This is part two of the summer series on the digital single market. It maps the enforcement architecture of EU digital rulebook. Part one audited the 1,400 definitions in the same corpus.
**
Montesquieu spent a lifetime showing that laws matter less than the spirit in which they are administered. Brussels has spent twenty-five years testing the proposition. 34 digital instruments, and every one of them opens with the same solemn vow, to improve the functioning of the internal market. The vow is sincere. But a law does not enforce itself, any more than a promise keeps itself; behind every article stands a machinery of boards, agencies, authorities… and it is the arrangement of this machinery, not the eloquence of the recitals, that decides whether 34 instruments compose one market or a mosaic of dozens.
Well, that machinery can be counted. I analyzed 34 binding instruments of the EU digital rulebook, from the eCommerce Directive of 2000 to the European Health Data Space Regulation of 2025, and recorded every institution assigned a function under any of them, with the operative provision quoted. I also recorded every provision that allocates or coordinates authority between institutions, classified by type. The result is an empirical map of the rulebook’s enforcement architecture.
A map of enforcement machinery may seem far from the concerns of this newsletter. It is not. Tocqueville foresaw a power that would cover society with “a network of small, complicated rules, minute and uniform.” What he did not say is who would pay for the netting. Who pays is a competition question. The net costs the same to a firm of three as to a firm of three hundred thousand. It is a fixed cost, and a fixed cost is never neutral. It selects. It selects quietly, without a decision, without an author, in favor of whoever is already large enough to carry it. The rules are addressed to everyone. The bill is not.
I. What the institutions are asked to do
Start with the raw counts, because they discipline everything that follows. The 34 instruments assign functions to institutions 1,068 times in operative text. Count every authority, board, office, network and body those texts name, and the list runs to 672 different names. Many of the names describe the same institution wearing different hats from one law to the next; group them and 328 distinct institutions remain, some of them specific bodies such as ENISA, others categories that every Member State fills in its own way, such as the ubiquitous competent authority. Every one of the 34 laws gives at least one task to the European Commission. Forty-six other supervisors, counted the same way, receive tasks under more than one law.
The rulebook also coordinates. I found 440 provisions allocating or arranging authority between institutions. The complaint one hears is that the EU legislated in silos and forgot to connect them. The texts do not support it. They connect constantly.
For the rest, three profiles emerge from the 1,068 assignments, and each one carries part of the answer.
The first profile concerns the tasks. I classified every assignment against a fixed set of functions, from rulemaking at one end to sanctioning at the other. The three most frequent functions in the EU digital rulebook are exchanging information, advising… and coordinating. Together, they appear more than twice as often as investigation, adjudication and sanctioning combined. Supervision sits in between. Dispute resolution comes last of the whole set.
Read that back slowly. Europe’s digital institutions are asked, more than anything else, to tell each other things.
The second profile concerns where the institutions come from. A slight majority of all assignments hand a new task to a body that already existed. For every ten tasks handed out, roughly one comes with a new body built for it; the other nine go to bodies that already exist or that Member States must pick. What the new laws do create, reliably, is committees. The audit below lists the coordination boards, and there are more of them than there are instruments giving anyone the power to fine.
The third profile concerns where the institutions sit. Assignments to Union-level bodies outnumber assignments to national ones, in a body of law whose enforcement is, on paper, mostly national. A reader can hold that fact next to the phrase single market and draw their own conclusion about which level is accumulating the paper and which level does the work.
What does this mean for the single market? Most of these instruments apply to a firm wherever it operates, including in a single Member State. The firm answers first to its national authorities, and above them sits a Union layer of boards and agencies whose main output is opinions. Opinions do not converge on a single answer, and a market is single to the extent that answers are. On these counts, the Union is building procedure faster than it is building decisions.
II. Coordination without decision
The 440 coordination provisions sort into a fixed set of mechanism types, from the one-stop-shop at one end to the flat statement that an EU decision prevails at the other. Their distribution repeats the lean of Section I, so I will not restate it. The finding sits at the binding end of the scale.
Binding mechanisms, meaning dispute resolution, supremacy of an EU decision and the one-stop-shop, account for about one in eight of the 440. The rulebook is thick with channels and thin on arbiters.
Where the binding mechanisms do appear, they cluster in two places. The first is personal data. Whenever a newer law touches it, the law hands the question back to the authorities the GDPR created. The Data Act does this, and so do the Data Governance Act, the health-data regulation, the AI Act and the Platform Work Directive. Five instruments, one deference, always in the same direction. The second cluster is older than the digital rulebook and sits in telecoms, where the Commission can veto a national regulator’s draft decision, alone in one configuration and jointly with BEREC in another. Both provisions are reproduced in the audit below, because almost nothing else in the 34 instruments looks like them.
Then there are the silences, and two of them are worth the subscription on their own. The Digital Services Act (Regulation 2022/2065) and the Digital Markets Act (Regulation 2022/1925) are enforced out of the same building in Brussels, often against the same companies, yet neither contains a clause coordinating with the other. I had both texts searched in both directions and recorded the absence as a verified finding, not an inference. And the two regimes that define strong authentication, PSD2 (Directive 2015/2366) for payments and eIDAS2 (Regulation 2024/1183) for the new European identity wallet, are bridged by nothing but a recital.
Why does the DSA-DMA silence matter, given that both are enforced by the same Commission? Because the corpus itself treats situations like this as needing rules. That is what the 440 coordination provisions are for, and the DMA uses them; its High-Level Group convenes six other regulatory networks. Measured against the drafters’ own method, the DSA’s absence from that list is a gap. And the gap has content, because the two regulations reach the same design decisions. A choice screen the DMA requires can raise dark-pattern and minor-protection questions under the DSA. A recommender adjustment demanded by DSA risk mitigation changes the very rankings the DMA polices for self-preferencing. When one decision answers to two proceedings, something must say whether findings carry across, which remedy yields, and whether a second penalty may price the same facts twice. Nothing does. The Court’s ne bis in idem case law patrols the outer boundary, but a constitutional backstop is not an allocation.
That is the single-market cost of coordination without decision, stated concretely. Where two authorities hold the same file and the law obliges them only to keep each other informed, nothing prevents them from reaching opposite conclusions, and nothing says whose conclusion prevails. A firm can satisfy one authority and still be pursued by the other for the same conduct. It cannot read its position off the page. It discovers it, authority by authority, and discovery of that kind is a cost that falls hardest on the firms least able to price legal uncertainty.
III. One instrument, many supervisors
Sections I and II counted the whole rulebook at once. The next question is how the architecture looks one instrument at a time.
For each instrument I counted how many different kinds of authority hold supervision over it. The count is of types, not bodies, and the distinction matters. The GDPR is supervised by one type, the data protection authority, instantiated twenty-seven times across the Member States. The AI Act is supervised by fifteen types at once. Market surveillance authorities, notifying authorities, data protection authorities for some uses, financial supervisors for others, the AI Office for general-purpose models. Counted this way, the AI Act is the most crowded instrument in the corpus, and its crowding measures something the GDPR’s model avoided. A firm under the GDPR faces many copies of one supervisor. A firm deploying one AI system can face several different supervisors whose competences meet inside a single product.
And when all five complexity indicators are read together, the heaviest instrument of the 34 is not the AI Act at all. It is the health-data regulation of 2025, the youngest text in the corpus, which names sixty-one distinct bodies in its operative provisions, more than the GDPR and the DSA combined.
The direction of travel is measurable, not asserted. The instruments of the early 2000s named a handful of bodies each. The GDPR raised the ceiling to twenty-seven in 2016. The four heaviest instruments in the corpus, all adopted since 2022, sit between forty and sixty-one. The audit below sets out the full progression, instrument by instrument, with adoption dates.
Whether a crowded field amounts to fragmentation depends on whether someone allocates. So I traced, for every overlap the matrix surfaced, whether any provision decides who prevails. The personal-data seam is handled well, five times over, and it is the only seam handled that consistently. Four seams carry nothing at all. The DSA and the DMA regulate the same platforms with no clause connecting their enforcement. The eIDAS2 wallet and PSD2 both define strong authentication, one obliging firms to accept the wallet, the other setting the standard payments must meet, with no provision saying that the first satisfies the second. Ranking transparency is imposed four times over, by the DMA, the P2B Regulation, the DSA and consumer law, each version with its own supervisor and no rule for reading the four together. And a single security incident can trigger notification duties under five regimes, each with its own form, deadline and recipient, and no common entry point. Firms sit on all four seams today. The audit below reproduces, for each, the provisions that create the overlap and the verification that found no rule resolving it.
Plural supervision is not the same thing as strict supervision. Fifteen authorities over one instrument allow fifteen readings of it to coexist until a court settles the point, and that settlement sits years away. In the meantime each reading is somebody’s compliance program.
IV. The single market, measured
The three profiles converge on one question, which is the one this publication cares about.
In a functioning single market, a firm can ask a simple question and receive a single answer. Which authority supervises my activity, and under which procedure? Across these 34 instruments the answer depends on the instrument, and behind most instruments it then depends on the Member State.
Nineteen instruments assign functions to a body called only a competent authority, and nothing in the corpus obliges a Member State to unify those designations, or even to publish a map of them. Multiply nineteen labels by twenty-seven Member States before counting the sectoral splits. The generic label is the single largest authority family in the dataset.
The claim has to stay narrow to stay true. The corpus does not forbid consolidation, and several Member States have merged designations on their own initiative. What the texts themselves show is more limited, and holds regardless. After twenty-five years and 34 instruments, the question of who enforces remains open in the law, and the newest instruments leave it more open than the older ones did. Whatever the direction of travel is, it is not convergence.
Measured against this dataset, a completed digital single market has a recognisable shape. New instruments would name their enforcers instead of leaving designations open. Coordination clauses would include mechanisms that bind. Filings that today go to five authorities would go through one entry point. No instrument adopted since 2022 moves any of the three numbers in that direction, and nothing currently on the table does either. Every layer of this architecture had its reasons. Added together, the layers still do not make a market.
All in all, there is something very European about this architecture, in the way a formal garden is very French. Every hedge was planted for a reason. Every path is individually defensible. Stand at any point and the design around you is impeccable. It is only from above that you notice the paths do not connect, and that the garden, taken as a whole, leads nowhere in particular. The treaties promised a market. What has been built, so far, is a garden of authorities, 328 of them, each tending its own parterre. It can be admired. It cannot yet be crossed.
**
The audit that follows contains the architecture, counted:
The full function census, in absolute numbers;
The designation and territorial breakdowns, with shares;
The table of authorities holding mandates under several instruments, and the table of the instruments supervised by the most authorities;
The coordination mechanisms with their frequencies and the binding share computed. The provisions that actually decide, quoted;
The complexity ranking on five stated indicators, instrument by instrument, with the progression over time;
The four seams that carry no mechanism at all, each verified in both directions.
Readers inside an institution will find the map of who else holds their files, and under which duty. Readers advising firms will find the questions the texts leave unanswered, which is where client exposure lives. Researchers and legislative drafters will find a measured baseline against which the next instrument can be scored. These are the numbers behind every claim above.
