SkarpChapter 6 of 17
Federation, Common Purchasing, Open Source, and General Rules
The proposal couples sovereignty requirements with practical market-shaping tools: a public-sector cloud federation, Commission-led purchasing, and reusable open-source software. The closing recitals and Title I also establish the principles, objectives, and definitions needed to interpret every later obligation.
Orientation: What This Module Covers
Read the Text in Order
This module moves from recitals (69)-(91) to Articles 1-4. Recitals explain rationale; articles formulate the proposed operative rules.
Status Check
As of July 20, 2026, EUR-Lex lists this as Commission document COM(2026) 502 final, published in June 2026: a proposal rather than an enacted Regulation.
Four Connected Tools
The text links a public cloud federation, common purchasing, open-source reuse, and research-and-deployment objectives for cloud and AI.
Recital (69): Why Create the EuroCloud Federation?
Political Background
Recital (69) connects the Federation to declarations from October and December 2020 and Council conclusions of May 21, 2024.
The Stated Purpose
EuroCloud should bring together highly trusted, secure public-sector cloud initiatives to "facilitate the sharing of such capabilities between Union entities and public-sector bodies."
Scope and Possible Future Review
The text focuses on Union entities and public-sector bodies. A later evaluation may assess participation by specified non-Member-State actors and Union-headquartered international organisations.
Recitals (70)-(73): Public Participation, Control, Security, and Cost Recovery
Public-Only Boundary
"Participation within the EuroCloud Federation should be limited to public entities, without direct participation of a private party."
The Three Cumulative Control Tests
Control through an intermediate entity requires decisive influence, no direct private capital, and over 80% of activities devoted to entrusted tasks.
Security and Continuity
The sharing entity should use policies for risk analysis, access control, incident handling, business continuity, interoperability, and connectivity.
Narrow Cost Exception
Sharing is normally free. Charges may only be necessary and proportionate recovery of additional costs caused by sharing capacity.
Quiz: EuroCloud Participation and Charges
Check Your Reading of Recitals (71)-(73)
Choose the option that most accurately reflects the supplied text. Pay attention to the fact that the three control conditions are cumulative, and that cost recovery is limited to additional costs incurred in sharing capacity.
Which arrangement best fits the recital's conditions for an intermediate legal entity through which a public sharing entity provides EuroCloud services?
- The public entity decisively influences strategy and significant decisions; there is no direct private capital; and more than 80% of the intermediary's activities carry out tasks entrusted by that entity.
- The public entity owns 51% of the intermediary, while a private investor owns the remaining 49%, and the intermediary serves mainly commercial customers.
- The public entity may influence technical choices, but a private shareholder controls strategic decisions and the intermediary's tasks are split evenly between public and commercial work.
- The intermediary has no public entity relationship, but agrees to charge only cost-recovery fees.
Show Answer
Answer: A) The public entity decisively influences strategy and significant decisions; there is no direct private capital; and more than 80% of the intermediary's activities carry out tasks entrusted by that entity.
The text requires all three conditions: decisive influence over strategic objectives and significant decisions, no direct private capital participation, and more than 80% of activities performed for tasks entrusted by the sharing entity. Cost recovery alone cannot satisfy the participation conditions.
Recitals (74)-(77): Commission-Led Common Purchasing
Why Common Purchasing?
Recital (74) identifies limited funds, weak purchasing power, and insufficient technical or procurement expertise as barriers to digital procurement.
Participating Entities
Member State contracting authorities, Commission-selected partner organisations, and Union institutions, agencies, and bodies are "participating entities."
Dynamic Purchasing Systems
Newly acceding entities may join during a system's validity with prior Commission approval, before a future tender, without disrupting existing or ongoing procedures.
Minimum Agreement Threshold
The agreement enters into force under its provisions, "subject to the approval of at least two Member States."
Worked Example: A Shared Cloud Procurement
Scenario
Several public bodies need cloud services but have unequal budgets, purchasing power, and procurement expertise. A central arrangement can pool demand.
Late Joiner Rule
A new entity may join a dynamic purchasing system only with Commission approval and before a future tender. It cannot disturb prior or ongoing procedures.
Common Needs, Not Every Need
The Commission should seek to address common needs where possible, but is not obliged to satisfy needs specific to a limited number of entities.
Subsequent Provision
A contracting authority that acquired supplies through the Commission may offer them to others without a new procedure, while remaining bound by the initial contract.
Recitals (78)-(80): Governance, Responsibility, and Fees
Steering Committee
The committee supplies strategic oversight and guides procurement priorities. It also oversees participant involvement.
Operational Boundary
Operations remain with the Commission, including setting fees. The steering committee is not the procurement operator.
Responsibility Follows Conduct
When a participating entity independently performs stages of a procurement, it remains solely responsible for those autonomous stages.
Two Different Financial Models
Commission procurement fees can cover direct and indirect procurement costs. EuroCloud sharing charges are separately limited to necessary, proportionate additional sharing costs.
Recitals (81)-(84): Open Source, Reuse, Catalogue, and OSPO Network
Why Open Source?
"Access to the source code enables auditability, fosters collaboration and reuse and reduces dependency on a single vendor."
Standards and Components
When building cloud and AI ecosystems or stacks, public administrations should promote open standards and components released under an open-source licence.
Reuse and Discoverability
If an entity voluntarily makes software reusable, it must use a catalogue or repository connected to the EU OSS Catalogue.
Central Search and Coordination
The OSS Catalogue is a centralised place for public administrations to search and access reusable software; the OSPO network supports coordination and best-practice exchange.
Recitals (85)-(91): Updating Powers, Competition Safeguards, and Subsidiarity
Delegated and Implementing Powers
Delegated acts may update or supplement listed matters; implementing powers seek uniform implementation conditions under Regulation (EU) No 182/2011.
Consultation and Data Protection
The Commission should consult appropriately, including experts. The European Data Protection Supervisor should be consulted where necessary.
Competition Safeguards
State-aid measures are "without prejudice to the application of Articles 107 and 108 TFEU." Articles 101 and 102 TFEU also remain applicable.
Why Union Action?
The recital concludes that Union action is justified where objectives cannot be sufficiently achieved by Member States but can be better achieved at Union level.
Title I: Article 1 and the Definitions That Frame the Text
Article 1 Framework
Article 1 covers leadership initiatives, data-centre deployment, a sovereign cloud and AI offer, critical-technology dependencies, and public-sector cloud uptake.
Two General Objectives
The first concerns competitiveness and innovation capacity; the second complements it by improving the single market through a uniform Union legal framework.
Frontier AI
"‘frontier AI’ means AI models or AI systems built upon such models that can perform a wide variety of tasks and that approach, reach or exceed the current state of the art;"
AI Agent and Audits
An AI agent perceives and acts with autonomy. Audit criteria are cumulative Annex II criteria for assurance levels 2, 3, or 4.
Articles 3 and 4: Leadership Initiatives and Eight Operational Objectives
Article 3 General Objective
The initiatives pursue "promoting research and innovation activities and achieving large-scale capacity throughout the Union’s cloud and AI ecosystem".
Objectives 1 and 2
Objective 1 targets efficient data-centre technologies. Objective 2 develops open cloud stacks and related infrastructure supporting Union technological autonomy.
Objectives 3 and 4
Objective 3 develops frontier AI as a strategic asset. Objective 4 builds physical-AI capability for areas such as robotics, vehicles, and drones.
Objectives 5 to 8
The remaining objectives address industrial AI, AI agents, public-sector AI, and broad regional and local uptake through Centres for AI, EuroCloud, curriculum, and procurement.
Quiz: Match the Objective to the Activity
Apply Articles 3 and 4
This question tests whether you can distinguish the eight operational objectives. Do not choose an answer simply because it mentions AI or cloud: select the objective whose Article 4 activities directly include the stated action.
Which operational objective includes secure large-scale data pooling for collaborative AI training through privacy-enhancing and confidentiality-preserving technologies?
- Operational objective 1: advanced energy- and resource-efficient data-centre technologies
- Operational objective 3: frontier AI
- Operational objective 5: industrial AI
- Operational objective 8: regional and local AI adoption and European cloud uptake
Show Answer
Answer: C) Operational objective 5: industrial AI
Article 4(5)(c), under operational objective 5, states that the initiatives shall "enable secure large-scale data pooling for collaborative AI training through technologies enhancing privacy and preserving confidentiality."
Flashcards: Exact Terms and Thresholds
Recall the Source Precisely
Flip each card and test whether you can state the text's exact phrase, threshold, or distinction.
- EuroCloud purpose
- It should "facilitate the sharing of such capabilities between Union entities and public-sector bodies."
- Who may participate directly in EuroCloud?
- "Participation within the EuroCloud Federation should be limited to public entities, without direct participation of a private party."
- Intermediate-entity activity threshold
- More than 80% of its activities must be carried out in performing tasks entrusted to it by the sharing entity.
- EuroCloud cost-recovery rule
- Charges are permitted only where "the charges are limited strictly to what is necessary and proportionate to recover the costs incurred by the sharing entity" for the beneficiary using entity.
- Minimum approval for the procurement agreement
- It enters into force under its provisions, "subject to the approval of at least two Member States."
- Why does the text support open source?
- "Access to the source code enables auditability, fosters collaboration and reuse and reduces dependency on a single vendor".
- EU OSS Catalogue function
- "The OSS Catalogue should serve as a centralised catalogue for any public administration to search and access software" made available for reuse.
- Operational objective 2
- "supporting the development and deployment of cloud computing stacks supporting the Union’s technological autonomy"
Key Terms
- AI agent
- An AI system, or coordinated set of AI systems, able to perceive and act on its environment with a degree of autonomy, using tools as needed to meet goals and adapt to changing inputs and contexts.
- frontier AI
- AI models or AI systems built on such models that perform a wide variety of tasks and approach, reach, or exceed the current state of the art.
- OSPO network
- The network of open-source programme offices intended to coordinate relevant structures across Union entities and Member States and exchange information and best practices.
- sharing entity
- The public entity sharing data-centre or cloud-computing services within the EuroCloud Federation; recitals (71)-(73) attach control, security, and cost-recovery conditions to it.
- EuroCloud Federation
- The European public-sector cloud federation described in recital (69) as bringing together national and European cloud initiatives with highly trusted and secure public-sector cloud capabilities.
- participating entity
- A Member State contracting authority, Commission-selected partner organisation, or Union institution, agency, or body participating in the Commission procurement procedures described in recital (74).
- operational objective
- One of the eight specific objectives in Article 3(2), with detailed activities set out in Article 4.
- Union assurance levels
- Levels 2, 3, and 4, for which Annex II supplies cumulative criteria used by an auditing organisation when assessing an audited provider and service.
- central purchasing body
- The role proposed for the Commission in conducting procurement activities for participating entities.
- beneficiary using entity
- The entity using capacity shared by a sharing entity. In recital (73), narrowly limited charges may recover additional costs incurred for this entity.
- dynamic purchasing system
- A purchasing system in which newly acceding participating entities may, subject to prior Commission approval and before a future tender, join during the system's validity.