# What a national skill must add on top Status as at 2026-08-05. This skill is the EU baseline. It is deliberately incomplete for any single member state. This file lists, per instrument, exactly what the national layer supplies — so that a `legal-de`, `legal-fr`, `legal-it` or any other national skill knows what it owns, and so that this skill never claims to answer a question it cannot. ## The test | Instrument type | Reaches the user | National skill owns | |---|---|---| | **Regulation** | directly, identically, from the date in the regulation itself | the supervisory authority, the penalty procedure, and any express member-state option in the text | | **Directive** | only through the national transposing act | **the operative rule itself** — period, threshold, wording, remedy — plus everything above | Art 288 TFEU. A regulation is binding in its entirety and directly applicable in all member states. A directive is binding as to the result to be achieved upon each member state to which it is addressed, but leaves to the national authorities the choice of form and methods. A directive that has not been transposed cannot be relied on by one private party against another — **Case C-91/92 Faccini Dori**, where the Court refused horizontal direct effect. ## Regulations — narrow national layer ### GDPR — Regulation (EU) 2016/679 The substance is identical everywhere. The national skill must supply: - **the supervisory authority**: name, postal address, website, and the national complaint route. Art 13(2)(d) requires the notice to state the right to lodge a complaint; naming the wrong authority is a visible error - **the digital consent age under Art 8(1)** — 16 by default, with a member-state option down to 13. Every member state that exercised it did so in its own act. See the table in `gdpr-notice.md`; a national skill must state its own figure with the statute - **Art 9(4)**: member states may maintain or introduce further conditions, including limitations, on the processing of genetic data, biometric data or data concerning health. Several did - **Art 10**: processing of criminal conviction data is permitted only under the control of official authority or where authorised by Union or member state law providing appropriate safeguards. The authorisation is national - **Arts 85 to 91**: journalistic and academic expression, public access to official documents, national identification numbers, **employment context (Art 88)**, archiving and research, secrecy obligations, churches and religious associations. All national, all materially different - **Art 37(4)**: member state law may require a DPO in cases beyond Art 37(1). This is where the German 20-persons threshold lives — it is national law, not the GDPR - the language the notice must be published in, and any national rule on where it must be reachable - national administrative-fine practice and any national criminal provisions under Art 84 ### DSA — Regulation (EU) 2022/2065 - the **Digital Services Coordinator** and the national enforcement architecture - the national **penalty framework** under Art 52 - the certification of **out-of-court dispute settlement bodies** under Art 21 and the list of certified bodies - the award of **trusted flagger** status under Art 22 - national law defining what content is illegal — the DSA does not define illegality, it defines the process ### AI Act — Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744 - the **market surveillance authority** and the notifying authority under Art 70 - national penalty rules within the Art 99 ceilings, and any national provisions for public authorities - regulatory sandbox arrangements under Art 57 - national language requirements for the Art 50 disclosures ### GPSR — Regulation (EU) 2023/988 - the market surveillance authority - **the language in which warnings and safety information must be given** — Art 19(d) leaves this to the member state where the product is made available. This is a hard national dependency for any cross-border listing ### P2B — Regulation (EU) 2019/1150 - national enforcement bodies and representative-action arrangements under Art 14 ### Data Act — Regulation (EU) 2023/2854 - the competent authority and the dispute settlement bodies under Art 10 and Art 37 - national penalty rules ### CRA — Regulation (EU) 2024/2847 - the market surveillance authority and national penalties ## Directives — the national skill owns the rule ### ePrivacy — Directive 2002/58/EC The consent standard comes from the GDPR and is uniform. Everything else is national: - the transposing act and its section numbers — this is what a compliance text must cite, never Art 5(3) of the directive - the **enforcing authority**, which is not always the data protection authority - **consent lifetime**, where the national authority set one. There is no EU figure. Do not state a number without naming the national source - **Art 13(2) soft opt-in** as actually transposed. Some member states narrowed it, some added form requirements at collection - national rules on unsolicited calls, fax and messaging under Art 13(3) - any national position on cookie walls and pay-or-consent beyond EDPB Opinion 08/2024 ### Consumer Rights Directive 2011/83/EU The heaviest national layer in this skill. - **the order-button wording**. Art 8(2) requires "order with obligation to pay" **or a corresponding unambiguous formulation**; each member state transposed its own formula, and only the national formula is safe. Never translate the English phrase - **the withdrawal period**: 14 days, with the **Art 9(1a)** member-state option to extend to 30 days for unsolicited visits and promotional excursions - **the withdrawal terminology** — the national statutory word, which is often not a translation of "withdrawal" - **the national model withdrawal form**, i.e. the national transposition of Annex I(B), verbatim - **the Art 11a withdrawal-function labels** — "withdraw from contract here" and "confirm withdrawal" exist in each member state's own wording - **Art 6a(2)**: member states may impose additional marketplace information requirements - **Art 16** member-state options: derogation for unsolicited-visit contracts, and loss of the withdrawal right after full performance for consumer-requested repairs - the transposition state of **Directive (EU) 2023/2673** (applicable 19.06.2026) and **Directive (EU) 2024/825** (applicable 27.09.2026), which several member states are late on - national penalty levels under Art 24 ### Sale of Goods Directive (EU) 2019/771 and Digital Content Directive (EU) 2019/770 - **the liability period**. Two years is the floor; **Art 10(3) and 10(5)** let member states go longer or use a limitation-period model instead. Several did - **the burden-of-proof period**. One year by default; **Art 11(2)** lets member states set two. Several did. A pan-EU statement of "one year" is unsafe - **Art 12**: whether the member state requires notification of the defect, and within what period, minimum two months - **Art 10(5a)** as amended by Directive (EU) 2024/1799: whether the member state derogated from the 12-month repair extension using the at-least-three-years alternative - **the transposition state of Directive (EU) 2024/1799**, applicable 31.07.2026 — many member states are within days of, or past, the deadline without a law - the national statute and section numbers that must be cited to consumers ### Unfair Contract Terms Directive 93/13/EEC - **minimum harmonisation (Art 8)**: national **blacklists and greylists** of terms that are void or presumed void without any fairness test. This is the layer that decides most real terms-and-conditions questions, and it is invisible from the directive - national law on the consequences of a void term and on collective proceedings under Art 7(2) - national penalty levels under Art 8b ### Unfair Commercial Practices Directive 2005/29/EC - the transposing act, the enforcement authority and the national procedural route (administrative, civil, competitor actions) - the **Art 3(5)–(6)** flexibility clauses as used - the transposition state of **Directive (EU) 2024/825**, applicable 27.09.2026 - national penalty levels under Art 13 ### Price Indication Directive 98/6/EC - **Art 6a(3)–(5)** member-state options: fast-perishing goods, products on the market under 30 days, progressively increased reductions - national unit-price rules and the national enforcement body ### EAA — Directive (EU) 2019/882 - the **market surveillance authority for products** and the **authority responsible for checking service compliance**, plus the national complaint route - national penalty levels under Art 30 - whether and how the national act incorporated the **Art 3(23)** microenterprise definition, and whether it imported the consolidation rules of Recommendation 2003/361/EC - the **Art 4(6)** guidelines and tools for microenterprises - the national language of the Annex V information - whether the member state exercised the Art 31(3) deferral for emergency communications ### NIS2 — Directive (EU) 2022/2555 - **the national act and its actual commencement date.** Many member states transposed well after 18.10.2024, some are still not in force. Until the national act commences, the entity has no NIS2 duties — but Implementing Regulation (EU) 2024/2690 applies directly once it does - how the member state resolved the **Art 2(2)-of-the-Annex "and/or" ambiguity** in the size test - the national registration duty and its deadline - the national CSIRT and competent authority, and the reporting channel - the **Art 2(5)** option for local public administration and education institutions - national penalty and management-liability rules ### ADR Directive 2013/11/EU - the **competent ADR entities** and whether participation is mandatory for the sector - the national transposition of the Art 13 information duty - the transposition timetable for Directive (EU) 2025/2647, applicable 20.09.2028 ### Representative Actions Directive (EU) 2020/1828 - the national qualified entities and the national collective-redress procedure ## What a national skill must NOT do - Restate the GDPR, DSA, AI Act or Data Act at length. Those are Regulations; the EU baseline is the whole of the substance. Depth belongs in the national deviation - Assert a national rule without the national statute and section - Copy another member state's transposition. A German § number in a French text, or an Austrian § in a German text, is the signature of a template that was never checked - Reintroduce an ODR link. The obligation was repealed for every member state simultaneously by Regulation (EU) 2024/3228 ## Handover format When this skill produces an output that depends on a national rule, the gap is reported as an explicit item, not silently defaulted: ``` [[MISSING: national order-button wording — ]] [[MISSING: national withdrawal period and terminology — ]] [[MISSING: digital consent age under Art 8(1) GDPR — ]] [[MISSING: burden-of-proof period under Art 11 Dir (EU) 2019/771 — ]] [[MISSING: supervisory authority name and address — ]] ``` A national skill resolves these. This skill never guesses them.