{
  "$schema_version": "1.0.0",
  "$description": "Institutions and authorities. One record type: an authority is an institution that holds a supervisory competence. Competence edges live here and nowhere else; 'who supervises instrument X' is answered by querying this file, never by a duplicated field on the instrument.",
  "$last_verified": "2026-08-27",
  "$note": "Wildcard institution IDs ending in '-*' denote the whole class of national bodies of that kind (dpa-* = all national data protection authorities). Wildcard instrument '*' in a competence means the role is held across the acquis rather than for one instrument.",
  "institutions": [
    {
      "id": "ec",
      "short_name": "European Commission",
      "full_name": "European Commission",
      "type": "inst-type:eu-institution",
      "member_state": null,
      "parent": null,
      "children": [
        "ec-dg-connect",
        "ec-dg-comp",
        "ai-office"
      ],
      "competences": [
        {
          "instrument": "*",
          "role": "role:legislates",
          "exclusive": false,
          "scope": "Right of legislative initiative.",
          "basis": [],
          "note": null
        },
        {
          "instrument": "*",
          "role": "role:issues-guidance",
          "exclusive": false,
          "scope": null,
          "basis": [],
          "note": null
        },
        {
          "instrument": "dma",
          "role": "role:supervises",
          "exclusive": true,
          "scope": "Sole enforcer of the DMA.",
          "basis": [
            "dma:art-38"
          ],
          "note": null
        },
        {
          "instrument": "dma",
          "role": "role:designates",
          "exclusive": true,
          "scope": "Gatekeeper designation decisions.",
          "basis": [
            "dma:art-3"
          ],
          "note": null
        },
        {
          "instrument": "dma",
          "role": "role:fines",
          "exclusive": true,
          "scope": null,
          "basis": [
            "dma:art-30"
          ],
          "note": null
        },
        {
          "instrument": "dsa",
          "role": "role:supervises",
          "exclusive": false,
          "scope": "VLOPs and VLOSEs only. National Digital Services Coordinators supervise everything below that tier.",
          "basis": [
            "dsa:art-56"
          ],
          "note": "The single most commonly conflated competence in the acquis."
        },
        {
          "instrument": "dsa",
          "role": "role:designates",
          "exclusive": true,
          "scope": "VLOP and VLOSE designation.",
          "basis": [
            "dsa:art-33"
          ],
          "note": null
        },
        {
          "instrument": "dsa",
          "role": "role:fines",
          "exclusive": false,
          "scope": "VLOPs and VLOSEs only.",
          "basis": [
            "dsa:art-74"
          ],
          "note": null
        },
        {
          "instrument": "ai-act",
          "role": "role:issues-guidance",
          "exclusive": false,
          "scope": null,
          "basis": [],
          "note": null
        },
        {
          "instrument": "nis2",
          "role": "role:investigates",
          "exclusive": false,
          "scope": "Infringement proceedings against Member States for failure to transpose. Not supervision of entities.",
          "basis": [],
          "note": null
        }
      ],
      "claims": [
        "clm-dma-commission-exclusive",
        "clm-dsa-commission-vlop-only"
      ],
      "sources": [
        "src-eurlex-dma",
        "src-eurlex-dsa"
      ],
      "last_verified": "2026-08-27"
    },
    {
      "id": "ec-dg-connect",
      "short_name": "DG CONNECT",
      "full_name": "Directorate-General for Communications Networks, Content and Technology",
      "type": "inst-type:directorate-general",
      "member_state": null,
      "parent": "ec",
      "children": [],
      "competences": [
        {
          "instrument": "dsa",
          "role": "role:supervises",
          "exclusive": false,
          "scope": "Houses the Commission’s DSA supervision and enforcement team for designated very large online platforms and search engines (Directorate F, Platforms Policy and Enforcement).",
          "basis": [],
          "note": "Established 27 Sep 2026 from the Commission’s own pages (src-ec-dsa-enforcement-team-2024): Directorate F at DG CONNECT supports the Commission’s supervisory and enforcement role under the DSA. The Commission, not the directorate-general, holds the powers in law: exclusively for Section 5 of Chapter III (DSA Art. 56(2)) and for the rest of the Regulation against very large online platforms and search engines (Art. 56(3)), read in the Official Journal text 27 Sep 2026. This records where the work sits."
        },
        {
          "instrument": "dma",
          "role": "role:investigates",
          "exclusive": false,
          "scope": "Half of the joint DG COMP–DG CONNECT team responsible for implementing and enforcing the DMA.",
          "basis": [],
          "note": "Established 27 Sep 2026 from the DMA portal (src-ec-dma-portal-whos-in-charge): the Commission is the sole enforcer, and a joint team in DG COMP and DG CONNECT implements and enforces the DMA."
        }
      ],
      "claims": [],
      "sources": [
        "src-ec-dsa-enforcement-team-2024",
        "src-ec-dma-portal-whos-in-charge"
      ],
      "last_verified": "2026-09-27"
    },
    {
      "id": "ec-dg-comp",
      "short_name": "DG COMP",
      "full_name": "Directorate-General for Competition",
      "type": "inst-type:directorate-general",
      "member_state": null,
      "parent": "ec",
      "children": [],
      "competences": [
        {
          "instrument": "dma",
          "role": "role:investigates",
          "exclusive": false,
          "scope": "Half of the joint DG COMP–DG CONNECT team responsible for implementing and enforcing the DMA.",
          "basis": [],
          "note": "Established 27 Sep 2026 from the DMA portal (src-ec-dma-portal-whos-in-charge): the Commission is the sole enforcer, and a joint team in DG COMP and DG CONNECT implements and enforces the DMA. The earlier wording, ‘operational lead’, was stronger than the source and is replaced."
        },
        {
          "instrument": "tfeu",
          "role": "role:investigates",
          "exclusive": true,
          "scope": "Article 102 TFEU antitrust enforcement, which runs alongside the DMA rather than instead of it.",
          "basis": [
            "tfeu:art-102"
          ],
          "note": null
        }
      ],
      "claims": [
        "clm-dma-alongside-102"
      ],
      "sources": [
        "src-ec-google-adtech-2025",
        "src-ec-dma-portal-whos-in-charge"
      ],
      "last_verified": "2026-09-27"
    },
    {
      "id": "ai-office",
      "short_name": "AI Office",
      "full_name": "European AI Office",
      "type": "inst-type:eu-body",
      "member_state": null,
      "parent": "ec",
      "children": [],
      "competences": [
        {
          "instrument": "ai-act",
          "role": "role:supervises",
          "exclusive": true,
          "scope": "General-purpose AI models under Chapter V.",
          "basis": [
            "ai-act:art-53",
            "ai-act:art-55"
          ],
          "note": null
        },
        {
          "instrument": "ai-act",
          "role": "role:issues-guidance",
          "exclusive": false,
          "scope": "Including the GPAI Code of Practice process.",
          "basis": [],
          "note": null
        }
      ],
      "claims": [
        "clm-gpai-code-voluntary"
      ],
      "sources": [
        "src-ec-gpai-code"
      ],
      "last_verified": "2026-08-27"
    },
    {
      "id": "edpb",
      "short_name": "EDPB",
      "full_name": "European Data Protection Board",
      "type": "inst-type:network",
      "member_state": null,
      "parent": null,
      "children": [
        "dpa-*"
      ],
      "competences": [
        {
          "instrument": "gdpr",
          "role": "role:coordinates",
          "exclusive": false,
          "scope": "Consistency mechanism and dispute resolution between national authorities.",
          "basis": [
            "gdpr:art-65"
          ],
          "note": null
        },
        {
          "instrument": "gdpr",
          "role": "role:issues-guidance",
          "exclusive": false,
          "scope": null,
          "basis": [],
          "note": null
        },
        {
          "instrument": "gdpr",
          "role": "role:advises",
          "exclusive": false,
          "scope": "Opinions on legislative proposals.",
          "basis": [],
          "note": null
        },
        {
          "instrument": "dsa",
          "role": "role:issues-guidance",
          "exclusive": false,
          "scope": "On the DSA–GDPR interface.",
          "basis": [],
          "note": null
        }
      ],
      "claims": [
        "clm-edpb-edps-omnibus-pushback"
      ],
      "sources": [
        "src-edpb-jo-1-2026",
        "src-edpb-jo-2-2026"
      ],
      "last_verified": "2026-08-27"
    },
    {
      "id": "edps",
      "short_name": "EDPS",
      "full_name": "European Data Protection Supervisor",
      "type": "inst-type:eu-body",
      "member_state": null,
      "parent": null,
      "children": [],
      "competences": [
        {
          "instrument": "gdpr",
          "role": "role:supervises",
          "exclusive": true,
          "scope": "Supervises the EU institutions themselves, under Regulation (EU) 2018/1725 rather than the GDPR.",
          "basis": [],
          "note": "The distinct legal basis matters: the EDPS does not supervise Member State controllers."
        },
        {
          "instrument": "gdpr",
          "role": "role:advises",
          "exclusive": false,
          "scope": "Opinions on legislative proposals, including against the Commission's own.",
          "basis": [],
          "note": null
        }
      ],
      "claims": [
        "clm-edps-opposes-commission",
        "clm-edpb-edps-omnibus-pushback"
      ],
      "sources": [
        "src-edpb-jo-1-2026",
        "src-edpb-jo-2-2026",
        "src-cjeu-c413-23p"
      ],
      "last_verified": "2026-08-27"
    },
    {
      "id": "enisa",
      "short_name": "ENISA",
      "full_name": "European Union Agency for Cybersecurity",
      "type": "inst-type:eu-agency",
      "member_state": null,
      "parent": null,
      "children": [],
      "competences": [
        {
          "instrument": "nis2",
          "role": "role:coordinates",
          "exclusive": false,
          "scope": null,
          "basis": [],
          "note": null
        },
        {
          "instrument": "nis2",
          "role": "role:issues-guidance",
          "exclusive": false,
          "scope": null,
          "basis": [],
          "note": null
        },
        {
          "instrument": "cra",
          "role": "role:coordinates",
          "exclusive": false,
          "scope": "Establishes, manages and maintains the single reporting platform; receives manufacturers' notifications alongside the coordinating CSIRT.",
          "basis": [
            "cra:art-14",
            "cra:art-16"
          ],
          "note": "Verified 27 Sep 2026 against CRA Arts 14(1) and 16(1) in the Official Journal (CELEX 32024R2847)."
        }
      ],
      "claims": [],
      "sources": [
        "src-eurlex-nis2",
        "src-eurlex-cra"
      ],
      "last_verified": "2026-08-27"
    },
    {
      "id": "cjeu",
      "short_name": "CJEU",
      "full_name": "Court of Justice of the European Union",
      "type": "inst-type:court",
      "member_state": null,
      "parent": null,
      "children": [
        "gc"
      ],
      "competences": [
        {
          "instrument": "*",
          "role": "role:interprets",
          "exclusive": true,
          "scope": "Definitive interpretation of Union law, including on preliminary reference.",
          "basis": [],
          "note": null
        },
        {
          "instrument": "nis2",
          "role": "role:hears-appeals",
          "exclusive": true,
          "scope": "Infringement actions against Member States, including financial sanctions.",
          "basis": [],
          "note": null
        }
      ],
      "claims": [
        "clm-cjeu-pseudonymised-data"
      ],
      "sources": [
        "src-cjeu-c413-23p",
        "src-ec-nis2-referral-2026"
      ],
      "last_verified": "2026-08-27"
    },
    {
      "id": "gc",
      "short_name": "General Court",
      "full_name": "General Court of the European Union",
      "type": "inst-type:court",
      "member_state": null,
      "parent": "cjeu",
      "children": [],
      "competences": [
        {
          "instrument": "dma",
          "role": "role:hears-appeals",
          "exclusive": false,
          "scope": "Actions for annulment against Commission designation and non-compliance decisions.",
          "basis": [],
          "note": null
        },
        {
          "instrument": "dsa",
          "role": "role:hears-appeals",
          "exclusive": false,
          "scope": "Including the supervisory-fee decisions.",
          "basis": [],
          "note": null
        }
      ],
      "claims": [
        "clm-gc-apple-designation-upheld",
        "clm-gc-supervisory-fee-annulled"
      ],
      "sources": [
        "src-gc-apple-designation-2026",
        "src-gc-supervisory-fee-2025"
      ],
      "last_verified": "2026-08-27"
    },
    {
      "id": "ep",
      "short_name": "European Parliament",
      "full_name": "European Parliament",
      "type": "inst-type:eu-institution",
      "member_state": null,
      "parent": null,
      "children": [],
      "competences": [
        {
          "instrument": "*",
          "role": "role:legislates",
          "exclusive": false,
          "scope": "Co-legislator under the ordinary legislative procedure.",
          "basis": [],
          "note": null
        }
      ],
      "claims": [
        "clm-ep-privacy-defender"
      ],
      "sources": [
        "src-ep-legtrain-digital-package"
      ],
      "last_verified": "2026-08-27"
    },
    {
      "id": "council",
      "short_name": "Council",
      "full_name": "Council of the European Union",
      "type": "inst-type:eu-institution",
      "member_state": null,
      "parent": null,
      "children": [],
      "competences": [
        {
          "instrument": "*",
          "role": "role:legislates",
          "exclusive": false,
          "scope": "Co-legislator under the ordinary legislative procedure.",
          "basis": [],
          "note": null
        }
      ],
      "claims": [
        "clm-data-omnibus-stalled"
      ],
      "sources": [
        "src-council-cloud-ai-act-2026",
        "src-privacynext-2026-omnibus"
      ],
      "last_verified": "2026-08-27"
    },
    {
      "id": "dpa-*",
      "short_name": "National DPAs",
      "full_name": "National data protection supervisory authorities",
      "type": "inst-type:national-authority",
      "member_state": null,
      "parent": "edpb",
      "children": [],
      "competences": [
        {
          "instrument": "gdpr",
          "role": "role:supervises",
          "exclusive": false,
          "scope": "Each in its own Member State; cross-border cases are led by the main-establishment authority under the one-stop-shop.",
          "basis": [
            "gdpr:art-51",
            "gdpr:art-56"
          ],
          "note": null
        },
        {
          "instrument": "gdpr",
          "role": "role:investigates",
          "exclusive": false,
          "scope": null,
          "basis": [
            "gdpr:art-58"
          ],
          "note": null
        },
        {
          "instrument": "gdpr",
          "role": "role:fines",
          "exclusive": false,
          "scope": null,
          "basis": [
            "gdpr:art-83"
          ],
          "note": null
        }
      ],
      "claims": [
        "clm-one-stop-shop"
      ],
      "sources": [
        "src-eurlex-gdpr"
      ],
      "last_verified": "2026-08-27"
    },
    {
      "id": "dpa-ie",
      "short_name": "Irish DPC",
      "full_name": "Data Protection Commission (Ireland)",
      "type": "inst-type:national-authority",
      "member_state": "ie",
      "parent": "edpb",
      "children": [],
      "competences": [
        {
          "instrument": "gdpr",
          "role": "role:supervises",
          "exclusive": false,
          "scope": "Lead supervisory authority for most large platform controllers with their main establishment in Ireland.",
          "basis": [
            "gdpr:art-56"
          ],
          "note": null
        },
        {
          "instrument": "gdpr",
          "role": "role:fines",
          "exclusive": false,
          "scope": null,
          "basis": [
            "gdpr:art-83"
          ],
          "note": null
        }
      ],
      "claims": [
        "clm-dpc-share-of-fines",
        "clm-dpc-collected",
        "clm-dpc-staff-growth"
      ],
      "sources": [
        "src-dpc-fines-page",
        "src-thestory-2026-fines-limbo",
        "src-rte-2026-dpc-4bn"
      ],
      "last_verified": "2026-08-27"
    },
    {
      "id": "dpa-nl",
      "short_name": "AP",
      "full_name": "Autoriteit Persoonsgegevens (Netherlands)",
      "type": "inst-type:national-authority",
      "member_state": "nl",
      "parent": "edpb",
      "children": [],
      "competences": [
        {
          "instrument": "gdpr",
          "role": "role:supervises",
          "exclusive": false,
          "scope": null,
          "basis": [
            "gdpr:art-51"
          ],
          "note": null
        },
        {
          "instrument": "gdpr",
          "role": "role:fines",
          "exclusive": false,
          "scope": null,
          "basis": [
            "gdpr:art-83"
          ],
          "note": null
        }
      ],
      "claims": [
        "clm-ap-uber-2026",
        "clm-ap-uber-2024"
      ],
      "sources": [
        "src-ap-uber-2026",
        "src-ap-uber-2024"
      ],
      "last_verified": "2026-09-27"
    },
    {
      "id": "dpa-lu",
      "short_name": "CNPD",
      "full_name": "Commission nationale pour la protection des données (Luxembourg)",
      "type": "inst-type:national-authority",
      "member_state": "lu",
      "parent": "edpb",
      "children": [],
      "competences": [
        {
          "instrument": "gdpr",
          "role": "role:supervises",
          "exclusive": false,
          "scope": null,
          "basis": [
            "gdpr:art-56"
          ],
          "note": null
        },
        {
          "instrument": "gdpr",
          "role": "role:fines",
          "exclusive": false,
          "scope": null,
          "basis": [
            "gdpr:art-83"
          ],
          "note": null
        }
      ],
      "claims": [
        "clm-amazon-annulment"
      ],
      "sources": [
        "src-linarilaw-2026-amazon"
      ],
      "last_verified": "2026-08-27"
    },
    {
      "id": "dpa-it",
      "short_name": "Garante",
      "full_name": "Garante per la protezione dei dati personali (Italy)",
      "type": "inst-type:national-authority",
      "member_state": "it",
      "parent": "edpb",
      "children": [],
      "competences": [
        {
          "instrument": "gdpr",
          "role": "role:supervises",
          "exclusive": false,
          "scope": null,
          "basis": [
            "gdpr:art-51"
          ],
          "note": null
        },
        {
          "instrument": "gdpr",
          "role": "role:fines",
          "exclusive": false,
          "scope": null,
          "basis": [
            "gdpr:art-83"
          ],
          "note": null
        }
      ],
      "claims": [
        "clm-openai-fine-voided"
      ],
      "sources": [
        "src-europeanlawblog-openai-rome"
      ],
      "last_verified": "2026-08-27"
    },
    {
      "id": "dpa-es",
      "short_name": "AEPD",
      "full_name": "Agencia Española de Protección de Datos (Spain)",
      "type": "inst-type:national-authority",
      "member_state": "es",
      "parent": "edpb",
      "children": [],
      "competences": [
        {
          "instrument": "gdpr",
          "role": "role:supervises",
          "exclusive": false,
          "scope": null,
          "basis": [
            "gdpr:art-51"
          ],
          "note": null
        },
        {
          "instrument": "gdpr",
          "role": "role:fines",
          "exclusive": false,
          "scope": null,
          "basis": [
            "gdpr:art-83"
          ],
          "note": null
        }
      ],
      "claims": [
        "clm-spain-most-decisions"
      ],
      "sources": [
        "src-brief-original"
      ],
      "last_verified": "2026-08-27"
    },
    {
      "id": "dsc-*",
      "short_name": "Digital Services Coordinators",
      "full_name": "National Digital Services Coordinators",
      "type": "inst-type:national-authority",
      "member_state": null,
      "parent": null,
      "children": [],
      "competences": [
        {
          "instrument": "dsa",
          "role": "role:supervises",
          "exclusive": false,
          "scope": "All intermediaries below the VLOP/VLOSE tier, in the Member State of establishment.",
          "basis": [
            "dsa:art-49",
            "dsa:art-56"
          ],
          "note": null
        },
        {
          "instrument": "dsa",
          "role": "role:coordinates",
          "exclusive": false,
          "scope": "Vetting of researchers and transmission of Art. 40(4) data-access requests.",
          "basis": [
            "dsa:art-40"
          ],
          "note": null
        }
      ],
      "claims": [
        "clm-dsa-commission-vlop-only",
        "clm-art-40-underperforming"
      ],
      "sources": [
        "src-eurlex-dsa"
      ],
      "last_verified": "2026-08-27"
    },
    {
      "id": "nca-*",
      "short_name": "National competent authorities",
      "full_name": "National competent authorities designated under sectoral instruments",
      "type": "inst-type:national-authority",
      "member_state": null,
      "parent": null,
      "children": [],
      "competences": [
        {
          "instrument": "data-act",
          "role": "role:supervises",
          "exclusive": false,
          "scope": "Enforcement is national and penalties are set by Member States.",
          "basis": [],
          "note": null
        },
        {
          "instrument": "nis2",
          "role": "role:supervises",
          "exclusive": false,
          "scope": "Essential and important entities in the Member State.",
          "basis": [
            "nis2:art-31"
          ],
          "note": null
        },
        {
          "instrument": "cra",
          "role": "role:supervises",
          "exclusive": false,
          "scope": "Market surveillance authorities.",
          "basis": [],
          "note": null
        },
        {
          "instrument": "ai-act",
          "role": "role:supervises",
          "exclusive": false,
          "scope": "AI systems other than general-purpose AI models, which sit with the AI Office.",
          "basis": [],
          "note": null
        }
      ],
      "claims": [
        "clm-data-act-enforcement-uneven"
      ],
      "sources": [
        "src-eurlex-data-act",
        "src-eurlex-nis2"
      ],
      "last_verified": "2026-08-27"
    },
    {
      "id": "esas",
      "short_name": "ESAs",
      "full_name": "European Supervisory Authorities (EBA, EIOPA, ESMA)",
      "type": "inst-type:eu-agency",
      "member_state": null,
      "parent": null,
      "children": [],
      "competences": [
        {
          "instrument": "dora",
          "role": "role:supervises",
          "exclusive": false,
          "scope": "Designate critical ICT third-party service providers through the Joint Committee; the ESA responsible for the financial entities with the largest share of total assets among a provider's users is its Lead Overseer.",
          "basis": [
            "dora:art-31"
          ],
          "note": "Verified 27 Sep 2026 against DORA Art. 31(1) in the Official Journal (CELEX 32022R2554)."
        }
      ],
      "claims": [],
      "sources": [
        "src-eurlex-dora"
      ],
      "last_verified": "2026-08-27"
    },
    {
      "id": "member-states",
      "short_name": "Member States",
      "full_name": "Member States of the European Union",
      "type": "inst-type:national-authority",
      "member_state": null,
      "parent": null,
      "children": [],
      "competences": [
        {
          "instrument": "nis2",
          "role": "role:transposes",
          "exclusive": true,
          "scope": "Transposition deadline 17 October 2024.",
          "basis": [],
          "note": null
        },
        {
          "instrument": "cer",
          "role": "role:transposes",
          "exclusive": true,
          "scope": "Same transposition deadline.",
          "basis": [],
          "note": null
        },
        {
          "instrument": "pld",
          "role": "role:transposes",
          "exclusive": true,
          "scope": null,
          "basis": [],
          "note": null
        },
        {
          "instrument": "data-act",
          "role": "role:fines",
          "exclusive": false,
          "scope": "Penalty levels are set nationally rather than by the Regulation.",
          "basis": [],
          "note": null
        }
      ],
      "claims": [
        "clm-nis2-transposition-failure",
        "clm-nis2-only-four-on-time"
      ],
      "sources": [
        "src-ec-nis2-lfn-2024",
        "src-ec-nis2-referral-2026"
      ],
      "last_verified": "2026-08-27"
    }
  ]
}