EU baseline for online legal texts

Use when writing, reviewing, or fixing the EU-law layer of legally required texts for a website, webshop, app, platform, or newsletter reaching the European Union — privacy notice, cookie banner and consent flow, distance-selling information, withdrawal instructions, conformity and guarantee wording, DSA notice-and-action, AI transparency, accessibility information — or when asked whether an online product is EU-compliant. Also use when a template cites an EU directive article at a consumer, when a US or single-member-state template is about to be reused across the EU, when personal data processing starts, or before an EU-facing product goes live.

EU baseline for online legal texts

The EU-level layer that applies in every member state. Grounded in the GDPR, the ePrivacy Directive, the DSA, the Consumer Rights Directive as amended by the Omnibus and the distance-financial-services and green-transition directives, the Digital Content and Sale of Goods Directives, the Unfair Contract Terms and Unfair Commercial Practices Directives, the EAA, the AI Act, the GPSR, P2B, the Data Act, the CRA and NIS2. This skill is the baseline a national skill sits on top of. It covers no member state's implementing act — it only flags where one is required.

Core principle: an EU Regulation applies directly and identically in every member state; an EU Directive does not. The Consumer Rights Directive, the Digital Content and Sale of Goods Directives, the ePrivacy Directive, the EAA and NIS2 reach a user only through a national transposing act that differs in periods, thresholds, wording and remedies — and a directive has no horizontal direct effect between private parties (Art 288 TFEU; Case C-91/92 Faccini Dori). A template that cites a directive article at a consumer is citing an instrument that does not bind the consumer or the trader. Cite the national statute, or describe the right without a citation.

Not legal advice

This skill produces drafts and findings, not legal advice. Before go-live:

Webshop, subscription, payment processing, children's data, health data, biometrics, platform operation, or any high-risk AI use: obtain sign-off from a qualified lawyer in the relevant member state.
Free first-line help: the national supervisory authority via the EDPB members list (edpb.europa.eu/about-edpb/our-members_en), the European Consumer Centres Network (eccnet.eu) for cross-border consumer questions, the Enterprise Europe Network (een.ec.europa.eu) for SMEs, and Your Europe Business (europa.eu/youreurope/business) for the official cross-border summaries.
Every generated text carries a visible  HTML comment until the user confirms legal sign-off. Never remove the marker silently.

Never omit or soften this section in the output.

Workflow

Run the intake first. No text before the answers. Questions in references/intake.md. Question 1 decides which national skill has to run afterwards.
Determine the obligation matrix below: which texts this specific project needs.
Read the reference file for each obligation before drafting. Never from memory — the article numbers are too specific and several changed in 2025 and 2026.
Run references/checklist.md, reporting each finding with its instrument and article.
Report every national dependency as an explicit gap, using references/national-layer.md.
Output the approval notice; leave the draft marker in place.

Shape of the output. Exactly four parts, in this order:

the legal text or finding itself, with the draft marker
the list of [[MISSING: …]] items the user must supply, including every national-layer gap
adjacent obligations open in the same project, one sentence each
the approval notice

The instrument and article sit next to the statement they support. Reference-file names and paths appear in none of the four parts — they are working material, not part of the delivery.

Obligation matrix

Situation	Required at EU level	Reference
Any processing of personal data, including server logs	Privacy notice under Art 13/14 GDPR	`gdpr-notice.md`
Any processing of personal data	Records, processor contracts, breach procedure, DPIA screening, DPO test (internal, not published)	`gdpr-internal.md`
Any recipient outside the EEA, including remote access	Chapter V transfer basis per recipient	`gdpr-transfers.md`
Any storage on or read from the user's device beyond strict necessity	Consent before access, Art 5(3) Dir 2002/58/EC	`consent-cookies.md`
Email or SMS marketing	Prior consent or Art 13(2) soft opt-in, all three conditions	`consent-cookies.md`
Selling to consumers at a distance	Precontractual information, order button, marketplace disclosures, price-reduction rules	`consumer-distance.md`
Selling to consumers at a distance	Withdrawal instruction, model form, Art 11a withdrawal function	`withdrawal.md`
Selling goods, digital content or digital services	Conformity, update duty, guarantee wording	`conformity.md`
Any standard terms, any consumer-facing interface	Unfair-terms and unfair-practices screening, dark patterns	`unfair-terms-practices.md`
Hosting third-party content, forum, comments, reviews, marketplace	DSA points of contact, notice and action, statement of reasons, trader traceability	`dsa.md`
Any AI system, chatbot or generative feature	Art 50 transparency, AI literacy, prohibited-practice and high-risk screening	`ai-act.md`
B2C e-commerce service, not a microenterprise	Annex V accessibility information in the terms	`accessibility.md`
Physical products, business users, connected products, cloud, regulated sectors	GPSR, CRA, P2B, Data Act, NIS2 scope tests; ODR shutdown	`other-instruments.md`
Any project touching a single member state	The national layer that this skill deliberately omits	`national-layer.md`

Hard rules

Never cite a directive article at a consumer. Art 288 TFEU: a directive binds the member state, not the private party. Case C-91/92 Faccini Dori refused horizontal direct effect. "Under Art 9 of Directive 2011/83/EU you may withdraw within 14 days" is wrong on the instrument and possibly wrong on the period. Cite the national provision or state the right plainly.
The ODR platform is dead. Regulation (EU) 2024/3228 repealed Regulation (EU) No 524/2013 with effect from 20.07.2025; complaint submission stopped 20.03.2025 and all data was deleted by 20.07.2025. The Art 14 duty to link to it fell away with it. Any ODR link is a dead link and a false statement about a redress route. Remove it from footers, terms, order emails and shop-system defaults; never add it back.
No terminal-equipment access before consent. Art 5(3) Directive 2002/58/EC covers cookies, localStorage, sessionStorage, IndexedDB, pixels, beacons, cache- and URL-based tracking, fingerprinting and IoT reporting — regardless of whether personal data is involved (EDPB Guidelines 2/2023 v2.0, 16.10.2024). Reject must sit on the first banner layer, visually equivalent to Accept. No pre-ticked boxes, no default-on sliders.
The digital consent age is not 16 across the EU. Art 8(1) GDPR sets 16 as the default and expressly allows member states to go down to 13. Verified spread: 13 in Belgium, Finland, Portugal and Sweden; 14 in Austria, Italy and Spain; 15 in Czechia, Denmark and France; 16 in Germany, Ireland, the Netherlands and Poland. Thirteen member states remain unverified. Never state a single EU-wide age; state the member state's figure with its statute, or report it as missing. See the table in gdpr-notice.md.
The order button carries the national statutory wording. Art 8(2) Directive 2011/83/EU requires "order with obligation to pay" or a corresponding unambiguous formulation, and each member state enacted its own. The sanction is not a fine: "If the trader has not complied with this subparagraph, the consumer shall not be bound by the contract or order." Never translate the English phrase and treat it as compliant.
A withdrawal function is mandatory on online interfaces since 19.06.2026. Art 11a of Directive 2011/83/EU, inserted by Directive (EU) 2023/2673: a continuously available "withdraw from contract here" function, a separate "confirm withdrawal" step, and a durable-medium acknowledgement with date and time. Recital 37 extends it beyond financial services to all distance contracts with a withdrawal right. It is not the German-style contract-cancellation button.
The AI Act high-risk dates moved. Regulation (EU) 2026/1744 (Digital Omnibus on AI), in force 27.07.2026, pushed Annex III standalone high-risk systems to 02.12.2027 and Annex I product-embedded systems to 02.08.2028. Art 50 transparency still applies from 02.08.2026. Any plan still keyed to 02.08.2026 for high-risk is wrong.
Do not draft to unadopted law. The ePrivacy Regulation proposal was withdrawn (OJ notice 06.10.2025) — Directive 2002/58/EC stays. The Digital Omnibus Regulation COM(2025) 837, which would amend the GDPR and repeal P2B, is at European Parliament committee stage and is not law. Only the AI omnibus was adopted.
Never invent facts about the business. Legal name, registered office, register number, VAT number, supervisory authority, representative, responsible person, retention periods, processor list: if unknown it becomes [[MISSING: …]] in the text and in the report, never a plausible-looking value.
Every national dependency is reported, never defaulted. Withdrawal period, guarantee period, burden-of-proof period, order-button wording, consent age, supervisory authority, consent lifetime: each is [[MISSING: … — <member state>]] until the national skill supplies it.

False friends

Assumptions imported from a single member state or from outside the EU that do not hold at EU level.

Imported assumption	Position at EU level
"§ 5 TMG / § 5 DDG governs the imprint" (Germany)	No single EU imprint provision. Art 5 of Directive 2000/31/EC sets the minimum; the operative rules are national and stack differently per member state
"§ 312k BGB cancellation button" (Germany)	Not an EU rule. What EU law now requires is the Art 11a CRD withdrawal function — a different thing: exercising withdrawal, not terminating a continuing contract
"Widerrufsrecht" as the universal term	The EU term is withdrawal; each member state has its own statutory word, and Austria's is Rücktritt, not Widerruf
"20 employees triggers a DPO" (Germany, § 38 BDSG)	Art 37(1) GDPR has no headcount threshold. Headcount rules are national law under Art 37(4)
"Consent age is 16 everywhere"	Art 8(1) default is 16 with an express option down to 13. Ten of the fourteen verified member states deviate; only Germany, Ireland, the Netherlands and Poland sit at 16
"Two years' guarantee across the EU, one year's reversed burden of proof"	Art 10(3)/(5) and Art 11(2) of Dir (EU) 2019/771 are member-state options. Both figures vary
"Link the EU ODR platform in the footer"	Repealed; the platform ceased operating 20.07.2025
"CCPA-style notice at collection is enough" (US)	Arts 13/14 GDPR require purpose, legal basis per processing, recipients, retention, transfers and the full rights list, before or at collection
"Legitimate interest covers analytics cookies" (US/UK habit)	Art 5(3) ePrivacy requires consent for the device access itself; the EDPB Cookie Banner Taskforce ruled out legitimate interest for placement, and a missing consent cannot be rescued downstream
"We are not established in the EU, so the GDPR does not apply"	Art 3(2) catches offering goods or services to, or monitoring the behaviour of, data subjects in the Union, and Art 27 then requires an EU representative
"The DSA is only for big tech"	Chapter III Sections 1 and 2 bind every intermediary and hosting provider with no size exemption. Only Sections 3 and 4 have micro/small reliefs, and they are three separate provisions — Arts 19, 29 and 15(2)
"The AI Act only matters for high-risk systems"	Art 4 AI literacy binds every provider and deployer, and Art 50 transparency binds chatbots and generative features from 02.08.2026
"EN 301 549 gives us presumption of conformity under the EAA"	No harmonised standard is cited in the OJ under Directive (EU) 2019/882. EN 301 549 V3.2.1 is harmonised only under the public-sector Directive (EU) 2016/2102
"We need a public accessibility statement with a feedback and enforcement link"	That is Directive (EU) 2016/2102, public sector. A private e-commerce service owes the EAA Annex V information in its terms and conditions

If an obligation comes to mind that cannot be traced to a named EU instrument and article, it is not asserted — it is reported as an open question.

Common mistakes

Mistake	Why it is wrong
One legal basis stated for the whole website	Art 13(1)(c) GDPR requires the basis per processing purpose
Privacy notice lists services the site does not load, or omits ones it does	Checked against the network trace, not against intent
"This site uses cookies. OK"	Not a clear affirmative action under Art 4(11) GDPR
Google Fonts, Maps, YouTube, reCAPTCHA loaded before consent	Terminal-equipment access plus a third-country transfer before any basis exists
Order button labelled "Buy", "Submit" or "Continue"	Art 8(2) CRD — the consumer is not bound by the contract
Withdrawal instruction without the model form	Art 6(1)(h) CRD requires the Annex I(B) form to be supplied
No withdrawal function on the site	Art 11a CRD, mandatory since 19.06.2026
"-40 %" computed against a list price	Art 6a Dir 98/6/EC and Case C-330/23 Aldi Süd, 26.09.2024 — the percentage must be computed against the 30-day low
Review badge without any verification step	Annex I point 23b UCPD, unfair in all circumstances
DSA cited as the fix for a misleading cookie banner	Art 25(2) DSA excludes practices covered by the UCPD or the GDPR
Chatbot with the AI disclosure only in the terms	Art 50(5) AI Act requires it at the first interaction
DPF named as the sole US transfer basis	Valid, but under appeal in Case C-703/25 P; always keep a fallback
Marketplace with no trader traceability	Art 30 DSA, subject only to the Art 29 micro/small exemption
Physical product sold with no EU responsible person	Art 16 GPSR — the product may not be placed on the market at all

Reference files

Each carries the instrument, the article numbers, a status date, the mandatory content, a template with [[PLACEHOLDER]] slots, and checkpoints.

references/intake.md — questions to answer before the first text
references/national-layer.md — per instrument, what a national skill must add on top
references/gdpr-notice.md — Arts 12–22 GDPR, information duties, legal bases, special categories, child consent per member state
references/gdpr-internal.md — Arts 27, 28, 30, 33–37 GDPR: representative, processor contracts, records, breach, DPIA, DPO
references/gdpr-transfers.md — Chapter V, adequacy list, SCCs, the Data Privacy Framework and its appeal
references/consent-cookies.md — Art 5(3) and Art 13 Dir 2002/58/EC, consent standard, banner design, pay-or-consent
references/consumer-distance.md — Dir 2011/83/EU and the Omnibus: precontractual information, order button, marketplaces, price reductions, reviews
references/withdrawal.md — periods, exceptions, effects, model form, the Art 11a withdrawal function
references/conformity.md — Dir (EU) 2019/770 and 2019/771 as amended by the Repair Directive
references/unfair-terms-practices.md — Dir 93/13/EEC and Dir 2005/29/EC, blacklists, dark patterns
references/dsa.md — Reg (EU) 2022/2065 tiers, exemptions, notice and action, trader traceability
references/ai-act.md — Reg (EU) 2024/1689 as amended by Reg (EU) 2026/1744, timeline, Art 50
references/accessibility.md — Dir (EU) 2019/882, scope, microenterprise exemption, Annex V versus public-sector statements
references/other-instruments.md — ODR shutdown and ADR, GPSR, CRA, P2B, Data Act, NIS2
references/checklist.md — pre-launch checklist with instrument and article per item