Skip to content
Back to Destinations

Global: compliance overview

4 regulations, 16 mapped obligations and 0 data-transfer routes, organised by when they start to bind you and what you have to do.

Filter the obligations that bind usContact an advisor

Regulatory timeline: what comes next

  1. 2025-04-01

    2025 editions take effect in CEN member bodies and supersede the 2011 editions

    ISO 10218 series on industrial robot safety (2025 editions)

Applicable regulations (4)

In forceSector-specificRelevance High

ISO 10218 series on industrial robot safety (2025 editions)

A Chinese robot company must align with this series when it ships industrial robots or cobots to EU, Japanese, Korean or North American customers whose purchase specifications require ISO 10218-1 conformity; when it acts as integrator building robot cells, collaborative workstations or production lines abroad (ISO 10218-2); when it supplies the robot as incomplete machinery to overseas OEMs, requiring a declaration of incorporation and documented integration constraints; and when overseas automotive, electronics or logistics customers demand safety-function performance level (PL/SIL) evidence and collaborative application risk assessments in tenders. Because the robot itself is usually partly completed machinery under the Machinery Regulation, this series also determines how smoothly it slots into the customer CE process.

3 obligations · reviewed 2026-09-12

In forceSector-specificRelevance Critical

UN Regulation No 155: cybersecurity and cybersecurity management system

A Chinese company is caught when, as a vehicle manufacturer, it exports passenger or commercial vehicles to Contracting Parties applying the Regulation (including the EU, the UK, Japan and Korea) and seeks type approval; when, as a Tier 1 or Tier 2 supplier, it supplies ECUs, domain controllers, telematics units, cockpit systems or automated-driving software to such manufacturers — since paragraph 7.2.2.5 requires the vehicle manufacturer to demonstrate how its CSMS manages dependencies on contracted suppliers and service providers, those requirements are pushed down into supply contracts and audits; and when it provides connected-car cloud platforms, OTA back ends or security operations services for overseas vehicle types. Vehicle types sold only in China are out of scope, but platform reuse across markets requires deliberate regional differentiation.

5 obligations · reviewed 2026-09-12

In forceSector-specificRelevance Critical

UN Regulation No 156: software updates and software update management system

A Chinese company is caught when it exports OTA-capable vehicles to markets applying the Regulation and seeks type approval; when it operates the OTA back end, delta-package build and staged rollout platform for exported vehicle types; when, as a domain controller or ECU supplier, it must provide software versions, integrity validation data and rollback capability for inclusion in the customer RXSWIN scheme; and when it sells remote feature subscriptions or pay-per-use functions to overseas fleets, which very easily trigger the test of altering functionality compared with registration. When a China-market model is ported for export, the OTA process is usually the part that must be rebuilt.

4 obligations · reviewed 2026-09-12

In forceSector-specificRelevance Critical

UN Regulation No 157: Automated Lane Keeping Systems (ALKS)

A Chinese company is caught when it exports passenger cars with L3 lane-keeping automation to Contracting Parties applying the Regulation and seeks type approval; when, as a supplier of automated-driving domain controllers, perception algorithms or redundant actuators, it must give the vehicle manufacturer a safety concept, failsafe analysis and validation evidence to support the Annex 4 assessment; when it designs transition demand prompts, cockpit entertainment suspension logic and the DSSAD recording scheme for exported types; and after export, when it runs field safety monitoring and remediation, since Annex 4 paragraph 3.5.4 requires critical incidents to be reported to the type approval authority. A level-3 function built to GB/T 40429-2021 for the domestic market needs a fully rebuilt safety argument and evidence package in the R157 structure before it can be exported.

4 obligations · reviewed 2026-09-12

What you can use right now

Playbooks

AI hardware and compute going global: two-way export controls, end users and model-weight transfersEU enterprise due diligence and tenders: a 48-hour response mechanism

Templates

Model CardData Card — datasheet for a training, validation or test datasetAI incident and serious incident reporting record (register plus report drafts)ISSB (IFRS S1 / S2) sustainability-related financial disclosure report outlineGreenhouse gas inventory workpaper (GHG Protocol Scope 1 / 2 / 3)Double materiality assessment workpaper (CSRD / ESRS basis)Customer security and privacy questionnaire answer bank (grouped by CAIQ / CCM domains)Tender / RFP compliance response pack (covering both EU public procurement and enterprise procurement)SOC 2 Type II readiness checklist (Trust Services Criteria)ISO/IEC 42001 AI management system implementation and certification readiness checklistSupplier and subcontractor ESG and security due diligence questionnaire (for use as the buyer)Investor ESG due diligence pack (for fundraising and pre-IPO)Third-party sustainability assurance readiness checklist (starting from limited assurance)

Relevant standards

  • IFRS S1 General Requirements for Disclosure of Sustainability-related Financial Information · IFRS S1 (issued June 2023; not amended as at 12 September 2026 — the December 2025 greenhouse gas emissions amendments apply only to IFRS S2)
  • IFRS S2 Climate-related Disclosures · IFRS S2 (issued June 2023; amended by the December 2025 Amendments to Greenhouse Gas Emissions Disclosures, effective for annual reporting periods beginning on or after 1 January 2027)
  • TCFD Recommendations (incorporated into the ISSB Standards; the Task Force has disbanded) · 2017 Recommendations (implementation guidance updated in 2021); succeeded by IFRS S2 from 2023
  • SASB Standards (industry-based sustainability metrics, now maintained by the ISSB) · Current version maintained by the ISSB; conforming amendments aligned with the greenhouse gas emissions disclosure amendments issued in December 2025
  • GRI Standards (Universal, Sector and Topic Standards) · Universal Standards GRI 1/2/3 (2021 edition, effective 1 January 2023) + Sector Standards GRI 11–14 + Topic Standards (including GRI 101: Biodiversity 2024, GRI 102: Climate Change 2025 and GRI 103: Energy 2025)
  • SBTi Corporate Net-Zero Standard · Version 1.3.1 (current; usable for target setting until 31 January 2028) and Version 2.0 (published; validation opens from Q1 2027)
  • ISO 14064-1:2018 Greenhouse gases — Specification with guidance at the organization level for quantification and reporting of greenhouse gas emissions and removals · ISO 14064-1:2018 / EN ISO 14064-1:2018
  • ISO 14067:2018 Greenhouse gases — Carbon footprint of products — Requirements and guidelines for quantification · ISO 14067:2018
  • ISO/IEC 42001 Artificial Intelligence Management System (AIMS) · ISO/IEC 42001:2023 (edition 1, dated 2023-12); European adoption EN ISO/IEC 42001:2026
  • ISO/IEC 42006:2025 Requirements for bodies providing audit and certification of AI management systems · ISO/IEC 42006:2025 (edition 1, dated 2025-07)
  • ISO/IEC 23894:2023 Artificial intelligence — Guidance on risk management · ISO/IEC 23894:2023 (edition 1, dated 2023-02)
  • ISO/IEC 42005:2025 Artificial intelligence — AI system impact assessment · ISO/IEC 42005:2025 (adopted identically in Australia as AS ISO/IEC 42005:2025)
  • ISO/IEC 22989:2022 Artificial intelligence concepts and terminology · ISO/IEC 22989:2022 (edition 1, 2022-07-19; European adoption EN ISO/IEC 22989:2023)
  • ISO/IEC 27001:2022 Information security management systems — Requirements · ISO/IEC 27001:2022 (edition 3, 2022-10); European adoption EN ISO/IEC 27001:2023, including Amendment A1:2024
  • ISO/IEC 27002:2022 Information security controls · ISO/IEC 27002:2022 (2022-02-15; European adoption EN ISO/IEC 27002:2022, including Corrigendum AC:2024)
  • ISO/IEC 27701:2025 Privacy information management systems — Requirements and guidance · ISO/IEC 27701:2025 (edition 2, 2025-10), cancelling and replacing ISO/IEC 27701:2019
  • NIST Artificial Intelligence Risk Management Framework 1.0 (NIST AI 100-1) · AI RMF 1.0 (NIST AI 100-1, released 2023-01-26; being revised under the White House AI Action Plan)
  • NIST AI 600-1 Generative Artificial Intelligence Profile · NIST AI 600-1 (released July 2024; approved by the NIST Editorial Review Board on 2024-07-25)
  • SOC 2 (System and Organization Controls) and the AICPA Trust Services Criteria · 2017 Trust Services Criteria (with the 2022 revised points of focus)
  • CSA STAR and STAR for AI (including CCM, CAIQ, AICM and AI-CAIQ) · STAR program (combined CCM/CAIQ v4.1); AI Controls Matrix AICM v1 (released 2025-07-09, updated 2025-10-30; v1.1 also published)
  • TISAX and the VDA ISA (automotive supply chain information security assessment and exchange) · VDA ISA2027 (officially released by the VDA on 2026-07-01); from 2027 ISA is released in annual versions

Sources (9)

Content as of 2026-09-12 · corpus 2026.09|Compiled from public official sources with links and review dates for compliance decision support. Rules change; have licensed professionals review before external disclosure, regulatory filing or contractual commitments.

GDPR · PIPL · CCPA control mapping
Traceable AI · cited when sourced
ISO 27001 alignment in progress
WCAG 2.1 AA accessibility target
Global: compliance overview | HaiWen HQ