Snapshot
Responsibility maps, interinstitutional coordination, risk decisions and evidence-based advice for EU digital services.
Module status
- •Track: EU specialist practice
- •Last verified: 2026-11-01
- •Scope: Independent training aligned to official notice C/2026/4668; official sources always prevail.
Institutional roles
For institutional definitions, use the existing EU Knowledge chapters on the Commission, two Councils, Parliament and other bodies. This chapter addresses a different question: how does a specialist turn technical evidence into a decision an EU organisation can lawfully take?
A proposal to deploy AI or change security controls passes through several kinds of authority. A system owner defines the service need. Engineering evaluates implementation. Security assesses threats and controls. Legal and data-protection functions assess the relevant rules. Procurement manages the purchasing process. The responsible management level makes decisions within its mandate. These contributions should meet in a recorded decision, rather than become disconnected approvals.
Job titles and organisational charts differ between institutions. Identify actual delegated responsibilities before assigning an approval. A technically persuasive recommendation does not authorise its author to accept every residual risk.
Competence and action
The legal architecture chapter explains conferral, subsidiarity and proportionality. Their practical consequence is that a technical capability does not itself create a legal mandate. Before recommending a monitoring tool, automated decision or data exchange, establish the permitted purpose, competent actor and legal instrument.
Separate the Union's power to adopt legislation from an institution's authority to operate a particular service. An organisation may have a valid security objective while a proposed collection of employee communications is still excessive or inadequately authorised. A supplier's ability to implement the collection does not resolve that issue.
Map the actors around a digital service
Use an actor map to answer four questions: who owns the outcome, who operates the control, who provides independent challenge and who must be consulted or informed? Include external providers and dependent organisations.
| Decision | Lead contribution | Evidence to retain |
|---|---|---|
| Define intended use | Business or service owner | Purpose, affected users, service boundaries |
| Approve architecture | Design authority and responsible management | Options, dependencies, threat model, exceptions |
| Evaluate personal-data processing | Controller with data-protection advice | Processing purpose, roles, necessity, safeguards |
| Accept a supplier | Procurement and technical evaluators | Criteria, comparable evidence, documented assessment |
| Accept residual risk | Authorised risk owner | Remaining exposure, conditions, expiry and review |
| Respond to an incident | Incident leadership with relevant functions | Timeline, actions, evidence, reporting decisions |
The table is a working model, not a universal institutional delegation scheme. Confirm the local rules. A consultant can supply analysis while the accountable organisation retains its responsibilities.
Understand specialist EU coordination
An operational issue may involve bodies whose names appear similar but whose mandates differ. ENISA supports EU cybersecurity policy, cooperation and capacity. CERT-EU provides cybersecurity services for Union entities under the institutional cybersecurity framework. The Interinstitutional Cybersecurity Board has a governance role under that framework.
In AI, distinguish the European AI Office within the Commission, Member-State authorities and the AI Board. Scientific advice, stakeholder consultation and enforcement are different functions. Sending an assessment to an advisory body does not transfer an organisation's deployment responsibilities.
Ask what kind of coordination is needed. Sharing a technical indicator with an incident-response partner differs from requesting a legal interpretation or escalating a service interruption to management. Identify the audience and the applicable sharing conditions before transmitting sensitive details.
Worked case: a shared document assistant
Three EU bodies want a common assistant that searches internal documents. The proposed benefit is faster retrieval. Each body holds some documents the others cannot access.
Begin with the service boundary. A shared interface does not justify a shared permission domain. Establish which organisation controls each dataset, how identities are represented and where retrieval authorisation is enforced. A document copied into a vector index remains subject to its access restrictions.
Next, assign decisions. Service owners agree measurable use cases. Security and engineering test isolation between tenants, service identities and administrative roles. Data-protection functions assess personal-data flows. Procurement requires evidence from the provider. Management decides whether the remaining risks are acceptable for a defined deployment scope.
Record the dependency between decisions. A favourable model-quality evaluation does not establish tenant isolation. A lawful purpose does not establish that the architecture enforces it. A compliant procurement procedure does not prove that recovery works.
The defensible recommendation might approve a restricted pilot with named datasets, separate access boundaries, a documented escalation route and a review before expansion. This recommendation specifies what has been established and what remains conditional.
Write advice a decision-maker can use
A technical note should explain the decision, evidence, uncertainty and consequence. Open with the action requested. Present credible options against the same criteria. Identify assumptions whose failure would change the recommendation.
For example: “Approve a limited pilot for public documents after retrieval filtering and audit logging pass acceptance tests. Defer confidential collections until access-control evidence is available.” This gives management an executable decision. “The system is generally secure” gives little basis for approval.
Use measurements with denominators and scope. “Ninety-eight per cent of tests passed” is incomplete without the test population, severity of failures and whether critical access boundaries were tested. A single failed isolation test can outweigh many successful cosmetic checks.
Coordinate delivery and change
Maintain a decision log, an action owner for each condition and a change-control route. If a supplier changes a model, subprocessor, hosting region or security feature, assess whether the previous evidence still applies.
For interinstitutional work, agree a common minimum set of artefacts: service description, responsibility map, data flows, threat assessment, incident contacts and exit arrangements. Common artefacts improve coordination while allowing each participant to meet its own obligations.
Distinguish disagreement about facts from disagreement about risk appetite. The first needs better evidence; the second needs an authorised decision. Repeating a technical meeting does not resolve a question that belongs to management.
Check your understanding
- A supplier accepts contractual responsibility for security. Can the institution stop assessing its own service risk? No. Contractual allocation must be supported by operational evidence and the organisation's own responsibilities.
- Two bodies share an AI interface. May either retrieve all indexed documents? Only if the relevant access rights permit it; shared infrastructure does not erase authorisation boundaries.
- An adviser identifies a serious unresolved issue. What belongs in the recommendation? The decision affected, supporting evidence, practical conditions and an accountable owner.
Sources and focused background
- •EU Knowledge: agencies, delegation and accountability: institutional background for delegated technical work.
- •Regulation 2023/2841: Union-entity cybersecurity, CERT-EU and interinstitutional governance.
- •European AI Office: current AI governance structure.
- •EDPS guidance on controllers and processors: responsibilities in Union-entity processing.