A business that operate in, say, Germany, reports to the German authority.
A business that operates in 10 EU countries, can declare which one is the major country for them, and they have to deal only with the authority in that one country.
That's not how my lawyer explained it to me. They said that I was liable for violating privacy laws, or the opinion of the regulator, in any German state, even though I am a US company. And it doesn't matter if I have an EU subsidiary and I declare a major country. Maybe your lawyer has a different opinion, but they tell me I shouldn't go hire the lawyer that says what I want to hear.