What is the appeal timeline for a CADA decision?

Summary The proposed Cloud and AI Development Act (CADA) does not establish a uniform, EU-wide calendar for appealing enforcement decisions. Instead, Article 26(4) explicitly mandates that the procedural rules, including specific appeal deadlines, are determined by the national procedural law of the Member State where the competent authority is established. While CADA guarantees the right to an effective judicial remedy and the rights of defence (including the right to be heard and access to the file), the exact timeframe to lodge an appeal varies by jurisdiction. In-house counsel must therefore identify and monitor local administrative court deadlines, which can range from two weeks to several months, rather than relying on a single EU standard.

Detail

As proposed in COM(2026) 502 final, the Cloud and AI Development Act (CADA) creates a robust sovereignty framework for cloud computing services. This framework empowers national competent authorities to investigate infringements, order the cessation of violations, and impose penalties. However, the regulation deliberately leaves the procedural mechanics of challenging these decisions to the Member States, adhering to the principle of procedural autonomy within the EU legal order.

The Absence of a Fixed EU Appeal Deadline

Unlike certain sector-specific regulations that embed specific appeal periods (e.g., "30 days from notification") directly into the text, CADA does not prescribe a fixed number of days for challenging a decision. The proposal relies on the general principles of EU law, specifically the requirement for an effective judicial remedy, while delegating the implementation of procedural timelines to national law.

The governing provision is Article 26, which details the powers of national competent authorities. Article 26(4) is the critical clause for appeal timelines, stating:

"Member States shall set out specific rules and procedures for the exercise of the powers pursuant to paragraphs 1 and 2 and shall ensure that any exercise of those powers is subject to adequate safeguards under applicable national law in compliance with the general principles of Union law. Those measures shall be taken only in accordance with the right to respect for private life and the rights of defence, including the rights to be heard and to have access to the file, and shall be subject to the right of all affected parties to an effective judicial remedy."

This text confirms a two-tier structure:

Substantive Powers: CADA defines what authorities can do (e.g., impose fines under Article 26(2), order inspections under Article 26(1)).
Procedural Safeguards: CADA defines how these powers must be exercised (respecting rights of defence and judicial remedy), but leaves the timing (deadlines) to national law.

Consequently, a cloud provider facing a decision in France will be subject to French administrative procedural deadlines, while a provider in Germany will be subject to German deadlines. There is no "CADA clock" that ticks uniformly across the Union.

The Role of National Procedural Law and the Principle of Effectiveness

Because CADA is a Regulation, it is directly applicable. However, under the principle of procedural autonomy, Member States retain the competence to design their own administrative and judicial procedures, provided they respect two fundamental EU principles: equivalence and effectiveness.

Equivalence: The rules for appealing a CADA decision must not be less favourable than those governing similar domestic actions (e.g., appeals against fines under national cybersecurity or data protection laws).
Effectiveness: The national rules, including the appeal timeline, must not make it practically impossible or excessively difficult to exercise the right to an effective judicial remedy guaranteed by Article 26(4).

In practice, this results in a fragmented landscape. In some Member States, the deadline to appeal an administrative fine might be as short as two weeks from the date of notification. In others, it may be one month or longer. These deadlines are typically codified in national administrative procedure acts, specific digital market laws, or the national laws transposing the NIS2 Directive, rather than in the CADA text itself.

Rights of Defence: The Foundation of the Appeal Process

While the timeline is national, the substantive rights during the pre-appeal and appeal phases are harmonised by CADA. Article 26(4) explicitly protects the "rights of defence, including the rights to be heard and to have access to the file."

These rights have a direct impact on the appeal timeline and strategy:

Right to be Heard: Before a competent authority adopts a final decision (such as a penalty), it must allow the provider sufficient time to respond to the objections raised. If an authority fails to grant this opportunity, the resulting decision is procedurally flawed.
Access to the File: Providers must be granted access to the evidence used against them.
Impact on Deadlines: If a provider is denied the right to be heard or access to the file, this procedural violation can form the primary ground for an appeal to annul the decision. In some jurisdictions, such a violation may even suspend the running of the appeal deadline until the defect is cured.

Therefore, compliance teams must meticulously document every instance where they were denied timely access to evidence or given insufficient time to prepare a defence. A failure to respect these rights under Article 26(4) can invalidate the enforcement action, regardless of whether the appeal was lodged within the standard national deadline.

Investigative Powers and Immediate Challenges

Article 26(1) grants competent authorities broad investigative powers, including the power to require information, conduct inspections, and seize data. While these are often considered "interim" or "investigative" measures rather than final penalties, they can be challenged immediately.

The timeline for challenging an investigative order is often significantly shorter than for a final penalty. In many jurisdictions, a provider must act within days to prevent the execution of an inspection or the seizure of data. Again, these specific short-term deadlines are defined by national law. However, the overarching protection remains the right to an effective judicial remedy under Article 26(4). If a provider believes an inspection exceeds the scope of CADA or violates the rights of defence, they must act swiftly under local procedural rules to seek an injunction or annulment.

Penalties, Compensation, and the Appeal Process

Article 24 of CADA outlines the penalties and compensation rules. Member States must lay down rules on penalties that are "effective, proportionate and dissuasive." When a penalty is imposed, the provider has the right to seek compensation for damages under national law.

The appeal of the penalty itself follows the judicial remedy path described above. It is crucial to note that filing an appeal does not automatically suspend the obligation to pay a fine or comply with a corrective order unless national law provides for a suspensive effect. This varies significantly by jurisdiction:

In some Member States, an appeal automatically stays enforcement.
In others, the provider must explicitly request a stay and potentially provide financial security (a bond) to halt enforcement while the appeal is pending.

What this means for you

For in-house counsel and compliance officers, the lack of a uniform EU appeal timeline in CADA requires a proactive, localised compliance strategy.

Map Local Deadlines Immediately: You cannot rely on a generic "30-day" or "60-day" rule. You must identify the specific administrative appeal deadlines in every Member State where your cloud computing service provider has its main establishment (as defined in Article 25(4)). This is the jurisdiction with exclusive competence for enforcement.
Monitor National Transposition: As Member States designate their national competent authorities under Article 25, they will also publish the specific procedural rules for exercising the powers in Article 26. Subscribe to legal updates in these jurisdictions to catch changes in administrative procedure laws that might affect appeal windows.
Document Rights of Defence: Given the emphasis on the "right to be heard" and "access to the file" in Article 26(4), ensure your internal processes meticulously log all communications with competent authorities. If an authority issues a decision without giving you adequate time to respond to charges, this procedural flaw may extend your effective appeal window or provide grounds for annulment.
Prepare for Immediate Action: Investigative measures under Article 26(1) may have very short compliance windows. Have a legal on-call protocol ready to challenge invasive measures immediately if they exceed the scope defined in CADA, as delays could result in the loss of evidence or the inability to appeal effectively.
Check for Suspensive Effect: Before filing an appeal against a fine, verify whether the national law grants an automatic stay of execution. If not, be prepared to request a stay and potentially post security to prevent immediate enforcement while the case is pending.

Common misconceptions

Misconception 1: There is a standard 30-day appeal period across the EU for CADA fines. Reality: CADA is silent on specific appeal durations. The timeline is strictly a matter of national procedural law. Assuming a 30-day period could lead to missed deadlines in jurisdictions with shorter windows (e.g., 14 or 15 days).

Misconception 2: An appeal automatically stays the penalty or enforcement order. Reality: CADA does not guarantee a suspensive effect. Whether an appeal halts the payment of a fine or the cessation order depends entirely on national civil or administrative procedure codes. In some countries, you must explicitly request a stay and provide security; in others, it is automatic.

Misconception 3: The EU Commission handles appeals against national CADA decisions. Reality: Appeals against decisions by national competent authorities are handled by national courts. The Commission may be involved in cross-border cooperation under Article 28, but it does not act as an appellate body for individual enforcement cases.

Misconception 4: Only the final fine can be appealed. Reality: Intermediate decisions, such as orders to provide information or conduct inspections under Article 26(1), can often be challenged immediately. Waiting for the final penalty to appeal an investigative measure may result in the loss of the right to challenge the underlying evidence gathering.

Misconception 5: The rights of defence are optional or secondary to the timeline. Reality: Under Article 26(4), the rights of defence (including the right to be heard and access to the file) are mandatory safeguards. A violation of these rights can render a decision void, regardless of whether the appeal was filed within the correct national deadline.

This is general information about a draft EU regulation, not legal advice.