CADA tracker · source extraction
Article 17
Recognition of cloud computing service providers
1. A cloud computing service provider that aims to be recognised as offering a Union
assurance level, shall submit an application for recognition to the national competent
authority of establishment. When submitting an application for recognition, the cloud
computing service provider shall include all the relevant evidence required under
paragraphs 3 or 4.
2. The competent authority of establishment shall be the evaluating national competent
authority. An evaluating national competent authority that has received an
application for a candidate recognition, may, where necessary, request one or more
competent authorities of the other Member States to collaborate in the procedure for
a candidate recognition under this Article. Within 15 days of receiving such a
request, the national authority that has received a request for collaboration shall
either provide confirmation that it agrees to collaborate with the evaluating national
competent authority or refuse the request.
3. For Union assurance level 1, the candidate cloud computing service provider shall
submit to the evaluating national competent authority the EU statement of
conformity referred to in Article 19(2) and all the necessary evidence.
By way of derogation from the first subpragraph, the EU statement of conformity
issued under Article 19(2) by cloud computing service providers that are SMEs shall
be directly and automatically recognised in all Member States without the need for
prior recognition by the evaluating national competent authority.
4. For Union assurance levels 2, 3 and 4, the candidate cloud computing service
provider shall submit to the evaluating national competent authority the audit report,
the ‘positive’ audit opinion referred to in Article 20 and all the evidence provided to
the auditing organisation during the audit procedure.
5. Within 60 days of accepting an application pursuant to paragraph 1, the evaluating
national competent authority shall assess the evidence submitted pursuant to
paragraphs 3 or 4 and shall either:
(a) prepare a draft recognition decision and notify, as soon as possible, the
competent authorities of the other Member States for a 60-day review period to
confirm its intended recognition of the cloud computing service across the
Union as offering the applicable Union assurance level. The notification to the
competent authorities of the other Member States of the review period shall
include the evidence referred to in paragraphs 3 or 4; or
(b) where the evidence submitted is insufficient to allow the evaluating competent
authority to recognise the cloud computing service, it may request further
information from the applicant and request that the applicant submit such
information within a specified time limit. The period of 60 days referred to in
this paragraph shall be suspended from the date of issue of the request until the
date the information is received. The suspension shall not exceed 30 days in
total unless it is justified by the nature of the information requested or by
exceptional circumstances; or
(c) reject the request for recognition. Prior to rejecting the request for recognition,
the evaluating competent authority shall give the candidate cloud computing
service provider the opportunity to provide written comments on the
conclusions of the evaluation within 30 days. The evaluating competent
authority shall take due account of those comments when finalising its
conclusions.
6. During the review period referred to in paragraph 5, point (a), the national competent
authority of another Member State may submit a reasoned objection or request for
clarification to the evaluating national competent authority, where it considers that
the draft recognition decision does not comply with the applicable Union assurance
level set out in Annex II.
7. Where no reasoned objection or request for clarification is submitted within the
review period referred to in paragraph 5, point (a), the conclusions by the evaluating
national competent authority shall be deemed accepted by all Member States, the
evaluating national competent authority shall adopt the recognition decision and the
audited service shall be recognised throughout the Union at the appropriate Union
assurance level.
8. Where a request for clarification is submitted within the review period referred to in
paragraph 5, point (a), the evaluating national competent authority shall take due
account of such request and, where applicable, request new information from the
applicant as per paragraph 5, point (b) or confirm or modify its original draft
decision. Where the requesting competent authority is not satisfied, it may submit a
reasoned objection.
9. Where a reasoned objection is submitted within the review period referred to in
paragraph 5, point (a), or following the procedure referred to in paragraph 8, the
evaluating national competent authority shall assess the objection and shall either
maintain or revoke its original draft decision. The evaluating national competent
authority shall inform the competent authorities of the other Member States within
15 days after the end of the review perioed referred to in paragraph 5, point (a), or
within 15 days after receiving the reasoned objection following the procedure
referred to in paragraph 8, whichever is applicable.
10. In case the evaluating national competent authority intends to maintain its draft
decision, the concerned national competent authority may refer the matter to the
Commission. The Commission shall assess the referral and may request information
from the national competent authorities concerned. The Commission shall adopt a
binding decision determining whether the evaluating national competent authority
may adopt the recognition decision.
11. The evaluating national competent authority may revoke its recognition where it
finds that a cloud computing service provider, whose service was recognised across
the Union as providing a specific Union assurance level, intentionally or negligently,
supplied incorrect or misleading information.
12. The Commission may adopt implementing acts concerning the practical
arrangements for the procedures referred to in this Article. Those implementing acts
shall be adopted in accordance with the examination procedure referred to in Article
46(2).
13. The Commission may, in order to carry out the tasks assigned to it under paragraph
10 , require that national competent authorities of establishment provide, as soon as
possible and within a reasonable period, any relevant information relating to the
concerned cloud computing service provider and the application for recognition.
14. When sending a request for information, the Commission shall state the purpose of
the request, specify what information is required and set the period within which the
information is to be provided.