Loading the institutional map, with its filters. Until it arrives — or without JavaScript — this is the index of all 21 bodies and their competences:
- European Commission EU institutionLegislates (across the rulebook: Right of legislative initiative); Issues guidance (across the rulebook); Supervises (DMA, exclusive: Sole enforcer of the DMA); Designates (DMA, exclusive: Gatekeeper designation decisions); Imposes fines (DMA, exclusive); Supervises (DSA: VLOPs and VLOSEs only. National Digital Services Coordinators supervise everything below that tier); Designates (DSA, exclusive: VLOP and VLOSE designation); Imposes fines (DSA: VLOPs and VLOSEs only); Issues guidance (AI Act); Investigates (NIS2: Infringement proceedings against Member States for failure to transpose. Not supervision of entities).
- DG CONNECT — Directorate-General for Communications Networks, Content and Technology Directorate-GeneralSupervises (DSA: Houses the Commission’s DSA supervision and enforcement team for designated very large online platforms and search engines (Directorate F, Platforms Policy and Enforcement)); Investigates (DMA: Half of the joint DG COMP–DG CONNECT team responsible for implementing and enforcing the DMA).
- DG COMP — Directorate-General for Competition Directorate-GeneralInvestigates (DMA: Half of the joint DG COMP–DG CONNECT team responsible for implementing and enforcing the DMA); Investigates (TFEU, exclusive: Article 102 TFEU antitrust enforcement, which runs alongside the DMA rather than instead of it).
- AI Office — European AI Office EU body or officeSupervises (AI Act, exclusive: General-purpose AI models under Chapter V); Issues guidance (AI Act: Including the GPAI Code of Practice process).
- EDPB — European Data Protection Board Network of national authoritiesCoordinates (GDPR: Consistency mechanism and dispute resolution between national authorities); Issues guidance (GDPR); Advises (GDPR: Opinions on legislative proposals); Issues guidance (DSA: On the DSA–GDPR interface).
- EDPS — European Data Protection Supervisor EU body or officeSupervises (GDPR, exclusive: Supervises the EU institutions themselves, under Regulation (EU) 2018/1725 rather than the GDPR); Advises (GDPR: Opinions on legislative proposals, including against the Commission's own).
- ENISA — European Union Agency for Cybersecurity EU agencyCoordinates (NIS2); Issues guidance (NIS2); Coordinates (CRA: Establishes, manages and maintains the single reporting platform; receives manufacturers' notifications alongside the coordinating CSIRT).
- CJEU — Court of Justice of the European Union CourtInterprets (across the rulebook, exclusive: Definitive interpretation of Union law, including on preliminary reference); Hears appeals (NIS2, exclusive: Infringement actions against Member States, including financial sanctions).
- General Court — General Court of the European Union CourtHears appeals (DMA: Actions for annulment against Commission designation and non-compliance decisions); Hears appeals (DSA: Including the supervisory-fee decisions).
- European Parliament EU institutionLegislates (across the rulebook: Co-legislator under the ordinary legislative procedure).
- Council — Council of the European Union EU institutionLegislates (across the rulebook: Co-legislator under the ordinary legislative procedure).
- National DPAs — National data protection supervisory authorities National authoritySupervises (GDPR: Each in its own Member State; cross-border cases are led by the main-establishment authority under the one-stop-shop); Investigates (GDPR); Imposes fines (GDPR).
- Irish DPC — Data Protection Commission (Ireland) National authoritySupervises (GDPR: Lead supervisory authority for most large platform controllers with their main establishment in Ireland); Imposes fines (GDPR).
- AP — Autoriteit Persoonsgegevens (Netherlands) National authoritySupervises (GDPR); Imposes fines (GDPR).
- CNPD — Commission nationale pour la protection des données (Luxembourg) National authoritySupervises (GDPR); Imposes fines (GDPR).
- Garante — Garante per la protezione dei dati personali (Italy) National authoritySupervises (GDPR); Imposes fines (GDPR).
- AEPD — Agencia Española de Protección de Datos (Spain) National authoritySupervises (GDPR); Imposes fines (GDPR).
- Digital Services Coordinators — National Digital Services Coordinators National authoritySupervises (DSA: All intermediaries below the VLOP/VLOSE tier, in the Member State of establishment); Coordinates (DSA: Vetting of researchers and transmission of Art. 40(4) data-access requests).
- National competent authorities — National competent authorities designated under sectoral instruments National authoritySupervises (Data Act: Enforcement is national and penalties are set by Member States); Supervises (NIS2: Essential and important entities in the Member State); Supervises (CRA: Market surveillance authorities); Supervises (AI Act: AI systems other than general-purpose AI models, which sit with the AI Office).
- ESAs — European Supervisory Authorities (EBA, EIOPA, ESMA) EU agencySupervises (DORA: Designate critical ICT third-party service providers through the Joint Committee; the ESA responsible for the financial entities with the largest share of total assets among a provider's users is its Lead Overseer).
- Member States — Member States of the European Union National authorityTransposes (NIS2, exclusive: Transposition deadline 17 October 2024); Transposes (CER, exclusive: Same transposition deadline); Transposes (Revised PLD, exclusive); Imposes fines (Data Act: Penalty levels are set nationally rather than by the Regulation).