The Article You Cannot Afford to Misread

A regulation is read from the top. Draw it as a graph instead and it answers a question the linear text never puts to you: which article, if you get it wrong, takes the others down with it.

We built that graph for two instruments — Directive (EU) 2024/2853, the new Product Liability Directive, and Regulation (EU) 2022/2554, DORA. Every article is a node; every explicit cross-reference is an edge, typed by what it does. Nothing is drawn by hand. The extractor reads the official enacting terms on EUR-Lex, and a validator refuses to emit a graph in which any node asserting a legal proposition lacks a pin-cite and a source. Both graphs are open: the Product Liability Directive and DORA.

None of this is new as a field. Fowler and colleagues mapped the citation network of the United States Supreme Court in the mid-2000s; Koniaris, Anagnostopoulos and Vassiliou modelled six decades of European Union legislation from the Official Journal as a complex network; Coupette, Beckedorf, Hartung and Katz measured United States and German statutes and regulations as networks changing over time. That work is corpus-scale and descriptive, written by computational scientists about bodies of law. Two things here are different: the granularity is inside a single instrument, where a practitioner actually reasons, and the verification is a build condition rather than an afterthought.

The verification had to be adversarial

The second point earned itself. EUR-Lex separates the word “Article” from its number with a non-breaking space. An anchored expression looking for Article 8 therefore matches nothing, and the first parse returned zero articles — not an error, not a warning, simply an empty result that looked like a small act.

The second trap cost more. Legislative text is full of sentences like “in accordance with Articles 60 and 61 of Regulations (EU) No 1093/2010”. Those numbers belong to another instrument. A guard was written to exclude them — and it matched Regulation but not Regulations. One absent letter. The graph that resulted was structurally valid, passed every schema check, and was quantitatively wrong.

That is the honest lesson, and it is worth more than the map. A citation that cannot be omitted is a real safeguard — it is what separates a proposition built from its source from one that merely carries a source appended after the fact. But structural validity is not accuracy. The graph could not tell that 43 of its DORA edges pointed at the wrong act. Only reading the underlying sentences could.

Where each regime concentrates

With the guard fixed, the two instruments turn out to have opposite shapes. The Product Liability Directive is monocentric. It carries 10 internal article-to-article citations across 24 articles, and five of them — half — point at Article 8, on the economic operators liable for defective products. Articles 7, 11, 14, 16 and 17 all resolve back to it. That is what a liability instrument is: an apparatus for answering one question, with everything else routed to the answer.

DORA is not built that way. Its 64 articles carry 127 internal citations, and the most-cited provision — Article 6, the ICT risk management framework — absorbs 9.4% of them. Two further centres sit beside it: Article 31, designating critical ICT third-party service providers, and Article 35, the Lead Overseer’s powers, at nine citations each. The three together take under a quarter of the internal traffic, and they address three different parties — the financial entity, the European Supervisory Authorities, and the Lead Overseer.

What the shape tells you before you read

The practical value is not the picture. It is that topology describes the reading task before you have done any reading. On a monocentric instrument there is a shortcut and it is legitimate: find the hub, master it, and treat the rest as satellite. Get Article 8 of the Product Liability Directive wrong and the error does not stay put — it propagates into the recourse, limitation and expiry provisions that depend on it. One misreading, five downstream consequences.

On a polycentric instrument the shortcut does not exist. DORA has no article you can master and call yourself covered, because its three centres are addressed to different parties and answer different questions — what the entity must build, who the regulator declares critical, and what the supervisor may then do. This is why supplier-side DORA advice that stops at the contractual provisions of Article 30 is structurally incomplete: the designation machinery in Article 31 decides whether the oversight regime attaches to your client at all.

Two limits are worth stating plainly, because the graph invites more confidence than it has earned. The edges are structural, not semantic: the graph knows that Article 11 cites Article 8, not what it says about it. And the scope is the enacting terms — recitals, annex content and case law sit outside it. A map is not the territory. It is the index that tells you which part of the territory to walk first.

General information on Directive (EU) 2024/2853 (the Product Liability Directive) and Regulation (EU) 2022/2554 (DORA) — not legal advice, and no lawyer–client relationship is created. The graphs described here cover the article-level cross-references in the enacting terms as published on EUR-Lex; they exclude recitals, annex content, delegated and implementing acts, and case law, and they record that one provision refers to another without characterising what the reference does. Citation structure is a reading aid, not a substitute for reading. Any specific situation needs advice on its own facts.