This summer I measured the 34 instruments of the EU digital rulebook on five dimensions, what they say, who enforces them, where their rules are written, what breaking them costs and how far they reach. A new proposal has arrived, and the same instruments can be pointed at it on the day it is published.
**
In 1845 Frédéric Bastiat wrote a (satirical) petition on behalf of the candlemakers of France. They asked the Chamber of Deputies for protection against a foreign competitor who was flooding the market with light at an impossible price, and they proposed a remedy, a law requiring every window to be shuttered. The competitor was the sun. Bastiat’s point was that a preference always looks like a gift to the producer it names, and that the bill is paid by everyone who would have used the cheaper light.
I thought of the candlemakers while reading Article 11 of the European Innovation Act, which the Commission presented on 9 September. The Act has two working parts. The first, 28 of its 41 articles, is a procedure code for public bodies that buy research and development, telling them to consult the market first, award several contracts in parallel, run the work in phases, weight innovation at 15% of the award, leave the intellectual property with the contractor, and admit only firms of European origin. The second, six articles, asks the EU Intellectual Property Office to build a voluntary framework for valuing patents and a platform for licensing them, so that a firm whose only asset is its IP can borrow against it. The Commission’s Joint Research Centre credits the package with up to 452 billion euros of additional GDP and 507,000 jobs over ten years.
It is a serious proposal, written by people who want what I want, which is a Europe where ideas become companies. It also arrives into a rulebook that already exists. Over five studies this summer I measured that rulebook, the 34 binding instruments of EU digital law, on five dimensions, the words they use, the institutions they create, the rules they leave to be written later, the price they attach to breaking them, and how far they reach. Those five measurements are a grid, and a new text can be laid on it the day it is published.
So I coded the Act, all 41 articles, 366 distinct rules, and laid it on the grid. On four of the five dimensions it reproduces the defect the corresponding study found. On the fifth it does something the corpus had never done in twenty-five years, and that is where the candlemakers come back.
1. What is in it
Four of the five dimensions can be reported quickly, because on each the Act does the thing the corresponding study found the rulebook already doing. The fifth takes longer.
New words for old things
The first study counted 1,400 definitions across the 34 instruments and found the same concepts defined differently from one act to the next. A new instrument can lower that number by borrowing or raise it by inventing. This one invents. Of its 28 definitions, 22 have no counterpart anywhere in the corpus. Exactly one, “SME”, is identical to an existing definition. “Economic operator” is defined differently from the four instruments that already define it. “Innovation” is defined here for the first time in twenty-five years of digital legislation, though not invented. The wording is lifted from Directive 2014/24/EU on public procurement, with the words “a new” deleted twice, so that a merely improved marketing or organisational method now counts where the older text required a new one. The Act cites no source for it, and the impact assessment’s own glossary reproduces it differently from the operative article.
Four definitions are not in the Act at all. “Innovative startup”, “innovative scaleup” and “innovative enterprise” were removed from the proposal after the Regulatory Scrutiny Board, the Commission’s internal quality check, issued two negative opinions on the impact assessment, and they return through a Commission Recommendation cited in a footnote. Four terms that decide whether a firm may tender, among them “control of a third country” and “substantive business operations”, are not defined anywhere.
No wires to the rest of the rulebook
The second study counted 328 distinct bodies and 440 coordination provisions across the corpus, of which 98 connect one instrument to another. Those 98 are what makes a rulebook a rulebook rather than a pile.
The Act adds 89 institutional assignments and 15 coordination provisions. Not one of the 15 connects a public buyer to a data protection supervisory authority, to a market surveillance authority, to a CSIRT, or to any other body created by the 34 instruments. Its channels run elsewhere, to the Commission under the Foreign Subsidies Regulation and to a committee of the EUIPO’s own founding Regulation. A public buyer applying this Act will handle personal data, cybersecurity requirements and security exclusions, and the Act tells it to comply with the GDPR, with the Cyber Resilience Act and with NIS2, without connecting it to a single authority that administers them. The one body the Act creates, the Competence Centre at the EUIPO, is denied legal personality, financial autonomy and decision-making powers by the article that creates it.
Nobody pays for breaking it
The fourth study went looking for the price of non-compliance across the corpus and found six instruments that attach no consequence to anything. This would be the seventh. Searching all 41 articles returns 26 consequences, 18 of them procedural steps a buyer takes against a tenderer. There is no fine, no periodic penalty, no Member State penalty clause, no review procedure and no supervisory authority. The phrase “Member States shall” does not occur once, so no Member State is obliged to designate an authority, to lay down penalties or to provide a remedy. The procurement Remedies Directives tie their review duty to contracts inside the 2014 directives, which is exactly the zone this Act was written to fill.
The asymmetry is the point. A firm that cannot document its ownership chain “shall be excluded”. A buyer that ignores the entire procedure faces nothing in the text.
The door that opens one way
The fifth study extracted the 273 scope rules of the corpus, and found eight distinct ways a firm can be caught, every one of them pulling foreign firms in. Twenty of the 34 instruments follow a firm across the border. Not one excludes a firm because of where it was incorporated or who owns it.
Article 11 would be the first. Public buyers “shall open the participation in R&D procurement only to” operators with origin in a Member State, or in a country whose procurement agreement with the Union covers research and development. The Union’s schedule under the WTO Government Procurement Agreement lists the services it opens and leaves research and development out, so the second category has no obvious member, and the Commission’s documents name none. Others enter through exceptions, when no listed supplier exists, when no suitable tender arrived in two years, or when the listed offer costs more than 20% more.
Origin then follows ownership. Under Article 12, a company incorporated in the Union without “substantive business operations” there takes the origin of whoever holds “dominant influence” over it. A buyer may go further on security grounds and admit only Union firms “not subject to control of a third country”. At least half the research, including the work of the principal scientists, must be performed in the listed countries. And a buyer may require that personal data stay in data centers there (Article 26(3)), a localization option the digital rulebook had declined to write for twenty-five years (Exhibit 2 reproduces the clauses and walks every route in and out).
The economics points the other way. Nicholas Bloom, Mirko Draca and John Van Reenen found that Chinese import competition raised patenting and productivity inside European firms. Maria Guadalupe, Olga Kuzmina and Catherine Thomas found that foreign acquisition raised innovation in the Spanish firms acquired. The Commission’s own impact assessment prices the preference at EUR 464 million in lost output, using a formula built on a study of Ukraine, and calls the result “a broad indicator rather than a precise forecast” (Exhibit 2).
Why the door was thought necessary
Why would a proposal reverse the corpus’s one consistent direction without saying so? The impact assessment answers the question by accident. It justifies the preference with a gap. “Both US and Asia (e.g. China) have a systematic approach”, it says, and “The EU lacks such an approach”. It concedes that “Europe’s strategic autonomy is already pursued by some sectoral legislation”, naming the Net-Zero Industry Act, the Critical Raw Materials Act and, once, the Chips Act.
It never mentions the digital rulebook. The GDPR, the Data Act, DORA, NIS2, the AI Act, the DSA and the DMA return zero hits in the 80,000 words of the assessment. Yet those are the instruments in which, as I documented in July in The paperwork of independence, Europe has been legislating sovereignty since 2014 through five mechanisms, from the legal representatives that twelve acts now conscript to the Data Act’s rule against foreign government access. The premise that Europe lacks a systematic approach holds for procurement law. It does not hold for European law .
That is the deeper finding, and it explains the other four. A text drafted without the corpus in view will invent words the corpus already has, build institutions the corpus cannot reach, and reverse a direction it does not know the corpus was travelling in.
2. What could have been featured
Is it fair to hold a procurement regulation against the whole literature on innovation? It would not be, if the Act claimed only to improve procurement. It claims more. Its general objective, in the Commission’s own words, is “to improve the functioning of the Single Market for innovation by reducing structural barriers to bring innovative solutions to the market”. It is called the European Innovation Act. And the 452 billion euros are attached to that general claim, not to the procurement chapter alone. An instrument that proposes to reduce the structural barriers to innovation in Europe invites the question of which barriers the evidence says matter, and its own two specific objectives, procurement and intellectual property, are the answer it gives.
What the evidence says works
There is a large literature on the same question. I extracted from it the drivers it identifies, checking every source for authors, year, title and venue before using it, and coded the Act against each. It covers two. It works against three, all forms of openness. It is silent on twenty, and the silence is measurable. Across the Act, its recitals, its memorandum and its 80,000-word impact assessment, 117,088 words in total, the terms for skilled immigration appear zero times, as do “foreign direct investment”, “size threshold” and “innovation principle”.
One comparison compresses it. In 2019 Nicholas Bloom, John Van Reenen and Heidi Williams reviewed the evidence on innovation policy for the Journal of Economic Perspectives and rated nine instruments. Three received their top score for net benefit: R&D tax credits, skilled immigration, and trade and competition. The Act is silent on the first two and works against the third. Its own two pillars do not appear in their table, and the word “procurement” does not occur in the article (Exhibit 3 sets out every driver with its sources).
I do not read this as proof that the Act’s pillars are wrong. Sabrina Howell on US research grants, and Enrico Moretti, Claudia Steinwender and Van Reenen on defense R&D, both find that public research money works. William Mann finds that patent collateral finances real innovation. The literature supports both ideas. It treats them as two items on a long list, and the Act treats them as the list.
What this means for competitiveness
Much of the procurement chapter is sound practice. Letting contractors keep their intellectual property, capping the financial capacity a buyer may demand at half the contract value, barring a requirement of prior experience unless the subject-matter justifies it, and awarding several contracts at once are improvements on what many national buyers do. A startup selling research to a public buyer will find the door easier to open, provided it is European.
The reservation is about the house. My July essay argued that the rulebook keeps European firms small not through any single duty but through its structure, 27 enforcement environments and a compliance layer that an incumbent absorbs and a young company cannot. Measured against that essay’s 33 propositions, this Act addresses none fully, partly addresses nine, is silent on nine, and adds to fifteen. It reduces none of the 27 environments. It repeals no Union obligation. It amends exactly one instrument, the EU trade mark Regulation, to give the EUIPO new tasks.
None of that requires the Act to be abandoned. Four of the five findings are drafting choices, and I have set out in the last exhibit the amendments that would answer them, article by article, along with the fourteen errors in the text as transmitted. They would take a committee a fortnight. The fifth finding, the door, is not a drafting matter and should be argued in public before adoption rather than after (Exhibit 4).
It also gives itself few means of finding out whether it worked. On the 14 criteria I proposed in Adaptive Regulation (European Journal of Risk Regulation, 2026) for whether a law can learn, it meets five, partly meets five and fails four. It has no duty to monitor its own effects in the procurement chapter, no body charged with proposing changes, and no actor other than the Commission who can start a revision. The memorandum’s entry under monitoring arrangements reads, in full, “Not Applicable”. The one instrument of regulatory learning in the package, the sandbox, is the one that was moved out of the Regulation and into a non-binding Recommendation.
**
THE AUDIT
Four exhibits follow. The first is open to every reader, and the other three are the reason this piece exists.
Exhibit 1, the free one, is the grid itself. Five rows, one per dimension, the figure from the 34 instruments on the left and the figure from the Act on the right.
Exhibit 2 reproduces Articles 11 and 12 in full and walks all seventeen routes through the door, the eight that let a firm in, the five that keep it out, and the four that let the Commission narrow the list further without a vote in Parliament. It gives the price the Commission puts on the door, 464 million euros a year, and the formula behind it, which rests on a study of Ukraine. It ends on Article 39, whose three lists of delegated powers match neither each other nor the text, with the consequence that Parliament and Council could not revoke the power to close the door to a third country.
Exhibit 3 took the longest to build and is the one I would defend hardest. Twenty-eight drivers of innovation drawn from 284 verified sources, and for each one what it requires in practice, how many studies stand behind it, how many of those cut against the reading I take, and what the Act does about it. Twenty of the twenty-eight appear nowhere in 117,088 words of Commission text. The terms for skilled immigration appear zero times, and so do the names of the AI Act, the Digital Services Act and the Digital Markets Act.
Exhibit 4 is the constructive one. The amendments that would answer four of the five findings before adoption, article by article, and the fourteen errors in the text as transmitted, starting with the fact that the proposal contains two articles numbered 10 and no Article 16, and a cross-reference to an Article 31(8) that does not exist. Every article citation in all four links to its page in the Commission’s own PDF.
Exhibit 1: How the Act fits the rulebook it joins
The five studies published this summer measured the 34 binding instruments of the EU digital rulebook on five dimensions. The same measurements can be taken on a proposal. This is the result.
Read down the right-hand column and one pattern repeats. On every dimension but the last, the Act reproduces the defect the corresponding study measured. On the last, it reverses the corpus’s one consistent direction.
Vocabulary. The corpus already contains 1,400 definitions, and the first study found the same concept carrying different meanings across instruments. A new act can reduce that count by borrowing, or raise it by inventing. This one invents. Of its 28 definitions, 22 have no counterpart in the 34 instruments, and of the six that do, five diverge from at least one existing definition. “Economic operator” is defined differently from the Cyber Resilience Act, the General Product Safety Regulation, the Product Liability Directive and the European Health Data Space. Four definitions, including “innovative startup” and “innovative scaleup”, are not in the Act at all but in Commission Recommendations, which is how the definitions the Regulatory Scrutiny Board forced out of the proposal returned to it by reference. One defined term, “innovation agency”, is never used again after the scope article. Four terms that decide whether a firm may tender at all, among them “control of a third country” and “substantive business operations”, are not defined anywhere.
Institutions. The second study counted 328 bodies and 440 coordination provisions, 98 of which connect one instrument to another. Those 98 are the wiring of the rulebook. This Act adds 89 assignments and 15 coordination provisions, and not one of the 15 connects a public buyer to a data protection supervisory authority, a market surveillance authority, a CSIRT, or any other authority created by the 34 instruments. Its channels run instead to the Commission under the Foreign Subsidies Regulation and to the trade mark committee of the EUIPO’s own founding Regulation. The one body it creates, the Competence Centre, is denied legal personality, financial autonomy and decision-making powers by the article that creates it. 93% of its assignments go to bodies that already exist, against 53% across the corpus.
Rules written elsewhere. The third study found 517 provisions that hand the rule to a later text. Counted the same way, this Act is modest, and the distribution is what matters. Its procurement chapter can operate on the day it enters into force. Its financing chapter cannot operate at all until the Commission adopts three implementing acts, none of which carries a deadline, and until the EUIPO builds a framework due four years out. The rules on regulatory sandboxes, the one instrument of experimentation in the package, were removed from the Regulation after the Scrutiny Board’s second negative opinion and placed in a proposed Council Recommendation with no review clause, to be implemented “as soon as practicable”.
The price of breach. The fourth study found six instruments in the corpus that attach no consequence to anything. This would be the seventh. Searching all 41 articles returns 26 consequences, 18 of them procedural steps a public buyer takes against a tenderer, and no fine, no periodic penalty and no Member State penalty clause. The public buyer is the party that imposes in 19 of the 26 rows and the target in none. The phrase “Member States shall” does not occur once, so no Member State is required to designate an authority, to lay down penalties or to provide a review procedure.
Reach. The fifth study extracted the 273 scope rules of the corpus and found eight ways a firm can be caught, all of them pulling foreign firms in. Twenty of the 34 instruments follow a firm across the border. Not one excludes a firm because of where it was incorporated or who owns it. This Act would be the first, and it adds a second novelty, an option for a public buyer to require that personal data be held in data centers inside the listed countries. The corpus had reached outward for twenty-five years without once drawing that line.
For the single market, this is the finding that ties the five studies to the new text. Each defect the series measured is a cost the rulebook imposes on a firm operating across the Union. A new instrument can reduce that cost by reusing the vocabulary, wiring itself to the existing enforcers, and carrying its own consequences. This one adds a vocabulary, stands beside the architecture, and carries none.
