Delegation of Powers

Legal Framework

The exercise of delegation is governed by Article 92 GDPR and Article 38 NIS2 Directive. These articles empower the European Commission to adopt delegated acts to supplement or amend non-essential elements of the respective legislation. The procedural framework for this delegation, including its exercise, is strictly defined by the parent regulations (GDPR and NIS2) and the general principles laid down in Articles 290 and 291 of the Treaty on the Functioning of the European Union (TFEU). The law requires that any delegation must be explicitly granted by the legislative act, specifying its objectives, content, scope, and duration. Delegated acts cannot modify the essential elements of the regulation or directive.

Practical Application

The interpretation, as synthesized from authoritative commentary, emphasizes that the exercise of delegated power is not discretionary; it is a bounded technical implementation. The Commission must act within the precise scope defined by the empowering article. For instance, under GDPR Article 92, delegated acts are limited to specifying further criteria and requirements for certification mechanisms, data protection seals, and codes of conduct. In practice, the Commission exercises this power by drafting a delegated act, which is then subject to scrutiny by the European Parliament and the Council, who have the right to object. The process ensures that the Commission's implementing measures align with the legislative intent.

Key Considerations

• Monitor Delegated Acts: Organizations must monitor the Official Journal of the EU for adopted delegated acts under GDPR and NIS2, as these directly create binding technical compliance obligations.
• Understand the Limits: Compliance measures should be based on the final, published delegated act, not on the broader base articles. The delegated act contains the specific, actionable rules.
• Scrutiny Period Awareness: Note that delegated acts enter into force only if no objection is raised by the co-legislators within the set scrutiny period (typically two months, extendable by two). Tracking this timeline helps anticipate the effective date of new requirements.