Summary Under the proposed Cloud and AI Development Act (CADA), the European Commission is legally required to notify the European Parliament and the Council simultaneously immediately upon adopting a delegated act, as mandated by Article 45(5). This simultaneous notification is the critical procedural trigger that starts the two-month objection period defined in Article 45(6). During this window, either institution may block the act from entering into force. The period may be extended by three months at the initiative of either institution.

Detail

The proposed Cloud and AI Development Act (CADA), COM(2026) 502 final, establishes a framework for strengthening Europe's cloud and AI ecosystem. To ensure the regulation remains adaptable to rapid technological changes without requiring a full legislative revision, the proposal grants the European Commission the power to adopt delegated acts. These acts allow the Commission to supplement or amend non-essential elements of the regulation, such as updating the criteria for Union assurance levels in Annex II or specifying detailed rules for audit evidence in Annex III.

However, this delegated power is subject to strict democratic oversight. The legislative procedure governing how these acts are communicated to the co-legislators is designed to ensure transparency, equality, and the ability of the Parliament and Council to exercise their veto power effectively.

The Obligation of Simultaneous Notification

The cornerstone of this oversight mechanism is Article 45(5) of the CADA proposal. This provision imposes a strict, non-discretionary obligation on the Commission regarding the timing and method of communication.

The text of Article 45(5) states:

"As soon as it adopts a delegated act, the Commission shall notify it simultaneously to the European Parliament and to the Council."

This requirement serves two distinct but interconnected purposes:

  1. Procedural Equality and Transparency: The term "simultaneously" ensures that neither the European Parliament nor the Council receives privileged or early access to the legislative text. Both co-legislators must have equal and immediate access to the act to conduct their scrutiny. This prevents any tactical advantage where one institution might be informed before the other, potentially influencing the legislative dynamic or the timing of objections.
  2. Defining the Start of the Objection Clock: The moment of simultaneous notification is the definitive legal starting point for the procedural timeline. It is not the date of adoption by the Commission, nor the date of publication in the Official Journal, but the date of this specific notification that triggers the countdown for the objection period.

The Two-Month Objection Period and Entry into Force

The notification under Article 45(5) directly activates the mechanism described in Article 45(6). This provision establishes the specific timeframe and conditions under which a delegated act becomes legally binding.

As proposed, a delegated act adopted pursuant to the powers listed in Article 45(2) (which references Articles 6(4), 16(2), 20(9), 21(1), and 31(3)) shall enter into force only if:

  • No objection has been expressed by either the European Parliament or the Council within a period of two months of notification of that act; or
  • Before the expiry of that period, both the European Parliament and the Council have informed the Commission that they will not object.

If either institution raises an objection within this two-month window, the delegated act does not enter into force. The Commission cannot proceed with the act without addressing the concerns of the objecting institution. This effectively halts the regulatory change, requiring the Commission to either withdraw the act, amend it, or propose a new legislative act to achieve the same result.

Extension of the Scrutiny Period

Recognizing that some delegated acts may involve complex technical assessments or significant policy implications, Article 45(6) provides a mechanism for extending the scrutiny period.

The text states:

"That period shall be extended by three months at the initiative of the European Parliament or of the Council."

This provision allows for a total scrutiny period of up to five months (two months initial + three months extension). The extension is triggered at the initiative of either institution, meaning a single request from the Parliament or the Council is sufficient to extend the deadline. This ensures that if either body requires more time to analyze the technical details of an amendment to the Union assurance levels or audit criteria, they can secure that time without needing the consent of the other institution.

Scope of Delegated Acts Subject to This Procedure

It is crucial to distinguish which powers under CADA are subject to this specific notification and objection procedure. Article 45(2) explicitly lists the powers conferred on the Commission that are subject to the conditions of Article 45. These include:

  • Amending Annex I: To reflect relevant market and technological developments regarding the Cloud and AI Leadership Initiatives (Article 6(4)).
  • Amending Annexes II and III: To update the criteria for Union assurance levels (Article 16(2)) and the evidence set out in Annex III (Article 21(1)).
  • Audit Rules: To supplement the Regulation by laying down detailed rules for the performance of audits, including procedural steps and templates (Article 20(9)).
  • Private Sector Impact Assessments: To specify the need for impact assessments and risk mitigation measures for private companies operating in sectors of high criticality (Article 31(3)).

The delegation of power for these acts is conferred for an indeterminate period from the date of entry into force of the Regulation. However, Article 45(3) clarifies that this delegation may be revoked at any time by the European Parliament or the Council, providing a further layer of control over the Commission's rule-making authority.

What this means for you

For in-house counsel, compliance officers, and legal teams within the cloud and AI sector, understanding the notification mechanism of delegated acts is essential for strategic regulatory monitoring and compliance planning.

1. Monitoring the Notification, Not Just Publication While the Official Journal of the European Union is the standard source for legal texts, the legal clock for the objection period starts before publication, at the moment of simultaneous notification to the EP and Council. Compliance teams should monitor the Commission's internal registers and the EUR-Lex database for newly adopted delegated acts, particularly those amending Annex II (sovereignty criteria) or Annex III (audit evidence). A delay in publication does not pause the objection clock; the two-month period runs from the notification date.

2. The "Silence is Consent" Window The period between notification and the expiry of the objection window is a critical "waiting period." If no objection is raised within two months (or five if extended), the act enters into force automatically. Companies preparing for audits under Union assurance levels 2, 3, or 4 must use this window to adjust their technical documentation, software bills of materials (SBOM), and supply chain controls. Once the act enters into force, the new criteria become mandatory, and there is no further opportunity to challenge the act through the objection procedure.

3. Strategic Engagement Timing The simultaneous notification ensures that industry stakeholders have a clear, predictable timeline for the finalization of rules. However, the most effective window for industry input is before the act is adopted. Article 45(4) mandates that the Commission consult experts designated by each Member State during its preparatory work. Once the act is adopted and notified, the scope for changing the act is limited strictly to the objection process by the Parliament or Council. Therefore, engaging with the Commission during the consultation phase is far more effective than attempting to influence the outcome after notification.

4. Legal Certainty and Validity The strict requirement for simultaneous notification under Article 45(5) is a procedural safeguard. If a delegated act were to be notified sequentially (e.g., to the Council first, then the Parliament), it could be argued that the procedural requirements were violated, potentially rendering the objection period invalid or the act itself subject to annulment by the Court of Justice of the European Union. This ensures that the regulatory environment remains stable and that no "hidden" rules are enacted without full co-legislator awareness.

Common misconceptions

Misconception 1: Notification happens after publication in the Official Journal. Correction: No. Article 45(5) requires notification as soon as the act is adopted. Publication typically follows shortly after, but the legal objection period begins upon notification to the EP and Council, not upon public publication.

Misconception 2: The Commission can notify institutions sequentially to manage the timeline. Correction: No. The word "simultaneously" in Article 45(5) is mandatory. Sequential notification would violate the procedural requirements and could jeopardize the legal validity of the act.

Misconception 3: Only the Council can object to delegated acts. Correction: Both the European Parliament and the Council have equal veto power. If either institution objects within the two-month period, the act does not enter into force.

Misconception 4: The two-month objection period is fixed and cannot be changed. Correction: The period can be extended by three months at the initiative of either the European Parliament or the Council. This means the total scrutiny period can last up to five months, providing flexibility for complex technical reviews.

Related

This is general information about a draft EU regulation, not legal advice.