Third study of the EU digital corpus for The Competition System, after the vocabulary of the 34 instruments and their enforcement architecture. This one asks where the operative rules come from. The Competition System covers what shapes competition. A rulebook whose content arrives in installments shapes it twice, once through the rules and once through the cost of watching them arrive.
**
Some furniture arrives as a flat box and a promise. The EU digital rulebook does just that. Its 34 main instruments sit on EUR-Lex, free, in twenty-four languages, from the eCommerce Directive of 2000 to the Health Data Space Regulation of 2025. One would expect to find the single market fully assembled, since that is what each of them announces in its opening recital. What one finds instead, on actually reading all 34, is the frame and an assembly notice. The shelves come later, by delegated act, by implementing act, by harmonized standard, drafted by other hands on another calendar. So I started cataloging the missing shelves, and ended up with 517 of them. This means the EU legislator, 517 times, decided that the rule would be written later, by someone else, under a different procedure.
The anatomy of the 517
The number alone says little, so here is its structure (more details in Exhibit 1). Of the 517 calls for outside norms, 292 are mandatory, the text says “shall adopt”, not “may”. Of the norms summoned, 287 are binding law and another 36 carry a presumption of conformity, the quiet mechanism by which following a technical document becomes a legal defense.
So, the logical next question is what can a firm do before the summoned text arrives? It has a measured answer (more details in Exhibit 2). For 291 of the 517, the underlying obligation operates on its own and the outside norm refines it. For 132, it operates only partially. And for 94, nearly one in five, the obligation is simply inert until a further text issues; the legislative act is a promise with a blank where the content should be. This matters because a firm subject to one (or several) of those 94 obligations cannot buy legal certainty at any price, however well advised, until someone else finishes writing the rule.
Now, one may think that, at least, most of this must be simple paperwork. It is not (more details in Exhibit 5). I classified each of the 517 provisions by what the summoned norm is empowered to write. Process, the formats, templates, procedures, channels and fees, accounts for 173 of the 517, one third. Another 268 write the content of duties, what a covered firm must actually do or show. And 76 (1 in 7) can move the perimeter of the regime itself, who or what is covered at all. 60 of those 76 perimeter powers summon binding acts.
Let me give you some examples. The list of uses that make an AI system high-risk under the AI Act can be rewritten by the Commission outside the ordinary legislative procedure. So can the compute threshold that decides which general-purpose models face the strictest regime in the world. The list of products that cannot be sold in Europe without cybersecurity certification, the heaviest burden in the Cyber Resilience Act, is a delegated act. The list of public datasets every administration must give away free of charge is an implementing act. Whether personal data may leave for Washington or Delhi is an implementing act. What a crypto firm must file to obtain the authorization MiCA demands sits in drafts from ESMA. Each of those decisions is the kind a parliament exists to make, and each was made, or will be made, somewhere else.
Two drafting styles
The dependence of this shadow EU rulebook is not evenly spread across EU primary regulation (more details in Exhibit 3). Six instruments hold roughly half of it. MiCA leads with 57 calls, every single one mandatory, a regulation whose authorization regimes state what applicants must show while the content of the showing sits in drafts from ESMA and EBA (more details in Exhibit 4). The AI Act follows with 47, then eIDAS2 with 45, a regulation that mandates a European Digital Identity Wallet whose technical identity is established by implementing acts adopted after it. The Health Data Space carries 39, including eleven provisions that cannot apply at all before the Commission acts, the most of any instrument.
At the other end sits the instrument that proves the style is a choice (more details in Exhibit 8). The 2024 Product Liability Directive, adopted in the same legislative season as the AI Act, contains no empowerment whatsoever. Zero. A complete liability regime, written once, in full, in the text. The DMA makes the same point differently. None of its twelve calls for outside norms is mandatory, nine are optional and three await a market investigation, and none is needed to activate anything; Articles 5, 6 and 7 apply of their own force. Whatever explains the delegating style of MiCA and the EHDS, it is not the era, the subject matter’s novelty, or some general truth about modern lawmaking. Two 2022-2024 instruments demonstrate the alternative.
And the choice is being made more and more often (more details in Exhibit 7). An instrument adopted between 2000 and 2015 made 7 appointments with outside texts on average. One adopted between 2016 and 2019 made 11. One adopted since 2020 makes 20. The medians tell the same story, 5 before 2020 against 16 after, so the rise belongs to the generation, not to two or three outliers, and the mandatory share holds near 60% throughout. Each legislative wave enlarges the rulebook behind the rulebook faster than it enlarges the rulebook.
The bill, in two currencies
Why should a newsletter about competition care about the EU’s shadow rulebook?Because a rulebook that arrives in installments is a fixed cost with a subscription model. A firm subject to five of these instruments is not watching five texts. It is watching the workstreams those texts have opened, the drafts, the consultations, the endorsement procedures, and it is watching them continuously, because 292 of the installments are mandatory and therefore coming. Large firms staff this. They sit in the standardization committees, answer the consultations, and read the drafts before the drafts are law (see Exhibit 6). The price of knowing the law is a Brussels monitoring operation, and that price does not vary with revenue. Fixed costs select, quietly, without a decision and without an author, in favor of whoever is already large enough to carry them.
It matters to the DSM for a reason the recitals never state. Between the day an obligation enters into force and the day its content arrives, the uniform rule is not uniform. Each mandatory call opens such a waiting period, and the rulebook has at least 292 of them built in. Inside each one, the question the missing text should settle gets answered locally instead, a national authority publishes interim guidance here, a supervisor takes a provisional position there, firms follow their lawyers’ best guess, and the same provision is read one way in Paris and another in Warsaw until the summoned act closes the debate. A market is single when its rules are knowable everywhere at once. This one is knowable in installments, on a calendar the annexes set years ahead, which means the completion of the single market is not an event that happened in 1993 or will happen with the next regulation. It is a backlog.
The audit below is the part I would keep to myself if I sold advice by the hour. It opens with the full census by legal form, author and binding force (see Exhibit 1). Then comes the dependence test, which separates the rules a firm could follow today from the rules that do not yet have content (see Exhibit 2). This is the table a general counsel needs to tell the board what is law and what is an appointment. The rest is built for specific readers. A compliance team can rank its exposure across all 34 instruments in an afternoon (see Exhibit 3). A counsel in finance will recognize the skeleton statute from the inside; MiCA alone carries 57 mandatory appointments (see Exhibit 4). Exhibit 5 lists the 30 dormant perimeter powers that can pull a firm into a regime, or shut it out of one, on a trigger. And a policy team can use Exhibit 6 to decide which drafting rooms are worth a seat before the next consultation closes. Every claim is quoted verbatim from the operative articles. The method, including the blind re-extraction test I ran before publishing, is at the end.
Diderot thought an encyclopedia could hold the whole of useful knowledge, on the honest condition that it would never be finished. Brussels has built the inverse object, a rulebook that is finished and yet not whole. The 34 volumes are free, as promised. The appendix is where the obligations live, and the appendix is by appointment. What follows is the appendix.
