Snapshot
Apply digital law to real services: scope, actors, amendments, reporting triggers and testable compliance evidence.
Module status
- •Track: EU specialist practice
- •Last verified: 2026-11-01
- •Scope: Independent training aligned to official notice C/2026/4668; official sources always prevail.
Ordinary legislative procedure
The EU Knowledge chapter on lawmaking explains proposals, readings and trilogues. Here the task is to assess what a legal development changes for a digital service. A proposal, political agreement, published regulation and applicable obligation represent different stages. A supplier presentation may blur those stages; a specialist's recommendation should identify them.
For each material claim, record the instrument, provision, version, affected actor and relevant date. “The EU has agreed new AI rules” is insufficient evidence for changing a production control or postponing a compliance task.
Acts and implementation
Use the legal architecture reference for the definitions of regulations, directives, decisions, delegated acts and implementing acts. Apply the distinction to an actual obligation: NIS2 is a directive with national implementation, whereas the institutional cybersecurity regulation addresses Union entities directly.
A basic act may be supplemented by later delegated or implementing measures. A technical requirement found in a later measure must be read within that measure's legal basis and scope. Commission Implementing Regulation 2024/2690, for example, sets requirements for specified categories of entities; it is not a universal list of duties automatically imposed on every organisation.
Use a repeatable legal-reading method
Read in a sequence that reduces false assumptions:
- Identify the object and scope, including exclusions.
- Identify the regulated actor and activity.
- Read the operative obligation and relevant definitions.
- Check exceptions, thresholds, dependencies and transitional provisions.
- Check amendments, application dates and supplementary measures.
- Translate the result into a control, owner and evidence requirement.
Recitals help explain context and purpose. Operative provisions establish duties. A guidance document may clarify interpretation or offer examples without having the same legal status as the underlying instrument.
Keep legal uncertainty visible. If classification depends on a factual question that has not been resolved, obtain that fact or specify a conditional conclusion. Do not hide an unresolved premise behind confident language.
Distinguish the dates that matter
Publication is the official release of a measure. Entry into force establishes when it becomes part of the legal order. Application dates determine when particular provisions must be followed. Transitional arrangements may depend on when a product was placed on the market, substantially modified or put into service.
The CRA illustrates why a single “start date” is misleading. Manufacturer reporting obligations began applying on 11 September 2026, while most product requirements apply from 11 December 2027. A manufacturer cannot postpone a current reporting duty by citing the later general date.
AI law also needs a version-aware reading. The Commission reports that the AI Omnibus entered into force on 27 July 2026 and changed the implementation timetable. Verify the current legal text and the provision being discussed before using dates from an older slide deck.
For a project decision, write a timeline with one line per applicable obligation. Include the source, trigger, owner, required evidence and review date. This is more useful than a general statement that a regulation “applies in 2026”.
Worked case: one incident, several legal questions
A Union body uses a supplier's document service. A vulnerability permits unauthorised access, and some files contain personal data. The supplier also sells the affected software as a product.
Do not start by choosing one law for the whole event. Separate the actors and activities. The Union body assesses its institutional cybersecurity obligations and the applicable personal-data rules. The supplier assesses its own obligations, which may include product-security or other sectoral requirements. The contract establishes notification and cooperation arrangements but does not replace statutory duties.
Build a small matrix:
| Question | Evidence needed |
|---|---|
| Who experienced the incident? | Affected legal entities and services |
| Which systems and data were involved? | Scope, access paths, data categories |
| Which reporting triggers are met? | Applicable provisions and known impact |
| When did each actor become aware? | Dated incident records |
| Who reports to whom? | Authority, recipient and contractual contacts |
| Which facts remain uncertain? | Investigation owner and next update |
The correct response can involve parallel workstreams. A cybersecurity notification does not automatically satisfy a personal-data breach requirement, and a supplier's notification does not necessarily discharge the customer's duties.
Turn legal requirements into testable controls
“Provide appropriate access control” is too broad for an acceptance test. Identify the protected resource, authorised roles, enforcement point, exceptional access, review process and retained evidence.
Similarly, a duty to maintain documentation needs a named owner, an update trigger and a retrievable record. A duty to monitor needs telemetry, thresholds or review criteria, an escalation route and evidence that someone acts on findings.
Distinguish a legal minimum from a stronger internal requirement. An institution may choose an additional safeguard because its risk warrants it. Describe that safeguard as an organisational decision rather than attributing an invented requirement to EU law.
Judicial and enforcement context
For the roles of courts and infringement proceedings, use EU Knowledge: the CJEU. In project work, the immediate lesson is traceability: preserve the facts and reasoning behind a decision so that an authorised reviewer can understand how the applicable rule was used.
Legal advice, procurement review, data-protection supervision and technical assurance answer different questions. An assessment that meets one purpose should not be presented as approval for every other purpose.
Common reading errors
- •Treating a draft or press announcement as the current operative provision.
- •Reading an exception without its qualifying conditions.
- •Applying a requirement to the wrong actor because both organisations use the same technology.
- •Assuming a voluntary standard automatically proves legal compliance.
- •Copying reporting deadlines between regimes without checking triggers and recipients.
- •Treating a lack of known harm as proof that an obligation cannot apply.
Check your understanding
- A technical guidance document cites an implementing regulation. What should you check first? Whether the regulation covers the entity and activity under review.
- A new system is not high-risk under the AI Act. Does that establish compliance with all EU law? No. Data protection, security, procurement and other rules may still apply.
- What makes a legal requirement usable in delivery? A clear interpretation tied to an owner, control, evidence and update trigger.
Primary sources
- •EUR-Lex: official acts, amendments and consolidated texts.
- •NIS2 technical implementation guidance: scope and evidence examples.
- •CRA reporting guidance: current reporting duties.
- •AI Omnibus update: changes requiring current-version checks.
Judicial and enforcement context
National courts apply Union law. The preliminary-ruling procedure lets them ask the Court of Justice about interpretation or validity. The Commission may pursue an infringement procedure when it considers a Member State has failed to fulfil Treaty obligations.