Summary Yes, under the proposed Cloud and AI Development Act (CADA), any fine or enforcement measure can be challenged in court. Article 26(4) explicitly guarantees that the exercise of enforcement powers by national competent authorities is subject to the "right of all affected parties to an effective judicial remedy." While national competent authorities have the power to impose fines or periodic penalty payments, they may also request a judicial authority to do so under Article 26(2)(b) and (c). Crucially, the specific procedural rules for challenging these measures—including deadlines, court hierarchy, and the standard of review—are determined by national law, provided they respect the fundamental rights of defence and private life mandated by the proposal.

Detail

The enforcement architecture of the proposed Cloud and AI Development Act (CADA) is designed to balance robust regulatory oversight with the fundamental rights of the entities subject to it. As a proposal (COM(2026) 502 final), CADA would establish a framework where national competent authorities (NCAs) are the primary enforcers, but their powers are strictly circumscribed by procedural safeguards and the overarching right to judicial review.

The Enforcement Mechanism: Administrative vs. Judicial Imposition

A critical feature of CADA's enforcement regime is the dual pathway for imposing financial sanctions. Article 26(2) outlines the enforcement powers of national competent authorities. Specifically:

  • Article 26(2)(b) grants NCAs the power to "impose fines, or to request a judicial authority in their Member State to do so," for failures to comply with the Regulation or investigative orders.
  • Article 26(2)(c) provides a similar mechanism for "periodic penalty payments," which are used to ensure the termination of infringements or compliance with investigative orders.

This dual mechanism reflects the diversity of administrative law across the EU Member States. In some jurisdictions, administrative bodies possess the direct authority to levy fines. In others, the imposition of financial penalties requires a judicial order to ensure constitutional compliance. By allowing NCAs to either impose fines directly or request a judicial authority to do so, CADA ensures that the enforcement framework is adaptable to national legal traditions while maintaining a uniform EU-wide standard of effectiveness.

Regardless of whether the fine is imposed administratively or via a judicial order, the resulting measure is subject to the same fundamental rights protections. The proposal does not create a "black box" enforcement system; rather, it integrates CADA enforcement into the existing national judicial ecosystems.

The Right to an Effective Judicial Remedy

The cornerstone of the right to challenge CADA fines is Article 26(4). This provision mandates that measures taken by national competent authorities "shall be subject to the right of all affected parties to an effective judicial remedy."

This clause is not merely a formality; it is a substantive guarantee derived from the general principles of EU law, including the Charter of Fundamental Rights. It ensures that:

  1. Scope of "Affected Parties": The right extends beyond the cloud computing service provider who is the primary target of the fine. It includes "all affected parties," which could encompass subcontractors, auditing organisations, or other entities subject to inspections, information requests, or other investigative measures under Article 26(1).
  2. Procedural Safeguards: Before a fine is imposed, the right to an effective judicial remedy is underpinned by the requirement that measures respect "the right to respect for private life and the rights of defence." This includes the "rights to be heard and to have access to the file." If an NCA fails to provide these safeguards, the resulting fine is vulnerable to annulment in court.
  3. Judicial Review: The "effective judicial remedy" implies that a national court must have the power to review the legality, proportionality, and factual basis of the enforcement measure. The court can assess whether the NCA acted within its powers, whether the evidence was sufficient, and whether the penalty was proportionate to the infringement.

National Procedural Rules and Harmonisation

While Article 26(4) guarantees the existence of a judicial remedy, it does not prescribe the procedure for exercising it. The proposal explicitly states in Article 26(4) that "Member States shall set out specific rules and procedures for the exercise of the powers pursuant to paragraphs 1 and 2."

This means that the practical steps for challenging a CADA fine—such as the time limit for filing an appeal, the specific court with jurisdiction (administrative vs. civil), and the burden of proof—will vary depending on the Member State where the NCA is located. However, this national discretion is not unlimited. The proposal imposes a "floor" of protection:

  • Effectiveness: The national procedure must not render the exercise of the right to a remedy practically impossible or excessively difficult.
  • Proportionality: Under Article 26(3), any measure taken must be "effective, dissuasive and proportionate." National courts will apply this standard when reviewing fines, considering factors such as the nature, gravity, scale, and duration of the infringement, as well as the economic capacity of the provider.
  • Fundamental Rights: National procedures must ensure that the rights of defence and privacy are respected throughout the process.

Consequently, while the substantive right to challenge a fine is harmonised across the EU, the procedural vehicle for that challenge is national. Legal counsel must therefore be familiar with the specific administrative and judicial codes of the Member State in question.

Interaction with Compensation and Civil Liability

It is important to distinguish between the administrative challenge to a fine and civil liability. Article 24(3) of the proposal establishes that recipients of cloud computing services have the right to seek compensation for damage suffered due to an infringement by a provider.

A challenge to a fine under Article 26(4) is an administrative or judicial review of the regulator's decision. A claim for compensation under Article 24(3) is a civil action for damages. While a successful challenge to a fine (e.g., proving no infringement occurred) would likely strengthen a civil defence, the two processes are distinct. A provider may be fined by an NCA and still face civil claims, or vice versa. However, the judicial review of the fine often serves as a critical precedent for establishing the facts in subsequent civil litigation.

What this means for you

For legal counsel, compliance officers, and cloud service providers, the right to an effective judicial remedy under Article 26(4) is a vital strategic asset, but it requires proactive management.

1. Immediate Assessment of Jurisdiction and Procedure

Upon receiving a notice of investigation or a draft fine, the first step is to identify the specific national procedural rules of the Member State where the NCA is established. Since Article 26(4) delegates the procedural framework to Member States, you must determine:

  • What is the deadline for filing an appeal? (This is often short, e.g., 30 days).
  • Which court has jurisdiction? (Administrative court, civil court, or a specialized tribunal?)
  • Does the appeal automatically suspend the enforcement of the fine, or must a separate request for a stay of execution be filed?

2. Leveraging Procedural Defences

The most common grounds for challenging a CADA fine will likely be procedural rather than substantive. If the NCA failed to grant access to the file, denied the right to be heard, or conducted an inspection without proper justification, these are direct violations of Article 26(4). Such violations can lead to the annulment of the decision, regardless of whether the underlying infringement actually occurred.

3. Proportionality Arguments

Even if an infringement is established, the fine can be challenged on the grounds of proportionality. Article 26(3) requires NCAs to consider the "nature, gravity, scale and duration of the infringement," as well as the "financial benefits gained" and the "infringing party's annual turnover." If the fine is disproportionate to the economic reality of the provider or the severity of the breach, a national court can reduce or annul the penalty.

4. Strategic Coordination with Judicial Authorities

In Member States where the NCA must request a judicial authority to impose a fine, the "challenge" may occur during the judicial proceeding rather than as a post-decision appeal. In these scenarios, the provider's legal team must be prepared to defend against the NCA's request in court, presenting evidence and arguments directly to the judge. Understanding this distinction is crucial for timing and resource allocation.

5. Documentation for Judicial Review

To exercise the right to an effective judicial remedy, the provider must maintain a rigorous record of all interactions with the NCA. This includes:

  • All responses to information requests under Article 26(1).
  • Records of any inspections or on-site visits.
  • Evidence of the right to be heard and access to the file.
  • Any communications regarding the draft decision.

This documentation is the foundation of any judicial challenge. Without it, proving a violation of procedural rights becomes significantly more difficult.

Common misconceptions

Misconception 1: CADA fines are final and cannot be appealed. This is incorrect. Article 26(4) explicitly guarantees the right to an effective judicial remedy. While an NCA's decision is binding and enforceable, it is not final in the sense of being immune from review. Affected parties have a statutory right to challenge the legality and proportionality of the measure in national courts.

Misconception 2: The European Commission imposes CADA fines. This is incorrect. CADA enforcement is decentralised. Article 25 designates national competent authorities in each Member State as the primary enforcers. The Commission's role is supervisory and coordinating (e.g., resolving disputes between NCAs under Article 28), but it does not directly impose fines on providers. Therefore, challenges are brought before national courts, not the Court of Justice of the European Union (CJEU), unless a preliminary ruling on EU law interpretation is sought.

Misconception 3: Only the cloud provider can challenge a fine. This is incorrect. Article 26(4) refers to "all affected parties." This broad phrasing ensures that subcontractors, auditing organisations, or other entities that were subject to investigative measures (such as information requests or inspections) also have standing to challenge those measures if their rights were infringed.

Misconception 4: Filing an appeal automatically stops the fine. This is generally incorrect. In most EU Member States, filing an appeal does not automatically suspend the obligation to pay or the enforcement of the fine. A separate request for a "stay of execution" is usually required, and the court must be convinced that immediate enforcement would cause irreparable harm. Compliance officers should prepare for the financial impact of the fine while pursuing legal challenges.

Misconception 5: National courts cannot review the substance of the fine. This is incorrect. The "effective judicial remedy" implies a full review of both the facts and the law. National courts have the authority to assess whether the NCA correctly applied the criteria for fines (e.g., turnover, gravity) and whether the evidence supports the finding of an infringement.

Related

This is general information about a draft EU regulation, not legal advice.