{
 "$schema_version": "1.0.0",
 "$description": "Glossary terms as a knowledge layer: each term links outward to the instruments, provisions, institutions and enforcement actions it belongs to, so a definition is an entry point into the data rather than a dead end.",
 "$last_verified": "2026-08-27",
 "$note": "Definitions are carried over verbatim from the existing glossary panel. IDs gain a 'gl-' prefix; the DOM currently uses 'gloss-<slug>'. The mapping is gl-<slug> to gloss-<slug>.",
 "terms": [
  {
   "id": "gl-vlop",
   "term": "VLOP",
   "legacy_dom_id": "gloss-vlop",
   "definition": "Very Large Online Platform under the DSA — 45 million+ average monthly EU recipients. Triggers the heaviest tier of DSA obligations: systemic risk assessment, audits, researcher data access.",
   "instruments": [
    "dsa"
   ],
   "provisions": [
    "dsa:art-33",
    "dsa:art-34",
    "dsa:art-40"
   ],
   "institutions": [
    "ec"
   ],
   "enforcement": [
    "enf-x-ec-2025",
    "enf-temu-ec-2026"
   ],
   "actors": [
    "actor:vlop"
   ],
   "related_terms": [
    "gl-vlose",
    "gl-dsa-art-34",
    "gl-dsc"
   ],
   "claims": [
    "clm-dsa-vlop-threshold",
    "clm-dsa-four-tiers"
   ],
   "sources": [
    "src-eurlex-dsa"
   ],
   "last_verified": "2026-08-27"
  },
  {
   "id": "gl-vlose",
   "term": "VLOSE",
   "legacy_dom_id": "gloss-vlose",
   "definition": "Very Large Online Search Engine — the DSA's VLOP-equivalent designation for search engines.",
   "instruments": [
    "dsa"
   ],
   "provisions": [
    "dsa:art-33"
   ],
   "institutions": [
    "ec"
   ],
   "enforcement": [],
   "actors": [
    "actor:vlose"
   ],
   "related_terms": [
    "gl-vlop"
   ],
   "claims": [
    "clm-dsa-vlop-threshold"
   ],
   "sources": [
    "src-eurlex-dsa"
   ],
   "last_verified": "2026-08-27"
  },
  {
   "id": "gl-gpai",
   "term": "GPAI",
   "legacy_dom_id": "gloss-gpai",
   "definition": "General-Purpose AI model under the AI Act — trained on broad data, displaying significant generality, capable of competently performing a wide range of distinct tasks.",
   "instruments": [
    "ai-act"
   ],
   "provisions": [
    "ai-act:art-3-63",
    "ai-act:art-51",
    "ai-act:art-53",
    "ai-act:art-55"
   ],
   "institutions": [
    "ai-office"
   ],
   "enforcement": [],
   "actors": [
    "actor:gpai-provider"
   ],
   "related_terms": [
    "gl-flop"
   ],
   "claims": [
    "clm-flop-threshold",
    "clm-gpai-code-voluntary"
   ],
   "sources": [
    "src-eurlex-ai-act"
   ],
   "last_verified": "2026-08-27"
  },
  {
   "id": "gl-dpia",
   "term": "DPIA",
   "legacy_dom_id": "gloss-dpia",
   "definition": "Data Protection Impact Assessment under GDPR Art. 35 — mandatory before high-risk processing begins.",
   "instruments": [
    "gdpr"
   ],
   "provisions": [
    "gdpr:art-35"
   ],
   "institutions": [
    "dpa-*"
   ],
   "enforcement": [],
   "actors": [
    "actor:controller"
   ],
   "related_terms": [
    "gl-dsa-art-34"
   ],
   "claims": [
    "clm-three-impact-assessments"
   ],
   "sources": [
    "src-eurlex-gdpr"
   ],
   "last_verified": "2026-08-27"
  },
  {
   "id": "gl-frand",
   "term": "FRAND",
   "legacy_dom_id": "gloss-frand",
   "definition": "Fair, Reasonable And Non-Discriminatory — the standard applied to mandatory B2B data-sharing terms under the Data Act.",
   "instruments": [
    "data-act"
   ],
   "provisions": [
    "data-act:art-8"
   ],
   "institutions": [
    "nca-*"
   ],
   "enforcement": [],
   "actors": [
    "actor:data-holder",
    "actor:data-recipient"
   ],
   "related_terms": [],
   "claims": [],
   "sources": [
    "src-eurlex-data-act"
   ],
   "last_verified": "2026-09-27",
   "requires_verification": false,
   "verification_note": "Data Act Art. 8(1): data made available in business-to-business relations 'under fair, reasonable and non-discriminatory terms and conditions'. Read on 27 Sep 2026 in the Official Journal text (CELEX 32023R2854). Earlier: The FRAND standard's location in the Data Act text has not been pinned to a provision in this build."
  },
  {
   "id": "gl-dsc",
   "term": "DSC",
   "legacy_dom_id": "gloss-dsc",
   "definition": "Digital Services Coordinator — each Member State's lead national authority under the DSA.",
   "instruments": [
    "dsa"
   ],
   "provisions": [
    "dsa:art-49",
    "dsa:art-56",
    "dsa:art-40"
   ],
   "institutions": [
    "dsc-*"
   ],
   "enforcement": [],
   "actors": [],
   "related_terms": [
    "gl-vlop"
   ],
   "claims": [
    "clm-dsa-commission-vlop-only",
    "clm-art-40-underperforming"
   ],
   "sources": [
    "src-eurlex-dsa"
   ],
   "last_verified": "2026-08-27"
  },
  {
   "id": "gl-cps",
   "term": "CPS",
   "legacy_dom_id": "gloss-cps",
   "definition": "Core Platform Service under the DMA — the scope-defining category (intermediation, search, social networking, OS, browsers, cloud, advertising, etc.) that can trigger gatekeeper designation.",
   "instruments": [
    "dma"
   ],
   "provisions": [
    "dma:art-2",
    "dma:art-3"
   ],
   "institutions": [
    "ec"
   ],
   "enforcement": [
    "enf-apple-gc-2026-designation"
   ],
   "actors": [
    "actor:gatekeeper"
   ],
   "related_terms": [
    "gl-gatekeeper"
   ],
   "claims": [
    "clm-dma-designation",
    "clm-dma-scope-gap"
   ],
   "sources": [
    "src-eurlex-dma"
   ],
   "last_verified": "2026-08-27"
  },
  {
   "id": "gl-gatekeeper",
   "term": "Gatekeeper",
   "legacy_dom_id": "gloss-gatekeeper",
   "definition": "An undertaking providing a core platform service, designated by the Commission under DMA Art. 3 on the basis of turnover or market capitalisation, user thresholds and an entrenched and durable position.",
   "instruments": [
    "dma"
   ],
   "provisions": [
    "dma:art-3",
    "dma:art-5",
    "dma:art-6",
    "dma:art-7"
   ],
   "institutions": [
    "ec"
   ],
   "enforcement": [
    "enf-apple-ec-2025",
    "enf-meta-ec-2025",
    "enf-apple-gc-2026-designation"
   ],
   "actors": [
    "actor:gatekeeper"
   ],
   "related_terms": [
    "gl-cps",
    "gl-vlop"
   ],
   "claims": [
    "clm-dma-designation",
    "clm-seven-gatekeepers",
    "clm-dma-commission-exclusive"
   ],
   "sources": [
    "src-eurlex-dma"
   ],
   "last_verified": "2026-08-27",
   "new_in_this_build": true,
   "note": "Added because the term is used throughout Part IV and in the taxonomy but had no glossary entry. This is the worked example from the specification: Gatekeeper to DMA to designation to obligations to Commission to enforcement."
  },
  {
   "id": "gl-flop",
   "term": "FLOP",
   "legacy_dom_id": "gloss-flop",
   "definition": "Floating-point operation — the unit used to measure AI training compute, and the basis of the AI Act's systemic-risk presumption (10^25 FLOP).",
   "instruments": [
    "ai-act"
   ],
   "provisions": [
    "ai-act:art-51",
    "ai-act:art-3-63"
   ],
   "institutions": [
    "ai-office"
   ],
   "enforcement": [],
   "actors": [
    "actor:gpai-provider"
   ],
   "related_terms": [
    "gl-gpai"
   ],
   "claims": [
    "clm-flop-threshold"
   ],
   "sources": [
    "src-eurlex-ai-act"
   ],
   "last_verified": "2026-08-27"
  },
  {
   "id": "gl-dora",
   "term": "DORA",
   "legacy_dom_id": "gloss-dora",
   "definition": "Digital Operational Resilience Act — ICT risk management for financial entities. A Regulation, not a Directive — no transposition patchwork.",
   "instruments": [
    "dora"
   ],
   "provisions": [],
   "institutions": [
    "esas",
    "nca-*"
   ],
   "enforcement": [],
   "actors": [
    "actor:financial-entity",
    "actor:ict-third-party-provider"
   ],
   "related_terms": [
    "gl-nis2"
   ],
   "claims": [
    "clm-directives-underperform"
   ],
   "sources": [
    "src-eurlex-dora"
   ],
   "last_verified": "2026-08-27"
  },
  {
   "id": "gl-nis2",
   "term": "NIS2",
   "legacy_dom_id": "gloss-nis2",
   "definition": "Network and Information Security Directive 2 — the EU's baseline cybersecurity Directive, covering entities in 18 sectors (11 in Annex I, 7 in Annex II).",
   "instruments": [
    "nis2"
   ],
   "provisions": [
    "nis2:art-20",
    "nis2:art-21",
    "nis2:art-23"
   ],
   "institutions": [
    "nca-*",
    "enisa",
    "member-states"
   ],
   "enforcement": [],
   "actors": [
    "actor:essential-entity",
    "actor:important-entity"
   ],
   "related_terms": [
    "gl-cer",
    "gl-dora",
    "gl-cra"
   ],
   "claims": [
    "clm-nis2-management-liability",
    "clm-nis2-transposition-failure",
    "clm-nis2-only-four-on-time"
   ],
   "sources": [
    "src-eurlex-nis2"
   ],
   "last_verified": "2026-09-27",
   "requires_verification": false,
   "verification_note": "Corrected on 27 Sep 2026: the 18 sectors are counted from Annexes I and II of the Official Journal text (CELEX 32022L2555). The earlier figure of 'roughly 160,000 entities' was removed rather than carried forward unsourced: no official source for it was found (the Commission's NIS2 policy page and FAQ do not give it). Earlier: The figures 'roughly 160,000 entities across 18 sectors' in the definition are not sourced and have not been verified."
  },
  {
   "id": "gl-cra",
   "term": "CRA",
   "legacy_dom_id": "gloss-cra",
   "definition": "Cyber Resilience Act — horizontal cybersecurity requirements for products with digital elements, across their lifecycle.",
   "instruments": [
    "cra"
   ],
   "provisions": [],
   "institutions": [
    "nca-*",
    "enisa"
   ],
   "enforcement": [],
   "actors": [
    "actor:pde-manufacturer"
   ],
   "related_terms": [
    "gl-nis2"
   ],
   "claims": [],
   "sources": [
    "src-eurlex-cra"
   ],
   "last_verified": "2026-08-27"
  },
  {
   "id": "gl-cer",
   "term": "CER",
   "legacy_dom_id": "gloss-cer",
   "definition": "Critical Entities Resilience Directive — NIS2's companion on physical resilience.",
   "instruments": [
    "cer"
   ],
   "provisions": [],
   "institutions": [
    "nca-*",
    "member-states"
   ],
   "enforcement": [],
   "actors": [
    "actor:critical-entity"
   ],
   "related_terms": [
    "gl-nis2"
   ],
   "claims": [],
   "sources": [
    "src-eurlex-cer"
   ],
   "last_verified": "2026-08-27"
  },
  {
   "id": "gl-dsa-art-34",
   "term": "DSA Art. 34",
   "legacy_dom_id": "gloss-dsa-art-34",
   "definition": "The systemic risk assessment obligation for VLOPs/VLOSEs — arguably the DSA's most consequential and most contested provision.",
   "instruments": [
    "dsa"
   ],
   "provisions": [
    "dsa:art-34",
    "dsa:art-35"
   ],
   "institutions": [
    "ec"
   ],
   "enforcement": [
    "enf-temu-ec-2026",
    "enf-tiktok-ec-2026-addictive",
    "enf-meta-ec-2026-addictive"
   ],
   "actors": [
    "actor:vlop",
    "actor:vlose"
   ],
   "related_terms": [
    "gl-vlop",
    "gl-dpia"
   ],
   "claims": [
    "clm-art-34-open-concept",
    "clm-three-impact-assessments"
   ],
   "sources": [
    "src-eurlex-dsa"
   ],
   "last_verified": "2026-08-27"
  },
  {
   "id": "gl-one-stop-shop",
   "term": "one-stop-shop",
   "legacy_dom_id": "gloss-one-stop-shop",
   "definition": "The GDPR mechanism (Art. 56) making the supervisory authority of a controller's main EU establishment the lead authority for cross-border cases — in practice, often Ireland.",
   "instruments": [
    "gdpr"
   ],
   "provisions": [
    "gdpr:art-56",
    "gdpr:art-60",
    "gdpr:art-65"
   ],
   "institutions": [
    "dpa-ie",
    "dpa-*",
    "edpb"
   ],
   "enforcement": [
    "enf-openai-garante-2024"
   ],
   "actors": [
    "actor:controller"
   ],
   "related_terms": [],
   "claims": [
    "clm-one-stop-shop",
    "clm-dpc-share-of-fines",
    "clm-openai-fine-voided"
   ],
   "sources": [
    "src-eurlex-gdpr"
   ],
   "last_verified": "2026-08-27"
  }
 ]
}