Summary Yes, delegated acts adopted under the proposed Cloud and AI Development Act (CADA) are fully subject to judicial review by the Court of Justice of the European Union (CJEU). While Article 45 of the proposal grants the European Parliament and the Council a political power to object to or revoke the delegation of power, this does not preclude legal challenges. Private parties, Member States, and EU institutions may challenge the validity of a CADA delegated act before the CJEU under Article 263 of the Treaty on the Functioning of the European Union (TFEU). Successful challenges typically rely on grounds such as lack of competence (exceeding the delegation), infringement of essential procedural requirements (e.g., failure to consult), or manifest error of assessment.

Detail

The proposed Cloud and AI Development Act (CADA), COM(2026) 502 final, establishes a complex governance framework where the European Commission is empowered to adopt secondary legislation to adapt technical criteria and operational rules. Article 45 of the proposal explicitly confers the power to adopt delegated acts to supplement or amend non-essential elements of the Regulation. Specifically, Article 45(2) lists the articles under which these powers are granted:

  • Article 6(4): Amending Annex I (Grand Challenges) to reflect market developments.
  • Article 16(2): Amending Annex II (Union assurance levels) and Annex III (Audit evidence).
  • Article 20(9): Laying down detailed rules for the performance of audits.
  • Article 21(1): Amending Annex III regarding necessary audit evidence.
  • Article 31(3): Specifying the need for impact assessments for private sector entities in high-criticality sectors.

These delegated acts are legally binding and produce legal effects vis-à-vis third parties. Consequently, they fall squarely within the scope of judicial review under the EU Treaties. It is critical to distinguish between the political scrutiny mechanism embedded in the CADA text and the judicial review mechanism provided by the EU Treaties.

Political Scrutiny (Article 45) vs. Judicial Review (Article 263 TFEU)

The CADA proposal outlines a specific political control mechanism in Article 45.

  • Revocation of Delegation: Under Article 45(3), the European Parliament or the Council may revoke the delegation of power "at any time." This is a political decision to strip the Commission of its authority to adopt further acts, not a review of a specific act's legality.
  • Objection Mechanism: Under Article 45(6), a delegated act shall enter into force only if no objection has been expressed by either the European Parliament or the Council within a period of two months of notification (extendable by three months). This is a "political veto." If either institution objects, the act does not enter into force.

However, the existence of this political veto does not immunize delegated acts from judicial scrutiny. Once a delegated act enters into force (either because no objection was raised or the objection period expired), it becomes part of the EU legal order. As such, it is subject to the general principle of judicial review enshrined in Article 263 TFEU. This article empowers the CJEU to review the legality of acts of the institutions, bodies, offices, or agencies of the Union intended to produce legal effects vis-à-vis third parties.

The distinction is fundamental:

  1. Article 45 (Political): A pre-entry-into-force check by the legislature. It is a political assessment of whether the act aligns with the political will of the Parliament and Council.
  2. Article 263 TFEU (Judicial): A post-entry-into-force check by the judiciary. It is a legal assessment of whether the act complies with the Treaties, the parent regulation (CADA), and general principles of law.

A delegated act that survives the Article 45 objection period can still be annulled by the CJEU if it is found to be unlawful. Conversely, an act that is objected to under Article 45 never enters into force and thus cannot be challenged under Article 263 (as there is no act to annul), though the decision to revoke the delegation could theoretically be challenged.

Who Can Challenge a Delegated Act?

Standing to bring an action for annulment under Article 263 TFEU varies significantly depending on the applicant's status.

1. Privileged Applicants (Automatic Standing) The European Parliament, the Council, and the Commission have automatic standing to challenge any act. In the context of CADA, the Parliament or Council might challenge a delegated act if they believe the Commission exceeded the scope of the delegation granted in Article 45, even if they did not exercise their political objection right in time.

2. Member States (Automatic Standing) Member States have automatic standing. If a Member State believes a CADA delegated act (e.g., one amending the criteria for Union assurance levels in Annex II) infringes upon national competencies, misinterprets the sovereignty framework, or violates the principle of subsidiarity, it can bring a direct action for annulment.

3. Private Parties (Companies, Individuals, Industry Associations) Private parties do not have automatic standing. To challenge a CADA delegated act directly, a private party must demonstrate that the act is of "direct and individual concern" to them, as established by the Plaumann test.

  • Direct Concern: The act must directly affect the applicant's legal situation without requiring further implementing measures.
  • Individual Concern: The applicant must be affected by reason of certain attributes peculiar to them, or by reason of a factual situation which differentiates them from all other persons.

This is a high threshold. A delegated act that updates the audit criteria for Union Assurance Level 3 generally applies to a class of entities (all cloud providers) and is considered to be of "general concern." However, if a delegated act imposes specific, unique obligations on a single company, or if the act is a "regulatory act" (non-legislative) that does not entail implementing measures, the "individual concern" requirement may be waived under the second paragraph of Article 263 TFEU.

In practice, private parties often find it difficult to challenge the delegated act itself directly. Instead, they may:

  • Challenge the implementing acts (adopted under Article 46) that apply the delegated rules to specific situations.
  • Raise the invalidity of the delegated act as a defense in national proceedings. If a national authority enforces a CADA requirement based on a delegated act, the affected party can argue in national court that the underlying delegated act is illegal. The national court may then (or must, if it is a court of last instance) refer the question of validity to the CJEU under Article 267 TFEU (preliminary ruling).

Grounds for Annulment

If a challenge is brought before the CJEU, the Court will assess the delegated act against the exhaustive grounds for annulment listed in Article 263 TFEU. For CADA delegated acts, the following grounds are most relevant:

1. Lack of Competence (Ultra Vires) The Commission may only act within the limits of the delegation. Article 45(2) specifies the exact scope: amending Annex I, updating Annex II/III, laying down audit rules, etc. If the Commission were to use a delegated act to fundamentally alter the structure of the sovereignty framework (e.g., creating a new assurance level not envisaged in the proposal) or to impose new substantive obligations on Member States, it would exceed its competence. The Court strictly interprets the scope of delegation; any act going beyond the "non-essential elements" defined in the parent regulation is liable to annulment.

2. Infringement of an Essential Procedural Requirement The CADA proposal imposes strict procedural obligations on the Commission before adopting a delegated act.

  • Consultation: Article 45(4) mandates that "the Commission shall consult experts designated by each Member State in accordance with the principles laid down in the Interinstitutional Agreement of 13 April 2016 on Better Law-Making." Failure to consult these experts, or to consult them in a manner that allows for genuine input, constitutes a breach of an essential procedural requirement.
  • Notification: Article 45(5) requires the Commission to notify the European Parliament and the Council "simultaneously" upon adoption. Failure to do so, or notifying them after the act has been published, could be grounds for annulment.
  • Reasoning: While not explicitly detailed in Article 45, general EU law requires that acts state the reasons on which they are based. A delegated act that fails to explain the technical or legal justification for changing audit criteria (Annex III) could be annulled.

3. Infringement of the Treaties or Any Rule of Law Relating to Their Application This is a broad ground covering violations of primary law (TFEU, TEU) and the Charter of Fundamental Rights.

  • Fundamental Rights: If a delegated act imposes audit requirements that disproportionately infringe on trade secrets (Article 33 Charter) or data protection rights (Article 8 Charter), it could be annulled. For example, if a delegated act under Article 20(9) required the disclosure of source code in a way that violated intellectual property rights without sufficient safeguards, it would be unlawful.
  • Principles of Proportionality and Legal Certainty: The act must be proportionate to the objective and clear enough for operators to foresee their obligations.

4. Misuse of Powers If the Commission adopted a delegated act for a purpose other than that for which the power was conferred (e.g., using the power to update Annex II to achieve a political goal unrelated to technical updates), the act could be annulled.

5. Manifest Error of Assessment While the CJEU grants the Commission a margin of appreciation in technical and scientific assessments (e.g., defining "state-of-the-art" cybersecurity standards), the Court will annul an act if the assessment is "manifestly incorrect" or based on materially inaccurate information. If a delegated act updating audit evidence criteria relies on flawed data or ignores established industry standards without justification, it may be struck down.

The Role of Implementing Acts

It is important to distinguish delegated acts from implementing acts. Article 46 of the proposal provides for implementing acts (e.g., specifying the procedure for the EuroCloud Federation or the practical arrangements for recognition). These are adopted under the examination procedure of Regulation (EU) No 182/2011, involving a committee of Member States.

  • Judicial Review: Implementing acts are also subject to judicial review under Article 263 TFEU.
  • Political Scrutiny: Unlike delegated acts, implementing acts are not subject to the Parliament/Council objection period in Article 45. Instead, they are scrutinized by the Member State committee.
  • Legal Effect: Delegated acts supplement or amend the regulation (quasi-legislative), while implementing acts ensure uniform conditions for application (executive). The grounds for annulment are similar, but the procedural context differs.

What this means for you

For in-house counsel, compliance officers, and legal teams in the cloud and AI sector, understanding the reviewability of CADA delegated acts is a critical component of strategic risk management.

  1. Monitor the Consultation Phase: Article 45(4) requires the Commission to consult Member State experts. While private companies are not the designated experts, industry associations often participate in these groups. Engaging during this phase is the most effective way to influence the technical content of delegated acts, such as the detailed rules for audits under Article 20(9) or the evidence requirements in Article 21(1). A failure to consult properly is a strong ground for future annulment.
  2. Assess Standing Early: If a delegated act imposes burdensome obligations (e.g., new evidence requirements for Union Assurance Level 4), assess whether your company is "individually concerned." If the act applies generally, direct challenge is difficult. Consider coordinating with industry bodies or lobbying a Member State to bring a challenge on your behalf.
  3. Prepare Defense Strategies: If you are subject to enforcement action based on a delegated act you believe is illegal, do not wait for a direct challenge. Raise the invalidity of the act as a defense in national court proceedings. The national court can (and must, if it is the final instance) refer the question of validity to the CJEU under Article 267 TFEU. This is often the most viable route for private parties to challenge the legality of a delegated act.
  4. Watch the Clocks:
    • Political: The Parliament and Council have two months (extendable by three) to object under Article 45(6).
    • Judicial: An action for annulment under Article 263 TFEU must be brought within two months of the publication of the act in the Official Journal or its notification to the plaintiff. Missing this deadline renders the act final and binding, even if it is legally flawed.

Common misconceptions

"Delegated acts are immune from court review because they are technical." Incorrect. While the CJEU shows deference to the Commission's technical expertise, it rigorously reviews whether the Commission stayed within its delegated powers and followed procedural rules. A technical act can be annulled for procedural flaws (e.g., failure to consult) or for exceeding the scope of the delegation.

"Only the European Parliament and Council can stop a delegated act." Incorrect. While they hold the political veto under Article 45, the CJEU holds the judicial veto under Article 263 TFEU. A delegated act that enters into force after the political objection period expires can still be annulled by the Court if it is found to be unlawful. The political process is not a substitute for judicial review.

"I can challenge any delegated act as a company." Incorrect. Private parties face a high standing threshold. You must prove the act is of "direct and individual concern" to you. Broad regulatory changes affecting all cloud providers generally fail this test. Coordination with industry groups, reliance on Member State challenges, or raising the issue as a defense in national proceedings are often necessary strategies.

"If the Parliament doesn't object, the act is legal." Incorrect. The Parliament's silence under Article 45 only means the act enters into force. It does not validate the act's legality. The act remains subject to full judicial review, and if it violates the Treaties or the CADA proposal, it can be annulled years later.

Related

This is general information about a draft EU regulation, not legal advice.