Introduction

The Centre for European Policy Studies (CEPS) convened a Task Force to examine reforms required for the EU digital acquis. The report addresses the exploding complexity of digital laws and the consequent need for simplification to strengthen EU productivity and competitiveness. This reform is considered essential in light of the deteriorating transatlantic relationship and the necessity of bolstering the European Union’s open strategic autonomy.

Explosive growth in the number and complexity of EU ‘digital’ laws

The number of EU laws dealing primarily with digitalisation has risen dramatically from 20 in 2012 to 88 by summer 2024. Additionally, the average length of these laws has roughly doubled over the last 20 years. Mathematical modelling indicates that 88 laws create approximately 3,828 potential two-way interactions, making it impossible for human experts to identify all conflicts and inconsistencies without automated support. This volume of legislation imposes significant regulatory burdens, particularly on small and medium-sized enterprises (SMEs).

Digital sovereignty, open strategic autonomy, and industrial policy

Geopolitical tensions have highlighted the EU’s reliance on the United States as a primary technology supplier. To reduce strategic risk, the report advocates for choosing priorities through rigorous risk assessments of dependencies. Mitigation strategies include enhancing self-supply in vital sectors, diversifying international supply chains, and collaborating with trustworthy technology partners. The Task Force explored the concept of a ‘Eurostack’ — an EU-based technology stack independent of US or Chinese technology — as a means of achieving strategic autonomy.

Competition and the level playing field: the Digital Markets Act

The Digital Markets Act (DMA) has entered active enforcement, but the Task Force found it too early to confidently judge its effectiveness. Recommendation 1 suggests the Commission publish a clear framework of indicators for contestability and fairness, using independent bodies for assessment. Recommendation 2 proposes standardising compliance reporting around agreed key performance indicators (KPIs). Recommendation 3 suggests a bounded data-access mechanism for vetted researchers, similar to the Digital Services Act (DSA), to support independent evaluations of the DMA’s impact.

Fundamental freedoms: the Digital Services Act

The DSA’s supervisory architecture remains inconsistent across Member States due to an implementation gap. Recommendation 4 urges Member States to prioritise the empowerment of Digital Services Coordinators (DSCs). Recommendation 5 calls for the development of verifiable outcome indicators for content moderation to move beyond self-declared platform figures. Recommendation 6 advises the Commission to support additional guidance for independent audits, building on existing assurance frameworks like ISAE 3000 (Revised).

The artificial intelligence Act

While the AI Act’s risk-based approach is broadly supported, providers face uncertainty regarding concrete compliance. Recommendation 7 urges the Commission to prioritise the delivery of harmonised standards and practical, example-based guidance. Recommendation 8 stresses that amendments pursued under the simplification agenda must distinguish clearly between administrative streamlining and substantive change, with the latter requiring evidence-based impact assessments rather than unexamined appeals to urgency.

Privacy, cybersecurity, and data sharing

The General Data Protection Regulation (GDPR) faces challenges regarding its ‘one-stop-shop’ mechanism, which concentrates enforcement responsibilities in smaller Member States like Ireland and Luxembourg. Cybersecurity remains fragmented across instruments such as NIS 2, the Cyber Resilience Act, and DORA. The report identifies a need for targeted structural improvements, including the harmonisation of incident-reporting definitions and clearer proportionality guidance across different regulatory regimes.

The better regulation process: creating, evaluating, improving, and simplifying EU laws and regulation

The report finds that EU regulatory ambition is outpacing implementation capacity. Recommendation 9 calls for the Commission, Parliament, and Council to jointly share responsibility for the better regulation system. Recommendations 10 and 11 argue that every legislative proposal should be accompanied by an impact assessment, with addendums prepared to summarise differences in the law as enacted. Recommendation 13 suggests moving ex-post evaluations to an independent body, such as the Court of Auditors, to ensure impartiality. Finally, Recommendations 19 and 20 advocate for strengthening the SOLVIT network and evolving the Single Digital Gateway into a genuinely usable compliance tool for merchants.