Summary Yes, both the European Parliament and the Council can object to a delegated act under the proposed Cloud and AI Development Act (CADA). As proposed in Article 45(6), a delegated act will enter into force only if no objection has been expressed by either institution within two months of notification. This period can be extended by three months at the initiative of the European Parliament or the Council. If either body objects within this timeframe, the act does not enter into force. This mechanism ensures that the Commission cannot unilaterally alter critical technical criteria, such as Union Assurance Levels, without the consent of the co-legislators.

Detail

The Cloud and AI Development Act (CADA), proposed as Regulation COM(2026) 502 final, establishes a framework for strengthening Europe's cloud and AI ecosystem. A significant portion of the regulation's technical adaptability relies on delegated acts, which empower the European Commission to supplement or amend non-essential elements of the legislation. These acts are crucial for updating technical criteria, audit evidence, and assurance levels in response to rapid technological change without requiring a full legislative revision.

However, this power is strictly circumscribed by the oversight rights of the European Parliament and the Council. The specific procedural safeguards for these acts are codified in Article 45 of the proposal.

The Objection Mechanism: Article 45(6)

The core of the oversight mechanism is the "negative consent" procedure defined in Article 45(6). This provision dictates the precise conditions under which a delegated act becomes legally binding.

According to the text of Article 45(6):

"Delegated act adopted pursuant to Article 6(4), Article 16(2), Article 20(9), Article 21(1), and Article 31(3) shall enter into force only if no objection has been expressed either by the European Parliament or by the Council within a period of two months of notification of that act to the European Parliament and to the Council or if, before the expiry of that period, the European Parliament and the Council have both informed the Commission that they will not object."

This clause establishes three critical rules:

  1. The Two-Month Window: The default period for scrutiny is two months starting from the date of notification to both institutions.
  2. The Extension Right: The same article explicitly states: "That period shall be extended by three months at the initiative of the European Parliament or of the Council." This means either institution can unilaterally extend the scrutiny period by an additional three months, bringing the maximum potential review time to five months.
  3. The Veto Condition: The act enters into force only if no objection is raised. If either the Parliament or the Council expresses an objection within the applicable period (two months or the extended three months), the act fails to enter into force.

The provision also allows for early entry into force if both institutions explicitly inform the Commission that they will not object before the deadline expires. However, in the absence of such explicit confirmation, silence does not constitute consent until the period has fully elapsed without objection.

Scope of Delegated Acts Subject to Objection

The objection mechanism in Article 45(6) applies specifically to the most sensitive technical amendments within CADA. The delegation of power is conferred for an indeterminate period under Article 45(2), but it is limited to the following specific articles:

  • Article 6(4): Amending Annex I (Grand Challenges) to reflect relevant market and technological developments regarding the Cloud and AI Leadership Initiatives.
  • Article 16(2): Amending Annex II (Criteria for Union Assurance Levels) and Annex III (Audit Evidence). This is particularly critical, as it allows the Commission to update the criteria for Levels 1 through 4, which determine a provider's eligibility to serve the public sector.
  • Article 20(9): Laying down detailed rules on the performance of audits, including procedural steps, rules for auditing organisations, technical competences, and templates for audit reports.
  • Article 21(1): Amending Annex III to specify the necessary evidence needed to assess the audit criteria under Annex II.
  • Article 31(3): Specifying the need for impact assessments and risk mitigation measures for private companies operating in sectors of high criticality.

Because these delegated acts can fundamentally alter the compliance landscape for cloud providers and public procurers, the objection right serves as a vital check on the Commission's regulatory power.

The Procedure for Notification and Objection

The process is designed to ensure transparency and simultaneous access to information for both co-legislators.

  1. Notification: Under Article 45(5), as soon as the Commission adopts a delegated act, it must notify it simultaneously to the European Parliament and to the Council.
  2. Consultation: Before adopting the act, Article 45(4) requires the Commission to consult experts designated by each Member State in accordance with the principles of the Interinstitutional Agreement on Better Law-Making.
  3. Scrutiny: Upon notification, the two-month clock begins. During this time, the Parliament and Council may review the act for legality, proportionality, and consistency with the parent regulation.
  4. Objection: If either institution objects, the act is blocked. The objection must be expressed within the two-month period (or the extended three-month period if initiated).
  5. Outcome: If an objection is raised, the act does not enter into force. The Commission cannot force the act through. It must either withdraw the act, revise it to address the concerns, or propose a new legislative measure through the ordinary legislative procedure.

Revocation of the Delegation of Power

Distinct from objecting to a specific act, Article 45(3) provides a broader mechanism for the co-legislators to reclaim their legislative authority. It states:

"The delegation of power referred to in Article 6(4), Article 16(2), Article 20(9), Article 21(1), and Article 31(3) may be revoked at any time by the European Parliament or by the Council."

A decision to revoke "puts an end to the delegation of the power specified in that decision." Crucially, Article 45(3) clarifies that such a revocation "shall not affect the validity of any delegated acts already in force." This means revocation is a forward-looking measure that prevents the Commission from adopting new delegated acts in those areas, whereas an objection under Article 45(6) prevents a specific act from ever taking effect.

What this means for you

For legal counsel, compliance officers, and cloud service providers, understanding the objection mechanism is essential for risk management and strategic planning.

1. Regulatory Volatility During the Scrutiny Period

When the Commission publishes a draft delegated act (e.g., updating the criteria for Union Assurance Level 3), it does not become law immediately. There is a mandatory two-month waiting period, which can stretch to five months if the Parliament or Council initiates an extension. During this window, the legal status of the proposed changes is uncertain. Compliance teams should monitor the Official Journal of the European Union and Commission notifications closely. If an objection is likely, stakeholders may have additional time to prepare for the status quo or to lobby for changes before the act becomes binding.

2. Stability of Union Assurance Levels

The criteria for Union Assurance Levels (Annex II) are subject to amendment via delegated acts under Article 16(2). If the Commission proposes to tighten the requirements for third-country control or data localization, industry stakeholders can engage with Members of the European Parliament (MEPs) or Council representatives during the objection period. If you are preparing for an audit under Assurance Level 2, 3, or 4, be aware that the criteria could be amended, but only if the act survives the objection period without a veto.

3. Audit Methodology and Evidence

The rules for independent third-party audits (Article 20) and the specific evidence required (Annex III) are also subject to delegated acts under Article 20(9) and Article 21(1). Changes to audit methodologies, technical competences of auditors, or evidence templates will follow this same notification and objection process. Compliance officers should track these updates, as they directly impact the cost, complexity, and timeline of obtaining recognition for cloud services.

4. Strategic Advocacy

The objection period represents a critical "last mile" for stakeholder engagement. If a proposed delegated act imposes disproportionate burdens on SMEs, creates technical impossibilities, or conflicts with other EU regulations, industry associations can urge the Parliament or Council to raise an objection. This is a direct channel to halt regulatory changes that may be flawed or premature. Unlike the ordinary legislative procedure, where amendments are common, the objection mechanism offers a binary "veto" that can stop an act entirely.

Common misconceptions

"The Commission can change the law unilaterally." Incorrect. While the Commission drafts delegated acts, it cannot bypass the Parliament and Council. They possess a veto power via the objection mechanism in Article 45(6). The Commission cannot force a delegated act into force if either co-legislator objects within the specified period.

"Objection means the act is amended." Incorrect. The objection is a veto, not a negotiation tool. If the Parliament or Council objects, the act is rejected entirely and does not enter into force. The Commission must then draft a new act or seek other legislative solutions; it cannot simply amend the rejected text and re-adopt it under the same procedure.

"The two-month period is fixed and unchangeable." Incorrect. As explicitly stated in Article 45(6), the period "shall be extended by three months at the initiative of the European Parliament or of the Council." This means the maximum scrutiny period can be up to five months, providing significant time for detailed review.

"Delegated acts are permanent once adopted." Incorrect. The delegation of power itself can be revoked at any time by the Parliament or Council under Article 45(3). Furthermore, the Commission is required to review certain delegated acts regularly (e.g., every 18 months for Assurance Levels under Article 16(3)), ensuring they remain up-to-date with technological developments.

Related

This is general information about a draft EU regulation, not legal advice.