Does CADA give customers a private right of action against providers?

Summary The proposed Cloud and AI Development Act (CADA) does not establish a broad, standalone private right of action for every regulatory violation. However, Article 24(3) explicitly grants recipients of cloud computing services a direct right to seek compensation from providers for any damage or loss suffered due to infringements of the sovereignty framework obligations (Title IV). This private enforcement mechanism operates alongside public administrative penalties, allowing victims to pursue remedies through national courts while Member States enforce regulatory fines.

Detail

The enforcement architecture of the proposed Cloud and AI Development Act (CADA) is bifurcated, distinguishing clearly between public regulatory enforcement and private civil liability. For legal counsel and compliance officers, understanding this distinction is critical for risk management, contract drafting, and litigation strategy. CADA does not create a blanket private right of action for every breach of the regulation; rather, it specifically carves out a compensation right for damages resulting from infringements of the Union cloud computing sovereignty framework (Title IV).

The Specific Right to Compensation: Article 24(3)

The cornerstone of private enforcement under CADA is found in Article 24(3). The provision states:

"Recipients of the cloud computing services shall have the right to seek, in accordance with Union and national law, compensation from cloud computing service providers for any damage or loss suffered due to an infringement by those providers of their obligations under this Chapter."

This clause establishes a clear causal link requirement: the recipient must demonstrate that the damage or loss was a direct result of the provider's infringement of their obligations under Title IV. This chapter encompasses the Union assurance levels (Article 16), the recognition procedures (Article 17), the transparency obligations (Article 23), and the associated audit requirements (Article 20).

It is crucial to note the phrasing "in accordance with Union and national law." CADA does not prescribe the specific procedural mechanisms, statutes of limitation, burden of proof standards, or calculation methodologies for these claims. Instead, it mandates that Member States ensure such a right exists within their national legal systems. Consequently, the actual litigation will occur in national courts, applying local civil procedure rules, but grounded in the substantive rights created by CADA.

Public Penalties vs. Private Compensation

CADA employs a dual-track enforcement model. While Article 24(3) addresses private redress, Article 24(1) and Article 24(2) address public enforcement.

Article 24(1) obliges Member States to lay down rules on penalties applicable to infringements by cloud computing service providers. These penalties must be "effective, proportionate and dissuasive." Article 24(2) provides a non-exhaustive list of criteria for imposing these penalties, including:

The nature, gravity, scale, and duration of the infringement.
Any action taken by the infringing party to mitigate or remedy the damage.
The financial benefits gained or losses avoided by the infringing party.
The infringing party's annual turnover in the Union.

Crucially, the existence of public fines does not preclude private compensation. A provider can be fined by a national competent authority for failing to maintain a specific Union assurance level, while simultaneously facing civil litigation from a customer who suffered data loss or service disruption as a result of that failure. The two tracks are complementary: public penalties deter non-compliance and punish the provider, while private compensation restores the victim to their pre-infringement position.

Scope of "Recipients" and "Infringements"

The term "recipients" in Article 24(3) refers to the entities purchasing or using the cloud computing services. Given that the sovereignty framework (Title IV) is largely triggered by public procurement requirements under Article 30, this primarily encompasses public sector bodies and Union entities. However, the definition is not strictly limited to them; any entity receiving the service in a context where the provider has obligations under Title IV could potentially qualify.

The "infringements" covered are specific to the obligations under Title IV. This includes:

False Claims of Assurance Levels: If a provider falsely claims to offer Union Assurance Level 2, 3, or 4, and a customer relies on this for sensitive data processing, any resulting breach of confidentiality or operational failure could trigger compensation.
Failure to Notify Material Changes: Under Article 23, providers must notify authorities of material changes affecting their assurance level. Failure to do so, if it leads to a security incident or loss, could be grounds for a claim.
Breach of Audit Obligations: If a provider fails to undergo the required independent audits for Levels 2-4 (as per Article 20), and this lack of oversight contributes to a service failure, the recipient may seek damages.

Limitations and Context

It is vital to distinguish CADA's private right from other EU regulations. The GDPR, for instance, has been interpreted by the Court of Justice of the European Union (CJEU) to allow private claims for non-material damage, but the scope is often debated. CADA's Article 24(3) is more explicit in granting the right to seek compensation for "damage or loss," which typically implies material harm (financial loss, operational downtime, remediation costs).

Furthermore, this right does not extend to general breaches of the Data Act or the AI Act unless those breaches also constitute an infringement of the specific sovereignty obligations under CADA's Title IV. For example, a breach of data portability rules under the Data Act would not trigger Article 24(3) of CADA, but a breach of the requirement to keep customer data exclusively within the Union (a criterion in Annex II for all assurance levels) would.

What this means for you

For in-house counsel and compliance officers, the existence of a private right of action under Article 24(3) has immediate implications for contract management, insurance, and operational resilience.

1. Contractual Allocation of Liability You must review existing and future cloud service agreements. Standard indemnity clauses may need to be updated to account for CADA's specific liability regime. Ensure that your contracts with cloud providers explicitly address liabilities arising from failures to meet Union Assurance Levels. Consider negotiating specific caps or exclusions for indirect damages, while ensuring that the provider's insurance covers potential compensation claims under Article 24(3).

2. Evidence Preservation and Audit Trails To succeed in a compensation claim, you must prove causation: that the provider's infringement caused your loss. This requires rigorous logging and monitoring. If you are a recipient of a Level 3 or 4 service, ensure you have access to audit reports (where legally permissible) and maintain detailed records of service disruptions, data breaches, or operational anomalies. These records will be critical evidence in national courts.

3. Due Diligence on Provider Status Regularly verify the provider's status in the central repository established under Article 22. If a provider's recognition is revoked or amended, you must act swiftly to mitigate risks. Failure to migrate or adjust controls after a known change in assurance level could weaken a subsequent compensation claim, as a court might find that you failed to mitigate your own losses.

4. Insurance Coverage Review your cyber liability and professional indemnity insurance policies. Ensure they cover claims arising from regulatory non-compliance under CADA. Given the potential severity of penalties under Article 24(2) and the risk of private compensation, adequate coverage is essential.

5. Monitoring Regulatory Guidance The Commission will issue guidance on the methodology for risk assessments and the mapping of assurance levels to data sensitivity. Stay informed about these updates, as they will influence how courts interpret "infringements" and the standard of care expected from providers.

Common misconceptions

Misconception 1: CADA creates a broad private right of action for all violations. Reality: Article 24(3) is limited to infringements of the obligations under Title IV (the sovereignty framework). It does not create a private right for breaches of Title II (R&D initiatives) or Title III (data centre deployment). A provider's failure to meet energy efficiency standards in an acceleration zone, for example, would not trigger a private compensation claim under CADA.

Misconception 2: Private compensation replaces public fines. Reality: The two are cumulative. A provider can be fined by the state and ordered to pay compensation to the victim simultaneously. The public penalty is a matter of regulatory enforcement, while the compensation is a matter of civil restitution.

Misconception 3: Only public sector bodies can claim compensation. Reality: While the sovereignty framework primarily targets public procurement, Article 24(3) refers to "recipients of the cloud computing services." If a private entity is a recipient of a service where the provider has obligations under Title IV (e.g., a service marketed as sovereign for public use but also used by a private partner), that private entity may also have standing, depending on national law interpretations.

Misconception 4: The right to compensation is automatic upon infringement. Reality: The recipient must actively seek compensation "in accordance with Union and national law." This requires filing a claim in a national court. It is not an automatic refund or adjustment by the provider. The recipient bears the burden of proving the infringement, the damage, and the causal link.

Official sources

This is general information about a draft EU regulation, not legal advice.