9 September2026. Root legal-text lane closed. Two adopted EU instruments and their expressly incorporated research-organisation definition were acquired from EUR-Lex. These are powers and conditions in enacted text, not decisions about GDI. Both regulation pages show in-force status; this is not a review of every related national measure or later enforcement case.
Under Regulation2022/2065 Article40(4),(8)-(11), the Digital Services Coordinator of the platform provider's establishment grants vetted status for the specific research and issues the reasoned access request. A researcher's home coordinator may perform an initial assessment but does not acquire the final decision. The awarding coordinator can investigate and terminate access if eligibility lapses, after allowing the researcher to respond. Grant participation does not itself confer this status.
Article40(8) requires research affiliation, independence from commercial interests, disclosure of research funding, appropriate security/confidentiality, necessity/proportionality, the specified systemic-risk research purpose and free public results. The incorporated Directive2019/790 Article2(1) defines a scientific-research organisation acting without profit or reinvesting profits, or under a recognised public-interest mission, without preferential results access for an undertaking exercising decisive influence. Its recital12 explains structural control as an exclusion example. This is not an acquired assessment of GDI's eligibility. A licensing business alone does not prove failure of these conditions, nor does government or foundation support prove independence. The stated commercial-independence condition is not a general certification of political neutrality.
Delegated Regulation2025/2050 Article8 and recital12 make the application a particularly revealing expected record. The recital calls for funder identity, amount, nature/duration, awarded versus pending status and, where available, funder evaluations. The operative text requires information about research funding and a declaration of commercial independence relevant to the specific project. We have acquired the required categories, not any applicant's declarations or assessor's reasons.
The coordinator also sets technical, legal and organisational access conditions (Article9). A secure environment can constrain which data researchers see and log processing; the law does not always require transfer of raw data. Article10 requires access-start deadline and termination date. Article15 requires providers to report actual provision/termination within three working days and supply needed documentation. It constrains extra data-management or standard-tool restrictions unless specified in the reasoned request, and additional personal-data conditions outside that request. These are case-specific rules, not a general requirement to integrate any nominated detection product. No approved GDI tool, grant-to-API entitlement or current AI4TRUST connection is shown.
Article7 sets80 working days to issue a reasoned request or explain refusal, with reasoned extension. It is neither GDI's requested maximum60-day process nor a guaranteed data-delivery deadline. Under base Article40(5)-(6), providers can seek amendment within15 days on stated access/security/confidentiality grounds and the coordinator decides within15 days. Delegated Articles12-14 specify assessment, optional mediation with judicial rights preserved, and independent experts. Experts must declare no financial/personal ties to provider or applicant, no outcome interest and no conflict; their opinions are recorded in AGORA. This does not prove any expert has been retained in a named case.
The public record is narrower than the application file. Article11 requires an overview of an issued reasoned request and its changes, containing topic, provider, data description and access modalities. It does not require every applicant, rejected application, funding declaration or reviewer record to appear publicly, and does not require researcher/funder names in that overview. Exact-name failure is therefore not a reliable absence test. Authorised access and actual delivery also leave different records: an overview can show the former, Article15 notification the latter.
Two other legal channels must remain distinct. Article40(12) covers publicly accessible platform data for researchers satisfying conditions8(b)-(e), without the paragraph4 project-specific vetted route. Article22 trusted-flagger status separately gives priority processing of illegal-content notices within an expertise area, with reporting, suspension and revocation rules. It does not make each notice a binding removal command. No status under either channel is inferred for GDI.
The reused GDI20April2026 account says Article40 generically when describing2024 platform applications/refusals. Without original applications and replies, this case cannot assign the exact paragraph or treat them as coordinator vetting decisions. Its calls for a60-day process, standard sharing protocol and mandatory approved-tool API compatibility remain requested changes. The adopted law permits meaningful compelled research access under specified conditions; it does not establish that this organisation obtained it or that any classification controls a commercial or state decision.
Sources and root read scope: dsa2022.html, original2022/2065, complete Articles40 and22 only; access2025.html, original2025/2050, complete Articles1-16 plus selected recitals11,12,14,17,21,24, title/OJ date/status, not whole preamble or Annex; research-definition2019.html, original2019/790, Article2(1) and recital12, other Article2 definitions only contextual. Complete source bytes retained does not mean complete documents read. Selected derivatives and root-transport.json preserve scope and custody. Reused horizon-gdi2026.derived.txt selected account/recommendations read in this run; its original/read history stays in the accepted Horizon packet. No new source independence. Root acquisition ends here.