Which regulation wins? There is a rule for that

If you work in a regulated team you have DORA, NIS2, GDPR and the AI Act arriving on the same desk. At some point somebody asks the obvious question, and it is a good one: which of these do we actually have to follow?

Nobody in the room ever seems to know there is a formal answer.

Think of it like a board game

Every board game has a line in the rulebook for what happens when two things contradict each other. Usually it is some version of "if a card contradicts the rulebook, the card wins."

That line is lex specialis, and it has been doing that job in EU law for considerably longer than board games have existed. There are three of these tiebreakers, and you consult them in order.

Rule 1, lex superior. The higher-ranked rule wins. Treaty beats regulation, regulation beats conflicting national law. In EU law this is the principle of primacy, anchored in Case 11/70, Internationale Handelsgesellschaft, and reaffirmed more times than anyone has counted.

Rule 2, lex specialis. The more specific rule wins for the situation it is specific about. The general rule stays on the books; it just is not the rule for this case. The classic formulation is that the special rule covers everything the general rule covers, plus at least one further element.

Rule 3, lex posterior. The later rule wins, where two rules of the same rank collide and neither is more specific. The presumption is that the legislature knew the earlier law and meant to override it.

Most arguments end at rule 2.

Rule 2 is the one that saves you work

Here is what it looks like when it bites.

You are a financial entity in scope of DORA. You are also, on the face of it, in scope of NIS2. Two cybersecurity risk-management regimes, two incident-reporting clocks, two supervisory relationships. Teams build for both, and it is enormously expensive.

They should not. NIS2 Article 4(1) and (2) carve out entities covered by a sector-specific Union act whose requirements are at least equivalent in effect, and Recital 28 names Regulation (EU) 2022/2554 as exactly that act for financial entities. DORA is lex specialis. The NIS2 risk-management, reporting and supervision provisions do not stack on top.

One incident reporting regime, not two. That is a principle of statutory interpretation turning directly into a line item.

So I mapped the whole hierarchy

The tiebreakers only help once you know which tier a rule sits in, and that turns out to be the part people are hazy on. A regulation and an implementing technical standard are not the same kind of thing, and the difference is which article of the Treaty put them there.

So the page runs from the Treaties every Member State signs, through Article 288 TFEU and the five legal acts it authorises, down to a technical standard the ESAs draft for one product line. Regulation, Directive, Decision, Recommendation, Delegated act, Implementing act, RTS, ITS, national law. Every box carries the article it lives at and a real example, visible without hovering or clicking anything.

A note on where citations come from

While putting it together I checked every case reference against the actual judgment rather than against my notes. Three things did not survive.

A case was cited under a party name that does not appear anywhere in it. C-582/08 is Commission v United Kingdom; the lex specialis holding is real and sits verbatim at paragraph 35, but the name attached to it was invented somewhere upstream.

A second case was cited for a proposition it does not contain. Seagon, C-339/07, is a jurisdiction ruling under the Insolvency Regulation, and at paragraph 29 the Court expressly declined to answer the question it was being cited for. It is gone from the page.

And the lex specialis "test" was attributed to the CJEU. It is the classic doctrinal formulation, not something the Court states as a test, so it is now described as what it is.

None of those were load-bearing errors, but all three would have been quoted back at me by the first lawyer who read the page carefully. If you publish regulatory material, open the judgment. The citation you inherited was written by someone who may not have.

The hierarchy of EU law, Treaties to RTS →

TFEU Arts. 288 to 291 · Case 11/70 · C-582/08 · NIS2 Art. 4 and Recital 28 · DORA · Reg. (EU) 2026/1744. Practitioner material, not legal advice.