{ "$schema_version": "1.0.0", "$description": "Canonical source records. One record per document. Referenced by ID from claims, enforcement, timeline, instruments and institutions. A source is never described twice.", "$last_verified": "2026-08-28", "$note": "url_status 'url:live' means the URL was fetched or seen in search results on the accessed date during this build. 'url:unchecked' means the reference is recorded but the URL has not been confirmed to resolve. 'url:none' means no citable URL has been located. AUDIT-2026-09-25 (2026-09-26): records re-read individually against their sources carry that date in their own last_verified; this file's $last_verified is deliberately unchanged, because the file as a whole was not re-read, and moving it would assert that it was.", "sources": [ { "id": "src-brief-original", "tier": "tier:4", "type": "source-type:commentary", "publisher": null, "publisher_name": "The European Legal Framework for the Digital World (this brief)", "title": "Original source document underlying this site", "url": null, "url_status": "url:none", "published": "2026-08-19", "accessed": "2026-08-27", "language": "en", "note": "Placeholder provenance for facts asserted by the brief itself where no external source has yet been located. Any claim resting only on this source is by definition unverified and is flagged as such.", "resolution": "self-reference", "resolution_note": "Not a source. Placeholder provenance where no external source has been located." }, { "id": "src-eurlex-gdpr", "tier": "tier:1", "type": "source-type:regulation", "publisher": "eu", "publisher_name": "EUR-Lex", "title": "Regulation (EU) 2016/679 (General Data Protection Regulation)", "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679", "url_status": "url:live", "published": "2016-05-04", "accessed": "2026-08-27", "language": "en", "note": "Title and number confirmed by fetch." }, { "id": "src-eurlex-dsa", "tier": "tier:1", "type": "source-type:regulation", "publisher": "eu", "publisher_name": "EUR-Lex", "title": "Regulation (EU) 2022/2065 (Digital Services Act)", "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022R2065", "url_status": "url:live", "published": "2022-10-27", "accessed": "2026-08-27", "language": "en", "note": "Title and number confirmed by fetch." }, { "id": "src-dsa-text-unofficial-arts-14-19", "tier": "tier:4", "type": "source-type:commentary", "publisher": null, "publisher_name": "eu-digital-services-act.com (unofficial reproduction of the DSA text)", "title": "The Digital Services Act — Article 14 (Terms and conditions) and Article 19 (Exclusion for micro and small enterprises)", "url": "https://www.eu-digital-services-act.com/Digital_Services_Act_Article_19.html", "url_status": "url:live", "published": null, "accessed": "2026-09-26", "language": "en", "note": "Privately published reproduction of Regulation (EU) 2022/2065, not an official text; Arts. 14 and 19 (same URL pattern) read on 2026-09-26. Art. 14(4): providers of intermediary services 'shall act in a diligent, objective and proportionate manner' in applying and enforcing restrictions, 'with due regard to the rights and legitimate interests of all parties involved, including the fundamental rights of the recipients of the service'. Art. 19: Section 3 (online platforms), except Art. 24(3), does not apply to micro or small enterprises (and for 12 months after they lose that status), but does apply to any provider designated a VLOP under Art. 33. Cited because EUR-Lex returns HTTP 202 with no body in this environment.", "reproduces": "src-eurlex-dsa" }, { "id": "src-ec-vlop-designation-2023", "tier": "tier:2", "type": "source-type:press-release", "publisher": "ec", "publisher_name": "European Commission", "title": "Digital Services Act: Commission designates first set of Very Large Online Platforms and Search Engines (IP/23/2413)", "url": "https://ec.europa.eu/commission/presscorner/detail/en/ip_23_2413", "url_status": "url:live", "published": "2023-04-25", "accessed": "2026-09-26", "language": "en", "note": "Read via the Press Corner API on 2026-09-26. Seventeen VLOPs (including Twitter) and two VLOSEs designated; 'the companies will now have to comply, within four months, with the full set of new obligations under the DSA'." }, { "id": "src-op-dsa-vlop-2023-08-25", "tier": "tier:2", "type": "source-type:press-release", "publisher": null, "publisher_name": "data.europa.eu (Publications Office of the European Union)", "title": "Digital Services Act takes effect for large online platforms", "url": "https://data.europa.eu/en/news-events/news/digital-services-act-takes-effect-large-online-platforms", "url_status": "url:live", "published": "2023-08-25", "accessed": "2026-09-26", "language": "en", "note": "News item dated 25 August 2023, read on 2026-09-26: 'Today the Digital Services Act (DSA) comes into force for large online platforms', naming 19 platforms and search engines." }, { "id": "src-eurlex-dma", "tier": "tier:1", "type": "source-type:regulation", "publisher": "eu", "publisher_name": "EUR-Lex", "title": "Regulation (EU) 2022/1925 (Digital Markets Act)", "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022R1925", "url_status": "url:live", "published": "2022-10-12", "accessed": "2026-08-27", "language": "en", "note": "Title, number and entry into force of 1 November 2022 confirmed by fetch." }, { "id": "src-eurlex-ai-act", "tier": "tier:1", "type": "source-type:regulation", "publisher": "eu", "publisher_name": "EUR-Lex", "title": "Regulation (EU) 2024/1689 (Artificial Intelligence Act)", "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689", "url_status": "url:live", "published": "2024-07-12", "accessed": "2026-08-27", "language": "en", "note": "Title and number confirmed by fetch. The metadata field scraped for entry into force returned an application milestone rather than the entry-into-force date; the entry-into-force record is flagged for confirmation against the consolidated text." }, { "id": "src-aia-text-unofficial-arts-2-4", "tier": "tier:4", "type": "source-type:commentary", "publisher": null, "publisher_name": "artificialintelligenceact.eu (unofficial AI Act Explorer)", "title": "EU AI Act Explorer — Article 2 (Scope) and Article 4 (AI literacy), as amended", "url": "https://artificialintelligenceact.eu/article/2/", "url_status": "url:live", "published": null, "accessed": "2026-09-26", "language": "en", "note": "Privately published explorer of Regulation (EU) 2024/1689, marking the Digital Omnibus amendments; not an official text. Art. 2 and Art. 4 pages (same URL pattern) read on 2026-09-26. Art. 2(3): the Regulation does not apply to AI systems where and in so far as they are placed on the market, put into service, or used with or without modification exclusively for military, defence or national security purposes. Art. 4(1), as amended: providers and deployers of AI systems shall take measures to support the development of AI literacy of their staff and others operating AI on their behalf, without being required to guarantee any specific level; new Art. 4(2)-(3) task the Commission, Member States and the Board with supporting it. Cited because EUR-Lex returns HTTP 202 with no body in this environment.", "reproduces": "src-eurlex-ai-act" }, { "id": "src-aia-text-unofficial-arts-111-113", "tier": "tier:4", "type": "source-type:commentary", "publisher": null, "publisher_name": "artificialintelligenceact.eu (unofficial AI Act Explorer)", "title": "EU AI Act Explorer — Articles 101, 111 and 113, as amended", "url": "https://artificialintelligenceact.eu/article/113/", "url_status": "url:live", "published": null, "accessed": "2026-09-26", "language": "en", "note": "Privately published explorer of Regulation (EU) 2024/1689 marking the Digital Omnibus amendments; not an official text. Read on 2026-09-26. Art. 113: applies from 2 August 2026; point (b) applies Chapter V and related chapters from 2 August 2025 'with the exception of Article 101'. Art. 101(1): the Commission may fine GPAI model providers up to 3% of worldwide turnover or EUR 15 000 000, whichever is higher. Art. 111(2): providers and deployers of high-risk AI systems intended to be used by public authorities shall comply by 2 August 2030. Cited because EUR-Lex returns HTTP 202 with no body in this environment.", "reproduces": "src-eurlex-ai-act" }, { "id": "src-eurlex-data-act", "tier": "tier:1", "type": "source-type:regulation", "publisher": "eu", "publisher_name": "EUR-Lex", "title": "Regulation (EU) 2023/2854 (Data Act)", "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32023R2854", "url_status": "url:live", "published": "2023-12-22", "accessed": "2026-08-27", "language": "en", "note": "Title and number confirmed by fetch." }, { "id": "src-da-text-unofficial-arts-1-50", "tier": "tier:4", "type": "source-type:commentary", "publisher": null, "publisher_name": "eu-data-act.com (unofficial reproduction of the Data Act text)", "title": "EU Data Act — article index, Article 1 (Subject matter and scope) and Article 50 (Entry into force and application)", "url": "https://www.eu-data-act.com/Data_Act_Articles.html", "url_status": "url:live", "published": null, "accessed": "2026-09-26", "language": "en", "note": "Privately published reproduction of Regulation (EU) 2023/2854, not an official text; the article index and the Art. 1 and Art. 50 pages (Data_Act_Article_N.html) read on 2026-09-26. Index: Chapter VI 'Switching between data processing services' is Arts. 23-31 (nine articles); the Regulation has fifty. Art. 1(2): covers personal and non-personal data. Art. 1(5): without prejudice to data-protection law; in a conflict, Union or national data-protection law prevails. Art. 50: applies from 12 September 2025; Art. 3(1) applies to connected products and related services placed on the market after 12 September 2026; Chapter IV applies to contracts concluded after 12 September 2025, and from 12 September 2027 to contracts concluded on or before that date if of indefinite duration or due to expire at least 10 years from 11 January 2024. No equivalent provision for Chapter VI. Cited because EUR-Lex returns HTTP 202 with no body in this environment.", "reproduces": "src-eurlex-data-act" }, { "id": "src-ec-data-act-faq-v1-4", "tier": "tier:2", "type": "source-type:guidance", "publisher": "ec", "publisher_name": "European Commission", "title": "Frequently Asked Questions — Data Act, Version 1.4", "url": "https://ec.europa.eu/newsroom/dae/redirection/document/108144", "url_status": "url:live", "published": "2026-01-22", "accessed": "2026-09-26", "language": "en", "note": "Linked from the Commission's Data Act FAQ page; downloaded and read on 2026-09-26. Question 42b addresses Chapter IV's application to contracts concluded before 12 September 2025, restating Art. 50. The switching section (questions 52-58b) covers scope, exportable data, the 12 January 2027 end of switching charges and the Art. 31 regime, but does not say whether Chapter VI applies to contracts concluded before 12 September 2025." }, { "id": "src-dlapiper-data-act-switching-2025", "tier": "tier:4", "type": "source-type:commentary", "publisher": null, "publisher_name": "DLA Piper", "title": "Understanding switching rights under the Data Act", "url": "https://www.dlapiper.com/insights/publications/2025/07/understanding-switching-termination-rights-under-the-data-act", "url_status": "url:live", "published": "2025-07-31", "accessed": "2026-09-26", "language": "en", "note": "Law-firm analysis. States that the Data Act grants any in-scope customer a right to terminate regardless of the contract's terms, and that 'this also applies for contracts concluded before September 12, 2025, regardless of any previously agreed minimum contract period'. A practitioner reading, not guidance." }, { "id": "src-oireachtas-bills-2025-2026", "tier": "tier:2", "type": "source-type:report", "publisher": null, "publisher_name": "Houses of the Oireachtas", "title": "Oireachtas legislation register — bills of 2025 and 2026 (open data API)", "url": "https://api.oireachtas.ie/v1/legislation?bill_year=2026&limit=500", "url_status": "url:live", "published": null, "accessed": "2026-09-27", "language": "en", "note": "The Oireachtas's own register of bills, read through its open data API on 27 Sep 2026: 85 bills for 2025 and 92 for 2026 (the latter updated to 25 Sep 2026). Neither year contains a Data Bill, so the Data Bill whose General Scheme was published on 4 February 2026 had not been introduced in either House by that date. The 2026 list does contain the Regulation of Artificial Intelligence Bill 2026, recorded as enacted." }, { "id": "src-matheson-ie-data-bill-2026", "tier": "tier:4", "type": "source-type:commentary", "publisher": null, "publisher_name": "Matheson", "title": "The Data Act Part III: The Irish Enforcement Framework", "url": "https://www.matheson.com/insights/the-data-act-part-iii-the-irish-enforcement-framework/", "url_status": "url:live", "published": "2026-05-18", "accessed": "2026-09-26", "language": "en", "note": "Law-firm analysis. The General Scheme of Ireland's Data Bill was published on 4 February 2026 and appoints ComReg and the CCPC as dual competent authorities, with the CCPC as Data Coordinator and ComReg over cloud switching and interoperability; after written submissions to the Joint Committee on Enterprise, Tourism and Employment closed, the General Scheme 'will continue to undergo pre-legislative scrutiny'. The General Scheme itself was not opened." }, { "id": "src-eurlex-nis2", "tier": "tier:1", "type": "source-type:regulation", "publisher": "eu", "publisher_name": "EUR-Lex", "title": "Directive (EU) 2022/2555 (NIS 2 Directive)", "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022L2555", "url_status": "url:live", "published": "2022-12-27", "accessed": "2026-08-27", "language": "en", "note": "Title, number and entry into force of 16 January 2023 confirmed by fetch." }, { "id": "src-nis2-text-unofficial-arts-20-32", "tier": "tier:4", "type": "source-type:commentary", "publisher": null, "publisher_name": "nis-2-directive.com (unofficial reproduction of the NIS2 text)", "title": "The NIS 2 Directive — Article 20 (Governance) and Article 32 (Supervisory and enforcement measures in relation to essential entities)", "url": "https://www.nis-2-directive.com/NIS_2_Directive_Article_20.html", "url_status": "url:live", "published": null, "accessed": "2026-09-26", "language": "en", "note": "Privately published reproduction of Directive (EU) 2022/2555, not an official text; Arts. 20 and 32 (same URL pattern) read on 2026-09-26. Art. 20(1): management bodies of essential and important entities approve the Art. 21 risk-management measures, oversee their implementation and can be held liable for infringements by the entities of that Article. Art. 32(6): Member States ensure that natural persons responsible for or representing an essential entity can be held liable for breach of their duties to ensure compliance. Cited because EUR-Lex returns HTTP 202 with no body in this environment.", "reproduces": "src-eurlex-nis2" }, { "id": "src-cellar-nim-nis2-cer-2026-09-27", "tier": "tier:2", "type": "source-type:report", "publisher": "eu", "publisher_name": "Publications Office of the European Union", "title": "National implementing measures notified for Directive (EU) 2022/2555 (NIS2) and Directive (EU) 2022/2557 (CER) — Cellar, 27 September 2026", "url": "https://publications.europa.eu/webapi/rdf/sparql", "url_status": "url:live", "published": null, "accessed": "2026-09-27", "language": "en", "note": "Read 27 Sep 2026 through the Publications Office's SPARQL endpoint: every work whose CELEX begins 72022L2555 (NIS2) or 72022L2557 (CER), i.e. the national measures Member States have notified as transposing each directive (the list EUR-Lex shows under 'National transposition'). NIS2: 304 measures from 25 Member States; none from Ireland or Spain. CER: 219 measures from 24 Member States; none from Bulgaria, Spain or Sweden. A notified measure is not a finding of complete transposition — France and the Netherlands notified NIS2 measures and were still referred on 8 July 2026 — so these lists establish who has notified something, not who has finished. Query: SELECT ?celex WHERE { ?w cdm:resource_legal_id_celex ?celex . FILTER(STRSTARTS(STR(?celex), \"72022L2555\")) }." }, { "id": "src-eurlex-cer", "tier": "tier:1", "type": "source-type:regulation", "publisher": "eu", "publisher_name": "EUR-Lex", "title": "Directive (EU) 2022/2557 (Critical Entities Resilience Directive)", "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022L2557", "url_status": "url:live", "published": "2022-12-27", "accessed": "2026-08-27", "language": "en", "note": "Title and number confirmed by fetch." }, { "id": "src-ec-cer-referral-2026", "tier": "tier:2", "type": "source-type:press-release", "publisher": "ec", "publisher_name": "European Commission", "title": "Commission decides to refer Bulgaria, France, Luxembourg, the Netherlands, Poland, Spain and Sweden to the Court of Justice for failing to transpose the Directive on critical entities resilience (IP/26/910)", "url": "https://ec.europa.eu/commission/presscorner/detail/en/ip_26_910", "url_status": "url:live", "published": "2026-04-29", "accessed": "2026-09-26", "language": "en", "note": "Read via the Press Corner API on 2026-09-26. Member States had to transpose the CER Directive by 17 October 2024; most have notified complete transposition; Bulgaria, France, Luxembourg, the Netherlands, Poland, Spain and Sweden have not. Letters of formal notice November 2024, reasoned opinions July 2025, referral with a request for financial sanctions." }, { "id": "src-eurlex-dora", "tier": "tier:1", "type": "source-type:regulation", "publisher": "eu", "publisher_name": "EUR-Lex", "title": "Regulation (EU) 2022/2554 (Digital Operational Resilience Act)", "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022R2554", "url_status": "url:live", "published": "2022-12-27", "accessed": "2026-08-27", "language": "en", "note": "Title and number confirmed by fetch. The scraped metadata field conflated entry into force with the 17 January 2025 application date; both are recorded separately in the timeline." }, { "id": "src-eurlex-cra", "tier": "tier:1", "type": "source-type:regulation", "publisher": "eu", "publisher_name": "EUR-Lex", "title": "Regulation (EU) 2024/2847 (Cyber Resilience Act)", "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R2847", "url_status": "url:live", "published": "2024-11-20", "accessed": "2026-10-14", "language": "en", "note": "Title, number and entry into force of 10 December 2024 confirmed by fetch. Official Journal text re-read on 14 Oct 2026 from EUR-Lex (ELI reg/2024/2847/oj). Art. 71(2): 'This Regulation shall apply from 11 December 2027. However, Article 14 shall apply from 11 September 2026 and Chapter IV (Articles 35 to 51) shall apply from 11 June 2026.' Art. 24(3) applies the Art. 14(1) notification obligation to open-source software stewards to the extent they are involved in development, and Art. 14(3) and (8) where severe incidents affect their own systems; Art. 24 falls under the general date." }, { "id": "src-cra-text-unofficial-art71", "tier": "tier:4", "type": "source-type:commentary", "publisher": null, "publisher_name": "european-cyber-resilience-act.com (unofficial reproduction of the CRA text)", "title": "Cyber Resilience Act, Article 71 — Entry into force and application", "url": "https://www.european-cyber-resilience-act.com/Cyber_Resilience_Act_Article_71.html", "url_status": "url:live", "published": null, "accessed": "2026-09-26", "language": "en", "note": "Privately published reproduction of Regulation (EU) 2024/2847, not an official text; read on 2026-09-26. Art. 71(2): applies from 11 December 2027; Article 14 from 11 September 2026; Chapter IV (Articles 35 to 51) from 11 June 2026. Cited because EUR-Lex returns HTTP 202 with no body in this environment.", "reproduces": "src-eurlex-cra" }, { "id": "src-eurlex-pld", "tier": "tier:1", "type": "source-type:regulation", "publisher": "eu", "publisher_name": "EUR-Lex", "title": "Directive (EU) 2024/2853 on liability for defective products", "url": "https://eur-lex.europa.eu/eli/dir/2024/2853/oj/eng", "url_status": "url:live", "published": "2024-11-18", "accessed": "2026-08-27", "language": "en", "note": "Applies to products placed on the market or put into service after 9 December 2026 (Art. 2(1)). Art. 4(1) includes software in the definition of product." }, { "id": "src-eurlex-ai-omnibus", "tier": "tier:1", "type": "source-type:regulation", "publisher": "eu", "publisher_name": "EUR-Lex", "title": "Regulation (EU) 2026/1744 of 8 July 2026 (Digital Omnibus on AI)", "url": "https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng", "url_status": "url:live", "published": "2026-07-08", "accessed": "2026-10-14", "language": "en", "note": "Directly supports entry into force on 27 July 2026. Re-read in full on 14 Oct 2026 (OJ L, 2026/1744, 24.7.2026; Art. 4: entry into force on the third day after publication). Art. 1, point (5), replaces Art. 4 (literacy: 'take measures to support'; 'does not require providers or deployers to guarantee any specific level of AI literacy of any individual'); Art. 1, point (39)(b), adds Art. 111(4) (Art. 50(2) by 2 December 2026 for systems placed on the market before 2 August 2026); Art. 1, point (40), amends Art. 113: Art. 5(1)(ba)-(bb), (1a) and (1b) from 2 December 2026; Chapter III Sections 1-3 from 2 December 2027 (Art. 6(2), Annex III) and 2 August 2028 (Art. 6(1), Annex I). Recital 40 gives the reason for the delay: 'the delayed availability of standards, common specifications, and alternative guidance and the delayed establishment of national competent authorities'." }, { "id": "src-eurlex-gdpr-procedural", "tier": "tier:1", "type": "source-type:regulation", "publisher": "eu", "publisher_name": "Publications Office of the European Union (Cellar)", "title": "Regulation (EU) 2025/2518 of 26 November 2025 laying down additional procedural rules on the enforcement of Regulation (EU) 2016/679", "url": "http://publications.europa.eu/resource/celex/32025R2518", "url_status": "url:live", "published": "2025-12-12", "accessed": "2026-09-27", "language": "en", "note": "The Official Journal text, retrieved on 27 Sep 2026 from the Publications Office's Cellar by CELEX number (the EUR-Lex HTML page answered with a bot challenge that day). The header reads OJ L of 12.12.2025; the enacting terms end \"Done at Strasbourg, 26 November 2025\" and provide for entry into force on the twentieth day following publication." }, { "id": "src-op-ai-omnibus-record", "tier": "tier:2", "type": "source-type:legislative-document", "publisher": "eu", "publisher_name": "Publications Office of the European Union", "title": "Regulation (EU) 2026/1744 (Digital Omnibus on AI) — publication record", "url": "https://op.europa.eu/en/publication-detail/-/publication/b459c07f-86fb-11f1-bf5e-01aa75ed71a1/language-en", "url_status": "url:live", "published": "2026-07-24", "accessed": "2026-09-26", "language": "en", "note": "The Publications Office's catalogue record for the act, read on 2026-09-26: 'CELEX : 32026R1744', 'ELI : reg/2026/1744/oj', 'OJ : L_202601744', published 2026-07-24. The act's text itself was not opened here." }, { "id": "src-eurlex-dsa-da-2050", "tier": "tier:1", "type": "source-type:regulation", "publisher": "eu", "publisher_name": "EUR-Lex", "title": "Commission Delegated Regulation (EU) 2025/2050 of 1 July 2025 on data access under the Digital Services Act", "url": "https://eur-lex.europa.eu/eli/reg_del/2025/2050/oj/eng", "url_status": "url:live", "published": "2025-07-01", "accessed": "2026-08-27", "language": "en", "note": "Directly supports entry into force on 29 October 2025. Silent on the data access portal." }, { "id": "src-eurlex-data-omnibus-837", "tier": "tier:1", "type": "source-type:legislative-document", "publisher": "ec", "publisher_name": "European Commission", "title": "COM(2025) 837 final — Digital Omnibus Regulation", "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52025PC0837", "url_status": "url:live", "published": "2025-11-19", "accessed": "2026-09-27", "language": "en", "note": "A proposal, not law. The Commission's own label is 'Digital Omnibus'; 'Data Omnibus' is informal shorthand used in this brief. Text read on 27 Sep 2026 from the English PDF of the act held by the Publications Office's Cellar (the CELEX record's first document, 1_EN_ACT_part1_v9.pdf); Art. 3 amends the GDPR." }, { "id": "src-cjeu-c413-23p", "tier": "tier:1", "type": "source-type:judgment", "publisher": "cjeu", "publisher_name": "Court of Justice of the European Union", "title": "Judgment in Case C-413/23 P, EDPS v SRB", "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:62023CJ0413", "url_status": "url:live", "published": "2025-09-04", "accessed": "2026-08-27", "language": "en", "note": "Grand Chamber, 4 September 2025. Pseudonymisation, the concept of personal data and identifiability." }, { "id": "src-cjeu-c413-23p-pr", "tier": "tier:2", "type": "source-type:court-press-release", "publisher": "cjeu", "publisher_name": "Court of Justice of the European Union", "title": "Press release on Case C-413/23 P", "url": "https://curia.europa.eu/site/upload/docs/application/pdf/2025-09/cp250107en.pdf", "url_status": "url:live", "published": "2025-09-04", "accessed": "2026-08-27", "language": "en", "note": null }, { "id": "src-eurlex-chips-act", "tier": "tier:1", "type": "source-type:regulation", "publisher": "eu", "publisher_name": "Publications Office of the European Union (Cellar)", "title": "Regulation (EU) 2023/1781 of 13 September 2023 establishing a framework of measures for strengthening Europe's semiconductor ecosystem (Chips Act) (OJ L 229, 18.9.2023, p. 1)", "url": "http://publications.europa.eu/resource/celex/32023R1781", "url_status": "url:live", "published": "2023-09-18", "accessed": "2026-09-27", "language": "en", "note": "The Official Journal text, retrieved on 27 Sep 2026 from the Publications Office's Cellar by CELEX number. Read for its citation only: 'Having regard to the Treaty on the Functioning of the European Union, and in particular Article 173(3) and Article 114 thereof'. The instrument's status is not established from this reading." }, { "id": "src-eurlex-eudpr", "tier": "tier:1", "type": "source-type:regulation", "publisher": "eu", "publisher_name": "Publications Office of the European Union (Cellar)", "title": "Regulation (EU) 2018/1725 of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies (OJ L 295, 21.11.2018, p. 39)", "url": "http://publications.europa.eu/resource/celex/32018R1725", "url_status": "url:live", "published": "2018-11-21", "accessed": "2026-09-27", "language": "en", "note": "The Official Journal text, retrieved on 27 Sep 2026 from the Publications Office's Cellar by CELEX number. Art. 52 establishes the European Data Protection Supervisor and makes it responsible for monitoring the application of data-protection law by Union institutions and bodies." }, { "id": "src-eurlex-charter-art-51", "tier": "tier:1", "type": "source-type:legislative-document", "publisher": "eu", "publisher_name": "Publications Office of the European Union (Cellar)", "title": "Charter of Fundamental Rights of the European Union, Article 51 (OJ C 202, 7.6.2016, p. 404)", "url": "http://publications.europa.eu/resource/celex/12016P051", "url_status": "url:live", "published": "2016-06-07", "accessed": "2026-09-27", "language": "en", "note": "The Charter text of Article 51 as published in the Official Journal, retrieved on 27 Sep 2026 from the Publications Office's Cellar by CELEX number. Recorded as a legislative document because the source vocabulary has no treaty type." }, { "id": "src-cjeu-c293-12", "tier": "tier:1", "type": "source-type:judgment", "publisher": "cjeu", "publisher_name": "Court of Justice of the European Union", "title": "Judgment of 8 April 2014, Digital Rights Ireland and Seitlinger and Others, Joined Cases C-293/12 and C-594/12, EU:C:2014:238", "url": "http://publications.europa.eu/resource/celex/62012CJ0293", "url_status": "url:live", "published": "2014-04-08", "accessed": "2026-09-27", "language": "en", "note": "The judgment text (Grand Chamber, CELEX 62012CJ0293), retrieved on 27 Sep 2026 from the Publications Office's Cellar. Operative part: Directive 2006/24/EC is invalid." }, { "id": "src-cjeu-c203-15", "tier": "tier:1", "type": "source-type:judgment", "publisher": "cjeu", "publisher_name": "Court of Justice of the European Union", "title": "Judgment of 21 December 2016, Tele2 Sverige and Watson and Others, Joined Cases C-203/15 and C-698/15, EU:C:2016:970", "url": "http://publications.europa.eu/resource/celex/62015CJ0203", "url_status": "url:live", "published": "2016-12-21", "accessed": "2026-09-27", "language": "en", "note": "The judgment text (Grand Chamber, CELEX 62015CJ0203), retrieved on 27 Sep 2026 from the Publications Office's Cellar." }, { "id": "src-cjeu-c511-18", "tier": "tier:1", "type": "source-type:judgment", "publisher": "cjeu", "publisher_name": "Court of Justice of the European Union", "title": "Judgment of 6 October 2020, La Quadrature du Net and Others, Joined Cases C-511/18, C-512/18 and C-520/18, EU:C:2020:791", "url": "http://publications.europa.eu/resource/celex/62018CJ0511", "url_status": "url:live", "published": "2020-10-06", "accessed": "2026-09-27", "language": "en", "note": "The judgment text (Grand Chamber, CELEX 62018CJ0511), retrieved on 27 Sep 2026 from the Publications Office's Cellar." }, { "id": "src-cnil-google-2025", "tier": "tier:2", "type": "source-type:press-release", "publisher": null, "publisher_name": "Commission nationale de l'informatique et des libertés (CNIL)", "title": "Cookies and advertisements inserted between emails: GOOGLE fined 325 million euros by the CNIL", "url": "https://www.cnil.fr/en/cookies-and-advertisements-inserted-between-emails-google-fined-325-million-euros-cnil", "url_status": "url:live", "published": "2025-09-03", "accessed": "2026-09-27", "language": "en", "note": "The CNIL's English release of 3 September 2025 on its decision of 1 September 2025, read on 27 Sep 2026. States that cookie and electronic-prospecting operations fall under the ePrivacy rules (Article 82 of the French Data Protection Act; Article L. 34-5 CPCE), not the GDPR, so the one-stop-shop does not apply." }, { "id": "src-cnil-shein-2025", "tier": "tier:2", "type": "source-type:press-release", "publisher": null, "publisher_name": "Commission nationale de l'informatique et des libertés (CNIL)", "title": "Cookies placed without consent: SHEIN fined 150 million euros by the CNIL", "url": "https://www.cnil.fr/en/cookies-placed-without-consent-shein-fined-150-million-euros-cnil", "url_status": "url:live", "published": "2025-09-03", "accessed": "2026-09-27", "language": "en", "note": "The CNIL's English release of 3 September 2025 on its decision of 1 September 2025 against Infinite Styles Services Co. Limited, read on 27 Sep 2026. Article 82 of the French Data Protection Act; the one-stop-shop does not apply." }, { "id": "src-ap-uber-2026", "tier": "tier:2", "type": "source-type:press-release", "publisher": null, "publisher_name": "Autoriteit Persoonsgegevens (Dutch Data Protection Authority)", "title": "Uber fined nearly 825 million euros for automated driver blocking", "url": "https://www.autoriteitpersoonsgegevens.nl/en/current/uber-fined-nearly-825-million-euros-for-automated-driver-blocking", "url_status": "url:live", "published": "2026-08-21", "accessed": "2026-09-27", "language": "en", "note": "Read 27 Sep 2026. EUR 824,990,000 for fully automated deactivation of drivers (GDPR Art. 22) and insufficient information about it; lead authority under the one-stop-shop after a complaint lodged with the CNIL; 'Uber has filed an appeal against the fine.' Lists the earlier AP fines on Uber (EUR 600,000 in 2018, EUR 10m in 2023, EUR 290m in 2024)." }, { "id": "src-ap-uber-2024", "tier": "tier:2", "type": "source-type:press-release", "publisher": null, "publisher_name": "Autoriteit Persoonsgegevens (Dutch Data Protection Authority)", "title": "Dutch DPA imposes a fine of 290 million euro on Uber because of transfers of drivers' data to the US", "url": "https://www.autoriteitpersoonsgegevens.nl/en/current/dutch-dpa-imposes-a-fine-of-290-million-euro-on-uber-because-of-transfers-of-drivers-data-to-the-us", "url_status": "url:live", "published": "2024-08-26", "accessed": "2026-09-27", "language": "en", "note": "Read 27 Sep 2026. EUR 290 million under the GDPR for transfers of European drivers' data to the US without appropriate safeguards." }, { "id": "src-cms-enforcement-tracker-db", "tier": "tier:4", "type": "source-type:commentary", "publisher": null, "publisher_name": "CMS", "title": "GDPR Enforcement Tracker — case database", "url": "https://www.enforcementtracker.com/", "url_status": "url:live", "published": null, "accessed": "2026-09-27", "language": "en", "note": "The law firm's database of published fines, read on 27 Sep 2026 from the dataset embedded in the page (3,275 cases). Used only to check that no GDPR fine other than those the regulators' own pages record exceeds EUR 251 million. It omits the annulled EUR 746m Amazon fine and lists the French ePrivacy decisions alongside GDPR fines." }, { "id": "src-eurlex-emfa", "tier": "tier:1", "type": "source-type:regulation", "publisher": "eu", "publisher_name": "Publications Office of the European Union (Cellar)", "title": "Regulation (EU) 2024/1083 of 11 April 2024 establishing a common framework for media services in the internal market (European Media Freedom Act) (OJ L 2024/1083, 17.4.2024)", "url": "http://publications.europa.eu/resource/celex/32024R1083", "url_status": "url:live", "published": "2024-04-17", "accessed": "2026-09-27", "language": "en", "note": "The Official Journal text, retrieved on 27 Sep 2026 from the Publications Office's Cellar by CELEX number. Art. 29: applies from 8 August 2025; Art. 3 from 8 November 2024; Arts 4(1)-(2), 6(3), 7-13 and 28 from 8 February 2025; Arts 14-17 from 8 May 2025; Art. 20 from 8 May 2027." }, { "id": "src-eurlex-ttpa", "tier": "tier:1", "type": "source-type:regulation", "publisher": "eu", "publisher_name": "Publications Office of the European Union (Cellar)", "title": "Regulation (EU) 2024/900 of 13 March 2024 on the transparency and targeting of political advertising (OJ L 2024/900, 20.3.2024)", "url": "http://publications.europa.eu/resource/celex/32024R0900", "url_status": "url:live", "published": "2024-03-20", "accessed": "2026-09-27", "language": "en", "note": "The Official Journal text, retrieved on 27 Sep 2026 from the Publications Office's Cellar by CELEX number. Art. 30(2): applies from 10 October 2025; Art. 3 and Art. 5(1) from the date of entry into force." }, { "id": "src-eurlex-platform-work", "tier": "tier:1", "type": "source-type:regulation", "publisher": "eu", "publisher_name": "Publications Office of the European Union (Cellar)", "title": "Directive (EU) 2024/2831 of 23 October 2024 on improving working conditions in platform work (OJ L 2024/2831, 11.11.2024)", "url": "http://publications.europa.eu/resource/celex/32024L2831", "url_status": "url:live", "published": "2024-11-11", "accessed": "2026-09-27", "language": "en", "note": "The Official Journal text, retrieved on 27 Sep 2026 from the Publications Office's Cellar by CELEX number. Art. 29(1): transposition by 2 December 2026." }, { "id": "src-eurlex-ehds", "tier": "tier:1", "type": "source-type:regulation", "publisher": "eu", "publisher_name": "Publications Office of the European Union (Cellar)", "title": "Regulation (EU) 2025/327 of 11 February 2025 on the European Health Data Space (OJ L 2025/327, 5.3.2025)", "url": "http://publications.europa.eu/resource/celex/32025R0327", "url_status": "url:live", "published": "2025-03-05", "accessed": "2026-09-27", "language": "en", "note": "The Official Journal text, retrieved on 27 Sep 2026 from the Publications Office's Cellar by CELEX number. Art. 105: applies from 26 March 2027, with staged dates in 2029 and 2031 for priority categories of personal electronic health data and EHR systems. The Publications Office's metadata records entry into force on 25 March 2025." }, { "id": "src-eurlex-eidas2", "tier": "tier:1", "type": "source-type:regulation", "publisher": "eu", "publisher_name": "Publications Office of the European Union (Cellar)", "title": "Regulation (EU) 2024/1183 of 11 April 2024 amending Regulation (EU) No 910/2014 as regards establishing the European Digital Identity Framework (OJ L 2024/1183, 30.4.2024)", "url": "http://publications.europa.eu/resource/celex/32024R1183", "url_status": "url:live", "published": "2024-04-30", "accessed": "2026-10-14", "language": "en", "note": "The Official Journal text, retrieved on 27 Sep 2026 from the Publications Office's Cellar by CELEX number. Inserted Art. 5a(1): each Member State to provide at least one European Digital Identity Wallet within 24 months of the entry into force of the implementing acts under Art. 5a(23) and Art. 5c(6). Re-read on 14 Oct 2026 from EUR-Lex (ELI reg/2024/1183/oj). Inserted Art. 5f(2): private relying parties, except microenterprises and small enterprises (Recommendation 2003/361/EC), that are required by Union or national law, or by contract, to use strong user authentication for online identification shall, no later than 36 months from the entry into force of the implementing acts under Arts 5a(23) and 5c(6) 'and only upon the voluntary request of the user', also accept European Digital Identity Wallets. Art. 5f(1) concerns public-sector online services; Art. 5f(3) very large online platforms that require user authentication." }, { "id": "src-eurlex-eudi-2024-2981", "tier": "tier:1", "type": "source-type:regulation", "publisher": "eu", "publisher_name": "Publications Office of the European Union (Cellar)", "title": "Commission Implementing Regulation (EU) 2024/2981 of 28 November 2024 as regards the certification of European Digital Identity Wallets", "url": "http://publications.europa.eu/resource/celex/32024R2981", "url_status": "url:live", "published": "2024-12-04", "accessed": "2026-09-27", "language": "en", "note": "The Official Journal text, retrieved on 27 Sep 2026 from the Publications Office's Cellar by CELEX number. Adopted 'in particular' under Article 5c(6) of Regulation (EU) No 910/2014. The Publications Office's metadata records entry into force on 24 December 2024, as for Implementing Regulations 2024/2977, 2024/2979, 2024/2980 and 2024/2982 of the same date." }, { "id": "src-gov-ie-data-bill-2025", "tier": "tier:2", "type": "source-type:legislative-document", "publisher": null, "publisher_name": "Government of Ireland — Department of Enterprise, Tourism and Employment", "title": "General Scheme of the Data Bill 2025", "url": "https://www.gov.ie/en/department-of-enterprise-tourism-and-employment/publications/general-scheme-of-the-data-bill-2025/", "url_status": "url:live", "published": "2026-02-04", "accessed": "2026-09-27", "language": "en", "note": "The department's publication page, read on 27 Sep 2026 ('Published on: 4 February 2026', 'Last updated on: 10 July 2026'). Following government decisions of 8 October 2024 and 16 December 2025, the CCPC and ComReg are designated as competent authorities for the Data Act and the CCPC as Data Coordinator; the General Scheme empowers both to impose administrative financial sanctions. The General Scheme PDF itself was not opened." }, { "id": "src-dpc-annual-report-2025-pdf", "tier": "tier:2", "type": "source-type:report", "publisher": "dpa-ie", "publisher_name": "Data Protection Commission (Ireland)", "title": "Data Protection Commission — Annual Report 2025", "url": "https://www.dataprotection.ie/sites/default/files/uploads/2026-06/DPC-Annual-Report-2025-Digital-AW.pdf", "url_status": "url:live", "published": "2026-06-30", "accessed": "2026-09-27", "language": "en", "note": "The full report (140 pages), read on 27 Sep 2026. p. 5: the move 'from a one to three-person Commission' and staff 'increased to 295 by year end'; p. 115: 'By year-end 2025, the DPC had reached a total headcount of 295'; p. 119: 272 employees at the gender-pay-gap snapshot of 20 June 2025." }, { "id": "src-whitehouse-dst-factsheet-2025", "tier": "tier:2", "type": "source-type:press-release", "publisher": null, "publisher_name": "The White House", "title": "Fact Sheet: President Donald J. Trump Issues Directive to Prevent the Unfair Exploitation of American Innovation", "url": "https://www.whitehouse.gov/fact-sheets/2025/02/fact-sheet-president-donald-j-trump-issues-directive-to-prevent-the-unfair-exploitation-of-american-innovation/", "url_status": "url:live", "published": "2025-02-21", "accessed": "2026-09-27", "language": "en", "note": "Read on 27 Sep 2026 with the memorandum it accompanies (whitehouse.gov/presidential-actions/2025/02/defending-american-companies-and-innovators-from-overseas-extortion-and-unfair-fines-and-penalties/). The fact sheet names the DMA and DSA as regulations that 'will face scrutiny from the Administration'; the memorandum's own text does not name them. Recorded at tier 2 as the US executive's own statement; it is evidence of the US position, not of EU law." }, { "id": "src-eurlex-dga", "tier": "tier:1", "type": "source-type:regulation", "publisher": "eu", "publisher_name": "Publications Office of the European Union (Cellar)", "title": "Regulation (EU) 2022/868 of 30 May 2022 on European data governance (Data Governance Act) (OJ L 152, 3.6.2022, p. 1)", "url": "http://publications.europa.eu/resource/celex/32022R0868", "url_status": "url:live", "published": "2022-06-03", "accessed": "2026-09-27", "language": "en", "note": "The Official Journal text, retrieved on 27 Sep 2026 from the Publications Office's Cellar by CELEX number. Art. 38: entry into force on the twentieth day following publication; applies from 24 September 2023." }, { "id": "src-eurlex-eprivacy", "tier": "tier:1", "type": "source-type:regulation", "publisher": "eu", "publisher_name": "Publications Office of the European Union (Cellar)", "title": "Directive 2002/58/EC of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (OJ L 201, 31.7.2002, p. 37)", "url": "http://publications.europa.eu/resource/celex/32002L0058", "url_status": "url:live", "published": "2002-07-31", "accessed": "2026-09-27", "language": "en", "note": "The Official Journal text, retrieved on 27 Sep 2026 from the Publications Office's Cellar by CELEX number. Read from the PDF of the original text: Art. 17(1), transposition before 31 October 2003; Art. 20, entry into force on the day of publication." }, { "id": "src-cjeu-c623-17", "tier": "tier:1", "type": "source-type:judgment", "publisher": "cjeu", "publisher_name": "Court of Justice of the European Union", "title": "Judgment of 6 October 2020, Privacy International, Case C-623/17, EU:C:2020:790", "url": "http://publications.europa.eu/resource/celex/62017CJ0623", "url_status": "url:live", "published": "2020-10-06", "accessed": "2026-09-27", "language": "en", "note": "The judgment text (Grand Chamber, CELEX 62017CJ0623), retrieved on 27 Sep 2026 from the Publications Office's Cellar by CELEX number. Operative part, point 1: national legislation enabling a State authority to require providers of electronic communications services to forward traffic and location data to the security and intelligence agencies for the purpose of safeguarding national security falls within the scope of Directive 2002/58, read in the light of Article 4(2) TEU." }, { "id": "src-eurlex-teu-art-4", "tier": "tier:1", "type": "source-type:legislative-document", "publisher": "eu", "publisher_name": "Publications Office of the European Union (Cellar)", "title": "Consolidated version of the Treaty on European Union, Article 4 (OJ C 202, 7.6.2016, p. 18)", "url": "http://publications.europa.eu/resource/celex/12016M004", "url_status": "url:live", "published": "2016-06-07", "accessed": "2026-09-27", "language": "en", "note": "The Treaty text of Article 4 TEU as published in the Official Journal, retrieved on 27 Sep 2026 from the Publications Office's Cellar by CELEX number. Recorded as a legislative document because the source vocabulary has no treaty type. Art. 4(2), third sentence: 'In particular, national security remains the sole responsibility of each Member State.'" }, { "id": "src-cjeu-c623-17-pr", "tier": "tier:2", "type": "source-type:court-press-release", "publisher": "cjeu", "publisher_name": "Court of Justice of the European Union", "title": "Press Release No 123/20 — Case C-623/17 Privacy International and Joined Cases C-511/18, C-512/18 and C-520/18 La Quadrature du Net and Others", "url": "https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-10/cp200123en.pdf", "url_status": "url:live", "published": "2020-10-06", "accessed": "2026-09-26", "language": "en", "note": "Read on 2026-09-26. Several Member States argued that the e-Privacy Directive does not apply to national legislation whose purpose is to safeguard national security, citing the third sentence of Article 4(2) TEU; the Court held that national legislation requiring providers of electronic communications services to retain traffic and location data, or to forward it to security and intelligence authorities, for that purpose falls within the scope of the Directive. Tier 2 under the audit's rule for press releases. The Privacy International judgment itself was read on 27 Sep 2026 (src-cjeu-c623-17); it concerns forwarding, and the retention limb of this press release comes from the joined La Quadrature du Net cases." }, { "id": "src-gc-apple-designation-2026", "tier": "tier:2", "type": "source-type:court-press-release", "publisher": "gc", "publisher_name": "General Court of the European Union", "title": "Press Release No 96/26 — Joined Cases T-1079/23, T-1080/23 and T-214/24, Apple v Commission", "url": "https://curia.europa.eu/site/upload/docs/application/pdf/2026-07/cp260096en.pdf", "url_status": "url:live", "published": "2026-07-08", "accessed": "2026-08-27", "language": "en", "note": "App Store and iOS gatekeeper designation upheld; iMessage pleas inadmissible; App Store versions treated as a single core platform service." }, { "id": "src-gc-t1079-23-judgment", "tier": "tier:1", "type": "source-type:judgment", "publisher": "gc", "publisher_name": "General Court of the European Union", "title": "Judgment of 8 July 2026, Apple and Apple Distribution International v Commission, Joined Cases T-1079/23, T-1080/23 and T-214/24, ECLI:EU:T:2026:451", "url": "http://publications.europa.eu/resource/celex/62023TJ1079", "url_status": "url:live", "published": "2026-07-08", "accessed": "2026-09-27", "language": "en", "note": "The judgment text (CELEX 62023TJ1079), retrieved on 27 Sep 2026 from the Publications Office's Cellar by CELEX number; ECLI and CELEX confirmed in the Court's own register (InfoCuria). Operative part: the cases are joined and the actions dismissed." }, { "id": "src-gc-supervisory-fee-2025", "tier": "tier:2", "type": "source-type:court-press-release", "publisher": "gc", "publisher_name": "General Court of the European Union", "title": "Press Release No 114/25 — Cases T-55/24 Meta Platforms Ireland and T-58/24 TikTok Technology", "url": "https://curia.europa.eu/site/upload/docs/application/pdf/2025-09/cp250114en.pdf", "url_status": "url:live", "published": "2025-09-10", "accessed": "2026-09-26", "language": "en", "note": "The DSA supervisory-fee implementing decisions were annulled because the methodology should have been adopted by delegated act; effects provisionally maintained for up to 12 months. This is an annulment of the fee decisions, not of the fee mechanism." }, { "id": "src-oj-t438-25-apple-action", "tier": "tier:2", "type": "source-type:court-record", "publisher": "gc", "publisher_name": "General Court of the European Union", "title": "Action brought on 7 July 2025 – Apple v Commission (Case T-438/25), OJ C/2025/5215", "url": "http://publications.europa.eu/resource/celex/62025TN0438", "url_status": "url:live", "published": "2025-10-06", "accessed": "2026-09-27", "language": "en", "note": "Read on 27 Sep 2026 from the Publications Office’s Cellar by CELEX number (62025TN0438). Apple Inc. seeks annulment in full or in part of Commission Decision C(2025) 2090 final of 23 April 2025 in case DMA.100109, adopted under Arts 29(1)(a), 30(1)(a) and 31(1)(h) DMA, or annulment or reduction of the fine imposed by its Art. 2. Five pleas; the first alleges misinterpretation and misapplication of Art. 5(4) DMA." }, { "id": "src-oj-t794-25-google-action", "tier": "tier:2", "type": "source-type:court-record", "publisher": "gc", "publisher_name": "General Court of the European Union", "title": "Action brought on 20 November 2025 – Google and Alphabet v Commission (Case T-794/25), OJ C/2026/185", "url": "http://publications.europa.eu/resource/celex/62025TN0794", "url_status": "url:live", "published": "2026-01-12", "accessed": "2026-10-23", "language": "en", "note": "Read on 23 Oct 2026 from the Publications Office’s Cellar by CELEX number (62025TN0794, XHTML manifestation). Google LLC and Alphabet Inc. seek annulment in whole or in part of the Commission’s prohibition decision of 5 September 2025 ‘in Case AT.40760 – Google - Adtech and Data-related practices’ under Article 102 TFEU and Article 54 EEA, and annulment or reduction of the fine. Seventeen pleas. The case number given here, AT.40760, differs from the AT.40670 of the Commission’s release IP/25/1992; which is correct is not established." }, { "id": "src-curia-register-2026-10-23", "tier": "tier:2", "type": "source-type:court-record", "publisher": "cjeu", "publisher_name": "Court of Justice of the European Union", "title": "InfoCuria case register — state of ten cases, read 23 October 2026", "url": "https://infocuria.curia.europa.eu/", "url_status": "url:live", "published": null, "accessed": "2026-10-23", "language": "en", "note": "The Court’s own case register, queried through its search service on 23 Oct 2026. Recorded as ‘Affaire pendante’ (pending) on that date: T-794/25 Google and Alphabet v Commission (lodged 20 Nov 2025); T-438/25 Apple v Commission (7 Jul 2025); T-435/25 Meta Platforms v Commission (4 Jul 2025); T-325/23 Meta Platforms Ireland v EDPB (13 Jun 2023); C-744/25 P and C-745/25 P, the Commission’s appeals in the supervisory-fee cases (20 Nov 2025); C-1009/26 Tiktok Technology and TikTok Information Technologies UK (11 Sep 2026, no referring court in the entry). Also registered and pending: T-638/26, with an application for interim measures T-638/26 R, and T-639/26, Alphabet and Google Ireland v Commission, all lodged 28 Sep 2026 — the register gives no subject matter and the Publications Office held no Official Journal notice of either action (HTTP 404 for CELEX 62026TN0638 and 62026TN0639), so which decisions they challenge is not established. The register is a live record: ‘pending’ is its state on the read date only." }, { "id": "src-oj-t435-25-meta-action", "tier": "tier:2", "type": "source-type:court-record", "publisher": "gc", "publisher_name": "General Court of the European Union", "title": "Action brought on 4 July 2025 – Meta Platforms v Commission (Case T-435/25), OJ C/2025/5214", "url": "http://publications.europa.eu/resource/celex/62025TN0435", "url_status": "url:live", "published": "2025-10-06", "accessed": "2026-09-27", "language": "en", "note": "Read on 27 Sep 2026 from the Publications Office’s Cellar by CELEX number (62025TN0435). Meta Platforms, Inc. seeks annulment of the Commission’s Decision of 23 April 2025 in Case DMA.100055 Meta – Article 5(2) DMA, and annulment or reduction of the fine imposed by its Art. 2. Four pleas; the first contests the finding that Ads Choice does not comply with Art. 5(2)." }, { "id": "src-oj-t114-26-x-action", "tier": "tier:2", "type": "source-type:court-record", "publisher": "gc", "publisher_name": "General Court of the European Union", "title": "Action brought on 16 February 2026 – X Internet and X Holdings v Commission (Case T-114/26), OJ C/2026/2390", "url": "http://publications.europa.eu/resource/celex/62026TN0114", "url_status": "url:live", "published": "2026-05-04", "accessed": "2026-09-27", "language": "en", "note": "Read on 27 Sep 2026 from the Publications Office’s Cellar by CELEX number (62026TN0114). X Internet ulc and X Holdings Corp. seek annulment, in whole or in part, of the Commission Decision of 5 December 2025 in Cases DSA.100101, DSA.100102 and DSA.100103 – X (formerly Twitter), or annulment of the amount of the fines imposed by its Art. 4. Six pleas; the first alleges breach of the rights of defence and of good administration." }, { "id": "src-oj-t120-26-xai-action", "tier": "tier:2", "type": "source-type:court-record", "publisher": "gc", "publisher_name": "General Court of the European Union", "title": "Action brought on 16 February 2026 – X.AI Holdings v Commission (Case T-120/26), OJ C/2026/2391", "url": "http://publications.europa.eu/resource/celex/62026TN0120", "url_status": "url:live", "published": "2026-05-04", "accessed": "2026-09-27", "language": "en", "note": "Read on 27 Sep 2026 from the Publications Office’s Cellar by CELEX number (62026TN0120). X.AI Holdings LLC seeks annulment of the Commission’s decision of 5 December 2025 in Cases DSA.100101, DSA.100102 and DSA.100103 – X (formerly Twitter) (C(2025) 8630 final), or its annulment insofar as it is addressed to the applicant, or of the fines imposed on it under Art. 4. Eight pleas." }, { "id": "src-oj-t121-26-musk-action", "tier": "tier:2", "type": "source-type:court-record", "publisher": "gc", "publisher_name": "General Court of the European Union", "title": "Action brought on 16 February 2026 – Musk v Commission (Case T-121/26), OJ C/2026/2392", "url": "http://publications.europa.eu/resource/celex/62026TN0121", "url_status": "url:live", "published": "2026-05-04", "accessed": "2026-09-27", "language": "en", "note": "Read on 27 Sep 2026 from the Publications Office’s Cellar by CELEX number (62026TN0121). Elon Musk seeks annulment of the same decision of 5 December 2025 (C(2025) 8630 final), or its annulment insofar as it is addressed to him, or of the fines imposed on him under Art. 4, relying on pleas similar to the eight in Case T-120/26." }, { "id": "src-oj-c744-25p-fee-appeal", "tier": "tier:2", "type": "source-type:court-record", "publisher": "cjeu", "publisher_name": "Court of Justice of the European Union", "title": "Appeal brought on 20 November 2025 by the European Commission against the judgment of the General Court in Case T-55/24, Meta Platforms Ireland v Commission (Case C-744/25 P), OJ C/2026/164", "url": "http://publications.europa.eu/resource/celex/62025CN0744", "url_status": "url:live", "published": "2026-01-12", "accessed": "2026-09-27", "language": "en", "note": "Read on 27 Sep 2026 from the Publications Office’s Cellar by CELEX number (62025CN0744). The Commission asks the Court of Justice to set aside the judgment of 10 September 2025 and give final judgment, or refer the case back. The contested act at first instance was Implementing Decision C(2023) 8176 final of 27 November 2023 determining the DSA supervisory fee for Facebook and Instagram." }, { "id": "src-oj-c745-25p-fee-appeal", "tier": "tier:2", "type": "source-type:court-record", "publisher": "cjeu", "publisher_name": "Court of Justice of the European Union", "title": "Appeal brought on 20 November 2025 by the European Commission against the judgment of the General Court in Case T-58/24, Tiktok Technology v Commission (Case C-745/25 P), OJ C/2026/165", "url": "http://publications.europa.eu/resource/celex/62025CN0745", "url_status": "url:live", "published": "2026-01-12", "accessed": "2026-09-27", "language": "en", "note": "Read on 27 Sep 2026 from the Publications Office’s Cellar by CELEX number (62025CN0745). Same form of order as C-744/25 P. The contested act at first instance was Implementing Decision C(2023) 8173 final of 27 November 2023 determining the DSA supervisory fee for TikTok." }, { "id": "src-oj-t325-23-meta-edpb-action", "tier": "tier:2", "type": "source-type:court-record", "publisher": "gc", "publisher_name": "General Court of the European Union", "title": "Action brought on 13 June 2023 – Meta Platforms Ireland v EDPB (Case T-325/23), OJ 2023/C 271/47", "url": "http://publications.europa.eu/resource/celex/62023TN0325", "url_status": "url:live", "published": "2023-07-31", "accessed": "2026-09-27", "language": "en", "note": "Read on 27 Sep 2026 from the Publications Office’s Cellar by CELEX number (62023TN0325). Meta Platforms Ireland seeks annulment of the EDPB’s Binding Decision 1/2023 of 13 April 2023 on data transfers by Meta Platforms Ireland for its Facebook service (Art. 65 GDPR). This is an action against the EDPB’s binding decision, not against the DPC’s own decision, which is a national act." }, { "id": "src-curia-register-2026-09-27", "tier": "tier:2", "type": "source-type:court-record", "publisher": "cjeu", "publisher_name": "Court of Justice of the European Union", "title": "InfoCuria case register — state of eleven cases, read 27 September 2026", "url": "https://infocuria.curia.europa.eu/", "url_status": "url:live", "published": null, "accessed": "2026-09-27", "language": "en", "note": "The Court’s own case register, queried through its search service on 27 Sep 2026. Recorded as ‘Affaire pendante’ (pending) on that date: T-438/25 Apple v Commission (lodged 7 Jul 2025); T-435/25 Meta Platforms v Commission (4 Jul 2025); T-114/26 X Internet and X Holdings v Commission, T-120/26 X.AI Holdings v Commission and T-121/26 Musk v Commission (all 16 Feb 2026); C-744/25 P and C-745/25 P, the Commission’s appeals in the supervisory-fee cases (20 Nov 2025); T-325/23 Meta Platforms Ireland v EDPB (13 Jun 2023). Also registered: T-536/26 Whaleco Technology v Commission, lodged 12 Aug 2026 and pending — the register gives no subject matter and no Official Journal notice of the action was yet held by the Publications Office (HTTP 404 for CELEX 62026TN0536), so which decision it challenges is not established. No action by Google or by AliExpress lodged after 23 Jul 2026 and 20 Jul 2026 respectively was found in the register. The register is a live record: ‘pending’ is its state on the read date only." }, { "id": "src-mlex-2025-dsa-fee-appeal", "tier": "tier:4", "type": "source-type:journalism", "publisher": null, "publisher_name": "MLex", "title": "Meta, TikTok facing EU Commission appeal against supervisory fee court ruling", "url": "https://www.mlex.com/mlex/data-privacy-security/articles/2414639/meta-tiktok-facing-eu-commission-appeal-against-supervisory-fee-court-ruling", "url_status": "url:paywalled", "published": "2025-11-24", "accessed": "2026-09-26", "language": "en", "note": "Paywalled; only the standfirst was read: Meta Platforms and TikTok are facing an appeal by the European Commission after the General Court held the Commission used the wrong procedure to set DSA supervisory fees. Gives no case number or lodging date in the part that was read." }, { "id": "src-mlex-2026-dsa-fee-appeal-oj", "tier": "tier:4", "type": "source-type:journalism", "publisher": null, "publisher_name": "MLex", "title": "Meta and TikTok supervisory fee wins appealed by EU Commission", "url": "https://www.mlex.com/mlex/articles/2428819/meta-and-tiktok-supervisory-fee-wins-appealed-by-eu-commission", "url_status": "url:paywalled", "published": "2026-01-12", "accessed": "2026-09-26", "language": "en", "note": "Paywalled; only the summary was read: Meta Platforms Ireland and TikTok Technology are facing appeals by the European Commission, as two documents in the Official Journal of the European Union showed. The Official Journal notices themselves (and their case numbers) could not be retrieved: EUR-Lex returns HTTP 202 with no body in this environment and CURIA's case search reported 'temporarily unavailable' on 2026-09-26." }, { "id": "src-ec-x-fine-2025", "tier": "tier:2", "type": "source-type:press-release", "publisher": "ec", "publisher_name": "European Commission", "title": "Commission fines X EUR 120 million under the Digital Services Act", "url": "https://digital-strategy.ec.europa.eu/en/news/commission-fines-x-eu120-million-under-digital-services-act", "url_status": "url:live", "published": "2025-12-05", "accessed": "2026-10-14", "language": "en", "note": "Confirms the amount and all three grounds. Does not use the phrase 'first DSA fine'. CORRECTED 14 Oct 2026: the page as read that day (last update 16 January 2026) does state 'This is the first non-compliance decision under the DSA.' The earlier note's 'does not use the phrase' is withdrawn: the phrase 'first DSA fine' does not appear, but the first-decision statement does." }, { "id": "src-ec-x-decision-2025-house-release", "tier": "tier:2", "type": "source-type:decision", "publisher": null, "publisher_name": "US House Judiciary Committee (release of the European Commission's decision)", "title": "Commission Decision C(2025) 8630 final of 5.12.2025, Cases DSA.100101, DSA.100102 and DSA.100103 — X (formerly Twitter)", "url": "https://judiciary.house.gov/sites/evo-subsites/republicans-judiciary.house.gov/files/2026-01/ACT_part1.pdf", "url_status": "url:live", "published": "2026-01", "accessed": "2026-09-26", "language": "en", "note": "The Commission has not published this decision; this is the text released by the Republican majority of the US House Judiciary Committee in January 2026, marked 'SENSITIVE'. The Commission has not confirmed or commented on the release, so authenticity rests on the releaser, and the record is tier 2 because tier describes the publisher. Read 2026-09-26. The decision ends on printed page 183 ('Done at Brussels, 5.12.2025', Henna Virkkunen). Recital 320: X 'mentioned only three employees working part-time on assessing data access requests'. Recital 302: the commercial developer API cost USD 5 000 per month for the second most extensive 'Pro' tier; the free Twitter Academic API programme had been discontinued. Fines: EUR 45m (Art. 25(1)), EUR 35m (Art. 39), EUR 40m (Art. 40(12))." }, { "id": "src-eucrim-x-first-fine", "tier": "tier:4", "type": "source-type:commentary", "publisher": null, "publisher_name": "eucrim", "title": "EU fines X 120 million in first DSA non-compliance decision", "url": "https://eucrim.eu/news/eu-fines-x-120-million-in-first-dsa-non-compliance-decision/", "url_status": "url:live", "published": "2025-12", "accessed": "2026-08-27", "language": "en", "note": "Carries the 'first' framing, which the Commission text does not." }, { "id": "src-ec-temu-fine-2026", "tier": "tier:2", "type": "source-type:press-release", "publisher": "ec", "publisher_name": "European Commission", "title": "Commission fines Temu EUR 200 million for breaching the Digital Services Act", "url": "https://digital-strategy.ec.europa.eu/en/news/commission-fines-temu-eu200-million-breaching-digital-services-act", "url_status": "url:live", "published": "2026-05-28", "accessed": "2026-08-27", "language": "en", "note": "Confirms the amount and the systemic-risk ground. Contains no ranking language; 'largest to date' is not supported by this source." }, { "id": "src-techpolicypress-temu", "tier": "tier:4", "type": "source-type:journalism", "publisher": null, "publisher_name": "Tech Policy Press", "title": "EU tests limits of platform risk assessments with 200 million Temu fine", "url": "https://www.techpolicy.press/eu-tests-limits-of-platform-risk-assessments-with-200-million-temu-fine/", "url_status": "url:live", "published": "2026-05", "accessed": "2026-08-27", "language": "en", "note": "Carries the 'biggest DSA penalty yet' framing." }, { "id": "src-ec-tiktok-commitments-2025", "tier": "tier:2", "type": "source-type:press-release", "publisher": "ec", "publisher_name": "European Commission", "title": "Commission accepts TikTok's commitments on advertising transparency under the Digital Services Act", "url": "https://digital-strategy.ec.europa.eu/en/news/commission-accepts-tiktoks-commitments-advertising-transparency-under-digital-services-act", "url_status": "url:live", "published": "2025-12-05", "accessed": "2026-08-27", "language": "en", "note": null }, { "id": "src-ec-tiktok-commitments-ip-2025", "tier": "tier:2", "type": "source-type:press-release", "publisher": "ec", "publisher_name": "European Commission", "title": "Commission accepts TikTok's commitments on advertising transparency under the Digital Services Act (IP/25/2940)", "url": "https://ec.europa.eu/commission/presscorner/detail/en/ip_25_2940", "url_status": "url:live", "published": "2025-12-05", "accessed": "2026-09-26", "language": "en", "note": "The full press release behind the news item src-ec-tiktok-commitments-2025, read via the Press Corner API on 2026-09-26. Its quotation: 'The message is clear: our aim is compliance. When platforms engage constructively with the Commission, we are ready to accept solid commitments.' The commitments are binding under DSA Art. 71." }, { "id": "src-ec-tiktok-addictive-2026", "tier": "tier:2", "type": "source-type:press-release", "publisher": "ec", "publisher_name": "European Commission", "title": "Commission preliminarily finds TikTok's addictive design in breach of the Digital Services Act", "url": "https://digital-strategy.ec.europa.eu/en/news/commission-preliminarily-finds-tiktoks-addictive-design-breach-digital-services-act", "url_status": "url:live", "published": "2026-02-06", "accessed": "2026-08-27", "language": "en", "note": null }, { "id": "src-ec-meta-addictive-2026", "tier": "tier:2", "type": "source-type:press-release", "publisher": "ec", "publisher_name": "European Commission", "title": "Commission preliminarily finds addictive design on Instagram and Facebook in breach of the Digital Services Act", "url": "https://digital-strategy.ec.europa.eu/en/news/commission-preliminarily-finds-addictive-design-instagram-and-facebook-breach-digital-services-act", "url_status": "url:live", "published": "2026-07-10", "accessed": "2026-10-14", "language": "en", "note": "Read 14 Oct 2026 with the full press release IP/26/1579 (10 July 2026). Preliminary findings in formal proceedings opened 16 May 2024; 'These preliminary findings do not prejudge the final outcome of the investigation.' At this stage the Commission considers Meta needs design changes, 'for instance, by disabling key addictive features such as autoplay and infinite scroll by default'. The same proceedings produced preliminary findings on under-13 age assurance on 29 April 2026." }, { "id": "src-ec-meta-under13-2026", "tier": "tier:2", "type": "source-type:press-release", "publisher": "ec", "publisher_name": "European Commission", "title": "Press release IP/26/920 — Commission preliminarily finds Meta in breach of Digital Services Act for failing to prevent minors under 13 from using Instagram and Facebook", "url": "https://ec.europa.eu/commission/presscorner/detail/en/ip_26_920", "url_status": "url:live", "published": "2026-04-29", "accessed": "2026-10-21", "language": "en", "note": "Read in full 21 Oct 2026 through the Commission's press corner. Preliminary findings that Instagram and Facebook breach the DSA 'for failing to diligently identify, assess and mitigate the risks of minors under 13 years old accessing their services': self-declared birth dates with 'no effective controls in place'; a reporting tool 'requiring up to seven clicks'; an 'incomplete and arbitrary risk assessment', against evidence that 'roughly 10-12% of children under 13' use the services. Part of the formal proceedings opened 16 May 2024; 'These findings do not prejudge the final outcome of the investigation.' If confirmed, a non-compliance decision could carry a fine of up to 6% of worldwide turnover. The release names no article; the proceedings' opening release (IP/24/2664) names Articles 28, 34 and 35." }, { "id": "src-ec-x-preliminary-2024", "tier": "tier:2", "type": "source-type:press-release", "publisher": "ec", "publisher_name": "European Commission", "title": "Press release IP/24/3761 — Commission sends preliminary findings to X for breach of the Digital Services Act", "url": "https://ec.europa.eu/commission/presscorner/detail/en/ip_24_3761", "url_status": "url:live", "published": "2024-07-12", "accessed": "2026-10-22", "language": "en", "note": "Read in full 22 Oct 2026 through the Commission's press corner. 'Today, the Commission has informed X of its preliminary view that it is in breach of the Digital Services Act (DSA) in areas linked to dark patterns, advertising transparency and data access for researchers': the 'verified accounts' blue checkmark, the advertisement repository, and researchers' access to public data." }, { "id": "src-ec-dsa-costs-2025", "tier": "tier:2", "type": "source-type:report", "publisher": "ec", "publisher_name": "European Commission", "title": "COM(2026) 147 — Report on the overall annual costs incurred for the Commission’s tasks under Regulation (EU) 2022/2065 in 2025 and the supervisory fees charged in 2025", "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52026DC0147", "url_status": "url:live", "published": "2026-03-31", "accessed": "2026-10-22", "language": "en", "note": "Read 22 Oct 2026 in the Publications Office's Cellar (CELEX 52026DC0147, XHTML). Dated Brussels, 31.3.2026. Para. (9): '80 staff members were recruited' in 2025, 54 to DG CNECT and 26 to the Commission representations. Para. (14): recruitment came later than foreseen, 'amounting to a total of approximately 138 FTEs (including a total of approximately 34 FTE officials and temporary agents, 92 FTE contract agents and 12 FTE seconded national experts dedicated to tasks referred to in Article 43(2) DSA)', EUR 21.153 million. A footnote warns that the FTEs 'do not represent the total number of Commission staff members working on DSA activities in 2025'." }, { "id": "src-ec-meta-minors-opening-2024", "tier": "tier:2", "type": "source-type:press-release", "publisher": "ec", "publisher_name": "European Commission", "title": "Press release IP/24/2664 — Commission opens formal proceedings against Meta under the Digital Services Act related to the protection of minors on Facebook and Instagram", "url": "https://ec.europa.eu/commission/presscorner/detail/en/ip_24_2664", "url_status": "url:live", "published": "2024-05-16", "accessed": "2026-10-21", "language": "en", "note": "Read in full 21 Oct 2026 through the Commission's press corner. Opens proceedings on the design of Facebook's and Instagram's interfaces, on 'age-verification tools used by Meta, which may not be reasonable, proportionate and effective', and on default privacy settings for minors: 'If proven, these failures would constitute infringements of Articles 28, 34, and 35 of the DSA.'" }, { "id": "src-ec-tiktok-minors-2026", "tier": "tier:2", "type": "source-type:press-release", "publisher": "ec", "publisher_name": "European Commission", "title": "Commission preliminarily finds TikTok in breach of the Digital Services Act for failing to ensure safe accounts for minors", "url": "https://digital-strategy.ec.europa.eu/en/news/commission-preliminary-finds-tiktok-breach-digital-services-act-failing-ensure-safe-accounts-minors", "url_status": "url:live", "published": "2026-07-24", "accessed": "2026-10-14", "language": "en", "note": "Read 14 Oct 2026 with the full press release IP/26/1679 (24 July 2026). Preliminary findings, not a decision, in the formal proceedings opened 19 February 2024. The release states that the same investigation 'also included TikTok's potentially addictive design, for which preliminary findings were adopted in February', researchers' data access (preliminary findings October 2025) and advertising transparency (closed by binding commitments, December 2025): one proceeding, several separate sets of findings." }, { "id": "src-ec-apple-meta-dma-2025", "tier": "tier:2", "type": "source-type:press-release", "publisher": "ec", "publisher_name": "European Commission", "title": "Commission finds Apple and Meta in breach of the Digital Markets Act", "url": "https://digital-markets-act.ec.europa.eu/commission-finds-apple-and-meta-breach-digital-markets-act-2025-04-23_en", "url_status": "url:live", "published": "2025-04-23", "accessed": "2026-09-27", "language": "en", "note": "EUR 500 million against Apple under Art. 5(4); EUR 200 million against Meta under Art. 5(2). Read in full on 27 Sep 2026 as press release IP/25/1085 through the Commission's press corner: investigations opened 25 March 2024; preliminary views 24 June 2024 (Apple) and 1 July 2024 (Meta); compliance required within 60 days; the Meta finding covers March–November 2024; the same day the Commission closed its investigation into Apple's user-choice obligations and found Facebook Marketplace should no longer be designated." }, { "id": "src-ec-meta-ad-choice-2025", "tier": "tier:2", "type": "source-type:press-release", "publisher": "ec", "publisher_name": "European Commission", "title": "Meta commits to give EU users choice on personalised ads under Digital Markets Act", "url": "https://digital-markets-act.ec.europa.eu/meta-commits-give-eu-users-choice-personalised-ads-under-digital-markets-act-2025-12-08_en", "url_status": "url:live", "published": "2025-12-08", "accessed": "2026-09-26", "language": "en", "note": "Read 2026-09-26. The Commission acknowledges Meta's undertaking to offer EU users a choice between consenting to share all their data for fully personalised advertising and sharing less data for more limited personalised advertising, presented in January 2026; the Commission will then seek evidence on uptake. Describes a two-way choice; the brief's earlier 'three-tier advertising model' is not in it." }, { "id": "src-ec-apple-specification-2025", "tier": "tier:2", "type": "source-type:press-release", "publisher": "ec", "publisher_name": "European Commission", "title": "Commission provides guidance under Digital Markets Act to facilitate development of innovative products on Apple's platforms (IP/25/816)", "url": "https://ec.europa.eu/commission/presscorner/detail/en/ip_25_816", "url_status": "url:live", "published": "2025-03-19", "accessed": "2026-09-26", "language": "en", "note": "Read via the Press Corner API on 2026-09-26. On 19 March 2025 the Commission adopted two specification decisions under Art. 6(7): measures for connected-device interoperability and for the process handling developers' interoperability requests; public consultation launched 18 December 2024. The Commission's specification-proceedings Q&A page was also read and mentions no Apple 'waiver' of any features." }, { "id": "src-ec-booking-designation-2024", "tier": "tier:1", "type": "source-type:legislative-document", "publisher": "ec", "publisher_name": "European Commission", "title": "Commission Decision of 13.5.2024 designating Booking Holdings Inc. as a gatekeeper pursuant to Article 3 of Regulation (EU) 2022/1925 (C(2024) 3176 final, Case DMA.100019)", "url": "https://ec.europa.eu/competition/digital_markets_act/cases/202442/DMA_100019_191.pdf", "url_status": "url:live", "published": "2024-05-13", "accessed": "2026-09-26", "language": "en", "note": "The designation decision itself, downloaded from the Commission's own DMA Gatekeepers Portal. States on its face that it designates 'Booking Holdings Inc.' ('BHI') as the gatekeeper undertaking for the online intermediation service Booking.com. The Commission's own gatekeepers-portal page and press release refer to the undertaking only as 'Booking', without the corporate suffix used for every other designated gatekeeper (Alphabet Inc., Amazon.com Inc., Apple Inc., ByteDance Ltd., Meta Platforms, Inc.) — this decision is the primary source for the full legal name." }, { "id": "src-thenextweb-ustr-2026", "tier": "tier:4", "type": "source-type:journalism", "publisher": null, "publisher_name": "TheNextWeb", "title": "US lawmakers press Trump to open trade probe into EU tech rules", "url": "https://thenextweb.com/news/us-lawmakers-eu-tech-rules-trade-probe", "url_status": "url:live", "published": "2026-07-21", "accessed": "2026-09-26", "language": "en", "note": "States that in February 2025 President Trump signed a memorandum directing US agencies to scrutinise foreign digital rules, naming the DMA and DSA specifically, and that in July 2026 a group of US lawmakers wrote urging a formal Section 301 trade investigation into the same two instruments. Does not itself use the word 'objected'; it documents executive and congressional pressure rather than a single formal diplomatic objection." }, { "id": "src-ec-google-adtech-2025", "tier": "tier:2", "type": "source-type:press-release", "publisher": "ec", "publisher_name": "European Commission", "title": "Commission fines Google EUR 2.95 billion over abusive practices in online advertising technology", "url": "https://competition-policy.ec.europa.eu/about/news/commission-fines-google-eu295-billion-over-abusive-practices-online-advertising-technology-2025-09-05_en", "url_status": "url:live", "published": "2025-09-05", "accessed": "2026-08-27", "language": "en", "note": "Case AT.40670. An Article 102 TFEU antitrust decision, not a DMA decision." }, { "id": "src-ec-meta-whatsapp-ai-2025", "tier": "tier:2", "type": "source-type:press-release", "publisher": "ec", "publisher_name": "European Commission", "title": "Commission opens antitrust investigation into Meta's new policy regarding AI providers' access to WhatsApp", "url": "https://digital-strategy.ec.europa.eu/en/news/commission-opens-antitrust-investigation-metas-new-policy-regarding-ai-providers-access-whatsapp", "url_status": "url:live", "published": "2025-12-04", "accessed": "2026-09-26", "language": "en", "note": "Confirms the 4 December 2025 opening date and that it is an antitrust investigation into a possible breach of EU competition rules over Meta's WhatsApp Business Solution policy (announced October 2025). Does not itself name Article 102 TFEU; see src-insighteu-whatsapp-interim-2026 for that." }, { "id": "src-ec-dma-cloud-mi-2025", "tier": "tier:2", "type": "source-type:press-release", "publisher": "ec", "publisher_name": "European Commission", "title": "Commission launches market investigations on cloud computing services under the Digital Markets Act (IP/25/2717)", "url": "https://ec.europa.eu/commission/presscorner/detail/en/ip_25_2717", "url_status": "url:live", "published": "2025-11-18", "accessed": "2026-09-26", "language": "en", "note": "Read via the Press Corner API on 2026-09-26; the shorter news item on digital-markets-act.ec.europa.eu (18 November 2025) links to it. Three market investigations opened: two on whether Amazon Web Services and Microsoft Azure should be designated as gatekeepers despite not meeting the quantitative thresholds, one on whether the DMA's obligations are effective in the cloud sector. The Commission 'aims to conclude' the AWS and Azure investigations 'within 12 months'; the sector investigation 'will result in a final report to be published within 18 months'. If designated, six months to comply." }, { "id": "src-ec-emfa-page", "tier": "tier:2", "type": "source-type:guidance", "publisher": "ec", "publisher_name": "European Commission", "title": "European Media Freedom Act", "url": "https://commission.europa.eu/topics/democracy/eu-actions-protect-democracy/european-media-freedom-act_en", "url_status": "url:live", "published": null, "accessed": "2026-09-26", "language": "en", "note": "Commission policy page, read 2026-09-26: the EMFA entered into force on 7 May 2024 and most of its provisions entered into application on 8 August 2025; the page links CELEX 32024R1083 (Regulation (EU) 2024/1083)." }, { "id": "src-ec-political-ads-page", "tier": "tier:2", "type": "source-type:guidance", "publisher": "ec", "publisher_name": "European Commission", "title": "Transparency and targeting of political advertising", "url": "https://commission.europa.eu/strategy-and-policy/policies/justice-and-fundamental-rights/democracy-eu-citizenship-anti-corruption/democracy-and-electoral-rights/transparency-and-targeting-political-advertising_en", "url_status": "url:live", "published": null, "accessed": "2026-09-26", "language": "en", "note": "Commission policy page, read 2026-09-26: Regulation (EU) 2024/900 'entered into full application on 10 October 2025' and applies to offline and online political advertising." }, { "id": "src-ec-platform-work-page", "tier": "tier:2", "type": "source-type:guidance", "publisher": "ec", "publisher_name": "European Commission", "title": "The future of work (platform work)", "url": "https://employment-social-affairs.ec.europa.eu/policies-and-activities/rights-work/future-work_en", "url_status": "url:live", "published": null, "accessed": "2026-09-26", "language": "en", "note": "Commission policy page, read 2026-09-26: 'Member States have until December 2026 to transpose these rules'; links the directive at eur-lex.europa.eu/eli/dir/2024/2831 (Directive (EU) 2024/2831)." }, { "id": "src-ec-ehds-page", "tier": "tier:2", "type": "source-type:guidance", "publisher": "ec", "publisher_name": "European Commission", "title": "European Health Data Space Regulation (EHDS)", "url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en", "url_status": "url:live", "published": null, "accessed": "2026-09-26", "language": "en", "note": "Commission policy page, read 2026-09-26: published in the Official Journal on 5 March 2025, entered into force on 26 March 2025, 'marking the beginning of the transition phase towards application'; links OJ L_202500327 (Regulation (EU) 2025/327). On 27 Sep 2026 the Official Journal text and the Publications Office's metadata were read: published 5 March 2025, entry into force on 'the twentieth day following' publication, recorded as 25 March 2025 — one day earlier than this page says. The site follows the Official Journal." }, { "id": "src-ec-eudi-page", "tier": "tier:2", "type": "source-type:guidance", "publisher": "ec", "publisher_name": "European Commission", "title": "The European Digital Identity Regulation", "url": "https://digital-strategy.ec.europa.eu/en/policies/eudi-regulation", "url_status": "url:live", "published": null, "accessed": "2026-09-26", "language": "en", "note": "Commission policy page, read 2026-09-26: Regulation (EU) 2024/1183 establishing the European Digital Identity Framework has entered into force and 'mandates Member States to provide EU Digital Identity (eID) Wallets to citizens by the end of 2026'." }, { "id": "src-ec-cyber-package-qa-2026", "tier": "tier:2", "type": "source-type:guidance", "publisher": "ec", "publisher_name": "European Commission", "title": "Cybersecurity Package — Questions & Answers", "url": "https://digital-strategy.ec.europa.eu/en/faqs/cybersecurity-package-questions-answers", "url_status": "url:live", "published": "2026-01-20", "accessed": "2026-09-27", "language": "en", "note": "Commission Q&A, read 2026-09-26 and again 2026-09-27: 'On 20 January 2026, the Commission has proposed a new cybersecurity package', including amendments to the NIS2 Directive and a revised Cybersecurity Act. The COM document numbers are not given on the page and were not recorded." }, { "id": "src-dma-text-unofficial-art2", "tier": "tier:4", "type": "source-type:commentary", "publisher": null, "publisher_name": "eu-digital-markets-act.com (unofficial reproduction of the DMA text)", "title": "The final text of the Digital Markets Act (DMA) — Article 2, Definitions", "url": "https://www.eu-digital-markets-act.com/Digital_Markets_Act_Article_2.html", "url_status": "url:live", "published": null, "accessed": "2026-09-26", "language": "en", "note": "Privately published reproduction of Regulation (EU) 2022/1925, not an official text. Art. 2(2) lists as core platform services (a) online intermediation, (b) search engines, (c) social networking, (d) video-sharing, (e) number-independent interpersonal communications, (f) operating systems, (g) web browsers, (h) virtual assistants, (i) cloud computing services and (j) online advertising; generative AI is not listed. Cited because EUR-Lex returns HTTP 202 with no body in this environment; to be replaced by src-eurlex-dma once the consolidated text can be read.", "reproduces": "src-eurlex-dma" }, { "id": "src-dma-text-unofficial-arts-11-39", "tier": "tier:4", "type": "source-type:commentary", "publisher": null, "publisher_name": "eu-digital-markets-act.com (unofficial reproduction of the DMA text)", "title": "The final text of the Digital Markets Act (DMA) — Articles 11, 13, 14, 15, 38 and 39", "url": "https://www.eu-digital-markets-act.com/Digital_Markets_Act_Article_38.html", "url_status": "url:live", "published": null, "accessed": "2026-09-26", "language": "en", "note": "Privately published reproduction of Regulation (EU) 2022/1925, not an official text; one page per article (same URL pattern, Digital_Markets_Act_Article_N.html), each read on 2026-09-26; the URL recorded is Art. 38's. Art. 11 'Reporting': a compliance report within 6 months of designation, updated at least annually. Art. 13 'Anti-circumvention'. Art. 14 'Obligation to inform about concentrations'. Art. 15 'Obligation of an audit': an independently audited description of consumer-profiling techniques. Art. 38(7): a national competition authority may, on its own initiative, investigate possible non-compliance with Arts. 5, 6 and 7 on its territory, and reports its findings 'to support the Commission in its role as sole enforcer'; the Commission's opening of proceedings under Art. 20 ends that possibility. Art. 39 'Cooperation with national courts': national courts in proceedings for the application of the Regulation may ask the Commission for information or its opinion, and may not decide against a Commission decision. Cited because EUR-Lex returns HTTP 202 with no body in this environment.", "reproduces": "src-eurlex-dma" }, { "id": "src-dma-text-unofficial-art54", "tier": "tier:4", "type": "source-type:commentary", "publisher": null, "publisher_name": "eu-digital-markets-act.com (unofficial reproduction of the DMA text)", "title": "The final text of the Digital Markets Act (DMA) — Article 54, Entry into force and application", "url": "https://www.eu-digital-markets-act.com/Digital_Markets_Act_Article_54.html", "url_status": "url:live", "published": null, "accessed": "2026-09-26", "language": "en", "note": "Privately published reproduction of Regulation (EU) 2022/1925, not an official text; read on 2026-09-26. Art. 54: the Regulation 'shall apply from 2 May 2023', with Art. 3(6)-(7) and Arts. 40 and 46-50 from 1 November 2022 and Arts. 42-43 from 25 June 2023 (postponed to the application date if earlier). Cited because EUR-Lex returns HTTP 202 with no body in this environment.", "reproduces": "src-eurlex-dma" }, { "id": "src-ec-dma-designation-2023", "tier": "tier:2", "type": "source-type:press-release", "publisher": "ec", "publisher_name": "European Commission", "title": "Digital Markets Act: Commission designates six gatekeepers (IP/23/4328)", "url": "https://ec.europa.eu/commission/presscorner/detail/en/ip_23_4328", "url_status": "url:live", "published": "2023-09-06", "accessed": "2026-09-26", "language": "en", "note": "Read via the Press Corner API on 2026-09-26. Alphabet, Amazon, Apple, ByteDance, Meta and Microsoft designated for 22 core platform services; the gatekeepers 'now have six months to comply with the full list of do's and don'ts', though some obligations apply from designation." }, { "id": "src-ec-dma-gatekeepers-comply-2024", "tier": "tier:2", "type": "source-type:press-release", "publisher": "ec", "publisher_name": "European Commission", "title": "Designated gatekeepers must now comply with all obligations under the Digital Markets Act", "url": "https://digital-markets-act.ec.europa.eu/designated-gatekeepers-must-now-comply-all-obligations-under-digital-markets-act-2024-03-07_en", "url_status": "url:live", "published": "2024-03-07", "accessed": "2026-09-26", "language": "en", "note": "News announcement read on 2026-09-26: 'As of today, Apple, Alphabet, Meta, Amazon, Microsoft and ByteDance, the six gatekeepers designated by the Commission in September 2023, have to fully comply with all obligations in the Digital Markets Act.'" }, { "id": "src-insighteu-whatsapp-interim-2026", "tier": "tier:4", "type": "source-type:journalism", "publisher": null, "publisher_name": "Insight EU Monitoring", "title": "EU Commission orders Meta to restore free WhatsApp access for rival AI assistants", "url": "https://ieu-monitoring.com/editorial/eu-commission-orders-meta-to-restore-free-whatsapp-access-for-rival-ai-assistants/1243042", "url_status": "url:live", "published": "2026-06-09", "accessed": "2026-09-26", "language": "en", "note": "Reports the 9 June 2026 interim-measures decision, tagged 'Article 102 TFEU' by the outlet, and the intermediate procedural steps: a February 2026 Statement of Objections and an April 2026 supplementary Statement of Objections. States the Commission's first-sight finding that Meta holds a dominant position in the EEA-wide consumer-communication-app market and abused it by blocking third-party AI assistants from the WhatsApp Business API from 15 October 2025." }, { "id": "src-ec-nis2-referral-2026", "tier": "tier:2", "type": "source-type:press-release", "publisher": "ec", "publisher_name": "European Commission", "title": "Commission refers Ireland, Spain, France and the Netherlands to the Court of Justice for failing to transpose NIS2", "url": "https://digital-strategy.ec.europa.eu/en/news/commission-refers-ireland-spain-france-and-netherlands-court-justice-failing-transpose-rules", "url_status": "url:live", "published": "2026-07-08", "accessed": "2026-08-27", "language": "en", "note": "Confirms the referral includes a request for financial sanctions: a lump sum and daily penalties until complete transposition is notified." }, { "id": "src-ec-nis2-lfn-2024", "tier": "tier:2", "type": "source-type:press-release", "publisher": "ec", "publisher_name": "European Commission", "title": "Commission calls on 23 Member States to fully transpose the NIS2 Directive", "url": "https://digital-strategy.ec.europa.eu/en/news/commission-calls-23-member-states-fully-transpose-nis2-directive", "url_status": "url:live", "published": "2024-11-28", "accessed": "2026-08-27", "language": "en", "note": "States that letters of formal notice went to 23 named Member States for failure to fully transpose by 17 October 2024. The figure 'only 4 of 27' is the arithmetic complement and is not stated by any official source located." }, { "id": "src-ec-gpai-code", "tier": "tier:2", "type": "source-type:guidance", "publisher": "ec", "publisher_name": "European Commission", "title": "General-Purpose AI Code of Practice", "url": "https://digital-strategy.ec.europa.eu/en/policies/ai-code-practice", "url_status": "url:live", "published": "2025-07-10", "accessed": "2026-09-26", "language": "en", "note": "Confirms the final version was received on 10 July 2025 and sets out the drafting timeline: first draft, second draft (19 Dec 2024), third draft (11 Mar 2025), final version (10 Jul 2025). The brief's 'after four drafts' is only accurate if the final text is counted as the fourth." }, { "id": "src-ec-gpai-code-safety-security", "tier": "tier:2", "type": "source-type:guidance", "publisher": "ec", "publisher_name": "European Commission", "title": "General-Purpose AI Code of Practice — Safety and Security chapter (PDF)", "url": "https://ec.europa.eu/newsroom/dae/redirection/document/118119", "url_status": "url:live", "published": "2025-07-10", "accessed": "2026-09-26", "language": "en", "note": "Downloaded from the Commission's Code of Practice page and read on 2026-09-26. Appendix 1.4 (p. 37) lists the 'specified systemic risks' every signatory identifies under Measure 2.1(2): (1) chemical, biological, radiological and nuclear; (2) loss of control; (3) cyber offence; (4) harmful manipulation. Hallucination is not among them; Appendix 1.3.2 names a 'tendency to hallucinate, to produce misinformation, or to obscure sources of information' only as a model propensity that may be a source of systemic risk. Drafted by independent experts; published by the Commission." }, { "id": "src-ec-gpai-guidelines-2025", "tier": "tier:2", "type": "source-type:press-release", "publisher": "ec", "publisher_name": "European Commission", "title": "Commission publishes guidelines for providers of general-purpose AI models", "url": "https://digital-strategy.ec.europa.eu/en/news/commission-publishes-guidelines-providers-general-purpose-ai-models", "url_status": "url:live", "published": "2025-07-18", "accessed": "2026-09-26", "language": "en", "note": "News item read on 2026-09-26, with the Commission's FAQ page on the same guidelines. The guidelines define general-purpose AI models as those trained with more than 10^23 FLOP and able to generate language (text or audio), text-to-image or text-to-video; the FAQ calls this an 'indicative criterion', with possible exceptions. The guidelines themselves were not opened." }, { "id": "src-ec-dsa-data-access-2025", "tier": "tier:2", "type": "source-type:press-release", "publisher": "ec", "publisher_name": "European Commission", "title": "New measures unlock access to data of the largest online platforms to support research", "url": "https://digital-strategy.ec.europa.eu/en/news/new-measures-unlock-access-data-largest-online-platforms-support-research", "url_status": "url:live", "published": "2025-10-29", "accessed": "2026-08-27", "language": "en", "note": "Directly supports the 29 October 2025 date." }, { "id": "src-ec-dsa-data-access-portal", "tier": "tier:2", "type": "source-type:press-release", "publisher": "ec", "publisher_name": "European Commission", "title": "Commission adopts delegated act on data access under the Digital Services Act", "url": "https://digital-strategy.ec.europa.eu/en/news/commission-adopts-delegated-act-data-access-under-digital-services-act", "url_status": "url:live", "published": "2025-07-02", "accessed": "2026-08-27", "language": "en", "note": "Directly supports the centralised DSA data access portal." }, { "id": "src-ec-ai-omnibus-in-force", "tier": "tier:2", "type": "source-type:press-release", "publisher": "ec", "publisher_name": "European Commission", "title": "AI Omnibus enters into force", "url": "https://digital-strategy.ec.europa.eu/en/news/ai-omnibus-enters-force", "url_status": "url:live", "published": "2026-07-27", "accessed": "2026-08-27", "language": "en", "note": "Gives the new dates — Annex III high-risk from 2 December 2027, product-embedded high-risk from 2 August 2028 — but does not characterise the shift as 'sixteen months'. That figure is a computation, not a quoted claim." }, { "id": "src-ec-dma-review-2026", "tier": "tier:2", "type": "source-type:report", "publisher": "ec", "publisher_name": "European Commission", "title": "DMA Review Report, COM(2026) 178 final", "url": "https://digital-markets-act.ec.europa.eu/system/files/2026-04/DMA%20Review%20Report_COM_2026_178_1_EN.pdf", "url_status": "url:live", "published": "2026-04-28", "accessed": "2026-08-27", "language": "en", "note": "Supports the Article 53 basis and the enforce-rather-than-expand conclusion. Does not state the 3 May 2026 deadline or the 450-contribution figure." }, { "id": "src-ec-dma-review-qa", "tier": "tier:2", "type": "source-type:guidance", "publisher": "ec", "publisher_name": "European Commission", "title": "DMA review — questions and answers", "url": "https://digital-markets-act.ec.europa.eu/about-dma/dma-review-qa_en", "url_status": "url:live", "published": "2026", "accessed": "2026-08-27", "language": "en", "note": "States that the first review was legally required by 3 May 2026." }, { "id": "src-ec-dma-consultation-2026", "tier": "tier:2", "type": "source-type:press-release", "publisher": "ec", "publisher_name": "European Commission", "title": "Commission publishes summary and responses to the consultation on the ongoing review of the Digital Markets Act", "url": "https://digital-markets-act.ec.europa.eu/commission-publishes-summary-and-responses-consultation-ongoing-review-digital-markets-act-2026-01-08_en", "url_status": "url:live", "published": "2026-01-08", "accessed": "2026-08-27", "language": "en", "note": "Supports 'over 450 contributions'." }, { "id": "src-ec-tech-sovereignty-2026", "tier": "tier:2", "type": "source-type:press-release", "publisher": "ec", "publisher_name": "European Commission", "title": "Strengthening Europe's tech sovereignty", "url": "https://commission.europa.eu/news-and-media/news/strengthening-europes-tech-sovereignty-2026-06-03_en", "url_status": "url:live", "published": "2026-06-03", "accessed": "2026-08-27", "language": "en", "note": "Confirms the package date and the inclusion of the Cloud and AI Development Act. Silent on legal basis." }, { "id": "src-council-cloud-ai-act-2026", "tier": "tier:2", "type": "source-type:legislative-document", "publisher": "council", "publisher_name": "Council of the European Union", "title": "ST 10104/2026 — transmission of COM(2026) 502 final, Cloud and AI Development Act", "url": "https://data.consilium.europa.eu/doc/document/ST-10104-2026-INIT/en/pdf", "url_status": "url:live", "published": "2026-06-04", "accessed": "2026-08-27", "language": "en", "note": "Directly supports the dual legal basis of Article 114 TFEU and Article 173(3) TFEU applied cumulatively." }, { "id": "src-ec-draghi-report", "tier": "tier:2", "type": "source-type:report", "publisher": "ec", "publisher_name": "European Commission", "title": "The Future of European Competitiveness (Draghi report)", "url": "https://commission.europa.eu/topics/competitiveness/draghi-report_en", "url_status": "url:live", "published": "2024-09-09", "accessed": "2026-09-26", "language": "en", "note": "The Commission's Draghi report page. Merged on 2026-09-26 (audit T-30) with the former src-draghi-report-2024, which described the same report through a newsroom URL (ec.europa.eu/newsroom/growth/items/847989). Part A (A competitiveness strategy for Europe) and Part B (In-depth analysis and recommendations). Both PDFs were downloaded from the Commission's Draghi report page (commission.europa.eu/document/download/97e481fd-2dc3-412d-be4c-f152a8232961_en and ec1409c1-d4b4-4882-8bdd-3519f86bbb92_en) and read on 2026-09-26. Part A, printed p. 24, Chapter 2: around 70% of foundational AI models developed in the US since 2017; three US hyperscalers over 65% of the global and European cloud market; the largest European cloud operator just 2% of the EU market; autonomous robotics around 22% of worldwide activity; AI services around 17%. Part B, printed p. 77: EU cloud providers' share of the EU market decreased to under 16% in 2021. Part B, p. 79, gives 73% (not 'around 70%') for foundational models from the US since 2017. No 'under 15%' figure appears in either part." }, { "id": "src-ep-oeil-ai-omnibus", "tier": "tier:2", "type": "source-type:legislative-document", "publisher": "ep", "publisher_name": "European Parliament — Legislative Observatory", "title": "Procedure file 2025/0359(COD): Simplification of the implementation of harmonised rules on artificial intelligence – Digital Omnibus on AI", "url": "https://oeil.secure.europarl.europa.eu/oeil/en/procedure-file?reference=2025/0359(COD)", "url_status": "url:live", "published": null, "accessed": "2026-09-27", "language": "en", "note": "Parliament's procedure file, read on 27 Sep 2026 with its summary of the 26 March 2026 decision (document-summary id 1895845). Key events from the proposal (19/11/2025) to publication in the Official Journal (24/07/2026). The summary: 'The European Parliament adopted by 569 votes to 45 against and 23 abstentions, amendments to the proposal ... The issue was sent back to the committee responsible for interinstitutional negotiations.'" }, { "id": "src-ep-legtrain-ai-omnibus", "tier": "tier:2", "type": "source-type:legislative-document", "publisher": "ep", "publisher_name": "European Parliament", "title": "Legislative Train — Digital Omnibus on AI", "url": "https://www.europarl.europa.eu/legislative-train/package-digital-package/file-digital-omnibus-on-ai", "url_status": "url:live", "published": "2026", "accessed": "2026-09-27", "language": "en", "note": "Supports the 19 November 2025 publication date and COM(2025) 836. Re-read on 27 Sep 2026 (information updated as of 01/08/2026): Council general approach 13 March 2026; trilogue agreement 7 May 2026; Coreper approval 13 May 2026; plenary approval 16 June 2026 (423 in favour, 57 against, 174 abstentions); Council adoption 29 June 2026; final act signed 8 July 2026." }, { "id": "src-ep-legtrain-digital-package", "tier": "tier:2", "type": "source-type:legislative-document", "publisher": "ep", "publisher_name": "European Parliament", "title": "Legislative Train — Digital Package", "url": "https://www.europarl.europa.eu/legislative-train/theme-a-new-plan-for-europe-s-sustainable-prosperity-and-competitiveness/file-digital-package", "url_status": "url:live", "published": "2026", "accessed": "2026-08-27", "language": "en", "note": "Supports the 19 November 2025 publication date and COM(2025) 837 final." }, { "id": "src-edpb-jo-1-2026", "tier": "tier:2", "type": "source-type:opinion", "publisher": "edpb", "publisher_name": "European Data Protection Board and European Data Protection Supervisor", "title": "EDPB–EDPS Joint Opinion 1/2026 on the AI Omnibus proposal", "url": "https://www.edpb.europa.eu/documents/legislative-opinion/edpb-edps-joint-opinion-12026-on-the-proposal-for-a-regulation-as_en", "url_status": "url:live", "published": "2026-01-20", "accessed": "2026-08-27", "language": "en", "note": null }, { "id": "src-edpb-jo-2-2026", "tier": "tier:2", "type": "source-type:opinion", "publisher": "edpb", "publisher_name": "European Data Protection Board and European Data Protection Supervisor", "title": "EDPB–EDPS Joint Opinion 2/2026 on the Digital Omnibus proposal", "url": "https://www.edpb.europa.eu/documents/legislative-opinion/edpb-edps-joint-opinion-22026-on-the-proposal-for-a-regulation-as_en", "url_status": "url:live", "published": "2026-02", "accessed": "2026-08-27", "language": "en", "note": null }, { "id": "src-dpc-fines-page", "tier": "tier:2", "type": "source-type:regulator-statement", "publisher": "dpa-ie", "publisher_name": "Data Protection Commission (Ireland)", "title": "Fines", "url": "https://www.dataprotection.ie/en/dpc-guidance/decisions/fines", "url_status": "url:live", "published": null, "accessed": "2026-08-27", "language": "en", "note": "The DPC's own published position on imposed and collected fines. Re-read 27 Sep 2026: \"Total Fines (last updated 10/08/2026) €4,038,832,000\"; \"approximately €20 million in fines has been collected\"; and, under Collection of Fines, fines \"do not become payable until they are confirmed in Court\"." }, { "id": "src-thestory-2026-fines-limbo", "tier": "tier:4", "type": "source-type:journalism", "publisher": null, "publisher_name": "TheStory.ie", "title": "Billions in data protection fines imposed, just EUR 20 million collected", "url": "https://www.thestory.ie/2026/01/13/billions-in-data-protection-fines-imposed-just-e20-million-collected-dpc-says-vast-majority-of-penalties-remain-stuck-in-legal-limbo/", "url_status": "url:live", "published": "2026-01-13", "accessed": "2026-08-27", "language": "en", "note": null }, { "id": "src-rte-2026-dpc-4bn", "tier": "tier:4", "type": "source-type:journalism", "publisher": null, "publisher_name": "RTÉ", "title": "Data Protection Commission owed over EUR 4 billion in fines", "url": "https://www.rte.ie/news/business/2026/0112/1552670-data-protection-commission-fines/", "url_status": "url:live", "published": "2026-01-12", "accessed": "2026-08-27", "language": "en", "note": null }, { "id": "src-dpc-annual-report-2025", "tier": "tier:2", "type": "source-type:report", "publisher": "dpa-ie", "publisher_name": "Data Protection Commission (Ireland)", "title": "Data Protection Commission publishes Annual Report for 2025 and results of 'Sharenting' survey", "url": "https://www.dataprotection.ie/en/data-protection-commission-publishes-2025-annual-report", "url_status": "url:live", "published": "2026-06-30", "accessed": "2026-09-26", "language": "en", "note": "The DPC's own summary of its Annual Report 2025 (full PDF linked from this page, not itself retrieved). Confirms the three-Commissioner structure (Des Hogan, Dale Sunderland, Niamh Sweeney) and administrative fines totalling roughly EUR 530.77m for 2025 alone. Does not itself state a staff headcount; see src-iapp-sweeney-2026 for that." }, { "id": "src-iapp-sweeney-2026", "tier": "tier:4", "type": "source-type:journalism", "publisher": null, "publisher_name": "IAPP", "title": "New Irish Data Protection Commissioner Niamh Sweeney addresses scrutiny over her appointment, shares agency priorities", "url": "https://iapp.org/news/a/new-irish-data-protection-commissioner-niamh-sweeney-addresses-scrutiny-over-her-appointment-shares-agency-priorities", "url_status": "url:live", "published": "2026-04-01", "accessed": "2026-09-26", "language": "en", "note": "Quotes Commissioner Niamh Sweeney directly: 'With nearly 300 staff, up from 27 in 2014... growth has plateaued.' A direct quotation from a sitting Commissioner, reported by a specialist trade publication, not the DPC's own published figure." }, { "id": "src-eucrim-gdpr-procedural-2026", "tier": "tier:3", "type": "source-type:commentary", "publisher": null, "publisher_name": "eucrim (Max Planck Institute for the Study of Crime, Security and Law)", "title": "New Regulation Speeds Up Handling of Cross-Border GDPR Complaints", "url": "https://eucrim.eu/news/new-regulation-speeds-up-handling-of-cross-border-gdpr-complaints/", "url_status": "url:live", "published": "2026-01-16", "accessed": "2026-09-26", "language": "en", "note": "States that Regulation (EU) 2025/2518 was adopted 26 November 2025, published in Official Journal L 2025/2518 of 12 December 2025, entered into force 1 January 2026 and applies from 2 April 2027; regular investigations are expected to conclude within 15 months (12 for simplified procedures). EUR-Lex itself could not be retrieved in this environment (returns HTTP 202 with no body on every attempt); this specialist academic-institute newsletter is cited instead, pending direct confirmation of the consolidated text." }, { "id": "src-mlex-2026-amazon-annulment", "tier": "tier:4", "type": "source-type:journalism", "publisher": null, "publisher_name": "MLex", "title": "Amazon sees Luxembourg appeals court annul EUR 746 million GDPR fine", "url": "https://www.mlex.com/mlex/articles/2452693/amazon-sees-luxembourg-appeals-court-annul-746-million-gdpr-fine", "url_status": "url:paywalled", "published": "2026-03", "accessed": "2026-08-27", "language": "en", "note": null }, { "id": "src-lu-cadm-52757c-judgment", "tier": "tier:1", "type": "source-type:judgment", "publisher": null, "publisher_name": "Cour administrative du Grand-Duché de Luxembourg", "title": "Cour administrative, arrêt du 12 mars 2026, n° 52757C du rôle, ECLI:LU:CADM:2026:52757", "url": "https://ja.public.lu/50001-55000/52757C.pdf", "url_status": "url:live", "published": "2026-03-12", "accessed": "2026-09-27", "language": "fr", "note": "The judgment's full text (89 pages), read 27 Sep 2026. Appeal of 25 April 2025 against the tribunal administratif's judgment of 18 March 2025 (no. 46578), which had upheld the CNPD's decision of 15 July 2021 (fine of EUR 746,000,000; corrective measures within six months under a daily penalty of EUR 746,000). Operative part: the CNPD's declaration that the injunctions have become moot is recorded; the requested preliminary references are refused; the CNPD decision is annulled 'en tous ses volets' and the file remitted to the CNPD; costs shared. Grounds: no examination of fault (C-807/21, C-683/21) and no real proportionality analysis of choosing a fine. Pseudonymised: the appellant appears as '(AA)'." }, { "id": "src-justice-lu-amazon-2026", "tier": "tier:2", "type": "source-type:court-press-release", "publisher": null, "publisher_name": "Justice Luxembourg (justice.public.lu)", "title": "Arrêt de la Cour administrative en relation avec un des grands acteurs mondiaux au niveau du commerce en ligne", "url": "https://justice.public.lu/fr/actualites/2026/03/arret-cour-administrative-amazon.html", "url_status": "url:live", "published": "2026-03-13", "accessed": "2026-09-26", "language": "fr", "note": "The Luxembourg judiciary's own announcement, read 2026-09-26. Judgment of the Cour administrative of 12 March 2026, no. 52757C du rôle, on appeal from the tribunal administratif judgment of 18 March 2025 (no. 46578). At the hearing of 8 January 2026 counsel for both parties, including the CNPD's, confirmed the company was now compliant on the disputed points, so the coercive measures and daily penalty became moot. Violations broadly upheld (some elements set aside as unverified; Art. 21 grievances out of scope). Remitted to the CNPD because it had not analysed fault (intent or negligence), required since CJEU C-807/21 Deutsche Wohnen and C-683/21 Nacionalinis (5 December 2023), and had imposed a fine almost automatically without weighing the other available measures. The judgment itself was not opened." }, { "id": "src-doj-x-intervention-2026", "tier": "tier:2", "type": "source-type:press-release", "publisher": null, "publisher_name": "United States Department of Justice, Office of Public Affairs", "title": "United States Files Request to Intervene in Case Brought by X Corp. and Elon Musk Seeking to Annul Decision by European Commission", "url": "https://www.justice.gov/opa/pr/united-states-files-request-intervene-case-brought-x-corp-and-elon-musk-seeking-annul", "url_status": "url:live", "published": "2026-09-24", "accessed": "2026-09-26", "language": "en", "note": "Read 2026-09-26. The US filed an application to intervene in X Internet and X Holdings v Commission, Case T-114/26, and Musk v Commission, Case T-121/26, before the General Court, supporting annulment of the Commission's decision of 5 December 2025 (EUR 120 million, jointly and severally). A party's own announcement: it establishes the application and the case numbers, not its admission or merits." }, { "id": "src-euperspectives-x-appeal-2026", "tier": "tier:4", "type": "source-type:journalism", "publisher": null, "publisher_name": "EU Perspectives", "title": "Social platform X challenges €120m EU fine in first major court test of DSA enforcement", "url": "https://euperspectives.eu/2026/02/social-platform-x-challenges-e120m-eu-fine-in-first-major-court-test-of-dsa-enforcement/", "url_status": "url:live", "published": "2026-02-20", "accessed": "2026-09-26", "language": "en", "note": "Read 2026-09-26. Reports X's action before the General Court against the 5 December 2025 decision, and quotes X's announcement of 20 February 2026 alleging procedural errors and breaches of the rights of defence. Gives no case number." }, { "id": "src-dpc-meta-transfers-2023", "tier": "tier:2", "type": "source-type:press-release", "publisher": "dpa-ie", "publisher_name": "Data Protection Commission (Ireland)", "title": "Data Protection Commission announces conclusion of inquiry into Meta Ireland", "url": "https://www.dataprotection.ie/en/news-media/press-releases/Data-Protection-Commission-announces-conclusion-of-inquiry-into-Meta-Ireland", "url_status": "url:live", "published": "2023-05-22", "accessed": "2026-09-26", "language": "en", "note": "Read 2026-09-26. Final decision adopted 12 May 2023: Meta Ireland infringed Art. 46(1) GDPR by continuing EU-US transfers for Facebook after Schrems II; orders to suspend transfers within five months and to bring processing into conformity; administrative fine of EUR 1.2 billion, reflecting the EDPB's binding determination under Art. 65." }, { "id": "src-dpc-tiktok-transfers-2025", "tier": "tier:2", "type": "source-type:press-release", "publisher": "dpa-ie", "publisher_name": "Data Protection Commission (Ireland)", "title": "Irish Data Protection Commission fines TikTok €530 million and orders corrective measures following Inquiry into transfers of EEA User Data to China", "url": "https://www.dataprotection.ie/en/news-media/latest-news/irish-data-protection-commission-fines-tiktok-eu530-million-and-orders-corrective-measures-following", "url_status": "url:live", "published": "2025-05-02", "accessed": "2026-09-26", "language": "en", "note": "Read 2026-09-26. Final decision: TikTok infringed Art. 46(1) GDPR in its transfers of EEA user data to China and Art. 13(1)(f) transparency requirements; administrative fines totalling EUR 530 million; order to bring processing into compliance within six months, with suspension of transfers to China if it does not." }, { "id": "src-paperjam-amazon-2026", "tier": "tier:4", "type": "source-type:journalism", "publisher": null, "publisher_name": "Paperjam", "title": "€746m fine: CNPD decision against Amazon overturned", "url": "https://en.paperjam.lu/article/eu746m-fine-cnpd-decision-against-amazon-overturned", "url_status": "url:live", "published": "2026-03-13", "accessed": "2026-09-26", "language": "en", "note": "Read 2026-09-26. Ruling delivered Thursday 12 March 2026; annulled the CNPD restricted panel's decision of 15 July 2021; substance of the breaches upheld; case referred back to the CNPD; at the 8 January 2026 hearing the parties confirmed Amazon now relies on consent rather than legitimate interest, which the CNPD considers compliant." }, { "id": "src-cms-lu-enforcement-2026", "tier": "tier:4", "type": "source-type:commentary", "publisher": null, "publisher_name": "CMS", "title": "GDPR Enforcement Tracker Report — Luxembourg", "url": "https://cms.law/en/int/publication/gdpr-enforcement-tracker-report/luxembourg", "url_status": "url:live", "published": "2026-05-21", "accessed": "2026-09-26", "language": "en", "note": "Law-firm report, read 2026-09-26. Dates the annulment to 13 March 2026 (the publication date; the judgment is of 12 March) and lists the two grounds: no analysis of intent or negligence (Deutsche Wohnen, Nacionalinis) and no examination of other sanction options." }, { "id": "src-csoonline-alliance-risk-2026", "tier": "tier:4", "type": "source-type:journalism", "publisher": null, "publisher_name": "CSO Online", "title": "GDPR set the tone for regulatory action — and the AI fine pushback to come", "url": "https://www.csoonline.com/article/4178001/gdpr-set-the-tone-for-regulatory-action-and-the-ai-fine-pushback-to-come.html", "url_status": "url:live", "published": "2026-05-29", "accessed": "2026-09-26", "language": "en", "note": "Read on 2026-09-26. Reports an analysis by 'insurance brokerage Alliance Risk': an estimated EUR 7.1 billion of GDPR fines announced over eight years, of which nearly 40%, around EUR 2.8 billion, is already annulled or under active legal challenge; Alliance Risk used the CMS Law GDPR Enforcement Tracker as its primary source, cross-referenced against IAPP, Kiteworks and UniConsent data. Alliance Risk's own publication could not be located; PPC Land describes the firm as a 'cyber risk advisory firm' rather than a brokerage." }, { "id": "src-ppcland-alliance-risk-2026", "tier": "tier:4", "type": "source-type:journalism", "publisher": null, "publisher_name": "PPC Land", "title": "Eight years of GDPR: 40% of the €7.1B in fines annulled or under challenge", "url": "https://ppc.land/eight-years-of-gdpr-40-of-the-eur7-1b-in-fines-annulled-or-under-challenge/", "url_status": "url:live", "published": "2026-05-30", "accessed": "2026-10-21", "language": "en", "note": "Read 21 Oct 2026. By Luís Rijo. Attributes the EUR 7.1 billion, ~40% and EUR 2.8 billion figures to 'analysis published this week by Alliance Risk, a cyber risk advisory firm', 'drawn primarily from the CMS Law GDPR Enforcement Tracker'. Its link to Alliance Risk's publication goes to an interactive map (gdpr-interactive-map-2018-2026.netlify.app), which was read the same day: it reports EUR 6.07 billion across 2,879 enforcement actions to May 2026, names no author and contains none of the three figures. A second press report of the same analysis, not the analysis; CSO Online calls the firm an insurance brokerage, PPC Land a cyber risk advisory firm." }, { "id": "src-edpb-cef-2026", "tier": "tier:2", "type": "source-type:press-release", "publisher": "edpb", "publisher_name": "European Data Protection Board", "title": "CEF 2026: EDPB launches coordinated enforcement action on transparency and information obligations under the GDPR", "url": "https://www.edpb.europa.eu/news/news/2026/cef-2026-edpb-launches-coordinated-enforcement-action-transparency-and-information_en", "url_status": "url:live", "published": "2026-03-19", "accessed": "2026-09-26", "language": "en", "note": "Read 2026-09-26. The 2026 Coordinated Enforcement Framework action concerns transparency and information obligations (GDPR Arts. 12, 13 and 14); '25 Data Protection Authorities (DPAs) across Europe will take part'; a consolidated report is to follow." }, { "id": "src-edri-poland-dsa-veto-2026", "tier": "tier:4", "type": "source-type:commentary", "publisher": null, "publisher_name": "European Digital Rights (EDRi)", "title": "President's veto further delays the implementation of the DSA in Poland", "url": "https://edri.org/our-work/presidents-veto-further-delays-the-implementation-of-the-dsa-in-poland/", "url_status": "url:live", "published": "2026-01-21", "accessed": "2026-09-26", "language": "en", "note": "Advocacy network's account, read 2026-09-26: the Polish President vetoed the draft law adapting Polish law to the DSA in January 2026 (press reports date it 9 January). The President's own announcement on prezydent.pl could not be read: the site served a Cloudflare challenge to every client in this environment." }, { "id": "src-300polityka-pl-dsa-2026", "tier": "tier:4", "type": "source-type:journalism", "publisher": null, "publisher_name": "300polityka", "title": "Prezydent podpisał 5 ustaw, w tym pierwszą wdrażającą DSA", "url": "https://300polityka.pl/pl/live/2026-09-25/prezydent-podpisal-5-ustaw-w-tym-pierwsza-wdrazajaca-dsa", "url_status": "url:live", "published": "2026-09-25", "accessed": "2026-09-26", "language": "pl", "note": "Read 2026-09-26. On 25 September 2026 the President signed, among five laws, the amendment to the act on providing services by electronic means — one of two DSA-implementing bills sent to the Sejm after the January veto — establishing the Digital Services Coordinator (the President of UKE) and a National Council for Digital Services. Parliament was still working on the second bill, on blocking illegal content, the issue behind the veto. Quotes the presidential spokesman's announcement." }, { "id": "src-interia-pl-dsa-2026", "tier": "tier:4", "type": "source-type:journalism", "publisher": null, "publisher_name": "Interia Biznes", "title": "Nawrocki podpisał ustawę. Polska będzie mogła karać platformy internetowe", "url": "https://biznes.interia.pl/gospodarka/news-nawrocki-podpisal-ustawe-polska-bedzie-mogla-karac-platformy,nId,23549252", "url_status": "url:live", "published": "2026-09", "accessed": "2026-09-26", "language": "pl", "note": "Read 2026-09-26. The President signed the amendment allowing the President of UKE to be appointed Digital Services Coordinator, so that Poland can handle citizens' complaints and bring proceedings against platforms infringing the DSA." }, { "id": "src-cispe-ceo-letter-2026", "tier": "tier:4", "type": "source-type:commentary", "publisher": null, "publisher_name": "CISPE (Cloud Infrastructure Services Providers in Europe)", "title": "Joint letter of European cloud CEOs to EVP Virkkunen on the Cloud and AI Development Act, 17 March 2026", "url": "https://www.cispe.cloud/website_cispe/wp-content/uploads/2026/03/Cloud-CEOs-Joint-Letter-March-17-2026-FINAL.pdf", "url_status": "url:live", "published": "2026-03-17", "accessed": "2026-09-26", "language": "en", "note": "Industry letter, read 2026-09-26. Principle 1: 'Sovereignty must be defined by control, not by EU presence or cybersecurity', reflecting effective control, ownership of technology and protection from extraterritorial jurisdiction; warns against 'sovereignty washing'. 25 signatories: 24 company heads (CEOs, one co-CEO, one managing director, one without a title) and CISPE's chairwoman. CISPE's own press release says both '24 European digital CEOs' and 'CEOs representing 25' providers." }, { "id": "src-linarilaw-2026-amazon", "tier": "tier:4", "type": "source-type:commentary", "publisher": null, "publisher_name": "Linari Law Firm", "title": "Luxembourg court of appeal cancels EUR 746 million CNPD fine against Amazon", "url": "https://www.linari-law.lu/luxembourg-court-of-appeal-cancels-eur-746-million-cnpd-fine-against-amazon/", "url_status": "url:live", "published": "2026-03", "accessed": "2026-08-27", "language": "en", "note": "No primary source for the Luxembourg Court of Appeal judgment has been located; the judgment itself is flagged for retrieval." }, { "id": "src-garante-openai-2024", "tier": "tier:2", "type": "source-type:press-release", "publisher": "dpa-it", "publisher_name": "Garante per la protezione dei dati personali", "title": "ChatGPT, il Garante privacy chiude l’istruttoria. OpenAI dovrà realizzare una campagna informativa di sei mesi e pagare una sanzione di 15 milioni di euro", "url": "https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10085432", "url_status": "url:live", "published": "2024-12-20", "accessed": "2026-09-27", "language": "it", "note": "The Garante's press release (doc-web 10085432, 'Roma, 20 dicembre 2024'), read 27 Sep 2026, with its English version on the same page. It now carries the Garante's notice that decision no. 755 of 2 November 2024 (doc-web 10085455) has been temporarily removed from its website following the Court of Rome's judgment no. 4153/2026, published 18 March 2026, which upheld the opposition to it. The release: EUR 15 million fine; six-month information campaign under Art. 166(7) of the Privacy Code; investigation opened March 2023; file transmitted to the Irish DPC as lead authority." }, { "id": "src-europeanlawblog-openai-rome", "tier": "tier:3", "type": "source-type:research", "publisher": null, "publisher_name": "European Law Blog", "title": "Establish, Then Escape? How the Court of Rome, the One-Stop-Shop and a Single Word Opened an AI Enforcement Gap", "url": "https://europeanlawblog.eu/establish-then-escape-how-the-court-of-rome-the-one-stop-shop-and-a-single-word-opened-an-ai-enforcement-gap/", "url_status": "url:live", "published": "2026-06-04", "accessed": "2026-09-27", "language": "en", "note": "Academic analysis of the Rome tribunal ruling voiding the Garante's OpenAI fine. The judgment itself is flagged for retrieval. On 27 Sep 2026 the recorded URL (europeanlawblog.eu/pub/92oig1ws) returned HTTP 404; the post was found by the blog's own search at the URL now recorded, dated 4 June 2026, and re-read. Its note [i] identifies the judgment: Tribunale Ordinario di Roma, R.G. 4785/2025, decided 18 March 2026, full grounds public on 28 May 2026." }, { "id": "src-privacynext-2026-omnibus", "tier": "tier:4", "type": "source-type:journalism", "publisher": null, "publisher_name": "Privacy Next", "title": "Digital Omnibus negotiations — GDPR July 2026 update", "url": "https://www.privacynext.eu/resources/digital-omnibus-negotiations-gdpr-july-2026-update/", "url_status": "url:live", "published": "2026-07-08", "accessed": "2026-08-27", "language": "en", "note": "The only located source stating that the Cyprus Presidency withdrew its compromise text from COREPER II for lack of a qualified majority. No official Council source has been found. This claim rests on commentary alone." }, { "id": "src-icle-omnibus-2026-06", "tier": "tier:4", "type": "source-type:commentary", "publisher": null, "publisher_name": "International Center for Law & Economics", "title": "EU Digital Omnibus Hands the Wheel to the Referee", "url": "https://laweconcenter.org/resources/eu-digital-omnibus-hands-the-wheel-to-the-referee/", "url_status": "url:live", "published": "2026-06-11", "accessed": "2026-09-26", "language": "en", "note": "States that the Cypriot Presidency's most recent compromise text, Council document 9547/26 of 21 May 2026, deletes three of the Commission's four principal GDPR reforms (the entity-relative personal-data test, the relocation of cookie consent into the GDPR, and the legitimate-interest basis for AI processing) and removes the Commission's proposed pseudonymisation-criteria power. A think-tank commentary, not an official Council document." }, { "id": "src-ppcland-omnibus-2026-09", "tier": "tier:4", "type": "source-type:journalism", "publisher": null, "publisher_name": "PPC Land", "title": "EU Council draft drops unconditional opt-out from GDPR AI clause", "url": "https://ppc.land/eu-council-draft-drops-unconditional-opt-out-from-gdpr-ai-clause/", "url_status": "url:live", "published": "2026-09-26", "accessed": "2026-09-26", "language": "en", "note": "Reports on and quotes the Irish Presidency's compromise text ST 12535/26 (dated 3 September 2026, classified LIMITE), circulated ahead of an Antici Group meeting of 11 September 2026, based on restricted Council documents published by noyb. Article 88c becomes 'Article 88 bis' (legitimate-interest basis for AI, with the Commission's safeguards — including the unconditional right to object — struck out); the personal-data definition change is replaced by a new Article 25a on pseudonymised data, modelled on the CJEU's EDPS v SRB judgment; cookie consent is returned to the ePrivacy Directive. A specialist news outlet quoting a leaked restricted document, not an official Council publication." }, { "id": "src-bruegel-2026-enforcement-authority", "tier": "tier:4", "type": "source-type:commentary", "publisher": null, "publisher_name": "Bruegel", "title": "The case for a European Union digital enforcement authority", "url": "https://www.bruegel.org/policy-brief/case-european-union-digital-enforcement-authority", "url_status": "url:live", "published": "2026-03-05", "accessed": "2026-08-27", "language": "en", "note": "Think-tank policy brief by Mario Mariniello. Primary for its own argument; not primary for the underlying facts." }, { "id": "src-ecnl-hungary-ai-act", "tier": "tier:4", "type": "source-type:commentary", "publisher": null, "publisher_name": "European Center for Not-for-Profit Law", "title": "Civil society urges the European Commission to uphold the AI Act in Hungary", "url": "https://ecnl.org/news/civil-society-urges-european-commission-uphold-ai-act-hungary", "url_status": "url:live", "published": "2025", "accessed": "2026-08-27", "language": "en", "note": null }, { "id": "src-ec-infringement-package-2026-10", "tier": "tier:2", "type": "source-type:press-release", "publisher": "ec", "publisher_name": "European Commission", "title": "INF/26/1760 — October infringements package: key decisions", "url": "https://ec.europa.eu/commission/presscorner/detail/en/inf_26_1760", "url_status": "url:live", "published": "2026-10-01", "accessed": "2026-10-21", "language": "en", "note": "Read in full 21 Oct 2026 through the Commission's press corner, with the thirteen earlier packages since the Hungarian amendments of March 2025: INF/25/503 (12 Mar 2025), INF/25/982 (7 May 2025), INF/25/1241 (18 Jun 2025), INF/25/1628 (17 Jul 2025), INF/25/2077 (8 Oct 2025), INF/25/2481 (21 Nov 2025), INF/25/2745 (11 Dec 2025), INF/26/115 (30 Jan 2026), INF/26/431 (11 Mar 2026), INF/26/720 (29 Apr 2026), INF/26/1084 (4 Jun 2026), INF/26/1376 (8 Jul 2026), INF/26/1380 (15 Jul 2026, transposition) and INF/26/1760 (1 Oct 2026). None of the fourteen mentions the AI Act, artificial intelligence, biometric identification or facial recognition. A package lists the Commission's KEY decisions of the cycle, not every one, so an absence here is partial evidence of an absence in the register; the register itself (ec.europa.eu/implementing-eu-law) answered HTTP 404 to its search page from this environment on 21 Oct 2026." }, { "id": "src-euronews-magyar-2026", "tier": "tier:4", "type": "source-type:journalism", "publisher": null, "publisher_name": "Euronews", "title": "Péter Magyar sworn in as Hungary's new prime minister after landslide April election victory", "url": "https://www.euronews.com/my-europe/2026/05/09/peter-magyar-sworn-in-as-hungarys-new-prime-minister-after-landslide-april-election-victor", "url_status": "url:live", "published": "2026-05-09", "accessed": "2026-09-26", "language": "en", "note": "Péter Magyar's Tisza party won the April 2026 parliamentary election, ending Viktor Orbán's government; Magyar took office on 9 May 2026 (formally sworn in on 12 May)." }, { "id": "src-euobserver-pride-2026", "tier": "tier:4", "type": "source-type:journalism", "publisher": null, "publisher_name": "EUobserver", "title": "Budapest free to celebrate Pride again, but Orbán-surveillance machine still in place", "url": "https://euobserver.com/224022/budapest-free-to-celebrate-pride-again-but-orban-surveillance-machine-still-in-place/", "url_status": "url:live", "published": "2026-06-25", "accessed": "2026-09-26", "language": "en", "note": "Opinion piece by Eva Simon, Aljosa Ajanovic Andelic and Karolina Iwanska. States that the police officially acknowledged the Budapest Pride march scheduled for 27 June 2026, a reversal from the previous government, but that 'the laws that criminalise Pride participation and enable biometric surveillance of protesters remain in force' — i.e. the March 2025 amendments were not repealed." }, { "id": "src-edri-hungary-ai-act", "tier": "tier:4", "type": "source-type:commentary", "publisher": null, "publisher_name": "European Digital Rights (EDRi)", "title": "Hungary's new biometric surveillance laws violate the AI Act", "url": "https://edri.org/our-work/hungarys-new-biometric-surveillance-laws-violate-the-ai-act/", "url_status": "url:live", "published": "2025-05-06", "accessed": "2026-09-26", "language": "en", "note": "Joint legal analysis with ECNL, Liberties and the Hungarian Civil Liberties Union. States its own classification directly: real-time remote biometric identification is prohibited under AI Act Art. 5(1)(h), while retrospective ('post') facial recognition is classified as high-risk rather than prohibited; the analysis argues the Hungarian system's near-immediate processing of newly generated footage places it on the real-time side of that line, which is the contested step." }, { "id": "src-cms-enforcement-tracker", "tier": "tier:4", "type": "source-type:report", "publisher": null, "publisher_name": "CMS", "title": "GDPR Enforcement Tracker Report 2025/2026 (7th edition)", "url": "https://cms.law/en/int/publication/GDPR-Enforcement-Tracker-Report/executive-summary", "url_status": "url:live", "published": "2026-03-01", "accessed": "2026-08-28", "language": "en", "note": "Located 28 Aug 2026. Records 2,685 fines as at March 2026 and Spain as the most active authority by count (1,048 published fines). CORRECTION SURFACED: the EUR 7.1bn cumulative total and the EUR 4.04bn Irish figure are DLA Piper's, not CMS's — CMS records roughly EUR 6.11bn in directly documented fines. The divergence is exactly what Annex B warns about, and the brief was citing the wrong tracker for those two numbers.", "resolution_note": "Identified and linked: this is the specific publication the brief draws on (see url and note). It is cited as tier-4 commentary: it can support what its authors argue or report, not a legal fact on its own. Rewritten on 2026-09-26 \u2014 the earlier text said no specific publication had been named, which stopped being true when the URL was located." }, { "id": "src-cms-tracker-insights-2026-09-27", "tier": "tier:4", "type": "source-type:report", "publisher": null, "publisher_name": "CMS", "title": "GDPR Enforcement Tracker — Insights (data refreshed 27 September 2026)", "url": "https://www.enforcementtracker.com/insights", "url_status": "url:live", "published": "2026-09-27", "accessed": "2026-09-27", "language": "en", "note": "The live Insights page of CMS's GDPR Enforcement Tracker, read 27 Sep 2026 ('data shown was last refreshed 2026-09-27 13:01 UTC'). Headline: total cases 3,275 across 32 countries; total fines EUR 7,159,322,834; largest single fine EUR 1,200m (Meta Platforms Ireland). Its 'Top violation types' chart, by penalty total, carries these sums in the page's own embedded data: insufficient legal basis EUR 3,124,976,242 (992 cases); non-compliance with general data processing principles EUR 2,649,889,997 (814); insufficient technical and organisational measures to ensure information security EUR 971,797,663 (616); insufficient fulfilment of information obligations EUR 257,948,460 (216); the remaining six categories together about EUR 154m. A live dataset: every figure is its state on the read date. It is a different document from the 7th edition report (src-cms-enforcement-tracker), whose March 2026 total was lower." }, { "id": "src-legiscope-nis2-tracker-2026", "tier": "tier:4", "type": "source-type:commentary", "publisher": null, "publisher_name": "Legiscope", "title": "NIS2 Enforcement Tracker 2026: Fines, Audits, Status", "url": "https://www.legiscope.com/blog/nis2-enforcement-tracker-2026.html", "url_status": "url:live", "published": "2026-07-10", "accessed": "2026-09-26", "language": "en", "note": "A GDPR/NIS2 compliance vendor's blog. States its own figures for 'first fines' in Belgium (€185K), Italy (€450K), Hungary (€78K) and Lithuania (€52K), but its own 'On the figures' section says NIS2 enforcement data is fragmented across national authorities, that most do not publish a centralised fine register, and that its amounts 'aggregate reported and estimated figures... they should be treated as directional, not as an authoritative legal record.' No official decision, case number or authority-published figure was located from this source or any other." }, { "id": "src-acn-nis-obblighi-2026", "tier": "tier:2", "type": "source-type:guidance", "publisher": null, "publisher_name": "Agenzia per la Cybersicurezza Nazionale (ACN), Italy — NIS portal", "title": "NIS — Obblighi; La normativa; Registrazione (ACN, the Italian national competent authority for NIS)", "url": "https://www.acn.gov.it/portale/nis/obblighi", "url_status": "url:live", "published": null, "accessed": "2026-10-22", "language": "it", "note": "Read 22 Oct 2026 on ACN's own NIS pages (obblighi, la-normativa, registrazione). La normativa: 'Con il decreto legislativo 4 settembre 2024, n. 138, l'Italia ha recepito nell'ordinamento nazionale la direttiva (UE) 2022/2555'. Obblighi: 'Dal 1° dicembre 2024 e non oltre il 28 febbraio 2025, i soggetti pubblici e privati a cui si applica la normativa devono registrarsi'; first windows of '9 mesi per le notifiche e 18 mesi per le misure di sicurezza, decorrenti dalla data di consolidamento dell'elenco dei soggetti NIS (aprile 2025)'; annual updates 15 April–31 May. Registrazione: failure to register is sanctioned up to 0.1% of worldwide turnover. The pages are undated (published null). ACN is a national authority, not an EU institution, so publisher is null and the name is given in full." }, { "id": "src-iccl-ireland-bottleneck", "tier": "tier:4", "type": "source-type:report", "publisher": null, "publisher_name": "Irish Council for Civil Liberties", "title": "Europe's enforcement paralysis: ICCL's 2021 GDPR report", "url": "https://www.iccl.ie/digital-data/2021-gdpr-report/", "url_status": "url:live", "published": "2021-09-13", "accessed": "2026-08-28", "language": "en", "note": "Johnny Ryan and Alan Toner, Irish Council for Civil Liberties. Located 28 Aug 2026. Source of both the \"bottleneck\" characterisation and the Spain-issues-ten-times-more-draft-decisions comparison. IMPORTANT: this is a 2021 report. The brief presents the critique in the present tense; the underlying data are five years old and the DPC has since restructured.", "resolution_note": "Identified and linked: this is the specific publication the brief draws on (see url and note). It is cited as tier-4 commentary: it can support what its authors argue or report, not a legal fact on its own. Rewritten on 2026-09-26 \u2014 the earlier text said no specific publication had been named, which stopped being true when the URL was located." }, { "id": "src-icle-gdpr-law-of-everything", "tier": "tier:4", "type": "source-type:commentary", "publisher": null, "publisher_name": "International Center for Law & Economics", "title": "ICLE Comments to the European Commission on GDPR and ePrivacy in the Digital Omnibus", "url": "https://laweconcenter.org/resources/icle-comments-to-the-european-commission-on-gdpr-and-eprivacy-in-the-digital-omnibus/", "url_status": "url:live", "published": "2026-03-13", "accessed": "2026-09-26", "language": "en", "note": "Located 28 Aug 2026. Contains the proportionality-asymmetry argument almost verbatim: the EDPB/EDPS analysis tests whether limitations on data protection are justified without asking whether the scope of data protection remains proportionate to the burdens it imposes. The phrase \"law of everything\" is not ICLE's coinage — see src-purtova-law-of-everything. Re-read 2026-09-26: published 13 March 2026; ICLE itself footnotes the phrase to Purtova (footnote 3: 'The phrase adapts Nadezhda Purtova, The Law of Everything ... (2018) 10 Law Innov Technol 40').", "resolution_note": "Identified and linked: this is the specific publication the brief draws on (see url and note). It is cited as tier-4 commentary: it can support what its authors argue or report, not a legal fact on its own. Rewritten on 2026-09-26 \u2014 the earlier text said no specific publication had been named, which stopped being true when the URL was located." }, { "id": "src-algorithmwatch-systemic-risk", "tier": "tier:3", "type": "source-type:report", "publisher": null, "publisher_name": "AlgorithmWatch", "title": "Researching Systemic Risks under the Digital Services Act (interim report)", "url": "https://algorithmwatch.org/en/researching-systemic-risks-under-the-digital-services-act/", "url_status": "url:live", "published": "2024-07-26", "accessed": "2026-08-28", "language": "en", "note": "Oliver Marsh, AlgorithmWatch. Located 28 Aug 2026. The report records that Recitals 79–89 were often not seen as providing clarity and were argued to confuse the Articles further — the brief's claim. Note the report's own headline finding is that practical problems outweigh conceptual ones, which is a slightly different emphasis from the brief's.", "resolution_note": "Identified and linked: this is the specific publication the brief draws on (see url and note). It is cited as tier-3 research: it can support what its authors argue or report, not a legal fact on its own. Rewritten on 2026-09-26 \u2014 the earlier text said no specific publication had been named, which stopped being true when the URL was located." }, { "id": "src-cset-gpai-code", "tier": "tier:3", "type": "source-type:research", "publisher": null, "publisher_name": "Center for Security and Emerging Technology, Georgetown University", "title": "AI Safety under the EU AI Code of Practice — A New Global Standard?", "url": "https://cset.georgetown.edu/article/eu-ai-code-safety/", "url_status": "url:live", "published": "2025-07-01", "accessed": "2026-08-28", "language": "en", "note": "Mia Hoffmann, Center for Security and Emerging Technology, Georgetown. Located 28 Aug 2026. States that the safety and security chapter sets a minimum standard going beyond current industry practice, provided the Code is widely adopted — which is the brief's claim, including the proviso.", "resolution_note": "Identified and linked: this is the specific publication the brief draws on (see url and note). It is cited as tier-3 research: it can support what its authors argue or report, not a legal fact on its own. Rewritten on 2026-09-26 \u2014 the earlier text said no specific publication had been named, which stopped being true when the URL was located." }, { "id": "src-noyb-omnibus", "tier": "tier:4", "type": "source-type:report", "publisher": null, "publisher_name": "noyb", "title": "Digital Omnibus Report V3: Analysis of Select GDPR and ePrivacy Proposals by the Commission", "url": "https://noyb.eu/en/digital-omnibus-report-v3-analysis-select-gdpr-and-eprivacy-proposals-commission", "url_status": "url:live", "published": "2026-02-24", "accessed": "2026-08-28", "language": "en", "note": "Located 28 Aug 2026. noyb states the GDPR and ePrivacy amendments would produce multiple conflicts with the Charter and a clear departure from the GDPR's logic and CJEU case law — the brief's wording tracks this closely. V3 also comments on the EDPB/EDPS joint opinion of 11 Feb 2026.", "resolution_note": "Identified and linked: this is the specific publication the brief draws on (see url and note). It is cited as tier-4 commentary: it can support what its authors argue or report, not a legal fact on its own. Rewritten on 2026-09-26 \u2014 the earlier text said no specific publication had been named, which stopped being true when the URL was located." }, { "id": "src-itif-dma-compliance", "tier": "tier:4", "type": "source-type:commentary", "publisher": null, "publisher_name": "Information Technology and Innovation Foundation", "title": "Comments to the European Commission for Its First Review of the Digital Markets Act", "url": "https://itif.org/publications/2025/09/24/comments-to-the-european-commission-for-its-first-review-of-the-digital-markets-act/", "url_status": "url:live", "published": "2025-09-24", "accessed": "2026-08-28", "language": "en", "note": "Located 28 Aug 2026. Carries the \"opaque and administratively complex\" characterisation and the argument that a gatekeeper may struggle to know whether it is compliant, let alone deliberately violate. Note that ITIF is itself quoting studies for the first phrase.", "resolution_note": "Identified and linked: this is the specific publication the brief draws on (see url and note). It is cited as tier-4 commentary: it can support what its authors argue or report, not a legal fact on its own. Rewritten on 2026-09-26 \u2014 the earlier text said no specific publication had been named, which stopped being true when the URL was located." }, { "id": "src-papakonstantinou-dehert", "tier": "tier:3", "type": "source-type:research", "publisher": null, "publisher_name": "Papakonstantinou and De Hert", "title": "The Regulation of Digital Technologies in the EU: the law-making phenomena of “act-ification”, “GDPR mimesis” and “EU law brutality”", "url": "https://techreg.org/article/view/11459", "url_status": "url:live", "published": "2022-05-21", "accessed": "2026-08-28", "language": "en", "note": "Technology and Regulation, 2022, 48–60. Open access. Located 28 Aug 2026: the paper is the origin of both terms the brief uses, and it identifies the same three phenomena. The authors later expanded it into a Routledge monograph (2024); the brief's characterisation matches the paper.", "resolution_note": "Identified and linked: this is the specific publication the brief draws on (see url and note). It is cited as tier-3 research: it can support what its authors argue or report, not a legal fact on its own. Rewritten on 2026-09-26 \u2014 the earlier text said no specific publication had been named, which stopped being true when the URL was located." }, { "id": "src-cdt-ai-act-national-security", "tier": "tier:4", "type": "source-type:commentary", "publisher": null, "publisher_name": "Center for Democracy and Technology", "title": "Analysis of the AI Act law-enforcement and national-security boundary", "url": null, "url_status": "url:none", "published": null, "accessed": "2026-09-27", "language": "en", "note": "Referenced by the brief. Specific publication and URL not yet identified.", "resolution": "publication-not-identified", "resolution_note": "The brief refers to this organisation's work without naming a specific publication, so there is no document to link to. This cannot be fixed by searching harder for a URL: the underlying reference has to be pinned to a title and date first. Until then, any claim resting only on this source is unresolved. 27 Sep 2026: a web search returns CDT's 'EU AI Act Brief – Pt. 2, Privacy & Surveillance' (https://cdt.org/insights/eu-ai-act-brief-pt-2-privacy-surveillance/) as the likely publication, but cdt.org answered with a Cloudflare block and it could not be opened, so it is not recorded as this source's URL." }, { "id": "src-us-house-judiciary-dsa-2025", "tier": "tier:4", "type": "source-type:report", "publisher": null, "publisher_name": "US House Judiciary Committee", "title": "The Foreign Censorship Threat: How the European Union's Digital Services Act Compels Global Censorship and Infringes on American Free Speech (Interim Staff Report)", "url": "https://judiciary.house.gov/sites/evo-subsites/republicans-judiciary.house.gov/files/2025-07/DSA_Report%26Appendix%2807.25.25%29.pdf", "url_status": "url:live", "published": "2025-07-25", "accessed": "2026-09-27", "language": "en", "note": "Located and opened on 27 Sep 2026 (145-page PDF with appendix): interim staff report of the Committee on the Judiciary of the US House of Representatives, dated 25 July 2025. A partisan committee report (published on the Committee Republicans' site), recorded as evidence of the US congressional position, not of EU law." }, { "id": "src-edpb-guidelines-3-2025", "tier": "tier:2", "type": "source-type:guidance", "publisher": "edpb", "publisher_name": "European Data Protection Board", "title": "EDPB Guidelines 3/2025 on the interplay between the DSA and the GDPR", "url": "https://www.edpb.europa.eu/documents/guideline/guidelines-32025-on-the-interplay-between-the-dsa-and-the-gdpr_en", "url_status": "url:live", "published": "2026-09-17", "accessed": "2026-09-27", "language": "en", "note": "Located and read on 27 Sep 2026 on the EDPB's own site. The title recorded here is the official one. Version 1 was put to public consultation from 12 September to 31 October 2025 (its page is now marked 'Obsolete version'); the final version, Guidelines 3/2025 v2, is dated 17 September 2026 and published with a report on the consultation. The URL now points to the final version; the consultation page was the one recorded before." }, { "id": "src-ec-google-dma-opening-2024", "tier": "tier:2", "type": "source-type:press-release", "publisher": "ec", "publisher_name": "European Commission", "title": "Commission opens non-compliance investigations against Alphabet, Apple and Meta under the Digital Markets Act (IP/24/1689)", "url": "https://ec.europa.eu/commission/presscorner/detail/en/ip_24_1689", "url_status": "url:live", "published": "2024-03-25", "accessed": "2026-09-27", "language": "en", "note": "Read in full 27 Sep 2026 through the Commission's press corner. Names the article for each proceeding: Art. 5(4) (steering) for Alphabet's Google Play and Apple's App Store; Art. 6(5) for self-preferencing on Google Search; Art. 6(3) for Apple's user-choice obligations; Art. 5(2) for Meta's 'pay or consent'." }, { "id": "src-ec-google-dma-fine-2026", "tier": "tier:2", "type": "source-type:press-release", "publisher": "ec", "publisher_name": "European Commission", "title": "Commission fines Google €890 million for breaches of the Digital Markets Act", "url": "https://digital-markets-act.ec.europa.eu/commission-fines-google-eur890-million-breaches-digital-markets-act-2026-07-23_en", "url_status": "url:live", "published": "2026-07-23", "accessed": "2026-08-27", "language": "en", "note": "Commission DMA portal announcement. Press release reference IP/26/1670." }, { "id": "src-ec-google-dma-fine-2026-ip", "tier": "tier:2", "type": "source-type:press-release", "publisher": "ec", "publisher_name": "European Commission", "title": "Press release IP/26/1670 — Commission fines Google €890 million for breaches of the Digital Markets Act", "url": "https://ec.europa.eu/commission/presscorner/detail/en/ip_26_1670", "url_status": "url:live", "published": "2026-07-23", "accessed": "2026-08-27", "language": "en", "note": "Commission press corner release." }, { "id": "src-ec-cloud-gatekeeper-preliminary-2026", "tier": "tier:2", "type": "source-type:press-release", "publisher": "ec", "publisher_name": "European Commission", "title": "Commission reaches preliminary position that Amazon's and Microsoft's market leading cloud services should be designated under the DMA", "url": "https://digital-markets-act.ec.europa.eu/commission-reaches-preliminary-position-amazons-and-microsofts-market-leading-cloud-services-should-2026-06-25_en", "url_status": "url:live", "published": "2026-06-25", "accessed": "2026-09-26", "language": "en", "note": "Preliminary position only. Press release reference IP/26/1444. No designation decision had been adopted at the date recorded here." }, { "id": "src-ec-ai-act-framework", "tier": "tier:2", "type": "source-type:guidance", "publisher": "ec", "publisher_name": "European Commission", "title": "AI Act — regulatory framework for artificial intelligence", "url": "https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai", "url_status": "url:live", "published": null, "accessed": "2026-08-27", "language": "en", "note": "The Commission's own statement of the AI Act's entry-into-force and application dates." }, { "id": "src-ec-ai-act-enforcement-2026", "tier": "tier:2", "type": "source-type:press-release", "publisher": "ec", "publisher_name": "European Commission", "title": "Commission starts enforcing AI Act rules and new transparency requirements on 2 August", "url": "https://ec.europa.eu/commission/presscorner/detail/en/ip_26_1714", "url_status": "url:live", "published": "2026-08-02", "accessed": "2026-08-27", "language": "en", "note": "Press release IP/26/1714." }, { "id": "src-hunton-ai-omnibus-2026", "tier": "tier:4", "type": "source-type:commentary", "publisher": null, "publisher_name": "Hunton Andrews Kurth LLP", "title": "EU Digital Omnibus on AI Enters Into Force", "url": "https://www.hunton.com/privacy-and-cybersecurity-law-blog/eu-digital-omnibus-on-ai-enters-into-force", "url_status": "url:live", "published": "2026-07-28", "accessed": "2026-09-26", "language": "en", "note": "Law firm client alert. States the Digital Omnibus (Regulation (EU) 2026/1744) entered into force 27 July 2026, and gives the key AI Act dates directly: 2 August 2026 transparency obligations enter into force; 2 December 2026 marking obligations apply to systems already on the market before 2 August 2026; 2 December 2027 Annex III stand-alone high-risk; 2 August 2028 Annex I embedded high-risk." }, { "id": "src-nicfab-ai-omnibus-2026", "tier": "tier:4", "type": "source-type:commentary", "publisher": null, "publisher_name": "NicFab", "title": "Digital Omnibus AI: Official Journal (closing article of a ten-part series)", "url": "https://nicfab.eu/en/posts/digital-omnibus-ai-official-journal/", "url_status": "url:live", "published": "2026-07-28", "accessed": "2026-09-26", "language": "en", "note": "Detailed practitioner analysis of Regulation (EU) 2026/1744, published in the Official Journal 24 July 2026 and in force from 27 July 2026. Quotes the inserted Art. 5(1) points (ba) (non-consensual AI-generated intimate imagery, tracking and tightening the GDPR consent standard) and (bb) (the same conduct in relation to material within the meaning of Directive 2011/93/EU, i.e. CSAM), both applying from 2 December 2026, the same date given for the end of the Art. 50(2) marking transition for systems already on the market before 2 August 2026." }, { "id": "src-dlapiper-gdpr-survey-2026", "tier": "tier:4", "type": "source-type:report", "publisher": null, "publisher_name": "DLA Piper", "title": "GDPR Fines and Data Breach Survey: January 2026 (eighth edition)", "url": "https://www.dlapiper.com/en/insights/publications/2026/01/dla-piper-gdpr-fines-and-data-breach-survey-january-2026", "url_status": "url:live", "published": "2026-01-21", "accessed": "2026-10-14", "language": "en", "note": "The actual source of three figures the brief attributed to the CMS tracker: EUR 7.1bn cumulative to 10 Jan 2026, EUR 4.04bn for the Irish DPC, and 443 breach notifications per day (up 22% from 363). A law firm's survey, not a regulator's return — indicative of magnitude, as Annex B says. Re-read 14 Oct 2026. Definition of the headline figure, in DLA Piper's words: 'The aggregate total fines reported since the application of GDPR on 25 May 2018 to 10 January 2026 across all the jurisdictions surveyed now stands at EUR7.1 billion'. Fines reported, not fines upheld on appeal or collected. Also 'approximately EUR1.2 billion' in 2025 and EUR 4.04 billion for the Irish DPC since May 2018." }, { "id": "src-ec-dma-portal-whos-in-charge", "tier": "tier:2", "type": "source-type:regulator-statement", "publisher": "ec", "publisher_name": "European Commission", "title": "The EU Digital Markets Act — Who's in charge (DMA portal home page)", "url": "https://digital-markets-act.ec.europa.eu/index_en", "url_status": "url:live", "published": null, "accessed": "2026-09-27", "language": "en", "note": "Read 27 Sep 2026. 'Who's in charge': \"The European Commission is the sole enforcer of the DMA. A joint team in the Directorates-General for Competition (DG COMP) and Communications Networks, Content and Technology (DG CONNECT) is responsible for the implementation and enforcement of the DMA.\"" }, { "id": "src-ec-dsa-enforcement-team-2024", "tier": "tier:2", "type": "source-type:regulator-statement", "publisher": "ec", "publisher_name": "European Commission", "title": "Do you want to help enforce the Digital Services Act? Apply now to be part of the DSA enforcement team!", "url": "https://digital-strategy.ec.europa.eu/en/news/do-you-want-help-enforce-digital-services-act-apply-now-be-part-dsa-enforcement-team", "url_status": "url:live", "published": "2024-01-15", "accessed": "2026-09-27", "language": "en", "note": "Read 27 Sep 2026: the staff that \"Directorate F (Platforms Policy and Enforcement) at DG CONNECT is hiring will support the Commission's new supervisory and enforcement role related to the DSA\", working in teams \"dealing with designated services\" and investigating potential infringements. The Commission's page of 18 November 2022 likewise says DG CONNECT \"is building a multi-disciplinary enforcement team\" for the DSA." }, { "id": "src-ec-dma-gatekeepers-portal", "tier": "tier:2", "type": "source-type:regulator-statement", "publisher": "ec", "publisher_name": "European Commission", "title": "DMA designated gatekeepers", "url": "https://digital-markets-act.ec.europa.eu/gatekeepers-portal_en", "url_status": "url:live", "published": "2025-04-23", "accessed": "2026-10-14", "language": "en", "note": "The Commission's own register. Six designated 6 Sep 2023; Apple iPadOS added 29 Apr 2024; Booking added 13 May 2024; Facebook Marketplace undesignated 23 Apr 2025. Confirms the seven undertakings the brief names, and gives 23 currently designated core platform services. Re-read 14 Oct 2026: the page still names seven gatekeepers and states 'In total, 23 core platform services provided by those gatekeepers are currently designated'; the 23 listed services were counted that day and agree. AWS and Azure are not listed (preliminary position only, 25 June 2026)." }, { "id": "src-oj-aild-withdrawal-2025", "tier": "tier:2", "type": "source-type:legislative-document", "publisher": "ep", "publisher_name": "European Parliament", "title": "European Parliament Legislative Train — AI Liability Directive", "url": "https://www.europarl.europa.eu/legislative-train/theme-a-europe-fit-for-the-digital-age/file-ai-liability-directive", "url_status": "url:live", "published": "2025-10-06", "accessed": "2026-08-28", "language": "en", "note": "The Parliament's Legislative Train file, which records that the AI Liability Directive was announced for withdrawal in the Commission Work Programme 2025 (COM(2025) 45, 11 Feb 2025, \"no foreseeable agreement\") and formally withdrawn by notice C/2025/5423 in the Official Journal on 6 October 2025. Retitled on 2026-09-26 (audit T-30): the record previously named the OJ notice, which has never been opened; the notice is on EUR-Lex (CELEX 52025XC05423), which returns HTTP 202 with no body in this environment, as did the Legislative Train page on 2026-09-26, so the accessed date is the original one. The ID keeps 'oj' because IDs are never renamed." }, { "id": "src-purtova-law-of-everything", "tier": "tier:3", "type": "source-type:research", "publisher": null, "publisher_name": "Nadezhda Purtova", "title": "The law of everything. Broad concept of personal data and future of EU data protection law", "url": "https://www.tandfonline.com/doi/full/10.1080/17579961.2018.1452176", "url_status": "url:live", "published": "2018-04-02", "accessed": "2026-08-28", "language": "en", "note": "Law, Innovation and Technology. The origin of the phrase the brief attributes to ICLE. Purtova's conclusion is not ICLE's: she argues for abandoning the personal/non-personal distinction, not for narrowing the scope of the GDPR. Attached as context so the borrowing is visible." }, { "id": "src-techpolicy-national-security-2026", "tier": "tier:4", "type": "source-type:commentary", "publisher": null, "publisher_name": "Tech Policy Press", "title": "When National Security Becomes a Shield for Evading AI Accountability", "url": "https://www.techpolicy.press/when-national-security-becomes-a-shield-for-evading-ai-accountability/", "url_status": "url:live", "published": "2026-02-16", "accessed": "2026-08-28", "language": "en", "note": "Carries both halves of the brief's Part XI argument: that \"national security\" is loosely enough defined to be used as a bypass, and that Hungary had not invoked the exemption for its facial-recognition deployment. Attached in place of the CDT publication the brief refers to, which could not be identified." }, { "id": "src-eli-ai-omnibus-2026-1744", "tier": "tier:1", "type": "source-type:regulation", "publisher": "eu", "publisher_name": "EUR-Lex / ELI", "title": "Regulation (EU) 2026/1744 of 8 July 2026 (Digital Omnibus on AI)", "url": "http://data.europa.eu/eli/reg/2026/1744/oj", "url_status": "url:live", "published": "2026-07-24", "accessed": "2026-08-28", "language": "en", "note": "Published in the Official Journal 24 July 2026, in force 27 July 2026. Amends the AI Act (2024/1689), the Civil Aviation Regulation (2018/1139) and the Machinery Regulation (2023/1230). Located 28 Aug 2026 in response to an external review that asked whether the instrument was still a proposal — it is not, and the dataset already recorded it as in force." }, { "id": "src-ec-aliexpress-fine-2026", "tier": "tier:2", "type": "source-type:press-release", "publisher": "ec", "publisher_name": "European Commission", "title": "Commission fines AliExpress EUR 550 million for breaching the Digital Services Act", "url": "https://digital-strategy.ec.europa.eu/en/news/commission-fines-aliexpress-eu550-million-breaching-digital-services-act", "url_status": "url:live", "published": "2026-07-20", "accessed": "2026-10-14", "language": "en", "note": "Confirms the EUR 550 million fine, publication date 20 July 2026, and the systemic-risk ground (failure to diligently assess and mitigate risk from illegal, unsafe or counterfeit products). Contains no ranking language and no article numbers or action-plan deadline; those are corroborated by secondary legal commentary (Lewis Silkin, 24 July 2026; Il Sole 24 Ore, 20 July 2026; JURIST, 22 July 2026). Re-read 14 Oct 2026 together with the full press release IP/26/1654 (20 July 2026): 'AliExpress now has until 20 October 2026 to submit an action plan'; the Board then has one month for its opinion and the Commission a further month to decide. The page itself does not carry that detail; the press release does." }, { "id": "src-iehc-2026-347-tiktok", "tier": "tier:1", "type": "source-type:judgment", "publisher": null, "publisher_name": "High Court of Ireland (Commercial)", "title": "TikTok Technology Limited and TikTok Information Technologies UK Limited v Data Protection Commission [2026] IEHC 347 (Mulcahy J, 3 June 2026), Record No. 2025/248 MCA", "url": "https://ww2.courts.ie/acc/alfresco/d03be1e0-7395-4ba4-86f5-c331e3670995/2026_IEHC_347.pdf/pdf", "url_status": "url:live", "published": "2026-06-03", "accessed": "2026-09-27", "language": "en", "note": "The approved judgment's full text (185 pages), read 27 Sep 2026. §6: the DPC issued its decision on 30 April 2025. §11: TikTok appealed by originating notice of motion issued 27 May 2025, under ss. 142 and 150 of the Data Protection Act 2018. §14: the appeal automatically stayed payment of the fines (s. 142); the corrective orders were stayed by [2025] IEHC 619 (13 Nov 2025), and the Supreme Court continued that stay by [2026] IESC 27 (30 April 2026). §§576-577: all grounds against the Art. 46(1) and Art. 13(1)(f) infringement findings, and against the decision to impose fines, to be dismissed; the amount of the fines left over. §§578, 592: errors in the DPC's assessment of material relevant to the suspension order; the court proposes to vacate the corrective orders and remit them to the DPC, subject to hearing the parties on 11 June 2026 on the final form of order." }, { "id": "src-iehc-2026-419-tiktok", "tier": "tier:1", "type": "source-type:judgment", "publisher": null, "publisher_name": "High Court of Ireland (Commercial)", "title": "TikTok Technology Limited and TikTok Information Technologies UK Limited v Data Protection Commission [2026] IEHC 419 (Mulcahy J, 30 June 2026), Record No. 2025/248 MCA", "url": "https://www2.courts.ie/acc/alfresco/65d7e861-a6f7-4fa9-b03c-91c1eb07c96c/2026_IEHC_419.pdf/pdf", "url_status": "url:live", "published": "2026-06-30", "accessed": "2026-09-27", "language": "en", "note": "The approved judgment's full text (72 pages), read 27 Sep 2026: the judgment on the grounds left over from [2026] IEHC 347, all concerning the calculation of the fines (Art. 83 GDPR). §§238-242: subject to the questions below, the DPC was entitled to treat 2024 as the preceding financial year and to have regard to ByteDance's turnover; its limited errors under Art. 83(2) do not merit revisiting the fines. §243: four questions proposed for a preliminary reference to the CJEU under Art. 267 TFEU (imputation to the parent and its rights of defence; the role of group turnover in setting the amount; aggregation under Art. 83(3)). §244: the parties to prepare a draft Order for Reference; matter listed for 10 July 2026." }, { "id": "src-dpc-annual-report-2023", "tier": "tier:2", "type": "source-type:report", "publisher": "dpa-ie", "publisher_name": "Data Protection Commission (Ireland)", "title": "Data Protection Commission — Annual Report 2023", "url": "https://www.dataprotection.ie/sites/default/files/uploads/2024-05/DPC%20EN_AR%202023_Final%20.pdf", "url_status": "url:live", "published": "2024-05-29", "accessed": "2026-09-27", "language": "en", "note": "Read 27 Sep 2026. On the Meta transfers decision (EDPB decision of 13 April 2023; DPC Final Decision of 12 May 2023; fine of EUR 1.2 billion, suspension and compliance orders): 'The Final Decision is under appeal' (p. 38), and 'Meta initiated three court challenges against the DPC/EDPB: a statutory appeal before the Irish High Court, Judicial Review proceedings before the High Court and annulment proceedings against the EDPB' (p. 41; the report says 'before the Court of Justice', the action being T-325/23 before the General Court). Publication date from the DPC's press release of 29 May 2024." }, { "id": "src-curia-register-c1009-26", "tier": "tier:2", "type": "source-type:court-record", "publisher": "cjeu", "publisher_name": "Court of Justice of the European Union", "title": "InfoCuria case register — Case C-1009/26, Tiktok Technology and TikTok Information Technologies UK, read 27 September 2026", "url": "https://infocuria.curia.europa.eu/", "url_status": "url:live", "published": null, "accessed": "2026-09-27", "language": "en", "note": "The Court's own case register, queried through its search service on 27 Sep 2026: C-1009/26, a reference for a preliminary ruling (procedure type 'RP') named 'Tiktok Technology and TikTok Information Technologies UK', lodged 11 Sep 2026 and recorded as 'Affaire pendante'. The register entry read gives no referring court and no questions, so that it is the reference the Irish High Court proposed in [2026] IEHC 419 is consistent with the parties' names but not established." }, { "id": "src-twobirds-ai-omnibus-trilogue-2026", "tier": "tier:4", "type": "source-type:commentary", "publisher": null, "publisher_name": "Bird & Bird", "title": "Digital Omnibus on AI: Trilogue Stalls Ahead of the AI Act Deadline", "url": "https://www.twobirds.com/en/insights/2026/digital-omnibus-on-ai-trilogue-stalls-ahead-of-the-ai-act-deadline", "url_status": "url:live", "published": "2026-05-05", "accessed": "2026-09-27", "language": "en", "note": "Law-firm commentary, read 27 Sep 2026 (publication date from the page's structured data). Opening paragraph: 'On 28 April 2026, the second political trilogue on the Digital Omnibus on AI ended without agreement after roughly twelve hours of negotiation. The breakdown did not concern the most prominent element of the proposal, the postponement of the AI Act's high-risk obligations, but the conformity assessment architecture for AI systems embedded in products that fall under existing EU sectoral safety law (Annex I to the AI Act).'" }, { "id": "src-iapp-ai-omnibus-trilogue-2026", "tier": "tier:4", "type": "source-type:commentary", "publisher": null, "publisher_name": "IAPP", "title": "Notes from the AI Governance Center: AI Act Omnibus: What just happened and what comes next?", "url": "https://iapp.org/news/a/ai-act-omnibus-what-just-happened-and-what-comes-next", "url_status": "url:live", "published": "2026-04-29", "accessed": "2026-09-27", "language": "en", "note": "Ashley Casovan (IAPP AI Governance Center), published 29 April 2026, read 27 Sep 2026: 'after 12 hours of negotiations in Brussels fell apart 28 April'; 'The 28 April trilogue was the second and final session scheduled to negotiate the Omnibus package'. It does not state the cause." }, { "id": "src-dete-value-of-data-centres-2026", "tier": "tier:3", "type": "source-type:report", "publisher": null, "publisher_name": "Department of Enterprise, Tourism and Employment (Ireland); report prepared by KPMG", "title": "The value of data centres to Ireland — an independent report prepared by KPMG for the Department of Enterprise, Tourism and Employment (March 2026)", "url": "https://enterprise.gov.ie/en/publications/publication-files/the-value-of-data-centres-to-ireland.pdf", "url_status": "url:live", "published": "2026-06-02", "accessed": "2026-09-27", "language": "en", "note": "Read 27 Sep 2026 (181 pages). Recorded at tier 3, not 2: the Department publishes it, but it is an independent consultancy report and its findings are KPMG's. Executive summary: 'Dublin's concentration of data centres has positioned it as a strategic European data centre hub, alongside Frankfurt, London, Amsterdam, and Paris – collectively known as the FLAP-D markets'; 'Dublin becoming a key European hub for data centres alongside Frankfurt, London, Amsterdam and Paris'. It gives no share of European capacity. Publication date from the Department's news item of 2 June 2026 ('Minister Burke publishes report on the economic value of data centres to Ireland')." }, { "id": "src-agenceurope-omnibus-2026-10-12", "tier": "tier:4", "type": "source-type:journalism", "publisher": null, "publisher_name": "Agence Europe (Europe Daily Bulletin No. 13958)", "title": "Future of 'Digital Omnibus' still in limbo as Member States fail to agree", "url": "https://agenceurope.eu/en/bulletin/article/13958/17/future-of-digital-omnibus-still-in-limbo-as-member-states-fail-to-agree", "url_status": "url:live", "published": "2026-10-12", "accessed": "2026-10-14", "language": "en", "note": "Read 14 Oct 2026. Datelined Brussels, 12/10/2026, in the bulletin of 13 October 2026; English version of an original in French by Louis Dubar. States that the Irish Presidency's compromise text 'was supposed to go to a vote at an EU Committee of Permanent Representatives (Coreper II) meeting on Sunday 11 October. But in the end, it wasn't even discussed – or voted on'; that its examination had already been postponed at a Coreper meeting on Wednesday 7 October 'under pressure from Germany and France'; that Berlin's reservations concern the Data Act's provisions on trade secrets; and that 'Ireland may hold further consultations with Member State delegations, a source said'. Specialist press, tier 4. No Council agenda, outcome of proceedings or press release recording either meeting was located on 14 Oct 2026, so the procedural outcome rests on this report and is labelled as reported, not as an official record." }, { "id": "src-agenceurope-omnibus-2026-10-20", "tier": "tier:4", "type": "source-type:journalism", "publisher": null, "publisher_name": "Agence Europe (Europe Daily Bulletin No. 13964)", "title": "'Digital Omnibus' proposal back before EU Member States with new safeguards for trade secrets", "url": "https://agenceurope.eu/en/bulletin/article/13964/7/digital-omnibus-proposal-back-before-eu-member-states-with-new-safeguards-for-trade-secrets", "url_status": "url:live", "published": "2026-10-20", "accessed": "2026-10-21", "language": "en", "note": "Read 21 Oct 2026. Datelined Strasbourg, 20/10/2026, in the bulletin of 21 October 2026. States that the Irish compromise 'failed to secure support at the 7 October meeting of the Committee of Permanent Representatives to the EU (Coreper)' and that 'Coreper is due to examine a revised version on Wednesday 21 October', with a view to 'adopting a negotiating mandate with the European Parliament on the text'; among the changes, 'stronger protection for trade secrets, one of Berlin's red lines', including 'a reference to trade secrets constituting industrial manufacturing know-how', and a provision for 'the Commission to submit a specific report, accompanied by recommendations' on 'the proportionality of the obligations imposed on small and medium-sized enterprises'. Written before the meeting: it does not report its outcome. Specialist press, tier 4." }, { "id": "src-council-cm-4156-2026", "tier": "tier:2", "type": "source-type:legislative-document", "publisher": "council", "publisher_name": "Council of the European Union, General Secretariat", "title": "CM 4156/26 — Notice of meeting and provisional agenda, Antici Group (Simplification), 25 September 2026", "url": "https://data.consilium.europa.eu/doc/document/CM-4156-2026-INIT/en/pdf", "url_status": "url:live", "published": "2026-09-17", "accessed": "2026-10-21", "language": "en", "note": "Read 21 Oct 2026 on the Council's document register. Dated Brussels, 17 September 2026. Item 1, Omnibus VII: Digital Omnibus: 'Exchange of views based on the Presidency revised compromise text', 'ST 13112/26 (Presidency revised compromise text – to be issued)', with WK 14017/26 as the Presidency's steering note. It gives no date for ST 13112/26 itself; ST 13112/26 was not found on the register (HTTP 404, 21 Oct 2026)." }, { "id": "src-council-st-12535-2026", "tier": "tier:2", "type": "source-type:legislative-document", "publisher": "council", "publisher_name": "Council of the European Union, General Secretariat", "title": "ST 12535/26 — Digital Omnibus: Presidency revised compromise text (3 September 2026)", "url": "https://data.consilium.europa.eu/doc/document/ST-12535-2026-INIT/en/pdf", "url_status": "url:live", "published": "2026-09-03", "accessed": "2026-10-21", "language": "en", "note": "Read 21 Oct 2026 on the Council's document register, where it now appears (PDF rendered 16 Oct 2026; 158 pages; still marked LIMITE). Note from the General Secretariat to Delegations, 'Presidency revised compromise text', 'in view of the AGS meeting of 11 September 2026', changes against ST 10677/26 marked. The annex renumbers the AI clause 'Article 88c88 bis' and the pseudonymisation article 'Article 29a25a' (strikethrough and insertions run together in the text layer, so which safeguards are struck cannot be read from the extraction; the brief's account of them rests on src-ppcland-omnibus-2026-09)." }, { "id": "src-council-st-13886-2026", "tier": "tier:2", "type": "source-type:legislative-document", "publisher": "council", "publisher_name": "Council of the European Union, General Secretariat (copy distributed by Agence Europe)", "title": "ST 13886/26 — Digital Omnibus: Mandate for negotiations with the European Parliament (2 October 2026)", "url": "https://aeur.eu/f/nrj", "url_status": "url:live", "published": "2026-10-02", "accessed": "2026-10-21", "language": "en", "note": "Read 21 Oct 2026. A LIMITE document not on the Council's register (HTTP 404 for ST-13886-2026-INIT, 21 Oct 2026); read in the copy Agence Europe distributes, each page stamped 'Obtained by Agence Europe'. Its authenticity rests on that distribution, which is why only its cover facts are used: dated Brussels, 2 October 2026; note from the General Secretariat to the Permanent Representatives Committee; subject the Digital Omnibus, 'Mandate for negotiations with the European Parliament'; 163 pages. §7: the Antici Group (Simplification) examined the proposal at meetings including 11 and 25 September, and 'between July and September, the Presidency presented two revised compromise texts'. §9: after 25 September the Presidency updated the text, notably on the Data Acquis, the GDPR and the ePrivacy cookie rules." }, { "id": "src-oeil-2025-0360", "tier": "tier:2", "type": "source-type:legislative-document", "publisher": "ep", "publisher_name": "European Parliament — Legislative Observatory", "title": "Procedure file 2025/0360(COD): Simplification of the digital legislative framework – Digital Omnibus (Omnibus VII)", "url": "https://oeil.europarl.europa.eu/oeil/en/procedure-file?reference=2025%2F0360%28COD%29", "url_status": "url:live", "published": null, "accessed": "2026-10-14", "language": "en", "note": "Parliament's own procedure file, read 14 Oct 2026: status and stage reached 'Awaiting committee decision'; joint committee responsible ITRE and LIBE, rapporteurs Aura Salla (EPP) and Marina Kaljurand (S&D), appointed 25 Feb 2026; committee referral announced 19 Jan 2026; committee draft report PE786.818 of 22 Jun 2026; nine documents of amendments tabled in committee dated 27 Jul 2026 (PE786.820, PE790.967, PE790.968, PE791.071–073, PE791.873, PE791.874, PE791.883). No committee vote, plenary position or trilogue is recorded. The file does not state how many amendments were tabled, and they were not counted here. A live page: what it shows is its state on the accessed date." }, { "id": "src-ec-x-action-plan-2026", "tier": "tier:2", "type": "source-type:press-release", "publisher": "ec", "publisher_name": "European Commission", "title": "Commission accepts X's action plan to comply with Digital Services Act", "url": "https://digital-strategy.ec.europa.eu/en/news/commission-accepts-xs-action-plan-comply-digital-services-act", "url_status": "url:live", "published": "2026-07-16", "accessed": "2026-10-14", "language": "en", "note": "Read 14 Oct 2026 (publication 16 July 2026, last update 17 July 2026). 'Following the Commission's decision that X is in breach of the DSA and a fine in December 2025', X committed to improve its ad repository and researchers' access to public data; an independent external audit will assess the changes. The Board for Digital Services, in its opinion of 15 June, found the overall plan insufficient; the Commission accepted it and clarified several points. X has six months to implement the measures and must then submit an audit. The acceptance follows the infringement decision and does not withdraw it." }, { "id": "src-ec-google-dma-specification-2026", "tier": "tier:2", "type": "source-type:press-release", "publisher": "ec", "publisher_name": "European Commission", "title": "Commission provides guidance to Google for AI interoperability on Android and sharing of Google Search data under the Digital Markets Act", "url": "https://digital-markets-act.ec.europa.eu/commission-provides-guidance-google-ai-interoperability-android-and-sharing-google-search-data-under-2026-07-16_en", "url_status": "url:live", "published": "2026-07-16", "accessed": "2026-10-14", "language": "en", "note": "Read 14 Oct 2026 on the DMA portal and in the full press release IP/26/1634 (Commission press corner). Two sets of 'binding specification measures': interoperability with features of Google Android for rival AI services (Art. 6(7) DMA) — activation by voice command and acting in apps on the user's behalf, with safeguards for privacy, device integrity and security; and sharing of search data with third-party search engines (Art. 6(11) DMA) — AI chatbots offering search functionalities are eligible, Google must share, subject to anonymisation, the same data it collects to optimise its own search, by a multi-layered anonymisation method, with a prior check of serious cybersecurity and data-protection risks per recipient and a pricing formula. 'Google must start sharing search data with eligible search engine providers from January 2027. Users will start benefitting from the changes to Android as of July 2027.' Specification proceedings 'do not provide for the imposition of fines'; the decisions 'remain subject to independent judicial scrutiny'. Proceedings opened 27 January 2026. The decisions themselves were not read." }, { "id": "src-ec-cra-reporting", "tier": "tier:2", "type": "source-type:guidance", "publisher": "ec", "publisher_name": "European Commission", "title": "Cyber Resilience Act — Reporting obligations", "url": "https://digital-strategy.ec.europa.eu/en/policies/cra-reporting", "url_status": "url:live", "published": null, "accessed": "2026-10-14", "language": "en", "note": "Read 14 Oct 2026. 'As of 11 September 2026, manufacturers are required to report actively exploited vulnerabilities and severe incidents impacting the security of products with digital elements.' 'In accordance with Article 71(2) of the CRA, open-source software stewards are subject to reporting obligations (Article 24(3)) from 11 December 2027.' Early warning within 24 hours, notification within 72 hours, final report within 14 days of a corrective measure (vulnerabilities) or one month of the notification (severe incidents); one submission through ENISA's single reporting platform, operational since 11 September 2026." }, { "id": "src-eurlex-eudi-2024-2977", "tier": "tier:1", "type": "source-type:regulation", "publisher": "eu", "publisher_name": "EUR-Lex", "title": "Commission Implementing Regulation (EU) 2024/2977 of 28 November 2024 as regards person identification data and electronic attestations of attributes issued to European Digital Identity Wallets", "url": "https://eur-lex.europa.eu/eli/reg_impl/2024/2977/oj", "url_status": "url:live", "published": "2024-12-04", "accessed": "2026-10-14", "language": "en", "note": "Official Journal text read 14 Oct 2026 (OJ L, 2024/2977, 4.12.2024). Adopted 'in particular' under Article 5a(23) of Regulation (EU) No 910/2014; 'This Regulation shall enter into force on the twentieth day following that of its publication', which is 24 December 2024. Implementing Regulation (EU) 2024/2981, under Article 5c(6), was published the same day with the same entry-into-force clause, read the same day." } ] }