Judgment of the General Court (Fourth Chamber, Extended Composition) of 2 October 2024. – VC v European Agency for Safety and Health at Work.

1

By its action based on Article 263 TFEU, the applicant, VC, is seeking the annulment of the decision of the European Agency for Safety and Health at Work (EU-OSHA) of 13 January 2023 ordering the exclusion of the applicant from participation in procedures for public procurement, grants, prizes, awards and financial instruments covered by the general budget of the European Union and from participation in award procedures covered by the European Development Fund (EDF) governed by Council Regulation (EU) 2018/1877 of 26 November 2018 on the financial regulation applicable to the 11th European Development Fund, and repealing Regulation (EU) 2015/323 (OJ 2018 L 307, p. 1), for a period of two years with effect from 18 January 2023 (Articles 1 and 2), the inclusion of the applicant’s name in the database of the early detection and exclusion system for the duration of the exclusion period (Article 3), and the publication on the European Commission’s website of certain information relating to the exclusion (Article 4) (‘the contested decision’).

2

On 11 May 2021, EU-OSHA published call for tenders EUOSHA/2021/OP/F/SE/0144 for the provision of information and communication technology (ICT) and web services. This procurement contract was divided into three lots.

3

On the same day, the Comisión Nacional de los Mercados y la Competencia (National Commission on Markets and Competition, Spain) (‘the CNMC’) adopted a decision finding that the applicant had participated in a single and continuous infringement of competition law and imposing a fine on it and prohibiting it from being awarded contracts with the Spanish authorities (‘the CNMC Decision’). According to the CNMC, between March 2009 and May 2017 the applicant participated, with several other companies, in a cooperative network in which the participants exchanged commercially sensitive information and engaged in joint strategies aimed at eliminating competition in certain tenders for the provision of consultancy services to Spanish government departments and other public bodies.

4

On 21 June 2021, the applicant submitted a bid for the second lot of the procurement contract in question, relating to the provision of project management support and consultancy services.

5

On 29 July 2021, after becoming aware of the CNMC decision, EU-OSHA asked the applicant to explain why it had not mentioned that decision in its declaration on honour and whether it had implemented any remedial measures to remedy the infringement.

6

On 24 August 2021, the applicant replied that it had not declared the CNMC decision because, first, the decision was not final, since the Audiencia Nacional (National High Court, Spain) had not ruled on the appeal against the decision or on the application for interim relief and, second, it did not entail an effective ban on participating in public procurement contracts, since the Spanish Minister for the Economy and Finance had not determined the scope of the ban.

7

On 10 February 2022, the authorising officer responsible asked the panel convened pursuant to Article 143 of Regulation (EU, Euratom) 2018/1046 of the European Parliament and of the Council of 18 July 2018 on the financial rules applicable to the general budget of the Union, amending Regulations (EU) No 1296/2013, (EU) No 1301/2013, (EU) No 1303/2013, (EU) No 1304/2013, (EU) No 1309/2013, (EU) No 1316/2013, (EU) No 223/2014, (EU) No 283/2014, and Decision No 541/2014/EU and repealing Regulation (EU, Euratom) No 966/2012 (OJ 2018 L 193, p. 1; ‘the Financial Regulation’), to make a recommendation concerning whether to impose an exclusion or a financial penalty on the applicant.

8

Subsequently, the Audiencia Nacional (National High Court) ordered a stay of enforcement of the CNMC decision (‘the national decision to stay enforcement’) on 11 April 2022.

9

On 13 July 2022, the panel convened in accordance with Article 143 of the Financial Regulation (‘the panel’) notified the applicant of the preliminary classification of that party’s conduct within the meaning of Article 136(2) of the Financial Regulation.

10

The applicant submitted its observations on this preliminary classification on 22 August 2022.

11

On 8 December 2022, the panel sent its recommendation to EU-OSHA. Taking the view that the applicant’s conduct should be regarded as ‘grave professional misconduct’, it recommended that the applicant be excluded and that this exclusion be published.

12

By the contested decision, of which the applicant was notified on 17 January 2023, EU-OSHA followed this recommendation and ordered the following:

13

On 21 November 2023, subsequent to the action being brought in the present case, the applicant applied to EU-OSHA for a review of the contested decision on the basis of Article 136(8) of the Financial Regulation.

14

The applicant contends that the Court should:

15

EU-OSHA contends that the Court should:

16

The applicant raises five pleas in law in support of its action. The first plea alleges a failure to respect the national decision to stay enforcement and the second criticises the assessment of the remedial measures implemented by the applicant. The third plea asserts that the decision to adopt the exclusion penalty breached the principle of proportionality. The fourth plea contests the publication of the exclusion. By the fifth plea in law, which is raised in the alternative, the applicant alleges that EU-OSHA failed to consider the application of a financial penalty as an alternative to exclusion.

17

The applicant contends that – based on Article 106 of Regulation (EU, Euratom) No 966/2012 of the European Parliament and of the Council of 25 October 2012 on the financial rules applicable to the general budget of the Union and repealing Council Regulation (EC, Euratom) No 1605/2002 (OJ 2012 L 298, p. 1), as amended in particular by Regulation (EU, Euratom) 2015/1929 of the European Parliament and of the Council of 28 October 2015 (OJ 2015 L 286, p. 1) (‘the former Financial Regulation’), and Article 136 of the Financial Regulation, in that they both require, in paragraph 1, the exclusion of an entity where it has been established by a final national judgment that the entity is guilty of grave professional misconduct and in that they both allow, in paragraph 2, such exclusion on the basis of a preliminary classification by the Union authorities on the basis of a non-final national decision – the Union authorities must also respect decisions adopted as a precautionary measure by national courts in respect of non-final national administrative decisions, in particular where, as in the present case, those authorities do not themselves carry out any investigative activity. Thus, if the decision serving as the exclusive basis for the abovementioned preliminary classification is suspended, that decision can no longer be used to support that classification. The applicant asserts that the national decision to stay enforcement – even without mentioning an examination of the prima facie case – calls into question the validity and legality of the CNMC decision. The applicant also notes the similarity between the objective pursued by the exclusion ordered by the contested decision and that pursued by the prohibition on being awarded procurement contracts ordered by the CNMC, which represents a typical penalty in the field of public procurement contracts and was suspended by the national decision to stay enforcement.

18

The applicant also relies on Article 325 TFEU, which relates to provisions intended to counter fraud, and on Article 4(3) TEU, which lays down the principle of sincere cooperation, in order to highlight the manifest contradiction between the national decision to stay enforcement and the contested decision, which is the result of a clear lack of coordination between the competent authorities in protecting the financial interests of the Union, which is required by those provisions.

19

It should be remembered as a preliminary point that procedural rules are generally held to apply to all proceedings pending at the time when they enter into force, whereas substantive rules are usually interpreted as not applying to situations existing before their entry into force (see, to that effect, judgments of 12 November 1981, Meridionale Industria Salumi and Others, 212/80 to 217/80, EU:C:1981:270, paragraph 9; of 6 July 1993, CT Control (Rotterdam) and JCT Benelux v Commission, C‑121/91 and C‑122/91, EU:C:1993:285, paragraph 22; and of 26 March 2015, Commission v Moravia Gas Storage, C‑596/13 P, EU:C:2015:203, paragraph 33). Consequently, the rules applicable to the exclusion procedure at issue are those laid down in the Financial Regulation, which entered into force in 2018, while the substantive rules applicable to that exclusion are those laid down in the former Financial Regulation, which was in force on the date of the single and continuous infringement resulting in the exclusion, which ended in 2017.

20

It must also be observed that Article 106 of the former Financial Regulation and Article 136 of the Financial Regulation are identical in their provisions relevant to the present case.

21

Thus, in accordance with paragraph 1(c)(ii) of those articles, a person or entity will be excluded from participating in award procedures governed by the Financial Regulation where it has been established by a final judgment or a final administrative decision that the person or entity is guilty of grave professional misconduct by having violated applicable laws or regulations or ethical standards of the profession to which the person or entity belongs, or by having engaged in any wrongful conduct which has an impact on its professional credibility where such conduct denotes wrongful intent or gross negligence, in particular entering into agreement with other persons or entities with the aim of distorting competition.

22

Similarly, in accordance with the first and second subparagraphs of paragraph 2, in the absence of a final judgment or, where applicable, a final administrative decision under paragraph 1(c), the authorising officer responsible will exclude a person or entity on the basis of a preliminary classification in law of a conduct of that person or entity, having regard to established facts or other findings contained in the recommendation of the panel. That preliminary classification does not prejudge the assessment of the conduct of the person or entity concerned by the competent authorities of Member States under national law. The authorising officer responsible will review his or her decision to exclude the person or entity and/or to impose a financial penalty without delay following the notification of a final judgment or a final administrative decision. In cases where the final judgment or the final administrative decision does not set the duration of the exclusion, the authorising officer responsible will set that duration on the basis of established facts and findings and having regard to the recommendation of the panel.

23

Under the third subparagraph of paragraph 2, where the final judgment or final administrative decision holds that the person or entity is not guilty of the conduct subject to a preliminary classification in law, on the basis of which that person or entity has been excluded, the authorising officer responsible will, without delay, bring an end to that exclusion and/or reimburse, as appropriate, any financial penalty imposed. Furthermore, in accordance with the fourth subparagraph of paragraph 2, the facts and findings referred to in the first subparagraph will include, in particular, facts established in the context of audits or investigations carried out by the Court of Auditors or the European Anti-Fraud Office (OLAF), or any other check, audit or control performed under the responsibility of the authorising officer as well as decisions of the Commission relating to the infringement of Union competition law or of a national competent authority relating to the infringement of Union or national competition law.

24

It follows from those provisions that an entity is excluded from participating in the proceedings concerned either where it is established by a final judgment or a final administrative decision that the entity in question is guilty of grave professional misconduct or, in the absence of a final judgment or a final administrative decision, on the basis of a preliminary classification in law of its conduct by the competent authority of the Union in the light of established facts or findings determined, in particular, by decisions of a national competition authority.

25

It follows that the absence of a final judgment or decision establishing the misconduct in question does not preclude the adoption of an exclusion measure by the competent EU authority in order to protect the financial interests of the Union (see, to that effect, judgments of 9 February 2022, Elevolution – Engenharia v Commission, T‑652/19, not published, EU:T:2022:63, paragraph 76, and of 21 December 2022, Vialto Consulting v Commission, T‑537/18, not published, EU:T:2022:852, paragraph 142).

26

It must also be inferred from this that the Union legislature intended to allow the competent EU authority to make its own assessment of the acts committed by the economic operator concerned, without waiting for a court to give judgment (see, by analogy, judgment of 19 June 2019, Meca, C‑41/18, EU:C:2019:507, paragraph 31). The same applies to the effectiveness of the exclusion system, which implies that it should be applied as quickly as possible, without having to wait for a final judgment (see, to that effect, judgment of 9 February 2022, Elevolution – Engenharia v Commission, T‑652/19, not published, EU:T:2022:63, paragraph 77).

27

Moreover, the factors that may be taken into consideration in this respect are specified – in a non-exhaustive list – in the fourth subparagraph of Article 106(2) of the former Financial Regulation and in the fourth subparagraph of Article 136(2) of the Financial Regulation (see paragraph 23 above), and are based in particular on the investigative activities of other Union entities or of the Member States, such that it is irrelevant whether the Union authority concerned does not itself carry out an investigation before adopting an exclusion decision.

28

Thus, in the present case, given that there was no final decision because an appeal had been lodged against the CNMC decision and was pending on the date of the contested decision, it was for EU-OSHA to make its own assessment of the conduct of the applicant on the basis of the CNMC decision, which is one of the factors listed by the relevant provisions (see paragraph 23 above), but also on the basis of other relevant elements of the context, including, in particular, the suspension of that decision. The situation governed by Article 106(2) of the former Financial Regulation and by Article 136(2) of the Financial Regulation is precisely the scenario in which the decision potentially serving as the basis for exclusion is not final, either because the time limit for lodging an appeal against that decision has not expired or because such an appeal has been lodged, or because it has been suspended, as in the present case. To take the view, as the applicant does, that a suspended decision can no longer serve as a basis for an exclusion decision would be tantamount to rendering ineffective the possibility provided for by the applicable provisions, as well as Article 106(7)(c) of the former Financial Regulation and Article 136(6)(a) of the Financial Regulation, which encourage persons or entities that have not been the subject of a final judgment to adopt remedial measures designed to demonstrate their reliability despite the decision finding an infringement of competition law (see, to that effect and by analogy, judgment of 19 June 2019, Meca, C‑41/18, EU:C:2019:507, paragraph 40; see also the paragraph 55 below).

29

It must be observed, in the first place, that EU-OSHA did in fact – in line with the findings established in the panel’s recommendation – take account of the suspension of the CNMC decision, in response to the applicant’s argument based on such a suspension. In recitals 35 to 37 of the contested decision, it began by reiterating that argument, before setting out the reasons why, in its view, that suspension did not, in the present case, prejudge the application of the EU rules. More specifically, EU-OSHA considered that, in the absence of a position on the prima facie case, the national decision to stay enforcement did not raise doubts as to the validity and legality of the CNMC decision and was based on considerations unrelated to the present administrative procedure, serving a different purpose from that for which the national penalty was imposed. EU-OSHA added that this decision was by definition not final and was therefore not binding on it.

30

In the second place, it should also be noted that EU-OSHA rightly considered that the suspension of the CNMC decision did not preclude the findings of that decision from being taken into account in order to demonstrate the existence of grave professional misconduct on the part of the applicant and to adopt an exclusion measure.

31

First, the facts alleged against the applicant are not based on mere supposition or presumption, but were established on the basis of the findings of an investigation carried out by the CNMC (see, to that effect, judgment of 21 December 2022, Vialto Consulting v Commission, T‑537/18, not published, EU:T:2022:852, paragraph 143; see also, by analogy, judgment of 21 December 2023, Infraestruturas de Portugal and Futrifer Indústrias Ferroviárias, C‑66/22, EU:C:2023:1016, paragraph 78).

32

Second, the national decision to stay enforcement does not take a position on the merits of the CNMC decision. The findings and considerations of the CNMC decision relating to the applicant’s failure to comply with competition law are therefore in no way called into question, or even doubted, by the national court. That court based its decision to stay enforcement on considerations derived solely from the consequences of the fine imposed and the prohibition on contracting for the applicant’s continued activities. The latter admits, moreover, that the national court did not expressly examine the existence of a prima facie case. In so far as the applicant submits that the national court implicitly but necessarily recognised the plausibility of the applicant’s allegations challenging the CNMC decision – since, according to national case-law, the granting of an interim measure presupposes such plausibility – it should be noted that such implicit considerations cannot, in any event, be sufficient to call into question the explicit considerations and findings of the CNMC decision.

33

Furthermore, it is irrelevant that the national decision to stay enforcement suspends not only the payment of the fine imposed by the CNMC decision but also the prohibition on the applicant’s being awarded procurement contracts in Spain, also imposed by that decision. Admittedly, this prohibition is similar to the exclusion ordered by the contested decision, especially since, according to the applicant, certain prohibitions on awarding procurement contracts are not ordered or applied when the operator concerned has adopted remedial measures or compliance measures to repair the damage caused by its illegal conduct. However, as can be seen from paragraph 32 above, the reason for suspending the prohibition on awarding public contracts is independent of the findings and considerations of the CNMC decision and is therefore not such as to call them into question. Thus, even if, as the applicant maintains, the difference in purpose between the exclusion procedure under the EU rules and the national procedure is not sufficient, as such, to preclude the national decision to stay enforcement from being taken into account by EU-OSHA (see paragraph 28 above), the fact remains that, in the present case, the reasons for the suspension of the CNMC decision do not call into question the material existence of the facts applied in the contested decision as the basis for excluding the applicant. Furthermore, the national decision to stay enforcement does not provide any information as to the adoption of remedial measures by the applicant or as to the justification for the suspension by the adoption of such measures.

34

It also follows from the balancing exercise correctly carried out by EU-OSHA in the present case between the CNMC decision and the national decision to stay enforcement that it cannot be accused of either a permitting conflict between the grounds of the contested decision and those of the national decision to stay enforcement, or of a failure to coordinate with the national authorities which would undermine the principle of sincere cooperation laid down in Article 4(3) TEU and the provisions intended to counter fraud governed by Article 325 TFEU.

35

It follows that the first limb of the first plea in law must be rejected.

36

The applicant submits that, by rendering the national decision to stay enforcement irrelevant, the contested decision calls into question the judicial protection that it obtained from the national court and, consequently, infringes Article 47 of the Charter of Fundamental Rights of the European Union (‘the Charter’), read in conjunction with Article 19(1) TEU. Respect for national court proceedings is all the more necessary in the case of ‘composite proceedings’, such as the exclusion procedure, in which the Union authorities take their decisions on the basis of national decisions. The applicant adds that the right to request a review of the exclusion decision or the opportunity to submit observations to the competent panel or authorising officer represent administrative safeguards, which prevent any replacement of the guarantees relating to review of the legality of acts adversely affecting an individual and of compliance with court rulings that are characteristic of effective judicial protection.

37

According to settled case-law, the principle of the effective judicial protection of individuals’ rights under EU law, referred to in the second subparagraph of Article 19(1) TEU, is a general principle of EU law stemming from the constitutional traditions common to the Member States, which has been enshrined in Articles 6 and 13 of the European Convention for the Protection of Human Rights and Fundamental Freedoms, signed in Rome on 4 November 1950, and which is now reaffirmed by Article 47 of the Charter (see, to that effect, judgment of 27 February 2018, Associação Sindical dos Juízes Portugueses, C‑64/16, EU:C:2018:117, paragraph 35 and the case-law cited).

38

It is also clear from the case-law that the effects of bringing administrative or legal proceedings are closely linked to the exercise and safeguard of fundamental rights in relation to judicial protection, respect for which is also guaranteed by the Community legal order and that legislation that paid no heed to the effects of bringing administrative or legal proceedings on the opportunity to participate in a procedure for the award of a contract would risk infringing the fundamental rights of the parties concerned (see, by analogy, judgment of 9 February 2006, La Cascina and Others, C‑226/04 and C‑228/04, EU:C:2006:94, paragraph 38).

39

However, it cannot be considered that, in the present case, the national decision to stay enforcement was disregarded and that the applicant’s right to judicial protection was infringed.

40

In fact, on the one hand, as can be seen from paragraphs 29 to 33 above, this decision was duly taken into account by the panel and then by EU-OSHA in the contested decision. In particular, EU-OSHA rightly considered that, in the absence of a position on the merits of the CNMC decision in the national decision to stay enforcement, it could rely on the findings of that decision to establish that grave professional misconduct had taken place and adopt an exclusion measure (see paragraphs 30 and 32 above). In addition, under the applicable provisions, if there is no final judgment or final decision, an exclusion penalty can only be ordered on the basis of a preliminary classification in law of the conduct at issue by the panel, taking into account all the relevant factors, including the suspension of the CNMC decision (see paragraphs 22, 23 and 28 above), a preliminary classification in law on which the applicant has, moreover, had the opportunity to present its observations (see paragraph 10 above) in accordance with Article 143(5) of the Financial Regulation. As the applicant argues, these are certainly administrative safeguards, but they do ensure that the national court decision is duly taken into account. It is also important to emphasise that the contested decision, which excludes the applicant from procurement contracts awarded by EU administrations, in no way calls into question the effects of the national decision to stay enforcement, in that it suspends the prohibition on award of contracts with Spanish government departments.

41

On the other hand, as is clear from paragraphs 24 to 26 above, it follows from the applicable provisions that, if there is no final judgment or final decision, as in the present case, the EU authority is not bound by administrative or judicial decisions taken at national level and thus has the power to exclude a person or entity – in this case the applicant – from procedures for the award of EU public contracts on the basis of a preliminary classification in law of its conduct.

42

The exercise of this right does not infringe Article 47 of the Charter. The existence – not contested by the applicant and confirmed by the present action – of a remedy to challenge the contested decision before the courts of the European Union specifically makes it possible to ensure that the applicant is afforded judicial protection. In particular, the General Court has jurisdiction in the present case both to annul the contested decision and to review that decision, by virtue of its unlimited jurisdiction under Article 143(9) of the Financial Regulation (judgment of 9 February 2022, Elevolution – Engenharia v Commission, T‑652/19, not published, EU:T:2022:63, paragraph 80; see also paragraph 127 below). Interim judicial protection is also safeguarded by the judge of the General Court hearing the application for interim measures, who has the power to order a stay of enforcement of the contested decision, in particular if that party believes, as in the present case, that it is not possible to rule out, prima facie, that EU-OSHA should have drawn the necessary conclusions from the national decision to stay enforcement (order of 14 July 2023, VC v EU-OSHA, T‑126/23 R, not published, EU:T:2023:405, paragraph 51).

43

Therefore, it is not appropriate to give the national decision to stay enforcement the same effect as that given to final decisions or judgments that require the EU authorities to exclude the person or entity concerned, in accordance with Article 136(1) of the Financial Regulation, or, where applicable, to allow the participation of that person or entity in EU public procurement procedures. If the power of the EU authorities to exclude a party from such a procedure were to be paralysed by the mere fact of the lodging of an appeal with suspensory effect against the national decision that might serve as a basis for the exclusion or of a suspension of that decision, such a power would be rendered ineffective (see, to that effect and by analogy, judgment of 19 June 2019, Meca, C‑41/18, EU:C:2019:507, paragraphs 37 and 38).

44

It should be added that in the event that the national decision to stay enforcement is followed by a final judgment annulling the CNMC decision, the third subparagraph of Article 136(2) of the Financial Regulation provides that the authorising officer is to terminate the exclusion without delay, thereby giving full effect to the national court decision and at the same time guaranteeing the applicant’s judicial protection, which attaches in this case to the national court decision, a decision that is binding on the EU authority.

45

It follows that the second limb of the first plea must be rejected, and that plea must therefore also be rejected.

46

The applicant asserts that the contested decision contains serious errors of assessment and infringes Article 106(7)(a) of the former Financial Regulation and Article 136(6)(a) of the Financial Regulation, since, on the basis of the information it provided to EU-OSHA, that body should have found that the applicant had implemented sufficient remedial measures. However, for each of the remedial measures, EU-OSHA demanded a disproportionate level of proof from the applicant, without giving it any opportunity to correct or supplement the information requested. In this respect, the applicant alleges that there was a lack of any independent assessment of those measures by the panel and that it relied on the CNMC’s assessment even though the latter is based on different documents. The applicant also asserts that the broad discretionary power concerning the award of a public contract cannot be applied to a penalty decision that goes beyond the framework of a specific procurement procedure and causes significant damage that would not result from the simple non-award of a contract.

47

The applicant adds that, in so far as the General Court has unlimited jurisdiction to review the contested decision pursuant to Article 143(9) of the Financial Regulation, based on Article 261 TFEU, it is submitting new documents in the present proceedings attesting to the reliability of the remedial measures. It stresses in this respect that remedial measures are not constituent elements of the infringement over which the Court would not have jurisdiction. According to the applicant, in any event, irrespective of that unlimited jurisdiction, those documents will be relevant for reviewing the legality of the contested decision, in so far as they relate to remedial measures adopted prior to that decision.

48

By way of conclusion, the applicant notes in its reply that it has not engaged in any anticompetitive practices since 2018, which demonstrates that the system it has put in place, as a whole, offers the required degree of reliability. For the sake of completeness, it has annexed to its reply a number of documents attesting to this reliability.

49

As a preliminary point, it should be borne in mind that the applicant does not dispute before the Court that it committed the infringement identified and punished by the CNMC decision. Neither does it dispute that its exclusion as a result of that finding of an infringement of Spanish competition law and Article 101 TFEU constitutes a penalty.

50

However, the applicant contests its exclusion in this case on the grounds of grave professional misconduct, on the basis that it adopted remedial measures demonstrating its reliability, in accordance with Article 106(7)(c) of the former Financial Regulation and Article 136(6)(a) of the Financial Regulation, the legal provisions successively applicable in the present case, having regard to the date of adoption of the remedial measures in question.

51

Before examining the applicant’s arguments challenging EU-OSHA’s assessment of the remedial measures adopted, it is appropriate, first, to clarify the nature of the jurisdiction and the extent of the review that the Court may exercise over the assessments in question, which are also at issue between the parties.

52

Pursuant to Article 143(9) of the Financial Regulation:

‘The Court of Justice of the European Union shall have unlimited jurisdiction to review a decision whereby the authorising officer excludes a person or entity referred to in Article 135(2) and/or imposes a financial penalty on a recipient, including annulling the exclusion, reducing or increasing its duration and/or annulling, reducing or increasing the financial penalty imposed …’

53

In so doing, the EU legislature made use of the option offered by Article 261 TFEU, which establishes that ‘regulations adopted jointly by the European Parliament and the Council, and by the Council pursuant to the provisions of the Treaties, may give the Court of Justice of the European Union unlimited jurisdiction with regard to the penalties provided for in such regulations’.

54

Article 143(9) of the Financial Regulation should therefore be interpreted in the light of Article 261 TFEU, such that the scope of that unlimited jurisdiction is strictly limited to determining the amount of the penalty, to the exclusion of any alteration of the constituent elements of the conduct justifying that penalty (see, by analogy, judgment of 21 January 2016, Galp Energía España and Others v Commission, C‑603/13 P, EU:C:2016:38, paragraphs 76 and 77 and the case-law cited).

55

In the present case, contrary to what the applicant maintains, examination of the remedial measures must be considered as part of the assessment of that conduct. Under Article 106(7)(c) of the former Financial Regulation and Article 136(6)(a) of the Financial Regulation, the relevant authorising officer ‘shall not exclude’ a person or entity if that person or entity ‘has taken remedial measures … to an extent that is sufficient to demonstrate its reliability’. This provision therefore establishes that an operator that has taken certain remedial measures demonstrating its reliability cannot be excluded from procurement contracts (judgment of 27 June 2017, NC v Commission, T‑151/16, EU:T:2017:437, paragraph 58). In accordance with the objective of protecting the financial interests of the EU pursued by the exclusion penalty (see, to that effect, judgment of 21 December 2022, Vialto Consulting v Commission, T‑537/18, not published, EU:T:2022:852, paragraphs 159 and 164; see also paragraph 25 above), there is no reason to exclude an offending operator that has become reliable once again. In this case, the grave professional misconduct initially observed has been corrected to the point where it no longer constitutes grounds for exclusion. The assessment to be made of the remedial measures is therefore, essentially, a verification of the continued existence of the grave professional misconduct – inferred in this case from the infringement established by a national authority – and of the possibility of its recurrence, which is a matter of assessing the conduct of the operator concerned, and the factual circumstances directly linked to it, and not of assessing its penalty.

56

It is irrelevant in this respect that the remedial measures are generally implemented after the infringement established by the national authority has occurred. As is clear from paragraphs 26 to 28 above, such a finding of infringement by a national authority is merely a preliminary step that may lead, following the assessment by the EU authority (see, to that effect, judgment of 15 February 2023, RH v Commission, T‑175/21, not published, EU:T:2023:77, paragraph 29), to the latter finding that grave professional misconduct has occurred. The conduct, that must be distinguished from the penalty for the purposes of determining the scope of unlimited jurisdiction, is not limited – in the field of public procurement, particularly in view of the two-stage procedure laid down in the Financial Regulation – to the infringement established by a national authority and its constituent elements, but includes other elements, possibly subsequent to that infringement that could lead the Union authority to infer that the operator concerned is reliable despite that infringement.

57

It follows that the Court cannot exercise its unlimited jurisdiction, as provided for in Article 143(9) of the Financial Regulation, for the purposes of considering the present plea in law. It cannot therefore substitute its own assessment of the remedial measures in question for that of EU-OSHA and will confine itself to reviewing the legality of that assessment.

58

It must be made clear, first, in view of the different positions expressed by the parties on this point, that this review of legality is limited to verifying compliance with the rules of law, in particular the procedural rules and the obligation to state reasons, the material accuracy of the facts and the absence of manifest error of assessment or misuse of powers (see judgment of 15 February 2023, RH v Commission, T‑175/21, not published, EU:T:2023:77, paragraph 30 and the case-law cited). As regards the assessment by the EU Courts as to whether an act of an institution is vitiated by a manifest error of assessment, it must be stated that, in order to establish that that institution committed a manifest error in assessing complex facts such as to justify the annulment of that act, the evidence adduced by the applicant must be sufficient to make the factual assessments used in the act implausible (see, to that effect, judgments of 12 December 1996, AIUFFASS and AKT v Commission, T‑380/94, EU:T:1996:195, paragraph 59, and of 28 February 2012, Grazer Wechselseitige Versicherung v Commission, T‑282/08, EU:T:2012:91, paragraph 158). Subject to that review of plausibility, it is not the Court’s role to substitute its assessment of complex facts for that made by the institution that adopted the decision (judgments of 15 October 2009, Enviro Tech (Europe), C‑425/08, EU:C:2009:635, paragraph 47, and of 12 February 2008, BUPA and Others v Commission, T‑289/03, EU:T:2008:29, paragraph 221).

59

In so far as the institutions have a margin of discretion in assessing whether conduct can be classified as grave professional misconduct (judgment of 15 February 2023, RH v Commission, T‑175/21, not published, EU:T:2023:77, paragraph 30; see also, by analogy, judgments of 4 July 2008, Entrance Services v Parliament, T‑333/07, not published, EU:T:2008:250, paragraph 59, and of 9 February 2022, Companhia de Seguros Índico v Commission, T‑672/19, not published, EU:T:2022:64, paragraph 50 and the case-law cited) and where the assessment of remedial measures is an integral part of the assessment of such conduct (see paragraph 55 above), a margin of discretion must also be granted to them in assessing those remedial measures.

60

It should be added – in response to the applicant – that the potential consequences of the exclusion decision, which go beyond the framework of a specific procurement procedure and cause significant damage to the excluded entity, are factors to be taken into consideration in the exercise of the discretionary power available to the institution and cannot, in themselves, call into question that margin of discretion.

61

There is also a need to specify the factors that may be taken into account by the Court in order to review the legality of EU-OSHA’s assessment of the remedial measures adopted by the applicant, given the differences between the parties in that regard.

62

It is clear from the case-law in competition matters that the scope of judicial review provided for in Article 263 TFEU extends to all the elements of Commission decisions relating to proceedings applying Articles 101 and 102 TFEU which are subject to in-depth review by the Court, in the light of the pleas raised by the applicants and taking into account all the elements submitted by them, whether those elements pre-date or post-date the decision at issue, whether they were submitted previously in the context of the administrative procedure or, for the first time, in the context of the proceedings before the Court, in so far as those elements are relevant to the review of the legality of the Commission decision (judgments of 21 January 2016, Galp Energía España and Others v Commission, C‑603/13 P, EU:C:2016:38, paragraph 72, and of 14 September 2022, Google and Alphabet v Commission (Google Android), T‑604/18, under appeal, EU:T:2022:541, paragraph 89).

63

Contrary to the applicant’s claims, it cannot be inferred from this case-law that, in the present case, the Court should take into account documents submitted to it by the applicant in the context of the present proceedings without having first been submitted in the course of the administrative procedure before EU-OSHA.

64

In accordance with Article 2 of Council Regulation (EC) No 1/2003 of 16 December 2002 on the implementation of the rules on competition laid down in Articles [101] and [102 TFEU] (OJ 2003 L 1, p. 1), where there is a dispute as to the existence of an infringement of the competition rules, it is incumbent on the Commission to prove the infringements it has found and to adduce evidence capable of demonstrating to the requisite legal standard the existence of circumstances constituting an infringement (see judgment of 8 September 2016, Lundbeck v Commission, T‑472/13, EU:T:2016:449, paragraph 105 and the case-law cited). It is then possible for the undertaking concerned to adduce evidence to the contrary, including by relying on evidence that had not been presented during the administrative procedure (see judgment of 9 June 2016, PROAS v Commission, C‑616/13 P, EU:C:2016:415, paragraph 43 and the case-law cited).

65

On the other hand, by establishing that a person or entity will not be excluded if that person or entity has implemented sufficient remedial measures to demonstrate its reliability, Article 106(7)(c) of the former Financial Regulation and Article 136(6)(a) of the Financial Regulation place the onus on the person or entity in question to establish that the remedial measures adopted are such as to prevent exclusion (see also Article 106(10) of the former Financial Regulation and Article 137(1) of the Financial Regulation). It follows that, unless the burden of proof imposed by those provisions is rendered ineffective, the operator concerned cannot be allowed to adduce evidence before the Court that was not submitted during the exclusion procedure, in order to obtain the annulment of the decision that imposed its exclusion because no evidence had been submitted by that operator that was deemed sufficient to demonstrate its reliability. A fortiori, the Court cannot rule in these proceedings on remedial measures not presented before EU-OSHA.

66

This is all the more true given that Article 136(8) of the Financial Regulation governs the case of remedial measures or elements presented after the exclusion decision, stipulating in such cases that the decision will be reviewed without delay by the authorising officer responsible. It would be prejudicial to the proper administration of justice and to the principle of institutional balance if the Court were to rule on new remedial measures or new evidence submitted, where applicable, at the same time as the authorising officer and that might lead that officer to review the contested decision in the course of the procedure (see, to that effect, judgment of 13 May 2020, Agmin Italy v Commission, T‑290/18, not published, EU:T:2020:196, paragraphs 46 and 47). Such a risk is, moreover, real in the present case, since the applicant submitted a request for review pursuant to Article 136(8) of the Financial Regulation to EU-OSHA on 21 November 2023, in the course of the present proceedings, attaching to it the items appearing in the annex to the application and the reply, without first having submitted those elements to EU-OSHA.

67

The situation would be different if, in the course of the procedure before it, EU-OSHA had not allowed the applicant to present all the evidence it wished to put forward to establish that the remedial measures it had adopted demonstrated its reliability (see, to that effect and by analogy, judgment of 7 June 2023, TC v Parliament, T‑309/21, under appeal, EU:T:2023:315, paragraph 131 and the case-law cited). However, that is not the position in the present case.

68

In fact, the applicant’s allegations that EU-OSHA gave it no opportunity to correct or supplement the information relating to the remedial measures it had adopted are unfounded. As can be seen from the case file, by a letter of 29 July 2021 (see paragraph 5 above), EU-OSHA invited the applicant to inform it whether remedial measures had been adopted and, after having been advised of these measures, asked the applicant – in notifying it of the preliminary classification of the proceedings of 13 July 2022 (see paragraph 9 above) – to send it the relevant documentary evidence to enable that authority to ‘assess the content of these measures, on the basis of the length of time they have been in force and evidence of the manner in which and the extent to which they have been implemented’. EU-OSHA also stated, in its classification, that the applicant could also inform it of any other remedial measures adopted after 24 August 2021 and demonstrate how and to what extent they have been implemented and are sufficient to demonstrate its reliability.

69

It follows that, for the purposes of examining the applicant’s arguments challenging EU-OSHA’s assessment of its remedial measures, only the evidence communicated to EU-OSHA prior to the adoption of the contested decision will be considered.

70

Under Article 106(8)(a) of the former Financial Regulation and Article 136(7)(a) of the Financial Regulation, which are identical on this point, remedial measures may include ‘measures to identify the origin of the situations giving rise to exclusion and concrete technical, organisational and personnel measures … appropriate to correct the conduct and prevent its further occurrence’.

71

As is clear from the wording of those provisions, which require in particular ‘concrete … measures … appropriate to correct the conduct’, the person or entity concerned cannot simply prove that new internal rules have been adopted or new entities set up, but must establish that they have been implemented and are effective, which alone is capable of ‘correcting’ conduct that has actually occurred, to the extent of justifying exclusion. Therefore, by requiring such evidence, EU-OSHA cannot be criticised for imposing a disproportionate level of proof on the applicant. This is all the more true because it should be borne in mind that the reason for exclusion at issue is based on an essential element of the relationship between the successful tenderer in question and the contracting authority, namely the reliability of the successful tenderer, on which the contracting authority’s trust is founded (see judgment of 21 December 2023, Infraestruturas de Portugal and Futrifer Indústrias Ferroviárias, C‑66/22, EU:C:2023:1016, paragraph 76 and the case-law cited).

72

In this case, the applicant presented evidence to show that it had adopted the following remedial measures:

73

It should be pointed out at the outset that those measures, some of which were adopted before the CNMC decision, have all been examined by EU-OSHA, not to mention having been considered by the CNMC, which had already taken some of them into account. It may be inferred from this that, contrary to what the applicant claims, EU-OSHA made its own assessment and did not merely adopt the CNMC’s considerations. That independent assessment, which is justified by the EU authority’s own power of assessment in relation to national authorities (see paragraphs 26 to 28 above), implies, contrary to EU-OSHA’s submissions, that the remedial measures already analysed by the CNMC should not be excluded from the analysis.

74

According to recitals 57 to 61 of the contested decision, EU-OSHA considers that the action plan communicated by the applicant to prove that an internal investigation had been launched does not provide any information on the date of the investigation, the procedure followed, the scope of the investigation, the resources devoted to it or the person who conducted it and his or her level of authority. Similarly, EU-OSHA believes that the applicant has also failed to report on the results of the investigation and, in particular, on the measures implemented as a result, the level of responsibility guaranteed, the consequences and, finally, the communication of its results to employees and management. EU-OSHA concludes that, while conducting an internal investigation may be an appropriate means of identifying the origin of the conduct in question, in the present case the lack of information about the abovementioned aspects prevents it from being considered as a fully fledged remedial measure.

75

The applicant submits that the action plan provided to EU-OSHA was merely a presentation of the essential information used to conduct the internal investigation, and that that investigation lasted at least three months, made it possible to obtain information on the processes and persons involved in the conduct under investigation and was followed by specific action plans aimed at correcting the conduct in question and by the adoption of disciplinary measures against those identified as responsible.

76

It must be remembered that, under Article 106(8)(a) of the former Financial Regulation and Article 136(7)(a) of the Financial Regulation, remedial measures intended to avoid exclusion must, where they are intended to identify the origin of the situation giving rise to exclusion, be followed by concrete measures appropriate to correct that situation or prevent its further occurrence.

77

It follows that a measure limited to identifying the problem which led to the exclusion, such as an internal investigation, cannot on its own be considered a sufficient remedial measure.

78

It also follows that, even assuming, as the applicant asserts, that the internal investigation in question lasted at least three months, it is necessary to examine the other remedial measures adopted in order to ascertain whether, taken together with that investigation, they ought to have been regarded by EU-OSHA as demonstrating the reliability of the applicant.

79

EU-OSHA took the view, in recitals 62 and 63 of the contested decision, that the dismissal and resignation of persons involved in the conduct in question are positive actions if they are the direct result of disciplinary proceedings related to that conduct, which was not established in the present case.

80

The applicant submits that the termination of the employment of two persons involved in the conduct in question was mentioned in the CNMC decision, and argues that EU-OSHA committed a serious error of assessment in considering that this measure was insufficient on the grounds that it was not the result of a disciplinary procedure, whereas the deterrent effect of that measure resulted from its communication to the employees. In any event, the applicant has attached additional documents to the application to prove that the employment of the associate responsible for the conduct at issue has been terminated.

81

It must be observed that the documents produced by the applicant do not show any connection between the termination of the employment of the persons concerned and the conduct in question. Admittedly, under the CNMC decision, on which the applicant principally relied, at least one member of the applicant’s staff ceased to be employed on 31 December 2018. However, there is no indication as to the reason for or nature of the termination of employment – whether resignation or dismissal – which makes it impossible to establish a connection with the conduct in question. That connection to the conduct in question is all the more implausible given that almost two years elapsed between the start of the internal investigation and the termination of that person’s employment.

82

Only such a connection is likely to produce the deterrent effect capable of preventing the repetition of the conduct in question alleged by the applicant.

83

EU-OSHA therefore considered, without committing a manifest error of assessment, that the termination of the employment of the persons involved in the conduct in question did not constitute a sufficient remedial measure in the case in point.

84

According to recitals 64 to 71 of the contested decision, it has not been established that the compliance programme put in place following the internal investigation – consisting of a specific compliance plan for negotiated procedures without publication (May 2017) and a new action plan to strengthen compliance in the public sector (November 2017) – has been effectively implemented. EU-OSHA also has doubts about the effectiveness of the checks carried out by the ‘special monitoring associate’ set up under the May 2017 plan.

85

The applicant submits, first, that the specific compliance plan for negotiated procedures without publication of May 2017 and the new action plan to strengthen compliance in the public sector of November 2017 have become final and, second, that a ‘special monitoring associate’ monitors public sector consultancy projects on a monthly basis, which is proven by three monitoring reports from that associate communicated to EU-OSHA, and by all of the monitoring reports drawn up in 2018, provided as an annex to the application. It also adds that it has implemented measures to prevent any recurrence of the conduct in question, as evidenced by the documents attached to the application.

86

It must be observed, first, that the documents provided by the applicant to establish its November 2017 action plan are an ‘internal document’ bearing that date and detailing various measures, which contains no indication of its author or even the applicant’s name, and a schematic presentation describing those measures, bearing the same date and the applicant’s name. Such documents, which both bear the date on which the plan was adopted, add no weight to the argument that EU-OSHA’s doubts as to the actual implementation of the November 2017 plan are implausible, especially since the applicant could, in order to dispel those doubts, have submitted documents proving the completion of the subsequent stages described in that plan and detailed in the two documents, in particular by submitting the ‘report containing the conclusions, the methodology used and the description of the assessment carried out’, which, according to the plan, was intended to be submitted.

87

Second, it must be observed that the compliance plan of May 2017 is also presented in the form of an ‘internal document’, with no indication of its author or the applicant’s name. The only documents attesting to its implementation concern one of the measures provided for in the plan, namely the monthly check carried out by the ‘special monitoring associate’. However, the monthly monitoring reports provided, including those communicated in the context of these proceedings, relate only to 2018, whereas no end date for that monitoring was stated in the plan, a fact that does not render implausible EU-OSHA’s doubts as to the continuation of that monitoring beyond 2018 and up to the date when the contested decision was adopted.

88

It follows that EU-OSHA was able to consider, without committing a manifest error of assessment, that the two plans drawn up as part of the compliance programme adopted following the internal investigation did not constitute sufficient remedial measures.

89

EU-OSHA found, in recitals 78 and 79 of the contested decision, that the applicant had not presented substantial evidence as to the actual activities carried out to monitor the measures adopted under the compliance programme.

90

The applicant submits that the example update of the measures adopted as part of the compliance programme, dated 29 April 2019, communicated to EU-OSHA and attesting to the monitoring of that programme, is sufficient evidence and has communicated as part of these proceedings – should the Tribunal deem it necessary – two emails from the chief risk officer to the employees concerned informing them of the update, in particular of the template contracts relating to the most common business relationships.

91

In that regard, it is sufficient to note that the applicant merely sent EU-OSHA an email, dated 29 April 2019, announcing an addition to the ‘company policy on gifts and similar items’, without attaching to the email the attachment containing the updated document. In the absence of other documents that could be considered, since they had not been submitted to EU-OSHA, this email alone does not rebut the finding of insufficient evidence of monitoring and updating of the applicant’s compliance programme, since it relates to a single aspect of that programme and, moreover, to an aspect not directly concerned by the conduct in question, such that it cannot, therefore, be regarded as ‘correcting’ the problem that led to the applicant’s exclusion.

92

EU-OSHA therefore did not commit a manifest error of assessment in considering that the updating and monitoring of the compliance programme were not sufficiently established to characterise remedial measures for the problem that led to the exclusion.

93

In recitals 72 to 74 of the contested decision, EU-OSHA welcomed the improvements made to the internal whistleblowing system, emphasising that the existence of a confidential whistleblowing mechanism and an effective and reliable process for investigating allegations of misconduct is one of the most effective remedial measures in principle. Nevertheless, it found that the evidence provided by the applicant was insufficient to demonstrate that the improvements to its whistleblowing system had been implemented and were effective.

94

The applicant notes that its whistleblowing system has been outsourced to a third-party company in order to improve it, which was established by documents submitted to EU-OSHA detailing the procedure for handling whistle-blowers, the annual evaluation of the use of this procedure and its promotion within the company, in addition to the data contained in its 2021 impact report available on its website.

95

It can be inferred from the evidence produced by the applicant that a new whistleblowing procedure was indeed adopted and promoted within the company in July 2018.

96

However, the email sent to the applicant’s employees on 22 May 2019 inviting them to reply to a questionnaire as part of the annual ethics survey does not make it possible, given that the attached questionnaire has not been provided, to demonstrate that a system for annual monitoring of the implementation of the new procedure is in place. As for the data relating to the whistleblowing reports received and the action taken to address them for the year 2021, as mentioned in the application, these are in no way established, apart from a reference to the applicant’s website. Although such a reference is in principle admissible (see order of 13 December 2023, Hamoudi v Frontex, T‑136/22, not published, under appeal, EU:T:2023:821, paragraph 51 and the case-law cited), the data appearing on the applicant’s website cannot be considered in the present case, since they have not been communicated to EU-OSHA, either in substance or by reference to the website, whereas the burden of proof lies with the applicant. In any event, it should be noted that the impact report for 2021, available on the applicant’s website, merely indicates the number of alerts received in 2021 (18), the fact that they related in particular to ‘integrity’ and that they had all been resolved by the date of the report, without any further details, which does not make it possible to establish the alleged significant increase in the number of alerts and does not provide any concrete indication of the action taken in response to these alerts.

97

It follows that the applicant has not provided any evidence to negate the plausibility of EU-OSHA’s finding that there is insufficient evidence of the implementation and effectiveness of the new whistleblowing procedure.

98

According to recitals 75 to 77 of the contested decision, the alleged existence of a risk management committee and a risk prevention committee is not supported in any way, and no information is provided about the experience and seniority of their members or the activities carried out by those committees.

99

The applicant submits that the Group’s policy manual provides for the existence of a risk supervisor with a certain level of seniority and experience who reports to management.

100

In that regard, it is sufficient to note that, given its content, namely guidelines that make no mention of risk management and prevention committees, and the fact that it was adopted in 2016 and thus during the infringement period, the document communicated by the applicant cannot serve to establish that those committees, taken together with other measures, constitute a corrective mechanism capable of demonstrating the reliability of the applicant.

101

No manifest error of assessment can therefore be found with regard to EU-OSHA’s assessment of the effectiveness of the applicant’s risk management and prevention committees.

102

EU-OSHA considered, in recitals 80 to 87 of the contested decision, that the information provided by the applicant did not make it possible to establish that the code of ethics had been implemented effectively in the company or that the ethics committee was independent, or to determine the issues actually dealt with or the steps taken by this committee with regard to staff. As for the other policies adopted by the applicant, there is nothing to indicate that they are followed and applied within the company.

103

The applicant submits that the code of ethics has been publicly approved by the Group’s Chairman and CEO and can be consulted on the Group’s website. It has also provided the Court with an updated version of the code of ethics and a series of communications sent to staff in 2019 reminding them of the importance of complying with the code of ethics. The applicant also notes the functions of the ethics committee and the launch of the latest survey in 2019, which provides information on the issues dealt with by this committee and the measures it adopts. As for the other measures adopted, namely the Group policy manual, the compliance and anti-corruption manual and the compliance policy, as well as the competition compliance guide, the applicant alleges that they have been communicated to its staff, supplementing the evidence provided in this regard, and, with specific reference to the Group policy manual, alleges a failure to state reasons in the absence of an explanation in the contested decision as to why that measure is insufficient.

104

As regards the code of ethics, it must be observed that the evidence provided by the applicant attesting to its existence does not negate the plausibility of EU-OSHA’s finding that there is no proof of the effective implementation of that code, even though such proof could have been provided, based in particular on the actions taken by the ethics committee created by the code of ethics.

105

With regard specifically to the ethics committee, the information provided by the applicant, which mainly concerns the rules governing that committee, does not make it possible to establish its verifiable actions, in particular with a view to ensuring the full application of the code of ethics. The applicant did produce an email confirming that the ethics committee had launched an ethics survey among all staff in order to assess knowledge of the code and identify potential improvements. However, quite apart from the fact that the applicant did not attach the questionnaire to that email (see paragraph 96 above), the fact remains that no information has been provided on the results of that survey or on the action taken in response to it.

106

Lastly, as regards the manuals, guides and policies adopted by the applicant to promote ethics, the evidence of their existence when it was actually provided, or even of their dissemination, does not make it possible to rebut EU-OSHA’s finding of a lack of evidence of their effective implementation. Moreover, the large number of documents distributed is not necessarily conducive to effective implementation. With regard more specifically to the group policy manual, in respect of which the applicant alleges a failure to state reasons in the contested decision, it must be observed that EU-OSHA took that manual into account and ruled on it along with other company policies in recitals 81 to 83 of the contested decision, considering that their mere presentation without additional evidence of their implementation was insufficient.

107

Therefore, EU-OSHA did not commit a manifest error in its assessment of the implementation by the applicant of procedures and policies relating to ethics.

108

According to recitals 88 to 90 of the contested decision, the information provided by the applicant does not make it possible to assess the likely overall impact of its training offer on the behaviour of its employees, given that there is no evidence relating to the attendance rate at training courses and the effects of those courses on employees’ actual knowledge.

109

The applicant argues that the training programme put in place prior to the CNMC’s investigation, and the one specifically created following that investigation, unequivocally demonstrate its desire to comply with the legal requirements, emphasising the existence within the company of a department dedicated to internal training and the mandatory nature of the training in question, as proven by various documents submitted to the Court.

110

It is not disputed that some of the training courses in question were specifically set up to prevent a repetition of the conduct in question, a fact that is, moreover, established by the documents provided by the applicant, which indicate or repeat the content of those courses.

111

However, those documents do not identify the attendees of the training courses in question and nor do they attest to their effectiveness. Their allegedly compulsory nature certainly contributes to a wider dissemination of the courses in question, but does not make it possible, as such, to know the exact rate of participation or – above all – which categories of beneficiaries are concerned – whereas the fact of targeting certain categories is decisive for these courses to have value – or even less so whether the content of the courses has been properly assimilated, which could have been demonstrated by presenting evidence of the tests carried out at the end of the training sessions and the results of those tests.

112

EU-OSHA therefore did not commit a manifest error of assessment in finding that the training put in place by the applicant did not constitute a sufficient remedial measure.

113

It follows from all the foregoing considerations that EU-OSHA did not commit a manifest error in its assessment of the remedial measures adopted by the applicant, whether taken individually or even together and in their chronological sequence, given the lack of evidence of their implementation and effectiveness, an aspect common to all the measures.

114

That conclusion is not called into question by the argument put forward by the applicant in its reply that it has not been sanctioned since the CNMC decision concerning facts dating back to 2017, which attests to its reliability since that date. The absence of sanctions by a competition authority does not imply the absence of infringement, or a fortiori the effectiveness of the remedial measures adopted.

115

The second plea must therefore be rejected.

116

The applicant alleges infringement of Article 106(3) and (7)(a) and (d) of the former Financial Regulation and of Article 136(3)(a) of the Financial Regulation, taken in conjunction with the principle of proportionality, and claims that the analysis of the proportionate nature of the penalty imposed by those provisions is vitiated by manifest errors of assessment.

117

As for the aggravating circumstance based on the seriousness of the situation and the impact of the conduct, the applicant takes the view that the situation in the present case was not serious and that the allegation that the impact of the conduct was considerable cannot be accepted. In that regard, it emphasises the lack of direct damage to the financial interests of the EU, the absence of corruption or fraud, the limited geographical scope of the conduct in question, the involvement of a single associate of the applicant, the time that has elapsed since the events, and the absence of aggravating circumstances relating to the impact of the conduct on competition in the Financial Regulation, as only the financial impact is taken into account. According to the applicant, allowing it to participate in the tendering procedures of the EU institutions, agencies and offices could not have an impact on the EU budget, since the conduct in question took place in a sector not governed by EU public procurement rules.

118

As to its alleged role as instigator of the conduct in question, the applicant submits that EU-OSHA committed a serious error of assessment in assuming that the CNMC considered that it had played a leading role in the infringement and that, in any event, such a circumstance is not envisaged by the Financial Regulation, which refers only to the intentional nature of the conduct and the degree of negligence, which have not been established in the present case.

119

In its reply, the applicant criticises the addition by EU-OSHA in its defence of new aggravating circumstances that had not been considered in the contested decision and infers from that that the allegations concerned are inadmissible.

120

Lastly, the applicant reiterates that, in view of the remedial measures it has taken, which make it unlikely that the conduct in question will be repeated, the exclusion penalty is disproportionate.

121

Under Article 106(3) of the former Financial Regulation and Article 136(3)(a) of the Financial Regulation, the authorising officer’s decisions are to be made in compliance with the principle of proportionality, in particular taking into account the seriousness of the situation, including the impact on the financial interests and image of the Union, the time that has elapsed since the relevant conduct was identified, the duration of the conduct and any recurrence, whether the conduct was intentional or the degree of negligence shown, and any other mitigating circumstances, such as the degree of cooperation of the person or entity concerned with the relevant competent authority and the contribution of that person or entity to the investigation. Similarly, Article 106(7)(c) of the former Financial Regulation and Article 136(6)(c) of the Financial Regulation provide that a person or entity will not be excluded where such exclusion would be disproportionate. In addition, according to Article 106(14)(c) of the former Financial Regulation and Article 139(1)(b)(ii) of the Financial Regulation, the duration of the exclusion will not exceed three years if, as in the present case, the exclusion is based on Article 106(1)(c) of the former Financial Regulation or Article 136(1)(c) of the Financial Regulation respectively, and there is no final judgment or final administrative decision.

122

It is also clear from established case-law in the field of the law governing penalties that, by virtue of the principle of proportionality, the actions of the institutions must not go beyond what is appropriate and necessary to achieve the desired objective. The gravity of infringements has to be determined by reference to numerous factors and it is important not to confer on one or other of those factors an importance that is disproportionate in relation to other factors. The principle of proportionality implies that the penalty be set proportionately to the factors taken into account for the purpose of assessing the gravity of the infringement and also that those factors be applied in a way that is consistent and objectively justified (judgment of 9 February 2022, Companhia de Seguros Índico v Commission, T‑672/19, not published, EU:T:2022:64, paragraph 80; see also, to that effect and by analogy, judgment of 17 May 2011, Arkema France v Commission, T‑343/08, EU:T:2011:218, paragraph 63 and the case-law cited).

123

In its assessment of the proportionate nature of any exclusion, EU-OSHA considered that it had to take into account the CNMC’s assessment of the applicant’s participation in a cartel, which constitutes a serious infringement of national and EU competition rules (recital 99 of the contested decision) and, while accepting that there was no direct damage to the financial interests of the EU, considered that this infringement constituted a form of grave professional misconduct that also entailed risks for the EU budget (recital 101 of the contested decision). EU-OSHA concluded that the exclusion of the applicant would not be disproportionate in this case.

124

As for the duration of the exclusion, EU-OSHA opted for an exclusion of two years, less than the maximum duration of three years, on the basis of the three aggravating circumstances, namely the lengthy duration of the conduct in question (99 months), the impact of that conduct (more than 80 contracts concerned and the fact that the applicant had the highest coverage rate in the network concerned) and the leading role played by the applicant (recital 112 of the contested decision), while also taking account of the time that has elapsed since the conduct in question (more than five years), the absence of direct damage to the financial interests of the Union and the adoption of remedial measures along the right lines, albeit insufficient to demonstrate the reliability of the applicant (recitals 113 to 115 of the contested decision).

125

In the present case, the argument by which the applicant challenges the proportionality of the decision to exclude it for a period of two years in the light of the circumstances of the case must be interpreted as inviting the Court to assess, in the exercise of its unlimited jurisdiction, the proportionate nature of the exclusion penalty and its duration taking into account the circumstances invoked (see, to that effect, judgment of 29 June 2022, LA International Cooperation v Commission, T‑609/20, EU:T:2022:407, paragraph 158). Further, in the light of the head of claim put forward in the alternative, by which the applicant seeks the replacement of the exclusion measure with a financial penalty, the present plea can be viewed as asking the Court, if it considers the exclusion penalty to be disproportionate, to replace it with a less stringent measure, which was confirmed by the applicant at the hearing in response to a question put by the Court.

126

It is true that the exercise of unlimited jurisdiction does not amount to a review of the Court’s own motion, and proceedings are inter partes. Thus, unlimited jurisdiction does not require that the Court should be obliged to undertake of its own motion a new and comprehensive investigation of the file, independently of the claims put forward by the applicant (see, to that effect, judgment of 8 November 2018, Pro NGO! v Commission, T‑454/17, EU:T:2018:755, paragraph 83; see also, by analogy, judgment of 26 January 2017, Duravit and Others v Commission, C‑609/13 P, EU:C:2017:46, paragraphs 32, 33 and 36). However, in order to satisfy the requirements of Article 47 of the Charter, when conducting a review in the exercise of its unlimited jurisdiction with regard to penalties, the EU judicature is bound to examine all complaints based on issues of fact and law that seek to show that the penalty is not commensurate with the gravity or the duration of the misconduct (see, by analogy, judgment of 26 September 2018, Infineon Technologies v Commission, C‑99/17 P, EU:C:2018:773, paragraph 195 and the case-law cited). By challenging the proportionate nature of its exclusion, the applicant is specifically challenging the commensurate nature of the penalty in the present case.

127

It follows that the present plea, which relates to the penalty imposed on the applicant in the present case, and all the arguments put forward in support of it concerning the assessment of the aggravating and mitigating circumstances taken into account, should be examined by exercising of the Court’s unlimited jurisdiction pursuant to Article 143(9) of the Financial Regulation (see also paragraphs 52 to 54 above).

128

It also follows that, contrary to what EU-OSHA maintains, that unlimited jurisdiction empowers the Court to vary the contested act, by taking into account all the factual circumstances, so as to amend, for example, the duration of the exclusion (judgment of 29 June 2022, LA International Cooperation v Commission, T‑609/20, EU:T:2022:407, paragraph 157) and it cannot confine itself to performing a limited review of the assessment of the relevant aggravating and mitigating circumstances.

129

With regard, first, to the aggravating circumstance relating to the seriousness of the situation, it must be observed, first of all, that it is clear from the use of the expression ‘including’ before the reference to the ‘impact on the financial interests and image of the Union’ in the applicable provisions (see paragraph 121 above) that that impact is not the only one that may be taken into account in assessing that aggravating circumstance. The seriousness of the conduct in question may therefore also be taken into account (see, to that effect, judgments of 29 June 2022, LA International Cooperation v Commission, T‑609/20, EU:T:2022:407, paragraph 159, and of 21 December 2022, Vialto Consulting v Commission, T‑537/18, not published, EU:T:2022:852, paragraph 160), as was done in the contested decision (recitals 99 and 101).

130

Next, the applicant’s conduct must be considered serious. The applicant does not dispute the fact that the CNMC, which issued the decision that led to the present exclusion, described the infringement of competition law in which the applicant participated as ‘serious’. Neither does the applicant contest the charge that its conduct could, without the remedial measures, constitute a case of ‘grave professional misconduct’ within the meaning of the provisions applicable in this case. Admittedly, as the applicant rightly points out, such qualifications are not sufficient to characterise the ‘seriousness of the situation’. Otherwise any grave professional misconduct would be considered to be proportionately punished by means of exclusion. However, in the present case – as is clear from the contested decision, and without the data in question having been contested by the applicant – such seriousness is supported by the large number of contracts affected by the infringement (80) and the fact that the applicant has the highest coverage rate in the network concerned (see recital 112(b) and (c) of the contested decision). In that regard, it is irrelevant that the persons directly responsible have since left their employment within the applicant, since that termination of employment – which was subsequent to the end of the offending conduct and is not established as being linked to that conduct – does not rebut either this conduct or its seriousness. The same applies to the time that has elapsed since the events, which is also invoked by the applicant and which, while it may be taken into account (see paragraph 139 below), does not affect the intrinsic seriousness of the conduct. As for the absence of corruption or fraud, that does not in itself lead to the conclusion that all the other behaviours, although less serious, are not serious enough to justify an exclusion order.

131

Finally, it must be observed that the absence of direct damage to the financial interests of the Union, invoked by the applicant, was also taken into account by EU-OSHA (recitals 101 and 113 of the contested decision). However, in so far as the conduct in question constitutes grave professional misconduct, it entails risks for the EU budget, as it could be repeated in the context of future EU calls for tenders, if the applicant chooses to take part in them (see recitals 101 and 107 of the contested decision). It is clear from the provisions applicable in this case that their purpose is to prevent entities that are unreliable, in particular because they have infringed competition law, from being awarded EU public contracts (see paragraphs 21 to 24 and 71 above). It also follows that the limited geographical scope of the conduct in question is irrelevant in this case, particularly in view of its intrinsic seriousness.

132

Second, with regard to its alleged role as instigator, the applicant misreads the CNMC decision. It can be seen from the passages of that decision devoted to determining the penalty (pages 271 and 272) that the CNMC, on the one hand, took into account the circumstances laid down in Article 64(1) of Ley 15/2007 de defensa de la competencia (Law No 15/2007 on protecting competition) of 3 July 2007 (BOE No 159 of 4 July 2007, p. 28848), relating to the duration of the infringement, the number of calls for tender involved and the turnover in the market affected by the infringement and, on the other hand and in addition, considered the aggravating circumstance provided for in Article 64(2)(b) of the same law, relating to the position of the person responsible for or the instigator of the infringement. The particular role played by the applicant in the infringement, within the meaning of this provision, had therefore been recognised by the CNMC. In addition, such a role is sufficient to demonstrate at the very least a degree of negligence, which is expressly mentioned in the applicable provisions as one of the aggravating circumstances (see paragraph 121 above).

133

Third, as regards the mitigating circumstance constituted by the remedial measures adopted by the applicant, it should be pointed out, as a preliminary point, that those remedial measures, which are regarded as going in the right direction, were taken into account in the present case by EU-OSHA, not to infer from them that the applicant was sufficiently reliable not to be excluded (see the second plea in law; see also recitals 102 and 103 of the contested decision), but to limit the duration of the exclusion pursuant to Article 106(3) of the former Financial Regulation and then Article 136(3) of the Financial Regulation (recitals 114 and 115 of the contested decision). In the present case, therefore, it is a question of analysing the remedial measures adopted by the applicant in so far as they contribute not to the determination of the wrongful conduct but to the determination of the associated penalty, thereby justifying the exercise by the Court of its unlimited jurisdiction. In doing so, even though the same remedial measures were alleged, they were considered by EU-OSHA for different purposes in its analysis, and moreover on the basis of different provisions, on the one hand, to verify the existence of conduct justifying the exclusion (Article 106(7)(c) of the former Financial Regulation and Article 136(6)(a) of the Financial Regulation), and on the other hand, to determine the duration of the exclusion (Article 106(3) of the former Financial Regulation and Article 136(3) of the Financial Regulation) (see, to that effect, judgment of 20 March 2024, Westpole Belgium v Parliament, T‑640/22, not published, EU:T:2024:188, paragraphs 83 to 86), which also implies a different examination by the Court of these two assessments.

134

In exercising its unlimited jurisdiction in the present case, the Court is therefore empowered to take account of evidence communicated for the first time in the context of the present proceedings without having previously been communicated to EU-OSHA (see, to that effect and by analogy, judgments of 16 November 2000, Stora Kopparbergs Bergslags v Commission,C‑286/98 P, EU:C:2000:630, paragraph 57, and of 12 July 2011, Fuji Electric v Commission, T‑132/07, EU:T:2011:344, paragraphs 209 and 210), subject, however, to compliance with the rules of admissibility laid down by the Rules of Procedure of the General Court.

135

Accordingly, pursuant to Article 85 of the Rules of Procedure, the evidence annexed to the reply should be disregarded as inadmissible. This evidence could all have been produced previously, either because it is dated before the application (Annexes C.1 and C.3), or because, although it is dated after the application, it refers to an annual report and an annual declaration (Annexes C.2 and C.4), versions of which could have been produced from previous years, or is a screen capture that could have been taken previously (Annex C.5). In addition, since EU-OSHA criticised the applicant, as early as the contested decision, for providing insufficient proof of the implementation of the alleged remedial measures, which implementation the evidence seeks to establish, that evidence does not constitute evidence to the contrary, the admissibility of which is accepted even at the reply stage (see judgment of 5 October 2020, HeidelbergCement and Schwenk Zement v Commission, T‑380/17, EU:T:2020:471, paragraphs 161 and 162 (not published and the case-law cited)).

136

On the other hand, the evidence communicated for the first time in the present proceedings, as an annex to the application, without having been previously communicated to EU-OSHA, should be declared admissible for the reasons stated in paragraph 134 above.

137

It is clear from the examination of that evidence that it confirms data already established by evidence previously communicated to EU-OSHA (Annex A.31, concerning the termination of the employment of the associate responsible), that it relates to new remedial measures (performance of random internal audits and creation of the position of ‘special risk advisor’ established by Annexes A.32 to A.34), and even proves the existence of certain measures, or the commencement of the implementation of some of them (Annexes A.35 to A.48, concerning the updating of the compliance programme, ethics procedures and policies, and employee training).

138

It can be inferred from this, as EU-OSHA did, that the remedial measures adopted by the applicant are a step in the right direction. However, a reduction of the penalty – in the present case of the duration of the exclusion – on the basis of such remedial measures should be made only with great care to ensure it is not perceived as an incentive to commit grave professional misconduct while speculating on a possible reduction in the penalty by reason of a subsequent alteration of the conduct of the person or entity concerned (see, to that effect and by analogy, judgment of 18 July 2005, Scandinavian Airlines System v Commission, T‑241/01, EU:T:2005:296, paragraph 228).

139

Having regard to all the findings and circumstances referred to above, and to the uncontested aggravating circumstance represented by the duration of the conduct in question, and the uncontested mitigating circumstance represented by the time that has elapsed since the conduct in question, it must be held that the two-year exclusion measure adopted by EU-OSHA, which is shorter than the maximum period of three years laid down in the relevant provisions of the Financial Regulation, constitutes a proportionate penalty to prevent unreliable entities from being able to conclude EU public contracts and to safeguard the Union’s finances.

140

Consequently, the third plea in law must be rejected.

141

The applicant submits that, in deciding to publish the exclusion penalty, EU-OSHA failed to fulfil its obligation to state reasons, committed a manifest error of assessment and breached the principle of proportionality.

142

First, the statement of reasons for the publication of the exclusion is stereotypical and therefore does not meet the requirements of the Financial Regulation, which requires a statement of reasons relating to the need for publication in the circumstances of the case and the deterrent effect of publication.

143

Second, the applicant submits that the decision in the present case to publish is manifestly unfounded in the light of the criteria laid down in Article 140 of the Financial Regulation, which provides for publication where it is necessary to reinforce the deterrent effect of the exclusion, and excludes such publication in the event of disproportionate damage being caused to the economic operator concerned. In that respect, the applicant points to the absence of direct damage to the financial interests of the Union, the existence of numerous cases of exclusion that are much more reprehensible than the one that led to its own exclusion, the limited geographical scope of the facts at issue, the adoption of remedial measures that are a step in the right direction, the fact that the conduct ceased more than five years ago and the particularly low risk that it will repeat that conduct, particularly in view of the amendment of the Spanish legislation, and the fact that the associate responsible for that conduct has ceased to be employed by the applicant. The applicant also contests EU-OSHA’s unlimited discretionary powers with regard to publication, given the need to comply with the limitations expressly laid down in Article 140 of the Financial Regulation.

144

Third, publication is completely disproportionate, given the existence of a single aggravating circumstance and the irreparable damage caused by publication to the reputation of the applicant and that of all the entities operating under the Group’s brand. The applicant adds that publication of the CNMC decision on the CNMC website and in the Spanish press confirms that publication of the contested decision is unnecessary.

145

It must be observed that the applicable provision in the present case, given the date of publication of the contested decision, is Article 140 of the Financial Regulation, which is similar to Article 106(16) of the former Financial Regulation and reads as follows:

‘Publication of exclusion and financial penalties

1.   In order to, where necessary, reinforce the deterrent effect of the exclusion and/or financial penalty, the Commission shall, subject to a decision of the authorising officer responsible, publish on its website the following information related to the exclusion and, where applicable, the financial penalty in the cases referred to in points (c) to (h) of Article 136(1):

Where the decision on the exclusion and/or financial penalty has been taken on the basis of a preliminary classification as referred to in Article 136(2), the publication shall indicate that there is no final judgment or, where applicable, final administrative decision. In such cases, information about any appeals, their status and their outcome, as well as any revised decision of the authorising officer responsible shall be published without delay. Where a financial penalty has been imposed, the publication shall also indicate whether that penalty has been paid.

The decision to publish the information shall be taken by the authorising officer responsible either following the relevant final judgment or, where applicable, final administrative decision, or following the recommendation of the panel …, as the case may be. That decision shall take effect three months after its notification to the person or entity concerned, as referred to in Article 135(2).

The information published shall be removed as soon as the exclusion has come to an end. In the case of a financial penalty, the publication shall be removed six months after payment of that penalty.

…

2.   The information referred to in paragraph 1 of this Article shall not be published in any of the following circumstances:

…

…’

146

In the present case, EU-OSHA decided, in Article 4 of the contested decision, to publish the exclusion imposed on the applicant on the Commission’s website for the duration of the exclusion. It took the view that the conduct of the applicant serving as the basis for its exclusion was ‘particularly prejudicial and reprehensible’, as it had ‘demonstrated a serious disregard for the rules governing the operation of the market, due to its intense and ongoing participation in collusive practices aimed at restricting and distorting competition’. It also indicated that it would publish the exclusion in order to reinforce its deterrent effect (recitals 119 to 121 of the contested decision).

147

It must be held from the outset that the decision to publish the applicant’s exclusion is sufficiently substantiated.

148

Recitals 119 to 121 of the contested decision clearly and unequivocally disclose EU-OSHA’s reasoning, based on the seriousness of the applicant’s conduct and the aim pursued of reinforcing the deterrent effect of the exclusion (see paragraph 146 above), thus enabling, in accordance with settled case-law, the applicant to ascertain the reasons for the measure taken and the Court to exercise its power of review (see, to that effect, judgment of 1 July 2008, Chronopost and La Poste v UFEX and Others, C‑341/06 P and C‑342/06 P, EU:C:2008:375, paragraph 88 and the case-law cited). Moreover, in view of the statement indicating the particular seriousness of the applicant’s conduct, which should be read in the light in particular of recitals 40 to 44 of the contested decision describing the facts of the present case as grave professional misconduct, it cannot be considered that such a statement of reasons is stereotypical in nature. The same applies to the reference – without any further details being provided – to the need to reinforce the deterrent effect of the exclusion, in so far as such a need is inherent in the particular seriousness of the infringement committed (see, to that effect, judgment of 21 December 2022, Vialto Consulting v Commission, T‑537/18, not published, EU:T:2022:852, paragraph 160).

149

As to the appropriateness of publication, it must be observed at the outset that, in the case of grave professional misconduct, exclusion and publication are complementary, since they ultimately have the same objective of inducing all the persons concerned to desist from any transgression of the rules (see, to that effect, judgment of 21 December 2022, Vialto Consulting v Commission, T‑537/18, not published, EU:T:2022:852, paragraphs 152 and 171). As a complement to the penalty of exclusion, it must be held that, in accordance with the case-law relating to review of the legality of penalties, the review of the proportionality of publication cannot be restricted, but must be a thorough review both in law and in fact (see, to that effect and by analogy, judgment of 9 June 2021, DI v ECB, T‑514/19, EU:T:2021:332, paragraph 197 and the case-law cited; see also paragraph 128 above).

150

The fact remains, nonetheless, that exclusion and publication are not equivalent in their effects, exclusion being essentially punitive whereas publication is deterrent and preventive. It follows that the decision to publish must be the subject of a specific proportionality analysis, even if the facts giving rise to the publication and the exclusion penalty may be common and studied concomitantly and the criteria for assessing their proportionality are in part common (see, to that effect, judgment of 21 December 2022, Vialto Consulting v Commission, T‑537/18, not published, EU:T:2022:852, paragraphs 171 and 173).

151

In the present case, as regards, first, the need to reinforce the deterrent effect of the exclusion, it should be remembered that such a need is inherent in the seriousness of the conduct in question (see paragraph 148 above). However, as is clear from the examination of the proportionality of the exclusion, the applicant is not disputing in those proceedings the fact that the infringement punished by the CNMC was committed, or the elements establishing its intrinsic seriousness (see paragraph 130 above; see also paragraph 49 above), which is not called into question by the existence of more reprehensible cases of exclusion. Furthermore, an analysis of the remedial measures adopted by the applicant shows that, although they are a step in the right direction, they do not allow us to conclude that the applicant has regained its reliability (see paragraphs 113 and 138 above), a reliability that cannot be inferred from the time that has elapsed since the infringement ceased. Furthermore, the allegedly limited geographical scope of the facts at issue, the absence of direct damage to the financial interests of the Union, and the alleged amendment of the Spanish legislation abolishing the type of public contract concerned by the conduct at issue are not decisive for the purposes of assessing the need to reinforce the deterrent effect of the exclusion within the meaning of Article 140(1) of the Financial Regulation, in so far as that deterrent effect is intended to prevent a repetition of the conduct in question in the context of the future relationship of the person or entity concerned with the institutions, agencies and offices of the Union. As for the alleged particularly low risk that the applicant will repeat the conduct in question, apart from the fact that the applicant supports this assertion only by the amendment of the Spanish legislation and the remedial measure consisting in the termination of the employment of the associate responsible for that conduct, both of which have been set aside above, it is important to remember that deterrence is aimed not only at the undertaking concerned but also at third parties (see, by analogy, judgment of 29 November 2005, Union Pigments v Commission, T‑62/02, EU:T:2005:430, paragraph 174). It follows that EU-OSHA did not commit an error of assessment in considering that it was necessary to reinforce the deterrent effect of the exclusion by publishing it.

152

With regard, second, to the damage to the applicant’s reputation, it must be held that such damage is inherent in the publication of the exclusion and does not, in the present case, constitute disproportionate damage within the meaning of Article 140(2)(b) of the Financial Regulation.

153

In fact, before that publication, the CNMC decision was made available on the CNMC website and the Spanish press reported on the decision. In addition, the impact of the publication ordered by EU-OSHA will be limited by the reference – required by the second subparagraph of Article 140(1) of the Financial Regulation – to the non-final nature of the CNMC decision, taking into account in this case the appeal lodged against that decision before the Audiencia Nacional (National High Court) and the stay ordered by that court. That kind of publicity given to the non-final nature of the CNMC decision, which goes beyond the national framework, is even likely to mitigate the effects produced by the publication of the CNMC decision on its website and its publication in the Spanish press.

154

Consequently, the fourth plea must be rejected.

155

The same would apply if the Court were to exercise its unlimited jurisdiction to rule on the present plea, as the applicant requested at the hearing. without it being necessary to rule on the admissibility of that request and on the possibility for the Court to substitute its own assessment for that of EU-OSHA with regard to the publication of the exclusion pursuant to Article 143(9) of the Financial Regulation, it must be held that, in the absence of any additional evidence put forward by the applicant in support of its request and in the light of the elements examined above, the publication of the exclusion of the applicant is justified.

156

In the alternative, the applicant alleges, first, that EU-OSHA failed to assess the application of a financial penalty as an alternative to the exclusion decision, in accordance with Article 106(13)(a) of the former Financial Regulation, which is applicable in the present case. It concludes, in its reply, that the contested decision is vitiated by a manifest failure to state reasons in this respect.

157

Second, in the event that the Court does not uphold that complaint, the applicant requests that the penalty of exclusion under its unlimited jurisdiction be replaced by a financial penalty that is reasonable based on the circumstances of the case, which would be between 2% and 10% of the value of the procurement contract. It stresses the admissibility of that request, supported in the present case by the specific argument based on the application of the more favourable provision in terms of penalty.

158

As a preliminary point, it should be noted that, having regard to the rejection of the first, second, third and fourth pleas in law, it is appropriate to examine the present plea in law, put forward in the alternative if the other pleas challenging the exclusion are rejected.

159

It is important to note, and is not disputed by the parties, that the provision applicable in the present case is that of the former Financial Regulation.

160

Only that provision allows the authorising officer responsible to replace the exclusion penalty by a financial penalty when exclusion would be disproportionate for any economic operator, such as the applicant, whereas Article 138(1) of the Financial Regulation only allows such a replacement for certain economic operators, the ‘recipient[s] with whom a legal commitment has been entered into’. Thus, in accordance with the case-law, in the event of developments in the rules governing administrative penalties, which would lead to certain aspects of the new rules being more lenient, but in other aspects more stringent than the old rules, it is appropriate to apply the most lenient rules (see, to that effect, judgment of 27 June 2017, NC v Commission, T‑151/16, EU:T:2017:437, paragraph 55 and the case-law cited), in the present case that of the former Financial Regulation.

161

According to Article 106(13)(a) of the former Financial Regulation:

‘13.   In order to ensure a deterrent effect, the contracting authority may, having regard, where applicable, to the recommendation of the panel referred to in Article 108, impose a financial penalty on an economic operator who has attempted to obtain access to Union funds by participating or requesting to participate in a procurement procedure while being, without having declared it in accordance with paragraph 10 of this Article, in one of the following exclusion situations:

162

First, it can be inferred from the wording of this provision, which establishes an option of replacement, that EU-OSHA was not, in the present case, required to examine the possibility of replacing the exclusion penalty by a financial penalty. That is all the more true as it follows from the foregoing that EU-OSHA rightly considered that exclusion did not constitute a disproportionate penalty. It cannot therefore be accused of failing to state reasons in that regard.

163

Second, as regards the request to the Court that it itself effect that replacement in the context of its unlimited jurisdiction, that must be dismissed as unfounded, without there being any need to rule on its admissibility, which is contested by EU-OSHA. The applicant merely invokes the application of Article 106(13)(a) of the former Financial Regulation, without setting out the reasons why the exclusion penalty should, in the present case, be replaced by a financial penalty. Furthermore, and in any event, it follows from an examination of the third plea in law that the exclusion penalty imposed in the present case is appropriate and should not, therefore, be replaced by a financial penalty.

164

The fifth plea must therefore be rejected.

165

It follows from all of the foregoing that this action must be dismissed.

166

Under Article 134(1) of the Rules of Procedure, the unsuccessful party is to be ordered to pay the costs if they have been applied for in the successful party’s pleadings. Since the applicant has been unsuccessful, it must be ordered to pay the costs, including those relating to the proceedings for interim measures, in accordance with the form of order sought by EU-OSHA.

On those grounds,

THE GENERAL COURT (Fourth Chamber, Extended Composition)

hereby: