Fifth and final study of the EU digital corpus for The Competition System. The first four measured what the 34 instruments say, who enforces them, where their rules are written, and what breaking them costs. This one asks the question that multiplies the other four. Every defect documented in this series scales with the rulebook’s reach, and the reach turns out to be the least standardized thing about it.
Maps used to mark the edge of the known world with monsters. The EU digital rulebook draws its edge in fragments, each instrument settling its own, and no map assembles them. So I created one. I analyzed the scope provisions of all 34 instruments, the articles that answer the only question every firm asks first, does this law apply to me, and I extracted every rule that draws a line, 273 of them, the lines that pull you in, the lines that let you out, the lines that decide which country holds you, and the lines that reach past the Union’s borders entirely.
The Brussels effect is usually argued. Anu Bradford’s thesis, that Europe exports its rules through the pull of its market, is discussed in terms of outcomes, the foreign firms that adopt EU standards worldwide because running two systems costs more than running one. This study takes the question one layer down, to the texts, and measures the legal reach itself, provision by provision, in the only place it is actually written. How many acts follow a firm across the border, on what trigger, with what hold on it once they arrive, and how the answer has changed across twenty-five years of drafting. What follows is a map of the Brussels effect as the legislator drew it, rather than as its consequences are inferred.
The 273 lines
The 34 instruments contain 273 scope rules (Exhibit 1 clusters them all). The largest single class, 72 rules, more than a quarter, consists of exclusions, the carve-outs for national security, research, open source, micro-enterprises, purely personal use and broadcasters. The EU digital rulebook spends more scope text saying whom it does not catch than whom it does. Another 36 rules answer a different question. Not whether the rulebook catches you, but which Member State gets you once it has. This is the main-establishment machinery this series met in the enforcement piece, the rules that send a covered firm to Dublin rather than Warsaw
Underneath every one of those 273 rules sits a trigger, i.e., what makes the law attach to a firm. Across the 34 instruments, I found eight distinct connecting factors, eight different answers to “what about me makes your law mine” (Exhibit 2 documents each with its provisions).
Establishment in the Union, the classical answer, still leads with 52 rules. Then the product placed on the Union market, the service provided in the Union, users located in the Union, goods or services offered to or targeted at the Union, connection to an EU infrastructure, and, in one act only, the output of a system used in the Union. Eighteen more rules stack several factors at once. The AI Act alone runs four factors in parallel, and its output rule is the longest arm in the corpus. It catches a provider or deployer located in a third country “where the output produced by the AI system is used in the Union” (Article 2(1)(c)). Nothing about the firm has to be European. A California company can sell its résumé-screening system to a Texas employer, run it on American servers, take payment in dollars, and still fall inside the AI Act because that employer applies the resulting scores when filling a post in its Paris office. What crossed the border was neither the product nor the money. It was the output.
A social network with no Union office is inside the DSA the moment it has recipients in the Union, inside the DMA if enough of them make it a gateway, and inside the TCO Regulation with its one-hour removal orders the moment it offers services here. A crypto platform abroad escapes MiCA’s authorization requirement only as long as the customer walks in unprompted, one marketing email and the reverse-solicitation shelter collapses. A Wisconsin gig platform is inside the Platform Work Directive for work performed in the Union “irrespective of their place of establishment or of the law otherwise applicable”. And a foreign vendor of hospital software is deemed by the EHDS to have put its system into service in the Union the moment it is offered as a service to anyone established here. None of these firms signed anything. The rulebook came to them.
The conscription clause
I use the term conscription clause for a provision that obliges a firm outside the Union to maintain a person or entity inside it, mandated to receive process, answer authorities and, in several regimes, bear liability on the firm’s behalf. 12 of the 34 instruments now contain one, which makes it the fastest-spreading clause in EU digital law (Exhibit 4 lists every regime). The GDPR invented the modern version in 2016. It stood alone until 2021.
Then the dam broke. The instruments that followed wrote eleven more, and the designs sharpened. The PLD makes the representative liable for the foreign manufacturer’s defective products, DORA inverts the technique and prohibits Union financial entities from using a foreign provider that, once designated critical, refuses to incorporate here, and the DSA adds the stick this series met in the price-list study, a firm with no representative can be pursued by every Member State at once.
The trend line behind that story is the cleanest in this entire series (Exhibit 8 charts it). Of the five instruments adopted between 2000 and 2015, none reached a firm without Union establishment. Not one. Of the ten adopted between 2016 and 2019, half did. Of the nineteen adopted since 2020, fifteen do, 79%. In one decade, reaching beyond the border went from unthinkable to the default drafting choice, and, as with the enforcement finding of the previous study, no treaty changed, no communication announced it, the drafting habits simply turned.
What changed with them is the toolkit. Establishment, the classical trigger, was never abandoned; thirteen of the nineteen instruments adopted since 2020 still use it. What changed is what got built around it. Users and targeting, the pair the GDPR invented, appear in no instrument adopted before 2016, in three of the ten adopted to 2019, and in eleven of the nineteen adopted since. The product placed on the Union market appears in six recent instruments and in none at all before 2020. The output of a system used in the Union appears exactly once, in 2024. Nothing was retired. Each generation kept every earlier trigger and added its own, which is the mechanical reason the number of ways to be caught has only ever risen (Exhibit 8 tracks each factor across the three generations).
The exclusions grew too, and faster, from 1.8 per instrument in the first generation to 2.5 in the newest. The rulebook reaches further and carves out more at the same time, which is the drafting signature of a legislator that wants breadth and fears its consequences in equal measure. It is also what a rulebook looks like when it grows by addition rather than by revision. I have argued separately that EU digital law should move from future-proof regulation, rules written to resist change, to future-responsive regulation, rules designed to be adjusted, with the modular architecture and the sensing and triggering mechanisms that make adjustment possible (Adaptive Regulation, European Journal of Risk Regulation, 2026). The scope layer is a case in point: eight triggers accumulated over twenty-five years, none ever revisited.
One question, eight answers
Here is the closing argument of this summer series. The eight connecting factors do not converge, they coexist, act by act, so the answer to “does EU digital law apply to me” is not one answer but many, on the same facts. A foreign AI firm can be inside the AI Act through its output, outside NIS2 for want of the right service category, inside the GDPR through monitoring, and outside MiCA until its first promotional email, simultaneously. Each boundary is defensible. Their sum is a perimeter no general counsel can state in one sentence, and the previous four studies each make it worse. The definitions differ across the line (study one), the enforcer differs across the line (study two), part of the rules are still unwritten across the line (study three), and the price of being wrong differs by Member State (study four). Reach is the multiplier of every defect this series has measured, which is why it is the closer (Exhibit 6 runs one firm across all the boundaries at once).
And yet something else is happening underneath. It is worth being precise about it, because the last two studies in this series point the same way. The price-list study found that the Union is increasingly setting penalty levels itself rather than leaving them to 27 legislatures. This study finds that the newest instruments converge on a shared playbook for reach, catch the firm through the market or the user, conscript a presence, sanction the refusal. On both dimensions the drafting is becoming more uniform, generation by generation, without anyone announcing a policy. That is the digital single market being built, quietly.
It would be a mistake to read that as the problem solved. Convergence on how to reach is not convergence on where reaching stops. The stopping rules remain 34 local inventions, the exclusions, the reverse-solicitation shelters, the deeming fictions (Exhibit 5 collects the strangest, including the act that switches its own longest arm off for the military, and the one that catches a token because of the currency it references). The right conclusion is narrower and more useful. Two of the five features I have measured are moving in the direction of a single market, which argues for accelerating that movement rather than congratulating it. The other three, the vocabulary, the institutional architecture and the rules still written elsewhere, are not moving in the right direction. A rulebook can converge on its reach and still fail the firm that has to comply with it, if the words, the enforcers and the missing texts stay where this series found them.
*
The audit below (about 3,800 words) assembles the rulebook’s outer edge in one place. The census of all 273 scope rules (Exhibit 1). The eight connecting factors, each with its provisions and its reach (Exhibit 2). The 20 instruments that follow firms across the border, and the 14 that do not (Exhibit 3). The twelve conscription regimes, who must appoint, who bears liability, what refusal costs (Exhibit 4). The stopping rules and the fictions, where the longest arms end (Exhibit 5). One hypothetical foreign firm walked across every boundary at once (Exhibit 6). The which-country layer that decides who holds your file once you are in (Exhibit 7). The trajectory of each connecting factor across three legislative generations (Exhibit 8). Every claim is quoted from the operative articles.
The audit answers a question that is asked constantly and, until now, answered by intuition. A firm outside the Union wants to know whether the rulebook has arrived at its door, which act brought it, what it must now maintain in Europe, and whether the boundary it is standing behind is stable. Those answers exist, but they are distributed across 34 texts, which is why the usual advice about EU reach is delivered as a feeling rather than a list. The exhibits are the list. They took five studies and a corpus to build, they are current to the texts as adopted, and they are as far as I know the only place the whole perimeter is written down in one document.
Let me conclude by saying this. Jorge Luis Borges, the Argentine writer, has a one-paragraph story about cartography. In it, an empire’s mapmakers grow so devoted to precision that they draw a map on the same scale as the empire itself, covering the territory point for point. The map is perfect and useless, and the next generation abandons it to the desert. The story is usually read as a warning against models that try to reproduce reality instead of explaining it.
The EU digital rulebook has produced the opposite curiosity. Its territory has no map at all, not because the borders are secret, but because each of the 34 acts draws its own and none of them is drawn on top of the others. The last four studies in this series measured the words, the institutions, the missing rules and the prices. This one measures the border itself, and the exhibits below are the closest thing to that missing map I can build from the texts as they stand.
