CADA tracker · source extraction
Article 18
Associated third countries
1. The Commission may adopt decisions, by means of implementing acts, identifying
third countries for which cloud computing service providers subject to the control of
that third country or a legal entity established in that third country may be audited
against the criteria for Union assurance level 3 pursuant to Annex II, provided that
that third country fulfils the following cumulative criteria:
(a) it is subject to a relevant adequacy decision adopted under Article 45 of
Regulation (EU) 2016/679;
(b) it has no measures in place that enable it to exercise control over the cloud
computing service provider in a way that would conflict with the requirements
for lawful access to non-personal data set out in paragraphs 2 and 3 of Article
32 of Regulation (EU) 2023/2854;
(c) it has no measures in place to compel the cloud computing service provider to
degrade or disrupt service continuity or provision. It also has no measures in
place to oblige the cloud computing service provider to implement, enforce,
give effect to, or comply with restrictive measures such as sanction regimes,
embargoes, or any equivalent legal or administrative measures, unless these
specific measures are legitimate under the national laws of Member States or
Union law;
(d) it has no measures in place to impede the provision of state-of-the-art
technologies and services provided by the cloud computing service provider;
(e) it maintains an open market to Union cloud computing services;
(f) the third country grants equivalent levels of access to public procurement
procedures of cloud computing services subject to the control of a Union
Member State or entity or a legal entity established in the Union.
Those implementing acts shall be adopted in accordance with the examination
procedure referred to in Article 46(2)
2. Where available information reveals that the third country no longer fulfils the
requirements under paragraph 1, the Commission shall repeal, amend or suspend the
decision referred to in paragraph 1.
3. The Commission shall publish on its website a list of third countries that fulfil the
requirements under paragraph 1 and those that no longer do so.
SECTION 2
CONFORMITY ASSESSMENT PROCEDURES