{ "$schema_version": "1.0.0", "$description": "Consequential statements drawn from the brief, typed and traced to sources. No new claims were written: every record below corresponds to a statement already present in the prose.", "$last_verified": "2026-08-28", "$note": "The 'supports' qualifier on each source reference is the load-bearing field. 'direct' means the source states the proposition; 'partial' means it establishes part of it, a narrower case, or the components from which it is computed; 'context' means it informs the claim without establishing it and is NOT a citation. A claim whose only sources are src-brief-original is by definition unverified, and verification_note says so. AUDIT-2026-09-25 (2026-09-26): records re-read individually against their sources carry that date in their own last_verified; this file's $last_verified is deliberately unchanged, because the file as a whole was not re-read, and moving it would assert that it was.", "claims": [ { "id": "clm-art-114-shapes-everything", "type": "claim-type:interpretation", "statement": "Almost the entire EU digital rulebook rests on Article 114 TFEU (internal-market harmonisation) rather than on a speech, safety or morality competence, and that choice shapes each instrument's form.", "instruments": [ "tfeu", "gdpr", "dsa", "dma", "ai-act", "data-act" ], "provisions": [], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-brief-original", "supports": "supports:direct", "locator": "Part I" } ], "legal_basis": [ "tfeu:art-114" ], "brief_part": "part-1", "published": "2026-08-19", "last_verified": "2026-09-27", "verification_note": "Checked on 27 Sep 2026 against the citations of the instruments in the Official Journal texts (Publications Office's Cellar): the DSA, DMA, Data Act, NIS2, CER Directive, DORA and CRA each cite 'Article 114' alone; the AI Act cites 'Articles 16 and 114'; the GDPR cites 'Article 16' only. 'Almost the entire' therefore holds, with the GDPR as the principal exception — now said in the brief and recorded as its own claim (clm-gdpr-legal-basis-art-16). That the choice shapes each instrument's form is the author's reading, so the claim stays an interpretation." }, { "id": "clm-gdpr-legal-basis-art-16", "type": "claim-type:law", "statement": "The GDPR rests on Article 16 TFEU, the Union's data-protection competence, not on Article 114.", "instruments": [ "gdpr", "tfeu" ], "provisions": [], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-eurlex-gdpr", "supports": "supports:direct", "locator": "Citation: 'Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof'" } ], "legal_basis": [], "brief_part": "part-1", "published": "2016-05-04", "last_verified": "2026-09-27", "verification_note": "Registered on 27 Sep 2026 for the clause added to Part I that day, read in the Official Journal text of Regulation (EU) 2016/679 (CELEX 32016R0679, via the Publications Office's Cellar). No tfeu:art-16 provision is modelled in data/instruments.json, so no legal_basis link is recorded." }, { "id": "clm-gdpr-template-replicated", "type": "claim-type:interpretation", "statement": "The instruments following the GDPR reproduce the same institutional shape — a specialised vocabulary, principles, case-specific rights and a supervisory apparatus — a pattern described as act-ification and GDPR mimesis.", "instruments": [ "gdpr", "dsa", "dma", "ai-act", "dga" ], "provisions": [], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-papakonstantinou-dehert", "supports": "supports:direct", "locator": "Abstract: \"three basic phenomena common to all, or most, EU new technology-relevant regulatory initiatives, namely (a) act-ification, (b) GDPR mimesis, and (c) regulatory brutality\"" } ], "legal_basis": [], "brief_part": "part-1", "published": null, "last_verified": "2026-09-27", "verification_note": "The publication is identified and open: Papakonstantinou and De Hert, 'The Regulation of Digital Technologies in the EU: the law-making phenomena of act-ification, GDPR mimesis and EU law brutality', Technology and Regulation, published 21 May 2022 (techreg.org, read 2026-09-26). Its abstract names act-ification and GDPR mimesis among three phenomena common to most EU technology regulation. The four-element description in the statement (vocabulary, principles, case-specific rights, supervisory apparatus) was not checked against the full text, which was not opened. Locators added 27 Sep 2026: each source was re-read that day and the locator quotes the sentence that carries the claim." }, { "id": "clm-dsa-supervision-fte-2025", "type": "claim-type:fact", "statement": "The Commission costed its DSA supervisory tasks in 2025 at about 138 full-time equivalents, a measure of time worked on fee-funded tasks rather than a count of all its DSA staff.", "instruments": [ "dsa" ], "provisions": [], "institutions": [ "ec" ], "enforcement": [], "legal_basis": [], "sources": [ { "source_id": "src-ec-dsa-costs-2025", "supports": "supports:direct", "locator": "Para. (14): 'approximately 138 FTEs … dedicated to tasks referred to in Article 43(2) DSA'; footnote to section 2.1: not 'the total number of Commission staff members working on DSA activities in 2025'" } ], "brief_part": "part-1", "published": "2026-03-31", "last_verified": "2026-10-22", "verification_note": "Registered 22 Oct 2026 (audit, facts hidden in interpretation: clm-capacity-ambition-gap's 'a few hundred staff'). 'A few hundred' had no source; the Commission's own cost report gives about 138 FTEs for 2025 on Art. 43(2) tasks and says that is not its total DSA headcount, so the brief now cites that figure with that qualification instead of an unsourced headcount." }, { "id": "clm-capacity-ambition-gap", "type": "claim-type:critique", "statement": "The recurring objection across every instrument is a capacity-ambition gap: broad obligations assigned either to a single Commission directorate with a few hundred staff or to twenty-seven national authorities of radically unequal resource.", "instruments": [ "dsa", "dma", "gdpr", "ai-act" ], "provisions": [], "institutions": [ "ec", "dpa-*", "dsc-*" ], "enforcement": [], "sources": [ { "source_id": "src-bruegel-2026-enforcement-authority", "supports": "supports:partial", "locator": null }, { "source_id": "src-brief-original", "supports": "supports:direct", "locator": "Part I, Part IX" } ], "legal_basis": [], "brief_part": "part-1", "published": "2026-03-05", "last_verified": "2026-08-27", "verification_note": "The Bruegel brief argues for an independent EU enforcement authority and supports the institutional half of the argument. The specific staffing figures are not verified. 22 Oct 2026 (audit, facts hidden in interpretation): 'a few hundred staff' replaced in the prose, in all four languages, by the Commission's own figure (clm-dsa-supervision-fte-2025: about 138 FTEs on DSA supervisory tasks in 2025, not the total headcount); the critique itself remains the author's.", "premises": [ "clm-dpc-staff-growth", "clm-iccl-ireland-bottleneck", "clm-dsa-commission-vlop-only" ] }, { "id": "clm-also-in-the-rulebook", "type": "claim-type:fact", "statement": "On 20 January 2026 the Commission proposed a cybersecurity package comprising a revised Cybersecurity Act and amendments to the NIS2 Directive; these are proposals, not law.", "instruments": [ "eidas2", "nis2" ], "provisions": [], "institutions": [ "ec" ], "enforcement": [], "sources": [ { "source_id": "src-ec-cyber-package-qa-2026", "supports": "supports:direct", "locator": "opening line: \"On 20 January 2026, the Commission has proposed a new cybersecurity package ... including amendments to the NIS2 Directive\"; Q1: \"the Commission has proposed to revise the Cybersecurity Act\"" } ], "legal_basis": [], "brief_part": "part-1", "published": null, "last_verified": "2026-09-27", "verification_note": "Atomization completed 27 Sep 2026. This record used to carry the whole 'Also in the rulebook' box as one conjunction of six propositions, each partly supported by a Commission page. Five of them now have their own claims on the same passage, each read in the Official Journal: clm-emfa-dates, clm-political-ads-dates, clm-platform-work-transposition, clm-ehds-dates, clm-eidas2-wallets. The one left is the cyber package, which this record now carries alone, re-read that day on the Commission's Q&A. 'Targeted' in the prose is the brief's characterisation of the NIS2 amendments; the Commission's text says 'amendments'. The COM numbers are not on the Q&A page and are not recorded. Earlier statement: Beyond the six regimes the brief covers, the rulebook includes the European Media Freedom Act (Regulation (EU) 2024/1083, mostly applicable from 8 August 2025), the political advertising regulation (Regulation (EU) 2024/900, fully applicable from 10 October 2025), the Platform Work Directive (Directive (EU) 2024/2831, to be transposed by December 2026), the European Health Data Space (Regulation (EU) 2025/327, in force since 25 March 2025), eIDAS2 (Regulation (EU) 2024/1183, wallets by the end of 2026), and the Commission's 20 January 2026 proposals for a revised Cybersecurity Act and targeted NIS2 amendments." }, { "id": "clm-emfa-dates", "type": "claim-type:law", "statement": "The European Media Freedom Act, Regulation (EU) 2024/1083, entered into force on 7 May 2024 and applies from 8 August 2025, with some provisions applying earlier and Article 20 from 8 May 2027.", "instruments": [], "provisions": [], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-eurlex-emfa", "supports": "supports:direct", "locator": "Art. 29; OJ L 2024/1083 of 17.4.2024" } ], "legal_basis": [], "brief_part": "part-1", "published": "2024-04-17", "last_verified": "2026-09-27", "verification_note": "Registered on 27 Sep 2026 for a row of the 'also in the rulebook' box in Part I and read that day in the Official Journal text (Publications Office's Cellar). The instrument is not modelled in data/instruments.json. Entry into force is the twentieth day after publication on 17 April 2024." }, { "id": "clm-political-ads-dates", "type": "claim-type:law", "statement": "The regulation on the transparency and targeting of political advertising, Regulation (EU) 2024/900, applies from 10 October 2025; its Articles 3 and 5(1) applied from its entry into force.", "instruments": [], "provisions": [], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-eurlex-ttpa", "supports": "supports:direct", "locator": "Art. 30(2)" } ], "legal_basis": [], "brief_part": "part-1", "published": "2024-03-20", "last_verified": "2026-09-27", "verification_note": "Registered on 27 Sep 2026 for a row of the 'also in the rulebook' box in Part I and read that day in the Official Journal text (Publications Office's Cellar). The instrument is not modelled in data/instruments.json." }, { "id": "clm-platform-work-transposition", "type": "claim-type:law", "statement": "Member States must transpose the Platform Work Directive, Directive (EU) 2024/2831, by 2 December 2026.", "instruments": [], "provisions": [], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-eurlex-platform-work", "supports": "supports:direct", "locator": "Art. 29(1)" } ], "legal_basis": [], "brief_part": "part-1", "published": "2024-11-11", "last_verified": "2026-09-27", "verification_note": "Registered on 27 Sep 2026 for a row of the 'also in the rulebook' box in Part I and read that day in the Official Journal text (Publications Office's Cellar). The instrument is not modelled in data/instruments.json." }, { "id": "clm-ehds-dates", "type": "claim-type:law", "statement": "The European Health Data Space Regulation, Regulation (EU) 2025/327, entered into force on 25 March 2025 and applies from 26 March 2027, with provisions on priority categories of health data and EHR systems phased in from 2029 and 2031.", "instruments": [], "provisions": [], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-eurlex-ehds", "supports": "supports:direct", "locator": "Art. 105; OJ L 2025/327 of 5.3.2025" } ], "legal_basis": [], "brief_part": "part-1", "published": "2025-03-05", "last_verified": "2026-09-27", "verification_note": "Registered on 27 Sep 2026 for a row of the 'also in the rulebook' box in Part I and read that day in the Official Journal text (Publications Office's Cellar). The instrument is not modelled in data/instruments.json. Published on 5 March 2025; the Publications Office's metadata records entry into force on 25 March 2025. The Commission's EHDS page says 26 March 2025; the site follows the Official Journal." }, { "id": "clm-eidas2-wallets", "type": "claim-type:law", "statement": "Under eIDAS2 each Member State must provide at least one European Digital Identity Wallet within 24 months of the entry into force of the implementing acts under Articles 5a(23) and 5c(6) of Regulation (EU) No 910/2014; those acts entered into force on 24 December 2024, which puts the deadline at 24 December 2026.", "instruments": [ "eidas2" ], "provisions": [], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-eurlex-eidas2", "supports": "supports:direct", "locator": "Art. 1, inserting Art. 5a(1) into Regulation (EU) No 910/2014" }, { "source_id": "src-eurlex-eudi-2024-2981", "supports": "supports:partial", "locator": "Citation ('in particular Article 5c(6) thereof'); entry into force 24 December 2024 (Publications Office metadata)" }, { "source_id": "src-eurlex-eudi-2024-2977", "supports": "supports:partial", "locator": "Citation ('in particular Article 5a(23) thereof'); OJ L, 2024/2977, 4.12.2024; final article: entry into force on the twentieth day following publication" } ], "legal_basis": [], "brief_part": "part-1", "published": "2024-04-30", "last_verified": "2026-10-14", "verification_note": "Registered on 27 Sep 2026 for a row of the 'also in the rulebook' box in Part I and read that day in the Official Journal text (Publications Office's Cellar). The implementing acts are Commission Implementing Regulations (EU) 2024/2977, 2024/2979, 2024/2980, 2024/2981 (adopted under Art. 5c(6)) and 2024/2982, all of 28 November 2024; the Publications Office's metadata records each entering into force on 24 December 2024. The 24 December 2026 date is the site's arithmetic on those two texts. 14 Oct 2026: re-read Art. 5a(1) on EUR-Lex and the entry-into-force clauses of Implementing Regulations (EU) 2024/2977 (under Art. 5a(23)) and 2024/2981 (under Art. 5c(6)) in the Official Journal: both published 4 December 2024, in force on the twentieth day, 24 December 2024. The 24-month arithmetic stands. No EU-level penalty for missing this date is stated in the provision, and none is claimed." }, { "id": "clm-eidas2-private-acceptance", "type": "claim-type:law", "statement": "From 24 December 2027, private relying parties that Union or national law or a contract requires to use strong user authentication for online identification must also accept European Digital Identity Wallets, but only at the user's voluntary request; microenterprises and small enterprises are excluded.", "instruments": [ "eidas2" ], "provisions": [ "eidas2:art-5f" ], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-eurlex-eidas2", "supports": "supports:direct", "locator": "Art. 1, inserting Art. 5f(2) into Regulation (EU) No 910/2014: 'with the exception of microenterprises and small enterprises'; 'no later than 36 months from the date of entry into force of the implementing acts referred to in Article 5a(23) and Article 5c(6) and only upon the voluntary request of the user'" }, { "source_id": "src-eurlex-eudi-2024-2977", "supports": "supports:partial", "locator": "OJ L, 2024/2977, 4.12.2024; entry into force on the twentieth day following publication (24 December 2024)" } ], "legal_basis": [], "brief_part": "part-1", "published": "2024-04-30", "last_verified": "2026-10-14", "verification_note": "Registered 14 Oct 2026 and read that day in the Official Journal text on EUR-Lex. The date is the site's arithmetic: 36 months from 24 December 2024, the entry into force of the implementing acts (clm-eidas2-wallets). It is not a duty on every business: it reaches only relying parties that must already use strong user authentication, it excludes micro and small enterprises as defined in Recommendation 2003/361/EC, and it applies only when the user asks. The provision lists transport, energy, banking, financial services, social security, health, drinking water, postal services, digital infrastructure, education and telecommunications as examples ('including'), not as a closed list. Very large online platforms are covered separately by Art. 5f(3)." }, { "id": "clm-gdpr-art-3-2-reach", "type": "claim-type:law", "statement": "The GDPR applies to controllers and processors not established in the Union when they process personal data of data subjects who are in the Union in connection with offering them goods or services or monitoring their behaviour there.", "instruments": [ "gdpr" ], "provisions": [ "gdpr:art-3" ], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-eurlex-gdpr", "supports": "supports:direct", "locator": "Art. 3(2)(a)–(b)" } ], "legal_basis": [ "gdpr:art-3" ], "brief_part": "part-1", "published": null, "last_verified": "2026-09-27", "verification_note": "Registered on 27 Sep 2026 for a statement already in the prose that no claim recorded. Checked that day against the Official Journal text (English, retrieved from the Publications Office's Cellar, CELEX 32016R0679): Article 3(2), points (a) and (b). The prose used to say the GDPR reaches \"any processing of EU residents' data\"; Article 3(2) turns on data subjects being in the Union, not on residence, and on targeting or monitoring. The prose was corrected to the Article on the same day." }, { "id": "clm-ai-act-art-2-1-c-output", "type": "claim-type:law", "statement": "The AI Act applies to providers and deployers of AI systems established or located in a third country where the output produced by the AI system is used in the Union.", "instruments": [ "ai-act" ], "provisions": [ "ai-act:art-2" ], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-eurlex-ai-act", "supports": "supports:direct", "locator": "Art. 2(1)(c)" } ], "legal_basis": [ "ai-act:art-2" ], "brief_part": "part-1", "published": null, "last_verified": "2026-09-27", "verification_note": "Registered on 27 Sep 2026 for a statement already in the prose that no claim recorded. Checked that day against the Official Journal text (English, retrieved from the Publications Office's Cellar, CELEX 32024R1689): Article 2(1)(c), in terms." }, { "id": "clm-data-act-art-1-3-f-cloud", "type": "claim-type:law", "statement": "The Data Act applies to providers of data processing services, irrespective of their place of establishment, that provide such services to customers in the Union.", "instruments": [ "data-act" ], "provisions": [], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-eurlex-data-act", "supports": "supports:direct", "locator": "Art. 1(3)(f)" } ], "legal_basis": [], "brief_part": "part-1", "published": null, "last_verified": "2026-09-27", "verification_note": "Registered on 27 Sep 2026 for a statement already in the prose that no claim recorded. Checked that day against the Official Journal text (English, retrieved from the Publications Office's Cellar, CELEX 32023R2854): Article 1(3)(f), in terms. The prose's \"non-EEA SaaS providers with EU customers\" is an instance of it." }, { "id": "clm-vagueness-is-delegation", "type": "claim-type:interpretation", "statement": "The operative standards of the EU digital rulebook — systemic risk, high-impact capabilities, effective interoperability, genuinely equivalent alternative — are almost all open-textured, so the law's effective content is set by Commission guidelines, delegated acts, codes of practice and harmonised standards rather than by the legislature.", "instruments": [ "dsa", "dma", "ai-act" ], "provisions": [], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-brief-original", "supports": "supports:direct", "locator": "Part IX" } ], "legal_basis": [], "brief_part": "part-9", "published": "2026-08-19", "last_verified": "2026-10-22", "verification_note": "Added on 2026-09-26 (audit T-35) so that the Part IX takeaway is a tracked record rather than untracked prose. It is the author's synthesis across the brief, not a statement any single source makes; it rests on the brief alone and is counted as unverified for that reason. Related, instrument-level: clm-art-34-open-concept. 22 Oct 2026 (audit, outdated interpretive claims): re-read against Parts I, III, IV and V as they stand: still consistent; the Google specification decisions under DMA Art. 6(7) and 6(11) (Part IV, July 2026) and the standards-driven AI Act delay (Part V) are current instances of the content being set below the legislature. It still rests on the brief alone, and that is unchanged: re-reading a synthesis against the Parts it synthesises dates the check; it does not source it." }, { "id": "clm-overlap-one-control-set", "type": "claim-type:interpretation", "statement": "A single recommender system can engage the GDPR, the DSA, the AI Act and, for a gatekeeper, the DMA at once, so the rational compliance strategy is one control set mapped to several regimes.", "instruments": [ "gdpr", "dsa", "ai-act", "dma" ], "provisions": [], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-brief-original", "supports": "supports:direct", "locator": "Part IX" } ], "legal_basis": [], "brief_part": "part-9", "published": "2026-08-19", "last_verified": "2026-10-22", "verification_note": "Added on 2026-09-26 (audit T-35) so that the Part IX takeaway is a tracked record rather than untracked prose. It is the author's synthesis across the brief, not a statement any single source makes; it rests on the brief alone and is counted as unverified for that reason. The article-level overlap is partly covered by clm-three-impact-assessments; the article lists in the prose have not been checked one by one. 22 Oct 2026 (audit, outdated interpretive claims): re-read against Parts II–V as they stand: none of the articles it lists was changed by the edits of 21 Oct 2026; still consistent. It still rests on the brief alone, and that is unchanged: re-reading a synthesis against the Parts it synthesises dates the check; it does not source it." }, { "id": "clm-rulebook-foreign-policy", "type": "claim-type:interpretation", "statement": "Because every designated gatekeeper undertaking and nearly every VLOP is non-European, the rulebook is a foreign-policy object: this shapes the timing of decisions, the choice between fines and commitments, and the political viability of expanding scope.", "instruments": [ "dma", "dsa" ], "provisions": [], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-brief-original", "supports": "supports:direct", "locator": "Part IX" } ], "legal_basis": [], "brief_part": "part-9", "published": "2026-08-19", "last_verified": "2026-10-22", "verification_note": "Added on 2026-09-26 (audit T-35) so that the Part IX takeaway is a tracked record rather than untracked prose. It is the author's synthesis across the brief, not a statement any single source makes; it rests on the brief alone and is counted as unverified for that reason. The gatekeeper half is the sourced fact clm-dma-asymmetry; 'nearly every VLOP' is not separately sourced. 22 Oct 2026 (audit, outdated interpretive claims): re-read against Parts III and IV as they stand: still consistent; Part IV states every designated gatekeeper undertaking is US- or Chinese-headquartered (Booking Holdings is US-based), and the VLOPs added since (enforcement and designations in Part III) do not change the \"nearly every\" half. It still rests on the brief alone, and that is unchanged: re-reading a synthesis against the Parts it synthesises dates the check; it does not source it.", "premises": [ "clm-dma-asymmetry", "clm-seven-gatekeepers" ] }, { "id": "clm-consolidation-contested", "type": "claim-type:interpretation", "statement": "2016-2024 was the accumulation phase of EU digital regulation and 2025-2027 is a consolidation phase, but consolidation is contested from within: simplification and expansion are happening in the same instruments.", "instruments": [ "gdpr", "ai-act" ], "provisions": [], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-brief-original", "supports": "supports:direct", "locator": "Part IX" } ], "legal_basis": [], "brief_part": "part-9", "published": "2026-08-19", "last_verified": "2026-10-22", "verification_note": "Added on 2026-09-26 (audit T-35) so that the Part IX takeaway is a tracked record rather than untracked prose. It is the author's synthesis across the brief, not a statement any single source makes; it rests on the brief alone and is counted as unverified for that reason. Its two supporting examples are facts recorded elsewhere and time-sensitive: the Council position on the Digital Omnibus (see the T-02 records) and the AI Omnibus prohibitions (tl-ai-act-2026-12-02-application). 22 Oct 2026 (audit, outdated interpretive claims): re-read against Parts V and VIII as they stand: still consistent; Part VIII now records no Council mandate reported as at 21 Oct 2026, and Part V that the AI Omnibus added the Art. 5(1)(ba)-(bb) prohibitions while deferring the high-risk tier. It still rests on the brief alone, and that is unchanged: re-reading a synthesis against the Parts it synthesises dates the check; it does not source it." }, { "id": "clm-gdpr-gravitational-centre", "type": "claim-type:interpretation", "statement": "The GDPR is the instrument every other one either builds on, carves an exception from, or must be reconciled with.", "instruments": [ "gdpr" ], "provisions": [], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-brief-original", "supports": "supports:direct", "locator": "Part II" } ], "legal_basis": [], "brief_part": "part-2", "published": "2026-08-19", "last_verified": "2026-08-27", "verification_note": "An authorial framing rather than a factual claim. Typed as interpretation for that reason." }, { "id": "clm-gdpr-total-fines", "type": "claim-type:fact", "statement": "DLA Piper's January 2026 survey puts the aggregate GDPR fines reported across the jurisdictions it surveyed, from 25 May 2018 to 10 January 2026, at EUR 7.1 billion.", "instruments": [ "gdpr" ], "provisions": [ "gdpr:art-83" ], "institutions": [ "dpa-*" ], "enforcement": [], "sources": [ { "source_id": "src-dlapiper-gdpr-survey-2026", "supports": "supports:direct", "locator": "\"The aggregate total fines reported since the application of GDPR on 25 May 2018 to 10 January 2026 across all the jurisdictions surveyed now stands at EUR7.1 billion\"" }, { "source_id": "src-cms-enforcement-tracker", "supports": "supports:partial", "locator": null } ], "legal_basis": [ "gdpr:art-83" ], "brief_part": "part-2", "published": null, "last_verified": "2026-10-14", "verification_note": "14 Oct 2026: the statement now names the tracker, its cut-off and what it counts, in DLA Piper's own words, re-read that day. It is a count of fines reported, not of fines upheld on appeal or collected. CMS's Enforcement Tracker measures something different on its own method (clm-cms-fines-total: EUR 7,159,322,834 across 3,275 cases on 27 September 2026; its March 2026 report about EUR 6.11 billion); the two are not added together, averaged or substituted for each other. Earlier statement: 'Cumulative GDPR fines have passed roughly EUR 7.1 billion since 2018.' Earlier note: Resolved 28 Aug 2026 against the DLA Piper survey of January 2026, which is the actual source of the EUR 7.1bn figure — the brief attributed it to the CMS tracker, which records roughly EUR 6.11bn on its own methodology. Both are compilations by law firms from published decisions, not audited totals; Annex B's warning stands and is now demonstrated rather than asserted. 21 Oct 2026 (audit, evidence item clm-gdpr-total-fines): the brief removed from its own sources; DLA Piper's survey carries the statement directly, and its status stays as computed from the remaining references.", "contested": { "note": "The two compilations disagree on the total. DLA Piper's January 2026 survey gives about EUR 7.1bn to 10 January 2026; the CMS Enforcement Tracker Report (March 2026) records roughly EUR 6.11bn in directly documented fines. Both compile published decisions by their own methods; neither is an audited figure (Annex B).", "sources": [ "src-dlapiper-gdpr-survey-2026", "src-cms-enforcement-tracker" ] } }, { "id": "clm-dpc-cumulative-fines", "type": "claim-type:fact", "statement": "The Irish DPC accounts for about EUR 4.04 billion of cumulative GDPR fine value.", "instruments": [ "gdpr" ], "provisions": [ "gdpr:art-56" ], "institutions": [ "dpa-ie" ], "enforcement": [], "sources": [ { "source_id": "src-dlapiper-gdpr-survey-2026", "supports": "supports:direct", "locator": "EUR 4.04bn, Irish Data Protection Commission" }, { "source_id": "src-dpc-fines-page", "supports": "supports:direct", "locator": "\"Total Fines (last updated 10/08/2026) €4,038,832,000\"" }, { "source_id": "src-rte-2026-dpc-4bn", "supports": "supports:partial", "locator": null }, { "source_id": "src-dpc-annual-report-2025", "supports": "supports:context", "locator": null } ], "legal_basis": [], "brief_part": "part-2", "published": "2026-01-21", "last_verified": "2026-09-27", "verification_note": "Split on 27 Sep 2026 out of clm-dpc-share-of-fines, which carried three propositions. The EUR 4.04bn figure was confirmed on 2026-09-26 against DLA Piper (January 2026), which states it; RTÉ reports \"over EUR 4 billion\" owed to the DPC. The DPC Annual Report 2025 reports about EUR 530.77m for 2025 alone and states no cumulative figure. Re-read 27 Sep 2026: the DPC's own Fines page states \"Total Fines (last updated 10/08/2026) €4,038,832,000\", which rounds to the EUR 4.04bn in the statement. The figure now rests on the regulator itself, not only on DLA Piper's compilation; the two measure to different dates (August and January 2026)." }, { "id": "clm-dpc-top-ten-fines", "type": "claim-type:fact", "statement": "Eight of the ten largest GDPR fines still standing were imposed by the Irish DPC; the other two are the Dutch authority's, both on Uber.", "instruments": [ "gdpr" ], "provisions": [ "gdpr:art-56" ], "institutions": [ "dpa-ie" ], "enforcement": [], "sources": [ { "source_id": "src-dpc-fines-page", "supports": "supports:partial", "locator": "Fines table: EUR 1.2bn (Meta, 12/05/2023), 530m (TikTok), 405m (Instagram), 390m (Meta), 345m (TikTok), 310m (LinkedIn), 265m (Meta), 251m (Meta), 225m (WhatsApp) — nine DPC fines of EUR 225m or more" }, { "source_id": "src-ap-uber-2026", "supports": "supports:partial", "locator": "First paragraph: 'imposes a fine of 824,990,000 euros on Uber' (21 August 2026)" }, { "source_id": "src-ap-uber-2024", "supports": "supports:partial", "locator": "First paragraph: 'imposes a fine of 290 million euros on Uber' (26 August 2024)" }, { "source_id": "src-cms-enforcement-tracker-db", "supports": "supports:partial", "locator": "Case list sorted by fine: no other GDPR fine above EUR 251 million (ETid-3232 Uber 824.99m; ETid-2447 Uber 290m)" }, { "source_id": "src-brief-original", "supports": "supports:context", "locator": "Part II" } ], "legal_basis": [], "brief_part": "part-2", "published": null, "last_verified": "2026-09-27", "verification_note": "Corrected on 27 Sep 2026. The two Dutch fines are their own claims (clm-ap-uber-2026, clm-ap-uber-2024). The brief said nine of ten, which was true on its date (19 August 2026) among fines still standing: Luxembourg's EUR 746m on Amazon was annulled on 12 March 2026 (enf-amazon-cnpd-2021), and the only non-DPC fine in the top ten was the Dutch authority's EUR 290m on Uber. On 21 August 2026 the Dutch authority fined Uber EUR 824,990,000 (under appeal), which displaced the DPC's EUR 225m on WhatsApp. Counted from the DPC's own fines table, the two Dutch releases, and CMS's enforcement database for completeness (read that day; 3,275 cases; no other GDPR fine above EUR 251m). The EUR 325m and 150m French decisions of September 2025 are ePrivacy fines and are not counted (clm-cnil-google-2025, clm-cnil-shein-2025). If the annulled Amazon fine were counted, the DPC share would be seven of ten. No single source states the ranking: it is this site's count, so every reference is partial. Split on 27 Sep 2026 out of clm-dpc-share-of-fines.", "reference_gap": true, "gap_note": "no source states the ranking itself; it is counted here from the regulators' own records" }, { "id": "clm-ap-uber-2026", "type": "claim-type:fact", "statement": "On 21 August 2026 the Dutch data protection authority fined Uber EUR 824,990,000 under the GDPR for fully automated deactivation of drivers; Uber has appealed.", "instruments": [ "gdpr" ], "provisions": [], "institutions": [ "dpa-nl" ], "enforcement": [ "enf-uber-ap-2026" ], "sources": [ { "source_id": "src-ap-uber-2026", "supports": "supports:direct", "locator": "First paragraph ('a fine of 824,990,000 euros on Uber'); section 'Amount of the fine for Uber' ('Uber has filed an appeal against the fine')" } ], "legal_basis": [], "brief_part": "part-2", "published": "2026-08-21", "last_verified": "2026-09-27", "verification_note": "Registered on 27 Sep 2026 for the corrected ranking in Part II and read that day in the Dutch authority's English release. Linked to its enforcement record and to the Dutch authority's institution record, both added on 27 Sep 2026 at the author's instruction." }, { "id": "clm-ap-uber-2024", "type": "claim-type:fact", "statement": "In August 2024 the Dutch data protection authority fined Uber EUR 290 million under the GDPR for transferring European drivers' data to the US without appropriate safeguards.", "instruments": [ "gdpr" ], "provisions": [], "institutions": [ "dpa-nl" ], "enforcement": [ "enf-uber-ap-2024" ], "sources": [ { "source_id": "src-ap-uber-2024", "supports": "supports:direct", "locator": "First paragraph ('a fine of 290 million euros on Uber'), 26 August 2024" } ], "legal_basis": [], "brief_part": "part-2", "published": "2024-08-26", "last_verified": "2026-09-27", "verification_note": "Registered on 27 Sep 2026 for the corrected ranking in Part II and read that day in the Dutch authority's English release. Linked to its enforcement record and to the Dutch authority's institution record, both added on 27 Sep 2026 at the author's instruction." }, { "id": "clm-one-stop-shop", "type": "claim-type:law", "statement": "GDPR Article 56 gives the supervisory authority of the controller's main establishment the lead role in cross-border cases, with Article 60 cooperation and Article 65 EDPB dispute resolution behind it.", "instruments": [ "gdpr" ], "provisions": [ "gdpr:art-56", "gdpr:art-60", "gdpr:art-65" ], "institutions": [ "dpa-*", "edpb" ], "enforcement": [ "enf-openai-garante-2024" ], "sources": [ { "source_id": "src-eurlex-gdpr", "supports": "supports:direct", "locator": "Arts. 56, 60, 65" } ], "legal_basis": [ "gdpr:art-56" ], "brief_part": "part-2", "published": "2016-05-04", "last_verified": "2026-08-27", "verification_note": null }, { "id": "clm-gdpr-procedural-regulation", "type": "claim-type:law", "statement": "Regulation (EU) 2025/2518, which harmonises the admissibility of complaints, the parties' procedural rights and the time limits for draft decisions in cross-border GDPR cases, entered into force on 1 January 2026 and applies from 2 April 2027, its investigation rules to complaints lodged after that date.", "instruments": [ "gdpr-procedural", "gdpr" ], "provisions": [], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-eurlex-gdpr-procedural", "supports": "supports:direct", "locator": "Art. 4(1) (admissibility), Arts 19, 22 and 24 (right to be heard, administrative file), Art. 12(1) and (6) (draft decision within 15 months, 12 under the simple cooperation procedure), Art. 36 (transitional provisions), Art. 37 (entry into force and application)" }, { "source_id": "src-eucrim-gdpr-procedural-2026", "supports": "supports:direct", "locator": "\"Regulation 2025/2518 entered into force on 1 January 2026 and it will apply from 2 April 2027\"" } ], "legal_basis": [], "brief_part": "part-2", "published": "2026-01-16", "last_verified": "2026-09-27", "verification_note": "Read against the Official Journal text on 27 Sep 2026 (OJ L 2025/2518 of 12.12.2025, via the Publications Office's Cellar). Art. 37: entry into force on the twentieth day following publication (1 January 2026) and application from 2 April 2027. Art. 36: Chapters III and IV apply to ex officio investigations opened, and complaint-based investigations whose complaint was lodged, after 2 April 2027. Corrected that day: the statement said the regulation 'applies to complaints lodged from 2 April 2027' and called the time limits 'investigation deadlines'; Art. 12 sets them for the lead authority's draft decision (15 months, extendable once by up to 12; 12 months under the simple cooperation procedure). Retyped from fact to law: the statement is what the instrument provides. Earlier confirmed against eucrim (Max Planck Institute), which reports the same dates." }, { "id": "clm-dpc-share-of-fines", "type": "claim-type:derived", "statement": "The Irish DPC's share of cumulative GDPR fine value is roughly 57%.", "instruments": [ "gdpr" ], "provisions": [ "gdpr:art-56" ], "institutions": [ "dpa-ie" ], "enforcement": [], "sources": [ { "source_id": "src-dlapiper-gdpr-survey-2026", "supports": "supports:partial", "locator": "EUR 4.04bn, Irish Data Protection Commission; aggregate total to 10 January 2026" } ], "legal_basis": [], "brief_part": "part-2", "published": "2026-01-12", "last_verified": "2026-09-26", "verification_note": "Retyped from fact to derived on 27 Sep 2026, when the three propositions this claim used to carry were split: the EUR 4.04bn is now clm-dpc-cumulative-fines and the nine-of-ten ranking clm-dpc-top-ten-fines. No source states the 57% share; it is this site's arithmetic, 4.04 / 7.1 = 0.569, and the derivation above records it so it can be re-run. The CMS tracker's lower total (clm-gdpr-total-fines) would give a larger share: the figure is only as good as the denominator. Earlier note: The EUR 4.04bn figure is confirmed against DLA Piper (January 2026); the DPC's own Annual Report 2025 confirms the Commission is a genuine three-Commissioner structure and reports roughly EUR 530.77m in fines for 2025 alone, which is consistent with continued growth of the cumulative total but does not itself state EUR 4.04bn or a share percentage. The derived 57% share and the \"nine of the ten largest fines\" ranking are NOT stated by any of these sources and remain the brief's own arithmetic against a total from the DLA Piper compilation.", "derivation": { "performed_by": "site", "method": "The DPC's cumulative fine value divided by the cumulative total of GDPR fines. Both figures come from the same edition of the DLA Piper survey, so the numerator and denominator share one methodology and one cut-off date.", "inputs": { "a": { "claim": "clm-dpc-cumulative-fines", "value": 4040000000, "as_stated": "EUR 4.04 billion" }, "b": { "claim": "clm-gdpr-total-fines", "value": 7100000000, "as_stated": "EUR 7.1 billion" } }, "formula": "a / b", "result": 0.569, "unit": "ratio", "rounding": { "to": 0.01, "stated_value": 0.57 } } }, { "id": "clm-dpc-collected", "type": "claim-type:fact", "statement": "Of more than EUR 4 billion levied through DPC inquiries, only on the order of EUR 20 million has been collected, because fines generally do not become payable until confirmed by a court.", "instruments": [ "gdpr" ], "provisions": [ "gdpr:art-83" ], "institutions": [ "dpa-ie" ], "enforcement": [], "sources": [ { "source_id": "src-dpc-fines-page", "supports": "supports:direct", "locator": "\"over €4 billion in fines have been levied … To date, approximately €20 million in fines has been collected\"; \"Collection of Fines\": fines \"do not become payable until they are confirmed in Court\"" }, { "source_id": "src-thestory-2026-fines-limbo", "supports": "supports:direct", "locator": "\"€4.02 billion of it remains uncollected and just €20 million has been paid in fines so far\"" }, { "source_id": "src-rte-2026-dpc-4bn", "supports": "supports:direct", "locator": "\"€4.02 billion of it remains uncollected and just €20m has been paid in fines so far\"" } ], "legal_basis": [ "gdpr:art-83" ], "brief_part": "part-2", "published": "2026-01-12", "last_verified": "2026-09-27", "verification_note": "Verified during the Step 1 audit. This is the DPC's own published position, corroborated by two independent reports. Locators added 27 Sep 2026: each source was re-read that day and the locator quotes the sentence that carries the claim. The DPC page also gives the reason in the statement: fines are not payable until confirmed in Court." }, { "id": "clm-dpc-collected-share", "type": "claim-type:derived", "statement": "What the DPC has collected is roughly half a percent of what it has levied.", "instruments": [ "gdpr" ], "provisions": [ "gdpr:art-83" ], "institutions": [ "dpa-ie" ], "enforcement": [], "sources": [ { "source_id": "src-dpc-fines-page", "supports": "supports:partial", "locator": null } ], "legal_basis": [], "brief_part": "part-2", "published": null, "last_verified": "2026-09-27", "verification_note": "Registered on 27 Sep 2026 for the sentence under the \"number nobody quotes\" box, which states a ratio no source states. It is this site's arithmetic on the two figures in clm-dpc-collected: EUR 20 million over EUR 4 billion is 0.005. Both inputs are orders of magnitude (\"on the order of\", \"more than\"), so the ratio is too.", "derivation": { "performed_by": "site", "method": "Collected divided by levied, both as the DPC states them.", "inputs": { "a": { "claim": "clm-dpc-collected", "value": 20000000, "as_stated": "EUR 20 million" }, "b": { "claim": "clm-dpc-collected", "value": 4000000000, "as_stated": "EUR 4 billion" } }, "formula": "a / b", "result": 0.005, "unit": "ratio", "rounding": { "to": 0.001, "stated_value": 0.005 } } }, { "id": "clm-announced-vs-collected", "type": "claim-type:interpretation", "statement": "Announced enforcement and delivered enforcement are different quantities: headline GDPR fine totals overstate what has been finally imposed and collected.", "instruments": [ "gdpr" ], "provisions": [ "gdpr:art-83" ], "institutions": [ "dpa-*" ], "enforcement": [ "enf-amazon-cnpd-2021", "enf-openai-garante-2024" ], "sources": [ { "source_id": "src-brief-original", "supports": "supports:direct", "locator": "Part II, Part IX" } ], "legal_basis": [], "brief_part": "part-2", "published": "2026-08-19", "last_verified": "2026-09-26", "verification_note": "The author's reading, and typed as one. On 27 Sep 2026 the Alliance Risk figure it used to carry was split into clm-alliance-risk-contested-share, which keeps the reference gap; this claim now carries only the inference, and names the four registered claims it is drawn from.", "premises": [ "clm-alliance-risk-contested-share", "clm-dpc-collected", "clm-amazon-annulment", "clm-openai-fine-voided" ] }, { "id": "clm-alliance-risk-contested-share", "type": "claim-type:attributed", "statement": "An analysis by the insurance brokerage Alliance Risk, drawing mainly on the CMS Enforcement Tracker, found that roughly 40% of the about EUR 7.1 billion in GDPR fines it counted as announced — about EUR 2.8 billion — is either annulled or actively contested in court.", "attributed_to": "Alliance Risk, as reported by CSO Online on 29 May 2026; the analysis draws mainly on the CMS Enforcement Tracker", "instruments": [ "gdpr" ], "provisions": [ "gdpr:art-83" ], "institutions": [ "dpa-*" ], "enforcement": [], "sources": [ { "source_id": "src-csoonline-alliance-risk-2026", "supports": "supports:partial", "locator": null }, { "source_id": "src-ppcland-alliance-risk-2026", "supports": "supports:partial", "locator": "Opening paragraphs: 'analysis published this week by Alliance Risk'; '€2.8 billion … annulled or under active legal challenge'" } ], "legal_basis": [], "brief_part": "part-2", "published": "2026-05-29", "last_verified": "2026-10-21", "verification_note": "Split on 27 Sep 2026 out of clm-announced-vs-collected, which carried both this figure and the reading drawn from it. The analysis is identified (audit T-25): CSO Online (29 May 2026) attributes the EUR 7.1 billion, ~40% and ~EUR 2.8 billion figures to the insurance brokerage Alliance Risk, drawing mainly on the CMS Enforcement Tracker; the prose now names it. Alliance Risk's own publication could not be located, so this rests on a press report of it, and 'contested' amounts may yet be upheld. The reference gap is left set for a person to clear, since the originating document has still not been read. 14 Oct 2026: reworded so that Alliance Risk's EUR 7.1 billion, counted mainly from the CMS tracker, is not read as DLA Piper's EUR 7.1 billion (clm-gdpr-total-fines): the two figures coincide in rounding but come from different compilations. The source was not re-read and the reference gap stands. Earlier statement: An analysis by the insurance brokerage Alliance Risk found that roughly 40% of the EUR 7.1 billion in announced GDPR fines — about EUR 2.8 billion — is either annulled or actively contested in court. 21 Oct 2026 (audit item 6): searched again for Alliance Risk's own publication. CSO Online (John Leyden, 29 May 2026) was re-read: it names 'insurance brokerage Alliance Risk' and links to no analysis. PPC Land (30 May 2026) reports the same figures and links to an interactive map as Alliance Risk's publication; the map reports EUR 6.07 billion across 2,879 actions to May 2026 and carries none of the 40%, EUR 2.8 billion or EUR 7.1 billion figures. No publication by Alliance Risk stating them was located. On the audit's instruction the figure was removed from the Part II chip and from Part IX §2, and kept only where Alliance Risk is named (the Part II box and the Part II thread). The reference gap stays set.", "reference_gap": true, "gap_note": "the ~40% of announced fine value said to be annulled or actively contested. No publication stating that proportion was located; the figure is attributed in the prose to eighth-anniversary analysis that could not be identified." }, { "id": "clm-spain-most-decisions", "type": "claim-type:fact", "statement": "Spain leads by number of GDPR decisions, with over a thousand.", "instruments": [ "gdpr" ], "provisions": [], "institutions": [ "dpa-es" ], "enforcement": [], "sources": [ { "source_id": "src-cms-enforcement-tracker", "supports": "supports:direct", "locator": "Numbers and figures: 1,048 published fines, most active authority" }, { "source_id": "src-brief-original", "supports": "supports:direct", "locator": "Part II" } ], "legal_basis": [], "brief_part": "part-2", "published": "2026-08-19", "last_verified": "2026-08-28", "verification_note": "Resolved 28 Aug 2026. CMS records 1,048 published fines for the Spanish AEPD as at March 2026, the highest count of any authority. Note the brief says \"decisions\" where the tracker counts published fines — a narrower quantity." }, { "id": "clm-dpc-staff-growth", "type": "claim-type:fact", "statement": "The DPC has grown to nearly 300 staff by 2026 and moved to a three-Commissioner structure.", "instruments": [ "gdpr" ], "provisions": [], "institutions": [ "dpa-ie" ], "enforcement": [], "sources": [ { "source_id": "src-dpc-annual-report-2025-pdf", "supports": "supports:direct", "locator": "p. 5 (Commissioners' foreword: 'completing the move from a one to three-person Commission'; staff 'increased to 295 by year end') and p. 115 ('By year-end 2025, the DPC had reached a total headcount of 295')" }, { "source_id": "src-iapp-sweeney-2026", "supports": "supports:direct", "locator": "'With nearly 300 staff, up from 27 in 2014'" }, { "source_id": "src-dpc-annual-report-2025", "supports": "supports:partial", "locator": "three Commissioners named" }, { "source_id": "src-brief-original", "supports": "supports:context", "locator": "Part II" } ], "legal_basis": [], "brief_part": "part-2", "published": "2026-04-01", "last_verified": "2026-09-27", "verification_note": "reference_gap cleared on 27 Sep 2026 on the author's instruction: the DPC's Annual Report 2025 states the headcount (295) and the three-person Commission. The gap it recorded was: \"No DPC annual report was located stating a specific staff headcount; the figure rests on a Commissioner's quoted remark rather than a published number, and the pre-2026 baseline (previously '110 in 2018') is now unsourced and has been removed from the statement rather than carried forward unverified.\". 27 Sep 2026: now read in the DPC's own Annual Report 2025 (PDF, published 30 June 2026), which states both halves: a headcount of 295 at the end of 2025 and the move to a three-person Commission. The 'nearly 300' figure is a direct quotation from sitting Commissioner Niamh Sweeney, reported by IAPP (1 April 2026); it is not the DPC's own published headcount figure, and no DPC annual report was located giving a specific number. The original 'roughly 110 staff in 2018' figure has been dropped rather than kept: no DPC 2018 annual report was retrieved to confirm it, and the site's own rule against inventing a comparison year applies here. The three-Commissioner structure is confirmed directly by the DPC's own Annual Report 2025 announcement, which names Des Hogan (Chairperson), Dale Sunderland and Niamh Sweeney." }, { "id": "clm-iccl-ireland-bottleneck", "type": "claim-type:attributed", "statement": "In 2021 the Irish Council for Civil Liberties called Ireland the GDPR's worst bottleneck, documenting failure to transmit draft decisions to peer authorities in the great majority of major cross-border cases.", "instruments": [ "gdpr" ], "provisions": [ "gdpr:art-60" ], "institutions": [ "dpa-ie" ], "enforcement": [], "sources": [ { "source_id": "src-iccl-ireland-bottleneck", "supports": "supports:direct", "locator": "\"Key insights\": \"The Irish Data Protection Commission is the bottleneck of GDPR enforcement against Big Tech across the EU. Almost all (98%) major GDPR cases referred to Ireland remain unresolved\"" } ], "legal_basis": [], "brief_part": "part-2", "published": null, "last_verified": "2026-09-27", "verification_note": "The report is identified: ICCL, 'Europe's enforcement paralysis: ICCL's 2021 GDPR report', 13 September 2021 (read 2026-09-26). It calls the Irish DPC 'the bottleneck of GDPR enforcement against Big Tech across the EU' and says 98% of major GDPR cases referred to Ireland remain unresolved. 'Worst' is the brief's gloss on 'the bottleneck'; the comparison with Spain in the prose was not found on the report's summary page and was not checked against the full report. The prose now dates the critique to 2021 (audit T-26); it describes Ireland five years ago, not today. Retyped from critique to attributed on 27 Sep 2026: the statement reports what Irish Council for Civil Liberties said; the site does not adopt the position, and the evidence it owes is that actor's own text. Locators added 27 Sep 2026: each source was re-read that day and the locator quotes the sentence that carries the claim.", "attributed_to": "Irish Council for Civil Liberties, \"Europe's enforcement paralysis: ICCL's 2021 GDPR report\" (13 September 2021)" }, { "id": "clm-icle-law-of-everything", "type": "claim-type:attributed", "statement": "The International Center for Law & Economics argues, borrowing Nadezhda Purtova's phrase, that the GDPR has been interpreted into a 'law of everything', and that the EDPB's proportionality analysis tests limitations on data protection without asking whether the scope of data protection remains proportionate to the burdens it imposes.", "instruments": [ "gdpr" ], "provisions": [], "institutions": [ "edpb" ], "enforcement": [], "sources": [ { "source_id": "src-icle-gdpr-law-of-everything", "supports": "supports:direct", "locator": "Section B and footnote 3" }, { "source_id": "src-purtova-law-of-everything", "supports": "supports:context", "locator": null } ], "legal_basis": [], "brief_part": "part-2", "published": "2026-03-13", "last_verified": "2026-09-26", "verification_note": "Added on 2026-09-26 (audit T-26). ICLE's comments on the Digital Omnibus (13 March 2026), read that day, call the GDPR a 'law of everything' and footnote the phrase to Purtova, 'The Law of Everything' (2018) 10 Law Innov Technol 40. Purtova is attached as context only: her conclusion (abandon the personal/non-personal distinction) is not ICLE's (narrow the GDPR's scope). The argument is ICLE's and is typed as critique. Retyped from critique to attributed on 27 Sep 2026: the statement reports what International Center for Law & Economics said; the site does not adopt the position, and the evidence it owes is that actor's own text.", "attributed_to": "International Center for Law & Economics, comments on the Digital Omnibus (13 March 2026)" }, { "id": "clm-edpb-cef-2026-transparency", "type": "claim-type:fact", "statement": "The EDPB made transparency and information obligations under GDPR Articles 12 to 14 the subject of its 2026 coordinated enforcement action, with twenty-five data protection authorities taking part.", "instruments": [ "gdpr" ], "provisions": [], "institutions": [ "edpb" ], "enforcement": [], "sources": [ { "source_id": "src-edpb-cef-2026", "supports": "supports:direct", "locator": "\"Next steps\": \"During 2026, 25 Data Protection Authorities (DPAs) across Europe will take part in this initiative\"" } ], "legal_basis": [], "brief_part": "part-2", "published": "2026-03-19", "last_verified": "2026-09-27", "verification_note": "Added on 2026-09-26 (audits T-22, T-27), from the EDPB's launch announcement of 19 March 2026. The same sentence's link between the CEF topic and CMS-corpus fine categories is the brief's reading, covered by clm-four-categories-94pct, not by this claim. Locators added 27 Sep 2026: each source was re-read that day and the locator quotes the sentence that carries the claim." }, { "id": "clm-poland-dsa-veto", "type": "claim-type:fact", "statement": "In January 2026 the Polish President vetoed the national law implementing the DSA; in September 2026 he signed a narrower replacement making the head of UKE the Digital Services Coordinator, while a second bill, on blocking illegal content, was still before parliament.", "instruments": [ "dsa" ], "provisions": [], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-edri-poland-dsa-veto-2026", "supports": "supports:direct", "locator": "Title and dateline: \"President's veto delays the implementation of the DSA in Poland\", 21 January 2026" }, { "source_id": "src-300polityka-pl-dsa-2026", "supports": "supports:direct", "locator": "25 September 2026: \"Prezydent podpisał 5 ustaw, w tym pierwszą wdrażającą DSA\"" }, { "source_id": "src-interia-pl-dsa-2026", "supports": "supports:partial", "locator": null } ], "legal_basis": [], "brief_part": "part-3", "published": "2026-01", "last_verified": "2026-09-27", "verification_note": "Tried again on 27 Sep 2026 for an official source: prezydent.pl still answers with a Cloudflare challenge (HTTP 403); the Sejm's open API (api.sejm.gov.pl) failed partway through its list of legislative processes; and the act signed on 25 September was not yet in the 2026 Journal of Laws index. Still tier 4. Added on 2026-09-26 (audits T-22, T-27). Sourced to EDRi (tier 4); the official announcement on prezydent.pl could not be read here (Cloudflare challenge). Updated 2026-09-26 by the author's decision: the September 2026 signing is now read (300polityka, 25 September 2026, quoting the presidential spokesman; Interia) and stated in the prose. The President's own site could not be read. Time-sensitive: the second bill is pending. Locators added 27 Sep 2026: each source was re-read that day and the locator quotes the sentence that carries the claim." }, { "id": "clm-cispe-cloud-ceos-letter", "type": "claim-type:attributed", "statement": "Twenty-four European cloud CEOs, writing with the chair of CISPE, asked that sovereignty be defined by control — ownership of the technology and protection from foreign jurisdiction — rather than by EU presence, to prevent 'sovereignty washing'.", "instruments": [ "cloud-ai-development-act" ], "provisions": [], "institutions": [ "ec" ], "enforcement": [], "sources": [ { "source_id": "src-cispe-ceo-letter-2026", "supports": "supports:direct", "locator": "Principle 1; signatories, p. 2" } ], "legal_basis": [], "brief_part": "part-10", "published": "2026-03-17", "last_verified": "2026-09-26", "verification_note": "Added on 2026-09-26 (audit T-22). The prose said the CEOs 'demanded absolute technical and legal control requirements'; the letter does not say that, and the sentence now follows its Principle 1. 'Twenty-four' counts the company heads; the 25th signatory is CISPE's chairwoman. Retyped from fact to attributed on 27 Sep 2026: the statement reports what twenty-four European cloud chief executives and the chair of CISPE said; the site does not adopt the position, and the evidence it owes is that actor's own text.", "attributed_to": "twenty-four European cloud chief executives and the chair of CISPE" }, { "id": "clm-draghi-national-champions", "type": "claim-type:attributed", "statement": "Draghi cautioned that promoting competitiveness should not lead to policies of defending national champions that can stifle competition and innovation.", "instruments": [], "provisions": [], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-ec-draghi-report", "supports": "supports:direct", "locator": "Part A, p. 13" } ], "legal_basis": [], "brief_part": "part-10", "published": "2024-09-09", "last_verified": "2026-09-26", "verification_note": "Added on 2026-09-26 (audit T-22). Part A, printed p. 13: competitiveness 'should also not lead to policies of defending \"national champions\" that can stifle competition and innovation'. The prose's next clause, that shielding strategic players from compliance can be read as doing exactly that, is the author's argument and is not covered by this claim. Retyped from fact to attributed on 27 Sep 2026: the statement reports what Mario Draghi said; the site does not adopt the position, and the evidence it owes is that actor's own text.", "attributed_to": "Mario Draghi, The Future of European Competitiveness (September 2024)" }, { "id": "clm-breach-notifications-per-day", "type": "claim-type:fact", "statement": "Regulators are processing an average of 443 breach notifications per day, a 22% year-on-year increase.", "instruments": [ "gdpr" ], "provisions": [ "gdpr:art-33" ], "institutions": [ "dpa-*" ], "enforcement": [], "sources": [ { "source_id": "src-dlapiper-gdpr-survey-2026", "supports": "supports:direct", "locator": "443 per day, up 22% from 363 (28 Jan 2025 – 27 Jan 2026)" }, { "source_id": "src-brief-original", "supports": "supports:direct", "locator": "Part II" } ], "legal_basis": [ "gdpr:art-33" ], "brief_part": "part-2", "published": "2026-08-19", "last_verified": "2026-08-28", "verification_note": "Resolved 28 Aug 2026. Both numbers and the window are stated by the source." }, { "id": "clm-four-categories-94pct", "type": "claim-type:derived", "statement": "Three violation categories account for roughly 94% of all GDPR fine value recorded in the CMS Enforcement Tracker: insufficient legal basis, non-compliance with the general processing principles, and insufficient security measures.", "instruments": [ "gdpr" ], "provisions": [], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-cms-tracker-insights-2026-09-27", "supports": "supports:partial", "locator": "the three category totals and the headline total, read back through the input claims" } ], "legal_basis": [], "brief_part": "part-2", "published": "2026-09-27", "last_verified": "2026-09-27", "verification_note": "CORRECTED 27 Sep 2026. The brief said FOUR categories account for roughly 94%. The CMS Enforcement Tracker's own data, read that day, gives three: legal basis 43.6%, general principles 37.0% and security 13.6% of the EUR 7,159,322,834 total make 94.2%; adding the fourth (information obligations, 3.6%) makes 97.8%. The prose now says three, in all four languages. No source states the percentage; it is this site's arithmetic over figures the tracker states, recorded in the derivation so it can be re-run. The tracker is a live dataset, so the share is its state on that date. The claim ID keeps 'four' because IDs are never renamed. Earlier: attributed to analysis of the CMS corpus with no edition located.", "derivation": { "performed_by": "site", "method": "The fine value of the three largest violation categories, by penalty total, divided by the tracker's total fine value. All four figures come from the same page on the same refresh, so numerator and denominator share one dataset and one cut-off.", "inputs": { "a": { "claim": "clm-cms-fines-legal-basis", "value": 3124976242, "as_stated": "EUR 3,124,976,242" }, "b": { "claim": "clm-cms-fines-principles", "value": 2649889997, "as_stated": "EUR 2,649,889,997" }, "c": { "claim": "clm-cms-fines-security", "value": 971797663, "as_stated": "EUR 971,797,663" }, "t": { "claim": "clm-cms-fines-total", "value": 7159322834, "as_stated": "EUR 7,159,322,834" } }, "formula": "(a + b + c) / t", "result": 0.9424, "unit": "ratio", "rounding": { "to": 0.01, "stated_value": 0.94 } } }, { "id": "clm-cms-fines-total", "type": "claim-type:fact", "statement": "On 27 September 2026 the CMS GDPR Enforcement Tracker recorded total fines of EUR 7,159,322,834 across 3,275 cases.", "instruments": [ "gdpr" ], "provisions": [], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-cms-tracker-insights-2026-09-27", "supports": "supports:direct", "locator": "Headline: \"Total fines €7.16B €7,159,322,834\"; \"Total cases 3,275\"; \"data shown was last refreshed 2026-09-27 13:01 UTC\"" } ], "legal_basis": [], "brief_part": "part-2", "published": "2026-09-27", "last_verified": "2026-09-27", "verification_note": "Read 27 Sep 2026 from the CMS GDPR Enforcement Tracker's Insights page. An input to clm-four-categories-94pct; recorded as its own claim so the figure has one home and the derivation can read it back. A live dataset: the figure is its state on the read date." }, { "id": "clm-cms-fines-legal-basis", "type": "claim-type:fact", "statement": "On 27 September 2026 the CMS GDPR Enforcement Tracker recorded fines totalling EUR 3,124,976,242 for insufficient legal basis for data processing.", "instruments": [ "gdpr" ], "provisions": [], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-cms-tracker-insights-2026-09-27", "supports": "supports:direct", "locator": "\"Top violation types\", by penalty total: \"Insufficient legal basis for data processing\", sum 3124976242, count 992 (the page's embedded chart data)" } ], "legal_basis": [], "brief_part": "part-2", "published": "2026-09-27", "last_verified": "2026-09-27", "verification_note": "Read 27 Sep 2026 from the CMS GDPR Enforcement Tracker's Insights page. An input to clm-four-categories-94pct; recorded as its own claim so the figure has one home and the derivation can read it back. A live dataset: the figure is its state on the read date." }, { "id": "clm-cms-fines-principles", "type": "claim-type:fact", "statement": "On 27 September 2026 the CMS GDPR Enforcement Tracker recorded fines totalling EUR 2,649,889,997 for non-compliance with general data processing principles.", "instruments": [ "gdpr" ], "provisions": [], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-cms-tracker-insights-2026-09-27", "supports": "supports:direct", "locator": "\"Top violation types\", by penalty total: \"Non-compliance with general data processing principles\", sum 2649889997, count 814" } ], "legal_basis": [], "brief_part": "part-2", "published": "2026-09-27", "last_verified": "2026-09-27", "verification_note": "Read 27 Sep 2026 from the CMS GDPR Enforcement Tracker's Insights page. An input to clm-four-categories-94pct; recorded as its own claim so the figure has one home and the derivation can read it back. A live dataset: the figure is its state on the read date." }, { "id": "clm-cms-fines-security", "type": "claim-type:fact", "statement": "On 27 September 2026 the CMS GDPR Enforcement Tracker recorded fines totalling EUR 971,797,663 for insufficient technical and organisational measures to ensure information security.", "instruments": [ "gdpr" ], "provisions": [], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-cms-tracker-insights-2026-09-27", "supports": "supports:direct", "locator": "\"Top violation types\", by penalty total: \"Insufficient technical and organisational measures to ensure information security\", sum 971797663, count 616" } ], "legal_basis": [], "brief_part": "part-2", "published": "2026-09-27", "last_verified": "2026-09-27", "verification_note": "Read 27 Sep 2026 from the CMS GDPR Enforcement Tracker's Insights page. An input to clm-four-categories-94pct; recorded as its own claim so the figure has one home and the derivation can read it back. A live dataset: the figure is its state on the read date." }, { "id": "clm-amazon-annulment", "type": "claim-type:fact", "statement": "The EUR 746 million fine against Amazon Europe Core was annulled by the Luxembourg courts in March 2026 on procedural grounds — the authority had not adequately assessed intent, negligence and proportionality — and referred back for reassessment, though the underlying violations were upheld.", "instruments": [ "gdpr" ], "provisions": [ "gdpr:art-83" ], "institutions": [ "dpa-lu" ], "enforcement": [ "enf-amazon-cnpd-2021" ], "sources": [ { "source_id": "src-lu-cadm-52757c-judgment", "supports": "supports:direct", "locator": "dispositif, p. 89: \"par réformation du jugement entrepris du 18 mars 2025, annule la décision de la Commission nationale pour la protection des données du 15 juillet 2021 en tous ses volets et renvoie le dossier devant ladite Commission\"; grounds pp. 85–88 (fault not examined; fine the only option considered); merits §§ 5.1–5.2 (Art. 6(1)(f), Arts 12–14 and 15–17 confirmed)" }, { "source_id": "src-justice-lu-amazon-2026", "supports": "supports:direct", "locator": "\"Dans son arrêt du 12 mars 2026, la Cour …\"" }, { "source_id": "src-mlex-2026-amazon-annulment", "supports": "supports:direct", "locator": "\"upheld the … findings that Amazon breached the GDPR, but referred the case back … for a new analysis of whether Amazon had engaged in deliberate conduct or negligence\"" }, { "source_id": "src-linarilaw-2026-amazon", "supports": "supports:direct", "locator": "Title: \"Luxembourg court of appeal cancels EUR 746 million CNPD fine against Amazon\"" } ], "legal_basis": [ "gdpr:art-83" ], "brief_part": "part-2", "published": "2026-03", "last_verified": "2026-09-27", "verification_note": "Verified 27 Sep 2026 against the judgment itself (52757C, 12 March 2026), read in full. 'The underlying violations were upheld' holds with two limits the judgment states: Arts 16 and 21 were held outside the investigation's scope, and for rectification and erasure the Court found a risk of non-compliance rather than an established infringement. Verified during the Step 1 audit, and on 2026-09-26 against the Luxembourg judiciary's announcement of judgment no. 52757C (Cour administrative, 12 March 2026; tier 2). The judgment itself has still not been retrieved. Locators added 27 Sep 2026: each source was re-read that day and the locator quotes the sentence that carries the claim." }, { "id": "clm-openai-fine-voided", "type": "claim-type:fact", "statement": "The Italian Garante's EUR 15 million ChatGPT decision was voided by a Rome tribunal in March 2026 on a pure jurisdiction point: once OpenAI established an Irish subsidiary, the DPC became lead authority.", "instruments": [ "gdpr" ], "provisions": [ "gdpr:art-56" ], "institutions": [ "dpa-it", "dpa-ie" ], "enforcement": [ "enf-openai-garante-2024" ], "sources": [ { "source_id": "src-europeanlawblog-openai-rome", "supports": "supports:direct", "locator": "\"annulled Decision No. 755 in its entirety on a purely preliminary, jurisdictional ground\"; notes [i]–[ii]: R.G. 4785/2025, decided 18 March 2026; OpenAI Ireland recognised by the DPC as single EEA establishment on 15 February 2024" }, { "source_id": "src-garante-openai-2024", "supports": "supports:partial", "locator": "notice at the head of the release: \"Il provvedimento n. 755 del 2 novembre 2024 è stato temporaneamente rimosso ... a seguito della sentenza del Tribunale di Roma n. 4153/2026, pubbl. il 18/03/2026, con la quale è stata accolta l'opposizione\" — the Garante's own record that the decision fell in March 2026; it does not state the ground" } ], "legal_basis": [ "gdpr:art-56" ], "brief_part": "part-2", "published": "2026", "last_verified": "2026-09-27", "verification_note": "27 Sep 2026: the Garante's own site now records that decision no. 755 of 2 November 2024 was the subject of the Court of Rome's judgment no. 4153/2026, published 18 March 2026, which upheld OpenAI's opposition — so the fine falling in March 2026 rests on the authority itself. The jurisdictional ground still rests on the European Law Blog: the judgment's text has not been located. Tried on 27 Sep 2026: the Garante's site search needs JavaScript and returned no result list, and no text of the Rome tribunal's judgment was located. Still rests on the European Law Blog. Verified during the Step 1 audit. The judgment itself has not been retrieved; the source is academic analysis of it. Re-read 27 Sep 2026 at the blog's new URL (the old one returned 404); the locator quotes the passage that carries the claim." }, { "id": "clm-cjeu-pseudonymised-data", "type": "claim-type:law", "statement": "The CJEU held in EDPS v SRB (C-413/23 P) that pseudonymised data is not necessarily personal data for every entity: identifiability must be assessed relative to the means reasonably likely to be used by the entity in question.", "instruments": [ "gdpr" ], "provisions": [], "institutions": [ "cjeu", "edps" ], "enforcement": [], "sources": [ { "source_id": "src-cjeu-c413-23p", "supports": "supports:direct", "locator": "Judgment of 4 September 2025, paras 80 and 82: pseudonymised data is not to be regarded \"in all cases and for every person\" as personal data" }, { "source_id": "src-cjeu-c413-23p-pr", "supports": "supports:direct", "locator": "Press Release No 107/25, page 1, paragraph beginning 'In the second place': pseudonymised data 'must not be regarded as constituting, in all cases and for every person, personal data'" } ], "legal_basis": [], "brief_part": "part-2", "published": "2025-09-04", "last_verified": "2026-09-27", "verification_note": "Grand Chamber judgment of 4 September 2025. Note the case concerns Regulation (EU) 2018/1725 rather than the GDPR directly. Locators added 27 Sep 2026: each source was re-read that day and the locator quotes the sentence that carries the claim. The judgment interprets Regulation (EU) 2018/1725, which governs the EU institutions, not the GDPR; the parallel with the GDPR's identical definitions is the brief's." }, { "id": "clm-art-22-predates-ai-act", "type": "claim-type:law", "statement": "GDPR Article 22 is the pre-existing European law of automated decision-making: it did not wait for the AI Act and applies to systems the AI Act classifies as minimal risk.", "instruments": [ "gdpr", "ai-act" ], "provisions": [ "gdpr:art-22" ], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-eurlex-gdpr", "supports": "supports:direct", "locator": "Art. 22" }, { "source_id": "src-eurlex-ai-act", "supports": "supports:partial", "locator": "Art. 6" } ], "legal_basis": [ "gdpr:art-22" ], "brief_part": "part-2", "published": "2016-05-04", "last_verified": "2026-08-27", "verification_note": null }, { "id": "clm-three-impact-assessments", "type": "claim-type:interpretation", "statement": "GDPR Art. 35 DPIAs, DSA Art. 34 systemic risk assessment and AI Act Art. 27 fundamental rights impact assessment are three overlapping assessment duties; an organisation running all three separately duplicates work regulators themselves acknowledge is duplicated.", "instruments": [ "gdpr", "dsa", "ai-act" ], "provisions": [ "gdpr:art-35", "dsa:art-34", "ai-act:art-27" ], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-brief-original", "supports": "supports:direct", "locator": "Part II" } ], "legal_basis": [ "gdpr:art-35", "dsa:art-34", "ai-act:art-27" ], "brief_part": "part-2", "published": "2026-08-19", "last_verified": "2026-08-27", "verification_note": "The existence of all three provisions is verified; the claim that regulators acknowledge the duplication is not sourced." }, { "id": "clm-gdpr-art-5-principles", "type": "claim-type:law", "statement": "Article 5 GDPR sets six principles for processing — lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality — and makes the controller responsible for, and able to demonstrate, compliance with them (accountability).", "instruments": [ "gdpr" ], "provisions": [ "gdpr:art-5" ], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-eurlex-gdpr", "supports": "supports:direct", "locator": "Art. 5(1)(a)–(f); Art. 5(2)" } ], "legal_basis": [ "gdpr:art-5" ], "brief_part": "part-2", "published": null, "last_verified": "2026-09-27", "verification_note": "Registered on 27 Sep 2026 for a statement already in the prose that no claim recorded. Checked that day against the Official Journal text (English, retrieved from the Publications Office's Cellar, CELEX 32016R0679): Article 5(1), points (a) to (f), each naming its principle, and Article 5(2) (accountability)." }, { "id": "clm-gdpr-art-6-lawful-bases", "type": "claim-type:law", "statement": "Article 6(1) GDPR makes processing lawful only where at least one of six bases applies: consent, contract, legal obligation, vital interests, public task or legitimate interests.", "instruments": [ "gdpr" ], "provisions": [ "gdpr:art-6" ], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-eurlex-gdpr", "supports": "supports:direct", "locator": "Art. 6(1)(a)–(f)" } ], "legal_basis": [ "gdpr:art-6" ], "brief_part": "part-2", "published": null, "last_verified": "2026-09-27", "verification_note": "Registered on 27 Sep 2026 for a statement already in the prose that no claim recorded. Checked that day against the Official Journal text (English, retrieved from the Publications Office's Cellar, CELEX 32016R0679): Article 6(1): \"Processing shall be lawful only if and to the extent that at least one of the following applies\", points (a) to (f). \"Exhaustive list\" in the prose follows from \"only if\"." }, { "id": "clm-gdpr-art-9-special-categories", "type": "claim-type:law", "statement": "Article 9 GDPR prohibits processing of special categories of personal data unless one of the exceptions it lists applies.", "instruments": [ "gdpr" ], "provisions": [ "gdpr:art-9" ], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-eurlex-gdpr", "supports": "supports:direct", "locator": "Art. 9(1)–(2)" } ], "legal_basis": [ "gdpr:art-9" ], "brief_part": "part-2", "published": null, "last_verified": "2026-09-27", "verification_note": "Registered on 27 Sep 2026 for a statement already in the prose that no claim recorded. Checked that day against the Official Journal text (English, retrieved from the Publications Office's Cellar, CELEX 32016R0679): Article 9(1) (the prohibition) and 9(2) (the exceptions). \"Narrow\" in the prose is the author's characterisation of the exceptions, not the text's." }, { "id": "clm-gdpr-data-subject-rights", "type": "claim-type:law", "statement": "Chapter III GDPR (Articles 12 to 23) sets out the data subject's rights: information, access, rectification, erasure, restriction, portability, objection, and the Article 22 right not to be subject to a decision based solely on automated processing that produces legal effects concerning the data subject or similarly significantly affects them.", "instruments": [ "gdpr" ], "provisions": [ "gdpr:art-22" ], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-eurlex-gdpr", "supports": "supports:direct", "locator": "Arts. 12–22 (Chapter III); Art. 22(1)" } ], "legal_basis": [ "gdpr:art-22" ], "brief_part": "part-2", "published": null, "last_verified": "2026-09-27", "verification_note": "Registered on 27 Sep 2026 for a statement already in the prose that no claim recorded. Checked that day against the Official Journal text (English, retrieved from the Publications Office's Cellar, CELEX 32016R0679): the headings of Articles 12 to 22 in Chapter III (\"Rights of the data subject\") and Article 22(1). Chapter III runs to Article 23 (restrictions), which the prose does not mention." }, { "id": "clm-gdpr-chapter-iv-duties", "type": "claim-type:law", "statement": "Chapter IV GDPR includes data protection by design and by default (Article 25), records of processing activities (Article 30), personal data breach notification and communication (Articles 33 and 34), data protection impact assessment (Article 35) and the data protection officer (Articles 37 to 39).", "instruments": [ "gdpr" ], "provisions": [ "gdpr:art-25", "gdpr:art-30", "gdpr:art-33", "gdpr:art-35", "gdpr:art-37" ], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-eurlex-gdpr", "supports": "supports:direct", "locator": "Arts. 25, 30, 33–35, 37–39 (Chapter IV)" } ], "legal_basis": [ "gdpr:art-25" ], "brief_part": "part-2", "published": null, "last_verified": "2026-09-27", "verification_note": "Registered on 27 Sep 2026 for a statement already in the prose that no claim recorded. Checked that day against the Official Journal text (English, retrieved from the Publications Office's Cellar, CELEX 32016R0679): the headings of Articles 25, 30, 33, 34, 35, 37, 38 and 39, all in Chapter IV (\"Controller and processor\")." }, { "id": "clm-gdpr-chapter-v-transfers", "type": "claim-type:law", "statement": "Chapter V GDPR governs transfers of personal data to third countries and international organisations.", "instruments": [ "gdpr" ], "provisions": [], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-eurlex-gdpr", "supports": "supports:direct", "locator": "Chapter V, Arts. 44–50" } ], "legal_basis": [], "brief_part": "part-2", "published": null, "last_verified": "2026-09-27", "verification_note": "Registered on 27 Sep 2026 for a statement already in the prose that no claim recorded. Checked that day against the Official Journal text (English, retrieved from the Publications Office's Cellar, CELEX 32016R0679): the heading of Chapter V and of Articles 44 and 49." }, { "id": "clm-gdpr-art-83-two-tiers", "type": "claim-type:law", "statement": "Article 83 GDPR sets two tiers of fine ceilings: up to EUR 10 million or 2% of total worldwide annual turnover, and up to EUR 20 million or 4%, whichever is higher in each case.", "instruments": [ "gdpr" ], "provisions": [ "gdpr:art-83" ], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-eurlex-gdpr", "supports": "supports:direct", "locator": "Art. 83(4) and (5)" } ], "legal_basis": [ "gdpr:art-83" ], "brief_part": "part-2", "published": null, "last_verified": "2026-09-27", "verification_note": "Registered on 27 Sep 2026 for a statement already in the prose that no claim recorded. Checked that day against the Official Journal text (English, retrieved from the Publications Office's Cellar, CELEX 32016R0679): Article 83(4) (EUR 10 000 000 or 2 %) and 83(5) (EUR 20 000 000 or 4 %), each \"whichever is higher\"." }, { "id": "clm-eprivacy-miscounted-fines", "type": "claim-type:fact", "statement": "Two large September 2025 French decisions (Google EUR 325m, Shein EUR 150m) were issued under the French ePrivacy regime rather than through the one-stop-shop, so they are not GDPR fines and should not be counted as such.", "instruments": [ "gdpr", "eprivacy" ], "provisions": [ "gdpr:art-56" ], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-cnil-google-2025", "supports": "supports:direct", "locator": "Section 'The jurisdiction of the CNIL'" }, { "source_id": "src-cnil-shein-2025", "supports": "supports:direct", "locator": "Section 'The jurisdiction of the CNIL'" } ], "legal_basis": [], "brief_part": "annex-b", "published": "2026-08-19", "last_verified": "2026-10-21", "verification_note": "21 Oct 2026 (audit, evidence item clm-eprivacy-miscounted-fines): rephrased. The claim used to say the two decisions 'are frequently miscounted as GDPR fines', which nothing showed; no two examples of the miscount were sought, and the statement now says only what the CNIL's own releases state — Article 82 of the French Data Protection Act, transposing the ePrivacy Directive, with the GDPR's one-stop-shop not applying — and the consequence for counting. With that scope the two CNIL releases carry it directly, so their references are direct and the brief no longer cites itself. The reference gap is left set for a person to clear. Earlier note: 27 Sep 2026: the legal basis of both decisions is now sourced to the CNIL's own releases and recorded as two claims (clm-cnil-google-2025, clm-cnil-shein-2025): Article 82 of the French Data Protection Act, transposing the ePrivacy Directive, with the GDPR's one-stop-shop not applying. That they are frequently miscounted as GDPR fines remains the brief's own observation. REQUIRES VERIFICATION. No external source located. This is a methodological caveat the brief raises against itself and is worth anchoring in the CNIL decisions.", "reference_gap": true, "gap_note": "The two French decisions of September 2025 are widely reported, but no source was located that states they are frequently miscounted as GDPR fines — that observation is the brief's own." }, { "id": "clm-cnil-google-2025", "type": "claim-type:fact", "statement": "On 1 September 2025 the CNIL fined Google EUR 325 million for cookie and email-advertising breaches under Article 82 of the French Data Protection Act, which transposes the ePrivacy Directive, outside the GDPR's one-stop-shop.", "instruments": [ "eprivacy" ], "provisions": [], "institutions": [ "dpa-*" ], "enforcement": [], "sources": [ { "source_id": "src-cnil-google-2025", "supports": "supports:direct", "locator": "Opening paragraph (1 September 2025; EUR 325 million: 200 million against Google LLC, 125 million against Google Ireland Limited) and section 'The jurisdiction of the CNIL' (Article 82; the one-stop-shop 'is not intended to apply')" } ], "legal_basis": [], "brief_part": "annex-b", "published": "2025-09-03", "last_verified": "2026-09-27", "verification_note": "Registered on 27 Sep 2026 for Annex B and read that day in the CNIL's English release. 'dpa-*' stands for the national authority because the dataset models no CNIL institution record." }, { "id": "clm-cnil-shein-2025", "type": "claim-type:fact", "statement": "On 1 September 2025 the CNIL fined Shein's Irish subsidiary EUR 150 million for cookie breaches under Article 82 of the French Data Protection Act, which transposes the ePrivacy Directive, outside the GDPR's one-stop-shop.", "instruments": [ "eprivacy" ], "provisions": [], "institutions": [ "dpa-*" ], "enforcement": [], "sources": [ { "source_id": "src-cnil-shein-2025", "supports": "supports:direct", "locator": "Opening paragraph (1 September 2025; EUR 150 million on Infinite Styles Services Co. Limited) and section 'The jurisdiction of the CNIL' (Article 82; the one-stop-shop 'does not apply')" } ], "legal_basis": [], "brief_part": "annex-b", "published": "2025-09-03", "last_verified": "2026-09-27", "verification_note": "Registered on 27 Sep 2026 for Annex B and read that day in the CNIL's English release. 'dpa-*' stands for the national authority because the dataset models no CNIL institution record." }, { "id": "clm-dsa-four-tiers", "type": "claim-type:law", "statement": "The DSA stacks obligations cumulatively across four tiers — all intermediary services, hosting services, online platforms, and VLOPs/VLOSEs — with each tier inheriting the one below.", "instruments": [ "dsa" ], "provisions": [ "dsa:art-16", "dsa:art-33" ], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-eurlex-dsa", "supports": "supports:direct", "locator": "Chapter III" } ], "legal_basis": [], "brief_part": "part-3", "published": "2022-10-27", "last_verified": "2026-08-27", "verification_note": null }, { "id": "clm-dsa-vlop-threshold", "type": "claim-type:law", "statement": "The VLOP and VLOSE designation threshold is 45 million average monthly active recipients in the Union.", "instruments": [ "dsa" ], "provisions": [ "dsa:art-33" ], "institutions": [ "ec" ], "enforcement": [], "sources": [ { "source_id": "src-eurlex-dsa", "supports": "supports:direct", "locator": "Art. 33" } ], "legal_basis": [ "dsa:art-33" ], "brief_part": "part-3", "published": "2022-10-27", "last_verified": "2026-08-27", "verification_note": null }, { "id": "clm-art-16-over-removal-incentive", "type": "claim-type:critique", "statement": "Because DSA Art. 16(3) makes a compliant notice give rise to actual knowledge and therefore liability exposure, while over-removal carries no equivalent liability — Article 14(4)'s duty to act diligently, objectively and proportionately gives it a legal cost only in principle — the rational response to a borderline notice is removal.", "instruments": [ "dsa" ], "provisions": [ "dsa:art-16" ], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-eurlex-dsa", "supports": "supports:partial", "locator": "Art. 16(3)" }, { "source_id": "src-dsa-text-unofficial-arts-14-19", "supports": "supports:partial", "locator": "Art. 14(4)" }, { "source_id": "src-brief-original", "supports": "supports:direct", "locator": "Part III" } ], "legal_basis": [ "dsa:art-16" ], "brief_part": "part-3", "published": "2026-08-19", "last_verified": "2026-09-26", "verification_note": "The provision is verified. The incentive argument is the author's, correctly typed as critique. Qualified on 2026-09-26 (audit T-15): Art. 14(4) does impose a duty of diligence, objectivity and proportionality with regard to users' fundamental rights, so 'no equivalent penalty' overstated the asymmetry. The audit's added phrase 'though one rarely enforced' was not used: no source for how often Art. 14(4) is enforced was found." }, { "id": "clm-dsa-micro-small-exemption", "type": "claim-type:law", "statement": "Micro and small enterprises are exempt from most online-platform obligations of the DSA (Art. 19) unless they are designated as very large online platforms.", "instruments": [ "dsa" ], "provisions": [], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-eurlex-dsa", "supports": "supports:direct", "locator": "Art. 19(1)–(2)" }, { "source_id": "src-dsa-text-unofficial-arts-14-19", "supports": "supports:partial", "locator": "Art. 19" } ], "legal_basis": [], "brief_part": "part-3", "published": "2022-10-27", "last_verified": "2026-09-27", "verification_note": "Added on 2026-09-26 (audit T-15). Art. 19 read from an unofficial reproduction (EUR-Lex returns HTTP 202 here): Section 3 of Chapter III, except Art. 24(3), does not apply to micro or small platforms, nor for 12 months after they lose that status, unless designated as VLOPs. 'Most' is used because the exclusion covers Section 3 only, and other sections carry exclusions of their own that were not checked. Checked 27 Sep 2026 against the Official Journal text read on 27 Sep 2026 from the Publications Office's Cellar (CELEX 32022R2065): Article 19(1) disapplies Section 3 (online platforms), except Article 24(3), for micro and small enterprises, and 19(2) re-applies it to any provider designated a very large online platform. The EUR-Lex reference is therefore direct; the unofficial reproduction is no longer the only reading of the text." }, { "id": "clm-art-34-open-concept", "type": "claim-type:critique", "statement": "DSA Art. 34–35 systemic risk is deliberately open-textured, and both failure modes are live: overly specific criteria risk platforms optimising for metrics rather than real harms, while overly vague ones leave the concept unadministrable.", "instruments": [ "dsa" ], "provisions": [ "dsa:art-34", "dsa:art-35" ], "institutions": [], "enforcement": [ "enf-temu-ec-2026" ], "sources": [ { "source_id": "src-algorithmwatch-systemic-risk", "supports": "supports:direct", "locator": null }, { "source_id": "src-eurlex-dsa", "supports": "supports:partial", "locator": "Arts. 34–35" } ], "legal_basis": [ "dsa:art-34" ], "brief_part": "part-3", "published": null, "last_verified": "2026-08-27", "verification_note": "requires verification — the AlgorithmWatch research has not been identified and no URL located." }, { "id": "clm-art-40-delegated-act", "type": "claim-type:law", "statement": "A delegated act on DSA Article 40 data access entered into force on 29 October 2025, establishing a centralised DSA Data Access Portal, procedural safeguards and platform data catalogues.", "instruments": [ "dsa" ], "provisions": [ "dsa:art-40" ], "institutions": [ "ec", "dsc-*" ], "enforcement": [], "sources": [ { "source_id": "src-eurlex-dsa-da-2050", "supports": "supports:direct", "locator": "Art. 3 (DSA data access portal); Art. 6(4)(c) (DSA data catalogues); Art. 16 (entry into force), OJ L series, 2025/2050, 9.10.2025" }, { "source_id": "src-ec-dsa-data-access-2025", "supports": "supports:direct", "locator": "\"As of 29 October 2025, new rules under the Digital Services Act (DSA) will allow researchers to gain unprecedented access\"" }, { "source_id": "src-ec-dsa-data-access-portal", "supports": "supports:direct", "locator": "\"On 2 July 2025, the Commission published a delegated act\"; \"testing of the DSA Portal\"" } ], "legal_basis": [ "dsa:art-40" ], "brief_part": "part-3", "published": "2025-10-29", "last_verified": "2026-09-27", "verification_note": "Commission Delegated Regulation (EU) 2025/2050 of 1 July 2025. Checked 27 Sep 2026 against the Official Journal text (Cellar, CELEX 32025R2050): Article 3 requires the Commission to establish and host a DSA data access portal; Article 6(4)(c) requires data providers to publish a DSA data catalogue; Article 16 provides for entry into force on the twentieth day after publication, and the Journal is dated 9.10.2025, which gives 29 October 2025. Locators added 27 Sep 2026: each source was re-read that day and the locator quotes the sentence that carries the claim." }, { "id": "clm-art-40-underperforming", "type": "claim-type:critique", "statement": "DSA Article 40 researcher data access is underperforming in practice, with a documented playbook of available refusals grounded in the purpose limitation.", "instruments": [ "dsa" ], "provisions": [ "dsa:art-40" ], "institutions": [ "ec", "dsc-*" ], "enforcement": [ "enf-x-ec-2025" ], "sources": [ { "source_id": "src-brief-original", "supports": "supports:direct", "locator": "Part III" }, { "source_id": "src-ec-x-fine-2025", "supports": "supports:partial", "locator": null } ], "legal_basis": [ "dsa:art-40" ], "brief_part": "part-3", "published": "2026-08-19", "last_verified": "2026-08-27", "verification_note": "The Commission decision against X confirms obstruction of researcher access as a ground. The wider 'playbook' characterisation is the author's." }, { "id": "clm-x-data-access-staffing", "type": "claim-type:fact", "statement": "In the X proceedings the Commission recorded that X had three employees working part-time on assessing data access requests.", "instruments": [ "dsa" ], "provisions": [ "dsa:art-40" ], "institutions": [ "ec" ], "enforcement": [ "enf-x-ec-2025" ], "sources": [ { "source_id": "src-ec-x-decision-2025-house-release", "supports": "supports:direct", "locator": "Recital 320" }, { "source_id": "src-ec-x-fine-2025", "supports": "supports:partial", "locator": null }, { "source_id": "src-brief-original", "supports": "supports:direct", "locator": "Part III" } ], "legal_basis": [], "brief_part": "part-3", "published": "2025-12-05", "last_verified": "2026-09-26", "verification_note": "Verified on 2026-09-26 against the decision text (recital 320) as released by the US House Judiciary Committee. The Commission has not published the decision or confirmed that release; the source note says so." }, { "id": "clm-x-api-price", "type": "claim-type:fact", "statement": "After X withdrew its free academic API, the Commission found researchers left with X's commercial developer API, whose 'Pro' tier cost USD 5,000 per month.", "instruments": [ "dsa" ], "provisions": [ "dsa:art-40" ], "institutions": [ "ec" ], "enforcement": [ "enf-x-ec-2025" ], "sources": [ { "source_id": "src-ec-x-decision-2025-house-release", "supports": "supports:direct", "locator": "Recital 302 and Figure 13" } ], "legal_basis": [ "dsa:art-40" ], "brief_part": "part-3", "published": "2025-12-05", "last_verified": "2026-09-26", "verification_note": "Added on 2026-09-26 (audits T-17, T-22). The prose said 'X's academic API is priced at up to USD 5,000 per month'; there is no academic API to price. Corrected from recital 302 of the decision as released by the US House Judiciary Committee; the Commission has not published it. The price is the one the decision records, not X's current price list, which was not checked." }, { "id": "clm-x-fine", "type": "claim-type:fact", "statement": "On 5 December 2025 the Commission fined X EUR 120 million under the DSA for deceptive design in the paid blue checkmark, a non-functional ad repository, and obstruction of researcher access; the Commission describes it as the first non-compliance decision under the DSA.", "instruments": [ "dsa" ], "provisions": [ "dsa:art-25", "dsa:art-39", "dsa:art-40" ], "institutions": [ "ec" ], "enforcement": [ "enf-x-ec-2025" ], "sources": [ { "source_id": "src-ec-x-decision-2025-house-release", "supports": "supports:partial", "locator": "Articles 4-6; signature page 183" }, { "source_id": "src-ec-x-fine-2025", "supports": "supports:direct", "locator": "\"a fine of €120 million … The breaches include the deceptive design of its 'blue checkmark', the lack of transparency of its advertising repository, and the failure to provide access to public data for researchers\"; \"This is the first non-compliance decision under the DSA.\"" }, { "source_id": "src-eucrim-x-first-fine", "supports": "supports:partial", "locator": null } ], "legal_basis": [ "dsa:art-74" ], "brief_part": "part-3", "published": "2025-12-05", "last_verified": "2026-10-14", "verification_note": "14 Oct 2026: 'first' is now sourced to the Commission itself. The press release, re-read that day, says 'This is the first non-compliance decision under the DSA'; the statement uses those words and the prose's 'first DSA non-compliance fine' rests on them. Earlier note: The amount and all three grounds are directly sourced. The characterisation as the FIRST DSA non-compliance fine is not in the Commission text and rests on commentary. Locators added 27 Sep 2026: each source was re-read that day and the locator quotes the sentence that carries the claim." }, { "id": "clm-x-action-plan", "type": "claim-type:fact", "statement": "On 16 July 2026 the Commission accepted X's action plan for its ad repository and researchers' access to data, giving X six months to implement it and then submit an independent audit; the Commission presents the plan as following its December 2025 infringement decision and fine, and records no withdrawal of either.", "instruments": [ "dsa" ], "provisions": [ "dsa:art-39", "dsa:art-40" ], "institutions": [ "ec" ], "enforcement": [ "enf-x-ec-2025" ], "sources": [ { "source_id": "src-ec-x-action-plan-2026", "supports": "supports:direct", "locator": "\"The European Commission has accepted X's action plan\"; \"Following the Commission's decision that X is in breach of the DSA and a fine in December 2025, X committed to …\"; \"X has six months to implement the measures set out in its action plan and it must then issue, and submit to the Commission, an audit of the measures.\"" } ], "legal_basis": [], "brief_part": "part-3", "published": "2026-07-16", "last_verified": "2026-10-14", "verification_note": "Registered 14 Oct 2026 and read that day. The Board for Digital Services had found the plan insufficient overall (opinion of 15 June 2026); the Commission accepted it with clarifications. 'Records no withdrawal' describes the Commission's text, which says nothing of withdrawing the decision; X's three actions for annulment are recorded on enf-x-ec-2025. Whether X has implemented the plan is not established." }, { "id": "clm-temu-fine", "type": "claim-type:fact", "statement": "On 28 May 2026 the Commission fined Temu EUR 200 million under the DSA for failing to diligently identify, analyse and assess the systemic risks from the sale of illegal products on its platform.", "instruments": [ "dsa" ], "provisions": [ "dsa:art-34", "dsa:art-35" ], "institutions": [ "ec" ], "enforcement": [ "enf-temu-ec-2026" ], "sources": [ { "source_id": "src-ec-temu-fine-2026", "supports": "supports:direct", "locator": "IP/26/1178: \"The company failed to diligently identify, analyse, and assess the systemic risks of illegal products being offered on its platform\"; Next steps: the action plan must \"remedy the breach of its risk-assessment obligations\"" }, { "source_id": "src-techpolicypress-temu", "supports": "supports:partial", "locator": null } ], "legal_basis": [ "dsa:art-74" ], "brief_part": "part-3", "published": "2026-05-28", "last_verified": "2026-09-27", "verification_note": "CORRECTED 27 Sep 2026 against the Commission's press release IP/26/1178, read in full: the breach found is of the risk-ASSESSMENT obligation only; the release says nothing of mitigation, and the action plan it requires is to 'remedy the breach of its risk-assessment obligations'. The earlier 'assess and mitigate' was carried over from AliExpress's decision, which found both. Prose corrected in all four languages. The amount and ground are directly sourced. The characterisation as the LARGEST DSA fine to date is not in the Commission text, rests on commentary, and is in any case superseded: AliExpress was fined EUR 550 million on 20 July 2026 (clm-aliexpress-fine). Locators added 27 Sep 2026: each source was re-read that day and the locator quotes the sentence that carries the claim." }, { "id": "clm-commission-prefers-compliance", "type": "claim-type:interpretation", "statement": "The Commission's stated priority in DSA enforcement is compliance rather than revenue: TikTok's ad-repository failings were cured by binding commitment rather than fine.", "instruments": [ "dsa" ], "provisions": [ "dsa:art-39" ], "institutions": [ "ec" ], "enforcement": [ "enf-tiktok-ec-2025-commitments" ], "sources": [ { "source_id": "src-ec-tiktok-commitments-ip-2025", "supports": "supports:partial", "locator": "Executive Vice-President's quotation" }, { "source_id": "src-ec-tiktok-commitments-2025", "supports": "supports:partial", "locator": null } ], "legal_basis": [], "brief_part": "part-3", "published": "2025-12-05", "last_verified": "2026-09-26", "verification_note": "The commitments decision is sourced. The Commission's stated priority is now sourced too (audit T-28): IP/25/2940 quotes 'The message is clear: our aim is compliance. When platforms engage constructively with the Commission, we are ready to accept solid commitments.' The 'not revenue' half remains the brief's gloss, which is why the claim stays an interpretation and the source is graded partial." }, { "id": "clm-first-architecture-enforcement", "type": "claim-type:interpretation", "statement": "The February 2026 TikTok preliminary findings were among the first enforcement actions targeting platform architecture — infinite scroll, autoplay, personalised recommenders — rather than illegal content.", "instruments": [ "dsa" ], "provisions": [ "dsa:art-34", "dsa:art-35" ], "institutions": [ "ec" ], "enforcement": [ "enf-tiktok-ec-2026-addictive" ], "sources": [ { "source_id": "src-ec-tiktok-addictive-2026", "supports": "supports:partial", "locator": null } ], "legal_basis": [], "brief_part": "part-3", "published": "2026-02-06", "last_verified": "2026-09-26", "verification_note": "The action is sourced. Softened from 'the first' to 'among the first' on 2026-09-26 (audit T-28): neither the Commission's news item nor its press release IP/26/312 claims primacy, and no other source was found that does." }, { "id": "clm-dsa-enforcement-escalation", "type": "claim-type:interpretation", "statement": "DSA enforcement escalated across 2025–2026, from the X and Temu fines to preliminary findings against TikTok and Meta on addictive design and minors' safety.", "instruments": [ "dsa" ], "provisions": [], "institutions": [ "ec" ], "enforcement": [ "enf-x-ec-2025", "enf-temu-ec-2026", "enf-tiktok-ec-2026-addictive", "enf-meta-ec-2026-addictive", "enf-tiktok-ec-2026-minors" ], "sources": [ { "source_id": "src-ec-x-fine-2025", "supports": "supports:partial", "locator": null }, { "source_id": "src-ec-temu-fine-2026", "supports": "supports:partial", "locator": null }, { "source_id": "src-ec-tiktok-addictive-2026", "supports": "supports:partial", "locator": null }, { "source_id": "src-ec-meta-addictive-2026", "supports": "supports:partial", "locator": null }, { "source_id": "src-ec-tiktok-minors-2026", "supports": "supports:partial", "locator": null } ], "legal_basis": [], "brief_part": "part-3", "published": "2026-07-24", "last_verified": "2026-09-26", "verification_note": "Each underlying action is directly sourced; the aggregate characterisation is the author's and is computable from the enforcement records. Retyped from fact to interpretation on 2026-09-26 (audit T-28): 'escalated' is a reading of the sequence, not a fact any one source states.", "premises": [ "clm-x-fine", "clm-temu-fine", "clm-aliexpress-fine" ] }, { "id": "clm-dsa-commission-vlop-only", "type": "claim-type:law", "statement": "The Commission supervises the DSA only for VLOPs and VLOSEs; national Digital Services Coordinators supervise every tier below that.", "instruments": [ "dsa" ], "provisions": [ "dsa:art-49", "dsa:art-56" ], "institutions": [ "ec", "dsc-*" ], "enforcement": [], "sources": [ { "source_id": "src-eurlex-dsa", "supports": "supports:direct", "locator": "Arts. 49, 56" } ], "legal_basis": [ "dsa:art-56" ], "brief_part": "part-3", "published": "2022-10-27", "last_verified": "2026-08-27", "verification_note": null }, { "id": "clm-gc-supervisory-fee-annulled", "type": "claim-type:fact", "statement": "Platform challenges to the DSA supervisory-fee decisions succeeded before the General Court for both TikTok and Meta.", "instruments": [ "dsa" ], "provisions": [], "institutions": [ "gc", "ec" ], "enforcement": [ "enf-supervisory-fee-gc-2025" ], "sources": [ { "source_id": "src-gc-supervisory-fee-2025", "supports": "supports:direct", "locator": "Press Release No 114/25: \"The General Court annuls the implementing decisions, while maintaining their effects for a provisional period\"" }, { "source_id": "src-mlex-2025-dsa-fee-appeal", "supports": "supports:partial", "locator": null }, { "source_id": "src-mlex-2026-dsa-fee-appeal-oj", "supports": "supports:partial", "locator": null } ], "legal_basis": [], "brief_part": "part-3", "published": "2025-09-10", "last_verified": "2026-09-27", "verification_note": "Re-read CURIA Press Release No 114/25 (10 September 2025) on 2026-09-26: the implementing decisions were annulled because the methodology for counting average monthly active recipients should have been adopted by delegated act; the Court found no error affecting the obligation to pay the 2023 fee and maintained the decisions' effects for up to twelve months from the judgments becoming final. It is not an annulment of the fee mechanism. The prose's statement that the Commission has appealed rests on two paywalled MLex reports (24 November 2025; 12 January 2026, citing two Official Journal notices), of which only the standfirst/summary could be read: tier-4 journalism, and hence only partial support. The appeal case numbers, lodging dates and current state (whether still pending on the date read) are not established; the Official Journal notices could not be retrieved (EUR-Lex returns HTTP 202 with no body; CURIA case search unavailable on 2026-09-26). Locators added 27 Sep 2026: each source was re-read that day and the locator quotes the sentence that carries the claim." }, { "id": "clm-x-preliminary-findings-2024", "type": "claim-type:fact", "statement": "On 12 July 2024 the Commission sent X preliminary findings that it breached the DSA on the blue checkmark, advertising transparency and researchers' access to data.", "instruments": [ "dsa" ], "provisions": [ "dsa:art-25", "dsa:art-39", "dsa:art-40" ], "institutions": [ "ec" ], "enforcement": [ "enf-x-ec-2025" ], "legal_basis": [], "sources": [ { "source_id": "src-ec-x-preliminary-2024", "supports": "supports:direct", "locator": "Paragraph 1: 'Today, the Commission has informed X of its preliminary view that it is in breach of the Digital Services Act'; three grievances listed" } ], "brief_part": "part-3", "published": "2024-07-12", "last_verified": "2026-10-22", "verification_note": "Registered 22 Oct 2026 (audit, facts hidden in interpretation: clm-press-release-governance's 'seventeen months of X case'). The release names no article; the provisions are those of the decision of 5 December 2025 for the same three grievances (enf-x-ec-2025). With clm-x-fine (5 December 2025) it carries the box's 'roughly seventeen months': 12 July 2024 to 5 December 2025 is sixteen months and twenty-three days." }, { "id": "clm-press-release-governance", "type": "claim-type:critique", "statement": "Announcing preliminary findings with detailed proposed remedies before publishing reasoning risks findings that are less responsive to debate and less likely to survive court challenge.", "instruments": [ "dsa" ], "provisions": [], "institutions": [ "ec" ], "enforcement": [ "enf-x-ec-2025" ], "sources": [ { "source_id": "src-brief-original", "supports": "supports:direct", "locator": "Part III" } ], "legal_basis": [], "brief_part": "part-3", "published": "2026-08-19", "last_verified": "2026-08-27", "verification_note": "The author's critique. Typed as such. 22 Oct 2026 (audit, facts hidden in interpretation): the factual half of the passage — the X decision came 'roughly seventeen months after the preliminary findings' — is now carried by clm-x-preliminary-findings-2024 and clm-x-fine, both dated from Commission releases; the critique itself remains the author's." }, { "id": "clm-dsa-gdpr-unresolved", "type": "claim-type:interpretation", "statement": "The DSA–GDPR interface is unresolved: the DSA tells platforms to be transparent while the GDPR tells them to minimise, and EDPB guidance mediates the conflict without dissolving it.", "instruments": [ "dsa", "gdpr" ], "provisions": [ "dsa:art-39", "dsa:art-40" ], "institutions": [ "edpb" ], "enforcement": [], "sources": [ { "source_id": "src-edpb-guidelines-3-2025", "supports": "supports:context", "locator": "Guidelines 3/2025 v2 (final, 17 September 2026) on the EDPB's site; v1 consulted 12 September – 31 October 2025" }, { "source_id": "src-brief-original", "supports": "supports:direct", "locator": "Part III" } ], "legal_basis": [], "brief_part": "part-3", "published": "2026-08-19", "last_verified": "2026-09-27", "verification_note": "27 Sep 2026: EDPB Guidelines 3/2025 located under exactly the title given, on the EDPB's own site; the final version (v2) is dated 17 September 2026, after a public consultation on v1 from 12 September to 31 October 2025. The guidelines are cited as context: that they mediate the DSA–GDPR tension without dissolving it is the author's reading, and the claim is an interpretation whose direct source is the brief." }, { "id": "clm-dma-ex-ante", "type": "claim-type:law", "statement": "The DMA is ex ante regulation: once an undertaking is designated, a list of prohibitions and obligations applies immediately, with no requirement to demonstrate anticompetitive effect in the individual case.", "instruments": [ "dma" ], "provisions": [ "dma:art-3", "dma:art-5", "dma:art-6" ], "institutions": [ "ec" ], "enforcement": [], "sources": [ { "source_id": "src-eurlex-dma", "supports": "supports:direct", "locator": "Arts. 3, 5, 6" } ], "legal_basis": [ "dma:art-5" ], "brief_part": "part-4", "published": "2022-10-12", "last_verified": "2026-08-27", "verification_note": null }, { "id": "clm-dma-designation", "type": "claim-type:law", "statement": "DMA Article 3 designates gatekeepers by quantitative presumption: substantial EU turnover or market capitalisation, at least 45 million monthly active end users and 10,000 yearly active business users in the Union, sustained over three financial years.", "instruments": [ "dma" ], "provisions": [ "dma:art-3" ], "institutions": [ "ec" ], "enforcement": [], "sources": [ { "source_id": "src-eurlex-dma", "supports": "supports:direct", "locator": "Art. 3" } ], "legal_basis": [ "dma:art-3" ], "brief_part": "part-4", "published": "2022-10-12", "last_verified": "2026-08-27", "verification_note": null }, { "id": "clm-seven-gatekeepers", "type": "claim-type:fact", "statement": "As at 14 October 2026 seven undertakings are designated as gatekeepers — Alphabet, Amazon, Apple, Booking, ByteDance, Meta and Microsoft — for 23 core platform services.", "instruments": [ "dma" ], "provisions": [ "dma:art-3" ], "institutions": [ "ec" ], "enforcement": [], "sources": [ { "source_id": "src-ec-dma-gatekeepers-portal", "supports": "supports:direct", "locator": "Gatekeepers portal, read 14 Oct 2026: the six designated on 6 September 2023, Apple's iPadOS (29 April 2024), Booking (13 May 2024); 'In total, 23 core platform services provided by those gatekeepers are currently designated'" }, { "source_id": "src-brief-original", "supports": "supports:direct", "locator": "Part IV" } ], "legal_basis": [ "dma:art-3" ], "brief_part": "part-4", "published": "2026-08-19", "last_verified": "2026-10-14", "verification_note": "Resolved 28 Aug 2026 against the Commission's own register. Seven undertakings, 23 designated core platform services. 14 Oct 2026: re-read on the Commission's register; seven undertakings and 23 core platform services, the 23 listed services counted that day. The statement now carries its date, because the count changes with every designation (AWS and Azure: preliminary position only, 25 June 2026)." }, { "id": "clm-dma-commission-exclusive", "type": "claim-type:law", "statement": "The Commission is the sole enforcer of the DMA; national competition authorities may investigate possible non-compliance and report to support the Commission (Art. 38(7)), and national courts may apply the DMA in proceedings before them (Art. 39).", "instruments": [ "dma" ], "provisions": [ "dma:art-38" ], "institutions": [ "ec" ], "enforcement": [], "sources": [ { "source_id": "src-eurlex-dma", "supports": "supports:direct", "locator": "Art. 38" }, { "source_id": "src-dma-text-unofficial-arts-11-39", "supports": "supports:partial", "locator": "Arts. 38(7), 39" } ], "legal_basis": [ "dma:art-38" ], "brief_part": "part-4", "published": "2022-10-12", "last_verified": "2026-09-26", "verification_note": "Corrected on 2026-09-26 (audit T-10). The earlier statement said there is no national enforcement route; Art. 38(7) lets national competition authorities investigate possible non-compliance with Arts. 5-7 on their territory, reporting to support the Commission 'in its role as sole enforcer', and Art. 39 governs national courts' proceedings for the application of the Regulation. Read from an unofficial reproduction of the text because EUR-Lex returns HTTP 202 with no body here; not yet checked against the Official Journal text. The brief's own sentence (part-4.p2) does not state exclusivity and is unchanged; data/instruments.json enforcement_mechanism is corrected to match." }, { "id": "clm-apple-proactive-enablement", "type": "claim-type:interpretation", "statement": "The April 2025 Apple decision establishes that the DMA Art. 5(4) standard is proactive enablement rather than mere non-obstruction, that formal compliance fails where user choices are not genuinely meaningful, and that compliance cannot be averaged across business terms.", "instruments": [ "dma" ], "provisions": [ "dma:art-5" ], "institutions": [ "ec" ], "enforcement": [ "enf-apple-ec-2025" ], "sources": [ { "source_id": "src-ec-apple-meta-dma-2025", "supports": "supports:partial", "locator": null }, { "source_id": "src-brief-original", "supports": "supports:direct", "locator": "Part IV" } ], "legal_basis": [ "dma:art-5" ], "brief_part": "part-4", "published": "2025-04-23", "last_verified": "2026-08-27", "verification_note": "The decision and fine are directly sourced. The three interpretive principles come from the non-confidential decision text published 26 May 2025, which has not been retrieved." }, { "id": "clm-meta-pay-or-consent", "type": "claim-type:fact", "statement": "Meta's binary pay-or-consent model was found not to provide the genuinely equivalent, less data-intensive alternative DMA Article 5(2) requires.", "instruments": [ "dma", "gdpr" ], "provisions": [ "dma:art-5" ], "institutions": [ "ec" ], "enforcement": [ "enf-meta-ec-2025" ], "sources": [ { "source_id": "src-ec-apple-meta-dma-2025", "supports": "supports:direct", "locator": "IP/25/1085, section 'Non-compliance decision on Meta's “consent or pay” model': the model 'did not give users the required specific choice to opt for a service that uses less of their personal data but is otherwise equivalent'" } ], "legal_basis": [ "dma:art-5" ], "brief_part": "part-4", "published": "2025-04-23", "last_verified": "2026-09-27", "verification_note": "Re-read on 27 Sep 2026 in the press corner's text of IP/25/1085 (23 April 2025). The finding covers the period from March 2024, when the DMA obligations became binding, to November 2024, when Meta introduced a further ads model that the Commission was then still assessing. The pricing range is stated by the brief and not independently sourced. The subsequent ad-model change is now its own claim, clm-meta-ad-choice-2026, sourced to the Commission (audit T-18)." }, { "id": "clm-meta-ad-choice-2026", "type": "claim-type:fact", "statement": "In December 2025 the Commission acknowledged Meta's undertaking to give EU users, from January 2026, a choice between fully personalised advertising and a less-personalised option that shares less of their data.", "instruments": [ "dma" ], "provisions": [ "dma:art-5" ], "institutions": [ "ec" ], "enforcement": [ "enf-meta-ec-2025" ], "sources": [ { "source_id": "src-ec-meta-ad-choice-2025", "supports": "supports:direct", "locator": "\"Meta will present these new options to users in the EU in January 2026\"" } ], "legal_basis": [ "dma:art-5" ], "brief_part": "part-4", "published": "2025-12-08", "last_verified": "2026-09-27", "verification_note": "Added on 2026-09-26 (audits T-18, T-22). Replaces the prose's 'three-tier advertising model', which no source supports: the Commission describes a two-way choice. Whether Meta implemented it as described, and its uptake, are not established. Locators added 27 Sep 2026: each source was re-read that day and the locator quotes the sentence that carries the claim." }, { "id": "clm-apple-art-6-7-specification", "type": "claim-type:fact", "statement": "In September 2024 the Commission opened two Article 6(7) specification proceedings on Apple's interoperability obligation for iOS and iPadOS, and on 19 March 2025 adopted two specification decisions: one setting out how Apple must open nine iOS connectivity features to third-party connected devices, the other how it must handle developers' interoperability requests.", "instruments": [ "dma" ], "provisions": [ "dma:art-6" ], "institutions": [ "ec" ], "enforcement": [], "sources": [ { "source_id": "src-ec-apple-specification-2025", "supports": "supports:direct", "locator": "IP/25/816, first paragraph (two decisions adopted), sections 'Connected devices' (nine iOS connectivity features) and 'Effective process for interoperability requests', and 'Background' (proceedings opened on 19 September 2024)" } ], "legal_basis": [ "dma:art-6" ], "brief_part": "part-4", "published": "2025-03-19", "last_verified": "2026-09-27", "verification_note": "Re-read on 27 Sep 2026 (the press corner's own document service) and corrected: the connectivity decision concerns nine iOS features for connected devices such as smartwatches, headphones and TVs; the second decision concerns the process for interoperability requests for iPhone and iPad features. The earlier wording, 'proceedings on iOS and iPadOS connectivity features', attached iPadOS to the wrong decision. Added on 2026-09-26 (audits T-18, T-22). IP/25/816 gives both dates: two specification proceedings opened on 19 September 2024, two decisions adopted on 19 March 2025. The prose's former clause 'Apple invoked a waiver clause for five features and the Commission refused it' was removed: no source was found for it, including the Commission's proceedings page." }, { "id": "clm-gc-apple-designation-upheld", "type": "claim-type:fact", "statement": "On 8 July 2026 the General Court dismissed Apple's gatekeeper-designation challenges in full, confirming the App Store and iOS obligations and closing the route by which designated gatekeepers could contest interoperability obligations at the designation stage.", "instruments": [ "dma" ], "provisions": [ "dma:art-3", "dma:art-6" ], "institutions": [ "gc" ], "enforcement": [ "enf-apple-gc-2026-designation" ], "sources": [ { "source_id": "src-gc-t1079-23-judgment", "supports": "supports:direct", "locator": "Operative part, point 2; paras 47 and 62 (plea of illegality against Art. 6(7) inadmissible at the designation stage), 99 (App Stores a single core platform service), 133-134 (iMessage plea inadmissible; T-1080/23 dismissed in its entirety), 148-149" }, { "source_id": "src-gc-apple-designation-2026", "supports": "supports:direct", "locator": "Press Release No 96/26" } ], "legal_basis": [], "brief_part": "part-4", "published": "2026-07-08", "last_verified": "2026-09-27", "verification_note": "Joined Cases T-1079/23, T-1080/23 and T-214/24, ECLI:EU:T:2026:451. Read against the judgment on 27 Sep 2026. The Art. 6(7) plea failed on admissibility (Art. 6(7) is not the legal basis of the designation decision, para 47), so the substance of Art. 6(7) interoperability remains untested. 'Closing the route' generalises from Apple's case: the holding is that a plea of illegality against Art. 6(7) is inadmissible in an action against a designation decision." }, { "id": "clm-google-android-ai-specification", "type": "claim-type:fact", "statement": "On 16 July 2026 the Commission adopted a binding specification decision under Article 6(7) DMA requiring Google to give rival AI assistants on Android access to the features its own AI services use, including activation by voice command and acting in apps on the user's behalf, with safeguards for privacy, device integrity and security; users are to see the changes from July 2027.", "instruments": [ "dma" ], "provisions": [ "dma:art-6" ], "institutions": [ "ec" ], "enforcement": [], "sources": [ { "source_id": "src-ec-google-dma-specification-2026", "supports": "supports:direct", "locator": "IP/26/1634, 'Interoperability with Google Android' and 'Next steps': 'users can activate their preferred AI assistant via voice commands'; 'perform actions in apps on their behalf'; 'Users will start benefitting from the changes to Android as of July 2027'; Background: Article 6(7) DMA" } ], "legal_basis": [ "dma:art-6" ], "brief_part": "part-4", "published": "2026-07-16", "last_verified": "2026-10-14", "verification_note": "Registered 14 Oct 2026 from the Commission's announcement and press release, read that day; the decision itself was not read. 'July 2027' is month precision as published. Specification decisions are not non-compliance decisions and carry no fine. Whether Google has brought an action against the decision was not established." }, { "id": "clm-google-search-data-specification", "type": "claim-type:fact", "statement": "A second specification decision of 16 July 2026, under Article 6(11) DMA, sets how Google must share anonymised search data with rival search engines: AI chatbots offering search functionalities are eligible, Google may first assess serious cybersecurity and data-protection risks for each recipient, the data are priced by a set formula, and sharing must start from January 2027.", "instruments": [ "dma" ], "provisions": [ "dma:art-6" ], "institutions": [ "ec" ], "enforcement": [], "sources": [ { "source_id": "src-ec-google-dma-specification-2026", "supports": "supports:direct", "locator": "IP/26/1634, 'Google search data' and 'Next steps': 'AI chatbots offering search functionalities are eligible to receive shared data'; 'allows Google to assess, before sharing any data, whether sharing such data with a specific third party poses serious cyber security and data protection risks'; 'a fair formula to calculate the price'; 'Google must start sharing search data with eligible search engine providers from January 2027'" } ], "legal_basis": [ "dma:art-6" ], "brief_part": "part-4", "published": "2026-07-16", "last_verified": "2026-10-14", "verification_note": "Registered 14 Oct 2026 from the Commission's announcement and press release, read that day; the decision itself was not read. The anonymisation method is described by the Commission as multi-layered and in line with the draft EDPB–Commission guidelines on the DMA–GDPR interplay; the Commission may amend it. Whether Google has brought an action against the decision was not established." }, { "id": "clm-dma-review-enforce-not-expand", "type": "claim-type:fact", "statement": "The Commission's DMA review concluded that future work should concentrate on enforcing what exists rather than expanding scope, despite substantial stakeholder demand to extend interoperability to social media, cloud and AI infrastructure.", "instruments": [ "dma" ], "provisions": [ "dma:art-53" ], "institutions": [ "ec" ], "enforcement": [], "sources": [ { "source_id": "src-ec-dma-review-2026", "supports": "supports:direct", "locator": "COM(2026) 178 final" }, { "source_id": "src-ec-dma-review-qa", "supports": "supports:partial", "locator": null }, { "source_id": "src-ec-dma-consultation-2026", "supports": "supports:partial", "locator": null } ], "legal_basis": [ "dma:art-53" ], "brief_part": "part-4", "published": "2026-04-28", "last_verified": "2026-08-27", "verification_note": "Three separate Commission sources are needed: the report for the conclusion, the Q&A for the 3 May 2026 deadline, and the consultation summary for 'over 450 contributions'. No single source carries all three." }, { "id": "clm-dma-scope-gap", "type": "claim-type:critique", "statement": "The main substantive criticism of the DMA is now its scope gap: cloud computing is already a core platform service under Article 2, but neither AWS nor Azure met the quantitative designation thresholds, and generative AI is not listed; the Commission opened market investigations into AWS and Azure on 18 November 2025 and reached a preliminary position in favour of designation on 25 June 2026.", "instruments": [ "dma" ], "provisions": [ "dma:art-2" ], "institutions": [ "ec" ], "enforcement": [], "sources": [ { "source_id": "src-eurlex-dma", "supports": "supports:partial", "locator": "Art. 2" }, { "source_id": "src-dma-text-unofficial-art2", "supports": "supports:partial", "locator": "Art. 2(2)(i)" }, { "source_id": "src-ec-dma-cloud-mi-2025", "supports": "supports:partial", "locator": null }, { "source_id": "src-ec-cloud-gatekeeper-preliminary-2026", "supports": "supports:partial", "locator": null }, { "source_id": "src-brief-original", "supports": "supports:direct", "locator": "Part IV" } ], "legal_basis": [ "dma:art-2" ], "brief_part": "part-4", "published": "2026-08-19", "last_verified": "2026-09-26", "verification_note": "Corrected on 2026-09-26 (audit T-09): the earlier statement said cloud sat 'largely outside' the core-platform-service list, but cloud computing services are Art. 2(2)(i). Read from an unofficial reproduction of the text (EUR-Lex returns HTTP 202 with no body here), so graded partial. The two press releases are each graded partial too: each carries only the dated facts, not the critique. The 18 November 2025 opening, and that AWS and Azure do not meet the quantitative thresholds, are from IP/25/2717; the 25 June 2026 preliminary position from IP/26/1444. That the scope gap is the 'main' criticism remains the brief's own critique. The prose no longer frames the WhatsApp/Meta matter as a DMA test case: see clm-whatsapp-ai-art102." }, { "id": "clm-whatsapp-ai-art102", "type": "claim-type:fact", "statement": "When Meta restricted rival AI assistants' access to WhatsApp, the Commission acted under Article 102 TFEU rather than the DMA: it opened an antitrust investigation on 4 December 2025, issued a Statement of Objections in February 2026 and ordered interim measures on 9 June 2026.", "instruments": [ "dma" ], "provisions": [], "institutions": [ "ec" ], "enforcement": [], "sources": [ { "source_id": "src-ec-meta-whatsapp-ai-2025", "supports": "supports:direct", "locator": "Headline, 4 December 2025: \"Commission opens antitrust investigation into Meta's new policy regarding AI providers' access to WhatsApp\"" }, { "source_id": "src-insighteu-whatsapp-interim-2026", "supports": "supports:direct", "locator": "9 June 2026: \"In February 2026, the Commission issued a Statement of Objections\"; \"ordered Meta to restore free access to WhatsApp for rival general-purpose AI assistants\"" } ], "legal_basis": [ "tfeu:art-102" ], "brief_part": "part-4", "published": "2025-12-04", "last_verified": "2026-09-27", "verification_note": "The Commission's own press release confirms the 4 December 2025 opening as an antitrust investigation into a possible breach of EU competition rules; the February 2026 Statement of Objections and the 9 June 2026 interim-measures decision, including their reliance on Article 102 TFEU, are confirmed by Insight EU Monitoring's report on the interim-measures decision, which names the legal basis directly. This is offered as evidence that the DMA's current obligations did not reach the conduct — the Commission used Article 102 precisely because the DMA did not apply — not as a claim about what the DMA itself says. Locators added 27 Sep 2026: each source was re-read that day and the locator quotes the sentence that carries the claim." }, { "id": "clm-dma-specification-utility-regulation", "type": "claim-type:critique", "statement": "In enforcing DMA Article 6(7) the Commission is not merely prohibiting conduct but prescribing product architecture, which resembles utility regulation.", "instruments": [ "dma" ], "provisions": [ "dma:art-6" ], "institutions": [ "ec" ], "enforcement": [], "sources": [ { "source_id": "src-brief-original", "supports": "supports:direct", "locator": "Part IV" } ], "legal_basis": [ "dma:art-6" ], "brief_part": "part-4", "published": "2026-08-19", "last_verified": "2026-08-27", "verification_note": "The author's critique." }, { "id": "clm-dma-asymmetry", "type": "claim-type:fact", "statement": "Every designated gatekeeper undertaking is US- or Chinese-headquartered — Booking.com is run from the Netherlands, but the designated undertaking is the US-based Booking Holdings Inc. The US administration has objected: a February 2025 presidential memorandum ordered scrutiny of foreign digital rules, and the White House named the DMA and DSA among them; in July 2026 US lawmakers pressed for a Section 301 trade investigation into both. Enforcement has proceeded regardless.", "instruments": [ "dma" ], "provisions": [ "dma:art-3" ], "institutions": [ "ec" ], "enforcement": [], "sources": [ { "source_id": "src-ec-booking-designation-2024", "supports": "supports:direct", "locator": "designating Booking Holdings Inc. as a gatekeeper" }, { "source_id": "src-whitehouse-dst-factsheet-2025", "supports": "supports:partial", "locator": "'Regulations that dictate how American companies interact with consumers in the European Union, like the Digital Markets Act and the Digital Services Act, will face scrutiny from the Administration.'" }, { "source_id": "src-thenextweb-ustr-2026", "supports": "supports:direct", "locator": "\"In February 2025, Trump signed a memorandum … naming the Digital Markets Act and Digital Services Act specifically\"" }, { "source_id": "src-brief-original", "supports": "supports:context", "locator": "Part IV" } ], "legal_basis": [], "brief_part": "part-4", "published": "2026-08-19", "last_verified": "2026-09-27", "verification_note": "Corrected on 27 Sep 2026 after reading the White House texts of 21 February 2025. The memorandum itself ('Defending American Companies and Innovators From Overseas Extortion and Unfair Fines and Penalties') does not name the DMA or DSA; the fact sheet published with it does. The brief's prose also said the administration had objected 'formally' and that 'the US Trade Representative said Section 301 action on digital rules was being prepared'; no source read supports either — the July 2026 letter is from lawmakers urging an investigation — so the prose now says what the claim and its sources say. The designated undertaking is now sourced directly to the Commission's own decision (C(2024) 3176 final), which names 'Booking Holdings Inc.' on its face — notably, the Commission's own public-facing gatekeepers-portal page and press release refer to the undertaking only as 'Booking', omitting the corporate suffix every other gatekeeper's entry carries. The US pressure is now sourced to a February 2025 presidential memorandum and a July 2026 congressional letter, both naming the DMA and DSA; neither is a formal diplomatic objection in the narrow sense, so 'has objected' is kept general rather than naming a specific legal instrument of protest. Locators added 27 Sep 2026: each source was re-read that day and the locator quotes the sentence that carries the claim.", "reference_gap": true, "gap_note": "The 'US administration has objected' framing rests on a presidential memorandum and a lawmakers' letter pressing for a Section 301 investigation, not on a formal WTO-style objection or diplomatic note; no such document was located." }, { "id": "clm-dma-consumer-benefit-modest", "type": "claim-type:interpretation", "statement": "Consumer benefit from the DMA is real but modest: EU iPhone users can set rival browsers and payment apps as defaults, install applications outside the App Store, and use third-party payment solutions — narrower than the rhetoric implied, at high administrative cost.", "instruments": [ "dma" ], "provisions": [ "dma:art-5", "dma:art-6" ], "institutions": [ "ec" ], "enforcement": [ "enf-apple-ec-2025" ], "sources": [ { "source_id": "src-brief-original", "supports": "supports:direct", "locator": "Part IV" } ], "legal_basis": [], "brief_part": "part-4", "published": "2026-08-19", "last_verified": "2026-08-27", "verification_note": "The author's assessment, resting on the Apple decision." }, { "id": "clm-dma-alongside-102", "type": "claim-type:law", "statement": "The DMA operates alongside Articles 101 and 102 TFEU, not instead of them: in September 2025 Google received a separate EUR 2.95 billion antitrust fine.", "instruments": [ "dma", "tfeu" ], "provisions": [], "institutions": [ "ec", "ec-dg-comp" ], "enforcement": [ "enf-google-ec-2025-adtech" ], "sources": [ { "source_id": "src-eurlex-dma", "supports": "supports:direct", "locator": "Art. 1(6)" }, { "source_id": "src-ec-google-adtech-2025", "supports": "supports:direct", "locator": "Case AT.40670" } ], "legal_basis": [], "brief_part": "part-4", "published": "2025-09-05", "last_verified": "2026-09-27", "verification_note": "Checked 27 Sep 2026 against the Official Journal text read on 27 Sep 2026 from the Publications Office's Cellar (CELEX 32022R1925): Article 1(6) — \"This Regulation is without prejudice to the application of Articles 101 and 102 TFEU.\" The Google fine is carried by the Commission's decision press release." }, { "id": "clm-ai-act-product-safety", "type": "claim-type:interpretation", "statement": "The AI Act is structurally product-safety legislation — conformity assessment, technical documentation, notified bodies, CE marking, post-market monitoring — and that choice determines both its strengths and the specific way it is failing to arrive on schedule.", "instruments": [ "ai-act" ], "provisions": [ "ai-act:art-6" ], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-eurlex-ai-act", "supports": "supports:partial", "locator": "Chapter III" }, { "source_id": "src-brief-original", "supports": "supports:direct", "locator": "Part V" } ], "legal_basis": [], "brief_part": "part-5", "published": "2026-08-19", "last_verified": "2026-08-27", "verification_note": null }, { "id": "clm-ai-act-not-all-ai", "type": "claim-type:attributed", "statement": "The AI Act does not regulate all AI: the Commission's position is that it introduces no rules for AI deemed minimal or no risk — applications such as AI-enabled video games or spam filters — and that the vast majority of AI systems currently used in the Union fall into that category.", "attributed_to": "European Commission, AI Act page 'AI Act — regulatory framework for artificial intelligence' (digital-strategy.ec.europa.eu, last update 3 August 2026)", "instruments": [ "ai-act" ], "provisions": [ "ai-act:art-6" ], "institutions": [ "ec" ], "enforcement": [], "sources": [ { "source_id": "src-ec-ai-act-framework", "supports": "supports:direct", "locator": "Section 'Minimal or no risk': 'The AI Act does not introduce rules for AI that is deemed minimal or no risk. The vast majority of AI systems currently used in the EU fall into this category. This includes applications such as AI-enabled video games or spam filters.'" }, { "source_id": "src-eurlex-ai-act", "supports": "supports:context", "locator": "Art. 6" }, { "source_id": "src-brief-original", "supports": "supports:direct", "locator": "Part V" } ], "legal_basis": [ "ai-act:art-6" ], "brief_part": "part-5", "published": "2026-08-19", "last_verified": "2026-09-27", "verification_note": "Atomized and retyped (law → attributed) on 27 Sep 2026. The claim now carries only the Commission's stated position, read that day on its AI Act page (digital-strategy.ec.europa.eu, 'Last update 3 August 2026'), which states it whole. The Article 4 AI-literacy duty, which applies to providers and deployers at every risk tier and which the Commission's sentence does not mention, is its own claim (clm-ai-omnibus-art-4-literacy, read in the Official Journal text of Regulation (EU) 2026/1744); the prose sentence citing this claim now cites that one too, and says the literacy duty applies across all tiers rather than 'no obligations'. Art. 6 stays as context: it is where the high-risk tier begins. Sourced on 27 Sep 2026. The Commission's position is on its AI Act page (digital-strategy.ec.europa.eu, 'Last update 3 August 2026'), which names AI-enabled video games and spam filters; the page does not mention the Art. 4 exception, so it supports the claim in part. Art. 4 as replaced by the Digital Omnibus on AI was read in the Official Journal text of Regulation (EU) 2026/1744 (Art. 1, point (5)), replacing the unofficial explorer relied on the day before: 'Providers and deployers of AI systems shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf'. No single primary text states the whole proposition, so it remains partial. Corrected on 2026-09-26 (audit T-11): 'no obligations' overstated the minimal-risk tier, because Art. 4 applies to providers and deployers of AI systems generally. Art. 4 as amended by the Digital Omnibus (Reg. (EU) 2026/1744) was read from an unofficial explorer, not the Official Journal: the duty is now to 'take measures to support the development of AI literacy' rather than to ensure a sufficient level of it." }, { "id": "clm-art-25-provider-trap", "type": "claim-type:law", "statement": "Under AI Act Article 25 a distributor, importer or deployer becomes a provider — assuming the full obligation set — if it puts its name or trademark on a high-risk system, substantially modifies it, or modifies its intended purpose.", "instruments": [ "ai-act" ], "provisions": [ "ai-act:art-25" ], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-eurlex-ai-act", "supports": "supports:direct", "locator": "Art. 25" } ], "legal_basis": [ "ai-act:art-25" ], "brief_part": "part-5", "published": "2024-07-12", "last_verified": "2026-08-27", "verification_note": null }, { "id": "clm-flop-threshold", "type": "claim-type:critique", "statement": "The 10^25 FLOP systemic-risk presumption is an administrable proxy for an unadministrable concept: risk does not scale linearly with compute, the threshold ages downward as efficiency improves, and domain-specific risk below it escapes entirely.", "instruments": [ "ai-act" ], "provisions": [ "ai-act:art-51" ], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-eurlex-ai-act", "supports": "supports:partial", "locator": "Art. 51(2)" }, { "source_id": "src-brief-original", "supports": "supports:direct", "locator": "Part V" } ], "legal_basis": [ "ai-act:art-51" ], "brief_part": "part-5", "published": "2026-08-19", "last_verified": "2026-08-27", "verification_note": "The threshold is verified. The critique is the author's and is typed as such." }, { "id": "clm-gpai-code-voluntary", "type": "claim-type:law", "statement": "The GPAI Code of Practice supplies the operative detail behind AI Act Articles 53 and 55, and it is voluntary.", "instruments": [ "ai-act" ], "provisions": [ "ai-act:art-53", "ai-act:art-55" ], "institutions": [ "ai-office", "ec" ], "enforcement": [], "sources": [ { "source_id": "src-eurlex-ai-act", "supports": "supports:direct", "locator": "Art. 53(4) and Art. 55(2) (providers 'may rely on codes of practice' to demonstrate compliance; those who do not adhere 'shall demonstrate alternative adequate means of compliance'); Art. 56(2) (codes to cover the obligations in Arts 53 and 55)" }, { "source_id": "src-ec-gpai-code", "supports": "supports:direct", "locator": "\"The Code of Practice details out these rules, representing a voluntary tool prepared by independent experts\"" } ], "legal_basis": [ "ai-act:art-53" ], "brief_part": "part-5", "published": "2025-07-10", "last_verified": "2026-09-27", "verification_note": "Read on 27 Sep 2026 against the Official Journal text of the AI Act: reliance on a code is optional (Arts 53(4) and 55(2)), and codes are to cover the obligations of Arts 53 and 55 (Art. 56(2)). The Digital Omnibus on AI (Regulation (EU) 2026/1744, Art. 1) replaces Art. 56(6) — the Commission now assesses whether codes cover those obligations — and leaves Arts 53(4) and 55(2) unchanged. The Commission's page calls the Code 'a voluntary tool'. Locators added 27 Sep 2026: each source was re-read that day and the locator quotes the sentence that carries the claim." }, { "id": "clm-gpai-code-four-drafts", "type": "claim-type:fact", "statement": "The GPAI Code of Practice was finalised on 10 July 2025 after three drafts and a final text.", "instruments": [ "ai-act" ], "provisions": [ "ai-act:art-53" ], "institutions": [ "ai-office" ], "enforcement": [], "sources": [ { "source_id": "src-ec-gpai-code", "supports": "supports:direct", "locator": "Timeline: '19 December 2024 AI Office publishes the second draft of the Code (first draft)'; '11 March 2025 Third draft of the Code of Practice'; '10 July 2025 The Commission received the final version of the Code'" } ], "legal_basis": [], "brief_part": "part-5", "published": "2025-07-10", "last_verified": "2026-09-27", "verification_note": "Re-read on 27 Sep 2026 (page 'Last update 25 June 2026'): the timeline links the first draft, lists the second (19 December 2024) and third (11 March 2025) drafts, and records the final version received on 10 July 2025, so the page supports the statement directly. Re-read on 2026-09-26: the Commission's timeline shows a first draft, a second draft (19 December 2024), a third draft (11 March 2025) and the final version received on 10 July 2025. The statement now matches the prose, which already said 'three drafts and a final text'. The claim ID keeps 'four-drafts' because IDs are never renamed." }, { "id": "clm-ai-act-standards-not-ready", "type": "claim-type:critique", "statement": "The harmonised standards needed to demonstrate conformity were not ready; requiring conformity assessment against standards that do not exist is not regulation but a trap, and their non-arrival despite being commissioned years in advance is an institutional failure.", "instruments": [ "ai-act" ], "provisions": [ "ai-act:art-6" ], "institutions": [ "ec" ], "enforcement": [], "sources": [ { "source_id": "src-eurlex-ai-omnibus", "supports": "supports:partial", "locator": "Recital 40: 'the delayed availability of standards, common specifications, and alternative guidance and the delayed establishment of national competent authorities lead to challenges that jeopardise the effective entry into application of those obligations'" }, { "source_id": "src-brief-original", "supports": "supports:direct", "locator": "Part V" } ], "legal_basis": [], "brief_part": "part-5", "published": "2026-08-19", "last_verified": "2026-10-14", "verification_note": "14 Oct 2026: the factual premise is anchored, partially, in recital 40 of Regulation (EU) 2026/1744, where the co-legislators give the delayed availability of standards as a reason for postponing the high-risk obligations. Whether any harmonised standard under the AI Act has since been cited in the Official Journal was not checked, so the record says nothing about the standards' state after July 2026. The evaluative half ('a trap', 'an institutional failure') is the author's critique and is typed as such. Earlier note: REQUIRES VERIFICATION. The state of the harmonised standards is not sourced. This is a substantive factual premise underlying the author's critique and should be anchored." }, { "id": "clm-ai-act-delay-scope", "type": "claim-type:law", "statement": "The AI Omnibus delayed the AI Act's high-risk obligations by sixteen months for Annex III systems and twelve for Annex I product-embedded systems, while leaving prohibitions, GPAI duties and transparency close to the original schedule.", "instruments": [ "ai-act", "ai-omnibus" ], "provisions": [ "ai-act:art-6" ], "institutions": [ "ec" ], "enforcement": [], "sources": [ { "source_id": "src-eurlex-ai-omnibus", "supports": "supports:direct", "locator": "Art. 1, point (40)(b), replacing Art. 113, third paragraph, point (c); point (40)(a) (Art. 5 additions from 2 December 2026); point (39)(b) (new Art. 111(4), Art. 50(2) by 2 December 2026); recital 40" }, { "source_id": "src-eurlex-ai-act", "supports": "supports:partial", "locator": "Art. 113 as adopted (general application 2 August 2026; Chapter V from 2 August 2025; Art. 6(1) from 2 August 2027)" }, { "source_id": "src-ec-ai-omnibus-in-force", "supports": "supports:partial", "locator": "Annex III high-risk from 2 December 2027; product-embedded high-risk from 2 August 2028" } ], "legal_basis": [], "brief_part": "part-5", "published": "2026-07-27", "last_verified": "2026-10-14", "verification_note": "Read on 27 Sep 2026 against the Official Journal texts of Regulation (EU) 2026/1744 and Regulation (EU) 2024/1689 (Publications Office's Cellar). Chapter III, Sections 1-3 now apply from 2 December 2027 for Annex III systems (originally the general date, 2 August 2026: sixteen months) and from 2 August 2028 for Annex I systems (originally 2 August 2027 under Art. 113(c): twelve months). The month counts are the site's arithmetic on those dates; recital 40 gives the original and new dates but no count. Chapters I and II (prohibitions) keep 2 February 2025, with two added Art. 5 prohibitions from 2 December 2026; Chapter V (GPAI) keeps 2 August 2025; Art. 50 keeps the general date, with a transition to 2 December 2026 for Art. 50(2) for systems already on the market. Corrected that day: the statement said 'roughly sixteen months' for the whole high-risk tier, which is true only of Annex III; the brief's own prose already said sixteen and twelve. Retyped from fact to law. Re-read 14 Oct 2026 against the Official Journal text of Regulation (EU) 2026/1744 retrieved from EUR-Lex that day; it agrees." }, { "id": "clm-ai-omnibus-in-force", "type": "claim-type:law", "statement": "The AI Omnibus, Regulation (EU) 2026/1744, entered into force on 27 July 2026, amending the AI Act.", "instruments": [ "ai-omnibus", "ai-act" ], "provisions": [], "institutions": [ "ec" ], "enforcement": [], "sources": [ { "source_id": "src-eli-ai-omnibus-2026-1744", "supports": "supports:direct", "locator": "OJ L, 24 July 2026" }, { "source_id": "src-eurlex-ai-omnibus", "supports": "supports:direct", "locator": "Art. 4 (entry into force on the third day following publication); OJ L series, 2026/1744, 24.7.2026" }, { "source_id": "src-ec-ai-omnibus-in-force", "supports": "supports:direct", "locator": "\"On 27 July 2026, the AI Omnibus enters into force across the EU\"" } ], "legal_basis": [], "brief_part": "part-8", "published": "2026-07-27", "last_verified": "2026-10-14", "verification_note": "Resolved 28 Aug 2026 against the ELI record. Published 24 July 2026, in force 27 July 2026. Locator added 27 Sep 2026 from the Official Journal text read that day (Cellar, CELEX 32026R1744): Article 4 provides for entry into force on the third day following publication, and the Journal is dated 24.7.2026, which gives 27 July 2026. Locators added 27 Sep 2026: each source was re-read that day and the locator quotes the sentence that carries the claim. Re-read 14 Oct 2026 against the Official Journal text of Regulation (EU) 2026/1744 retrieved from EUR-Lex that day; it agrees." }, { "id": "clm-ai-act-coherence-objection", "type": "claim-type:critique", "statement": "The AI Act is one instrument in a system that already regulated most of its subject matter: automated decision-making by GDPR Art. 22 since 2018, algorithmic recommender risk by DSA Arts. 34–35, product liability by the revised PLD — while the proposed AI Liability Directive was abandoned, leaving a gap in the fault-based route.", "instruments": [ "ai-act", "gdpr", "dsa", "pld", "ai-liability-directive" ], "provisions": [ "gdpr:art-22", "dsa:art-34" ], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-eurlex-gdpr", "supports": "supports:partial", "locator": "Art. 22" }, { "source_id": "src-eurlex-pld", "supports": "supports:partial", "locator": null }, { "source_id": "src-brief-original", "supports": "supports:direct", "locator": "Part V" } ], "legal_basis": [], "brief_part": "part-5", "published": "2026-08-19", "last_verified": "2026-08-27", "verification_note": null }, { "id": "clm-aild-abandoned", "type": "claim-type:fact", "statement": "The proposed AI Liability Directive was abandoned, leaving a gap in the fault-based liability route.", "instruments": [ "ai-liability-directive" ], "provisions": [], "institutions": [ "ec" ], "enforcement": [], "sources": [ { "source_id": "src-oj-aild-withdrawal-2025", "supports": "supports:direct", "locator": "C/2025/5423, 6 October 2025" }, { "source_id": "src-brief-original", "supports": "supports:direct", "locator": "Part V" } ], "legal_basis": [], "brief_part": "part-5", "published": "2026-08-19", "last_verified": "2026-08-28", "verification_note": "Resolved 28 Aug 2026, and made more precise: announced for withdrawal in the Commission Work Programme 2025 on 11 February 2025 (\"no foreseeable agreement\"), formally withdrawn in the Official Journal on 6 October 2025. The brief's \"abandoned\" is correct but undated." }, { "id": "clm-pld-covers-software", "type": "claim-type:law", "statement": "The revised Product Liability Directive brings software and AI within strict product liability, applying to products placed on the market or put into service after 9 December 2026.", "instruments": [ "pld" ], "provisions": [], "institutions": [ "member-states" ], "enforcement": [], "sources": [ { "source_id": "src-eurlex-pld", "supports": "supports:direct", "locator": "Arts. 2(1), 4(1), recital 13" } ], "legal_basis": [], "brief_part": "part-5", "published": "2024-11-18", "last_verified": "2026-08-27", "verification_note": "The brief's Annex A gives only 'Dec 2026'. The precise date comes from the Official Journal text." }, { "id": "clm-ai-act-art-5-prohibitions", "type": "claim-type:law", "statement": "Article 5 AI Act prohibits manipulative or deceptive techniques, exploitation of vulnerabilities due to age, disability or a social or economic situation, social scoring leading to detrimental treatment, criminal-risk prediction based solely on profiling, untargeted scraping of facial images for facial recognition databases, emotion inference in workplaces and education institutions, biometric categorisation deducing sensitive attributes, and real-time remote biometric identification in publicly accessible spaces for law enforcement, save for narrow exceptions.", "instruments": [ "ai-act" ], "provisions": [ "ai-act:art-5" ], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-eurlex-ai-act", "supports": "supports:direct", "locator": "Art. 5(1)(a)–(h)" } ], "legal_basis": [ "ai-act:art-5" ], "brief_part": "part-5", "published": null, "last_verified": "2026-09-27", "verification_note": "Registered on 27 Sep 2026 for a statement already in the prose that no claim recorded. Checked that day against the Official Journal text (English, retrieved from the Publications Office's Cellar, CELEX 32024R1689): Article 5(1), points (a) to (h), as originally adopted. The two prohibitions the AI Omnibus inserts as points (ba) and (bb) apply from 2 December 2026 (tl-ai-act-2026-12-02-application)." }, { "id": "clm-ai-act-art-50-transparency", "type": "claim-type:law", "statement": "Article 50 AI Act requires that people be informed when they interact with an AI system, that synthetic audio, image, video or text outputs be marked in a machine-readable format, and that deep fakes and AI-generated text published to inform the public on matters of public interest be disclosed.", "instruments": [ "ai-act" ], "provisions": [ "ai-act:art-50" ], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-eurlex-ai-act", "supports": "supports:direct", "locator": "Art. 50(1), (2), (4)" } ], "legal_basis": [ "ai-act:art-50" ], "brief_part": "part-5", "published": null, "last_verified": "2026-09-27", "verification_note": "Registered on 27 Sep 2026 for a statement already in the prose that no claim recorded. Checked that day against the Official Journal text (English, retrieved from the Publications Office's Cellar, CELEX 32024R1689): Article 50(1), (2) and (4). The text-disclosure duty in 50(4) does not apply where the content has undergone human review or editorial control under someone's editorial responsibility." }, { "id": "clm-ai-act-gpai-definition", "type": "claim-type:law", "statement": "Article 3(63) AI Act defines a general-purpose AI model as one that displays significant generality, is capable of competently performing a wide range of distinct tasks and can be integrated into a variety of downstream systems or applications.", "instruments": [ "ai-act" ], "provisions": [ "ai-act:art-3-63" ], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-eurlex-ai-act", "supports": "supports:direct", "locator": "Art. 3(63)" } ], "legal_basis": [ "ai-act:art-3-63" ], "brief_part": "part-5", "published": null, "last_verified": "2026-09-27", "verification_note": "Registered on 27 Sep 2026 for a statement already in the prose that no claim recorded. Checked that day against the Official Journal text (English, retrieved from the Publications Office's Cellar, CELEX 32024R1689): Article 3, point (63)." }, { "id": "clm-ai-act-art-53-duties", "type": "claim-type:law", "statement": "Every provider of a general-purpose AI model must keep technical documentation (Annex XI), provide information to downstream providers (Annex XII), put in place a policy to comply with Union copyright law and publish a sufficiently detailed summary of training content; the documentation duties do not apply to models released under a free and open-source licence, except models with systemic risk.", "instruments": [ "ai-act" ], "provisions": [ "ai-act:art-53" ], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-eurlex-ai-act", "supports": "supports:direct", "locator": "Art. 53(1)(a)–(d); Art. 53(2)" } ], "legal_basis": [ "ai-act:art-53" ], "brief_part": "part-5", "published": null, "last_verified": "2026-09-27", "verification_note": "Registered on 27 Sep 2026 for a statement already in the prose that no claim recorded. Checked that day against the Official Journal text (English, retrieved from the Publications Office's Cellar, CELEX 32024R1689): Article 53(1), points (a) to (d), and 53(2), whose last sentence reads \"This exception shall not apply to general-purpose AI models with systemic risks.\"" }, { "id": "clm-ai-act-art-51-presumption", "type": "claim-type:law", "statement": "Article 51(2) AI Act presumes a general-purpose AI model to have high-impact capabilities, and so systemic risk, when the cumulative compute used for its training exceeds 10^25 floating point operations.", "instruments": [ "ai-act" ], "provisions": [ "ai-act:art-51" ], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-eurlex-ai-act", "supports": "supports:direct", "locator": "Art. 51(1)(a), 51(2)" } ], "legal_basis": [ "ai-act:art-51" ], "brief_part": "part-5", "published": null, "last_verified": "2026-09-27", "verification_note": "Registered on 27 Sep 2026 for a statement already in the prose that no claim recorded. Checked that day against the Official Journal text (English, retrieved from the Publications Office's Cellar, CELEX 32024R1689): Article 51(1)(a) and 51(2)." }, { "id": "clm-ai-omnibus-art-4-literacy", "type": "claim-type:law", "statement": "The AI Omnibus replaced Article 4 of the AI Act: providers and deployers must now take measures to support the development of AI literacy of their staff, and the obligation does not require them to guarantee any specific level of AI literacy — where the original text required measures to ensure a sufficient level.", "instruments": [ "ai-act", "ai-omnibus" ], "provisions": [ "ai-act:art-4" ], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-eurlex-ai-omnibus", "supports": "supports:direct", "locator": "Art. 1, point (5) (replacing Art. 4 AI Act)" } ], "legal_basis": [], "brief_part": "part-5", "published": null, "last_verified": "2026-10-14", "verification_note": "Registered on 27 Sep 2026 for a statement already in the prose that no claim recorded. Checked that day against the Official Journal text (English, retrieved from the Publications Office's Cellar, CELEX 32026R1744): Article 1, point (5), of Regulation (EU) 2026/1744, and the original Article 4 of Regulation (EU) 2024/1689 (\"take measures to ensure, to their best extent, a sufficient level of AI literacy\"). Re-read 14 Oct 2026 against the Official Journal text of Regulation (EU) 2026/1744 retrieved from EUR-Lex that day; it agrees." }, { "id": "clm-ai-omnibus-legislative-path", "type": "claim-type:fact", "statement": "The AI Omnibus was proposed on 19 November 2025; the Council adopted its general approach on 13 March 2026 and Parliament its mandate on 26 March 2026, by 569 votes to 45; agreement was reached on 7 May 2026; Parliament approved the text on 16 June and the Council on 29 June 2026.", "instruments": [ "ai-omnibus", "ai-act" ], "provisions": [], "institutions": [ "ec", "ep", "council" ], "enforcement": [], "sources": [ { "source_id": "src-ep-oeil-ai-omnibus", "supports": "supports:direct", "locator": "Key events: 19/11/2025 proposal (COM(2025)0836); 26/03/2026 decision by Parliament, 1st reading (T10-0098/2026), referred back for interinstitutional negotiations; 16/06/2026 decision by Parliament (T10-0198/2026); 29/06/2026 act adopted by Council. Summary of 26/03/2026: 'adopted by 569 votes to 45 against and 23 abstentions'" }, { "source_id": "src-ep-legtrain-ai-omnibus", "supports": "supports:direct", "locator": "'The Council agreed its general approach on 13 March 2026. The co-legislators reached a trilogue agreement on the file on 7 May 2026'; 'Parliament's plenary approved the agreement on 16 June 2026 ... and the Council adopted the act on 29 June 2026'" }, { "source_id": "src-eurlex-ai-omnibus", "supports": "supports:partial", "locator": "Footnote 4: 'Position of the European Parliament of 16 June 2026 ... and decision of the Council of 29 June 2026'" } ], "legal_basis": [], "brief_part": "part-5", "published": null, "last_verified": "2026-09-27", "verification_note": "Verified on 27 Sep 2026 against Parliament's Legislative Observatory (procedure 2025/0359(COD), key events and the summary of 26 March 2026), the Legislative Train page (information updated 1 August 2026) and footnote 4 of the Official Journal text. Split that day: the collapsed trilogue of 28 April 2026, which no source read here mentions, is now its own claim (clm-ai-omnibus-april-trilogue). The final plenary vote of 16 June was 423 to 57 with 174 abstentions (Legislative Train); the Official Journal gives the adoption date as 8 July 2026, the day the act was signed (tl-ai-omnibus-2026-07-08-adoption)." }, { "id": "clm-ai-omnibus-april-trilogue", "type": "claim-type:fact", "statement": "The second political trilogue on the AI Omnibus, on 28 April 2026, ended without agreement after roughly twelve hours, over how the AI Act interlocks with existing sectoral product-safety law rather than over the delay itself.", "instruments": [ "ai-omnibus" ], "provisions": [], "institutions": [ "ep", "council" ], "enforcement": [], "sources": [ { "source_id": "src-twobirds-ai-omnibus-trilogue-2026", "supports": "supports:direct", "locator": "Opening paragraph: date, 'roughly twelve hours', and the Annex I conformity-assessment architecture as the point of breakdown" }, { "source_id": "src-iapp-ai-omnibus-trilogue-2026", "supports": "supports:partial", "locator": "'after 12 hours of negotiations in Brussels fell apart 28 April'; the second and final scheduled session" }, { "source_id": "src-brief-original", "supports": "supports:direct", "locator": "Part V" } ], "legal_basis": [], "brief_part": "part-5", "published": null, "last_verified": "2026-09-27", "verification_note": "27 Sep 2026: now stated whole by Bird & Bird (5 May 2026) and, for the date, the second session and the twelve hours, independently by the IAPP (29 April 2026, the day after). Both are commentary (tier 4), so the claim grades Secondary, not Official: no institution's own account was readable here (the Council's press pages return HTTP 403; Parliament's release of 7 May 2026 does not mention the failed session). The reference gap is cleared because its note — 'no source stating them has been located' — is no longer true. Split from clm-ai-omnibus-legislative-path on 27 Sep 2026. Neither Parliament's Legislative Observatory, the Legislative Train page nor Parliament's press release of 7 May 2026 ('Early Thursday morning, Parliament and Council negotiators reached a provisional deal') mentions a failed trilogue on 28 April; the press release does list 'No overlapping rules for machinery product safety' among the outcomes, which is consistent with the stated cause but does not establish it. The Council's press releases returned HTTP 403 in this environment." }, { "id": "clm-gpai-guidelines-10-23", "type": "claim-type:fact", "statement": "The Commission's July 2025 guidelines on general-purpose AI models add an indicative criterion: a model trained with more than 10^23 FLOP that can generate language, text-to-image or text-to-video output.", "instruments": [ "ai-act" ], "provisions": [ "ai-act:art-3-63" ], "institutions": [ "ec" ], "enforcement": [], "sources": [ { "source_id": "src-ec-gpai-guidelines-2025", "supports": "supports:direct", "locator": "Commission news item and FAQ on the GPAI guidelines: \"indicative criterion\"" } ], "legal_basis": [], "brief_part": "part-5", "published": "2025-07-18", "last_verified": "2026-09-26", "verification_note": "Registered on 27 Sep 2026 for the clause in Part V. The source record, read on 26 Sep 2026, reports the criterion from the Commission's news item and FAQ, which calls it indicative and allows exceptions; the guidelines themselves were not opened." }, { "id": "clm-data-act-non-personal", "type": "claim-type:law", "statement": "Where the GDPR governs personal data, the Data Act governs product and service data as such — personal or not, though predominantly non-personal, industrial and machine-generated, with the GDPR prevailing wherever personal data is involved — and reallocates control over it by default.", "instruments": [ "data-act", "gdpr" ], "provisions": [], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-eurlex-data-act", "supports": "supports:partial", "locator": "Art. 1(2): 'This Regulation covers personal and non-personal data'; Art. 1(5): 'In the event of a conflict between this Regulation and Union law on the protection of personal data or privacy … the relevant Union or national law on the protection of personal data or privacy shall prevail'" }, { "source_id": "src-brief-original", "supports": "supports:direct", "locator": "Part VI" } ], "legal_basis": [], "brief_part": "part-6", "published": "2023-12-22", "last_verified": "2026-10-22", "verification_note": "Corrected on 2026-09-26 (audit T-13): the earlier wording implied the Data Act concerns non-personal data. Art. 1(2) says it covers personal and non-personal data, and Art. 1(5) that data-protection law prevails in a conflict. Read from an unofficial reproduction (EUR-Lex returns HTTP 202 with no body here). 'Predominantly non-personal, industrial and machine-generated' remains the brief's characterisation. Checked 27 Sep 2026 against the Official Journal text read on 27 Sep 2026 from the Publications Office's Cellar (CELEX 32023R2854): Article 1(2) covers personal and non-personal data, and Article 1(5) makes data-protection law prevail in a conflict. \"Predominantly non-personal, industrial and machine-generated\" and \"reallocates control by default\" are the brief's characterisation, so the reference stays partial. The unofficial reproduction (src-da-text-unofficial-arts-1-50), read for the same two paragraphs on 26 Sep 2026, was removed from this claim on 27 Sep 2026: the Official Journal reading supersedes it and it added no support. 22 Oct 2026 (audit, evidence item clm-data-act-non-personal, which said Art. 1(2) and 1(5) were read from an unofficial reproduction): that was corrected on 27 Sep 2026, and both paragraphs were read again on 22 Oct 2026 in the Official Journal text (XHTML manifestation of CELEX 32023R2854 from the Publications Office's Cellar); the locator now quotes them. The OJ text supports the scope and the precedence rule, so the reference stays partial: 'predominantly non-personal, industrial and machine-generated' and 'reallocates control over it by default' are the brief's characterisation, which is why the brief remains a source." }, { "id": "clm-data-act-switching-numbers", "type": "claim-type:law", "statement": "Data Act Article 25 prescribes hard-edged switching terms: maximum two-month notice to initiate switching, a 30-calendar-day transitional period (or a justified alternative not exceeding seven months where technically unfeasible), at least 30 days data retrieval afterwards, and full erasure once retrieval ends.", "instruments": [ "data-act" ], "provisions": [ "data-act:art-25" ], "institutions": [ "nca-*" ], "enforcement": [], "sources": [ { "source_id": "src-eurlex-data-act", "supports": "supports:direct", "locator": "Art. 25(2)(a), (d), (g), (h); Art. 25(4)" }, { "source_id": "src-brief-original", "supports": "supports:direct", "locator": "Part VI" } ], "legal_basis": [ "data-act:art-25" ], "brief_part": "part-6", "published": "2023-12-22", "last_verified": "2026-09-27", "verification_note": "The article exists and governs switching contract terms; the specific periods have not been checked against the text in this build. Checked 27 Sep 2026 against the Official Journal text read on 27 Sep 2026 from the Publications Office's Cellar (CELEX 32023R2854): Article 25(2)(d) (notice \"shall not exceed two months\"), 25(2)(a) (transitional period of 30 calendar days), 25(4) (alternative period \"which shall not exceed seven months\"), 25(2)(g) (retrieval of at least 30 calendar days) and 25(2)(h) (full erasure)." }, { "id": "clm-data-act-art-3-application", "type": "claim-type:law", "statement": "The Data Act Article 3(1) design obligation — connected products must be built so that product and related service data are accessible to the user by default — applies to connected products and related services placed on the market after 12 September 2026.", "instruments": [ "data-act" ], "provisions": [ "data-act:art-3-1" ], "institutions": [ "nca-*" ], "enforcement": [], "sources": [ { "source_id": "src-eurlex-data-act", "supports": "supports:direct", "locator": "Art. 50, third paragraph" }, { "source_id": "src-da-text-unofficial-arts-1-50", "supports": "supports:partial", "locator": "Art. 50" }, { "source_id": "src-brief-original", "supports": "supports:direct", "locator": "Part VI, Annex A" } ], "legal_basis": [ "data-act:art-3-1" ], "brief_part": "part-6", "published": "2023-12-22", "last_verified": "2026-09-27", "verification_note": "Art. 50 read on 2026-09-26 from an unofficial reproduction of the text (EUR-Lex returns HTTP 202 with no body here): 'The obligation resulting from Article 3(1) shall apply to connected products and the services related to them placed on the market after 12 September 2026.' Not yet checked against the Official Journal text. Checked 27 Sep 2026 against the Official Journal text read on 27 Sep 2026 from the Publications Office's Cellar (CELEX 32023R2854): Article 50, third paragraph — \"The obligation resulting from Article 3(1) shall apply to connected products and the services related to them placed on the market after 12 September 2026.\"" }, { "id": "clm-data-act-trade-secret-tension", "type": "claim-type:critique", "statement": "The Data Act's trade-secret carve-out may swallow the rule or be swallowed by it: data holders may limit access where data qualifies as a trade secret, but practitioners doubt the required confidentiality measures are sufficient.", "instruments": [ "data-act" ], "provisions": [], "institutions": [ "nca-*" ], "enforcement": [], "sources": [ { "source_id": "src-brief-original", "supports": "supports:direct", "locator": "Part VI" } ], "legal_basis": [], "brief_part": "part-6", "published": "2026-08-19", "last_verified": "2026-08-27", "verification_note": "The author's critique, resting on unnamed practitioner commentary." }, { "id": "clm-data-act-retroactivity-open", "type": "claim-type:interpretation", "statement": "Data Act Article 50 phases in Chapter IV for pre-existing contracts but contains no equivalent carve-out for Chapter VI, and practitioner analysis reads the switching right as applying to contracts concluded before 12 September 2025 as well; the Commission's Data Act FAQ (version 1.4, January 2026) does not address the point directly.", "instruments": [ "data-act" ], "provisions": [ "data-act:art-25" ], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-da-text-unofficial-arts-1-50", "supports": "supports:partial", "locator": "Art. 50" }, { "source_id": "src-dlapiper-data-act-switching-2025", "supports": "supports:partial", "locator": null }, { "source_id": "src-ec-data-act-faq-v1-4", "supports": "supports:context", "locator": "Questions 42b, 52-58b" }, { "source_id": "src-brief-original", "supports": "supports:direct", "locator": "Part VI" } ], "legal_basis": [], "brief_part": "part-6", "published": "2026-08-19", "last_verified": "2026-09-26", "verification_note": "Rewritten on 2026-09-26 (audit T-13). The earlier statement called the point 'genuinely open in the text'; Art. 50 in fact phases in only Chapter IV for pre-existing contracts. Read from an unofficial reproduction of the text (EUR-Lex returns HTTP 202 with no body here). That the switching right reaches earlier contracts is one law firm's reading (DLA Piper, 31 July 2025), not guidance; the Commission's FAQ v1.4 was read and is silent on it. A Digital Omnibus proposal reportedly addresses pre-existing contracts for some services; not read, and not law. The claim ID keeps 'open' because IDs are never renamed." }, { "id": "clm-data-act-enforcement-uneven", "type": "claim-type:interpretation", "statement": "Data Act enforcement is national and therefore uneven: each Member State designates its own competent authorities, and Ireland — one of Europe's main data-centre hubs — published the General Scheme of its Data Bill only on 4 February 2026, with no Bill introduced in the Oireachtas by late September 2026.", "instruments": [ "data-act" ], "provisions": [], "institutions": [ "nca-*" ], "enforcement": [], "sources": [ { "source_id": "src-eurlex-data-act", "supports": "supports:partial", "locator": "Art. 37(1): 'Each Member State shall designate one or more competent authorities to be responsible for the application and enforcement of this Regulation'" }, { "source_id": "src-brief-original", "supports": "supports:direct", "locator": "Part VI" } ], "legal_basis": [], "brief_part": "part-6", "published": "2026-08-19", "last_verified": "2026-09-27", "verification_note": "Atomized and retyped (fact → interpretation) on 27 Sep 2026. Its three factual premises are now their own claims, each on the source that states it: the General Scheme and its designations (clm-ie-data-bill-general-scheme, the Irish government's page), the Bill not yet introduced (clm-ie-data-bill-not-introduced, the Oireachtas register), and Dublin's place among Europe's main data-centre hubs (clm-ie-data-centre-hub, the report the Irish government published). That enforcement is national is Data Act Art. 37(1), read in the Official Journal text (CELEX 32023R2854). What remains here — that national enforcement is therefore uneven — is the brief's argument. Two corrections in the prose (all four languages): 'host to a large share of Europe's cloud infrastructure' became 'one of Europe's main data-centre hubs', because no source gives a share; 'still in pre-legislative scrutiny in mid-2026' became 'no Bill introduced in the Oireachtas by late September 2026', which the parliament's register states. Reference gap cleared: its note named the cloud-share phrase, which is gone. Earlier history: 27 Sep 2026: the Oireachtas's own bills register shows no Data Bill introduced in 2025 or 2026 (to 25 Sep 2026), which confirms from the parliament itself that the Bill had not left the pre-legislative stage by mid-2026. Still unsourced: 'host to a large share of Europe's cloud infrastructure', so the claim stays without a single source stating it whole. 27 Sep 2026: the publication date and the designations are now read on the Irish government's own page (Department of Enterprise, Tourism and Employment: 'General Scheme of the Data Bill 2025', published 4 February 2026, last updated 10 July 2026). Its official title is the Data Bill 2025. Whether the Bill had left pre-legislative scrutiny by mid-2026 is not stated there, so that part still rests on Matheson (May 2026). The Irish facts are now sourced to Matheson (18 May 2026): General Scheme published 4 February 2026, ComReg and the CCPC appointed, pre-legislative scrutiny continuing. Law-firm commentary, hence partial; the General Scheme itself was not opened, and 'mid-2026' rests on an article dated May. 'Host to a large share of Europe's cloud infrastructure' is still unsourced, so the reference gap is left set." }, { "id": "clm-ie-data-bill-general-scheme", "type": "claim-type:fact", "statement": "Ireland published the General Scheme of its Data Bill 2025 on 4 February 2026; it designates the CCPC and ComReg as competent authorities for the Data Act, and the CCPC as Data Coordinator.", "instruments": [ "data-act" ], "provisions": [], "institutions": [ "nca-*" ], "enforcement": [], "sources": [ { "source_id": "src-gov-ie-data-bill-2025", "supports": "supports:direct", "locator": "Publication page: 'Published on: 4 February 2026'; the CCPC and ComReg 'are designated as competent authorities for the Data Act. The CCPC is also designated as the Data Coordinator'" }, { "source_id": "src-matheson-ie-data-bill-2026", "supports": "supports:partial", "locator": "Section on the General Scheme" } ], "legal_basis": [], "brief_part": "part-6", "published": "2026-08-19", "last_verified": "2026-09-27", "verification_note": "Split on 27 Sep 2026 out of clm-data-act-enforcement-uneven, which carried four propositions. Read that day on the Department of Enterprise, Tourism and Employment's own page (last updated 10 July 2026)." }, { "id": "clm-ie-data-bill-not-introduced", "type": "claim-type:fact", "statement": "No Data Bill had been introduced in the Oireachtas by 25 September 2026: none appears among the bills of 2025 or of 2026 in its register.", "instruments": [ "data-act" ], "provisions": [], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-oireachtas-bills-2025-2026", "supports": "supports:direct", "locator": "no Data Bill among the 85 bills of 2025 or the 92 of 2026 (register updated to 25 Sep 2026)" } ], "legal_basis": [], "brief_part": "part-6", "published": "2026-08-19", "last_verified": "2026-09-27", "verification_note": "Split on 27 Sep 2026 out of clm-data-act-enforcement-uneven. The brief said the Bill 'was still in pre-legislative scrutiny in mid-2026'; that rested on law-firm commentary (Matheson, May 2026). The parliament's own register supports the narrower and later statement recorded here, and the prose now says that instead. A register can only show what has been introduced: it is read on a date, and this claim is true on that date." }, { "id": "clm-ie-data-centre-hub", "type": "claim-type:attributed", "statement": "Dublin is one of Europe's main data-centre hubs, alongside Frankfurt, London, Amsterdam and Paris (the 'FLAP-D' markets).", "attributed_to": "KPMG, 'The value of data centres to Ireland', an independent report for the Irish Department of Enterprise, Tourism and Employment (March 2026, published 2 June 2026)", "instruments": [ "data-act" ], "provisions": [], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-dete-value-of-data-centres-2026", "supports": "supports:direct", "locator": "Executive summary: 'a strategic European data centre hub, alongside Frankfurt, London, Amsterdam, and Paris – collectively known as the FLAP-D markets'" } ], "legal_basis": [], "brief_part": "part-6", "published": "2026-08-19", "last_verified": "2026-09-27", "verification_note": "Split on 27 Sep 2026 out of clm-data-act-enforcement-uneven, which called Ireland 'host to a large share of Europe's cloud infrastructure'. No source read gives Ireland's share of European cloud or data-centre capacity; the report the Irish government published places Dublin among the five main European hubs and gives no share. The prose now says what the source says." }, { "id": "clm-nis2-management-liability", "type": "claim-type:law", "statement": "NIS2 Article 20(1) requires management bodies to approve and oversee the cybersecurity risk-management measures and provides that they can be held liable for the entity's infringements; for essential entities, Article 32(6) additionally requires that the natural persons responsible can be held liable for breaching their duties.", "instruments": [ "nis2" ], "provisions": [ "nis2:art-20" ], "institutions": [ "nca-*" ], "enforcement": [], "sources": [ { "source_id": "src-eurlex-nis2", "supports": "supports:direct", "locator": "Art. 20" }, { "source_id": "src-nis2-text-unofficial-arts-20-32", "supports": "supports:partial", "locator": "Arts. 20(1), 32(6)" } ], "legal_basis": [ "nis2:art-20" ], "brief_part": "part-7", "published": "2022-12-27", "last_verified": "2026-09-26", "verification_note": "Corrected on 2026-09-26 (audit T-12). Art. 20(1) makes management bodies of essential and important entities liable for the entity's infringements of Art. 21, which is not the same as personal liability; personal liability of the natural persons responsible is Art. 32(6), and only for essential entities. Both read from an unofficial reproduction of Directive (EU) 2022/2555 (EUR-Lex returns HTTP 202 with no body here); not yet checked against the Official Journal text. How national transpositions implement either provision is not covered." }, { "id": "clm-nis2-only-four-on-time", "type": "claim-type:derived", "statement": "Only four of twenty-seven Member States met the NIS2 transposition deadline of 17 October 2024.", "instruments": [ "nis2" ], "provisions": [], "institutions": [ "member-states", "ec" ], "enforcement": [], "sources": [ { "source_id": "src-ec-nis2-lfn-2024", "supports": "supports:partial", "locator": "First paragraph: letters of formal notice to 23 named Member States; 'sending letters of formal notice to the other 23 Member States'" } ], "legal_basis": [], "brief_part": "part-7", "published": "2024-11-28", "last_verified": "2026-09-27", "verification_note": "Retyped from fact to derived on 27 Sep 2026, as the earlier note recommended: no official source says 'four'. The Commission's release of 28 November 2024 (re-read that day) names the 23 Member States sent letters of formal notice for failing to fully transpose; the four it does not name are Belgium, Croatia, Italy and Lithuania. 'Met the deadline' is the site's reading of not being pursued: the release establishes that those four were not sent a letter on 28 November 2024, not the date on which each notified full transposition.", "derivation": { "performed_by": "site", "method": "The 27 Member States less the twenty-three the Commission sent letters of formal notice for failing to fully transpose NIS2 by 17 October 2024.", "inputs": { "a": { "claim": "clm-nis2-transposition-failure", "value": 23, "as_stated": "twenty-three" } }, "formula": "27 - a", "result": 4, "unit": "Member States", "rounding": { "to": 1, "stated_value": 4 } } }, { "id": "clm-nis2-transposition-failure", "type": "claim-type:fact", "statement": "The Commission sent letters of formal notice to twenty-three Member States in November 2024, reasoned opinions to nineteen in May 2025, and on 8 July 2026 referred Ireland, Spain, France and the Netherlands to the Court of Justice requesting financial sanctions.", "instruments": [ "nis2" ], "provisions": [], "institutions": [ "ec", "cjeu", "member-states" ], "enforcement": [], "sources": [ { "source_id": "src-ec-nis2-lfn-2024", "supports": "supports:direct", "locator": "\"sending letters of formal notice to the other 23 Member States\"" }, { "source_id": "src-ec-nis2-referral-2026", "supports": "supports:direct", "locator": "\"letters of formal notice on 28 November 2024 and reasoned opinions on 7 May 2025\"; \"Spain, France, Ireland and the Netherlands\"; \"a request to the Court to impose financial sanctions\"" } ], "legal_basis": [], "brief_part": "part-7", "published": "2026-07-08", "last_verified": "2026-09-27", "verification_note": "The letters of formal notice and the referral are directly sourced. The intermediate step — nineteen reasoned opinions in May 2025 — is NOT sourced and requires verification. Locators added 27 Sep 2026: each source was re-read that day and the locator quotes the sentence that carries the claim. Neither release gives the number of reasoned opinions (\"nineteen\" in the statement); that figure is not located." }, { "id": "clm-nis2-italy-regime-running", "type": "claim-type:fact", "statement": "Italy transposed NIS2 by Legislative Decree 138 of 4 September 2024; entities registered with its national authority, ACN, between 1 December 2024 and 28 February 2025, and the list of NIS entities was consolidated in April 2025.", "instruments": [ "nis2" ], "provisions": [], "institutions": [ "nca-*" ], "enforcement": [], "legal_basis": [], "sources": [ { "source_id": "src-acn-nis-obblighi-2026", "supports": "supports:direct", "locator": "La normativa: 'Con il decreto legislativo 4 settembre 2024, n. 138'; Obblighi: 'Dal 1° dicembre 2024 e non oltre il 28 febbraio 2025 … devono registrarsi'; 'consolidamento dell'elenco dei soggetti NIS (aprile 2025)'" } ], "brief_part": "part-7", "published": null, "last_verified": "2026-10-22", "verification_note": "Registered 22 Oct 2026 (audit, evidence item clm-nis2-enforcement-despite-transposition), read that day on ACN's own pages. It says that the Italian regime is running, which is what the authority states; it does not say that inspections or sanctions have taken place, which ACN's pages do not state." }, { "id": "clm-nis2-enforcement-despite-transposition", "type": "claim-type:fact", "statement": "No officially published NIS2 fine decision by a national authority had been located as of 22 October 2026; figures circulating for Belgium, Italy, Hungary and other Member States come from commercial trackers that cite no regulator decision.", "instruments": [ "nis2" ], "provisions": [], "institutions": [ "nca-*" ], "enforcement": [], "sources": [ { "source_id": "src-legiscope-nis2-tracker-2026", "supports": "supports:partial", "locator": null } ], "legal_basis": [], "brief_part": "part-7", "published": "2026-08-19", "last_verified": "2026-10-22", "verification_note": "22 Oct 2026 (audit, evidence item clm-nis2-enforcement-despite-transposition): split and dated. 'Supervision has begun' rested on Legiscope alone; it is now clm-nis2-italy-regime-running, sourced to ACN, the Italian authority, and says what ACN states rather than 'supervision'. This claim keeps only the negative, dated: a search on 22 Oct 2026 found vendor pages listing NIS2 fines (Belgium, Italy, Hungary, Lithuania, Germany) that cite no decision, press release or register entry, and none was found on a regulator's site. True only at that date. Earlier statement: 'Supervision under NIS2 has begun regardless of the transposition failure, but no officially published NIS2 fine decision has been located for this brief; figures circulating for Belgium, Italy and Hungary come from commercial trackers that describe their own numbers as indicative.' REQUIRES VERIFICATION. No entity, date, amount or authority naming an official NIS2 fine decision has been located. The one located source (Legiscope, a commercial NIS2-compliance vendor) explicitly describes its own figures as directional/indicative, not as decisions. The corresponding enforcement record (enf-nis2-first-fines) has been removed rather than kept as a placeholder that could be read as a countable action.", "reference_gap": true, "gap_note": "No official source located naming any first NIS2 fine in Belgium, Italy or Hungary. The only located source is a vendor tracker that disclaims its own figures as indicative." }, { "id": "clm-directives-underperform", "type": "claim-type:interpretation", "statement": "The EU's directive-based instruments underperform its regulation-based ones badly — the strongest single argument for the regulation-first drafting approach used elsewhere in the rulebook.", "instruments": [ "nis2", "cer", "dora", "cra" ], "provisions": [], "institutions": [ "member-states" ], "enforcement": [], "sources": [ { "source_id": "src-ec-nis2-referral-2026", "supports": "supports:partial", "locator": null }, { "source_id": "src-brief-original", "supports": "supports:direct", "locator": "Part VII" } ], "legal_basis": [], "brief_part": "part-7", "published": "2026-08-19", "last_verified": "2026-08-27", "verification_note": "The NIS2 transposition failure is directly sourced and supports the comparison; the generalisation is the author's.", "premises": [ "clm-nis2-only-four-on-time", "clm-nis2-transposition-failure" ] }, { "id": "clm-nis2-art-21-measures", "type": "claim-type:law", "statement": "Article 21(2) NIS2 lists ten minimum cybersecurity risk-management measures, including risk analysis, incident handling, business continuity, supply-chain security, basic cyber hygiene, cryptography and multi-factor authentication.", "instruments": [ "nis2" ], "provisions": [], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-eurlex-nis2", "supports": "supports:direct", "locator": "Art. 21(2)(a)–(j)" } ], "legal_basis": [], "brief_part": "part-7", "published": null, "last_verified": "2026-09-27", "verification_note": "Registered on 27 Sep 2026 for a statement already in the prose that no claim recorded. Checked that day against the Official Journal text (English, retrieved from the Publications Office's Cellar, CELEX 32022L2555): Article 21(2), points (a) to (j)." }, { "id": "clm-nis2-art-23-reporting", "type": "claim-type:law", "statement": "Article 23 NIS2 requires an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours and a final report within one month of the notification.", "instruments": [ "nis2" ], "provisions": [], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-eurlex-nis2", "supports": "supports:direct", "locator": "Art. 23(4)(a), (b), (d)" } ], "legal_basis": [], "brief_part": "part-7", "published": null, "last_verified": "2026-09-27", "verification_note": "Registered on 27 Sep 2026 for a statement already in the prose that no claim recorded. Checked that day against the Official Journal text (English, retrieved from the Publications Office's Cellar, CELEX 32022L2555): Article 23(4), points (a), (b) and (d)." }, { "id": "clm-nis2-art-32-6-personal-liability", "type": "claim-type:law", "statement": "For essential entities, Article 32(6) NIS2 requires that the natural persons responsible for or representing the entity can be held liable for breach of their duties to ensure compliance.", "instruments": [ "nis2" ], "provisions": [], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-eurlex-nis2", "supports": "supports:direct", "locator": "Art. 32(6)" } ], "legal_basis": [], "brief_part": "part-7", "published": null, "last_verified": "2026-09-27", "verification_note": "Registered on 27 Sep 2026 for a statement already in the prose that no claim recorded. Checked that day against the Official Journal text (English, retrieved from the Publications Office's Cellar, CELEX 32022L2555): Article 32(6)." }, { "id": "clm-nis2-art-34-4-fines", "type": "claim-type:law", "statement": "For essential entities infringing Article 21 or 23, NIS2 requires Member States to provide for administrative fines with a maximum of at least EUR 10 million or at least 2% of total worldwide annual turnover, whichever is higher.", "instruments": [ "nis2" ], "provisions": [], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-eurlex-nis2", "supports": "supports:direct", "locator": "Art. 34(4)" } ], "legal_basis": [], "brief_part": "part-7", "published": null, "last_verified": "2026-09-27", "verification_note": "Registered on 27 Sep 2026 for a statement already in the prose that no claim recorded. Checked that day against the Official Journal text (English, retrieved from the Publications Office's Cellar, CELEX 32022L2555): Article 34(4). The prose used to say the \"ceilings reach\" those amounts; the Directive sets the minimum that each national maximum must reach, not a ceiling. The prose was corrected to the Article on the same day." }, { "id": "clm-omnibus-is-a-concession", "type": "claim-type:interpretation", "statement": "The November 2025 Digital Omnibus is an official concession that the rulebook the Union spent six years building requires structural repair before it has finished arriving.", "instruments": [ "data-omnibus", "ai-omnibus" ], "provisions": [], "institutions": [ "ec" ], "enforcement": [], "sources": [ { "source_id": "src-ep-legtrain-digital-package", "supports": "supports:partial", "locator": null }, { "source_id": "src-brief-original", "supports": "supports:direct", "locator": "Part VIII" } ], "legal_basis": [], "brief_part": "part-8", "published": "2025-11-19", "last_verified": "2026-08-27", "verification_note": "The publication is sourced; the 'concession' reading is the author's and is typed as interpretation." }, { "id": "clm-omnibus-four-gdpr-reforms", "type": "claim-type:law", "statement": "The Commission's four principal proposed GDPR reforms were: an entity-relative test for personal data in Art. 4(1); a new Art. 41a empowering the Commission to set, by implementing acts, the means and criteria for determining when pseudonymised data ceases to be personal; relocation of cookie consent into a new Art. 88a; and a new Art. 88c providing an explicit legitimate-interest basis for AI model training. None is law.", "instruments": [ "data-omnibus", "gdpr" ], "provisions": [], "institutions": [ "ec" ], "enforcement": [], "sources": [ { "source_id": "src-eurlex-data-omnibus-837", "supports": "supports:direct", "locator": "Art. 3 (amendments to Regulation (EU) 2016/679): point 1(a) (Art. 4(1), added sentences), point 10 (new Art. 41a), point 15 (new Arts 88a and 88c)" }, { "source_id": "src-brief-original", "supports": "supports:direct", "locator": "Part VIII" } ], "legal_basis": [], "brief_part": "part-8", "published": "2025-11-19", "last_verified": "2026-09-27", "verification_note": "Checked on 27 Sep 2026 against the text of COM(2025) 837 final (the English PDF of the act, retrieved from the Publications Office's Cellar). Art. 3, point 1(a) adds to Art. 4(1) GDPR that information 'shall not be personal for a given entity where that entity cannot identify the natural person'; point 10 inserts Art. 41a ('The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities'); point 15 inserts Art. 88a (storing or accessing personal data in terminal equipment only with consent) and Art. 88c (legitimate interests for processing in the development and operation of AI systems and models). Corrected that day in the brief and its three translations: Art. 41a was described as empowering the Commission 'to determine when' pseudonymised data ceases to be personal; it empowers the Commission to set means and criteria for that determination. 'Principal' is the brief's selection." }, { "id": "clm-edpb-edps-omnibus-pushback", "type": "claim-type:attributed", "statement": "The EDPB and EDPS adopted Joint Opinion 1/2026 on the AI Omnibus and Joint Opinion 2/2026 on the Data Omnibus, holding in the second that the personal-data definition change goes far beyond a targeted modification and would significantly narrow the concept, that the Art. 41a implementing-act power should not be entrusted to the Commission, and that Art. 88c is unnecessary.", "instruments": [ "data-omnibus", "ai-omnibus", "gdpr" ], "provisions": [], "institutions": [ "edpb", "edps" ], "enforcement": [], "sources": [ { "source_id": "src-edpb-jo-2-2026", "supports": "supports:direct", "locator": "Paras 17 ('significantly narrowing the concept of personal data') and 21 ('goes far beyond a targeted modification of the GDPR'); paras 23 and 25 (applying the definitions is for supervisory authorities; 'suggest deleting proposed Article 41a GDPR'); para 39 ('it is not necessary to add a specific provision to the GDPR on this point')" }, { "source_id": "src-edpb-jo-1-2026", "supports": "supports:partial", "locator": "Title page: Joint Opinion 1/2026 on the Digital Omnibus on AI, adopted on 20 January 2026" } ], "legal_basis": [], "brief_part": "part-8", "published": "2026-01-20", "last_verified": "2026-09-27", "verification_note": "Both opinions read on 27 Sep 2026 in the PDFs the EDPB publishes. The three positions are all in Joint Opinion 2/2026 (adopted 10 February 2026); Joint Opinion 1/2026 (adopted 20 January 2026) concerns the AI Omnibus and supports only its own adoption, so it is recorded as partial. Corrected that day: the statement and the brief read as though both opinions held all three positions. 'Should not be entrusted to the Commission' paraphrases para 23 (it 'should be the competence of supervisory authorities, under the control of the competent courts, to apply the definitions of the GDPR') and para 25 (delete Art. 41a). Retyped from fact to attributed on 27 Sep 2026: the statement reports what the European Data Protection Board and the European Data Protection Supervisor said; the site does not adopt the position, and the evidence it owes is that actor's own text.", "attributed_to": "the European Data Protection Board and the European Data Protection Supervisor, Joint Opinion 2/2026 on the Digital Omnibus (10 February 2026)" }, { "id": "clm-data-omnibus-stalled", "type": "claim-type:fact", "statement": "The Data Omnibus has moved in both directions before the Council: by May 2026 successive Cypriot Presidency texts had deleted three of the Commission's four principal GDPR reforms, the Cypriot Presidency withdrew its text from COREPER in late June 2026 for lack of a qualified majority, and the Irish Presidency's revised compromise of 3 September 2026 then restored an AI legitimate-interest clause (as a new Article 88 bis, without the Commission's safeguards) and moved pseudonymised data into a new Article 25a.", "instruments": [ "data-omnibus" ], "provisions": [], "institutions": [ "council", "ec" ], "enforcement": [], "sources": [ { "source_id": "src-privacynext-2026-omnibus", "supports": "supports:direct", "locator": null }, { "source_id": "src-icle-omnibus-2026-06", "supports": "supports:direct", "locator": "Paragraph citing 'Council document 9547/26' of 21 May: the compromise 'deletes three of the Commission's four principal GDPR reforms'" }, { "source_id": "src-ppcland-omnibus-2026-09", "supports": "supports:direct", "locator": "Sections 'The clause, line by line' (ST 12535/26, 3 September 2026; the AI clause renumbered Article 88 bis) and 'Personal data after the SRB judgment' (new Article 25a)" }, { "source_id": "src-council-st-12535-2026", "supports": "supports:partial", "locator": "Annex: 'Article 88c88 bis'; 'Article 29a25a' (renumbering; the deletions are struck through in the original)" } ], "legal_basis": [], "brief_part": "part-8", "published": "2026-07-08", "last_verified": "2026-09-26", "verification_note": "No official Council document has been read directly (documents WK 11020/2026 ADD 4, ST 9547/26 and ST 12535/26 are cited via commentary and specialist press reporting on leaked restricted texts, not via the Council's own register). Highly time-sensitive: a Council mandate could form at any point. Re-verify before every publication. Locators added 27 Sep 2026 for the ICLE and PPC Land articles, re-read that day; privacynext.eu reset the connection on two attempts, so the COREPER withdrawal was not re-read and its reference still has no locator. 14 Oct 2026: the closing sentence ('As of 25 September 2026 the Council has no agreed mandate and trilogues have not begun.') was moved out of this record, which now carries the Council's movements up to September; the later state is in clm-data-omnibus-council-october (Council) and clm-data-omnibus-parliament-stage (Parliament). Nothing else in this record was re-read that day. 21 Oct 2026: ST 12535/26 is now on the Council's register and was read there. It confirms the date (3 September 2026) and the renumbering to Article 88 bis and Article 25a; which safeguards are struck cannot be read from its text layer, so it is recorded as partial support and the PPC Land reference stays." }, { "id": "clm-data-omnibus-st-13112", "type": "claim-type:fact", "statement": "A further Presidency revised compromise text on the Digital Omnibus, ST 13112/26, was the basis of the Antici Group (Simplification) meeting of 25 September 2026.", "instruments": [ "data-omnibus" ], "provisions": [], "institutions": [ "council" ], "enforcement": [], "legal_basis": [], "brief_part": "part-8", "last_verified": "2026-10-21", "published": "2026-09-17", "sources": [ { "source_id": "src-council-cm-4156-2026", "supports": "supports:direct", "locator": "Item 1: 'Exchange of views based on the Presidency revised compromise text — ST 13112/26 (Presidency revised compromise text – to be issued)'" }, { "source_id": "src-council-st-13886-2026", "supports": "supports:partial", "locator": "§7: meetings on '11 September, and 25 September'; 'the Presidency presented two revised compromise texts'" } ], "verification_note": "Registered 21 Oct 2026 (audit item 2), read that day. The agenda names the document but gives it no date of its own; the audit brief's '21 September' is not established by anything read, so the claim dates the meeting, not the text. ST 13112/26 itself was not found on the Council's register." }, { "id": "clm-data-omnibus-draft-mandate", "type": "claim-type:fact", "statement": "On 2 October 2026 the Council's General Secretariat put a 163-page draft mandate for negotiations with the European Parliament on the Digital Omnibus, ST 13886/26, to the Permanent Representatives Committee.", "instruments": [ "data-omnibus" ], "provisions": [], "institutions": [ "council" ], "enforcement": [], "legal_basis": [], "brief_part": "part-8", "last_verified": "2026-10-21", "published": "2026-10-02", "sources": [ { "source_id": "src-council-st-13886-2026", "supports": "supports:direct", "locator": "Cover note: 'Brussels, 2 October 2026'; 'To: Permanent Representatives Committee'; '- Mandate for negotiations with the European Parliament'; 163 pages" } ], "verification_note": "Registered 21 Oct 2026 (audit item 2), read that day in the copy Agence Europe distributes; the document is LIMITE and not on the Council's register, so only its cover facts are used (see the source note)." }, { "id": "clm-data-omnibus-coreper-21-october", "type": "claim-type:fact", "statement": "According to Agence Europe, a revised version of the Irish Presidency's text, with stronger protection for trade secrets and a Commission report on the proportionality of SMEs' obligations, was due before Coreper on 21 October 2026 with a view to a negotiating mandate; no outcome of that meeting had been published when this was checked on 21 October 2026.", "instruments": [ "data-omnibus" ], "provisions": [], "institutions": [ "council" ], "enforcement": [], "legal_basis": [], "brief_part": "part-8", "last_verified": "2026-10-21", "published": "2026-10-20", "sources": [ { "source_id": "src-agenceurope-omnibus-2026-10-20", "supports": "supports:direct", "locator": "Paragraphs 1-3: 'Coreper is due to examine a revised version on Wednesday 21 October'; 'stronger protection for trade secrets, one of Berlin's red lines'; 'a specific report … the proportionality of the obligations imposed on small and medium-sized enterprises'" } ], "verification_note": "Registered 21 Oct 2026 (audit item 2). The audit brief said the Coreper 'examined it on 21 October'; what was read says only that it was DUE to, in a report written the day before. The Council's own pages answered HTTP 403 to this environment, and no report of the meeting's outcome was found by search on 21 Oct 2026, so the second half is dated and must be replaced the moment an outcome is published. One specialist-press report (tier 4); graded accordingly." }, { "id": "clm-data-omnibus-council-october", "type": "claim-type:fact", "statement": "The Irish Presidency's compromise text on the Data Omnibus was due to be put to a vote in Coreper II on 11 October 2026 but was neither discussed nor voted on, its examination having already been postponed at Coreper on 7 October under pressure from Germany and France; as at 14 October 2026 the Council has no negotiating mandate.", "instruments": [ "data-omnibus" ], "provisions": [], "institutions": [ "council" ], "enforcement": [], "sources": [ { "source_id": "src-agenceurope-omnibus-2026-10-12", "supports": "supports:direct", "locator": "Paragraphs 1-2: 'was supposed to go to a vote at an EU Committee of Permanent Representatives (Coreper II) meeting on Sunday 11 October. But in the end, it wasn't even discussed – or voted on'; 'postponed … at an initial meeting of the Committee of Permanent Representatives (Coreper) on Wednesday 7 October, under pressure from Germany and France'" } ], "legal_basis": [], "brief_part": "part-8", "published": "2026-10-12", "last_verified": "2026-10-14", "verification_note": "Registered 14 Oct 2026 and read that day. The procedural outcome rests on one specialist-press report (Agence Europe, tier 4): no Council agenda, outcome of proceedings or press release recording the 7 or 11 October meetings was located, so the record is graded on that report and the prose says 'reported'. 'No negotiating mandate' follows from the vote not having been held, read with clm-data-omnibus-stalled; the report does not use the word 'mandate'. A Council mandate could form at any meeting: re-verify before every publication." }, { "id": "clm-data-omnibus-parliament-stage", "type": "claim-type:fact", "statement": "In the European Parliament the Data Omnibus is with the joint ITRE–LIBE committee: a draft report was tabled on 22 June 2026 and amendments to it on 27 July 2026, and on 14 October 2026 the procedure stood at 'awaiting committee decision', so Parliament has adopted no position and trilogues have not begun.", "instruments": [ "data-omnibus" ], "provisions": [], "institutions": [ "ep" ], "enforcement": [], "sources": [ { "source_id": "src-oeil-2025-0360", "supports": "supports:direct", "locator": "Procedure file 2025/0360(COD): 'Stage reached in procedure: Awaiting committee decision'; Key players (joint committee ITRE/LIBE); Documentation gateway (Committee draft report PE786.818, 22/06/2026; amendments tabled in committee, 27/07/2026)" } ], "legal_basis": [], "brief_part": "part-8", "published": null, "last_verified": "2026-10-21", "verification_note": "Registered 14 Oct 2026 from Parliament's own procedure file, read that day. The number of amendments tabled is not stated in the file and was not counted, so no figure is given. 'Trilogues have not begun' follows from the absence of a committee mandate and of a Council mandate (clm-data-omnibus-council-october); trilogue requires both. A live page: re-verify before every publication. 21 Oct 2026 (audit item 2): the Legislative Observatory page re-read; stage reached still 'Awaiting committee decision', the documentation gateway unchanged (draft report PE786.818 of 22 June 2026; amendments of 27 July 2026)." }, { "id": "clm-noyb-omnibus-charter", "type": "claim-type:attributed", "statement": "noyb concluded that the Digital Omnibus's GDPR and ePrivacy amendments would produce multiple conflicts with the Charter and a clear departure from the GDPR's logic and CJEU case law.", "attributed_to": "noyb, Digital Omnibus Report V3 (24 February 2026)", "instruments": [ "data-omnibus", "gdpr" ], "provisions": [], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-noyb-omnibus", "supports": "supports:direct", "locator": "\"Our analysis reveals that the parts amending the GDPR and the ePrivacy Directive would lead to multiple conflicts with the EU's Charter of Fundamental Rights … and a clear departure from the current logic of the GDPR or CJEU case law\"" } ], "legal_basis": [], "brief_part": "part-8", "published": "2026-02-24", "last_verified": "2026-09-27", "verification_note": "Registered on 27 Sep 2026 for the \"from digital rights\" flank in Part VIII. The source record, read on 28 Aug 2026, says noyb states this and that the brief's wording tracks it closely. No page or section locator was recorded. Locators added 27 Sep 2026: each source was re-read that day and the locator quotes the sentence that carries the claim." }, { "id": "clm-icle-enforcement-architecture", "type": "claim-type:attributed", "statement": "ICLE argues that the Digital Omnibus's greatest weakness is its silence on enforcement architecture: without institutional reform, the authorities that read the GDPR expansively will read the new exemptions narrowly.", "attributed_to": "International Center for Law & Economics — the specific publication is not identified in this build", "instruments": [ "data-omnibus", "gdpr" ], "provisions": [], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-icle-omnibus-2026-06", "supports": "supports:direct", "locator": "Opening section: 'Finally, the package’s greatest weakness was its silence on enforcement architecture. Without institutional reform, we argued, the same authorities that had interpreted the GDPR into a “law of everything” would read the new exemptions just as narrowly.'" }, { "source_id": "src-brief-original", "supports": "supports:direct", "locator": "Part VIII" } ], "legal_basis": [], "brief_part": "part-8", "published": null, "last_verified": "2026-09-27", "verification_note": "reference_gap cleared on 27 Sep 2026 on the author's instruction: ICLE's June 2026 text states the argument. The gap it recorded was: \"the ICLE publication making the enforcement-architecture argument\". Source found on 27 Sep 2026: ICLE's June 2026 commentary (src-icle-omnibus-2026-06), re-read that day, restates the argument ICLE says it made in its earlier comments on the Omnibus, in these words. Registered on 27 Sep 2026 for the \"from the competitiveness side\" flank in Part VIII. Neither ICLE record in sources.json (the March 2026 comments and the June 2026 commentary on the Council texts) is recorded as stating this argument, so the attribution rests on the brief until the publication is found." }, { "id": "clm-draghi-diagnosis", "type": "claim-type:attributed", "statement": "Draghi's The Future of European Competitiveness holds that the EU–US productivity divergence is largely explained by the tech sector, and names the rulebook itself as part of the problem: a complex web of overlapping rules producing an innovation gap.", "instruments": [], "provisions": [], "institutions": [ "ec" ], "enforcement": [], "sources": [ { "source_id": "src-ec-draghi-report", "supports": "supports:direct", "locator": "Part A, Foreword, printed p. 5: \"the productivity gap between the EU and the US is largely explained by the tech sector\"; Part A, Chapter 2, printed p. 30: \"the EU’s regulatory stance towards tech companies hampers innovation: the EU now has around 100 tech-focused laws and over 270 regulators active in digital networks across all Member States\"" } ], "legal_basis": [], "brief_part": "part-10", "published": "2024-09-09", "last_verified": "2026-09-27", "verification_note": "Verified 27 Sep 2026 against Part A of the report (the Commission's PDF), read for this claim: both halves are the report's own statements, quoted in the locator. 'A complex web of overlapping rules' is the brief's paraphrase of the second passage, which speaks of around 100 tech-focused laws, over 270 regulators, heterogeneous requirements and a proliferation of regulatory agencies; the report does not use that phrase. The report is located but its text has not been consulted; the characterisation is not checked against it. Retyped from fact to attributed on 27 Sep 2026: the statement reports what Mario Draghi said; the site does not adopt the position, and the evidence it owes is that actor's own text.", "attributed_to": "Mario Draghi, The Future of European Competitiveness (September 2024)" }, { "id": "clm-draghi-statistics", "type": "claim-type:fact", "statement": "Around 70% of foundation models have been developed in the US since 2017; three US hyperscalers account for over 65% of the global and European cloud market, the largest European operator holds just 2% of the EU market, and European providers' share of that market had fallen below 16% by 2021; European firms hold roughly 22% of worldwide autonomous-robotics activity and around 17% of AI services.", "instruments": [], "provisions": [], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-ec-draghi-report", "supports": "supports:direct", "locator": "Part A, p. 24 (70%, 65%, 2%, 22%, 17%); Part B, p. 77 (under 16% in 2021)" }, { "source_id": "src-brief-original", "supports": "supports:direct", "locator": "Part X" } ], "legal_basis": [], "brief_part": "part-10", "published": "2024-09-09", "last_verified": "2026-09-26", "verification_note": "Checked against the report text on 2026-09-26. Part A, p. 24, states each of: around 70% of foundational AI models developed in the US since 2017; three US hyperscalers over 65% of the global and European cloud market; the largest European cloud operator just 2% of the EU market; around 22% of worldwide autonomous-robotics activity; around 17% of AI-services activity. The earlier 'European providers under 15%' figure does not appear in the report and has been replaced by Part B, p. 77: EU cloud providers' share decreased to under 16% in 2021 — a share of the EU market, not the global one. Part B, p. 79, gives the foundation-model figure as 73%; the prose follows Part A's 'around 70%'. Reference gap cleared on 2026-09-26 by the author's decision: every percentage in the statement is located in the report, with page numbers." }, { "id": "clm-cloud-ai-act-dual-basis", "type": "claim-type:law", "statement": "The proposed Cloud and AI Development Act rests on a dual legal basis — Article 114 TFEU (internal market) and Article 173(3) TFEU (industrial competitiveness) — the same pairing on which the Chips Act (Regulation (EU) 2023/1781) already rests.", "instruments": [ "cloud-ai-development-act", "tfeu" ], "provisions": [], "institutions": [ "ec", "council" ], "enforcement": [], "sources": [ { "source_id": "src-council-cloud-ai-act-2026", "supports": "supports:direct", "locator": "ST 10104/2026, enclosing COM(2026) 502 final: explanatory memorandum, section 2 'Legal basis' (PDF p. 9: 'the cumulative legal basis of Articles 114 and 173(3) TFEU'); citation of the proposed Regulation (PDF p. 16)" }, { "source_id": "src-eurlex-chips-act", "supports": "supports:partial", "locator": "Citation: 'Having regard to the Treaty on the Functioning of the European Union, and in particular Article 173(3) and Article 114 thereof'" }, { "source_id": "src-ec-tech-sovereignty-2026", "supports": "supports:partial", "locator": null } ], "legal_basis": [ "tfeu:art-114", "tfeu:art-173" ], "brief_part": "part-10", "published": "2026-06-03", "last_verified": "2026-09-27", "verification_note": "Corrected on 27 Sep 2026. The statement said the dual basis was 'the first time industrial policy has been an explicit co-basis in this field'. The Chips Act, Regulation (EU) 2023/1781 (OJ L 229, 18.9.2023, read that day via the Publications Office's Cellar), already rests on 'Article 173(3) and Article 114' TFEU, and the brief itself counts the Chips Act in the rulebook; the brief and its three translations now say so. The Cloud and AI Development Act's basis was re-read that day in the Council's transmission of COM(2026) 502 final (ST 10104/2026, 4 June 2026). The Commission's own proposal is not in the Publications Office's Cellar under CELEX 52026PC0502 as of that date." }, { "id": "clm-sovereignty-vs-interoperability", "type": "claim-type:critique", "statement": "Sovereignty and interoperability pull in opposite directions: the Data Act was designed to mandate open interoperability and eliminate lock-in, while the proposed Cloud and AI Development Act's sovereignty requirements push toward highly secure, localised environments.", "instruments": [ "cloud-ai-development-act", "data-act" ], "provisions": [ "data-act:art-25" ], "institutions": [ "ec" ], "enforcement": [], "sources": [ { "source_id": "src-brief-original", "supports": "supports:direct", "locator": "Part X" } ], "legal_basis": [], "brief_part": "part-10", "published": "2026-08-19", "last_verified": "2026-08-27", "verification_note": "The author's critique. The claim that twenty-four European cloud CEOs demanded absolute technical and legal control requirements is not sourced. 22 Oct 2026 (audit, available support not linked): the claim that supports its premise is now recorded in `premises`, so the evidence drawer shows it; a premise supports part of an argument, and the argument itself still rests on the brief.", "premises": [ "clm-cispe-cloud-ceos-letter" ] }, { "id": "clm-art-4-2-teu-carve-out", "type": "claim-type:law", "statement": "Article 4(2) TEU reserves national security to the Member States: it remains the sole responsibility of each Member State.", "instruments": [ "teu" ], "provisions": [ "teu:art-4-2" ], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-eurlex-teu-art-4", "supports": "supports:direct", "locator": "Art. 4(2), third sentence" }, { "source_id": "src-brief-original", "supports": "supports:direct", "locator": "Part XI" } ], "legal_basis": [ "teu:art-4-2" ], "brief_part": "part-11", "published": "2026-08-19", "last_verified": "2026-09-27", "verification_note": "Split on 27 Sep 2026: until then this claim also carried the AI Act's national-security exclusion and the Privacy International holding, each now its own claim (clm-ai-act-national-security-exclusion, clm-privacy-international-national-security) so that each rests on its own primary source. Read that day against the Treaty text in the Official Journal (OJ C 202, 7.6.2016, p. 18, via the Publications Office's Cellar, CELEX 12016M004): 'In particular, national security remains the sole responsibility of each Member State.' Earlier history: corrected on 2026-09-26 (audit T-11) — the AI Act exclusion is for systems used 'exclusively' for those purposes; the provision link was corrected from Art. 5 to Art. 2 at the author's direction." }, { "id": "clm-ai-act-national-security-exclusion", "type": "claim-type:law", "statement": "The AI Act does not apply to AI systems placed on the market, put into service or used exclusively for military, defence or national security purposes, regardless of the type of entity carrying out those activities.", "instruments": [ "ai-act" ], "provisions": [ "ai-act:art-2" ], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-eurlex-ai-act", "supports": "supports:direct", "locator": "Art. 2(3), second and third subparagraphs" }, { "source_id": "src-aia-text-unofficial-arts-2-4", "supports": "supports:partial", "locator": "Art. 2(3)" } ], "legal_basis": [ "ai-act:art-2" ], "brief_part": "part-11", "published": "2026-08-19", "last_verified": "2026-09-27", "verification_note": "Split from clm-art-4-2-teu-carve-out on 27 Sep 2026. Read that day against the Official Journal text (CELEX 32024R1689, via the Publications Office's Cellar): Art. 2(3), second subparagraph, excludes AI systems 'where and in so far they are placed on the market, put into service, or used with or without modification exclusively for military, defence or national security purposes'; the third subparagraph excludes systems not placed on the Union market whose output is used in the Union exclusively for those purposes. The Digital Omnibus on AI (Regulation (EU) 2026/1744, Art. 1(2)) replaces Art. 2(2) and (7) and adds Art. 2(13); it does not amend Art. 2(3). The unofficial explorer, read on 26 Sep 2026, agrees and is kept only as a secondary reading." }, { "id": "clm-privacy-international-national-security", "type": "claim-type:law", "statement": "In Privacy International (C-623/17) the Court of Justice held that national legislation requiring providers of electronic communications services to forward traffic and location data to security and intelligence agencies for the purpose of safeguarding national security falls within the scope of the e-Privacy Directive, read in the light of Article 4(2) TEU.", "instruments": [ "eprivacy", "teu" ], "provisions": [ "teu:art-4-2" ], "institutions": [ "cjeu" ], "enforcement": [], "sources": [ { "source_id": "src-cjeu-c623-17", "supports": "supports:direct", "locator": "Operative part, point 1; paras 44 and 49" }, { "source_id": "src-cjeu-c623-17-pr", "supports": "supports:direct", "locator": "Press Release No 123/20, first page" } ], "legal_basis": [], "brief_part": "part-11", "published": "2020-10-06", "last_verified": "2026-09-27", "verification_note": "Split from clm-art-4-2-teu-carve-out on 27 Sep 2026 and read that day against the judgment (Grand Chamber, 6 October 2020, CELEX 62017CJ0623, via the Publications Office's Cellar). Para 44: 'the mere fact that a national measure has been taken for the purpose of protecting national security cannot render EU law inapplicable'. Corrected that day: the brief said the Court held 'national data-retention measures' within EU law. Privacy International concerned the forwarding (transmission) of traffic and location data to security and intelligence agencies; retention was the question in the joined La Quadrature du Net cases (C-511/18, C-512/18, C-520/18), decided the same day and covered by the same press release but not read here. The case concerns the e-Privacy Directive, not the AI Act: it bears on the AI Act's national-security exclusion by analogy only." }, { "id": "clm-art-5-binds-states", "type": "claim-type:law", "statement": "The AI Act Article 5 prohibitions bind public authorities as well as firms: social scoring by government, predictive policing based solely on profiling, and emotion recognition in workplaces and schools are prohibited outright for states as well as companies.", "instruments": [ "ai-act" ], "provisions": [ "ai-act:art-5" ], "institutions": [ "ec", "nca-*" ], "enforcement": [], "sources": [ { "source_id": "src-eurlex-ai-act", "supports": "supports:direct", "locator": "Art. 5" } ], "legal_basis": [ "ai-act:art-5" ], "brief_part": "part-11", "published": "2024-07-12", "last_verified": "2026-08-27", "verification_note": null }, { "id": "clm-hungary-biometric-breach", "type": "claim-type:interpretation", "statement": "Amendments passed by the Hungarian Parliament in March 2025 extending police use of facial recognition to all infractions constitute real-time remote biometric identification in breach of AI Act Article 5 and of the Charter, according to legal analysis by EDRi, ECNL, Liberties and the Hungarian Civil Liberties Union.", "instruments": [ "ai-act", "charter" ], "provisions": [ "ai-act:art-5" ], "institutions": [ "ec" ], "enforcement": [ "enf-hungary-commission-none" ], "sources": [ { "source_id": "src-edri-hungary-ai-act", "supports": "supports:direct", "locator": "6 May 2025: the four organisations \"believe that this broadened application of FRT … violates the EU AI Act and the Charter of Fundamental Rights of the EU\"" }, { "source_id": "src-ecnl-hungary-ai-act", "supports": "supports:direct", "locator": "30 September 2025: \"urging the European Commission to launch infringement proceedings against Hungary for violating the EU Artificial Intelligence Act\"" } ], "legal_basis": [ "ai-act:art-5" ], "brief_part": "part-11", "published": "2025", "last_verified": "2026-09-27", "verification_note": "Correctly typed as interpretation: this is the civil-society coalition's legal conclusion, not a judicial finding. The Hungarian legislation itself has not been retrieved. Note the brief's own careful point that Hungary has not invoked the national security exemption, so this is not a hard case about the boundary of Art. 4(2) TEU. The classification is itself contested on a narrower point: EDRi's own analysis distinguishes prohibited real-time identification from the merely high-risk retrospective ('post') kind, and rests the 'real-time' characterisation on how quickly the Hungarian system processes newly generated footage — a factual question the coalition's analysis asserts rather than a public technical finding settles. Locators added 27 Sep 2026: each source was re-read that day and the locator quotes the sentence that carries the claim." }, { "id": "clm-hungary-no-infringement", "type": "claim-type:fact", "statement": "No infringement decision against Hungary concerning the March 2025 facial-recognition amendments appears in the Commission's monthly infringement packages from 12 March 2025 to 1 October 2026, checked on 21 October 2026.", "instruments": [ "ai-act" ], "provisions": [ "ai-act:art-5" ], "institutions": [ "ec" ], "enforcement": [ "enf-hungary-commission-none" ], "sources": [ { "source_id": "src-ec-infringement-package-2026-10", "supports": "supports:partial", "locator": "Key decisions of the fourteen packages read: INF/25/503 (12 Mar 2025), INF/25/982 (7 May 2025), INF/25/1241 (18 Jun 2025), INF/25/1628 (17 Jul 2025), INF/25/2077 (8 Oct 2025), INF/25/2481 (21 Nov 2025), INF/25/2745 (11 Dec 2025), INF/26/115 (30 Jan 2026), INF/26/431 (11 Mar 2026), INF/26/720 (29 Apr 2026), INF/26/1084 (4 Jun 2026), INF/26/1376 (8 Jul 2026), INF/26/1380 (15 Jul 2026, transposition) and INF/26/1760 (1 Oct 2026); none mentions the AI Act or biometric identification" }, { "source_id": "src-techpolicy-national-security-2026", "supports": "supports:partial", "locator": "Hungary has not invoked the national security exemption" }, { "source_id": "src-ecnl-hungary-ai-act", "supports": "supports:partial", "locator": null }, { "source_id": "src-edri-hungary-ai-act", "supports": "supports:partial", "locator": null }, { "source_id": "src-euronews-magyar-2026", "supports": "supports:context", "locator": null }, { "source_id": "src-euobserver-pride-2026", "supports": "supports:context", "locator": null } ], "legal_basis": [], "brief_part": "part-11", "published": "2025", "last_verified": "2026-10-21", "verification_note": "21 Oct 2026 (audit item 7): reformulated as a dated negative and checked against the Commission's own record rather than NGOs and press. The fourteen monthly infringement packages since the March 2025 amendments were read in full (see the source note); none mentions the AI Act, biometric identification or facial recognition. The packages carry key decisions only, and the Commission's searchable register could not be queried from this environment (its search page answered HTTP 404), so the support is partial and the statement says what was searched and when. Earlier statement: 'The Commission has not opened infringement proceedings against Hungary on the basis of the biometric surveillance legislation.' Re-checked 26 Sep 2026. Contemporary commentary confirms that civil-society organisations were urging the Commission to open proceedings and that Hungary had not invoked the national-security exemption. The negative half of the claim — that no proceedings have been opened — cannot be proved by any source and is true only at an instant. The political context has changed since the claim was written: Péter Magyar's government took office 9 May 2026 and Budapest Pride went ahead with police acknowledgement in June 2026, but the March 2025 amendments this claim concerns were not repealed and no infringement proceeding was found on this basis. Re-verify before every publication." }, { "id": "clm-enforcement-asymmetry", "type": "claim-type:critique", "statement": "This body of law restrains corporate power far more effectively than it restrains state power, and on the record available the enforcement asymmetry between corporate and state addressees is hard to dispute.", "instruments": [ "ai-act", "teu", "gdpr", "dsa", "dma" ], "provisions": [ "ai-act:art-5" ], "institutions": [ "ec" ], "enforcement": [ "enf-hungary-commission-none", "enf-apple-ec-2025", "enf-x-ec-2025" ], "sources": [ { "source_id": "src-brief-original", "supports": "supports:direct", "locator": "Part XI" } ], "legal_basis": [ "teu:art-4-2" ], "brief_part": "part-11", "published": "2026-08-19", "last_verified": "2026-08-27", "verification_note": "The author's central conclusion, correctly typed as critique. It rests on clm-hungary-no-infringement, which is time-sensitive; if that claim decays, this one must be revisited. 21 Oct 2026 (audit, tone stronger than evidence): 'not seriously disputable' attenuated to 'on the record available … hard to dispute', in the claim and in all four languages; the Hungarian premise is now a dated negative (clm-hungary-no-infringement).", "premises": [ "clm-art-4-2-teu-carve-out", "clm-hungary-no-infringement", "clm-art-5-binds-states" ] }, { "id": "clm-charter-binds-member-states", "type": "claim-type:law", "statement": "The Charter of Fundamental Rights binds Member States when they are implementing EU law.", "instruments": [ "charter" ], "provisions": [], "institutions": [ "cjeu" ], "enforcement": [], "sources": [ { "source_id": "src-eurlex-charter-art-51", "supports": "supports:direct", "locator": "Art. 51(1)" } ], "legal_basis": [], "brief_part": "part-11", "published": "2026-08-19", "last_verified": "2026-09-27", "verification_note": "reference_gap cleared on 27 Sep 2026 on the author's instruction: the data-retention case line it named is now three claims, each read in its judgment. The gap it recorded was: \"Article 51(1) of the Charter is the legal basis and is in the dataset; the data-retention case line (Digital Rights Ireland, Tele2, La Quadrature du Net) is not individually sourced here.\". Split on 27 Sep 2026: the data-retention case line is now three claims of its own (clm-cjeu-digital-rights-ireland, clm-cjeu-tele2, clm-cjeu-la-quadrature), each on its judgment. Read that day against the Charter in the Official Journal (OJ C 202, 7.6.2016, p. 404): Art. 51(1) addresses the Charter 'to the Member States only when they are implementing Union law'." }, { "id": "clm-cjeu-digital-rights-ireland", "type": "claim-type:law", "statement": "In Digital Rights Ireland (C-293/12 and C-594/12, 8 April 2014) the Court of Justice declared the Data Retention Directive, Directive 2006/24/EC, invalid, holding that by adopting it the EU legislature had exceeded the limits of proportionality in the light of Articles 7, 8 and 52(1) of the Charter.", "instruments": [ "charter" ], "provisions": [], "institutions": [ "cjeu" ], "enforcement": [], "sources": [ { "source_id": "src-cjeu-c293-12", "supports": "supports:direct", "locator": "Operative part; para 69" } ], "legal_basis": [], "brief_part": "part-11", "published": "2014-04-08", "last_verified": "2026-09-27", "verification_note": "Split from clm-charter-binds-member-states on 27 Sep 2026 and read that day in the judgment (Grand Chamber, CELEX 62012CJ0293, via the Publications Office's Cellar). The measure struck down was an EU directive; the Member State measures came in the later cases." }, { "id": "clm-cjeu-tele2", "type": "claim-type:law", "statement": "In Tele2 Sverige (C-203/15 and C-698/15, 21 December 2016) the Court of Justice held that the e-Privacy Directive, read in the light of Articles 7, 8, 11 and 52(1) of the Charter, precludes national legislation providing, for the purpose of fighting crime, for general and indiscriminate retention of all traffic and location data.", "instruments": [ "charter", "eprivacy" ], "provisions": [], "institutions": [ "cjeu" ], "enforcement": [], "sources": [ { "source_id": "src-cjeu-c203-15", "supports": "supports:direct", "locator": "Operative part, point 1" } ], "legal_basis": [], "brief_part": "part-11", "published": "2016-12-21", "last_verified": "2026-09-27", "verification_note": "Split from clm-charter-binds-member-states on 27 Sep 2026 and read that day in the judgment (Grand Chamber, CELEX 62015CJ0203, via the Publications Office's Cellar)." }, { "id": "clm-cjeu-la-quadrature", "type": "claim-type:law", "statement": "In La Quadrature du Net (C-511/18, C-512/18 and C-520/18, 6 October 2020) the Court of Justice held that the e-Privacy Directive, read in the light of the Charter, precludes legislative measures providing, as a preventive measure, for general and indiscriminate retention of traffic and location data, subject to narrow exceptions such as a genuine and present or foreseeable serious threat to national security.", "instruments": [ "charter", "eprivacy" ], "provisions": [], "institutions": [ "cjeu" ], "enforcement": [], "sources": [ { "source_id": "src-cjeu-c511-18", "supports": "supports:direct", "locator": "Operative part, point 1" } ], "legal_basis": [], "brief_part": "part-11", "published": "2020-10-06", "last_verified": "2026-09-27", "verification_note": "Split from clm-charter-binds-member-states on 27 Sep 2026 and read that day in the judgment (Grand Chamber, CELEX 62018CJ0511, via the Publications Office's Cellar). The operative part lists further exceptions (targeted retention, IP addresses, civil identity, expedited retention); 'narrow exceptions such as' names only the first." }, { "id": "clm-edps-supervises-institutions", "type": "claim-type:law", "statement": "The EDPS supervises the EU institutions themselves: it is responsible for ensuring that Union institutions and bodies respect the right to data protection and for monitoring their application of data-protection law.", "instruments": [], "provisions": [], "institutions": [ "edps" ], "enforcement": [], "sources": [ { "source_id": "src-eurlex-eudpr", "supports": "supports:direct", "locator": "Art. 52(2) and (3)" } ], "legal_basis": [], "brief_part": "part-11", "published": "2018-11-21", "last_verified": "2026-09-27", "verification_note": "Split from clm-edps-opposes-commission on 27 Sep 2026 and read that day against the Official Journal text of Regulation (EU) 2018/1725 (OJ L 295, 21.11.2018, via the Publications Office's Cellar, CELEX 32018R1725). The instrument is not modelled in data/instruments.json, so no provision is linked." }, { "id": "clm-edps-opposes-commission", "type": "claim-type:fact", "statement": "The EDPS has publicly opposed the Commission's own legislative proposals.", "instruments": [], "provisions": [], "institutions": [ "edps", "ec" ], "enforcement": [], "sources": [ { "source_id": "src-edpb-jo-2-2026", "supports": "supports:direct", "locator": "Paras 21 ('strongly urge the co-legislators to not adopt the proposed changes to the definition of personal data') and 25 ('suggest deleting proposed Article 41a GDPR')" } ], "legal_basis": [], "brief_part": "part-11", "published": "2026-02", "last_verified": "2026-09-27", "verification_note": "Split on 27 Sep 2026: the EDPS's supervisory role is now its own claim of law (clm-edps-supervises-institutions, Regulation (EU) 2018/1725, Art. 52). Read that day: Joint Opinion 2/2026 (adopted jointly with the EDPB on 10 February 2026) urges the co-legislators not to adopt the Commission's proposed change to the definition of personal data (para 21) and suggests deleting its proposed Art. 41a (para 25). The judgment in C-413/23 P (EDPS v SRB) was removed on 2026-09-26 (audit T-30): it is litigation against an EU agency about the concept of personal data, not opposition to a Commission legislative proposal." }, { "id": "clm-ep-privacy-defender", "type": "claim-type:interpretation", "statement": "In this brief's reading, the European Parliament has been among the more consistent institutional defenders of privacy across this period.", "instruments": [], "provisions": [], "institutions": [ "ep" ], "enforcement": [], "sources": [ { "source_id": "src-brief-original", "supports": "supports:direct", "locator": "Part XI" } ], "legal_basis": [], "brief_part": "part-11", "published": "2026-08-19", "last_verified": null, "verification_note": "22 Oct 2026 (audit, tone stronger than evidence): 'the most consistent institutional defender' was a superlative no record here measures — no plenary votes or positions were compiled. Attenuated to an explicit reading ('in this brief's reading … among the more consistent') in all four languages, rather than supported with data this session did not gather. Earlier statement: 'The European Parliament has been the most consistent institutional defender of privacy across this period.' REQUIRES VERIFICATION. An evaluative claim about institutional behaviour over a decade; not sourced." }, { "id": "clm-google-dma-fine-2026", "statement": "On 23 July 2026 the Commission fined Google EUR 890 million for breaches of the Digital Markets Act, concerning self-preferencing in Search and anti-steering in Google Play.", "type": "claim-type:fact", "brief_part": "part-4", "instruments": [ "dma" ], "provisions": [], "institutions": [ "ec" ], "enforcement": [ "enf-google-ec-2026-dma" ], "legal_basis": [], "sources": [ { "source_id": "src-ec-google-dma-fine-2026", "supports": "supports:direct", "locator": "Headline: \"Commission fines Google €890 million for breaches of the Digital Markets Act\"; \"two decisions finding non-compliance … self-preferencing … on Google Search\"" }, { "source_id": "src-ec-google-dma-fine-2026-ip", "supports": "supports:direct", "locator": "IP/26/1670" } ], "published": "2026-07-23", "last_verified": "2026-10-21", "requires_verification": false, "verification_note": "Total and date confirmed against the Commission's own DMA portal and press release. The reported component split (EUR 460m Search, EUR 430m Play) is recorded on the enforcement record as reported and has NOT been confirmed against the decision text in this build. Locators added 27 Sep 2026: each source was re-read that day and the locator quotes the sentence that carries the claim. 21 Oct 2026 (audit item 1): IP/26/1670 re-read through the Commission press corner. The two fines that make up the total are registered as clm-google-dma-search-fine and clm-google-dma-play-fine. No later DMA fine appears in the press corner as at 21 Oct 2026." }, { "id": "clm-google-dma-search-fine", "type": "claim-type:fact", "statement": "One of the two decisions of 23 July 2026 fined Google EUR 460 million for self-preferencing its own services in Google Search, in breach of DMA Article 6(5).", "instruments": [ "dma" ], "institutions": [ "ec" ], "enforcement": [ "enf-google-ec-2026-dma" ], "legal_basis": [], "brief_part": "part-4", "published": "2026-07-23", "last_verified": "2026-10-21", "provisions": [ "dma:art-6" ], "sources": [ { "source_id": "src-ec-google-dma-fine-2026-ip", "supports": "supports:direct", "locator": "Paragraph 1: 'self-preferencing its own services on Google Search … the Commission issued Google a fine of €460 million'" }, { "source_id": "src-ec-google-dma-opening-2024", "supports": "supports:partial", "locator": "Names Article 6(5) for self-preferencing on Google Search" } ], "verification_note": "Registered 21 Oct 2026 (audit item 1), read that day in IP/26/1670 through the Commission press corner. The release names the conduct but not the article; Article 6(5) comes from the opening release IP/24/1689, as the enforcement record already records." }, { "id": "clm-google-dma-play-fine", "type": "claim-type:fact", "statement": "The other decision of 23 July 2026 fined Google EUR 430 million for restricting businesses on Google Play from steering consumers to other purchase channels, in breach of DMA Article 5(4).", "instruments": [ "dma" ], "institutions": [ "ec" ], "enforcement": [ "enf-google-ec-2026-dma" ], "legal_basis": [], "brief_part": "part-4", "published": "2026-07-23", "last_verified": "2026-10-21", "provisions": [ "dma:art-5" ], "sources": [ { "source_id": "src-ec-google-dma-fine-2026-ip", "supports": "supports:direct", "locator": "Paragraph 1: 'restrictions on businesses to direct consumers to alternative, often cheaper, purchase channels on Google Play (steering) … a fine of €430 million'" }, { "source_id": "src-ec-google-dma-opening-2024", "supports": "supports:partial", "locator": "Names Article 5(4) for Alphabet's steering rules" } ], "verification_note": "Registered 21 Oct 2026 (audit item 1), read that day in IP/26/1670 through the Commission press corner. The release names the conduct but not the article; Article 5(4) comes from the opening release IP/24/1689, as the enforcement record already records." }, { "id": "clm-google-dma-largest-total", "type": "claim-type:derived", "statement": "Google's two DMA fines of 23 July 2026 total EUR 890 million, the largest amount the Commission has imposed under the DMA to date; each fine alone is smaller than Apple's EUR 500 million of April 2025.", "instruments": [ "dma" ], "provisions": [], "institutions": [ "ec" ], "enforcement": [ "enf-google-ec-2026-dma", "enf-apple-ec-2025", "enf-meta-ec-2025" ], "sources": [ { "source_id": "src-ec-google-dma-fine-2026-ip", "supports": "supports:partial", "locator": "Paragraph 1: 'a fine of €460 million and a fine of €430 million respectively'" } ], "legal_basis": [], "brief_part": "part-4", "published": "2026-07-23", "last_verified": "2026-10-21", "verification_note": "Registered 21 Oct 2026 (audit item 1). No source states that EUR 890 million is the largest DMA amount: it is this site's comparison across its enforcement records, and the ranking block makes tools/evidence-audit.mjs recompute it from data/enforcement.json on every run, so it fails as soon as a larger DMA record is added. The comparison holds only over the records the observatory holds; on 21 Oct 2026 the Commission's press corner showed no DMA fine other than Apple's and Meta's (23 April 2025) and Google's (23 July 2026). 'Each fine alone is smaller than Apple's' is arithmetic on the same records: EUR 460 million and EUR 430 million against EUR 500 million.", "derivation": { "performed_by": "site", "method": "Sum of the two Google fines as the Commission states them; the 'largest to date' half is the ranking block, recomputed from the enforcement records.", "inputs": { "a": { "claim": "clm-google-dma-search-fine", "value": 460000000, "as_stated": "EUR 460 million" }, "b": { "claim": "clm-google-dma-play-fine", "value": 430000000, "as_stated": "EUR 430 million" } }, "formula": "a + b", "result": 890000000, "unit": "EUR", "rounding": { "to": 1000000, "stated_value": 890000000 } }, "ranking": { "dataset": "enforcement", "where": { "instrument": "dma", "authority": "ec" }, "by": "fine_eur", "subject": "enf-google-ec-2026-dma", "rank": 1 } }, { "id": "clm-cloud-gatekeeper-preliminary-2026", "statement": "On 25 June 2026 the Commission reached a preliminary position that Amazon Web Services and Microsoft Azure should be designated as gatekeepers under the DMA. No designation decision had been adopted as at the verification date.", "type": "claim-type:fact", "brief_part": "part-4", "instruments": [ "dma" ], "provisions": [ "dma:art-3" ], "institutions": [ "ec" ], "enforcement": [], "legal_basis": [ "dma:art-3" ], "sources": [ { "source_id": "src-ec-cloud-gatekeeper-preliminary-2026", "supports": "supports:direct", "locator": "25 June 2026: \"the Commission preliminarily finds that AWS and Azure … are an important gateway between businesses and their customers\"" } ], "published": "2026-06-25", "last_verified": "2026-09-27", "requires_verification": false, "verification_note": "A preliminary position is not a designation. Recorded so that the gatekeeper count remains readable as current without implying a decision that has not been taken. Locators added 27 Sep 2026: each source was re-read that day and the locator quotes the sentence that carries the claim." }, { "id": "clm-dma-art-5-prohibitions", "type": "claim-type:law", "statement": "Article 5 DMA prohibits a gatekeeper from combining personal data across services without consent (5(2)), requires it to let business users communicate and promote offers to end users free of charge and conclude contracts with them (5(4)), bars it from preventing users raising non-compliance with public authorities (5(6)), and bars it from requiring use of its identification service, web browser engine or payment service (5(7)).", "instruments": [ "dma" ], "provisions": [ "dma:art-5" ], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-eurlex-dma", "supports": "supports:direct", "locator": "Art. 5(2), (4), (6), (7)" } ], "legal_basis": [ "dma:art-5" ], "brief_part": "part-4", "published": null, "last_verified": "2026-09-27", "verification_note": "Registered on 27 Sep 2026 for a statement already in the prose that no claim recorded. Checked that day against the Official Journal text (English, retrieved from the Publications Office's Cellar, CELEX 32022R1925): Article 5, paragraphs 2, 4, 6 and 7." }, { "id": "clm-dma-art-6-obligations", "type": "claim-type:law", "statement": "Article 6 DMA holds the obligations susceptible of further specification, including allowing third-party app stores and sideloading (6(4)), no self-preferencing in ranking (6(5)), free and effective interoperability with the hardware and software features available to the gatekeeper's own services (6(7)), data portability (6(9)) and business-user access to their data (6(10)).", "instruments": [ "dma" ], "provisions": [ "dma:art-6" ], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-eurlex-dma", "supports": "supports:direct", "locator": "Art. 6(4), (5), (7), (9), (10)" } ], "legal_basis": [ "dma:art-6" ], "brief_part": "part-4", "published": null, "last_verified": "2026-09-27", "verification_note": "Registered on 27 Sep 2026 for a statement already in the prose that no claim recorded. Checked that day against the Official Journal text (English, retrieved from the Publications Office's Cellar, CELEX 32022R1925): the heading of Article 6 (\"susceptible of being further specified under Article 8\") and paragraphs 4, 5, 7, 9 and 10." }, { "id": "clm-dma-art-7-interoperability", "type": "claim-type:law", "statement": "Article 7 DMA imposes interoperability obligations on gatekeepers' number-independent interpersonal communications services.", "instruments": [ "dma" ], "provisions": [ "dma:art-7" ], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-eurlex-dma", "supports": "supports:direct", "locator": "Art. 7" } ], "legal_basis": [ "dma:art-7" ], "brief_part": "part-4", "published": null, "last_verified": "2026-09-27", "verification_note": "Registered on 27 Sep 2026 for a statement already in the prose that no claim recorded. Checked that day against the Official Journal text (English, retrieved from the Publications Office's Cellar, CELEX 32022R1925): the heading of Article 7." }, { "id": "clm-dma-arts-11-15-duties", "type": "claim-type:law", "statement": "A gatekeeper must report on its compliance within six months of designation and update the report at least annually (Article 11), is bound by an anti-circumvention duty (Article 13), must inform the Commission of intended concentrations (Article 14) and must submit an independently audited description of its consumer-profiling techniques (Article 15).", "instruments": [ "dma" ], "provisions": [], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-eurlex-dma", "supports": "supports:direct", "locator": "Arts. 11(1)–(2), 13, 14, 15(1)" } ], "legal_basis": [], "brief_part": "part-4", "published": null, "last_verified": "2026-09-27", "verification_note": "Registered on 27 Sep 2026 for a statement already in the prose that no claim recorded. Checked that day against the Official Journal text (English, retrieved from the Publications Office's Cellar, CELEX 32022R1925): Article 11(1) and (2), and the headings of Articles 13, 14 and 15 with Article 15(1)." }, { "id": "clm-aliexpress-fine", "type": "claim-type:fact", "statement": "On 20 July 2026 the Commission fined AliExpress EUR 550 million under the DSA for failure to adequately assess and mitigate systemic risks from the sale of illegal, unsafe and counterfeit products — the largest DSA fine to date.", "instruments": [ "dsa" ], "provisions": [ "dsa:art-34", "dsa:art-35" ], "institutions": [ "ec" ], "enforcement": [ "enf-aliexpress-ec-2026" ], "sources": [ { "source_id": "src-ec-aliexpress-fine-2026", "supports": "supports:direct", "locator": "Headline: \"Commission fines AliExpress €550 million\"; \"fell short of its obligation … to diligently assess the risk of dissemination of illegal, unsafe, or counterfeit products\"" } ], "legal_basis": [ "dsa:art-74" ], "brief_part": "part-3", "published": "2026-07-20", "last_verified": "2026-09-27", "verification_note": "The amount, date and ground are directly sourced from the Commission's press release. The 'largest to date' characterisation and the 20 October 2026 action-plan deadline rest on secondary legal commentary (Lewis Silkin, Il Sole 24 Ore, JURIST), not on the Commission text, which contains no ranking language. Locators added 27 Sep 2026: each source was re-read that day and the locator quotes the sentence that carries the claim. The release does not say \"the largest DSA fine to date\": that comparison is the site's, against the other DSA fines in enforcement.json (X EUR 120m, Temu EUR 200m). 21 Oct 2026 (audit item 5): 'the largest DSA fine to date' now carries a ranking block, which tools/evidence-audit.mjs recomputes from the DSA enforcement records on every run (EUR 550 million against X's EUR 120 million and Temu's EUR 200 million); no later DSA fine appears in the Commission's press corner as at 21 Oct 2026.", "ranking": { "dataset": "enforcement", "where": { "instrument": "dsa", "authority": "ec" }, "by": "fine_eur", "subject": "enf-aliexpress-ec-2026", "rank": 1 } }, { "id": "clm-dsa-replaced-ecd-liability", "type": "claim-type:law", "statement": "The DSA deleted the intermediary-liability provisions of the e-Commerce Directive (Articles 12 to 15 of Directive 2000/31/EC) and replaced them with its own conditional exemptions.", "instruments": [ "dsa" ], "provisions": [], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-eurlex-dsa", "supports": "supports:direct", "locator": "Art. 89(1)–(2); Arts. 4–6, 8" } ], "legal_basis": [], "brief_part": "part-3", "published": null, "last_verified": "2026-09-27", "verification_note": "Registered on 27 Sep 2026 for a statement already in the prose that no claim recorded. Checked that day against the Official Journal text (English, retrieved from the Publications Office's Cellar, CELEX 32022R2065): Article 89(1) deletes Articles 12 to 15 of Directive 2000/31/EC; Article 89(2) reads references to them as references to Articles 4, 5, 6 and 8 of the DSA." }, { "id": "clm-dsa-art-34-risk-assessment", "type": "claim-type:law", "statement": "Article 34 DSA requires providers of very large online platforms and search engines to identify, analyse and assess systemic risks stemming from the design or functioning of their service, including algorithmic systems, at least once a year and before deploying functionalities likely to have a critical impact: illegal content; negative effects on fundamental rights; on civic discourse, electoral processes and public security; and in relation to gender-based violence, public health, minors and physical and mental well-being — taking into account recommender and other algorithmic systems and intentional manipulation, including inauthentic use.", "instruments": [ "dsa" ], "provisions": [ "dsa:art-34" ], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-eurlex-dsa", "supports": "supports:direct", "locator": "Art. 34(1)(a)–(d); Art. 34(2)" } ], "legal_basis": [ "dsa:art-34" ], "brief_part": "part-3", "published": null, "last_verified": "2026-09-27", "verification_note": "Registered on 27 Sep 2026 for a statement already in the prose that no claim recorded. Checked that day against the Official Journal text (English, retrieved from the Publications Office's Cellar, CELEX 32022R2065): Article 34(1), first and second subparagraphs and points (a) to (d), and Article 34(2), point (a) and the subparagraph on intentional manipulation." }, { "id": "clm-dsa-art-35-mitigation", "type": "claim-type:law", "statement": "Article 35 DSA requires reasonable, proportionate and effective mitigation measures tailored to the systemic risks identified; the measures it lists are examples of what they may include.", "instruments": [ "dsa" ], "provisions": [ "dsa:art-35" ], "institutions": [], "enforcement": [], "sources": [ { "source_id": "src-eurlex-dsa", "supports": "supports:direct", "locator": "Art. 35(1)" } ], "legal_basis": [ "dsa:art-35" ], "brief_part": "part-3", "published": null, "last_verified": "2026-09-27", "verification_note": "Registered on 27 Sep 2026 for a statement already in the prose that no claim recorded. Checked that day against the Official Journal text (English, retrieved from the Publications Office's Cellar, CELEX 32022R2065): Article 35(1): \"Such measures may include, where applicable\". The prose's \"the choice of measures left to the provider\" is a fair reading of \"may include\", and is the author's." } ] }