- Home
- Suite features
- Cross-regulation mapping
Cross-regulation mapping: one measure, several regimes
Cross-regulation mapping in the Regingada Compliance Suite shows where the GDPR, the AI Act and the Digital Services Act (DSA) reach the same feature — 119 cross-regime links — and how 68 collisions are classified: both apply, one prevails, or an exception carves one out. It indicates which rules share one measure; it does not decide which binds you.
- 119 cross-regime links
- Collision Resolver · 68 classifications · incl. DMA, NIS2
- 7 guided tours
- Data Act · no links
- Export · none
- Case assessment · not made
Where do overlapping EU regulations meet, and which one gives way?
Mostly on a single measure, and on the corpus's reading usually neither gives way. An age check, a support chatbot or an incident playbook can be owed under two or three acts at once, each with its own addressee, trigger and clock. Of the 68 classified collisions, 46 read 'both cumulative', six 'conditional'; only 16 name a prevailing norm.
A compliance crosswalk for EU digital law is usually a spreadsheet, one control per row. Cross-regulation mapping starts from the articles and records how each pair relates; the collision map works through the eight seams that cost teams the most coordination.
From the legal notice to the Collision Resolver
Open /suite/#cross-reg. Then:
- Confirm the legal notice. It appears once per browser; tick the checkbox, then 'Accept & Continue'.
- Choose the 'Cross-Regulation' card. No quick-check questions follow, and the mode reads none: every visitor sees the same links and cards. Later, the sidebar item 'Cross-Regulation Mode' (network icon) brings you back.
- Start with '3c Guided tours'. Badged 'recommended': seven walkthroughs, each a paraphrase marked 'no legal assessment' with a small graph of the articles involved.
- Read the links. '3a Pseudo-3D Force' draws regime clusters joined by dashed links; '3b Matrix Heatmap' is an EU regulatory overlap heatmap at article level for one regime pair; '3d Subjects' groups links by subject. Clicking a link opens 'Edge detail'.
- Open the 'Collision Resolver'. The button sits above the tabs; chips filter by mechanism.
The card choice writes a profile, empty on a first visit and marked as cross-regulation acknowledged, to your browser's local storage beside your legal-notice acceptance; no account exists (see the Trust Center).
What cross-regulation mapping shows, and what it rests on
| Capability | Coverage | Output |
|---|---|---|
| Force graph (3a) | 119 cross-regime links of the EU digital law map: AI Act–GDPR 28, AI Act–DSA 27 (three to German authorities), DSA–GDPR 7, the rest to neighbouring law | Dashed links, strict or induced filter |
| Matrix heatmap (3b) | DSA × AI Act, DSA × GDPR, AI Act × GDPR, article by article | Coloured cells; AI Act × GDPR shows 11 links in 10 cells |
| Collision Resolver | 68 classifications of norm pairs: DSA, GDPR, AI Act, the Digital Markets Act (DMA), the NIS2 cybersecurity directive, China's Personal Information Protection Law (PIPL) and four further EU acts | Mechanism, prevailing norm, resolution, consequence, pinpoints |
Seven mechanisms, counted
Cumulation 35, valve norm 11 (one act defers to the other), lex specialis 10, precedence 6, derogation 3, parallelism 2, balancing 1. For the 128 links typed as plain overlaps (the 119 graph links plus nine typed ones), a closing note presumes parallel review.
Breach and incident: two notifications
Two resolver cards pair Art. 33 and 34 GDPR with Art. 23 NIS2 (as transposed nationally) as cumulation: one for notifying authorities, one for informing data subjects and service recipients. Triggers, addressees and deadlines differ; neither notice replaces the other. The clocks run in NIS2 incident reporting.
One hypothetical app, walked through
Take a hypothetical US short-video app with no EU establishment, teenage users and an AI support chatbot. The mode asks for none of these facts; you hold the corpus against them, as the model cases do with fictional companies.
- 3b · DSA × GDPRTwo cells light up: Art. 16 DSA × Art. 17 GDPR and Art. 38 DSA × Art. 4(4) GDPR. The other five DSA–GDPR links attach to DSA paragraphs and stay off the grid, Art. 13(1) DSA × Art. 27 GDPR among them.
- Valve normArt. 28 DSA (protection of minors) × Art. 24 GDPR: 'both cumulative', with Art. 28(3) DSA as the valve; the card asks for a documented proportionality memo on the age-assurance method.
- CumulationArt. 12 DSA meets Art. 50 AI Act on the chatbot: on the card's reading, only AI disclosure plus a human escalation channel satisfies both.
- DerogationThe Art. 19 DSA card: micro and small enterprises are exempt from the online-platform section, Art. 28 included, except Art. 24(3), unless designated a very large online platform (Art. 19(2)). The mode never asks for the figures that decide this.
You leave with article pairs to raise — not a finding that any of them applies.
What the mode leaves out, and where it falls short
- The classifications predate Regulation (EU) 2026/1744 (in force 27 July 2026): cards on high-risk AI Act duties, such as Art. 9 and Art. 26, do not say these apply only from 2 December 2027 (Annex III) or 2 August 2028 (Annex I).
- German in the English interface: 'Edge detail' and the grid button's edge list show German curator notes; resolver cards keep effect, conditions, pinpoints and footer in German, and some headers name a DSA article only by title ('Legal representatives' for Art. 13).
- DMA and NIS2 provisions have no graph node, so resolver cards show raw identifiers such as 'nis2_a21'.
- Matrix axes stop at 40 entries and skip penalty provisions, so Art. 99 AI Act and Art. 83 GDPR fall outside (the pictured Fines triangle tour shows them); 'DSA × DDG' draws an empty table.
- The grid button's regime count misaligns labels and numbers, reads zero for the Data Act and PIPL, and files conflict, gap and trigger links alike under 'Platform duties (overlaps)'.
- 'high' and 'medium' shading in 3a and 3b only tracks whether a curator note exceeds 30 characters; 'low' marks a link that is not a cross-reg edge. None of it grades weight.
- 'Start Cross-Reg AI analysis' opens the opt-in AI assistant, locked without an access code.
Frequently asked questions
How do the GDPR, the AI Act and the DSA overlap?
Through shared objects rather than shared wording: one feature, dataset or document falls under two or three acts, each with its own addressee and trigger. The GDPR and AI Act overlap alone accounts for 28 of the suite's 119 cross-regime links. The collision map explains why such points recur.
Can one risk assessment serve the DPIA, the FRIA and DSA Article 34?
Not as one document for all three. Art. 34 DSA binds only very large platforms and search engines; its resolver card with Art. 35 GDPR reads cumulation and calls 'one assessment covers the other' a documentable compliance error. The fundamental rights impact assessment (FRIA), owed from 2 December 2027 by certain deployers of Annex III systems (Regulation (EU) 2026/1744), complements a data protection impact assessment (DPIA) that already meets part of its duties (Art. 27(4) AI Act). See seam 04 of the collision map and the DPIA tool.
What is a regulatory collision, and how is it resolved?
A regulatory collision is where two provisions reach the same conduct and demand different things, or the same thing twice. Doctrine resolves it by mechanism: both apply (cumulation), one defers to the other (valve norm), one prevails (precedence, or lex specialis for the more specific rule), or one carves out an exception (derogation). Applying one to your facts is a legal assessment.
Who curated the overlap resolutions?
The classifications were drafted with AI assistance and then ratified by Theo Funk, a German attorney (Rechtsanwalt): 61 on 10 July 2026, and seven on Chinese data law — six PIPL articles and CAC Order No. 16 — on 23 July 2026. The ratification covers norm pairs in the abstract, not any company's facts.
Which regimes does cross-regulation mapping cover?
The tabs work on the DSA, the AI Act and the GDPR, with two German statutes (BetrVG on works councils, AGG on equal treatment), the EU Charter and the e-Commerce Directive at the edges. The 92 curated, typed links of the heatmap layer add the DMA and NIS2; the resolver adds PIPL and copyright, platform-to-business, product-safety and terrorist-content rules. The Data Act and the German DDG and BDSG have no links.
Does the GDPR or the AI Act prevail when they conflict?
Usually neither: both apply. Art. 2(7) AI Act leaves the GDPR unaffected, subject to Art. 10(5) and Art. 59 AI Act, so an AI system processing personal data answers to both. Of the seven AI Act × GDPR resolver cards, four read 'both cumulative', two name a prevailing norm and one is conditional. Which reaches your system is a legal assessment.
Can I export the overlap map?
No: there is no download, print view or share link, and the address opens only the view. To find a classification again, note the identifier in its resolver card's footer, such as res_conf_dsa_art_28__gdpr_art_24. Suite outputs elsewhere are listed on the deliverables page.
A classification of norm pairs, not a ruling on your facts
The resolver says how the corpus classifies a pair of provisions, not whether either reaches you: whether your app is an online platform, whether the Art. 19 DSA carve-out fits, or which age-assurance method is proportionate. Those turn on your facts, and the law firm Theo Funk can assess them under a separate mandate.
The resolver card on Art. 13 DSA and Art. 26(3) NIS2 reads the two appointments as cumulative: one mandate does not satisfy both. Each duty has its own trigger; lacking an EU establishment is only the starting point. Where one applies, Regingada UG (haftungsbeschränkt) can hold the representative role under Art. 27 GDPR, Art. 13 DSA, Art. 26(3) NIS2 or, for general-purpose AI model providers, Art. 54 AI Act — by separate written mandate, without legal advice. See EU representative for US companies, the NIS2 representative and the published fees.