What this project is for
EU Digital Policy is an analytical brief on the EU digital rulebook — the GDPR, the Digital Services Act, the Digital Markets Act, the AI Act, the Data Act and the cyber layer. It is written for readers who need to know what these instruments require, who enforces them, when they apply and how far the evidence for each statement actually goes.
Its distinguishing commitment is the evidence discipline rather than the subject. The argument is prose, and everything the argument rests on is data: every legal proposition, figure, date, status, competence and enforcement record is held as a record, with its sources, a locator into them, and a grade derived from what those sources can carry. Where nothing external supports a statement, the site says so rather than looking confident.
It is an independent, non-commercial project by Andrea Tosti. It is not affiliated with any EU institution, and nothing here is legal advice.
What the analysis rests on: the sources
Every source is ranked in one of four tiers, and the tier decides what a source can carry:
- Primary law and courts — the texts of regulations and directives on EUR-Lex, judgments of the Court of Justice and the General Court, official Commission decisions and legislative documents.
- Regulators and EU institutions — the EDPB, the EDPS, ENISA, national regulators and competent authorities, the European Parliament and the Council.
- Research — peer-reviewed research and established academic institutions.
- Industry, advocacy and press — industry bodies, advocacy organisations, commentary and journalism, which are never presented as equivalent to primary law.
Official EU documents are the foundation, but they are not the only sources, and the site does not pretend otherwise: where a statement rests on press or research alone, its grade says so. Every source, ranked by this hierarchy, is listed on the evidence and sources page.
How a statement becomes a record
Each consequential statement in the brief exists as a claim with a type that says what kind of statement it is: law (what an instrument provides), fact (what the evidence shows), derived (a figure this site computes from other claims, with its inputs, formula and rounding recorded so the arithmetic can be re-run), attributed (what a named actor states, reported rather than adopted), and the author's own interpretation, critique and forecast.
Each source attached to a claim says what it does for it: it directly supports the proposition, partially supports it, or gives context only. Context is not a citation. Each reference carries a locator precise enough to reach the evidence without reading the whole document.
Passages of the brief that are the author's synthesis, critique or recommendation are marked so that they are never read as a sourced finding.
How the evidence is graded
The grade of a claim is computed when the page loads, from its type and its sources, and is never stored, so it cannot drift away from the evidence it describes:
- Primary law — carried by the legal text itself or by a court.
- Official source — carried by a regulator or an EU institution.
- Secondary only — carried only by research, press or advocacy.
- Derived by this site — only as strong as its weakest input.
- Attributed view — checked against the actor's own publication; reported, not adopted.
- Interpretation — the author's reading. Sources can support its premises; they cannot settle its conclusion.
- Unresolved — no directly supporting external source has been located.
An asterisk in the running text means the reference is missing, not that the statement is doubted. It is removed only by finding the publication the brief was pointing at and checking that it says what the brief says — never by attaching a loosely related substitute.
Dates, status and competence
Each fact has one home. An instrument carries no dates of its own: it refers to dated events in a single timeline, and its key dates, the application date of each provision, the competent authority and the stage an enforcement case has reached are all derived from the records when a page is built. Two copies of a fact cannot disagree if there is only one.
Not knowing is kept apart from knowing that nothing exists. A field that has not been researched and a fact that has been researched but is not publicly determinable are different states, are shown differently, and an unknown is never counted as zero. Where no applicability rule covers a situation, the answer is not determined — never "probably not".
How the records are kept honest
Validators check the data, the markup, the translations and the evidence on every change, and the instrument pages are generated from the records rather than written by hand. Each record carries the date it was last verified, and review intervals depend on risk: a pending appeal is re-read sooner than a settled application date.
New sources can be proposed automatically, but nothing an automated agent finds reaches the site without a person deciding it should.
What this method cannot establish
The method makes the gaps visible; it does not close them. A substantial share of claims is not externally corroborated, and the evidence and sources page computes the current count on every load so that no document can drift from it. Verification dates are a compilation date: the field is per-record, the practice is not yet. Enforcement figures are indicative of magnitude, not audited. The validators check structure, not prose: a false sentence would pass every one of them. The Italian, French and Spanish translations have not been reviewed by a native speaker.
The full list is the known limitations section of the project's README, stated plainly because the site's own argument is that a record should say what it cannot support.
Source, data and history
The code, the datasets in data/*.json and the full change history are public in the
repository on GitHub. All of it may be reused
under the terms on the licence and reuse page.