Cloud and AI Development Act (CADA)

1. prepare a draft recognition decision and notify, as soon as possible, the competent authorities of the other Member States for a 60-day review period to confirm its intended recognition of the cloud computing service across the Union as offering the applicable Union assurance level. The notification to the competent authorities of the other Member States of the review period shall include the evidence referred to in paragraphs 3 or 4; or
2. where the evidence submitted is insufficient to allow the evaluating competent authority to recognise the cloud computing service, it may request further information from the applicant and request that the applicant submit such information within a specified time limit. The period of 60 days referred to in this paragraph shall be suspended from the date of issue of the request until the date the information is received. The suspension shall not exceed 30 days in total unless it is justified by the nature of the information requested or by exceptional circumstances; or
3. reject the request for recognition. Prior to rejecting the request for recognition, the evaluating competent authority shall give the candidate cloud computing service provider the opportunity to provide written comments on the conclusions of the evaluation within 30 days. The evaluating competent authority shall take due account of those comments when finalising its conclusions.

1. it is subject to a relevant adequacy decision adopted under Article 45 of Regulation (EU) 2016/679;
2. it has no measures in place that enable it to exercise control over the cloud computing service provider in a way that would conflict with the requirements for lawful access to non-personal data set out in paragraphs 2 and 3 of Article 32 of Regulation (EU) 2023/2854;
3. it has no measures in place to compel the cloud computing service provider to degrade or disrupt service continuity or provision. It also has no measures in place to oblige the cloud computing service provider to implement, enforce, give effect to, or comply with restrictive measures such as sanction regimes, embargoes, or any equivalent legal or administrative measures, unless these specific measures are legitimate under the national laws of Member States or Union law;
4. it has no measures in place to impede the provision of state-of-the-art technologies and services provided by the cloud computing service provider;
5. it maintains an open market to Union cloud computing services;
6. the third country grants equivalent levels of access to public procurement procedures of cloud computing services subject to the control of a Union Member State or entity or a legal entity established in the Union.

Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 46(2)

1. are independent from, and do not have any conflicts of interest with, the cloud computing service provider concerned, and any legal person connected to that provider, in particular:
   1. have not provided non-audit services related to the matters audited to the cloud computing service provider concerned or to any legal person connected to that provider in the 12-month period before the beginning of the audit, and have committed to not providing them with such services in the 12-month period after the completion of the audit;
   2. have not provided auditing services pursuant to this Article to the cloud computing service provider concerned or any legal person connected to that provider in the 10-year period before the beginning of the audit;
   3. are not performing the audit in return for fees that are contingent on the result of the audit;
2. have proven expertise, technical competence and capabilities in auditing cloud computing services;
3. have proven objectivity and professional ethics, based in particular on adherence to codes of practice or appropriate standards.

1. the name, address and point of contact of the provider subject to the audit, and the period covered;
2. the name and address of the auditing organisation or organisations performing the audit;
3. a declaration of interests;
4. a description of the specific aspects audited, and the methodology applied;
5. a description and a summary of the main findings drawn from the audit;
6. a list of the third parties consulted as part of the audit;
7. a ‘positive’ or ‘negative’ audit opinion and any information on whether the audited service of the audited provider complies with the applicable audit criteria for Union assurance level 2, 3 or 4 pursuant to Annex II;
8. where the audit opinion is ‘negative’, operational recommendations on specific measures to achieve compliance and the recommended timeframe to achieve compliance;
9. where the audit opinion is ‘positive’, the Union assurance level that needs to be recognised under Article 17, issued to the audited service of the audited provider pursuant to the applicable criteria set out in Annex II.

1. relevant and sufficient to enable the auditing organisation to prepare an audit report and provide an audit opinion; and
2. reliable, according to the auditing organisation’s professional judgment and scepticism.

1. the nature, gravity, scale and duration of the infringement;
2. any action taken by the infringing party to mitigate or remedy the damage caused by the infringement;
3. any previous infringements by the infringing party;
4. the financial benefits gained or losses avoided by the infringing party due to the infringement, insofar as such benefits or losses can be reliably established;
5. any other aggravating or mitigating factor applicable to the circumstances of the case;
6. infringing party’s annual turnover in the preceding financial year in the Union.

1. the power to require any cloud computing service provider, as well as any other persons acting for purposes related to their trade, business, craft or profession, who may reasonably be expected to be aware of information relating to a suspected infringement of this Regulation, including auditing organisations, to provide that information as soon as possible;
2. the power to carry out, or to request a judicial authority in their Member State to order, inspections of any premises that those providers or those persons acting for purposes related to their trade, business, craft or profession, use for purposes related to their trade, business, craft or profession, or to request other public authorities to do so, in order to examine, seize, take or obtain copies of information relating to a suspected infringement in any form, irrespective of the storage medium;
3. the power to ask any member of staff or representative of those providers or those persons acting for purposes related to their trade, business, craft or profession, to give explanations in respect of any information relating to a suspected infringement and, with their consent, to record their answers by any technical means.

1. the power to order the cessation of infringements and, where appropriate, to impose remedies proportionate to the infringement and necessary to bring the infringement effectively to an end, or to request a judicial authority in their Member State to do so;
2. the power to impose fines, or to request a judicial authority in their Member State to do so, for failure to comply with this Regulation, including with any of the investigative orders issued pursuant to paragraph 1;
3. the power to impose a periodic penalty payment, or to request a judicial authority in their Member State to do so, in accordance with Article 24 to ensure that an infringement is terminated in compliance with an order issued pursuant to point (a), or for failure to comply with any of the investigative orders issued pursuant to paragraph 1.