Skip to content

The hierarchy of EU law, Treaties to RTS

Article 288 TFEU. Where each EU rule sits, from the Treaties every Member State signs down to a technical standard the European Supervisory Authorities draft for one product line. Every box carries the article it lives at and a worked example, so the whole thing reads without clicking or hovering anything.

The thesis: primary law sets the powers, secondary law uses them, and technical standards pin down the numbers and templates. Everything else is interpretation or guidance. The pink border marks the box that anchors the rest.

The post that goes with this page: Which regulation wins? There is a rule for that.

The hierarchy at a glance

The EU legal hierarchy, Treaties, legal acts, technical standards Five horizontal bands: (1) EU Treaties as primary law, (2) Article 288 TFEU defining the five legal acts the institutions can adopt, (3) a left column of legislative acts (Regulation, Directive, Decision, Recommendation and Opinion) and a right column of non-legislative acts (Delegated and Implementing acts) with an inset for the financial-services case where delegated acts become Regulatory Technical Standards and implementing acts become Implementing Technical Standards, (4) national law at the base where Member States transpose directives and national supervisors operate, (5) the order in which the three conflict-resolution principles are consulted. The Treaty box carries an accent border to mark that the rest of the diagram is derived from it; every other box is hairline. Each box shows its worked example in accent pink at all times. PRIMARY LAW / TIER 1 EU Treaties TFEU / TEU / Charter of Fundamental Rights CONFER --> ex: Treaty of Lisbon, Arts. 288-291 TFEU ex: primacy over conflicting national law SECONDARY LAW / TIER 2 / ARTICLE 288 TFEU ex: every binding act the EU can pass "... the institutions shall adopt regulations, directives, decisions, recommendations and opinions." LEGISLATIVE ACTS / EP + COUNCIL NON-LEGISLATIVE ACTS / COMMISSION BINDING / DIRECTLY APPLICABLE Regulation Art. 288(2) TFEU Binds in full, direct in all 27 MS ex: GDPR, DORA, AI Act BINDING AS TO RESULT Directive Art. 288(3) TFEU Binds the result, needs transposition ex: NIS2, CRD VI, Solvency II BINDING ON ITS ADDRESSEES Decision / Art. 288(4) Binds in full, only who it names ex: GDPR adequacy decisions NON-BINDING / SOFT LAW Recommendation & Opinion Art. 288(5), no binding force ex: ESMA opinions SUPPLEMENTS NON-ESSENTIAL PARTS Delegated Acts Art. 290 TFEU, Commission adopts EP + Council can object or revoke ex: Delegated Reg. (EU) 2024/1772 UNIFORM CONDITIONS FOR APPLYING Implementing Acts Art. 291 TFEU, Reg. (EU) 182/2011 MS expert committees (comitology) ex: Implementing Reg. (EU) 2024/2956 FINANCIAL SERVICES / EBA / EIOPA / ESMA RTS / Regulatory Technical Standards Art. 290 TFEU, adopted as delegated acts The what: what entities must do ex: DORA RTS 2024/1773 ITS / Implementing Technical Standards Art. 291 TFEU, adopted as impl. acts The how: templates, formats, timelines ex: DORA ITS 2024/2956 NATIONAL LAW / TIER 3 Member State implementation / national supervisors (BaFin, ACPR) ex: NIS2UmsuCG, BaFin supervision WHEN TWO RULES APPLY / ORDER OF CONSULTATION (CJEU) 1 lex superior 2 lex specialis 3 lex posterior higher rank first, then the more specific rule, then the later one The EU legal hierarchy, narrow layout Single-column layout of the EU legal hierarchy. Same five bands as the wide layout, stacked vertically: Treaties, Article 288, then the four most-cited legislative acts, then non-legislative acts and the RTS/ITS inset, then national law at the bottom. Accent border reserved for the Treaty box. Every card shows its worked example in accent pink at all times. PRIMARY LAW / TIER 1 EU Treaties TFEU / TEU / Charter ex: Lisbon Treaty ARTICLE 288 TFEU The five legal acts of the EU ex: every binding act the EU can pass LEGISLATIVE ACTS BINDING / DIRECT APPL. Regulation Art. 288(2), direct in all 27 MS ex: GDPR, DORA, AI Act BINDING AS TO RESULT Directive Art. 288(3), needs transposition ex: NIS2, CRD VI, Solvency II BINDING ON ADDRESSEES Decision / Art. 288(4) ex: GDPR adequacy decisions NON-BINDING Recommendation & Opinion ex: ESMA opinions NON-LEGISLATIVE ACTS SUPPLEMENT / AMEND Delegated Acts Art. 290 TFEU, Commission adopts ex: Delegated Reg. (EU) 2024/1772 UNIFORM IMPLEMENTATION Implementing Acts Art. 291 TFEU, Reg. (EU) 182/2011 ex: Implementing Reg. (EU) 2024/2956 FINANCIAL SERVICES / EBA / EIOPA / ESMA RTS / Regulatory Technical Standards Art. 290 TFEU, the what ex: DORA RTS 2024/1773 ITS / Implementing Technical Standards Art. 291 TFEU, the how ex: DORA ITS 2024/2956 NATIONAL LAW / TIER 3 Member State implementation ex: NIS2UmsuCG in Germany WHEN TWO RULES APPLY / IN THIS ORDER 1 lex superior (rank wins) 2 lex specialis (specific wins) 3 lex posterior (later wins)
accent: the box that anchors the rest hairline: every other box / pink text = the worked example, shown on every box

The three principles, in detail

The band at the foot of the diagram names three principles and the order they are consulted in. This is that band in full. They are not a tier of their own — they are the rules for resolving overlaps within and across the tiers, developed by the Court of Justice in its case law. The EUR-Lex glossary on the hierarchy of norms has the official EU framing.

1 / RANK

Lex superior

The higher-ranked rule wins. EU primary law beats EU secondary law; EU law beats conflicting national law. In EU law this is the principle of primacy, anchored in Case 11/70, Internationale Handelsgesellschaft (1970) and reaffirmed many times since.

→ a Member State cannot pass a law that contradicts a directly applicable EU regulation.

2 / SPECIFICITY

Lex specialis

Lex specialis derogat legi generali. When two rules could apply and one is more specific to the situation than the other, the more specific rule prevails for that situation. The general rule stays on the books, but for the case at hand the specific one is the rule that applies. The classic formulation is that the special rule covers everything the general rule covers, plus at least one further element.

→ CJEU Commission v United Kingdom, C-582/08: Art. 2(1) of the Thirteenth VAT Directive 86/560 is "a lex specialis as compared with Articles 170 and 171" of the VAT Directive 2006/112 (para. 35).

3 / TIME

Lex posterior

When two rules of the same rank collide and neither is more specific, the later one prevails. The presumption is that the legislature knew the earlier law and meant to override it.

→ the Digital Omnibus on AI, Regulation (EU) 2026/1744, amends the AI Act on specified points; on those points the Omnibus displaces the earlier text.

The one that decides real work: for financial entities covered by DORA, DORA is the sector-specific act, so the NIS2 risk-management, reporting and supervision provisions do not stack on top (NIS2 Art. 4(1) and (2), Recital 28). That is lex specialis doing a day's work: it is the difference between one incident-reporting regime and two.

If there is no actual conflict, both norms apply in parallel and the more specific one is simply read first, as a matter of judicial economy. The order only bites when the two cannot both be satisfied.

Worked examples

Each row is the binding instrument at the tier it lives at, with its real citation.

Tier Instrument Real example
1 / Primary Treaty Treaty of Lisbon (2007), Art. 288 TFEU in its current form
2 / Regulation Regulation (EU) 2022/2554 DORA, applies across the EU from 17 Jan 2025
2 / Regulation Regulation (EU) 2024/1689 AI Act, staged application from 2 Feb 2025
2 / Directive Directive (EU) 2022/2555 NIS2, transposition deadline 17 Oct 2024
2 / Delegated Comm. Delegated Reg. (EU) 2024/1772 DORA, classification of ICT-related incidents
2 / RTS Comm. Delegated Reg. (EU) 2024/1773 DORA RTS: ICT third-party service provider policy (Art. 28)
2 / ITS Comm. Implementing Reg. (EU) 2024/2956 DORA ITS: register-of-information templates
3 / National NIS2 national implementations Germany: NIS2UmsuCG, in force 6 Dec 2025. France: not transposed, referred to the CJEU Jul 2026

Reading order if you only have time for one of them: the Treaty first, since it sets the powers, then the Regulation or Directive at the tier your work touches, then the RTS for the numbers and the ITS for the templates. Everything else is guidance or local implementation.

Verify before you rely on it

This is a practitioner's map, not legal advice. Every article and case reference here was checked against the primary text on EUR-Lex, but check the current version before you rely on it operationally. National transposition status in particular moves.

Where to go next

  • DORA, the most developed branch, and the one the RTS and ITS examples come from
  • NIS2, and the Art. 4 carve-out that makes DORA lex specialis for financial entities
  • EU AI Act, amended by the Digital Omnibus cited above
  • Worked examples, where these tiers turn into artefacts

Primary sources