerned. The Commission shall adopt a binding decision determining whether the evaluating national competent authority may adopt the recognition decision.
The evaluating national competent authority may revoke its recognition where it finds that a cloud computing service provider, whose service was recognised across the Union as providing a specific Union assurance level, intentionally or negligently, supplied incorrect or misleading information.
The Commission may adopt implementing acts concerning the practical arrangements for the procedures referred to in this Article. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 46(2).
The Commission may, in order to carry out the tasks assigned to it under paragraph 10 , require that national competent authorities of establishment provide, as soon as possible and within a reasonable period, any relevant information relating to the concerned cloud computing service provider and the application for recognition.
When sending a request for information, the Commission shall state the purpose of the request, specify what information is required and set the period within which the information is to be provided.

Art. 18 Cloud and AI Development Act - Associated third countries arrow_right_alt

The Commission may adopt decisions, by means of implementing acts, identifying third countries for which cloud computing service providers subject to the control of that third country or a legal entity established in that third country may be audited against the criteria for Union assurance level 3 pursuant to Annex II, provided that that third country fulfils the following cumulative criteria:
1. it is subject to a relevant adequacy decision adopted under Article 45 of Regulation (EU) 2016/679;
2. it has no measures in place that enable it to exercise control over the cloud computing service provider in a way that would conflict with the requirements for lawful access to non-personal data set out in paragraphs 2 and 3 of Article 32 of Regulation (EU) 2023/2854;
3. it has no measures in place to compel the cloud computing service provider to degrade or disrupt service continuity or provision. It also has no measures in place to oblige the cloud computing service provider to implement, enforce, give effect to, or comply with restrictive measures such as sanction regimes, embargoes, or any equivalent legal or administrative measures, unless these specific measures are legitimate under the national laws of Member States or Union law;
4. it has no measures in place to impede the provision of state-of-the-art technologies and services provided by the cloud computing service provider;
5. it maintains an open market to Union cloud computing services;
6. the third country grants equivalent levels of access to public procurement procedures of cloud computing services subject to the control of a Union Member State or entity or a legal entity established in the Union.
Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 46(2)
Where available information reveals that the third country no longer fulfils the requirements under paragraph 1, the Commission shall repeal, amend or suspend the decision referred to in paragraph 1.
The Commission shall publish on its website a list of third countries that fulfil the requirements under paragraph 1 and those that no longer do so.

Art. 19 Cloud and AI Development Act - Conformity self-assessment arrow_right_alt

Art. 20 Cloud and AI Development Act - Independent audit arrow_right_alt

Cloud computing service providers seeking recognition in accordance with Article 17 as offering Union assurance level 2, 3, or 4, shall undergo at their own expense, independent third-party audits to obtain an audit report and an audit opinion from an auditing organisation. An audited provider undergoing an audit procedure at a higher Union assurance level shall satisfy all the applicable cumulative criteria under Annex II applicable to the lower Union assurance levels. Failure to meet any requirements of a lower assurance level shall preclude conformity with the higher Union assurance levels.
Audited providers shall cooperate with auditing organisations and provide them assistance necessary to enable them to conduct those audits in an effective, efficient and timely manner, including by giving them access to all relevant data and premises and by answering oral or written questions. Audited providers shall refrain from hampering, unduly influencing or undermining the performance of the audit.
Auditing organisations shall ensure an adequate level of confidentiality and professional secrecy in respect of the information obtained from the audited providers and third parties as part of the audits, including after the audits have ended. That requirement shall not adversely affect the performance of the audits and other provisions of this Regulation. Under Article 23, the auditing organisation shall only share information that are necessary for the reporting purposes and do not contain any information that could reasonably be considered confidential.
Audits referred to paragraph 1 shall be performed by auditing organisations that:
1. are independent from, and do not have any conflicts of interest with, the cloud computing service provider concerned, and any legal person connected to that provider, in particular:
  1. have not provided non-audit services related to the matters audited to the cloud computing service provider concerned or to any legal person connected to that provider in the 12-month period before the beginning of the audit, and have committed to not providing them with such services in the 12-month period after the completion of the audit;
  2. have not provided auditing services pursuant to this Article to the cloud computing service provider concerned or any legal person connected to that provider in the 10-year period before the beginning of the audit;
  3. are not performing the audit in return for fees that are contingent on the result of the audit;
2. have proven expertise, technical competence and capabilities in auditing cloud computing services;
3. have proven objectivity and professional ethics, based in particular on adherence to codes of practice or appropriate standards.
Auditing organisations that perform the audits shall prepare an audit report for each audit. That report shall be substantiated, in writing, and shall include at least the following:
1. the name, address and point of contact of the provider subject to the audit, and the period covered;
2. the name and address of the auditing organisation or organisations performing the audit;
3. a declaration of interests;
4. a description of the specific aspects audited, and the methodology applied;
5. a description and a summary of the main findings drawn from the audit;
6. a list of the third parties consulted as part of the audit;
7. a ‘positive’ or ‘negative’ audit opinion and any information on whether the audited service of the audited provider complies with the applicable audit criteria for Union assurance level 2, 3 or 4 pursuant to Annex II;
8. where the audit opinion is ‘negative’, operational recommendations on specific measures to achieve compliance and the recommended timeframe to achieve compliance;
9. where the audit opinion is ‘positive’, the Union assurance level that needs to be recognised under Article 17, issued to the audited service of the audited provider pursuant to the applicable criteria set out in Annex II.
Where the auditing organisation was unable to audit certain aspects or to express an audit opinion based on its investigations, the audit report shall include an explanation of the circumstances and the reasons why those aspects could not be audited.
The auditing organisation may revoke its audit report and audit opinion where the audited provider, intentionally or negligently, supplied incorrect or misleading audit evidence.
The audited provider shall annually submit for review the audit report and the associated ‘positive’ audit opinion to the same or a different auditing organisation which shall assess the continued compliance of the audited service with the applicable criteria set out in Annex II. On the basis of the annual review, the auditing organisation may confirm, update, or revoke the initial audit report and audit opinion.
The Commission is empowered to adopt delegated acts in accordance with Article 45 to supplement this Regulation by laying down rules on the performance of audits on the procedural steps, rules for auditing organisations and their technical competences, auditing methodologies and templates for the audit reports.

Art. 21 Cloud and AI Development Act - Content and quality of audit evidence arrow_right_alt

Art. 22 Cloud and AI Development Act - Central repository of cloud computing services arrow_right_alt

Art. 23 Cloud and AI Development Act - Transparency obligations arrow_right_alt

Art. 24 Cloud and AI Development Act - Penalties and compensation arrow_right_alt

Art. 25 Cloud and AI Development Act - National competent authorities arrow_right_alt

Art. 26 Cloud and AI Development Act - Powers of the national competent authorities arrow_right_alt

Where needed to carry out their tasks under Article 17, competent authorities of establishment shall have the following investigative powers:
1. the power to require any cloud computing service provider, as well as any other persons acting for purposes related to their trade, business, craft or profession, who may reasonably be expected to be aware of information relating to a suspected infringement of this Regulation, including auditing organisations, to provide that information as soon as possible;
2. the power to carry out, or to request a judicial authority in their Member State to order, inspections of any premises that those providers or those persons acting for purposes related to their trade, business, craft or profession, use for purposes related to their trade, business, craft or profession, or to request other public authorities to do so, in order to examine, seize, take or obtain copies of information relating to a suspected infringement in any form, irrespective of the storage medium;
3. the power to ask any member of staff or representative of those providers or those persons acting for purposes related to their trade, business, craft or profession, to give explanations in respect of any information relating to a suspected infringement and, with their consent, to record their answers by any technical means.
Where needed to carry out their tasks under Article 17, national competent authorities of establishment shall have the following enforcement powers:
1. the power to order the cessation of infringements and, where appropriate, to impose remedies proportionate to the infringement and necessary to bring the infringement effectively to an end, or to request a judicial authority in their Member State to do so;
2. the power to impose fines, or to request a judicial authority in their Member State to do so, for failure to comply with this Regulation, including with any of the investigative orders issued pursuant to paragraph 1;
3. the power to impose a periodic penalty payment, or to request a judicial authority in their Member State to do so, in accordance with Article 24 to ensure that an infringement is terminated in compliance with an order issued pursuant to point (a), or for failure to comply with any of the investigative orders issued pursuant to paragraph 1.
Measures taken by national competent authorities of establishment in exercising their powers listed in paragraphs 1 and 2 shall be effective, dissuasive and proportionate, having regard, in particular, to the nature, gravity, recurrence and duration of the infringement or suspected infringement to which those measures relate, and, where relevant, the economic, technical and operational capacity of the service provider concerned.
Member States shall set out specific rules and procedures for the exercise of the powers pursuant to paragraphs 1 and 2 and shall ensure that any exercise of those powers is subject to adequate safeguards under applicable national law in compliance with the general principles of Union law. Those measures shall be taken only in accordance with the right to respect for private life and the rights of defence, including the rights to be heard and to have access to the file, and shall be subject to the right of all affected parties to an effective judicial remedy.

Cloud and AI Development Act (CADA)

TITLE IV / Chapter I – Cloud computing sovereignty framework (Art. 16-28)

Art. 16 Cloud and AI Development Act - Scope arrow_right_alt

Art. 17 Cloud and AI Development Act - Recognition of cloud computing service providers arrow_right_alt

Art. 18 Cloud and AI Development Act - Associated third countries arrow_right_alt

Art. 19 Cloud and AI Development Act - Conformity self-assessment arrow_right_alt

Art. 20 Cloud and AI Development Act - Independent audit arrow_right_alt

Art. 21 Cloud and AI Development Act - Content and quality of audit evidence arrow_right_alt

Art. 22 Cloud and AI Development Act - Central repository of cloud computing services arrow_right_alt

Art. 23 Cloud and AI Development Act - Transparency obligations arrow_right_alt

Art. 24 Cloud and AI Development Act - Penalties and compensation arrow_right_alt

Art. 25 Cloud and AI Development Act - National competent authorities arrow_right_alt

Art. 26 Cloud and AI Development Act - Powers of the national competent authorities arrow_right_alt

Art. 27 Cloud and AI Development Act - Mutual assistance arrow_right_alt

Art. 28 Cloud and AI Development Act - Cross-border cooperation arrow_right_alt