EU Law Cites More Than Its Own Citation Graph Records

What EUR-Lex publishes, and why it matters

Every instrument on EUR-Lex carries a metadata notice in the Common Data Model, and inside it a relation called WORK_CITES_WORK. Each entry gives a cited work with its CELEX number, its European Legislation Identifier and its Official Journal reference. The same data is queryable through the Cellar SPARQL endpoint, openly and without a key.

This is genuinely good public infrastructure and it deserves saying so. It is also, as far as we can establish, the only structured source of the dependency graph between EU legal instruments. If you are building a product that tells a company which regulations apply to it and what those regulations depend on, this is what you build on, because writing your own legal text parser is the thing everyone is trying to avoid.

So the question is simple and worth asking: does it record what the texts actually cite?

The result

A single aggregate would hide the story here. Three of the five instruments are covered well enough that a tool built on the structured data would behave sensibly. Two are not, and they happen to be the two newest and most commercially urgent.

Why the NIS2 gap is the one that matters

NIS2 does not describe the organisations it covers. It defines its scope through Annexes I and II by pointing at other legislation, in references of the form an entity as defined in Article 1, point (2), of Directive 2001/83/EC, or as defined in Article 2, points (1), (2) and (3), of Council Directive 91/271/EEC. Following those pointers is how a company determines whether it is an essential entity, an important entity, or out of scope entirely.

Those are precisely the references concentrated in the missing 62 per cent. The consequence is direct and testable. If your compliance tool maps regulatory dependencies from the European Union's structured metadata rather than from the text, it may not show you the legislation you need to read in order to establish whether NIS2 binds you at all.

That is a fair question to put to a vendor: did you parse the metadata or the text? The answer is informative either way, and it is the sort of question that is easy to ask and hard to bluff.

Three corrections, published because each looked publishable

This measurement produced a wrong answer three times, and every wrong answer was more dramatic than the truth. That is the normal direction of error for this kind of work, which is why the corrections are here rather than in a footnote.

First, a year and number swap. The pattern matching year-first citations allowed an optional No, so Regulation (EU) No 1024/2013 parsed as year 1024, number 2013, minting the identifier 31024R2013, which cannot exist. It was caught by taking the supposedly missing identifiers and checking whether they actually resolved on EUR-Lex. They did not.

Second, footnote titles counted as citations. EUR-Lex gives every cited instrument its full official title in a footnote, and those titles name further instruments. NIS2 does not cite Directive 89/686/EEC. It cites Regulation 1025/2012, whose title happens to mention 89/686/EEC. The first attempt to exclude footnotes used a character class that forbade parentheses and therefore matched almost nothing, because footnote bodies are full of (EU) and (EC).

Third, legislative history counted as citation. An instrument named after amending or repealing belongs to another act's title, and that is exactly what the AI Act's Annex I list of Union harmonisation legislation is made of. Excluding those fragments moved the AI Act from 35 to 52 per cent while NIS2 did not move at all, which is what established that the NIS2 gap is real and the AI Act's was substantially an artefact of our own parser.

The headline before any correction was that the citation graph missed 60 per cent of citations. It misses 36.6 per cent, in two instruments. The corrections are the reason to believe the second figure, and all three are covered by regression tests in the repository.

What we are not saying

We are not saying WORK_CITES_WORK is defective. Its intended scope is not documented publicly in a form this audit could verify, and it may deliberately record only formal citations rather than every instrument a text names. What is measured is the difference between the two. The consequence for anyone building on it holds whichever way that question is resolved.

Nor are the two columns counts of comparable objects. The structured graph also contains Treaty provisions such as Article 101 of the Treaty on the Functioning of the European Union, protocols, and soft law, between four and thirty entries per instrument, which our parser never targets and which therefore can never match. They do not affect the coverage figure, but they do mean the raw counts should not be compared directly.

The licence point, which changes what is possible

Our two previous studies in this series, on ISO/IEC 27001 and ISO/IEC 42001, could only model standards by address, never by text, because that text is sold. A SHACL layer proves the resulting graphs contain none of it.

EU law is different. EUR-Lex states that its reuse policy rests on Commission Decision 2011/833/EU and that, unless otherwise specified, legal documents published there may be re-used for commercial or non-commercial purposes under CC BY 4.0 with attribution. So this dataset holds the full text, parses it, and measures it. EUR-Lex names one carve-out itself, documents such as the International Accounting Standards, and those are not harvested here.

The practical upshot is a single graph with two kinds of node under two different rules: legal instruments carrying their text, addressed by CELEX and ELI, and standards carrying only an address. Very few people are building both halves.

The artefact

The repository is at github.com/fabio-rovai/regulatory-instrument-register. It contains a resumable harvester keyed by CELEX, the citation audit, the generated report, and offline known-answer tests including regression tests for all three corrections. Adding an instrument is a data edit. Code MIT, report CC BY 4.0, source material CC BY 4.0 under Decision 2011/833/EU.

Companion studies: the ISO/IEC 42001 assurance gap and why nobody can check an ISO 27001 certificate.