The CJEU has reinforced that responsibility under EU regulatory regimes attaches based on factual control rather than contractual labels. In cases addressing GDPR and digital services obligations, the court has focused on operational influence and decision-making authority. For SaaS providers and integrators, this elevates the importance of clearly allocating responsibilities, audit rights, and escalation mechanisms across customer and supplier contracts to avoid unintended liability concentration.