European Union: compliance overview
15 regulations, 106 mapped obligations and 6 data-transfer routes, organised by when they start to bind you and what you have to do.
Regulatory timeline: what comes next
2025-01-17
Registry information submission deadline for digital infrastructure and ICT service management entities
EU NIS 2 Directive2025-01-17
DORA starts to apply
DORA obligations bearing on AI and ICT third-party service providers2025-02-02
General provisions and prohibited practices apply
EU Artificial Intelligence Act2025-04-17
Member States must establish the list of essential and important entities
EU NIS 2 Directive2025-08-02
GPAI model obligations and governance framework apply
EU Artificial Intelligence Act2025-09-12
Regulation becomes applicable
EU Data Act2025-11-19
Commission proposal presented as part of the digital omnibus package
AI Omnibus (Digital Omnibus on AI)2026-03-24
Implementing Regulation (EU) 2026/481 enters into force: the small-series limit is lifted for automated valet parking and Annex V is added
EU implementing regulation on type-approval of the automated driving system (ADS) of fully automated vehicles2026-06-11
Chapter IV on notification of conformity assessment bodies (Arts. 35-51) applies
EU Cyber Resilience Act2026-07-24
Regulation published in the Official Journal
AI Omnibus (Digital Omnibus on AI)2026-07-27
Regulation enters into force; AI Act Articles 102 to 110 apply from this date
AI Omnibus (Digital Omnibus on AI)2026-07-27
Digital Omnibus enters into force: the Machinery Regulation moves from AI Act Annex I Section A to Section B, and AI requirements are migrated into it
EU Machinery Regulation2026-08-02
General date of application; Article 50 transparency rules apply; enforcement starts
EU Artificial Intelligence Act2026-09-11
The Article 14 manufacturer reporting obligations apply
EU Cyber Resilience Act2026-09-12
The access-by-design obligation applies to newly placed connected products
EU Data Act2026-10-20
Member States must notify their penalty rules to the Commission; Article 50(1) applies from the same day
EU Machinery Regulation2026-12-02
Two new prohibitions apply; Article 50(2) retrofit deadline for legacy synthetic-content systems
EU Artificial Intelligence Act2026-12-02
New prohibitions and the Article 50(2) legacy retrofit take effect on the same day
AI Omnibus (Digital Omnibus on AI)2026-12-09
Transposition deadline; applies to products placed on the market or put into service after this date
EU revised Product Liability Directive (covering software and AI systems)2027-01-12
Switching charges for data processing services are fully withdrawn
EU Data Act2027-01-20
Machinery Regulation applies in full; Directive 2006/42/EC is repealed
EU Machinery Regulation2027-08-02
Legacy GPAI models must be compliant; national regulatory sandboxes operational
EU Artificial Intelligence Act2027-09-02
Commission must publish post-market monitoring plan guidance including a voluntary template
AI Omnibus (Digital Omnibus on AI)2027-09-12
Chapter IV extends to certain legacy long-term contracts
EU Data Act2027-12-02
Rules for Annex III high-risk AI systems apply (as postponed by the AI Omnibus)
EU Artificial Intelligence Act2027-12-11
Regulation fully applicable
EU Cyber Resilience Act2027-12-31
End of the transition for devices with old-directive certificates (class III and certain class IIb implantables)
AI medical software under the EU Medical Devices Regulation2028-08-02
Rules for Annex I embedded high-risk AI systems apply (as postponed by the AI Omnibus)
EU Artificial Intelligence Act2028-08-02
Delegated acts adding AI health and safety requirements to Machinery Regulation Annex III must apply
AI Omnibus (Digital Omnibus on AI)2028-08-02
Latest date by which the delegated acts adding AI health and safety requirements to Annex III must apply
EU Machinery Regulation2028-12-31
End of the transition for the remaining class IIb, class IIa and certain class I devices
AI medical software under the EU Medical Devices Regulation2030-08-02
Compliance deadline for legacy high-risk systems intended for use by public authorities
EU Artificial Intelligence Act
Applicable regulations (15)
EU Artificial Intelligence Act
Typical triggering business actions: (1) serving EU customers with a foundation-model API, model weights or hosted inference, which constitutes placing a GPAI model on the Union market; (2) embedding AI in hardware sold into the EU (service robots, smart cockpits, industrial cameras, medical devices), bringing it under Annex I or Annex III; (3) selling SaaS to EU business customers for CV screening, creditworthiness assessment, educational evaluation or critical-infrastructure control, which falls under Annex III; (4) having no EU establishment but having the system output used in the EU under Art. 2(1)(c), e.g. a China-operated model serving inference to an EU application; (5) using third-party high-risk AI tools inside the EU, which is the position of an EU subsidiary running recruitment screening. Conversely, systems developed and put into service solely for scientific research and development and not placed on the market, and systems used exclusively for military, defence or national security purposes, are out of scope.
28 obligations · reviewed 2026-09-12
AI Omnibus (Digital Omnibus on AI)
Any Chinese AI company that planned its EU compliance spend against the original timetable should re-baseline. If the product falls into an Annex III high-risk use case, the deadline for conformity assessment and EU database registration moves from 2 Aug 2026 to 2 Dec 2027; if the AI is a safety component of machinery, toys, medical devices or other products under Union product legislation, it moves to 2 Aug 2028. Two things do not slip: the transparency and synthetic-content marking duties still apply from 2 Aug 2026, with legacy systems to be retrofitted by 2 Dec 2026; and the GPAI model obligations have applied since 2 Aug 2025. Companies qualifying as EU small mid-cap enterprises may also use the simplified technical documentation form and benefit from the lower fine cap.
5 obligations · reviewed 2026-09-12
EU General Data Protection Regulation (GDPR)
Two independent routes. First, if the company has an establishment in the EU (subsidiary, branch, stable arrangement) and the processing occurs in the context of that establishment’s activities, the GDPR applies wherever the processing takes place (Art. 3(1)). Second, even with no EU establishment, it applies where the company offers goods or services to data subjects in the EU, whether or not payment is required, or monitors their behaviour within the EU (Art. 3(2)). Concrete triggers for Chinese AI companies: an app or web product open to EU sign-ups; SaaS or APIs for EU business customers that carry end-user personal data, where the company is usually a processor; tracking EU visitors with cookies, SDKs or device fingerprinting; scraping web pages containing EU residents’ personal data for model training; and recruiting or employing staff in the EU. Mere accessibility of a website from the EU is generally not enough; an intention to target the EU market is needed, evidenced for example by EU languages, euro pricing or EU delivery.
11 obligations · reviewed 2026-09-12
EU Data Act
The scope expressly reaches non-EU entities. Concrete triggers: (1) manufacturers of connected products placed on the EU market — service robots, robot vacuums, smart cameras, wearables, smart cockpits, industrial sensing equipment — and providers of their related services, irrespective of place of establishment (Art. 1(3)(a)); (2) data holders making data available to data recipients in the Union, irrespective of establishment (Art. 1(3)(c)); (3) providers of data processing services serving customers in the Union, irrespective of establishment (Art. 1(3)(f)), which catches Chinese cloud vendors, AI PaaS and model-hosting platforms selling into the EU; and (4) providers holding non-personal data in the Union, who face the Art. 32 restrictions on third-country governmental access. Note that Chapter II covers both personal and non-personal data and applies alongside the GDPR.
6 obligations · reviewed 2026-09-12
EU NIS 2 Directive
Typical triggers: a Chinese company providing cloud computing, data centre, content delivery network, managed services or managed security services in the EU (Annex I points 8 and 9), or operating an online marketplace, online search engine or social networking platform (Annex II point 6), and qualifying as a medium-sized enterprise under Recommendation 2003/361/EC or exceeding those ceilings. An entity not established in the Union but offering such services there must designate a representative under Art. 26(3) in one of the Member States where the services are offered, and falls under that Member State’s jurisdiction; where no representative is designated, any Member State in which it provides services may take legal action against it. Note that a plain SaaS application is not necessarily a "cloud computing service"; whether it is caught depends on the national transposing definition and must be checked country by country.
5 obligations · reviewed 2026-09-12
EU Cyber Resilience Act
Triggering business actions: placing on the EU market any hardware or software product with networking or data-connection capability — robot bodies and controllers, smart cameras and sensors, edge inference boxes, wearables, and AI applications and SDKs sold as standalone software. Application does not depend on place of establishment, so Chinese manufacturers supplying the EU directly or through importers are caught. A manufacturer may (but need not) appoint an EU authorised representative, while importers and distributors have their own verification duties, and EU channel partners typically make CRA compliance a precondition for purchasing. Expressly excluded: products covered by the Medical Devices Regulation (EU) 2017/745, the In Vitro Diagnostic Regulation (EU) 2017/746 and the General Vehicle Safety Regulation (EU) 2019/2144; products certified under Regulation (EU) 2018/1139; and marine equipment within the scope of Directive 2014/90/EU. Art. 2(6) further excludes spare parts made available on the market to replace identical components and manufactured to the same specifications, and Art. 2(7) excludes products developed or modified exclusively for national security or defence purposes as well as products specifically designed to process classified information.
8 obligations · reviewed 2026-09-12
EU Digital Services Act
This entry covers only the AI-platform-relevant portion. Triggering business actions: a Chinese company operating in the EU a service that hosts user-generated content (an AI community, a model-sharing site, an AI-generated content platform, or a generative product where users can publish works publicly), or operating an online platform that connects users with third-party content or goods, or an online search engine. A pure B2B API that neither stores nor disseminates user content to the public generally is not an intermediary service; the decisive test is whether information is stored at the request of a recipient and disseminated to the public. Any provider offering services in the Union without an EU establishment must designate a legal representative under Art. 13 and notify the Digital Services Coordinator of the Member State where that representative resides or is established.
7 obligations · reviewed 2026-09-12
EU revised Product Liability Directive (covering software and AI systems)
This is a civil liability rule invoked before EU courts rather than an administrative obligation, but it determines a Chinese company’s EU exposure. It is triggered by placing robots, smart hardware, autonomous driving systems, medical AI devices or standalone AI software on the EU market after 9 Dec 2026. The liability chain under Art. 8(1) runs to the manufacturer of a defective product; the manufacturer of a defective component where it was integrated or inter-connected within the manufacturer’s control and caused the product to be defective; and, where the manufacturer of the product or component is established outside the Union, the importer, the manufacturer’s authorised representative, and where there is neither an EU importer nor an authorised representative, the fulfilment service provider. In addition, any natural or legal person that substantially modifies a product outside the manufacturer’s control and thereafter makes it available on the market or puts it into service is considered the manufacturer of that product for the purposes of the Directive (Art. 8(2)). The Directive does not apply to free and open-source software developed or supplied outside the course of a commercial activity (Art. 2(2)).
4 obligations · reviewed 2026-09-12
EU Data Governance Act
Triggering business actions: a Chinese company operating in the EU a data marketplace, a data exchange platform, a matchmaking platform for joint modelling or federated learning, a marketplace for training datasets, or a service helping individuals pool consent for their data to be used in AI training. Art. 11(3) is explicit: a provider not established in the Union that offers the Art. 10 services in the Union must designate a legal representative in one of the Member States where the services are offered and is deemed to fall under that Member State’s jurisdiction. Conversely, a company that uses data for its own products and model training rather than intermediating flows between third parties is generally not a data intermediation services provider, and that is the decisive dividing line.
3 obligations · reviewed 2026-09-12
EU ePrivacy Directive
Triggering business actions: (1) placing cookies, SDKs, pixels, local storage, device fingerprinting or any technique that reads from or writes to terminal equipment in a website or app aimed at EU users — Art. 5(3) requires consent whether or not personal data is involved, which is both different from and stricter than the GDPR; (2) sending marketing email, SMS or automated push messages to EU users; and (3) analysing communication content or traffic data in communication products such as messaging, conferencing or voice assistants, including processing communication content to train models, which must be assessed specifically against the Art. 5(1) consent requirement. Note that ePrivacy is a directive, so scope, the reading of "strictly necessary" and enforcement intensity are set by national law and differ markedly between Member States.
3 obligations · reviewed 2026-09-12
EU Machinery Regulation
A Chinese company is in scope as soon as it places machinery or a "related product" on the EU market or puts it into service in the EU. Typical triggers: shipping industrial robots, cobots, AGV/AMR fleets, robot cells or end-effectors to EU customers; supplying vision or force-control safety components, safety PLCs or safety-related software that perform a safety function; embedding a self-evolving motion-control or obstacle-avoidance model as a safety component in machines sold into the EU; retrofitting or upgrading machinery already placed on the EU market, which may amount to a substantial modification under Article 18 and pull the full manufacturer obligations onto the modifier. Products made in China and never entering the EU market are out of scope.
7 obligations · reviewed 2026-09-12
EU General Product Safety Regulation
A Chinese company is caught when it sells consumer robots, vacuum/mower/companion robots, smart cameras, AI toys or wearables to EU consumers through its own webshop, an online marketplace such as Amazon or eBay, or an EU distributor; when it offers products to EU consumers by distance selling (Article 19 expressly covers distance sales); or when it supplies AI hardware accessories with consumer characteristics. If the product ends up with an EU consumer, an Article 16 responsible person established in the Union must be in place before it may be placed on the market.
6 obligations · reviewed 2026-09-12
EU implementing regulation on type-approval of the automated driving system (ADS) of fully automated vehicles
A Chinese company is caught when it places unsupervised vehicles — robotaxis, driverless shuttles, delivery robots, port or campus autonomous vehicles — on the EU market and seeks type approval; when it deploys fleets with an EU transport service operator, defined in the Regulation as the entity providing a transport service using one or more fully automated vehicles; when, as an ADS supplier to an EU vehicle manufacturer, it must deliver the safety concept, scenario catalogue, virtual validation toolchain credibility evidence and in-service reporting interface; and when it runs remote assistance or remote monitoring centres for exported vehicles. Vehicles operating only on Chinese pilot roads are out of scope, but the scenario catalogue and safety argumentation can be reused provided the EU-side evidence is restructured to Annex III.
3 obligations · reviewed 2026-09-12
AI medical software under the EU Medical Devices Regulation
A Chinese AI company is caught when it supplies imaging-assisted diagnosis, pathology analysis, ECG or glucose physiological monitoring, treatment planning or medication recommendation software — including SaaS and cloud inference services — to EU hospitals, imaging centres or distributors; when it supplies AI modules forming part of a device to EU device manufacturers, who cascade the MDR requirements through supplier agreements; when it sells AI-enabled medical hardware under its own brand in the EU; and when it runs pre-market clinical investigations in the EU to support conformity assessment. The decisive test is not whether a large model is used but whether the software provides information used to take decisions with diagnosis or therapeutic purposes and how severe the impact of those decisions may be. A non-EU manufacturer must first appoint an EU authorised representative under Article 11 or it cannot place the device on the market.
6 obligations · reviewed 2026-09-12
DORA obligations bearing on AI and ICT third-party service providers
A Chinese AI company is caught when it supplies AI risk control, anti-fraud, research, customer service, document understanding or agent SaaS to EU banks, insurers, investment firms, payment institutions or trading venues; when it provides model inference APIs, vector databases, data analytics services or managed compute to such customers; when, as a group entity, it provides ICT services predominantly to its parent, subsidiaries or branches, since the Regulation expressly treats such entities as ICT third-party service providers; and when it takes part in payment-processing activities or operates payment infrastructure. The practical trigger is usually not a regulator but the financial customer inserting the Article 30 clauses into the contract at procurement or renewal and asking for the register of information fields. Where the service supports a critical or important function, the clause density and the audit cooperation duties rise sharply.
4 obligations · reviewed 2026-09-12
Data transfer routes
EU adequacy decision (GDPR Art. 45)
No volume threshold. Adequacy applies whenever the importer sits in a listed country, territory or sector and the transfer falls within the scope of that decision. Two partial decisions need care: Canada covers only private-sector commercial activity subject to PIPEDA; Japan covers only personal information handling business operators (PIHBOs) under the APPI and carries Supplementary Rules. The US decision covers only recipients that are actively self-certified to the Data Privacy Framework for the relevant data category.
Lead time: Estimate: 1-3 working days - this is a verification and documentation exercise, not an approval process. · Cost band Low
EU Standard Contractual Clauses (Decision 2021/914, four modules)
No volume threshold. Whenever personal data goes to a third-country importer with no adequacy decision and no Art. 49 derogation, SCCs are the default. Three points are routinely got wrong: (1) Clause 14 requires a documented assessment of the destination’s laws and practices (a TIA) before the transfer; (2) the pre-2021 SCCs were repealed with effect from 27 Sep 2021 and the transition for contracts concluded on them ended on 27 Dec 2022, so legacy templates are no longer a valid safeguard; (3) where the importer is itself directly subject to the GDPR under Art. 3(2), this set of clauses was not designed for that scenario and the Commission has signalled separate clauses - as of 12 Sep 2026 this research pass found no adopted decision covering it, so treat that case on specific legal advice.
Lead time: Estimate: 2-4 weeks for a single vendor including the TIA; 6-12 weeks for a group-wide roll-out plus supply chain. Expect longer where the importer resists the Clause 14 disclosure duties or the audit rights. · Cost band Medium
EU transfer impact assessment (SCC Clause 14 / EDPB six-step method)
No volume threshold. Any transfer to a third country relying on an Art. 46 tool (SCCs, BCRs, an approved code of conduct or certification mechanism) requires a documented, retained TIA; transfers under an Art. 45 adequacy decision do not. For Chinese companies going abroad the predictable pressure point is the reverse direction: where a Chinese parent or a China-based affiliate is the importer, EU customers and their counsel will probe how the National Intelligence Law, the Counter-Espionage Law and Art. 36 of the Data Security Law (no provision of domestic data to foreign judicial or law-enforcement authorities without approval of the competent authority) apply to the specific transfer, and what transparency and redress exist. Prepare the TIA proactively rather than waiting to be asked.
Lead time: Estimate: 1-2 weeks for a single low-risk destination with established precedent; 4-8 weeks where the data is highly sensitive or the destination’s law is contested, which usually needs local outside counsel. · Cost band Medium
EU Binding Corporate Rules (GDPR Art. 47)
No volume threshold but a structural one: BCRs cover only transfers inside one group of undertakings or a group engaged in a joint economic activity. Transfers to external customers, suppliers or channel partners cannot use BCRs and still need SCCs. There are controller BCRs (BCR-C, for the group acting as controller) and processor BCRs (BCR-P, for intra-group transfers when the group processes on customers’ behalf). The typical fit for a Chinese AI company: an EU entity whose model training, inference operations or support is performed remotely by teams in China or another third country, so that intra-group access is frequent and permanent - at that point BCRs are cheaper than maintaining dozens of SCCs. Note that BCRs do not remove the Art. 46 transfer-assessment duty; Art. 47(2)(m) itself requires conflicting third-country legal requirements to be reported to the supervisory authority.
Lead time: Estimate: 12-24 months from kick-off to formal approval (3-6 months drafting, 9-18 months regulator review plus the consistency mechanism). This is the longest lead time in this matrix and is not a fit for a single project. · Cost band Very High
EU derogations for specific situations (GDPR Art. 49)
No volume threshold but an exceptionality threshold: Art. 49 is designed as an exception, not a routine channel, and regulators consistently reject its use for systematic, repetitive, large-scale business transfers. A workable test: if the transfer is a standing part of how the product runs - routing EU users’ prompts to an inference cluster in China every day, say - it cannot rest on Art. 49(1)(a) consent or (b) contractual necessity and must use SCCs or BCRs. Under Art. 49(3), points (a), (b) and (c) and the compelling-legitimate-interests route do not apply to activities carried out by public authorities in the exercise of their public powers; under Art. 49(4) the important public interest in point (d) must be recognised in Union law or the law of the Member State to which the controller is subject.
Lead time: Estimate: 1-2 weeks to design and document the consent flow; add 2-4 weeks for the compelling-legitimate-interests route because the supervisory authority must be informed. · Cost band Low
EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795)
No volume threshold. It can be relied on only where the US importer is Active on the Data Privacy Framework list and the data category in question falls within its self-certification. Three frequent errors: (1) HR data requires separate certification and is otherwise not covered; (2) a listing can go Inactive or be removed, in which case the US entity still owes continuing obligations for data already received but new transfers lose their basis; (3) the UK and Switzerland each have their own extension (for the UK, the UK-US data bridge / UK Extension), and the EU decision does not automatically cover transfers out of the UK or Switzerland.
Lead time: Estimate: 1-3 working days for the listing check and the contract amendment. · Cost band Low
What you can use right now
Playbooks
Templates
Relevant standards
- European Sustainability Reporting Standards (ESRS) and the CSRD reporting duty · First set of ESRS: Delegated Regulation (EU) 2023/2772 (as amended by (EU) 2025/1416); CSRD: Directive (EU) 2022/2464, as amended by (EU) 2025/794 and (EU) 2026/470 (mandatory)
- EU Carbon Border Adjustment Mechanism (CBAM) · Regulation (EU) 2023/956 (adopted 10 May 2023, OJ L 130, published 16 May 2023), as amended by Regulation (EU) 2025/2083; definitive period from 1 January 2026 (mandatory)
- ISO 14064-1:2018 Greenhouse gases — Specification with guidance at the organization level for quantification and reporting of greenhouse gas emissions and removals · ISO 14064-1:2018 / EN ISO 14064-1:2018
- ISO 14067:2018 Greenhouse gases — Carbon footprint of products — Requirements and guidelines for quantification · ISO 14067:2018
- ISO/IEC 42001 Artificial Intelligence Management System (AIMS) · ISO/IEC 42001:2023 (edition 1, dated 2023-12); European adoption EN ISO/IEC 42001:2026
- ISO/IEC 22989:2022 Artificial intelligence concepts and terminology · ISO/IEC 22989:2022 (edition 1, 2022-07-19; European adoption EN ISO/IEC 22989:2023)
- ISO/IEC 27001:2022 Information security management systems — Requirements · ISO/IEC 27001:2022 (edition 3, 2022-10); European adoption EN ISO/IEC 27001:2023, including Amendment A1:2024
- ISO/IEC 27002:2022 Information security controls · ISO/IEC 27002:2022 (2022-02-15; European adoption EN ISO/IEC 27002:2022, including Corrigendum AC:2024)
- ISO/IEC 27701:2025 Privacy information management systems — Requirements and guidance · ISO/IEC 27701:2025 (edition 2, 2025-10), cancelling and replacing ISO/IEC 27701:2019
- CSA STAR and STAR for AI (including CCM, CAIQ, AICM and AI-CAIQ) · STAR program (combined CCM/CAIQ v4.1); AI Controls Matrix AICM v1 (released 2025-07-09, updated 2025-10-30; v1.1 also published)
- EU General-Purpose AI Code of Practice · Version published 2025-07-10, with three chapters: Transparency, Copyright, and Safety and Security
- EU Cloud Code of Conduct · Transnational code of conduct under GDPR Articles 40/41, endorsed by the EDPB (approved by the Belgian Data Protection Authority in May 2021), with a controls catalogue and three compliance levels
- TISAX and the VDA ISA (automotive supply chain information security assessment and exchange) · VDA ISA2027 (officially released by the VDA on 2026-07-01); from 2027 ISA is released in annual versions
What has actually happened here
- TikTok fined EUR 530 million for failing to demonstrate essential equivalence under Chinese law2025
- Meta fined EUR 1.2 billion for continuing EU–US transfers after Schrems II2023
- DPC uses its urgent High Court power for the first time; X’s undertaking on Grok training data is made permanent and the proceedings are struck out2024
- OpenAI fined EUR 15 million and ordered to run a six-month public information campaign (the decision was set aside by the Court of Rome at first instance)2024
- DeepSeek hit with an urgent processing-limitation order after arguing EU law did not apply to it2025
- Luka Inc. fined EUR 5 million over Replika, with a separate inquiry opened into the model’s training lifecycle2025
- Character.AI fined EUR 158,000 for notice shortcomings and late DPIA and EU representative, with a 120-day reporting duty2026
- Clearview AI fined EUR 30.5 million by the Dutch DPA, with up to EUR 5.1 million in non-compliance penalties2024
Sources (27)
- Regulation (EU) 2024/1689 (Artificial Intelligence Act) — Official Journal textOfficial Journal of the European Union / EUR-Lex · published 2024-07-12 · retrieved 2026-09-12
- Regulation (EU) 2026/1744 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI)Official Journal of the European Union / EUR-Lex · Art. 1(39)-(40) · published 2026-07-24 · retrieved 2026-09-12
- Timeline for the implementation of the EU AI Act (AI Act Service Desk)European Commission — AI Act Service Desk · retrieved 2026-09-12
- EU regulatory framework for AI — official policy page (risk tiers and application timeline)European Commission — Shaping Europe’s digital future · retrieved 2026-09-12
- European Commission news: the AI Omnibus enters into force on 27 July 2026European Commission — Shaping Europe’s digital future · published 2026-07-27 · retrieved 2026-09-12
- Guidelines on the scope of obligations for providers of general-purpose AI models under the AI ActEuropean Commission — European AI Office · published 2025-07-18 · retrieved 2026-09-12
- General-Purpose AI Code of Practice (Transparency, Copyright, Safety and Security chapters)European Commission — European AI Office · published 2025-07-10 · retrieved 2026-09-12
- Explanatory Notice and Template for the Public Summary of Training Content for general-purpose AI modelsEuropean Commission — European AI Office · published 2025-07-24 · retrieved 2026-09-12
- Guidelines on transparency obligations for providers and deployers of certain AI systemsEuropean Commission — Shaping Europe’s digital future · retrieved 2026-09-12
- Regulation (EU) 2016/679 (General Data Protection Regulation)Official Journal of the European Union / EUR-Lex · published 2016-05-04 · retrieved 2026-09-12
- Regulation (EU) 2023/2854 (Data Act)Official Journal of the European Union / EUR-Lex · published 2023-12-22 · retrieved 2026-09-12
- Directive (EU) 2022/2555 (NIS 2 Directive)Official Journal of the European Union / EUR-Lex · published 2022-12-27 · retrieved 2026-09-12
- Regulation (EU) 2024/2847 (Cyber Resilience Act)Official Journal of the European Union / EUR-Lex · published 2024-11-20 · retrieved 2026-09-12
- Regulation (EU) 2022/2065 (Digital Services Act)Official Journal of the European Union / EUR-Lex · published 2022-10-27 · retrieved 2026-09-12
- Directive (EU) 2024/2853 on liability for defective productsOfficial Journal of the European Union / EUR-Lex · published 2024-11-18 · retrieved 2026-09-12
- Regulation (EU) 2022/868 (Data Governance Act)Official Journal of the European Union / EUR-Lex · published 2022-06-03 · retrieved 2026-09-12
- Directive 2002/58/EC (ePrivacy Directive), consolidated version as amended by Directive 2009/136/ECOfficial Journal of the European Union / EUR-Lex · published 2002-07-31 · retrieved 2026-09-12
- Regulation (EU) 2023/1230 on machinery — consolidated text as at 27 July 2026 (corrigendum C1, amendments M1 and M2)Official Journal of the European Union / EUR-Lex consolidated text · Art. 8 third para., 20(10), 50(2), 51(2), 52(1), 54; Annex I Part A items 5–6 · published 2023-06-29 · retrieved 2026-09-12
- Corrigendum to Regulation (EU) 2023/1230 on machinery (OJ L 169, 4.7.2023, p. 35)Official Journal of the European Union / EUR-Lex · items 1–14 · published 2023-07-04 · retrieved 2026-09-12
- Regulation (EU) 2023/1230 on machinery — Official Journal textOfficial Journal of the European Union / EUR-Lex · Art. 10, 12, 18, 21, 24, 25, 50, 54; Annex I Part A; Annex III; Annex IV · published 2023-06-29 · retrieved 2026-09-12
- Regulation (EU) 2024/1689 (EU AI Act) — consolidated text as at 27 July 2026 (amendment marker M1)Official Journal of the European Union / EUR-Lex consolidated text · Art. 2(2), Art. 6(1), Art. 113; Annex I Sections A & B · published 2024-07-12 · retrieved 2026-09-12
- Regulation (EU) 2023/988 on general product safety — Official Journal textOfficial Journal of the European Union / EUR-Lex · Art. 5, 9, 14, 16, 20, 27, 35, 36, 37, 44, 52 · published 2023-05-23 · retrieved 2026-09-12
- Commission Implementing Regulation (EU) 2022/1426 on type-approval of the automated driving system (ADS) of fully automated vehiclesOfficial Journal of the European Union / EUR-Lex · Art. 2(1)(9)(10)(16)(34)(35), Art. 3, Art. 4; Annex I–IV · published 2022-08-26 · retrieved 2026-09-12
- Commission Implementing Regulation (EU) 2026/481 amending Implementing Regulation (EU) 2022/1426 (AVP use case, definitions and new Annex V)Official Journal of the European Union / EUR-Lex · Recitals 1–4; Art. 1(1)–(5); Art. 2 · published 2026-03-04 · retrieved 2026-09-12
- Regulation (EU) 2019/2144 (General Safety Regulation) — Official Journal textOfficial Journal of the European Union / EUR-Lex · Recitals 26–27; Art. 18; Annex II item D4 and "Notes to the table" · published 2019-12-16 · retrieved 2026-09-12
- Regulation (EU) 2017/745 on medical devices (MDR) — consolidated text as at 19 July 2026Official Journal of the European Union / EUR-Lex consolidated text · Art. 10, 11, 27, 29, 31, 83–87, 120, 123; Annex VIII §6.3 (Rule 11) · published 2017-05-05 · retrieved 2026-09-12
- Regulation (EU) 2022/2554 (Digital Operational Resilience Act, DORA) — Official Journal textOfficial Journal of the European Union / EUR-Lex · Art. 28(3), Art. 30(1)–(3), Art. 31(12), Art. 64 · published 2022-12-27 · retrieved 2026-09-12
Content as of 2026-09-12 · corpus 2026.09|Compiled from public official sources with links and review dates for compliance decision support. Rules change; have licensed professionals review before external disclosure, regulatory filing or contractual commitments.