Summary Under the proposed Cloud and AI Development Act (CADA), cloud computing service providers facing enforcement actions by national competent authorities are guaranteed robust procedural safeguards. Article 26(4) explicitly mandates that any exercise of investigative or enforcement powers must respect the right to respect for private life, the rights of defence (including the right to be heard and access to the file), and the right to an effective judicial remedy. These safeguards ensure compliance with the general principles of Union law, preventing arbitrary enforcement while authorities exercise significant powers to impose fines, order cessation of infringements, or demand information.

Detail

The Cloud and AI Development Act (CADA) establishes a rigorous sovereignty framework for cloud computing services, granting national competent authorities substantial powers to investigate and sanction non-compliance. However, the proposal is designed to balance these enforcement capabilities with fundamental procedural guarantees. These protections are codified primarily in Article 26, specifically in paragraph 4, which serves as the procedural shield for providers.

The Legal Basis: Article 26(4)

Article 26(4) is the cornerstone of procedural fairness in CADA enforcement. It stipulates that Member States must lay down specific rules and procedures for the exercise of the investigative and enforcement powers granted in paragraphs 1 and 2 of the same article. Crucially, the provision mandates that any exercise of these powers is subject to adequate safeguards under applicable national law in compliance with the general principles of Union law.

The text of Article 26(4) explicitly enumerates the fundamental rights that must be respected during any enforcement procedure:

  • The right to respect for private life: This ensures that investigations into a provider's operations do not unnecessarily infringe upon the privacy of individuals or the confidential nature of business data, unless strictly necessary for the investigation.
  • The rights of defence: This is a comprehensive umbrella term that encompasses specific procedural rights essential for a fair trial in administrative proceedings.
  • The right to be heard: Providers must be given the opportunity to present their observations, arguments, and evidence before a final decision is adopted.
  • The right to access the file: Providers must be able to review the evidence, documents, and information held by the competent authority that form the basis of the suspected infringement.
  • The right to an effective judicial remedy: Affected parties must have the ability to challenge enforcement measures, decisions, or penalties before a court or tribunal.

These rights are not merely aspirational; they are binding conditions that Member States must transpose into their national administrative law to ensure that CADA enforcement is lawful and proportionate.

Scope of Powers and the Necessity of Safeguards

To appreciate the weight of these rights, one must understand the powers they constrain. Article 26(1) grants competent authorities of establishment significant investigative powers, including:

  • The power to require any cloud computing service provider, auditing organisation, or other relevant persons to provide information.
  • The power to carry out, or request a judicial authority to order, inspections of any premises used for the provider's trade or profession.
  • The power to ask staff or representatives to give explanations regarding suspected infringements and, with consent, to record their answers.

Article 26(2) grants equally potent enforcement powers, including:

  • The power to order the cessation of infringements and impose proportionate remedies.
  • The power to impose fines for failure to comply with the Regulation or investigative orders.
  • The power to impose periodic penalty payments to ensure the termination of infringements.

Because these powers can severely impact a provider's operations, reputation, and financial standing, Article 26(3) requires that measures taken be "effective, dissuasive and proportionate." The rights of defence in Article 26(4) serve as the critical legal mechanism to ensure that this proportionality is not violated and that decisions are based on accurate, verified facts.

Interaction with Other CADA Provisions

The rights of defence are not isolated to Article 26; they permeate the CADA framework, interacting with other key provisions:

  • Article 24 (Penalties and compensation): While Article 24 outlines the criteria for imposing penalties (such as the nature, gravity, and duration of the infringement, and any financial benefits gained), the procedural right to be heard ensures that providers can contest these factors before penalties are levied. A provider can argue that the "financial benefits gained" were overstated or that mitigating factors were overlooked.
  • Article 17 (Recognition of cloud computing service providers): The right to be heard extends beyond enforcement to the administrative recognition phase. Under Article 17(5)(c), prior to rejecting a request for recognition, the evaluating competent authority must give the candidate provider the opportunity to provide written comments on the conclusions of the evaluation. This mirrors the enforcement safeguards, ensuring providers can defend their case before a recognition is denied.
  • Article 23 (Transparency obligations): If a provider notifies an authority of a material change under Article 23, and the authority subsequently initiates an enforcement action based on that notification, the provider retains the full suite of rights under Article 26(4) to challenge the authority's interpretation of that change.

The Role of National Law and Union Principles

CADA does not create a standalone, detailed procedural code for every minute aspect of the rights of defence. Instead, Article 26(4) relies on Member States to transpose these Union-level principles into national law. This means that while the existence of the right to access the file or the right to be heard is guaranteed by CADA, the mechanics (e.g., specific timelines for submitting comments, the format of file access, the specific court of appeal) will depend on the national administrative law of the Member State where the competent authority is located.

However, this delegation is not a blank check. The national rules must meet the threshold of the general principles of Union law. If national procedures fail to provide an effective right to be heard or access to the file, they would be in breach of the Regulation. The European Court of Justice would likely interpret these national rules in light of the fundamental rights guaranteed by the Charter of Fundamental Rights of the European Union.

What this means for you

For in-house counsel, compliance officers, and external legal advisors, the rights of defence provisions in CADA have immediate operational implications for managing regulatory risk and enforcement interactions.

1. Prepare for Evidence Requests and File Access When a national competent authority exercises its investigative powers under Article 26(1), you must understand that the information you provide will form the basis of the "file" to which you have a right of access under Article 26(4). Ensure that your internal documentation is accurate and defensible. Inaccurate or misleading information can lead to severe penalties under Article 24, and your ability to contest these penalties will be hampered if your initial submissions were flawed. Conversely, if the authority relies on external audit opinions (under Article 20) or internal notes, you must formally request access to these documents to verify their accuracy and context before responding.

2. Assert the Right to Be Heard Proactively If you receive a notice of a suspected infringement or a draft decision, do not assume it is final. Article 26(4) guarantees your right to be heard. You should formally submit written comments, evidence, and legal arguments. Use this opportunity to challenge the authority's assessment of the "nature, gravity, and duration" of the infringement, as required by Article 26(3). This is your primary chance to influence the outcome before a final decision is adopted.

3. Leverage Proportionality Arguments Article 26(3) requires that enforcement measures be proportionate to the infringement and the provider's economic and operational capacity. When facing enforcement, argue that any fines or orders are disproportionate to your specific circumstances. Document your financial constraints, technical challenges, and any steps taken to mitigate the infringement. This is a key element of the rights of defence and can significantly reduce potential penalties.

4. Plan for Judicial Review If administrative remedies fail, Article 26(4) guarantees an effective judicial remedy. Understand the national court procedures in the Member State where the competent authority is located. Given the technical complexity of cloud sovereignty cases, ensure your legal team has expertise in both administrative law and cloud technology. The right to an effective judicial remedy ensures that you can challenge not just the outcome, but also the legality of the procedure itself.

5. Monitor National Transposition Since Article 26(4) relies on national law for specific procedures, you must monitor how each Member State transposes these rights. Procedures for accessing the file or timelines for the right to be heard may vary. Ensure your compliance strategy is adapted to the specific national rules of the Member State where the enforcement action is taking place.

Common misconceptions

Misconception 1: CADA provides a detailed, self-contained procedural code. Reality: CADA sets the principles (rights of defence, access to file, etc.) in Article 26(4), but it relies on national law for the specific procedural rules. You must comply with national administrative procedures that incorporate these Union principles.

Misconception 2: The right to be heard applies only to final decisions. Reality: The right to be heard is a continuous procedural guarantee. It applies during the investigative phase (when providing information under Article 26(1)) and before any enforcement measure is taken. You can and should engage with the authority throughout the process to correct misunderstandings early.

Misconception 3: Access to the file means access to all internal authority documents. Reality: While you have the right to access the file, this right may be subject to limitations regarding confidential information, trade secrets of other parties, or ongoing investigations. However, the core evidence used against you to justify a sanction must be accessible to ensure a fair defence.

Misconception 4: Rights of defence are only relevant for fines. Reality: The rights of defence apply to all enforcement measures, including orders to cease infringements and periodic penalty payments. Even non-monetary sanctions can have severe operational impacts, justifying the use of defensive rights to challenge the necessity or proportionality of such orders.

Related

This is general information about a draft EU regulation, not legal advice.