Fact-based research on EU regulation: AI Act, GDPR, MiCA, DORA. Regulator profiles, fine registries, news. Sources cited.https://klarproof.com/en-ushttps://klarproof.com/regulators/finland/tietosuoja/https://klarproof.com/regulators/finland/tietosuoja/Tietosuojavaltuutetun toimisto is Finland's GDPR supervisory authority — one of the oldest in Europe (1987). What it does, how the collegial Sanctions Board works, why its head also chairs the EU's data-protection board (EDPB), and the €2.4M Posti fine that the Helsinki Administrative Court later annulled.Tue, 23 Jun 2026 00:00:00 GMTregulatorgdprtietosuojagdprfinlandprivacyhttps://klarproof.com/regulators/france/cnil/https://klarproof.com/regulators/france/cnil/The CNIL is France's GDPR supervisory authority — born from the 1974 SAFARI scandal and created by the 1978 Loi Informatique et Libertés, decades before the GDPR. This guide covers what it does, its 18-member college and sanctions chamber, the landmark fines from Google's first €50M to a record €325M, who runs it, and its 2024 figures — every fact sourced.Thu, 11 Jun 2026 00:00:00 GMTregulatorgdprcnilgdprfranceregulatordata-protectionhttps://klarproof.com/regulators/poland/uodo/https://klarproof.com/regulators/poland/uodo/The UODO is Poland's GDPR supervisory authority — the Personal Data Protection Office created in 2018 to replace the old GIODO inspectorate, and one of the most active fining regulators in the EU. What it does, who leads it after the 2024 change at the top, and the security-failure cases (Morele.net, Virgin Mobile) that define its enforcement. Every fact sourced.Thu, 11 Jun 2026 00:00:00 GMTregulatorgdpruodogdprpolandregulatordata-protectionhttps://klarproof.com/regulators/luxembourg/cnpd/https://klarproof.com/regulators/luxembourg/cnpd/The CNPD is Luxembourg's GDPR supervisory authority — a small national regulator that issued the second-largest GDPR fine in history, €746 million against Amazon, because so many global companies base their EU operations in the Grand Duchy. What it is, how its collège is composed after the 2025 change, and why a tiny country's regulator carries outsized weight. Every fact sourced.Thu, 11 Jun 2026 00:00:00 GMTregulatorgdprcnpdgdprluxembourgregulatordata-protectionamazonhttps://klarproof.com/regulators/sweden/imy/https://klarproof.com/regulators/sweden/imy/IMY (Integritetsskyddsmyndigheten) is Sweden's GDPR supervisory authority — the modern name of Datainspektionen, founded in 1973 to enforce what is widely regarded as the world's first national data protection law. This guide covers what it does, the mandate that runs beyond the GDPR, who runs it after the 2024 leadership change, and the Google, Spotify and Klarna fines — every fact sourced.Thu, 11 Jun 2026 00:00:00 GMTregulatorgdprimygdprswedenregulatordata-protectionhttps://klarproof.com/regulators/romania/anspdcp/https://klarproof.com/regulators/romania/anspdcp/The ANSPDCP is Romania's GDPR supervisory authority — one of the top three EU countries by number of fines, yet with some of the smallest amounts. What it is, who leads it, and the security-breach cases (Raiffeisen, UniCredit, and the famous hotel breakfast-list fine) that define a high-volume, low-value enforcement style. Every fact sourced.Thu, 11 Jun 2026 00:00:00 GMTregulatorgdpranspdcpgdprromaniaregulatordata-protectionhttps://klarproof.com/regulators/ireland/central-bank/https://klarproof.com/regulators/ireland/central-bank/The Central Bank of Ireland is both the country's central bank and its financial regulator in one — and, under MiCA, Ireland's single national competent authority for crypto. What it does, how the 2010 reform merged central banking and supervision, who governs it, and its role under MiCA and DORA. Every fact sourced.Thu, 11 Jun 2026 00:00:00 GMTregulatormicadoracentral-bank-irelandmicadorairelandregulatorcryptohttps://klarproof.com/regulators/france/acpr/https://klarproof.com/regulators/france/acpr/The ACPR is France's banking and insurance prudential supervisor, backed by the Banque de France — and, under MiCA, the authority that licenses stablecoin issuers. This guide covers what it does, its three decision-making bodies, the banks it has fined for money-laundering failures (including a €50 million penalty on La Banque Postale), who runs it, and its role under DORA — every fact sourced.Thu, 11 Jun 2026 00:00:00 GMTregulatormicadoraacprmicadorafranceregulatorstablecoinsbankinghttps://klarproof.com/regulators/france/amf/https://klarproof.com/regulators/france/amf/The AMF is France's financial markets regulator — and, under MiCA, the authority that authorises crypto-asset service providers to operate in France. This guide covers what it does, its two-body structure, how it splits crypto supervision with the ACPR, who chairs it, the fines its Enforcement Committee hands down, and its role under MiCA and DORA — every fact sourced.Thu, 11 Jun 2026 00:00:00 GMTregulatormicadoraamfmicadorafranceregulatorcryptohttps://klarproof.com/regulators/luxembourg/cssf/https://klarproof.com/regulators/luxembourg/cssf/The CSSF supervises the professionals and products of Luxembourg's vast financial sector — and, under MiCA, it is the country's single competent authority for crypto, unlike France's split. What it does, its role under MiCA and DORA, and who sits on its Executive Board through a 2026 change. Every fact sourced.Thu, 11 Jun 2026 00:00:00 GMTregulatormicadoracssfmicadoraluxembourgregulatorfundshttps://klarproof.com/regulators/eu/edps/https://klarproof.com/regulators/eu/edps/The European Data Protection Supervisor (EDPS) is the independent authority that watches how the EU's own institutions — the Commission, Parliament, Council, Europol and the rest — handle personal data. What it does, how it differs from the EDPB it is constantly confused with, and who runs it. Every fact sourced.Wed, 10 Jun 2026 00:00:00 GMTregulatorgdpredpsgdpreueudprprivacyhttps://klarproof.com/regulators/germany/bfdi/https://klarproof.com/regulators/germany/bfdi/The BfDI is Germany's federal data-protection regulator — but it supervises only federal bodies and the telecom and postal sector. The rest is handled by 16 state authorities. What the BfDI does, how Germany's two-tier system works, and who runs it. Every fact sourced.Wed, 10 Jun 2026 00:00:00 GMTregulatorgdprbfdigdprgermanyprivacybdsghttps://klarproof.com/regulators/germany/bnetza/https://klarproof.com/regulators/germany/bnetza/Germany chose its Federal Network Agency (Bundesnetzagentur, BNetzA) — the regulator that runs the power grid and telecoms — as its lead AI Act authority, not its data-protection commissioner. What the BNetzA is, the AI role set out in the draft KI-MIG law, and who runs it. Every fact sourced.Wed, 10 Jun 2026 00:00:00 GMTregulatorai-actbnetzaai-actgermanymarket-surveillanceregulationhttps://klarproof.com/regulators/germany/bafin/https://klarproof.com/regulators/germany/bafin/BaFin is Germany's integrated financial supervisor — banks, insurers, securities — and the national authority that licenses crypto firms under MiCA and supervises financial-sector IT resilience under DORA. Germany leads the EU in authorised crypto providers. What BaFin does and who runs it, every fact sourced.Wed, 10 Jun 2026 00:00:00 GMTregulatormicadorabafinmicadoragermanycryptocasphttps://klarproof.com/regulators/netherlands/ap/https://klarproof.com/regulators/netherlands/ap/The Autoriteit Persoonsgegevens is the Netherlands' GDPR supervisory authority — the regulator that fined Uber €290 million and Clearview AI €30.5 million, and, unusually, also the country's coordinating supervisor for algorithms and AI. What it does, how it is run, and who chairs it through the 2026 leadership change — every fact sourced.Wed, 10 Jun 2026 00:00:00 GMTregulatorgdprapgdprnetherlandsregulatoralgorithmsdata-protectionhttps://klarproof.com/enforcement/dora-ctpp-register/https://klarproof.com/enforcement/dora-ctpp-register/On 18 November 2025 the EU designated its first Critical ICT Third-Party Providers (CTPPs) under DORA — 19 tech firms, from the hyperscale clouds to SAP and Bloomberg, now overseen directly by EU regulators. The full list, what designation means, and the powers behind it — sourced to the official ESA document.Wed, 10 Jun 2026 00:00:00 GMTenforcementdoradoractppictoversighteucloudregistryhttps://klarproof.com/enforcement/mica-stablecoins-usdt-delisting/https://klarproof.com/enforcement/mica-stablecoins-usdt-delisting/MiCA's most visible real-world effect: by early 2025 the EU's licensed exchanges had removed Tether (USDT) for EEA users, while Circle's MiCA-authorised USDC and EURC moved in. The delisting timeline, why it happened, and how the EBA's 'significant token' test works — sourced to the regulators and editorial press.Wed, 10 Jun 2026 00:00:00 GMTenforcementmicamicastablecoinusdtusdcebaenforcementregistryhttps://klarproof.com/enforcement/big-tech-gdpr-fines/https://klarproof.com/enforcement/big-tech-gdpr-fines/A registry of the biggest GDPR fines ever issued — Meta €1.2 billion, Amazon €746 million, TikTok €530 million, Uber €290 million and more. Who was fined, how much, for what, why almost all of them come out of Ireland, and which ones courts have already overturned — every amount sourced to the regulator or the binding EU decision behind it.Wed, 10 Jun 2026 00:00:00 GMTenforcementgdprgdprbig-techfinesenforcementmetatiktokdata-transfershttps://klarproof.com/enforcement/aepd-fines/https://klarproof.com/enforcement/aepd-fines/A registry of the largest fines from Spain's AEPD — Google €10M, Vodafone €8.15M, CaixaBank €6M, BBVA €5M and more — and why Spain matters less for the size of any single fine than for sheer volume: it issues a larger share of the EU's GDPR fines than any other country. Who was fined, for what, and why banks and telcos dominate the list. Every amount sourced.Wed, 10 Jun 2026 00:00:00 GMTenforcementgdprgdpraepdspainfinesenforcementbankstelecomshttps://klarproof.com/enforcement/cnil-fines/https://klarproof.com/enforcement/cnil-fines/A registry of the biggest fines issued by France's CNIL — Google €150M and €100M, Facebook €60M, Microsoft €60M, Orange €50M, Criteo €40M and more. Why most of them are about cookies rather than the GDPR, why the CNIL can fine Big Tech directly when Ireland normally would, and which fines France's top court has upheld — every amount sourced to the regulator.Wed, 10 Jun 2026 00:00:00 GMTenforcementgdprgdprcnilfrancecookiesfinesenforcementeprivacyhttps://klarproof.com/enforcement/dpc-fines/https://klarproof.com/enforcement/dpc-fines/A registry of fines from Ireland's DPC — the lead regulator for most of Big Tech, which imposed over €652 million in a single year, yet is accused of going easy on the platforms and being forced higher by the EU. The Big Tech mega-fines, the modest domestic Irish cases (Tusla, Bank of Ireland), and the bottleneck criticism — every fact sourced.Wed, 10 Jun 2026 00:00:00 GMTenforcementgdprgdprdpcirelandbig-techfinesenforcementone-stop-shophttps://klarproof.com/enforcement/garante-fines/https://klarproof.com/enforcement/garante-fines/A registry of the largest GDPR fines from Italy's Garante — Enel Energia €79.1M and €26.5M, TIM €27.8M, Wind Tre €16.7M, Vodafone €12.25M — plus the pioneering gig-economy cases against Foodinho and Deliveroo. Why Italy's enforcement is dominated by unsolicited marketing calls and worker-management algorithms, and what each company did. Every amount sourced to the regulator.Wed, 10 Jun 2026 00:00:00 GMTenforcementgdprgdprgaranteitalytelemarketingfinesenforcementgig-economyhttps://klarproof.com/news/germany-ai-act-implementation-ki-mig/https://klarproof.com/news/germany-ai-act-implementation-ki-mig/Germany's Federal Cabinet adopted the government draft of its AI Act implementation law on 10 February 2026. It names the Federal Network Agency (BNetzA) as the main market-surveillance authority — but it is not yet enacted.Wed, 10 Jun 2026 00:00:00 GMTnewsai-actai-actgermanybnetzaenforcementregulationhttps://klarproof.com/news/eba-new-chair-michaud/https://klarproof.com/news/eba-new-chair-michaud/François-Louis Michaud became Chair of the European Banking Authority on 16 April 2026, succeeding José Manuel Campa. The EBA supervises significant stablecoin issuers under MiCA and is one of the three ESAs under DORA.Wed, 10 Jun 2026 00:00:00 GMTnewsmicamicadoraebaeustablecoinleadershiphttps://klarproof.com/news/openai-fine-annulled-rome-court/https://klarproof.com/news/openai-fine-annulled-rome-court/Italy's Tribunale di Roma has overturned, in full, the €15 million fine the Garante imposed on OpenAI over ChatGPT in December 2024 — the first major European generative-AI penalty to fall in court.Wed, 10 Jun 2026 00:00:00 GMTnewsgdprgdpropenaigaranteitalyaicourthttps://klarproof.com/regulators/eu/eba/https://klarproof.com/regulators/eu/eba/The European Banking Authority writes the EU's banking rulebook and, under MiCA, is the body that directly supervises the largest 'significant' stablecoins — the one part of crypto licensing that is centralised at EU level, not national. What it does, how it differs from ESMA, who runs it after the 2026 leadership change, and its role under DORA — every fact sourced.Sun, 17 May 2026 00:00:00 GMTregulatormicadoraebamicadoraeucryptostablecoinsregulatorhttps://klarproof.com/regulators/eu/eiopa/https://klarproof.com/regulators/eu/eiopa/The European Insurance and Occupational Pensions Authority is the EU's supervisor for insurance and occupational pensions. It has no crypto or MiCA role at all — it matters to this site for one reason: it is the third of the three ESAs that jointly run DORA. What it does, how it differs from EBA and ESMA, and who runs it — every fact sourced.Sun, 17 May 2026 00:00:00 GMTregulatordoraeiopadoraeuinsurancepensionsregulatorhttps://klarproof.com/regulators/eu/ai-office/https://klarproof.com/regulators/eu/ai-office/The European AI Office is the body that polices general-purpose AI — the GPT/Claude/Gemini-class models — directly from Brussels. What it does, the structural detail most coverage skips (it is not an independent agency — it is a department inside the European Commission), who runs it, and where it stops and national authorities take over — every fact sourced.Sun, 17 May 2026 00:00:00 GMTregulatorai-actai-officeai-acteugpairegulatoreuropean-commissionhttps://klarproof.com/regulators/eu/esma/https://klarproof.com/regulators/eu/esma/The European Securities and Markets Authority is the EU body that writes the technical rulebook for MiCA crypto and is one of the three authorities overseeing DORA. What it does, what it deliberately does NOT do (it does not licence or fine crypto firms — national regulators do), who runs it, and where it sits next to EBA — every fact sourced.Sun, 17 May 2026 00:00:00 GMTregulatormicadoraesmamicadoraeucryptoregulatorhttps://klarproof.com/regulators/italy/garante/https://klarproof.com/regulators/italy/garante/The Garante per la protezione dei dati personali is Italy's GDPR supervisory authority — and the regulator that made global headlines by temporarily blocking ChatGPT. What it does, how its four-member Collegio is structured, why the first big AI fines in Europe are Italian, and who runs it after the January 2026 mandate change — every fact sourced.Sun, 17 May 2026 00:00:00 GMTregulatorgdprgarantegdpritalyregulatoraidata-protectionhttps://klarproof.com/regulators/ireland/dpc/https://klarproof.com/regulators/ireland/dpc/The Data Protection Commission is Ireland's GDPR supervisory authority — and, because Meta, Google, Apple, TikTok, X and LinkedIn run their EU operations from Ireland, the lead regulator for most of Big Tech across the whole EU under the one-stop-shop. What it does, why one national authority carries EU-wide weight, and who runs it after the move from one Commissioner to a three-person Commission — every fact sourced.Sun, 17 May 2026 00:00:00 GMTregulatorgdprdpcgdprirelandregulatorbig-techone-stop-shophttps://klarproof.com/regulators/spain/aesia/https://klarproof.com/regulators/spain/aesia/AESIA is the EU's first dedicated national AI agency — Spain's authority for supervising and, where needed, sanctioning AI systems under the AI Act. What it does, the key detail that it is not an independent authority (unlike a data-protection DPA), who runs it, and where it sits — every fact sourced.Sun, 17 May 2026 00:00:00 GMTregulatorai-actaesiaai-actspainregulatorai-supervisionhttps://klarproof.com/regulators/spain/aepd/https://klarproof.com/regulators/spain/aepd/The Agencia Española de Protección de Datos is Spain's GDPR supervisory authority — and, by number of fines, the most prolific data-protection enforcer in the EU. What it does, why it is not the same body as Spain's AI authority AESIA, the 2025 leadership change under a new selection model, and who runs it — every fact sourced.Sun, 17 May 2026 00:00:00 GMTregulatorgdpraepdgdprspainregulatordata-protectionhttps://klarproof.com/enforcement/garante-ai-fines/https://klarproof.com/enforcement/garante-ai-fines/A registry of the Italian data protection authority's enforcement against generative-AI services: €15M on OpenAI for ChatGPT (later annulled by a Rome court) and €5M on Luka for Replika. What was violated, the exact articles, and the fate of each decision — every fact sourced to the regulator, the court record and editorial press.Sun, 17 May 2026 00:00:00 GMTenforcementgdprai-actgdprgaranteitalyaiopenaireplikafineshttps://klarproof.com/enforcement/clearview-ai-fines/https://klarproof.com/enforcement/clearview-ai-fines/A registry of the GDPR fines imposed on Clearview AI by EU data protection authorities — Italy, Greece, France and the Netherlands — for scraping billions of faces without a legal basis. The exact amounts, articles and orders, why the company has paid none of them, and how the UK route diverged. Every fact sourced to the regulator.Sun, 17 May 2026 00:00:00 GMTenforcementgdprai-actgdprclearviewfacial-recognitionbiometricaienforcementfineshttps://klarproof.com/regulators/estonia/aki/https://klarproof.com/regulators/estonia/aki/AKI is Andmekaitse Inspektsioon, Estonia's GDPR supervisory authority. What it does, who runs it, how to file a complaint, and how it went from issuing €280 fines to a €3,000,000 fine in 2025.Wed, 06 May 2026 00:00:00 GMTregulatorgdprakigdprestoniaprivacyhttps://klarproof.com/regulators/eu/edpb/https://klarproof.com/regulators/eu/edpb/The European Data Protection Board is the EU-wide body that coordinates national data-protection regulators (DPAs) and resolves cross-border GDPR disputes. What it does, how the one-stop-shop mechanism works, who leads it, and what binding decisions look like.Wed, 06 May 2026 00:00:00 GMTregulatorgdpredpbgdpreuone-stop-shopprivacyhttps://klarproof.com/enforcement/aki-fines/https://klarproof.com/enforcement/aki-fines/A complete public registry of fines issued by the Estonian Data Protection Inspectorate — from token misdemeanour fines of a few dozen euros on individuals up to €3 million against the Apotheka pharmacy chain. What was violated, which decisions were overturned in court, and why Estonia is the EU's most lenient GDPR jurisdiction — and is right now ceasing to be one.Wed, 06 May 2026 00:00:00 GMTenforcementgdprgdprakiestoniafinesprivacy