{ "$schema_version": "1.0.0", "$description": "Applicability rules. Declarative data evaluated by a deliberately unintelligent matcher: a rule fires when every dimension it specifies intersects the user's selection, and a dimension the rule omits is a wildcard. There is no decision tree in the JavaScript — the reasoning lives here and is inspectable.", "$last_verified": "2026-08-27", "$outcomes": { "outcome:applies": "Likely applies — on the facts given, a rule for the instrument fires. A case-specific assessment is still required.", "outcome:likely": "Potentially applicable — applies on the ordinary reading, but turns on a condition not established here.", "outcome:possible": "Potentially applicable — may apply, depending on facts this questionnaire does not ask for.", "outcome:unlikely": "Likely not applicable — but absence of an obligation here is not a safe harbour.", "outcome:undetermined": "NOT A RULE OUTCOME. Emitted by the engine when no rule covers the combination. Absence of a rule is absence of knowledge, never evidence of non-applicability." }, "$limits": [ "This is a map of the rulebook, not legal advice, and cannot be. It asks three questions where a lawyer would ask fifty.", "Every rule is drawn from the brief's own analysis and the instruments cited in it. Coverage is uneven by design: the six core instruments are covered in depth, the adjacent ones barely.", "A threshold the questionnaire does not establish downgrades an outcome by one step rather than excluding the rule, so a borderline case is shown rather than hidden.", "Sectoral, national and contractual obligations are almost entirely outside this dataset. A clean result here says nothing about them." ], "rules": [ { "id": "ap-gdpr-01", "instrument": "gdpr", "conditions": { "activity": ["activity:processing-personal-data"], "territory": ["territory:eu-established"] }, "outcome": "outcome:applies", "rationale": "Any processing of personal data by a controller or processor established in the Union falls within the GDPR, whatever the sector and whatever the size of the organisation. There is no de minimis exemption from the Regulation as a whole.", "obligations": ["gdpr:art-5", "gdpr:art-6", "gdpr:art-30", "gdpr:art-33", "gdpr:art-35"], "authority": ["dpa-*"], "dates": ["tl-gdpr-2018-05-25-application"], "exemptions": ["Purely personal or household activity is outside scope.", "Article 30(5) narrows the records obligation for organisations under 250 employees, but does not remove it where processing is not occasional or involves special categories."], "depends_on": [], "claims": ["clm-one-stop-shop"], "sources": ["src-eurlex-gdpr"], "last_verified": "2026-08-27" }, { "id": "ap-gdpr-02", "instrument": "gdpr", "conditions": { "activity": ["activity:processing-personal-data"], "territory": ["territory:non-eu-serving-eu"] }, "outcome": "outcome:likely", "rationale": "Article 3(2) reaches a controller not established in the Union where the processing relates to offering goods or services to data subjects in the Union, or to monitoring their behaviour. Whether either limb is met is a question of fact about targeting that this questionnaire does not establish — merely being accessible from the Union is not enough.", "obligations": ["gdpr:art-3", "gdpr:art-5", "gdpr:art-6"], "authority": ["dpa-*"], "dates": ["tl-gdpr-2018-05-25-application"], "exemptions": [], "depends_on": ["Whether the offering is directed at data subjects in the Union, or their behaviour is monitored."], "claims": [], "sources": ["src-eurlex-gdpr"], "last_verified": "2026-08-27" }, { "id": "ap-gdpr-03", "instrument": "gdpr", "conditions": { "actor": ["actor:public-authority"], "activity": ["activity:processing-personal-data"] }, "outcome": "outcome:applies", "rationale": "A public authority processing personal data owes the full obligation set, and must designate a data protection officer under Article 37 irrespective of the scale of processing.", "obligations": ["gdpr:art-37", "gdpr:art-35", "gdpr:art-6"], "authority": ["dpa-*"], "dates": ["tl-gdpr-2018-05-25-application"], "exemptions": ["Processing by competent authorities for law-enforcement purposes falls under the Law Enforcement Directive rather than the GDPR — an instrument outside this dataset."], "depends_on": [], "claims": [], "sources": ["src-eurlex-gdpr"], "last_verified": "2026-08-27" }, { "id": "ap-gdpr-04", "instrument": "gdpr", "conditions": { "actor": ["actor:ai-provider", "actor:ai-deployer"], "activity": ["activity:ai-deployment", "activity:processing-personal-data"] }, "outcome": "outcome:likely", "rationale": "Article 22 has governed decisions based solely on automated processing since 2018 and applies to systems the AI Act classifies as minimal risk. An AI system that produces legal or similarly significant effects for individuals engages it regardless of the AI Act tier the system falls into.", "obligations": ["gdpr:art-22", "gdpr:art-35"], "authority": ["dpa-*"], "dates": ["tl-gdpr-2018-05-25-application"], "exemptions": [], "depends_on": ["Whether the system processes personal data at all.", "Whether decisions are based solely on automated processing and produce legal or similarly significant effects."], "claims": ["clm-art-22-predates-ai-act", "clm-three-impact-assessments"], "sources": ["src-eurlex-gdpr"], "last_verified": "2026-08-27" }, { "id": "ap-dsa-01", "instrument": "dsa", "conditions": { "actor": ["actor:online-platform", "actor:vlop"], "activity": ["activity:online-platform-activity", "activity:marketplace-activity", "activity:recommender-systems"] }, "outcome": "outcome:applies", "rationale": "Obligations stack cumulatively across four tiers. An online platform owes the intermediary and hosting duties below it as well as the platform tier: notice and action, statements of reasons, internal complaint handling, the dark-pattern ban, advertising transparency and recommender-parameter disclosure.", "obligations": ["dsa:art-16", "dsa:art-25", "dsa:art-28"], "authority": ["dsc-*"], "dates": ["tl-dsa-2024-02-17-application"], "exemptions": ["Micro and small enterprises are exempt from the Section 3 online-platform obligations unless designated as a VLOP."], "depends_on": [], "claims": ["clm-dsa-four-tiers", "clm-art-16-over-removal-incentive"], "sources": ["src-eurlex-dsa"], "last_verified": "2026-08-27" }, { "id": "ap-dsa-02", "instrument": "dsa", "conditions": { "actor": ["actor:vlop"], "activity": ["activity:online-platform-activity", "activity:recommender-systems", "activity:marketplace-activity"], "thresholds": { "monthly_active_eu_users_gte": 45000000 } }, "outcome": "outcome:applies", "rationale": "Designation brings the heaviest tier: annual systemic risk assessment, proportionate mitigation, independent audit, an enhanced advertisement repository, a recommender option not based on profiling, vetted-researcher data access and a supervisory fee. The Commission supervises this tier directly.", "obligations": ["dsa:art-34", "dsa:art-35", "dsa:art-38", "dsa:art-39", "dsa:art-40"], "authority": ["ec"], "dates": ["tl-dsa-2023-08-01-application"], "exemptions": [], "depends_on": ["Actual designation by Commission decision. The threshold alone does not create the obligation."], "claims": ["clm-dsa-vlop-threshold", "clm-art-34-open-concept", "clm-art-40-underperforming"], "sources": ["src-eurlex-dsa"], "last_verified": "2026-08-27" }, { "id": "ap-dsa-03", "instrument": "dsa", "conditions": { "actor": ["actor:online-platform", "actor:large-company"], "activity": ["activity:recommender-systems"] }, "outcome": "outcome:possible", "rationale": "The systemic-risk regime for recommender design reaches only designated VLOPs and VLOSEs. A platform below that threshold owes recommender-parameter transparency but not the Article 34 assessment — unless and until it is designated.", "obligations": ["dsa:art-34", "dsa:art-35"], "authority": ["ec", "dsc-*"], "dates": ["tl-dsa-2023-08-01-application"], "exemptions": ["Below the 45 million threshold and absent designation, Articles 33–43 do not apply."], "depends_on": ["Whether the service reaches 45 million average monthly active recipients in the Union.", "Whether the Commission has designated it."], "claims": ["clm-dsa-vlop-threshold"], "sources": ["src-eurlex-dsa"], "last_verified": "2026-08-27" }, { "id": "ap-dsa-04", "instrument": "dsa", "conditions": { "activity": ["activity:marketplace-activity"] }, "outcome": "outcome:applies", "rationale": "A platform allowing consumers to conclude distance contracts with traders must obtain and check specified trader information before allowing use of the service, and must design its interface so that the trader's identity is visible.", "obligations": ["dsa:art-30", "dsa:art-16"], "authority": ["dsc-*"], "dates": ["tl-dsa-2024-02-17-application"], "exemptions": ["Micro and small enterprises are exempt from the online-platform section unless designated as a VLOP."], "depends_on": [], "claims": ["clm-temu-fine"], "sources": ["src-eurlex-dsa"], "last_verified": "2026-08-27" }, { "id": "ap-dsa-05", "instrument": "dsa", "conditions": { "actor": ["actor:researcher"] }, "outcome": "outcome:possible", "rationale": "Article 40 gives researchers a route to platform data rather than an obligation. Access to non-public data runs through the Digital Services Coordinator of establishment, not the platform, and is purpose-limited to the detection and understanding of systemic risks. The brief records that route as underperforming in practice.", "obligations": ["dsa:art-40"], "authority": ["dsc-*", "ec"], "dates": ["tl-dsa-2025-10-29-delegated-act"], "exemptions": ["Article 40 reaches only VLOPs and VLOSEs. Smaller platforms are outside it entirely."], "depends_on": ["Vetting by a Digital Services Coordinator.", "Whether the research is directed at systemic risks in the Union."], "claims": ["clm-art-40-underperforming", "clm-art-40-delegated-act"], "sources": ["src-eurlex-dsa", "src-eurlex-dsa-da-2050"], "last_verified": "2026-08-27" }, { "id": "ap-dma-01", "instrument": "dma", "conditions": { "actor": ["actor:gatekeeper"] }, "outcome": "outcome:applies", "rationale": "Designation is the switch. Once an undertaking is designated for a core platform service, the Article 5 prohibitions apply immediately and self-executingly, with no requirement to demonstrate anticompetitive effect in the individual case.", "obligations": ["dma:art-5", "dma:art-6", "dma:art-7", "dma:art-13"], "authority": ["ec"], "dates": ["tl-dma-2023-05-01-application"], "exemptions": ["The DMA imposes no direct obligations on SMEs."], "depends_on": ["Designation by Commission decision for the specific core platform service."], "claims": ["clm-dma-ex-ante", "clm-dma-designation", "clm-dma-commission-exclusive", "clm-apple-proactive-enablement"], "sources": ["src-eurlex-dma", "src-ec-apple-meta-dma-2025"], "last_verified": "2026-08-27" }, { "id": "ap-dma-02", "instrument": "dma", "conditions": { "actor": ["actor:large-company", "actor:online-platform", "actor:cloud-provider"], "thresholds": { "monthly_active_eu_end_users_gte": 45000000, "yearly_active_eu_business_users_gte": 10000 } }, "outcome": "outcome:possible", "rationale": "Article 3 designates by quantitative presumption: substantial Union turnover or market capitalisation, at least 45 million monthly active end users and 10,000 yearly active business users, sustained over three financial years. Meeting the thresholds triggers a notification duty, not the obligations themselves.", "obligations": ["dma:art-3", "dma:art-2"], "authority": ["ec"], "dates": ["tl-dma-2026-11-01-designation"], "exemptions": [], "depends_on": ["Whether the service is a core platform service within the Article 2 list.", "Whether the thresholds are met over three financial years.", "Designation by Commission decision."], "claims": ["clm-dma-designation", "clm-seven-gatekeepers"], "sources": ["src-eurlex-dma"], "last_verified": "2026-08-27" }, { "id": "ap-dma-03", "instrument": "dma", "conditions": { "actor": ["actor:sme"] }, "outcome": "outcome:unlikely", "rationale": "The Commission's 2026 review confirms the DMA imposes no direct obligations on SMEs. An SME is far more likely to encounter the DMA as a business user with rights against a gatekeeper — the right to steer, to access its own performance data, and to raise non-compliance with a national authority — than as an addressee.", "obligations": ["dma:art-5", "dma:art-6"], "authority": ["ec"], "dates": [], "exemptions": [], "depends_on": [], "claims": ["clm-dma-review-enforce-not-expand"], "sources": ["src-ec-dma-review-2026"], "last_verified": "2026-08-27" }, { "id": "ap-dma-04", "instrument": "dma", "conditions": { "activity": ["activity:cloud-services"] }, "outcome": "outcome:possible", "rationale": "Cloud computing services sit within the Article 2 list of core platform services, and cloud designation decisions are due in November 2026 with a market investigation running to May 2027. The scope gap the brief identifies is generative AI, not cloud.", "obligations": ["dma:art-2", "dma:art-3"], "authority": ["ec"], "dates": ["tl-dma-2026-11-01-designation", "tl-dma-2027-05-01-market-investigation"], "exemptions": [], "depends_on": ["The outcome of the pending cloud designation decisions."], "claims": ["clm-dma-scope-gap"], "sources": ["src-eurlex-dma"], "last_verified": "2026-08-27" }, { "id": "ap-ai-act-01", "instrument": "ai-act", "conditions": { "actor": ["actor:ai-provider", "actor:ai-deployer", "actor:gpai-provider"], "activity": ["activity:ai-development", "activity:ai-deployment", "activity:gpai-provision"] }, "outcome": "outcome:applies", "rationale": "The Article 5 prohibitions and the AI-literacy duty have applied since 2 February 2025 to every provider and deployer, at every risk tier. This is the part of the AI Act that is in force now and is not affected by the Omnibus deferral.", "obligations": ["ai-act:art-5"], "authority": ["nca-*", "ai-office"], "dates": ["tl-ai-act-2025-02-02-application"], "exemptions": ["The AI Act does not apply to AI systems used exclusively for military, defence or national security purposes."], "depends_on": [], "claims": ["clm-art-5-binds-states", "clm-ai-act-not-all-ai"], "sources": ["src-eurlex-ai-act"], "last_verified": "2026-08-27" }, { "id": "ap-ai-act-02", "instrument": "ai-act", "conditions": { "actor": ["actor:gpai-provider"], "activity": ["activity:gpai-provision"] }, "outcome": "outcome:applies", "rationale": "Every provider of a general-purpose AI model owes Article 53 since 2 August 2025: Annex XI technical documentation, an Annex XII information pack for downstream providers, a copyright compliance policy and a sufficiently detailed public summary of training content. The operative detail sits in the Code of Practice, which is voluntary.", "obligations": ["ai-act:art-53", "ai-act:art-3-63"], "authority": ["ai-office"], "dates": ["tl-ai-act-2025-08-02-application", "tl-ai-act-2025-07-10-guidance"], "exemptions": ["Article 53(2) partially exempts models released under a genuinely free and open-source licence — but the exemption evaporates entirely for systemic-risk models."], "depends_on": [], "claims": ["clm-gpai-code-voluntary"], "sources": ["src-eurlex-ai-act", "src-ec-gpai-code"], "last_verified": "2026-08-27" }, { "id": "ap-ai-act-03", "instrument": "ai-act", "conditions": { "actor": ["actor:gpai-provider"], "activity": ["activity:gpai-provision"], "thresholds": { "cumulative_training_flop_gte": 1e25 } }, "outcome": "outcome:likely", "rationale": "Article 51(2) presumes high-impact capabilities where cumulative training compute exceeds 10^25 FLOP, which brings the Article 55 frontier duties: model evaluation including documented adversarial testing, Union-level systemic risk assessment and mitigation, serious-incident reporting and adequate cybersecurity. The threshold is a rebuttable presumption, and the Commission may also designate by decision.", "obligations": ["ai-act:art-51", "ai-act:art-55"], "authority": ["ai-office"], "dates": ["tl-ai-act-2025-08-02-application"], "exemptions": [], "depends_on": ["Cumulative training compute, which the questionnaire does not ask for.", "Whether the presumption is rebutted, or systemic risk designated by Commission decision."], "claims": ["clm-flop-threshold"], "sources": ["src-eurlex-ai-act"], "last_verified": "2026-08-27" }, { "id": "ap-ai-act-04", "instrument": "ai-act", "conditions": { "actor": ["actor:ai-provider", "actor:ai-deployer"], "activity": ["activity:ai-deployment", "activity:ai-development"] }, "outcome": "outcome:possible", "rationale": "The Chapter III high-risk obligations — risk management, data governance, technical documentation, logging, human oversight, accuracy and cybersecurity, conformity assessment and registration — reach a system only through one of the two Article 6 entry routes. Most deployed AI never leaves the minimal-risk tier. Following the AI Omnibus these duties arrive on 2 December 2027 for Annex III systems and 2 August 2028 for product-embedded ones.", "obligations": ["ai-act:art-6", "ai-act:art-9", "ai-act:art-27"], "authority": ["nca-*"], "dates": ["tl-ai-act-2027-12-02-application", "tl-ai-act-2028-08-02-application"], "exemptions": ["Article 6(3) filters out an Annex III system that does not pose a significant risk of harm — but the provider must document that assessment and register the system."], "depends_on": ["Whether the system is a safety component of a product covered by Annex I harmonisation legislation.", "Whether it falls within an Annex III use case — biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, or justice and democratic processes."], "claims": ["clm-ai-act-not-all-ai", "clm-ai-act-delay-scope", "clm-ai-act-standards-not-ready"], "sources": ["src-eurlex-ai-act", "src-ec-ai-omnibus-in-force"], "last_verified": "2026-08-27" }, { "id": "ap-ai-act-05", "instrument": "ai-act", "conditions": { "actor": ["actor:ai-deployer", "actor:manufacturer", "actor:large-company", "actor:sme"], "activity": ["activity:ai-deployment"] }, "outcome": "outcome:possible", "rationale": "Article 25 is the trap most often missed: a distributor, importer or deployer becomes a provider — assuming the full obligation set — if it puts its name or trademark on a high-risk system, substantially modifies it, or modifies its intended purpose. Buying rather than building is not by itself a way out.", "obligations": ["ai-act:art-25"], "authority": ["nca-*"], "dates": ["tl-ai-act-2027-12-02-application"], "exemptions": [], "depends_on": ["Whether the system is high-risk at all.", "Whether the deployer rebrands, substantially modifies, or repurposes it."], "claims": ["clm-art-25-provider-trap"], "sources": ["src-eurlex-ai-act"], "last_verified": "2026-08-27" }, { "id": "ap-ai-act-06", "instrument": "ai-act", "conditions": { "actor": ["actor:public-authority"], "activity": ["activity:ai-deployment"] }, "outcome": "outcome:applies", "rationale": "The Article 5 prohibitions bind public authorities as well as firms. Social scoring by government, predictive policing based solely on profiling, and emotion recognition in workplaces and educational institutions are prohibited outright. Real-time remote biometric identification in publicly accessible spaces for law enforcement is prohibited subject to narrow exceptions.", "obligations": ["ai-act:art-5", "ai-act:art-27"], "authority": ["nca-*", "ec"], "dates": ["tl-ai-act-2025-02-02-application"], "exemptions": ["Article 4(2) TEU reserves national security to the Member States, and the AI Act does not apply to systems placed on the market, put into service or used exclusively for military, defence or national security purposes (Art. 2(3)). The brief argues this carve-out is the structural source of the asymmetry between constraint on corporate and on state power."], "depends_on": ["Whether the use is characterised as national security, which the Act does not itself resolve."], "claims": ["clm-art-5-binds-states", "clm-art-4-2-teu-carve-out", "clm-enforcement-asymmetry"], "sources": ["src-eurlex-ai-act"], "last_verified": "2026-08-27" }, { "id": "ap-ai-act-07", "instrument": "ai-act", "conditions": { "actor": ["actor:ai-provider", "actor:ai-deployer", "actor:gpai-provider"], "territory": ["territory:non-eu-serving-eu"] }, "outcome": "outcome:likely", "rationale": "The AI Act reaches providers placing systems on the Union market and, on the marketing criterion the brief identifies across the rulebook, providers whose system output is used in the Union irrespective of where they are established.", "obligations": ["ai-act:art-5", "ai-act:art-53"], "authority": ["ai-office", "nca-*"], "dates": ["tl-ai-act-2025-02-02-application"], "exemptions": [], "depends_on": ["Whether the system is placed on the Union market or its output used in the Union."], "claims": [], "sources": ["src-eurlex-ai-act"], "last_verified": "2026-08-27" }, { "id": "ap-data-act-01", "instrument": "data-act", "conditions": { "actor": ["actor:cloud-provider"], "activity": ["activity:cloud-services"] }, "outcome": "outcome:applies", "rationale": "Chapter VI is nine articles (Arts. 23-31) out of fifty and carries most of the Regulation's practical weight for the software industry. Providers of data processing services must remove all pre-commercial, commercial, technical, contractual and organisational obstacles to switching, and Article 25 prescribes the mandatory contractual terms.", "obligations": ["data-act:art-25"], "authority": ["nca-*"], "dates": ["tl-data-act-2025-09-12-application", "tl-data-act-2027-01-12-application"], "exemptions": [], "depends_on": ["Whether Chapter VI reaches contracts concluded before 12 September 2025: Article 50 phases in only Chapter IV for such contracts, and practitioner analysis reads the switching right as reaching them; the Commission's FAQ (version 1.4) does not address the point."], "claims": ["clm-data-act-switching-numbers", "clm-data-act-retroactivity-open"], "sources": ["src-eurlex-data-act"], "last_verified": "2026-08-27" }, { "id": "ap-data-act-02", "instrument": "data-act", "conditions": { "actor": ["actor:cloud-provider"], "activity": ["activity:cloud-services"], "territory": ["territory:non-eu-serving-eu"] }, "outcome": "outcome:likely", "rationale": "The Data Act reaches non-EEA providers of data processing services with customers in the Union. Establishment outside the Union is not a way out of the switching regime.", "obligations": ["data-act:art-25"], "authority": ["nca-*"], "dates": ["tl-data-act-2027-01-12-application"], "exemptions": [], "depends_on": ["Whether the provider offers services to customers in the Union."], "claims": [], "sources": ["src-eurlex-data-act"], "last_verified": "2026-08-27" }, { "id": "ap-data-act-03", "instrument": "data-act", "conditions": { "actor": ["actor:manufacturer", "actor:connected-product-provider"], "activity": ["activity:connected-products"] }, "outcome": "outcome:applies", "rationale": "From 12 September 2026 connected products must be designed and manufactured so that product and related service data are, by default, easily, securely and directly accessible to the user. This is a design obligation, not a disclosure one: it bites at the point the product is placed on the market.", "obligations": ["data-act:art-3-1"], "authority": ["nca-*"], "dates": ["tl-data-act-2026-09-12-application"], "exemptions": ["Data holders may limit access where data qualifies as a trade secret, but must notify the national competent authority, and the user may challenge before a court. The brief records practitioner doubt about whether the confidentiality measures required of recipients are sufficient."], "depends_on": [], "claims": ["clm-data-act-art-3-application", "clm-data-act-trade-secret-tension"], "sources": ["src-eurlex-data-act"], "last_verified": "2026-08-27" }, { "id": "ap-data-act-04", "instrument": "data-act", "conditions": { "actor": ["actor:sme", "actor:large-company"], "activity": ["activity:cloud-services", "activity:connected-products"] }, "outcome": "outcome:possible", "rationale": "The Data Act governs product and service data as such — personal or not, though predominantly non-personal, industrial and machine-generated, with the GDPR prevailing wherever personal data is involved — and reallocates control over it by default. An organisation may be a data holder, a user or a data recipient depending on the arrangement, and the obligations differ in each role.", "obligations": ["data-act:art-3-1", "data-act:art-25"], "authority": ["nca-*"], "dates": ["tl-data-act-2025-09-12-application", "tl-data-act-2027-09-12-application"], "exemptions": [], "depends_on": ["Which role the organisation occupies: data holder, user, or data recipient."], "claims": ["clm-data-act-non-personal", "clm-data-act-enforcement-uneven"], "sources": ["src-eurlex-data-act"], "last_verified": "2026-08-27" }, { "id": "ap-nis2-01", "instrument": "nis2", "conditions": { "actor": ["actor:critical-sector", "actor:essential-entity", "actor:important-entity"], "activity": ["activity:critical-infrastructure-operation"] }, "outcome": "outcome:likely", "rationale": "NIS2 sets ten baseline risk-management measures and a reporting cascade of 24 hours, 72 hours and one month. Article 20 makes management bodies approve and oversee the measures and liable for the entity's infringements, and Article 32(6) adds personal liability for those responsible at essential entities — the provision that actually changes boardroom behaviour. Whether an organisation is an essential or an important entity turns on its sector and size.", "obligations": ["nis2:art-3", "nis2:art-20", "nis2:art-21", "nis2:art-23"], "authority": ["nca-*", "enisa"], "dates": ["tl-nis2-2024-10-17-transposition"], "exemptions": [], "depends_on": ["THE OPERATIVE DATE IS NATIONAL, NOT EUROPEAN. NIS2 is a directive and transposition is materially incomplete: registration windows and compliance dates vary by Member State, and in several they have not yet arrived.", "Whether the organisation falls within an Annex I or Annex II sector and meets the size criteria."], "claims": ["clm-nis2-management-liability", "clm-nis2-transposition-failure", "clm-directives-underperform"], "sources": ["src-eurlex-nis2", "src-ec-nis2-referral-2026"], "last_verified": "2026-08-27" }, { "id": "ap-nis2-02", "instrument": "nis2", "conditions": { "actor": ["actor:cloud-provider"], "activity": ["activity:cloud-services", "activity:critical-infrastructure-operation"] }, "outcome": "outcome:likely", "rationale": "Cloud computing service providers and data centre service providers sit within the digital infrastructure sector, which NIS2 treats as essential. The size thresholds still determine whether an entity is essential or important.", "obligations": ["nis2:art-21", "nis2:art-23", "nis2:art-20"], "authority": ["nca-*"], "dates": ["tl-nis2-2024-10-17-transposition"], "exemptions": ["Micro and small enterprises are generally outside NIS2, subject to sector-specific exceptions."], "depends_on": ["National transposition in the Member State of establishment.", "Size criteria."], "claims": ["clm-nis2-transposition-failure"], "sources": ["src-eurlex-nis2"], "last_verified": "2026-08-27" }, { "id": "ap-nis2-03", "instrument": "nis2", "conditions": { "actor": ["actor:public-authority"], "activity": ["activity:critical-infrastructure-operation"] }, "outcome": "outcome:possible", "rationale": "Public administration entities are within NIS2's sectoral scope, but Member States retain latitude in how far down the administrative hierarchy the Directive is transposed. This is precisely where the transposition patchwork bites hardest.", "obligations": ["nis2:art-21", "nis2:art-23"], "authority": ["nca-*"], "dates": ["tl-nis2-2024-10-17-transposition"], "exemptions": [], "depends_on": ["How the Member State has transposed the public administration sector.", "Whether national security functions are carved out."], "claims": ["clm-nis2-transposition-failure"], "sources": ["src-eurlex-nis2"], "last_verified": "2026-08-27" }, { "id": "ap-dora-01", "instrument": "dora", "conditions": { "actor": ["actor:financial-entity"] }, "outcome": "outcome:applies", "rationale": "DORA has applied since 17 January 2025 as a Regulation, with no transposition patchwork. It governs ICT risk management, incident reporting, digital operational resilience testing and third-party risk arrangements for financial entities.", "obligations": ["dora:art-5", "dora:art-6", "dora:art-17", "dora:art-19", "dora:art-24", "dora:art-28"], "authority": ["esas", "nca-*"], "dates": ["tl-dora-2025-01-17-application"], "exemptions": [], "depends_on": ["Which category of financial entity, which determines the proportionality of the requirements."], "claims": ["clm-directives-underperform"], "sources": ["src-eurlex-dora"], "last_verified": "2026-09-27", "requires_verification": false, "verification_note": "Obligations point at DORA Arts 5, 6, 17, 19, 24 and 28, added on 27 Sep 2026 from the Official Journal text (CELEX 32022R2554); application from 17 January 2025 per Art. 64. Earlier: No provisions are recorded for DORA in instruments.json, so this rule cannot yet point at specific articles. The obligation list is empty rather than invented." }, { "id": "ap-dora-02", "instrument": "dora", "conditions": { "actor": ["actor:cloud-provider", "actor:ict-third-party-provider"], "activity": ["activity:cloud-services", "activity:financial-services-ict"] }, "outcome": "outcome:possible", "rationale": "An ICT provider serving financial entities is reached through the contractual requirements DORA imposes on its customers, and — if designated critical — directly through the ESA oversight framework.", "obligations": ["dora:art-28", "dora:art-31"], "authority": ["esas"], "dates": ["tl-dora-2025-01-17-application"], "exemptions": [], "depends_on": ["Whether the provider is designated a critical ICT third-party service provider.", "Whether it serves financial entities at all."], "claims": [], "sources": ["src-eurlex-dora"], "last_verified": "2026-09-27", "requires_verification": false, "verification_note": "The oversight allocation is now established: under DORA Art. 31(1) the ESAs designate critical ICT third-party service providers through the Joint Committee and appoint as Lead Overseer the ESA responsible for the financial entities holding the largest share of total assets among the provider's users (Official Journal, CELEX 32022R2554, read 27 Sep 2026). Earlier: The allocation of the DORA oversight framework between the three ESAs is not established from a primary source in this build." }, { "id": "ap-cra-01", "instrument": "cra", "conditions": { "actor": ["actor:manufacturer", "actor:pde-manufacturer", "actor:connected-product-provider"], "activity": ["activity:connected-products", "activity:product-with-digital-elements"] }, "outcome": "outcome:likely", "rationale": "The Cyber Resilience Act sets horizontal cybersecurity requirements for products with digital elements across their lifecycle. Reporting of actively exploited vulnerabilities and serious incidents begins on 11 September 2026; full application follows on 11 December 2027.", "obligations": ["cra:art-13", "cra:art-14"], "authority": ["nca-*", "enisa"], "dates": ["tl-cra-2026-09-11-reporting-deadline", "tl-cra-2027-12-11-application"], "exemptions": [], "depends_on": ["Whether the product is a product with digital elements within the Regulation's definition."], "claims": [], "sources": ["src-eurlex-cra"], "last_verified": "2026-09-27", "requires_verification": false, "verification_note": "Obligations point at CRA Arts 13 and 14, added on 27 Sep 2026 from the Official Journal text (CELEX 32024R2847); dates per Art. 71(2). Earlier: No provisions are recorded for the CRA in instruments.json, so this rule cannot yet point at specific articles." }, { "id": "ap-pld-01", "instrument": "pld", "conditions": { "actor": ["actor:manufacturer", "actor:ai-provider", "actor:connected-product-provider"], "activity": ["activity:connected-products", "activity:ai-deployment", "activity:ai-development", "activity:product-with-digital-elements"] }, "outcome": "outcome:likely", "rationale": "The revised Product Liability Directive brings software and AI within strict product liability for products placed on the market or put into service after 9 December 2026. This is civil liability before national courts, not an administrative penalty regime — and the proposed AI Liability Directive, which would have covered the fault-based route, was abandoned.", "obligations": [], "authority": ["member-states"], "dates": ["tl-pld-2026-12-09-application"], "exemptions": [], "depends_on": ["National transposition, and the law of the Member State in which a claim is brought."], "claims": ["clm-pld-covers-software", "clm-aild-abandoned"], "sources": ["src-eurlex-pld"], "last_verified": "2026-08-27" }, { "id": "ap-eidas2-01", "instrument": "eidas2", "conditions": { "activity": ["activity:digital-identity"] }, "outcome": "outcome:possible", "rationale": "Under the European Digital Identity framework (Regulation (EU) No 910/2014 as amended by Regulation (EU) 2024/1183), each Member State must provide at least one European Digital Identity Wallet within 24 months of the entry into force of the implementing acts under Arts 5a(23) and 5c(6), which entered into force on 24 December 2024. This dataset maps the framework as adjacent: the brief does not analyse it, and the rule covers the wallet obligation only.", "obligations": ["eidas2:art-5a"], "authority": ["member-states"], "dates": [], "exemptions": [], "depends_on": ["Whether the organisation provides or relies on a European Digital Identity Wallet — the obligations on relying parties and trust service providers are not mapped here."], "claims": ["clm-eidas2-wallets"], "sources": ["src-eurlex-eidas2", "src-eurlex-eudi-2024-2981"], "last_verified": "2026-09-27", "requires_verification": false, "verification_note": "Rebuilt on 27 Sep 2026 from the Official Journal texts of Regulation (EU) 2024/1183 (Art. 5a(1) as inserted) and Implementing Regulation (EU) 2024/2981; it replaces a placeholder that stated its own emptiness. Its scope is deliberately narrow: only the Member States' wallet obligation is mapped." }, { "id": "ap-cross-01", "instrument": "gdpr", "conditions": { "actor": ["actor:vlop", "actor:online-platform"], "activity": ["activity:recommender-systems", "activity:online-platform-activity"] }, "outcome": "outcome:applies", "rationale": "The DSA and the GDPR both reach the same conduct here and pull in different directions: the DSA requires transparency about recommender parameters and an advertisement repository, while the GDPR requires minimisation. EDPB guidance mediates the conflict without dissolving it. Compliance with one is not compliance with the other.", "obligations": ["gdpr:art-5", "gdpr:art-6", "gdpr:art-25"], "authority": ["dpa-*", "ec"], "dates": ["tl-gdpr-2018-05-25-application"], "exemptions": [], "depends_on": [], "claims": ["clm-dsa-gdpr-unresolved"], "sources": ["src-eurlex-gdpr", "src-edpb-guidelines-3-2025"], "last_verified": "2026-08-27" } ] }