Uncovering Hidden Links in the EU Digital Rulebook: Inside Our CPDP 2026 Workshop
It was a full house. On Wednesday 20 May 2026, twenty-five participants working at supervisory authorities, governments, law firms, consultancy firms, and academia filled the Music Room at Maison de la Poste in Brussels for our fully booked workshop at CPDP 2026. Together, we put a working prototype to the test: a visualisation that maps the hidden links across the EU Digital Rulebook, connecting roughly 2,700 EU laws and the body of CJEU case law through both explicit citations and semantic similarity. Built in five weeks by two talented Utrecht University data science students, the tool surfaced connections that even seasoned lawyers and regulators in the room had only sensed by intuition. Joost shared a first reflection on LinkedIn shortly after the workshop; this post takes a deeper look.
Why We Built a Visualisation of the EU Digital Rulebook
The EU’s digital legal landscape has grown faster than any practitioner can track. There are roughly 30,000 EU laws on the books, of which about 550 directives and regulations relate directly to the digital realm (GDPR, AI Act, DSA, DMA, Data Act, Cyber Resilience Act, and more). Nobody holds all those connections in their head.
Three conversations directly inspired this project. A colleague from the Hamburg Data Protection Authority noticed that the Court of Justice draws heavily on the Digital Markets Act in Meta v Bundeskartellamt without ever citing the DMA in the text. A senior partner at a leading international law firm challenged us to visualise legal families rather than isolated provisions. And the EDPS Opinion 4/2026 on the Cybersecurity Act and the NIS Directive flagged that the legislator drafts security provisions without ever linking them to the GDPR’s own security requirements. Three expert readers had spotted those hidden links by experience alone. The question driving the workshop was whether a tool could surface those links technically, consistently, and at scale.
The Prototype: Three Views of the EU Digital Rulebook
The prototype was developed by Dora Drogeanu and Tricia Lee, master’s students in Applied Data Science at the Utrecht University Data School, supervised by Florian Kunneman. The dataset covers active EU directives and regulations touching digital topics, plus CJEU case law from Stauder (1969) through April 2026. Dora led the work on explicit connections; Tricia led the implicit semantic layer.
- View 1, the Law Network: around 2,700 laws plotted as circles, clustered into 16 legal families and connected through amendments, repeals, body-text citations, and shared EuroVoc subject-matter tags. Filters let users toggle connection types and adjust the minimum number of shared connections.
- View 2, the Law and Case Network: the same law network with CJEU cases added as squares, linked to laws by reasoning-part and operative-part citations. Reasoning citations far outnumber operative-part citations, a pattern that lit up clearly on screen.
- View 3, Implicit Relations: the heart of the project. Around 400 laws and 200 cases connected purely by semantic similarity, using BGE-M embedding models applied to paragraph-level chunks of legal text. A threshold slider tightens or loosens the connections, and a keyword search with an “exclude exact phrase” toggle finds laws that express the same concept in different words.
The Discoveries That Surprised Even Us
The original questions were answered, and then some. The prototype confirmed our colleague’s intuition: in Meta v Bundeskartellamt, the Court’s reasoning sits semantically close to the Digital Markets Act, even though the judgment never cites the DMA. More striking, the tool revealed that Opinion 1/15 on the PNR Agreement uses near-identical wording to the provisions on prohibited AI practices in the AI Act. The Court reasoned in 2017 in ways the legislator codified in 2024, without ever citing the case.
We named the pattern foreshadowing and echoing: a judgment paragraph foreshadows a later legislative provision; a legislative provision echoes earlier case law. Another striking example came from a search for systemic risk, which surfaced three completely distinct legal worlds at once: Amazon EU v Commission (online platform risk under the DSA), the AI Act (economic and social risk from AI models), and CRD IV (financial risk in banking). One term, three different legal grammars. The CJEU eventually ruled in Amazon EU that these are distinct notions, but the prototype lays the entire debate out instantly. As Joost reminded the room during the workshop:
Lawyers professionally distrust everybody. So if the computer says this is a semantic relationship, we want to check for ourselves.
That instinct shaped the design. Every detected link is clickable down to the exact paragraph, with a hover preview and a direct route to the full text on EUR-Lex or CURIA. The lawyer remains in charge.
What Attendees Told Us
Demand on the live demo outran what the prototype server was sized for, so we quickly centralised the discussion on the main screen and turned the second half of the workshop into a structured feedback session. The candour that followed was a gift. Several themes recurred across every table:
- Merge the three views into one: participants want explicit and implicit connections visible side by side, filterable by category, rather than spread across separate tabs.
- Add a chronological dimension: visualising foreshadowing and echoing on a timeline would make the prototype’s most powerful insight self-evident.
- Make the sliders self-explanatory: attendees with a data background found the threshold and minimum-connections sliders intuitive; legal users asked for tooltips and clearer labels.
- Include upcoming legislation and Advocate General opinions: compliance teams in particular want to compare new and pending laws against existing ones to spot the gaps.
- Show clicked connections without navigating away: clicking a connected law should reveal the bridge between two nodes rather than jumping to a new node.
Several attendees described the value in their own words. A trial lawyer asked us to integrate the visualisation into Digibeetle so she could trace terms like damage across legal domains. A vendor-compliance specialist working with research and education institutions saw immediate use for her team in mapping gaps between cybersecurity and data protection rules. A Data Protection Authority representative confirmed that the legal-families approach mirrors mapping exercises her own authority has been running, given its broadened mandate.
What This Means for Your Work
For supervisory authorities with broadened mandates, the prototype offers a way to map jurisdictional overlap across the EU Digital Rulebook and to spot where new laws lean on familiar concepts without naming them. For law firms and consultancy practices advising on cross-cutting matters (AI, platforms, data, cybersecurity), it surfaces precedents and provisions that keyword search alone would miss. For businesses and compliance teams, it shortens the path from a single obligation to all the related regimes that may apply. For academic researchers, it opens new lines of inquiry into how legislative language migrates between domains.
Try the Updated Prototype in a One-on-One Session With Joost
Whether you attended the workshop or could not make it, we want you to experience the prototype properly. Since CPDP 2026, the tool has moved to a larger server and the team is incorporating the feedback collected in Brussels. We are now inviting interested practitioners to a dedicated one-on-one session with Joost, online or at your office, where he will walk you through the updated prototype, present the latest outcomes, and discuss how visualised connections across the EU Digital Rulebook can support your specific work.
These sessions are limited and tailored to each attendee. Book your one-on-one session here and tell us a little about the questions you want the prototype to answer. If you would also like a broader look at our expert-curated platform for EU digital law, simply mention it when booking.
