{ "$schema_version": "1.0.0", "$description": "Instruments, their nested provisions, and cross-instrument relationships. Instruments carry NO dates: every date is a timeline record referenced by ID through 'milestones'. Instruments carry NO supervisor field: competence is an edge in institutions.json.", "$last_verified": "2026-08-27", "$note": "legislative_status is a scalar describing position in the legislative process. It is deliberately NOT sufficient on its own: for staggered instruments the milestones array is authoritative about what actually applies and when. Entry into force and application are never merged. Treaty articles are modelled as provisions of the 'tfeu' and 'teu' instruments (tfeu:art-114, teu:art-4-2), so a legal basis is always a provision ID and never a special case. AUDIT-2026-09-25 (2026-09-26): records re-read individually against their sources carry that date in their own last_verified; this file's $last_verified is deliberately unchanged, because the file as a whole was not re-read, and moving it would assert that it was.", "instruments": [ { "id": "gdpr", "aliases": [ "general-data-protection-regulation", "reg-2016-679" ], "celex": "32016R0679", "short_name": "GDPR", "full_name": "Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data", "kind": "kind:regulation", "scope_class": "scope:core", "brief_part": "part-2", "legislative_status": "status:applicable", "status_as_of": "2026-10-21", "status_note": "Re-evaluated 21 Oct 2026 (audit item 9): in force with no end of validity and no amending act recorded, per the Publications Office's metadata (Cellar SPARQL, read 21 Oct 2026); general application since 25 May 2018 (Art. 99(2), milestone). Status unchanged. Only the status was re-read that day; the other fields of this record were last re-read on 27 Aug 2026.", "milestones": [ "tl-gdpr-2016-04-27-adoption", "tl-gdpr-2016-05-04-publication", "tl-gdpr-2016-05-24-entry-into-force", "tl-gdpr-2018-05-25-application" ], "amended_by": [], "amends": [], "repeals": [], "transposition": null, "dna": { "regulated_actor": [ "actor:controller", "actor:processor" ], "protected_party": [ "actor:data-subject" ], "objective": "Protection of natural persons with regard to the processing of personal data, and free movement of such data within the Union.", "risk_logic": "Risk to the rights and freedoms of natural persons.", "obligation_anchor": [ "gdpr:art-5", "gdpr:art-6", "gdpr:art-25", "gdpr:art-30", "gdpr:art-35" ], "enforcement_mechanism": "National supervisory authorities with the one-stop-shop for cross-border cases; EDPB consistency and dispute resolution.", "sanction_ceiling": { "pct_global_turnover": 4, "fixed_eur": 20000000, "basis": "gdpr:art-83", "note": "Two-tier: 2%/EUR 10m for the lower tier, 4%/EUR 20m for the upper tier. The figure recorded is the upper tier." }, "territorial_scope": [ "territory:eu-established", "territory:non-eu-serving-eu" ], "implementation_model": "Directly applicable" }, "provisions": [ { "id": "gdpr:art-3", "number": "3", "heading": "Territorial scope", "summary": "Applies to processing by a controller or processor established in the Union, and to processing of data subjects in the Union by a controller not established in the Union where it relates to offering goods or services to them or monitoring their behaviour.", "obligation_on": [ "actor:controller", "actor:processor" ], "claims": [], "sources": [ "src-eurlex-gdpr" ], "requires_verification": false, "verification_note": "Verified 27 Sep 2026 against the Official Journal text (English, retrieved that day from the Publications Office Cellar, CELEX 32016R0679): heading and number match; the summary was checked against paragraphs 1 and 2 (establishment in the Union; offering goods or services to, or monitoring the behaviour of, data subjects in the Union). Paragraph 3 (Member State law applying by virtue of public international law) is not in the summary. The earlier note said the article was recorded from general knowledge." }, { "id": "gdpr:art-5", "number": "5", "heading": "Principles relating to processing of personal data", "summary": "Six processing principles plus accountability: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality.", "obligation_on": [ "actor:controller" ], "claims": [], "sources": [ "src-eurlex-gdpr" ] }, { "id": "gdpr:art-6", "number": "6", "heading": "Lawfulness of processing", "summary": "Exhaustive list of lawful bases: consent, contract, legal obligation, vital interests, public task, legitimate interests.", "obligation_on": [ "actor:controller" ], "claims": [], "sources": [ "src-eurlex-gdpr" ] }, { "id": "gdpr:art-9", "number": "9", "heading": "Processing of special categories of personal data", "summary": "Prohibits processing of special categories absent a narrow derogation.", "obligation_on": [ "actor:controller" ], "claims": [], "sources": [ "src-eurlex-gdpr" ] }, { "id": "gdpr:art-22", "number": "22", "heading": "Automated individual decision-making, including profiling", "summary": "Protection against decisions based solely on automated processing producing legal or similarly significant effects. In force since 2018, and therefore the pre-existing European law of automated decision-making.", "obligation_on": [ "actor:controller" ], "claims": [ "clm-art-22-predates-ai-act" ], "sources": [ "src-eurlex-gdpr" ] }, { "id": "gdpr:art-25", "number": "25", "heading": "Data protection by design and by default", "summary": null, "obligation_on": [ "actor:controller" ], "claims": [], "sources": [ "src-eurlex-gdpr" ] }, { "id": "gdpr:art-30", "number": "30", "heading": "Records of processing activities", "summary": null, "obligation_on": [ "actor:controller", "actor:processor" ], "claims": [], "sources": [ "src-eurlex-gdpr" ] }, { "id": "gdpr:art-33", "number": "33", "heading": "Notification of a personal data breach to the supervisory authority", "summary": "72-hour notification decision.", "obligation_on": [ "actor:controller" ], "claims": [], "sources": [ "src-eurlex-gdpr" ] }, { "id": "gdpr:art-35", "number": "35", "heading": "Data protection impact assessment", "summary": "The conceptual ancestor of the DSA's Art. 34 systemic risk assessment and the AI Act's Art. 27 fundamental rights impact assessment.", "obligation_on": [ "actor:controller" ], "claims": [ "clm-three-impact-assessments" ], "sources": [ "src-eurlex-gdpr" ] }, { "id": "gdpr:art-37", "number": "37", "heading": "Designation of the data protection officer", "summary": "Mandatory where processing is carried out by a public authority or body, and in the other cases the Article specifies.", "obligation_on": [ "actor:controller", "actor:processor", "actor:public-authority" ], "claims": [], "sources": [ "src-eurlex-gdpr" ], "requires_verification": false, "verification_note": "Verified 27 Sep 2026 against the Official Journal text (English, retrieved that day from the Publications Office Cellar, CELEX 32016R0679): heading and number match; the summary was checked against paragraph 1, points (a) to (c): a public authority or body (courts acting in their judicial capacity excepted), regular and systematic monitoring on a large scale, and large-scale processing of special categories. The earlier note said the article was recorded from general knowledge." }, { "id": "gdpr:art-51", "number": "51", "heading": "Supervisory authority", "summary": "Each Member State provides for one or more independent supervisory authorities.", "obligation_on": [ "actor:member-state" ], "claims": [], "sources": [ "src-eurlex-gdpr" ] }, { "id": "gdpr:art-56", "number": "56", "heading": "Competence of the lead supervisory authority", "summary": "The one-stop-shop: the authority of the controller's main establishment leads cross-border cases.", "obligation_on": [], "claims": [ "clm-one-stop-shop", "clm-dpc-share-of-fines" ], "sources": [ "src-eurlex-gdpr" ] }, { "id": "gdpr:art-58", "number": "58", "heading": "Powers of supervisory authorities", "summary": null, "obligation_on": [], "claims": [], "sources": [ "src-eurlex-gdpr" ] }, { "id": "gdpr:art-60", "number": "60", "heading": "Cooperation between the lead authority and other concerned authorities", "summary": null, "obligation_on": [], "claims": [], "sources": [ "src-eurlex-gdpr" ] }, { "id": "gdpr:art-65", "number": "65", "heading": "Dispute resolution by the Board", "summary": null, "obligation_on": [], "claims": [], "sources": [ "src-eurlex-gdpr" ] }, { "id": "gdpr:art-83", "number": "83", "heading": "General conditions for imposing administrative fines", "summary": "Two-tier penalty ceilings.", "obligation_on": [], "claims": [ "clm-dpc-collected" ], "sources": [ "src-eurlex-gdpr" ] } ], "claims": [ "clm-gdpr-total-fines", "clm-gdpr-gravitational-centre" ], "sources": [ "src-eurlex-gdpr" ], "last_verified": "2026-10-21", "legal_basis": [ "tfeu:art-114" ] }, { "id": "dsa", "aliases": [ "digital-services-act", "reg-2022-2065" ], "celex": "32022R2065", "short_name": "DSA", "full_name": "Regulation (EU) 2022/2065 on a Single Market For Digital Services", "kind": "kind:regulation", "scope_class": "scope:core", "brief_part": "part-3", "legislative_status": "status:applicable", "status_as_of": "2026-10-21", "status_note": "Re-evaluated 21 Oct 2026 (audit item 9): in force with no end of validity and no amending act recorded, per the Publications Office's metadata (Cellar SPARQL, read 21 Oct 2026); applicable to all providers since 17 February 2024 (Art. 93(2), milestone). Status unchanged. Only the status was re-read that day; the other fields of this record were last re-read on 27 Aug 2026.", "milestones": [ "tl-dsa-2022-10-19-adoption", "tl-dsa-2022-10-27-publication", "tl-dsa-2022-11-16-entry-into-force", "tl-dsa-2023-08-01-application", "tl-dsa-2024-02-17-application", "tl-dsa-2025-10-29-delegated-act" ], "amended_by": [], "amends": [ "ecommerce-directive" ], "repeals": [], "transposition": null, "dna": { "regulated_actor": [ "actor:intermediary", "actor:hosting-provider", "actor:online-platform", "actor:vlop", "actor:vlose" ], "protected_party": [ "actor:recipient-of-service" ], "objective": "A single market for digital services, replacing the liability core of the 2000 e-Commerce Directive with a graduated due-diligence regime.", "risk_logic": "Systemic risk (Art. 34), assessed by the provider and mitigated proportionately.", "obligation_anchor": [ "dsa:art-16", "dsa:art-34", "dsa:art-35", "dsa:art-40" ], "enforcement_mechanism": "Commission for VLOPs and VLOSEs; national Digital Services Coordinators for all lower tiers.", "sanction_ceiling": { "pct_global_turnover": 6, "fixed_eur": null, "basis": "dsa:art-74", "note": null }, "territorial_scope": [ "territory:eu-established", "territory:non-eu-serving-eu" ], "implementation_model": "Directly applicable" }, "provisions": [ { "id": "dsa:art-16", "number": "16", "heading": "Notice and action mechanisms", "summary": "Electronic notice mechanisms for sufficiently precise and adequately substantiated notices. Art. 16(3) provides that a compliant notice gives rise to actual knowledge or awareness for the Art. 6 liability exemption where it allows a diligent provider to identify the illegality without a detailed legal examination.", "obligation_on": [ "actor:hosting-provider" ], "claims": [ "clm-art-16-over-removal-incentive" ], "sources": [ "src-eurlex-dsa" ] }, { "id": "dsa:art-25", "number": "25", "heading": "Online interface design and organisation", "summary": "Ban on dark patterns. Art. 25(2) excludes practices covered by the Unfair Commercial Practices Directive.", "obligation_on": [ "actor:online-platform" ], "claims": [], "sources": [ "src-eurlex-dsa" ] }, { "id": "dsa:art-28", "number": "28", "heading": "Online protection of minors", "summary": "Measures to ensure a high level of privacy, safety and security for minors, including a prohibition on advertising based on profiling where the recipient is known to be a minor.", "obligation_on": [ "actor:online-platform" ], "claims": [], "sources": [ "src-eurlex-dsa" ], "requires_verification": false, "verification_note": "Verified 27 Sep 2026 against the Official Journal text (English, retrieved that day from the Publications Office Cellar, CELEX 32022R2065): heading and number match; the summary was checked against paragraphs 1 and 2. The Regulation's own threshold for the advertising prohibition is that the provider is \"aware with reasonable certainty\" that the recipient is a minor, which the summary shortens to \"known\". The earlier note said the article was recorded from general knowledge." }, { "id": "dsa:art-30", "number": "30", "heading": "Traceability of traders", "summary": "Online platforms allowing consumers to conclude distance contracts with traders must obtain and check specified trader information before allowing use of the service.", "obligation_on": [ "actor:online-platform" ], "claims": [], "sources": [ "src-eurlex-dsa" ], "requires_verification": false, "verification_note": "Verified 27 Sep 2026 against the Official Journal text (English, retrieved that day from the Publications Office Cellar, CELEX 32022R2065): heading and number match; the summary was checked against paragraph 1 (information the platform must obtain before a trader may use it to offer products or services to consumers in the Union). The earlier note said the article was recorded from general knowledge." }, { "id": "dsa:art-33", "number": "33", "heading": "Very large online platforms and very large online search engines", "summary": "Designation threshold of 45 million average monthly active recipients in the Union.", "obligation_on": [], "claims": [ "clm-dsa-vlop-threshold" ], "sources": [ "src-eurlex-dsa" ] }, { "id": "dsa:art-34", "number": "34", "heading": "Risk assessment", "summary": "VLOPs and VLOSEs must diligently identify, analyse and assess systemic risks stemming from the design or functioning of their service, at least annually and before deploying functionalities likely to have a critical impact.", "obligation_on": [ "actor:vlop", "actor:vlose" ], "claims": [ "clm-art-34-open-concept" ], "sources": [ "src-eurlex-dsa" ] }, { "id": "dsa:art-35", "number": "35", "heading": "Mitigation of risks", "summary": "Proportionate, effective mitigation, with the choice of measures left to the provider.", "obligation_on": [ "actor:vlop", "actor:vlose" ], "claims": [ "clm-art-34-open-concept" ], "sources": [ "src-eurlex-dsa" ] }, { "id": "dsa:art-38", "number": "38", "heading": "Recommender systems", "summary": "At least one recommender option not based on profiling.", "obligation_on": [ "actor:vlop", "actor:vlose" ], "claims": [], "sources": [ "src-eurlex-dsa" ] }, { "id": "dsa:art-39", "number": "39", "heading": "Additional online advertising transparency", "summary": "Enhanced advertisement repository.", "obligation_on": [ "actor:vlop", "actor:vlose" ], "claims": [], "sources": [ "src-eurlex-dsa" ] }, { "id": "dsa:art-40", "number": "40", "heading": "Data access and scrutiny", "summary": "Art. 40(12) access to publicly available data; Art. 40(4) access to non-public data for vetted researchers, requested through the Digital Services Coordinator of establishment. Both purpose-limited to research on systemic risks.", "obligation_on": [ "actor:vlop", "actor:vlose" ], "claims": [ "clm-art-40-underperforming", "clm-x-data-access-staffing" ], "sources": [ "src-eurlex-dsa", "src-eurlex-dsa-da-2050" ] }, { "id": "dsa:art-49", "number": "49", "heading": "Competent authorities and Digital Services Coordinators", "summary": null, "obligation_on": [ "actor:member-state" ], "claims": [], "sources": [ "src-eurlex-dsa" ] }, { "id": "dsa:art-56", "number": "56", "heading": "Competences", "summary": "Allocates supervision between the Commission (VLOPs and VLOSEs) and national Digital Services Coordinators.", "obligation_on": [], "claims": [ "clm-dsa-commission-vlop-only" ], "sources": [ "src-eurlex-dsa" ] }, { "id": "dsa:art-74", "number": "74", "heading": "Fines", "summary": "Up to 6% of global annual turnover.", "obligation_on": [], "claims": [], "sources": [ "src-eurlex-dsa" ] } ], "claims": [ "clm-dsa-four-tiers", "clm-dsa-enforcement-escalation" ], "sources": [ "src-eurlex-dsa" ], "last_verified": "2026-10-21", "legal_basis": [ "tfeu:art-114" ] }, { "id": "dma", "aliases": [ "digital-markets-act", "reg-2022-1925" ], "celex": "32022R1925", "short_name": "DMA", "full_name": "Regulation (EU) 2022/1925 on contestable and fair markets in the digital sector", "kind": "kind:regulation", "scope_class": "scope:core", "brief_part": "part-4", "legislative_status": "status:applicable", "status_as_of": "2026-10-21", "status_note": "Re-evaluated 21 Oct 2026 (audit item 9): in force with no end of validity and no amending act recorded, per the Publications Office's metadata (Cellar SPARQL, read 21 Oct 2026); applicable since 2 May 2023 (Art. 54, milestone). Status unchanged. Only the status was re-read that day; the other fields of this record were last re-read on 27 Aug 2026.", "milestones": [ "tl-dma-2022-09-14-adoption", "tl-dma-2022-10-12-publication", "tl-dma-2022-11-01-entry-into-force", "tl-dma-2023-05-01-application", "tl-dma-2024-03-07-compliance", "tl-dma-2026-04-28-review", "tl-dma-2026-11-01-designation", "tl-dma-2027-05-01-market-investigation", "tl-dma-2027-01-01-compliance-deadline", "tl-dma-2027-07-01-compliance-deadline" ], "amended_by": [], "amends": [], "repeals": [], "transposition": null, "dna": { "regulated_actor": [ "actor:gatekeeper" ], "protected_party": [ "actor:business-user", "actor:end-user" ], "objective": "Contestable and fair markets in the digital sector, through ex ante obligations rather than ex post proof of anticompetitive effect.", "risk_logic": "Contestability and fairness. Designation is a binary switch, not a graduated tier.", "obligation_anchor": [ "dma:art-5", "dma:art-6", "dma:art-7" ], "enforcement_mechanism": "The Commission is the sole enforcer. National competition authorities may investigate possible non-compliance with Arts. 5-7 on their territory and report to support the Commission (Art. 38(7)); national courts may apply the Regulation in proceedings before them (Art. 39).", "sanction_ceiling": { "pct_global_turnover": 10, "fixed_eur": null, "basis": "dma:art-30", "note": "20% on repeated infringement." }, "territorial_scope": [ "territory:eu-established", "territory:non-eu-serving-eu" ], "implementation_model": "Directly applicable" }, "provisions": [ { "id": "dma:art-2", "number": "2", "heading": "Definitions", "summary": "The core platform service categories: intermediation, search, social networking, video sharing, communications, operating systems, browsers, virtual assistants, cloud, advertising.", "obligation_on": [], "claims": [ "clm-dma-scope-gap" ], "sources": [ "src-eurlex-dma" ] }, { "id": "dma:art-3", "number": "3", "heading": "Designation of gatekeepers", "summary": "Quantitative presumption: substantial EU turnover or market capitalisation, at least 45 million monthly active end users and 10,000 yearly active business users in the Union, sustained over three financial years.", "obligation_on": [], "claims": [ "clm-dma-designation", "clm-seven-gatekeepers" ], "sources": [ "src-eurlex-dma" ] }, { "id": "dma:art-5", "number": "5", "heading": "Obligations for gatekeepers", "summary": "Self-executing prohibitions. 5(2) no combining personal data across core platform services without consent, with a genuinely equivalent less-personalised alternative. 5(4) no anti-steering. 5(6) no preventing business users raising non-compliance. 5(7) no requiring use of the gatekeeper's identification, payment or browser engine.", "obligation_on": [ "actor:gatekeeper" ], "claims": [ "clm-apple-proactive-enablement", "clm-meta-pay-or-consent" ], "sources": [ "src-eurlex-dma", "src-ec-apple-meta-dma-2025" ] }, { "id": "dma:art-6", "number": "6", "heading": "Obligations susceptible of further specification", "summary": "6(4) third-party app stores and sideloading. 6(5) no self-preferencing in ranking. 6(7) free and effective interoperability. 6(9) data portability. 6(10) business-user access to performance data.", "obligation_on": [ "actor:gatekeeper" ], "claims": [ "clm-dma-specification-utility-regulation" ], "sources": [ "src-eurlex-dma" ] }, { "id": "dma:art-7", "number": "7", "heading": "Obligation for gatekeepers on interoperability of number-independent interpersonal communications services", "summary": null, "obligation_on": [ "actor:gatekeeper" ], "claims": [], "sources": [ "src-eurlex-dma" ] }, { "id": "dma:art-13", "number": "13", "heading": "Anti-circumvention", "summary": null, "obligation_on": [ "actor:gatekeeper" ], "claims": [], "sources": [ "src-eurlex-dma" ] }, { "id": "dma:art-30", "number": "30", "heading": "Fines", "summary": "Up to 10% of global annual turnover; 20% on repeated infringement.", "obligation_on": [], "claims": [], "sources": [ "src-eurlex-dma" ] }, { "id": "dma:art-38", "number": "38", "heading": "Cooperation and coordination with national competent authorities", "summary": "The Commission is the sole enforcer; national authorities support rather than enforce.", "obligation_on": [], "claims": [ "clm-dma-commission-exclusive" ], "sources": [ "src-eurlex-dma" ] }, { "id": "dma:art-53", "number": "53", "heading": "Review", "summary": "Required a review by 3 May 2026.", "obligation_on": [], "claims": [ "clm-dma-review-enforce-not-expand" ], "sources": [ "src-ec-dma-review-qa" ], "obligation_on_institution": "ec" } ], "claims": [ "clm-dma-ex-ante", "clm-dma-alongside-102", "clm-dma-asymmetry" ], "sources": [ "src-eurlex-dma" ], "last_verified": "2026-10-21", "legal_basis": [ "tfeu:art-114" ] }, { "id": "ai-act", "aliases": [ "artificial-intelligence-act", "reg-2024-1689" ], "celex": "32024R1689", "short_name": "AI Act", "full_name": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence", "kind": "kind:regulation", "scope_class": "scope:core", "brief_part": "part-5", "legislative_status": "status:partly-applicable", "status_as_of": "2026-10-21", "status_note": "In force since 2024. Prohibitions, AI-literacy, GPAI duties and governance apply; the high-risk tier does not yet. The scalar alone is insufficient — read the milestones. Re-evaluated 21 Oct 2026 (audit item 9): in force with no end of validity, per the Publications Office's metadata (Cellar SPARQL, read 21 Oct 2026), which records one amending act, Regulation (EU) 2026/1744 of 8 July 2026 (the AI Omnibus, amended_by); its application dates are the milestones, re-read against the amended Art. 113 on 14 Oct 2026. Still partly applicable: the high-risk tier applies from 2 December 2027 and 2 August 2028. Only the status was re-read on 21 Oct 2026; the other fields were last re-read on 27 Aug 2026.", "milestones": [ "tl-ai-act-2024-06-13-adoption", "tl-ai-act-2024-07-12-publication", "tl-ai-act-2024-08-01-entry-into-force", "tl-ai-act-2025-02-02-application", "tl-ai-act-2025-07-10-guidance", "tl-ai-act-2025-08-02-application", "tl-ai-act-2026-08-02-application", "tl-ai-act-2026-12-02-application", "tl-ai-act-2026-12-02-transition-end", "tl-ai-act-2027-12-02-application", "tl-ai-act-2028-08-02-application", "tl-ai-act-2030-08-02-application" ], "amended_by": [ "ai-omnibus" ], "amends": [], "repeals": [], "transposition": null, "dna": { "regulated_actor": [ "actor:ai-provider", "actor:ai-deployer", "actor:ai-importer", "actor:ai-distributor", "actor:gpai-provider" ], "protected_party": [ "actor:affected-person", "actor:ai-deployer" ], "objective": "Harmonised rules on artificial intelligence, structured as product-safety legislation: conformity assessment, technical documentation, notified bodies, CE marking, post-market monitoring.", "risk_logic": "Four-tier risk pyramid — unacceptable, high, transparency, minimal — with a separate compute-based presumption for general-purpose models.", "obligation_anchor": [ "ai-act:art-5", "ai-act:art-6", "ai-act:art-50", "ai-act:art-53", "ai-act:art-55" ], "enforcement_mechanism": "AI Office for general-purpose AI models; national competent authorities for AI systems; conformity assessment and market surveillance.", "sanction_ceiling": { "pct_global_turnover": 7, "fixed_eur": 35000000, "basis": "ai-act:art-99", "note": null }, "territorial_scope": [ "territory:eu-established", "territory:non-eu-serving-eu" ], "implementation_model": "Directly applicable" }, "provisions": [ { "id": "ai-act:art-2", "number": "2(3)", "heading": "Scope — exclusion of military, defence and national security", "summary": "The Regulation does not apply to AI systems where and in so far as they are placed on the market, put into service, or used with or without modification exclusively for military, defence or national security purposes, regardless of the type of entity carrying out those activities; nor does it affect Member States' competences concerning national security.", "obligation_on": [], "claims": [ "clm-ai-act-national-security-exclusion" ], "sources": [ "src-eurlex-ai-act" ] }, { "id": "ai-act:art-3-63", "number": "3(63)", "heading": "Definition of a general-purpose AI model", "summary": "Displays significant generality, is capable of competently performing a wide range of distinct tasks and can be integrated into a variety of downstream systems or applications. The Article sets no compute figure: the indicative criterion of more than 10^23 training FLOP comes from the Commission's July 2025 guidelines, not from the Regulation.", "obligation_on": [], "claims": [], "sources": [ "src-eurlex-ai-act" ], "requires_verification": false, "verification_note": "Checked 27 Sep 2026 against Article 3, point (63), of the Official Journal text (Cellar, CELEX 32024R1689). The summary used to attach an indicative 10^23 FLOP floor to the Article; the Article contains no compute figure, and that criterion is the Commission's July 2025 guidelines (src-ec-gpai-guidelines-2025). Corrected the same day." }, { "id": "ai-act:art-4", "number": "4", "heading": "AI literacy", "summary": "Providers and deployers of AI systems must take measures to support the development of AI literacy of their staff and of others operating or using AI systems on their behalf. As replaced by the AI Omnibus, the Article does not require them to guarantee any specific level of AI literacy; the original text required measures to ensure a sufficient level.", "obligation_on": [ "actor:ai-provider", "actor:ai-deployer" ], "claims": [ "clm-ai-omnibus-art-4-literacy" ], "sources": [ "src-eurlex-ai-act", "src-eurlex-ai-omnibus" ], "requires_verification": false, "verification_note": "Added 27 Sep 2026 from the Official Journal texts read that day from the Publications Office's Cellar: Article 4 of Regulation (EU) 2024/1689 (CELEX 32024R1689) as adopted, and Article 1, point (5), of Regulation (EU) 2026/1744 (CELEX 32026R1744), which replaces it." }, { "id": "ai-act:art-5", "number": "5", "heading": "Prohibited AI practices", "summary": "Manipulative or deceptive techniques; exploitation of vulnerabilities; social scoring; individual criminal-risk prediction based solely on profiling; untargeted facial-image scraping; emotion inference in workplaces and education; biometric categorisation inferring sensitive attributes; real-time remote biometric identification in publicly accessible spaces for law enforcement, subject to narrow exceptions. Binds public authorities as well as firms.", "obligation_on": [ "actor:ai-provider", "actor:ai-deployer", "actor:public-authority" ], "claims": [ "clm-art-5-binds-states", "clm-hungary-biometric-breach" ], "sources": [ "src-eurlex-ai-act" ] }, { "id": "ai-act:art-6", "number": "6", "heading": "Classification rules for high-risk AI systems", "summary": "Two entry routes: 6(1) safety component of a product covered by Annex I harmonisation legislation; 6(2) falling within Annex III. 6(3) provides a filter where no significant risk of harm is posed, subject to documentation and registration.", "obligation_on": [ "actor:ai-provider" ], "claims": [ "clm-ai-act-not-all-ai" ], "sources": [ "src-eurlex-ai-act" ] }, { "id": "ai-act:art-9", "number": "9", "heading": "Risk management system", "summary": null, "obligation_on": [ "actor:ai-provider" ], "claims": [], "sources": [ "src-eurlex-ai-act" ] }, { "id": "ai-act:art-25", "number": "25", "heading": "Responsibilities along the AI value chain", "summary": "A distributor, importer or deployer becomes a provider — assuming the full obligation set — if it puts its name or trademark on a high-risk system, substantially modifies it, or modifies its intended purpose.", "obligation_on": [ "actor:ai-distributor", "actor:ai-importer", "actor:ai-deployer" ], "claims": [ "clm-art-25-provider-trap" ], "sources": [ "src-eurlex-ai-act" ] }, { "id": "ai-act:art-27", "number": "27", "heading": "Fundamental rights impact assessment", "summary": null, "obligation_on": [ "actor:ai-deployer" ], "claims": [ "clm-three-impact-assessments" ], "sources": [ "src-eurlex-ai-act" ] }, { "id": "ai-act:art-50", "number": "50", "heading": "Transparency obligations", "summary": "Users must be informed they are interacting with an AI system; synthetic content must be marked in a machine-readable format; deep fakes and AI-generated text on matters of public interest must be disclosed.", "obligation_on": [ "actor:ai-provider", "actor:ai-deployer" ], "claims": [], "sources": [ "src-eurlex-ai-act" ] }, { "id": "ai-act:art-51", "number": "51", "heading": "Classification of general-purpose AI models with systemic risk", "summary": "51(1)(a) high-impact capabilities or 51(1)(b) Commission decision. 51(2) supplies the operative presumption: cumulative training compute greater than 10^25 FLOP.", "obligation_on": [ "actor:gpai-provider" ], "claims": [ "clm-flop-threshold" ], "sources": [ "src-eurlex-ai-act" ] }, { "id": "ai-act:art-53", "number": "53", "heading": "Obligations for providers of general-purpose AI models", "summary": "Annex XI technical documentation; Annex XII information pack for downstream providers; a copyright compliance policy; a sufficiently detailed public summary of training content. 53(2) partially exempts genuinely free and open-source models, but not systemic-risk models.", "obligation_on": [ "actor:gpai-provider" ], "claims": [], "sources": [ "src-eurlex-ai-act" ] }, { "id": "ai-act:art-55", "number": "55", "heading": "Obligations for providers of general-purpose AI models with systemic risk", "summary": "Model evaluation against standardised protocols including documented adversarial testing; assessment and mitigation of Union-level systemic risks; tracking and prompt reporting of serious incidents; adequate cybersecurity protection.", "obligation_on": [ "actor:gpai-provider" ], "claims": [ "clm-gpai-code-voluntary" ], "sources": [ "src-eurlex-ai-act" ] }, { "id": "ai-act:art-99", "number": "99", "heading": "Penalties", "summary": "Up to 7% of global annual turnover or EUR 35 million.", "obligation_on": [], "claims": [], "sources": [ "src-eurlex-ai-act" ] } ], "claims": [ "clm-ai-act-product-safety", "clm-ai-act-delay-scope", "clm-ai-act-standards-not-ready" ], "sources": [ "src-eurlex-ai-act" ], "last_verified": "2026-10-21", "legal_basis": [ "tfeu:art-114" ] }, { "id": "data-act", "aliases": [ "reg-2023-2854" ], "celex": "32023R2854", "short_name": "Data Act", "full_name": "Regulation (EU) 2023/2854 on harmonised rules on fair access to and use of data", "kind": "kind:regulation", "scope_class": "scope:core", "brief_part": "part-6", "legislative_status": "status:partly-applicable", "status_as_of": "2026-09-27", "status_note": "General application since 12 September 2025 (Art. 50). The Art. 3(1) design obligation applies to connected products and related services placed on the market after 12 September 2026; the switching-charge ban from 12 January 2027 (Art. 29(1)); Chapter IV's unfair-terms rules to long-running contracts concluded on or before 12 September 2025 from 12 September 2027 (Art. 50). Re-read against the milestones and the Official Journal text (CELEX 32023R2854) on 27 Sep 2026: still partly applicable. last_verified moved from 27 Aug to 27 Sep 2026 on 21 Oct 2026 (audit item 10), the date on which the status above was re-read against Arts 29 and 50 (commit 282a782); the other fields were last re-read on 27 Aug 2026.", "milestones": [ "tl-data-act-2023-12-13-adoption", "tl-data-act-2023-12-22-publication", "tl-data-act-2024-01-11-entry-into-force", "tl-data-act-2025-09-12-application", "tl-data-act-2026-09-12-application", "tl-data-act-2027-01-12-application", "tl-data-act-2027-09-12-application" ], "amended_by": [], "amends": [], "repeals": [], "transposition": null, "dna": { "regulated_actor": [ "actor:data-holder", "actor:cloud-provider", "actor:connected-product-provider" ], "protected_party": [ "actor:user", "actor:data-recipient" ], "objective": "Fair access to and use of data — predominantly non-personal, industrial and machine-generated — reallocating control over it by default.", "risk_logic": "Lock-in and contractual imbalance.", "obligation_anchor": [ "data-act:art-3-1", "data-act:art-25" ], "enforcement_mechanism": "National competent authorities; penalty levels set by Member States.", "sanction_ceiling": { "pct_global_turnover": null, "fixed_eur": null, "basis": null, "note": "Set by Member States rather than by the Regulation." }, "territorial_scope": [ "territory:eu-established", "territory:non-eu-serving-eu" ], "implementation_model": "Directly applicable" }, "provisions": [ { "id": "data-act:art-3-1", "number": "3(1)", "heading": "Obligation to make connected product data accessible to the user", "summary": "Connected products must be designed and manufactured so that product and related service data are, by default, easily, securely and directly accessible to the user.", "obligation_on": [ "actor:connected-product-provider", "actor:manufacturer" ], "claims": [ "clm-data-act-art-3-application" ], "sources": [ "src-eurlex-data-act" ] }, { "id": "data-act:art-25", "number": "25", "heading": "Contractual terms concerning switching", "summary": "Mandatory contractual content for switching: maximum two-month notice period; 30 calendar day transitional period (or a justified alternative not exceeding seven months where technically unfeasible); at least 30 days data retrieval afterwards; full erasure once retrieval ends.", "obligation_on": [ "actor:cloud-provider" ], "claims": [ "clm-data-act-switching-numbers" ], "sources": [ "src-eurlex-data-act" ] }, { "id": "data-act:art-8", "number": "8", "heading": "Conditions under which data holders make data available to data recipients", "summary": "Where, in business-to-business relations, a data holder is obliged to make data available to a data recipient, it must agree the arrangements on fair, reasonable and non-discriminatory terms and conditions and in a transparent manner.", "obligation_on": [ "actor:data-holder" ], "claims": [], "sources": [ "src-eurlex-data-act" ], "requires_verification": false, "verification_note": "Added 27 Sep 2026 from the Official Journal text retrieved that day from the Publications Office's Cellar (CELEX 32023R2854); heading and summary follow the Article's own paragraphs." }, { "id": "data-act:chapter-iv", "number": "13 (Chapter IV)", "heading": "Unfair contractual terms related to data access and use between enterprises", "summary": "Chapter IV applies to contracts concluded after 12 September 2025, and from 12 September 2027 to contracts concluded on or before that date that are of indefinite duration or due to expire at least ten years from 11 January 2024 (Art. 50).", "obligation_on": [ "actor:data-holder", "actor:data-recipient" ], "claims": [], "sources": [ "src-eurlex-data-act" ], "requires_verification": false, "verification_note": "Added 14 Oct 2026 so that the 12 September 2027 tranche attaches to the chapter it governs. Before this, the 2027 event carried no provision and js/regulatory-model.js read it as the Data Act's GENERAL application date, so Art. 8 (Chapter III) was shown as applying from 12 September 2027 rather than 12 September 2025. Chapter title and Art. 50 read on EUR-Lex (ELI reg/2023/2854/oj) on 14 Oct 2026; Chapter IV consists of Article 13." } ], "claims": [ "clm-data-act-non-personal", "clm-data-act-trade-secret-tension", "clm-data-act-retroactivity-open", "clm-data-act-enforcement-uneven", "clm-ie-data-bill-general-scheme", "clm-ie-data-bill-not-introduced", "clm-ie-data-centre-hub" ], "sources": [ "src-eurlex-data-act" ], "last_verified": "2026-09-27", "legal_basis": [ "tfeu:art-114" ] }, { "id": "nis2", "aliases": [ "dir-2022-2555" ], "celex": "32022L2555", "short_name": "NIS2", "full_name": "Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union", "kind": "kind:directive", "scope_class": "scope:core", "brief_part": "part-7", "legislative_status": "status:transposition-overdue", "status_as_of": "2026-10-21", "status_note": "In force since 2023, but a directive: obligations bite at national dates. The transposition deadline of 17 October 2024 has passed and transposition is still materially incomplete: the Commission sent letters of formal notice to 23 Member States in November 2024 and referred Ireland, Spain, France and the Netherlands to the Court of Justice in July 2026. Re-evaluated 21 Oct 2026 (audit items 9 and 10): the Commission's July 2026 infringements package (INF/26/1376, 8 Jul 2026) refers Ireland, Spain, France and the Netherlands to the Court of Justice for failing to notify complete transposition of Directive (EU) 2022/2555, after letters of formal notice of 28 November 2024 and reasoned opinions of 7 May 2025; the October 2026 package (INF/26/1760) records no closure. Still transposition-overdue. Only the status was re-read that day; the other fields were last re-read on 27 Aug 2026.", "milestones": [ "tl-nis2-2022-12-14-adoption", "tl-nis2-2022-12-27-publication", "tl-nis2-2023-01-16-entry-into-force", "tl-nis2-2024-10-17-transposition", "tl-nis2-2024-11-28-enforcement", "tl-nis2-2026-07-08-judicial" ], "amended_by": [], "amends": [], "repeals": [ "nis1" ], "transposition": { "deadline": "tl-nis2-2024-10-17-transposition", "state": { "ie": "transposition:referred", "es": "transposition:referred", "fr": "transposition:referred", "nl": "transposition:referred" }, "state_note": "Only the four Member States referred to the Court of Justice on 8 July 2026 are recorded, because those are the only per-state positions established from a primary source in this build. The remaining 23 Member States are NOT recorded as complete — their status is simply unknown here. A full per-state tracker is required before this field can be presented to users. 27 Sep 2026: the national measures notified to the Commission (Cellar, CELEX 72022L2555*) come from 25 Member States; none from Ireland or Spain, both among those referred. France and the Netherlands, also referred, have notified measures, which shows a notified measure is not complete transposition. The other 23 therefore stay unknown rather than being recorded as complete.", "requires_verification": true, "sources": [ "src-ec-nis2-referral-2026", "src-ec-nis2-lfn-2024", "src-cellar-nim-nis2-cer-2026-09-27" ], "last_verified": "2026-09-27" }, "dna": { "regulated_actor": [ "actor:essential-entity", "actor:important-entity" ], "protected_party": [ "actor:end-user" ], "objective": "A high common level of cybersecurity across the Union.", "risk_logic": "Sectoral criticality plus entity size.", "obligation_anchor": [ "nis2:art-20", "nis2:art-21", "nis2:art-23" ], "enforcement_mechanism": "National competent authorities, following national transposition.", "sanction_ceiling": { "pct_global_turnover": 2, "fixed_eur": 10000000, "basis": null, "note": "For essential entities. The provision conferring this ceiling has not been pinned to an article in this build." }, "territorial_scope": [ "territory:eu-established" ], "implementation_model": "Requires national transposition" }, "provisions": [ { "id": "nis2:art-3", "number": "3", "heading": "Essential and important entities", "summary": "Classifies entities of the types listed in Annexes I and II as essential or important. Annex I entities above the medium-sized-enterprise ceilings, and the special cases the Article lists, are essential; any Annex I or II entity that does not qualify as essential is important. The classification determines the supervisory regime that applies.", "obligation_on": [ "actor:essential-entity", "actor:important-entity" ], "claims": [], "sources": [ "src-eurlex-nis2" ], "requires_verification": false, "verification_note": "Verified 27 Sep 2026 against the Official Journal text (English, retrieved that day from the Publications Office Cellar, CELEX 32022L2555): heading and number match. The previous summary said entities are essential if in Annex I and important if in Annex II; paragraphs 1 and 2 are narrower, and the summary was corrected to them: an Annex I entity is essential only above the medium-sized-enterprise ceilings (or in the listed special cases), and any Annex I or II entity that does not qualify as essential is important. The earlier note said the article was recorded from general knowledge." }, { "id": "nis2:art-20", "number": "20", "heading": "Governance", "summary": "Management bodies must approve and oversee the cybersecurity risk-management measures and can be held liable for the entity's infringements (Art. 20(1)); at essential entities, the natural persons responsible can also be held liable (Art. 32(6)). The provision that actually changes boardroom behaviour.", "obligation_on": [ "actor:essential-entity", "actor:important-entity" ], "claims": [ "clm-nis2-management-liability" ], "sources": [ "src-eurlex-nis2" ] }, { "id": "nis2:art-21", "number": "21", "heading": "Cybersecurity risk-management measures", "summary": "Ten baseline measures including risk analysis, incident handling, business continuity, supply chain security, cyber hygiene, cryptography policy and multi-factor authentication.", "obligation_on": [ "actor:essential-entity", "actor:important-entity" ], "claims": [], "sources": [ "src-eurlex-nis2" ] }, { "id": "nis2:art-23", "number": "23", "heading": "Reporting obligations", "summary": "Early warning within 24 hours, incident notification within 72 hours, final report within one month.", "obligation_on": [ "actor:essential-entity", "actor:important-entity" ], "claims": [], "sources": [ "src-eurlex-nis2" ] }, { "id": "nis2:art-31", "number": "31", "heading": "General aspects concerning supervision and enforcement", "summary": null, "obligation_on": [], "claims": [], "sources": [ "src-eurlex-nis2" ] } ], "claims": [ "clm-nis2-transposition-failure", "clm-nis2-only-four-on-time", "clm-directives-underperform" ], "sources": [ "src-eurlex-nis2" ], "last_verified": "2026-10-21", "legal_basis": [ "tfeu:art-114" ] }, { "id": "cer", "aliases": [ "dir-2022-2557" ], "celex": "32022L2557", "short_name": "CER", "full_name": "Directive (EU) 2022/2557 on the resilience of critical entities", "kind": "kind:directive", "scope_class": "scope:core", "brief_part": "part-7", "legislative_status": "status:transposition-overdue", "status_as_of": "2026-10-21", "status_note": "A directive: obligations bite at national dates. The transposition deadline of 17 October 2024 has passed; on 29 April 2026 the Commission referred Bulgaria, France, Luxembourg, the Netherlands, Poland, Spain and Sweden to the Court of Justice for failing to transpose. Re-evaluated 21 Oct 2026 (audit items 9 and 10): the Commission's April 2026 infringements package (INF/26/720, 29 Apr 2026) refers Bulgaria, Spain, France, Luxembourg, the Netherlands, Poland and Sweden to the Court of Justice for failing to transpose Directive (EU) 2022/2557, which was due by 17 October 2024; the October 2026 package (INF/26/1760) records no closure. Still transposition-overdue. Only the status was re-read that day; the other fields were last re-read on 27 Aug 2026.", "milestones": [ "tl-cer-2022-12-14-adoption", "tl-cer-2022-12-27-publication", "tl-cer-2023-01-16-entry-into-force", "tl-cer-2024-10-17-transposition" ], "amended_by": [], "amends": [], "repeals": [], "transposition": { "deadline": "tl-cer-2024-10-17-transposition", "state": { "bg": "transposition:referred", "fr": "transposition:referred", "lu": "transposition:referred", "nl": "transposition:referred", "pl": "transposition:referred", "es": "transposition:referred", "se": "transposition:referred" }, "state_note": "The seven Member States the Commission referred to the Court of Justice on 29 April 2026 for failing to transpose (IP/26/910) are recorded. The Commission states that most others have notified complete transposition, but it does not name them, so the remaining twenty are not recorded as complete here: their individual status is unknown. 27 Sep 2026: the national measures notified (Cellar, CELEX 72022L2557*) come from 24 Member States; none from Bulgaria, Spain or Sweden, three of the seven referred. France, Luxembourg, the Netherlands and Poland, also referred, have notified some measures. Who has notified something is established; who has transposed completely is not, so the twenty stay unknown.", "requires_verification": true, "sources": [ "src-ec-cer-referral-2026", "src-eurlex-cer", "src-cellar-nim-nis2-cer-2026-09-27" ], "last_verified": "2026-09-27" }, "dna": { "regulated_actor": [ "actor:critical-entity" ], "protected_party": [ "actor:end-user" ], "objective": "Physical and organisational resilience of critical entities; NIS2's companion on the non-cyber side.", "risk_logic": "Sectoral criticality.", "obligation_anchor": [], "enforcement_mechanism": "National competent authorities, following national transposition.", "sanction_ceiling": { "pct_global_turnover": null, "fixed_eur": null, "basis": null, "note": "unknown — not established in this build." }, "territorial_scope": [ "territory:eu-established" ], "implementation_model": "Requires national transposition" }, "provisions": [], "claims": [], "sources": [ "src-eurlex-cer", "src-ec-cer-referral-2026" ], "last_verified": "2026-10-21", "legal_basis": [ "tfeu:art-114" ] }, { "id": "dora", "aliases": [ "reg-2022-2554" ], "celex": "32022R2554", "short_name": "DORA", "full_name": "Regulation (EU) 2022/2554 on digital operational resilience for the financial sector", "kind": "kind:regulation", "scope_class": "scope:core", "brief_part": "part-7", "legislative_status": "status:applicable", "status_as_of": "2026-10-21", "status_note": "Re-evaluated 21 Oct 2026 (audit item 9): in force with no end of validity and no amending act recorded, per the Publications Office's metadata (Cellar SPARQL, read 21 Oct 2026); applicable since 17 January 2025 (Art. 64, milestone). Status unchanged. Only the status was re-read that day; the other fields of this record were last re-read on 27 Aug 2026.", "milestones": [ "tl-dora-2022-12-14-adoption", "tl-dora-2022-12-27-publication", "tl-dora-2023-01-16-entry-into-force", "tl-dora-2025-01-17-application" ], "amended_by": [], "amends": [], "repeals": [], "transposition": null, "dna": { "regulated_actor": [ "actor:financial-entity", "actor:ict-third-party-provider" ], "protected_party": [ "actor:end-user" ], "objective": "ICT risk management for the financial sector, with no transposition patchwork.", "risk_logic": "Operational resilience of financial entities and their ICT dependencies.", "obligation_anchor": [], "enforcement_mechanism": "Financial supervisors; ESA oversight framework for critical ICT third-party providers.", "sanction_ceiling": { "pct_global_turnover": null, "fixed_eur": null, "basis": null, "note": "unknown — not established in this build." }, "territorial_scope": [ "territory:eu-established" ], "implementation_model": "Directly applicable" }, "provisions": [ { "id": "dora:art-5", "number": "5", "heading": "Governance and organisation", "summary": "Financial entities must have an internal governance and control framework for the effective and prudent management of ICT risk; the management body defines, approves, oversees and is responsible for the ICT risk management framework.", "obligation_on": [ "actor:financial-entity" ], "claims": [], "sources": [ "src-eurlex-dora" ], "requires_verification": false, "verification_note": "Added 27 Sep 2026 from the Official Journal text retrieved that day from the Publications Office's Cellar (CELEX 32022R2554); heading and summary follow the Article's own paragraphs." }, { "id": "dora:art-6", "number": "6", "heading": "ICT risk management framework", "summary": "Financial entities must have a sound, comprehensive and well-documented ICT risk management framework as part of their overall risk management system.", "obligation_on": [ "actor:financial-entity" ], "claims": [], "sources": [ "src-eurlex-dora" ], "requires_verification": false, "verification_note": "Added 27 Sep 2026 from the Official Journal text retrieved that day from the Publications Office's Cellar (CELEX 32022R2554); heading and summary follow the Article's own paragraphs." }, { "id": "dora:art-17", "number": "17", "heading": "ICT-related incident management process", "summary": "Financial entities must define, establish and implement a process to detect, manage and notify ICT-related incidents.", "obligation_on": [ "actor:financial-entity" ], "claims": [], "sources": [ "src-eurlex-dora" ], "requires_verification": false, "verification_note": "Added 27 Sep 2026 from the Official Journal text retrieved that day from the Publications Office's Cellar (CELEX 32022R2554); heading and summary follow the Article's own paragraphs." }, { "id": "dora:art-19", "number": "19", "heading": "Reporting of major ICT-related incidents and voluntary notification of significant cyber threats", "summary": "Financial entities must report major ICT-related incidents to their competent authority, and may notify significant cyber threats voluntarily.", "obligation_on": [ "actor:financial-entity" ], "claims": [], "sources": [ "src-eurlex-dora" ], "requires_verification": false, "verification_note": "Added 27 Sep 2026 from the Official Journal text retrieved that day from the Publications Office's Cellar (CELEX 32022R2554); heading and summary follow the Article's own paragraphs." }, { "id": "dora:art-24", "number": "24", "heading": "General requirements for the performance of digital operational resilience testing", "summary": "Financial entities other than microenterprises must establish, maintain and review a digital operational resilience testing programme as part of the ICT risk management framework.", "obligation_on": [ "actor:financial-entity" ], "claims": [], "sources": [ "src-eurlex-dora" ], "requires_verification": false, "verification_note": "Added 27 Sep 2026 from the Official Journal text retrieved that day from the Publications Office's Cellar (CELEX 32022R2554); heading and summary follow the Article's own paragraphs." }, { "id": "dora:art-28", "number": "28", "heading": "General principles (ICT third-party risk)", "summary": "Financial entities must manage ICT third-party risk as an integral component of ICT risk within their ICT risk management framework.", "obligation_on": [ "actor:financial-entity", "actor:ict-third-party-provider" ], "claims": [], "sources": [ "src-eurlex-dora" ], "requires_verification": false, "verification_note": "Added 27 Sep 2026 from the Official Journal text retrieved that day from the Publications Office's Cellar (CELEX 32022R2554); heading and summary follow the Article's own paragraphs." }, { "id": "dora:art-31", "number": "31", "heading": "Designation of critical ICT third-party service providers", "summary": "The ESAs, through the Joint Committee and on the Oversight Forum's recommendation, designate critical ICT third-party service providers and appoint as Lead Overseer for each the ESA responsible for the financial entities holding the largest share of total assets among its users.", "obligation_on": [ "actor:ict-third-party-provider" ], "claims": [], "sources": [ "src-eurlex-dora" ], "requires_verification": false, "verification_note": "Added 27 Sep 2026 from the Official Journal text retrieved that day from the Publications Office's Cellar (CELEX 32022R2554); heading and summary follow the Article's own paragraphs." } ], "claims": [], "sources": [ "src-eurlex-dora" ], "last_verified": "2026-10-21", "legal_basis": [ "tfeu:art-114" ] }, { "id": "cra", "aliases": [ "cyber-resilience-act", "reg-2024-2847" ], "celex": "32024R2847", "short_name": "CRA", "full_name": "Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements", "kind": "kind:regulation", "scope_class": "scope:core", "brief_part": "part-7", "legislative_status": "status:partly-applicable", "status_as_of": "2026-10-14", "status_note": "In force since December 2024. Chapter IV (notification of conformity assessment bodies) has applied since 11 June 2026 and Article 14 — manufacturers' reporting of actively exploited vulnerabilities and severe incidents — since 11 September 2026; the Regulation as a whole, including the main obligations on manufacturers, importers and distributors and the reporting obligations of open-source software stewards (Art. 24(3)), applies from 11 December 2027 (Art. 71(2), re-read on EUR-Lex on 14 Oct 2026). The scalar alone is insufficient — read the milestones. last_verified moved from 27 Aug to 14 Oct 2026 on 21 Oct 2026 (audit item 10), the date on which the status above was re-read (docs/AUDIT-2026-10-14.md §1 F), so that it is not earlier than status_as_of; the other fields were last re-read on 27 Aug 2026.", "milestones": [ "tl-cra-2024-10-23-adoption", "tl-cra-2024-11-20-publication", "tl-cra-2024-12-10-entry-into-force", "tl-cra-2026-06-11-application", "tl-cra-2026-09-11-reporting-deadline", "tl-cra-2027-12-11-application" ], "amended_by": [], "amends": [], "repeals": [], "transposition": null, "dna": { "regulated_actor": [ "actor:pde-manufacturer" ], "protected_party": [ "actor:end-user" ], "objective": "Horizontal cybersecurity requirements for products with digital elements.", "risk_logic": "Product security across the lifecycle.", "obligation_anchor": [], "enforcement_mechanism": "Market surveillance authorities; coordinated vulnerability reporting.", "sanction_ceiling": { "pct_global_turnover": null, "fixed_eur": null, "basis": null, "note": "unknown — not established in this build." }, "territorial_scope": [ "territory:eu-established", "territory:non-eu-serving-eu" ], "implementation_model": "Directly applicable" }, "provisions": [ { "id": "cra:art-13", "number": "13", "heading": "Obligations of manufacturers", "summary": "When placing a product with digital elements on the market, manufacturers must ensure it has been designed, developed and produced in accordance with the essential cybersecurity requirements in Part I of Annex I.", "obligation_on": [ "actor:manufacturer", "actor:pde-manufacturer" ], "claims": [], "sources": [ "src-eurlex-cra" ], "requires_verification": false, "verification_note": "Added 27 Sep 2026 from the Official Journal text retrieved that day from the Publications Office's Cellar (CELEX 32024R2847); heading and summary follow the Article's own paragraphs." }, { "id": "cra:art-14", "number": "14", "heading": "Reporting obligations of manufacturers", "summary": "Manufacturers must notify any actively exploited vulnerability, and severe incidents, simultaneously to the CSIRT designated as coordinator and to ENISA, via the single reporting platform. Applies from 11 September 2026 (Art. 71(2)).", "obligation_on": [ "actor:manufacturer", "actor:pde-manufacturer" ], "claims": [], "sources": [ "src-eurlex-cra" ], "requires_verification": false, "verification_note": "Added 27 Sep 2026 from the Official Journal text retrieved that day from the Publications Office's Cellar (CELEX 32024R2847); heading and summary follow the Article's own paragraphs." }, { "id": "cra:art-16", "number": "16", "heading": "Establishment of a single reporting platform", "summary": "ENISA establishes the single reporting platform for the notifications under Articles 14 and 15, and manages and maintains its day-to-day operations.", "obligation_on": [], "claims": [], "sources": [ "src-eurlex-cra" ], "requires_verification": false, "verification_note": "Added 27 Sep 2026 from the Official Journal text retrieved that day from the Publications Office's Cellar (CELEX 32024R2847); heading and summary follow the Article's own paragraphs." }, { "id": "cra:art-24", "number": "24", "heading": "Obligations of open-source software stewards", "summary": "Stewards must have a documented cybersecurity policy and cooperate with market surveillance authorities. Under Art. 24(3) the Art. 14(1) notification obligation applies to them to the extent they are involved in the development of the product, and Art. 14(3) and (8) where severe incidents affect the network and information systems they provide for development. Applies from 11 December 2027, the general date (Art. 71(2)), not from 11 September 2026.", "obligation_on": [ "actor:pde-manufacturer" ], "claims": [], "sources": [ "src-eurlex-cra", "src-ec-cra-reporting" ], "requires_verification": false, "verification_note": "Added 14 Oct 2026 from the Official Journal text read that day on EUR-Lex; the application date is confirmed in the same words on the Commission's CRA reporting page. obligation_on uses actor:pde-manufacturer because the taxonomy has no steward actor; stewards are not manufacturers, and the heading says whose duty this is." }, { "id": "cra:chapter-iv", "number": "35–51 (Chapter IV)", "heading": "Notification of conformity assessment bodies", "summary": "The rules under which Member States notify the bodies that carry out third-party conformity assessment of products with digital elements. Applies from 11 June 2026 (Art. 71(2)), ahead of the rest of the Regulation, so that notified bodies exist before the main obligations apply on 11 December 2027.", "obligation_on": [ "actor:member-state" ], "claims": [], "sources": [ "src-eurlex-cra" ], "requires_verification": false, "verification_note": "Added 14 Oct 2026 so that the 11 June 2026 date attaches to the chapter it governs. Before this, the Chapter IV event carried no provision and js/regulatory-model.js read it as the CRA's GENERAL application date, so every CRA provision — Art. 13 manufacturers' obligations and Art. 14 reporting included — was shown as applying from 11 June 2026. Heading from the chapter title and Art. 71(2) read on EUR-Lex on 14 Oct 2026. 'So that notified bodies exist before …' is the site's reading of the sequence, not a quotation." } ], "claims": [], "sources": [ "src-eurlex-cra", "src-cra-text-unofficial-art71", "src-ec-cra-reporting" ], "last_verified": "2026-10-14", "legal_basis": [ "tfeu:art-114" ] }, { "id": "ai-omnibus", "aliases": [ "digital-omnibus-on-ai", "com-2025-836", "reg-2026-1744" ], "celex": "32026R1744", "short_name": "AI Omnibus", "full_name": "Regulation (EU) 2026/1744 (Digital Omnibus on AI)", "kind": "kind:regulation", "scope_class": "scope:core", "brief_part": "part-8", "legislative_status": "status:in-force", "status_as_of": "2026-10-21", "status_note": "The Commission's own label is 'Digital Omnibus on AI'; 'AI Omnibus' is the informal shorthand used in this brief. Re-evaluated 21 Oct 2026 (audit item 9): in force with no end of validity, per the Publications Office's metadata (Cellar SPARQL, read 21 Oct 2026). Its Art. 4, read in the Official Journal text from Cellar that day, has it enter into force on the third day following publication and sets no separate application date, so status:in-force is the whole of its status; the dates it sets are dates of the AI Act it amends. Only the status was re-read that day; the other fields were last re-read on 27 Aug 2026.", "milestones": [ "tl-ai-omnibus-2026-07-08-adoption", "tl-ai-omnibus-2026-07-24-publication", "tl-ai-omnibus-2025-11-19-proposal", "tl-ai-omnibus-2026-07-27-entry-into-force" ], "amended_by": [], "amends": [ "ai-act" ], "repeals": [], "transposition": null, "dna": { "regulated_actor": [ "actor:ai-provider", "actor:ai-deployer" ], "protected_party": [ "actor:affected-person" ], "objective": "Simplification of the AI Act, principally by deferring the high-risk tier.", "risk_logic": "Inherits the AI Act's.", "obligation_anchor": [], "enforcement_mechanism": "Inherits the AI Act's.", "sanction_ceiling": { "pct_global_turnover": null, "fixed_eur": null, "basis": null, "note": "Amending instrument; inherits AI Act penalties." }, "territorial_scope": [ "territory:eu-established", "territory:non-eu-serving-eu" ], "implementation_model": "Directly applicable" }, "provisions": [], "claims": [ "clm-ai-act-delay-scope", "clm-ai-omnibus-in-force" ], "sources": [ "src-eurlex-ai-omnibus", "src-ec-ai-omnibus-in-force", "src-ep-legtrain-ai-omnibus", "src-op-ai-omnibus-record" ], "last_verified": "2026-10-21", "legal_basis": [ "tfeu:art-114" ] }, { "id": "data-omnibus", "aliases": [ "digital-omnibus", "com-2025-837" ], "celex": "52025PC0837", "short_name": "Data Omnibus", "full_name": "COM(2025) 837 final — Digital Omnibus Regulation (proposal)", "kind": "kind:proposal", "scope_class": "scope:core", "brief_part": "part-8", "legislative_status": "status:proposal", "status_as_of": "2026-10-21", "status_note": "NOT LAW. A Commission proposal (COM(2025) 837, 19 November 2025) with no Council negotiating mandate reported and no Parliament position as at 21 October 2026. Council: the Cypriot Presidency withdrew its compromise text from COREPER in late June 2026 for lack of a qualified majority; the Irish Presidency's revised compromise of 3 September 2026 (ST 12535/26) was followed by a further revised text for the Antici Group of 25 September (ST 13112/26, clm-data-omnibus-st-13112) and, on 2 October, by a draft negotiating mandate put to Coreper (ST 13886/26, clm-data-omnibus-draft-mandate); the Coreper II vote due on 11 October was not held, as reported by Agence Europe (clm-data-omnibus-council-october), and a revised version was due before Coreper on 21 October 2026, whose outcome had not been published when checked that day (clm-data-omnibus-coreper-21-october). Parliament: with the joint ITRE–LIBE committee, draft report of 22 June 2026, amendments tabled 27 July 2026, 'awaiting committee decision' on the Legislative Observatory on 21 October 2026 (clm-data-omnibus-parliament-stage). No trilogue has begun. Every GDPR, ePrivacy and Data Act change it contains is proposed text, not an obligation. Must never be rendered as an Act. The Commission's own label is 'Digital Omnibus'; 'Data Omnibus' is the informal shorthand used in this brief. 21 Oct 2026 (audit items 2 and 12): legislative_status changed from status:stalled to status:proposal, the factual stage: 'stalled' was a reading of the Council's progress, not a stage of the procedure, and the procedure is still at proposal. last_verified 21 Oct 2026: the status was re-read that day (audit items 2 and 12); the other fields were last re-read on 27 Aug 2026.", "milestones": [ "tl-data-omnibus-2025-11-19-proposal" ], "amended_by": [], "amends": [], "proposes_to_amend": [ "gdpr", "eprivacy", "data-act", "dga", "nis2" ], "repeals": [], "transposition": null, "dna": { "regulated_actor": [ "actor:controller", "actor:processor" ], "protected_party": [ "actor:data-subject" ], "objective": "Simplification of the data acquis: an entity-relative test for personal data in Art. 4(1); a new Art. 41a on pseudonymised data; relocation of cookie consent into a new Art. 88a; a new Art. 88c legitimate-interest basis for AI model training.", "risk_logic": "Inherits the GDPR's.", "obligation_anchor": [], "enforcement_mechanism": "Would inherit the GDPR's.", "sanction_ceiling": { "pct_global_turnover": null, "fixed_eur": null, "basis": null, "note": "Proposal; no independent ceiling." }, "territorial_scope": [ "territory:eu-established", "territory:non-eu-serving-eu" ], "implementation_model": "Not applicable — proposal" }, "provisions": [], "claims": [ "clm-data-omnibus-stalled", "clm-omnibus-four-gdpr-reforms", "clm-edpb-edps-omnibus-pushback", "clm-data-omnibus-council-october", "clm-data-omnibus-parliament-stage", "clm-data-omnibus-st-13112", "clm-data-omnibus-draft-mandate", "clm-data-omnibus-coreper-21-october" ], "sources": [ "src-eurlex-data-omnibus-837", "src-ep-legtrain-digital-package", "src-privacynext-2026-omnibus", "src-agenceurope-omnibus-2026-10-12", "src-oeil-2025-0360", "src-council-st-12535-2026", "src-council-cm-4156-2026", "src-council-st-13886-2026", "src-agenceurope-omnibus-2026-10-20" ], "last_verified": "2026-10-21", "legal_basis": [ "tfeu:art-114" ] }, { "id": "pld", "aliases": [ "product-liability-directive", "dir-2024-2853" ], "celex": "32024L2853", "short_name": "Revised PLD", "full_name": "Directive (EU) 2024/2853 on liability for defective products", "kind": "kind:directive", "scope_class": "scope:adjacent", "brief_part": null, "legislative_status": "status:transposition-pending", "status_as_of": "2026-08-27", "milestones": [ "tl-pld-2026-12-09-application", "tl-pld-2026-12-09-transposition" ], "amended_by": [], "amends": [], "repeals": [], "transposition": { "deadline": "tl-pld-2026-12-09-transposition", "state": {}, "state_note": "The transposition deadline is 9 December 2026 (Art. 22(1)) and has not passed, so no Member State can yet be late; per-state positions will be recorded once it has.", "requires_verification": false, "sources": [ "src-eurlex-pld" ], "last_verified": "2026-09-27" }, "dna": { "regulated_actor": [ "actor:manufacturer" ], "protected_party": [ "actor:end-user" ], "objective": "Strict liability for defective products, with software and AI brought within the definition of product.", "risk_logic": "Product defect.", "obligation_anchor": [], "enforcement_mechanism": "National courts.", "sanction_ceiling": { "pct_global_turnover": null, "fixed_eur": null, "basis": null, "note": "Civil liability, not administrative penalty." }, "territorial_scope": [ "territory:eu-established" ], "implementation_model": "Requires national transposition" }, "provisions": [], "claims": [ "clm-pld-covers-software" ], "sources": [ "src-eurlex-pld" ], "last_verified": "2026-08-27", "legal_basis": [ "tfeu:art-114" ] }, { "id": "gdpr-procedural", "aliases": [ "reg-2025-2518", "gdpr-cross-border-procedure-regulation" ], "celex": "32025R2518", "short_name": "GDPR Procedural Regulation", "full_name": "Regulation (EU) 2025/2518 laying down additional procedural rules on the enforcement of Regulation (EU) 2016/679", "kind": "kind:regulation", "scope_class": "scope:adjacent", "brief_part": "part-2", "legislative_status": "status:in-force", "status_as_of": "2026-09-27", "status_note": "In force since 1 January 2026 but not yet applicable: it applies from 2 April 2027 (Art. 37), and its investigation rules to complaints lodged, and ex officio investigations opened, after that date (Art. 36). Harmonises admissibility criteria for cross-border GDPR complaints (Art. 4), gives parties common procedural rights (including a right to be heard on preliminary findings and access to the administrative file, Arts 19 and 24) and sets time limits for the lead authority's draft decision (15 months; 12 under the simple cooperation procedure; Art. 12). Checked against the Official Journal text (OJ L 2025/2518, 12.12.2025, CELEX 32025R2518) on 27 Sep 2026.", "milestones": [ "tl-gdpr-procedural-2025-11-26-adoption", "tl-gdpr-procedural-2025-12-12-publication", "tl-gdpr-procedural-2026-01-01-entry-into-force", "tl-gdpr-procedural-2027-04-02-application" ], "amended_by": [], "amends": [], "repeals": [], "transposition": null, "dna": null, "provisions": [], "claims": [ "clm-gdpr-procedural-regulation" ], "sources": [ "src-eurlex-gdpr-procedural", "src-eucrim-gdpr-procedural-2026" ], "last_verified": "2026-09-27", "legal_basis": [] }, { "id": "dga", "aliases": [ "data-governance-act" ], "celex": "32022R0868", "short_name": "DGA", "full_name": "Regulation (EU) 2022/868 on European data governance (Data Governance Act)", "kind": "kind:regulation", "scope_class": "scope:adjacent", "brief_part": null, "legislative_status": "status:applicable", "status_as_of": "2026-09-27", "status_note": "In force since 23 June 2022 and applicable since 24 September 2023 (Art. 38; OJ L 152, 3.6.2022). Read on 27 Sep 2026 in the Official Journal text retrieved from the Publications Office's Cellar; the Publications Office's metadata records the instrument as in force.", "milestones": [ "tl-dga-2022-06-23-entry-into-force", "tl-dga-2023-09-24-application" ], "amended_by": [], "amends": [], "repeals": [], "transposition": null, "dna": null, "provisions": [], "claims": [], "sources": [ "src-eurlex-dga" ], "last_verified": "2026-09-27", "legal_basis": [ "tfeu:art-114" ] }, { "id": "eprivacy", "aliases": [ "eprivacy-directive" ], "celex": "32002L0058", "short_name": "ePrivacy", "full_name": "Directive 2002/58/EC on privacy and electronic communications (ePrivacy Directive)", "kind": "kind:directive", "scope_class": "scope:adjacent", "brief_part": null, "legislative_status": "status:in-force", "status_as_of": "2026-09-27", "status_note": "In force since its publication on 31 July 2002 (Art. 20; OJ L 201, 31.7.2002); transposition was due before 31 October 2003 (Art. 17(1)). Amended by Directive 2009/136/EC, as the Court of Justice's judgments cite it (e.g. C-623/17, operative part); the amending directive itself was not read here. Read on 27 Sep 2026 in the Official Journal text retrieved from the Publications Office's Cellar; the Publications Office's metadata records the instrument as in force.", "milestones": [], "amended_by": [], "amends": [], "repeals": [], "transposition": null, "dna": null, "provisions": [], "claims": [ "clm-eprivacy-miscounted-fines" ], "sources": [ "src-eurlex-eprivacy", "src-cjeu-c623-17" ], "last_verified": "2026-09-27", "legal_basis": [] }, { "id": "eidas2", "aliases": [ "european-digital-identity" ], "celex": "32024R1183", "short_name": "eIDAS2", "full_name": "Regulation (EU) 2024/1183 amending Regulation (EU) No 910/2014 as regards establishing the European Digital Identity Framework", "kind": "kind:regulation", "scope_class": "scope:adjacent", "brief_part": null, "legislative_status": "status:in-force", "status_as_of": "2026-10-14", "status_note": "In force since 20 May 2024 (Art. 2; OJ L 2024/1183, 30.4.2024); it amends Regulation (EU) No 910/2014 and sets no separate application date. Two dated duties follow from the implementing acts under Arts 5a(23) and 5c(6), in force since 24 December 2024: each Member State must provide a European Digital Identity Wallet within 24 months, by 24 December 2026 (Art. 5a(1); clm-eidas2-wallets), and private relying parties that must use strong user authentication — except micro and small enterprises — must accept the wallet at the user's voluntary request within 36 months, by 24 December 2027 (Art. 5f(2); clm-eidas2-private-acceptance). The first is a duty on Member States, the second a qualified duty on some businesses, not on all. Re-read on 14 Oct 2026 on EUR-Lex. last_verified moved from 27 Sep to 14 Oct 2026 on 21 Oct 2026 (audit item 10), the date on which the status above was re-read on EUR-Lex (docs/AUDIT-2026-10-14.md §1 E); the other fields were last re-read on 27 Sep 2026.", "milestones": [ "tl-eidas2-2026-12-24-compliance-deadline", "tl-eidas2-2027-12-24-compliance-deadline" ], "amended_by": [], "amends": [], "repeals": [], "transposition": null, "dna": null, "provisions": [ { "id": "eidas2:art-5a", "number": "5a (of Regulation (EU) No 910/2014, as inserted)", "heading": "European Digital Identity Wallets", "summary": "Each Member State must provide at least one European Digital Identity Wallet within 24 months of the entry into force of the implementing acts referred to in Art. 5a(23) and Art. 5c(6).", "obligation_on": [ "actor:member-state" ], "claims": [ "clm-eidas2-wallets" ], "sources": [ "src-eurlex-eidas2" ], "requires_verification": false, "verification_note": "Added 27 Sep 2026 from the Official Journal text retrieved that day from the Publications Office's Cellar (CELEX 32024R1183); heading and summary follow the Article's own paragraphs." }, { "id": "eidas2:art-5f", "number": "5f (of Regulation (EU) No 910/2014, as inserted)", "heading": "Cross-border reliance on European Digital Identity Wallets", "summary": "Public-sector online services that require electronic identification must also accept the wallet (5f(1)). Private relying parties required by Union or national law, or by contract, to use strong user authentication for online identification — except microenterprises and small enterprises — must also accept it, no later than 36 months from the entry into force of the implementing acts under Arts 5a(23) and 5c(6) and only upon the user's voluntary request (5f(2)). Very large online platforms that require user authentication must accept and facilitate it at the user's voluntary request (5f(3)).", "obligation_on": [ "actor:large-company", "actor:public-authority", "actor:vlop" ], "claims": [ "clm-eidas2-private-acceptance" ], "sources": [ "src-eurlex-eidas2" ], "requires_verification": false, "verification_note": "Added 14 Oct 2026 from the Official Journal text read that day on EUR-Lex (ELI reg/2024/1183/oj); heading and summary follow the Article's own paragraphs. obligation_on lists large companies because medium-sized enterprises are covered but micro and small ones are not, and the taxonomy has no 'medium enterprise' actor; read the summary, not the actor list, for the size test." } ], "claims": [], "sources": [ "src-eurlex-eidas2", "src-eurlex-eudi-2024-2981", "src-eurlex-eudi-2024-2977" ], "last_verified": "2026-10-14", "legal_basis": [ "tfeu:art-114" ] }, { "id": "cloud-ai-development-act", "aliases": [ "com-2026-502" ], "celex": null, "short_name": "Cloud and AI Development Act", "full_name": "COM(2026) 502 final — Cloud and AI Development Act (proposal)", "kind": "kind:proposal", "scope_class": "scope:adjacent", "brief_part": "part-10", "legislative_status": "status:proposal", "status_as_of": "2026-08-27", "status_note": "NOT LAW. Centrepiece of the European Technological Sovereignty Package. First instrument in this field with industrial competitiveness as an explicit co-basis.", "milestones": [ "tl-cloud-ai-act-2026-06-03-proposal" ], "amended_by": [], "amends": [], "repeals": [], "transposition": null, "dna": null, "provisions": [], "claims": [ "clm-cloud-ai-act-dual-basis", "clm-sovereignty-vs-interoperability" ], "sources": [ "src-council-cloud-ai-act-2026", "src-ec-tech-sovereignty-2026" ], "last_verified": "2026-08-27", "legal_basis": [ "tfeu:art-114", "tfeu:art-173" ] }, { "id": "ecommerce-directive", "aliases": [ "dir-2000-31" ], "celex": null, "short_name": "e-Commerce Directive", "full_name": "Directive 2000/31/EC on electronic commerce", "kind": "kind:directive", "scope_class": "scope:referenced", "brief_part": null, "legislative_status": "status:amended", "status_as_of": "2026-08-27", "status_note": "Its liability core was replaced by the DSA.", "milestones": [], "amended_by": [ "dsa" ], "amends": [], "repeals": [], "transposition": null, "dna": null, "provisions": [], "claims": [], "sources": [ "src-eurlex-dsa" ], "last_verified": "2026-08-27", "legal_basis": [] }, { "id": "nis1", "aliases": [ "dir-2016-1148" ], "celex": null, "short_name": "NIS1", "full_name": "Directive (EU) 2016/1148 (repealed)", "kind": "kind:directive", "scope_class": "scope:referenced", "brief_part": null, "legislative_status": "status:repealed", "status_as_of": "2026-08-27", "status_note": "Repealed by NIS2.", "milestones": [], "amended_by": [], "amends": [], "repeals": [], "transposition": null, "dna": null, "provisions": [], "claims": [], "sources": [ "src-eurlex-nis2" ], "last_verified": "2026-08-27", "legal_basis": [] }, { "id": "chips-act", "aliases": [], "celex": "32023R1781", "short_name": "Chips Act", "full_name": "Regulation (EU) 2023/1781 establishing a framework of measures for strengthening Europe's semiconductor ecosystem (Chips Act)", "kind": "kind:regulation", "scope_class": "scope:referenced", "brief_part": null, "legislative_status": "status:in-force", "status_as_of": "2026-09-27", "status_note": "In force since 21 September 2023, the third day after publication (Art. 41; OJ L 229, 18.9.2023), with no separate application date. Legal basis Art. 173(3) and Art. 114 TFEU. Read on 27 Sep 2026 in the Official Journal text retrieved from the Publications Office's Cellar; the Publications Office's metadata records the instrument as in force.", "milestones": [], "amended_by": [], "amends": [], "repeals": [], "transposition": null, "dna": null, "provisions": [], "claims": [], "sources": [ "src-eurlex-chips-act" ], "last_verified": "2026-09-27", "legal_basis": [ "tfeu:art-173", "tfeu:art-114" ] }, { "id": "ai-liability-directive", "aliases": [], "celex": null, "short_name": "AI Liability Directive", "full_name": "Proposed AI Liability Directive (withdrawn)", "kind": "kind:proposal", "scope_class": "scope:referenced", "brief_part": "part-5", "legislative_status": "status:withdrawn", "status_as_of": "2026-10-21", "status_note": "Abandoned, leaving a gap in the fault-based liability route. Must never be presented as law. Re-evaluated 21 Oct 2026 (audit item 9): the proposal COM(2022) 496 (CELEX 52022PC0496) carries an end of validity of 6 October 2025 in the Publications Office's metadata (Cellar SPARQL, read 21 Oct 2026), the date of the withdrawal published in the Official Journal (C/2025/5423, src-oj-aild-withdrawal-2025). Status unchanged: withdrawn.", "milestones": [], "amended_by": [], "amends": [], "repeals": [], "transposition": null, "dna": null, "provisions": [], "claims": [ "clm-aild-abandoned" ], "sources": [ "src-oj-aild-withdrawal-2025", "src-brief-original" ], "last_verified": "2026-10-21", "legal_basis": [] }, { "id": "charter", "aliases": [], "celex": null, "short_name": "Charter", "full_name": "Charter of Fundamental Rights of the European Union", "kind": "kind:treaty-provision", "scope_class": "scope:referenced", "brief_part": "part-11", "legislative_status": "status:in-force", "status_as_of": "2026-08-27", "milestones": [], "amended_by": [], "amends": [], "repeals": [], "transposition": null, "dna": null, "provisions": [], "claims": [ "clm-charter-binds-member-states" ], "sources": [ "src-brief-original" ], "last_verified": "2026-08-27", "legal_basis": [] }, { "id": "tfeu", "aliases": [], "celex": null, "short_name": "TFEU", "full_name": "Treaty on the Functioning of the European Union", "kind": "kind:treaty-provision", "scope_class": "scope:referenced", "brief_part": null, "legislative_status": "status:in-force", "status_as_of": "2026-08-27", "milestones": [], "amended_by": [], "amends": [], "repeals": [], "transposition": null, "dna": null, "provisions": [ { "id": "tfeu:art-102", "number": "102", "heading": "Abuse of a dominant position", "summary": "Ex post competition law. The DMA operates alongside it, not instead of it.", "obligation_on": [], "claims": [ "clm-dma-alongside-102" ], "sources": [ "src-brief-original" ] }, { "id": "tfeu:art-114", "number": "114", "heading": "Approximation of laws — internal-market harmonisation", "summary": "The competence on which almost the entire EU digital rulebook rests. Not a speech, safety or morality competence.", "obligation_on": [], "claims": [ "clm-art-114-shapes-everything" ], "sources": [ "src-brief-original" ] }, { "id": "tfeu:art-173", "number": "173(3)", "heading": "Industry — competitiveness", "summary": "Industrial-policy competence, used as an explicit co-basis for the first time in this field by the proposed Cloud and AI Development Act.", "obligation_on": [], "claims": [ "clm-cloud-ai-act-dual-basis" ], "sources": [ "src-brief-original" ] } ], "claims": [], "sources": [ "src-brief-original" ], "last_verified": "2026-08-27", "legal_basis": [] }, { "id": "teu", "aliases": [], "celex": null, "short_name": "TEU", "full_name": "Treaty on European Union", "kind": "kind:treaty-provision", "scope_class": "scope:referenced", "brief_part": null, "legislative_status": "status:in-force", "status_as_of": "2026-08-27", "milestones": [], "amended_by": [], "amends": [], "repeals": [], "transposition": null, "dna": null, "provisions": [ { "id": "teu:art-4-2", "number": "4(2)", "heading": "National identity and essential State functions", "summary": "Reserves national security to the sole responsibility of each Member State. The structural source of the asymmetry between constraint on corporate and on state power.", "obligation_on": [], "claims": [ "clm-art-4-2-teu-carve-out", "clm-privacy-international-national-security", "clm-enforcement-asymmetry" ], "sources": [ "src-eurlex-teu-art-4", "src-cjeu-c623-17" ] } ], "claims": [], "sources": [ "src-brief-original" ], "last_verified": "2026-08-27", "legal_basis": [] } ], "relationships": [ { "id": "rel-ai-act-gdpr-art-22", "from": "ai-act", "to": "gdpr", "kind": "rel-kind:overlap", "symmetric": true, "summary": "GDPR Art. 22 has governed solely-automated decision-making since 2018, including systems the AI Act classifies as minimal risk. The AI Act arrived into a field the GDPR already occupied.", "provisions": [ "gdpr:art-22", "ai-act:art-6" ], "claims": [ "clm-art-22-predates-ai-act", "clm-ai-act-coherence-objection" ], "sources": [ "src-eurlex-gdpr", "src-eurlex-ai-act" ], "last_verified": "2026-08-27" }, { "id": "rel-ai-act-gdpr-impact-assessments", "from": "ai-act", "to": "gdpr", "kind": "rel-kind:overlap", "symmetric": true, "summary": "GDPR Art. 35 DPIAs, DSA Art. 34 systemic risk assessment and AI Act Art. 27 fundamental rights impact assessment are three overlapping assessment duties that regulators themselves acknowledge are duplicated.", "provisions": [ "gdpr:art-35", "dsa:art-34", "ai-act:art-27" ], "claims": [ "clm-three-impact-assessments" ], "sources": [ "src-brief-original" ], "last_verified": "2026-08-27" }, { "id": "rel-dsa-gdpr-transparency-minimisation", "from": "dsa", "to": "gdpr", "kind": "rel-kind:conflict", "symmetric": true, "summary": "Content moderation is processing; ad repositories publish targeting data; Art. 40 access almost always entails personal data. The DSA tells platforms to be transparent while the GDPR tells them to minimise. EDPB guidance mediates the conflict but does not dissolve it.", "provisions": [ "dsa:art-40", "dsa:art-39" ], "claims": [ "clm-dsa-gdpr-unresolved" ], "sources": [ "src-edpb-guidelines-3-2025" ], "last_verified": "2026-08-27" }, { "id": "rel-dsa-dma-scope", "from": "dsa", "to": "dma", "kind": "rel-kind:complement", "symmetric": true, "summary": "Both regulate large platforms but on different axes: the DSA on systemic risk and due diligence, the DMA on contestability and fairness. Designation under one does not imply designation under the other.", "provisions": [ "dsa:art-33", "dma:art-3" ], "claims": [], "sources": [ "src-eurlex-dsa", "src-eurlex-dma" ], "last_verified": "2026-08-27" }, { "id": "rel-dma-tfeu-102", "from": "dma", "to": "tfeu", "kind": "rel-kind:complement", "symmetric": false, "summary": "The DMA operates alongside Articles 101 and 102 TFEU, not instead of them. Google received a separate EUR 2.95 billion Article 102 fine in September 2025.", "provisions": [ "tfeu:art-102" ], "claims": [ "clm-dma-alongside-102" ], "sources": [ "src-ec-google-adtech-2025" ], "last_verified": "2026-08-27" }, { "id": "rel-dma-gdpr-consent", "from": "dma", "to": "gdpr", "kind": "rel-kind:overlap", "symmetric": true, "summary": "DMA Art. 5(2)'s consent architecture is functionally a data protection provision enforced by a competition regulator.", "provisions": [ "dma:art-5" ], "claims": [ "clm-meta-pay-or-consent" ], "sources": [ "src-ec-apple-meta-dma-2025" ], "last_verified": "2026-08-27" }, { "id": "rel-ai-act-pld", "from": "ai-act", "to": "pld", "kind": "rel-kind:complement", "symmetric": true, "summary": "The AI Act is product-safety legislation; the revised Product Liability Directive brings software and AI within strict product liability. The proposed AI Liability Directive, which would have covered the fault-based route, was abandoned.", "provisions": [], "claims": [ "clm-aild-abandoned", "clm-pld-covers-software" ], "sources": [ "src-eurlex-pld" ], "last_verified": "2026-08-27" }, { "id": "rel-ai-omnibus-ai-act", "from": "ai-omnibus", "to": "ai-act", "kind": "rel-kind:amends", "symmetric": false, "summary": "Regulation (EU) 2026/1744 amends the AI Act, deferring the high-risk tier while leaving prohibitions, GPAI duties and transparency close to the original schedule.", "provisions": [], "claims": [ "clm-ai-act-delay-scope" ], "sources": [ "src-eurlex-ai-omnibus", "src-ec-ai-omnibus-in-force" ], "last_verified": "2026-08-27" }, { "id": "rel-data-omnibus-gdpr", "from": "data-omnibus", "to": "gdpr", "kind": "rel-kind:amends", "symmetric": false, "summary": "PROPOSED amendment only. The Digital Omnibus proposes changes to the personal-data definition, a new Art. 41a, relocation of cookie consent to Art. 88a and a new Art. 88c. None is law; the proposal is stalled in Council.", "provisions": [], "claims": [ "clm-omnibus-four-gdpr-reforms", "clm-data-omnibus-stalled" ], "sources": [ "src-eurlex-data-omnibus-837" ], "last_verified": "2026-08-27" }, { "id": "rel-nis2-cer", "from": "nis2", "to": "cer", "kind": "rel-kind:complement", "symmetric": true, "summary": "Companion directives sharing a transposition deadline: NIS2 on cyber resilience, CER on the physical and organisational resilience of critical entities.", "provisions": [], "claims": [], "sources": [ "src-eurlex-nis2", "src-eurlex-cer" ], "last_verified": "2026-08-27" }, { "id": "rel-nis2-dora", "from": "dora", "to": "nis2", "kind": "rel-kind:lex-specialis", "symmetric": false, "summary": "DORA is the sector-specific ICT resilience regime for financial entities, sitting against NIS2's horizontal baseline.", "provisions": [], "claims": [], "sources": [ "src-eurlex-dora", "src-eurlex-nis2" ], "last_verified": "2026-09-27", "requires_verification": false, "verification_note": "DORA recital 16: 'this Regulation constitutes lex specialis with regard to Directive (EU) 2022/2555'. Read on 27 Sep 2026 in the Official Journal text (CELEX 32022R2554, via the Publications Office's Cellar). Earlier: The lex specialis characterisation is stated by the brief's framing rather than established from a primary source in this build." }, { "id": "rel-cra-nis2", "from": "cra", "to": "nis2", "kind": "rel-kind:complement", "symmetric": true, "summary": "The CRA regulates the security of products with digital elements; NIS2 regulates the security of the entities that operate them.", "provisions": [], "claims": [], "sources": [ "src-eurlex-cra", "src-eurlex-nis2" ], "last_verified": "2026-08-27" }, { "id": "rel-data-act-cloud-ai-act", "from": "cloud-ai-development-act", "to": "data-act", "kind": "rel-kind:conflict", "symmetric": true, "summary": "The Data Act mandates open interoperability and the elimination of lock-in; the sovereignty requirements of the proposed Cloud and AI Development Act push toward highly secure, localised environments. The two pull in opposite directions.", "provisions": [ "data-act:art-25" ], "claims": [ "clm-sovereignty-vs-interoperability" ], "sources": [ "src-brief-original" ], "last_verified": "2026-08-27" }, { "id": "rel-dsa-ecommerce", "from": "dsa", "to": "ecommerce-directive", "kind": "rel-kind:amends", "symmetric": false, "summary": "The DSA replaced the liability core of the 2000 e-Commerce Directive with a graduated due-diligence regime.", "provisions": [], "claims": [], "sources": [ "src-eurlex-dsa" ], "last_verified": "2026-08-27" }, { "id": "rel-nis2-nis1", "from": "nis2", "to": "nis1", "kind": "rel-kind:repeals", "symmetric": false, "summary": "NIS2 repeals Directive (EU) 2016/1148.", "provisions": [], "claims": [], "sources": [ "src-eurlex-nis2" ], "last_verified": "2026-08-27" }, { "id": "rel-tfeu-114-acquis", "from": "tfeu", "to": "gdpr", "kind": "rel-kind:legal-basis", "symmetric": false, "summary": "Almost the entire digital rulebook rests on the internal-market harmonisation competence rather than on a speech, safety or morality competence. That choice shapes each instrument's form.", "provisions": [ "tfeu:art-114" ], "claims": [ "clm-art-114-shapes-everything" ], "sources": [ "src-brief-original" ], "last_verified": "2026-08-27" }, { "id": "rel-ai-act-teu-4-2", "from": "teu", "to": "ai-act", "kind": "rel-kind:carve-out", "symmetric": false, "summary": "Article 4(2) TEU reserves national security to the Member States, and the AI Act does not apply to AI systems placed on the market, put into service or used exclusively for military, defence or national security purposes (Art. 2(3)). This is the structural source of the asymmetry between constraint on corporate and on state power.", "provisions": [ "teu:art-4-2", "ai-act:art-2" ], "claims": [ "clm-art-4-2-teu-carve-out", "clm-enforcement-asymmetry" ], "sources": [ "src-brief-original" ], "last_verified": "2026-08-27" } ] }