Regulationsby GlyphJurisdiction
European Union: data, AI and cyber laws
Part of EU.
Regulations
Add to calendar
EU Consumer Credit Directive 2 (CCD2)Replaces the 2008 Consumer Credit Directive and extends it to buy-now-pay-later and small loans. Creditworthiness assessments must use relevant, accurate data and may not use special category data or social media data. Where the assessment involves automated processing, consumers get a right to human intervention and an explanation.Next: Nov 20 National rules apply · in 24 daysEU AI ActA risk-based product-safety regime for AI. It bans certain AI practices, imposes strict requirements on high-risk AI systems (risk management, data governance, documentation, human oversight, conformity assessment), sets transparency duties for chatbots, deepfakes and AI-generated content, and sets obligations for general-purpose AI model providers. The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force 27 July 2026) pushed the high-risk dates back to 2 December 2027 (Annex III) and 2 August 2028 (Annex I). It also softened the AI literacy duty and added bans on non-consensual sexual deepfakes and child sexual abuse material (CSAM) generation.Next: Dec 2 New bans on sexual deepfakes and CSAM generation; Art 50(2) grace period ends · in 36 daysEU Platform Work DirectiveFirst EU law on algorithmic management at work. Digital labour platforms may not use automated systems to process emotional, psychological or certain other personal data of platform workers, must be transparent about automated monitoring and decision systems, and must ensure human oversight and human review of significant decisions. It also creates a rebuttable presumption of employment.Next: Dec 2 Transposition deadline · in 36 daysProduct Liability DirectiveModernises EU strict (no-fault) liability for defective products. Software (including AI systems and SaaS), digital manufacturing files and related digital services now count as products. Destruction or corruption of non-professional data is compensable damage, and missing security updates or cybersecurity vulnerabilities can make a product defective. Courts can order evidence disclosure and presume defectiveness in complex cases.Next: Dec 9 Transposition deadline; old PLD repealed · in 43 dayseIDAS 2 / EU Digital Identity WalletRequires every Member State to offer at least one European Digital Identity Wallet so people can identify themselves and share verified attributes with selective disclosure. It adds new qualified trust services such as electronic attestations of attributes and electronic ledgers. Private relying parties that must use strong authentication, and very large online platforms, have to accept the wallet when the user asks.Next: Dec 24 Member States must provide EU Digital Identity Wallets · in 58 daysEU Data ActGives users of connected products and related services the right to access and share the data those products generate, and sets rules for business-to-business data sharing. It bans unfair data-sharing contract terms imposed on businesses and lets public bodies obtain data in cases of exceptional need. Cloud and other data processing service providers must make switching easy, and switching charges are phased out.Next: Jan 12, 2027 Cloud switching charges abolished · in 3 monthsEU Cyber Solidarity ActSets up a European Cybersecurity Alert System of national and cross-border Cyber Hubs, a Cybersecurity Emergency Mechanism with an EU Cybersecurity Reserve of trusted private incident response providers, and a Cybersecurity Incident Review Mechanism for significant and large-scale incidents.Next: Feb 5, 2027 First Commission evaluation · in 3 monthsDigital Services ActLayered obligations for intermediary services: notice-and-action for illegal content, statements of reasons, complaint handling, transparency reporting, and ad and recommender transparency. Profiling-based ads to minors and ads based on sensitive data are banned. Very large online platforms and search engines (45M+ EU users) must also run annual systemic-risk assessments and audits and give researchers data access.Next: Feb 18, 2027 DSA SME impact report · in 4 monthsEuropean Health Data Space (EHDS)Gives individuals electronic access to, and control over, their health data across the EU (primary use), with a cross-border MyHealth@EU infrastructure and mandatory requirements for electronic health record (EHR) systems. It also creates a permit-based framework for secondary use of health data (research, innovation, policy) through national Health Data Access Bodies, with data holders required to make data available.Next: Mar 26, 2027 EHDS general application date · in 5 monthsGDPRThe EU's core data protection law: any processing of personal data needs a lawful basis, must follow principles such as purpose limitation and data minimisation, and gives individuals rights of access, erasure, portability and objection. Controllers must notify breaches to the supervisory authority within 72 hours and restrict transfers outside the EEA to adequate countries or safeguarded mechanisms. Regulation (EU) 2025/2518 adds harmonised procedural rules for cross-border enforcement from 2 April 2027.Next: Apr 2, 2027 GDPR Procedural Regulation applies · in 5 monthsNIS2Requires medium and large entities in 18 critical sectors, including cloud, data centres, managed services, online marketplaces, search and social networks, to adopt cybersecurity risk-management measures. They must report significant incidents within 24 hours (early warning), 72 hours (notification) and one month (final report). Management bodies are accountable. Obligations apply through national transposing laws.Next: Apr 17, 2027 Next biennial entity notification · in 6 monthsCyber Resilience ActSets mandatory cybersecurity requirements for hardware and software products with digital elements sold in the EU: secure by design, vulnerability handling, security updates for the support period, SBOMs, and CE marking after conformity assessment. Manufacturers must report actively exploited vulnerabilities and severe incidents to CSIRTs and ENISA from 11 Sep 2026.Next: Dec 11, 2027 CRA fully applies · in 13 monthsEU CSAM Interim RegulationLets providers of number-independent interpersonal communications services, such as messaging and email, voluntarily scan for and report online child sexual abuse despite ePrivacy confidentiality rules, under strict conditions. It replaces Regulation (EU) 2021/1232, which expired on 2026-04-03. The permanent CSA Regulation proposed in 2022 is still not adopted.Next: Feb 1, 2028 Commission implementation report · in 15 monthsData Governance ActSets conditions for re-use of protected public-sector data (personal data, trade secrets, IP) and creates a notification and neutrality regime for data intermediation services. It also sets up voluntary registration of 'recognised data altruism organisations'. Data intermediaries must stay neutral, separate the intermediation service from other services and notify a competent authority.In effect since Jun 23, 2022Digital Markets ActImposes ex-ante do's and don'ts on designated gatekeepers. Examples: no combining personal data across services without consent, no self-preferencing, interoperability, data portability, and business-user data access. Gatekeepers must notify all acquisitions and submit an audited description of consumer profiling techniques.In effect since Nov 1, 2022Digital Omnibus (data/GDPR)Commission proposal to simplify EU digital rules. It would amend the GDPR (personal data definition, processing for AI, a new cookie/terminal-equipment consent regime in Art 88a/88b, breach notification only for high-risk breaches within 96 hours) and the ePrivacy Directive, NIS2, CER Directive and Data Act. A single-entry point would handle incident reporting, and the Data Governance Act, Free Flow Regulation, Platform-to-Business Regulation and Open Data Directive would be repealed and merged into the Data Act. The AI Act part was split out and adopted separately as Regulation (EU) 2026/1744.No date setDORAHarmonised ICT risk-management, major ICT-incident reporting, digital operational resilience testing (including threat-led penetration testing) and ICT third-party risk rules for EU financial entities. Financial entities must keep a register of all ICT third-party contracts. Critical ICT third-party providers (cloud, data centres and similar) come under direct EU oversight.In effect since Jan 16, 2023ePrivacy Directive (cookie law)Requires prior consent to store or access information on a user's device (cookies, SDKs, fingerprinting), except where strictly necessary. Also covers confidentiality of communications, traffic and location data, and unsolicited direct marketing (opt-in for email/SMS to individuals). Telecom providers must notify personal data breaches. Enforced through national laws.In effect since Jul 31, 2002EU Cybersecurity ActGives ENISA a permanent mandate and sets up the EU framework for voluntary cybersecurity certification schemes for ICT products, services and processes, such as the EUCC scheme. On 2026-01-20 the Commission proposed a replacement, the Cybersecurity Act 2 (COM(2026) 11), adding an ICT supply chain security framework aimed at high-risk suppliers.In effect since Jun 27, 2019EU e-Evidence PackageLets judicial authorities in one Member State order service providers in another to produce or preserve electronic evidence, such as subscriber, traffic and content data, directly and within tight deadlines. Non-EU providers offering services in the EU must appoint a designated establishment or legal representative to receive orders.In effect since Aug 18, 2026EU Financial Data Access (FIDA) proposalWould create a right for customers to have their financial data beyond payment accounts, such as savings, investments, insurance and credit data, shared with authorised third parties. Data holders would join financial data sharing schemes and customers would manage permissions through dashboards.No date setEU KIDS ActA legislative initiative designed to restrict social media platforms' access to children within the European Union.No date setEU Political Advertising Regulation (TTPA)Sets EU-wide transparency rules for paid political advertising, including labels, transparency notices and a public ad repository. Online targeting and ad delivery using personal data is only allowed with explicit consent, on data collected from the person, and never using special category data or profiling.In effect since Oct 10, 2025EU-US Data Privacy FrameworkGDPR Art 45 adequacy decision letting personal data flow from the EEA to US organisations self-certified under the Data Privacy Framework with the US Department of Commerce, with no further transfer mechanism needed. It relies on US Executive Order 14086 safeguards and the Data Protection Review Court for redress. The EU General Court upheld it in Latombe v Commission (T-553/23) on 3 Sep 2025, and an appeal is pending before the Court of Justice.In effect since Jul 10, 2023Interoperable Europe ActCreates a cooperation framework for cross-border interoperability of public sector digital services and data exchange. Public bodies must carry out interoperability assessments before changing binding requirements for trans-European digital public services, and an Interoperable Europe Board steers common solutions.In effect since Jul 12, 2024
Upcoming deadlines
EU Consumer Credit Directive 2 (CCD2)National rules applyMember States must apply the transposing measures from this date and the 2008 Directive is repealed.European UnionEU AI ActNew bans on sexual deepfakes and CSAM generation; Art 50(2) grace period endsNew Art 5(1)(ba)/(bb) prohibitions on AI systems that generate non-consensual intimate imagery of identifiable persons or child sexual abuse material apply. Generative AI systems placed on the market before 2 Aug 2026 must comply with the Art 50(2) marking duty by this date (new Art 111(4)).European UnionEU Platform Work DirectiveTransposition deadlineMember States must bring national laws into force to comply with the Directive (Article 29).European UnionProduct Liability DirectiveTransposition deadline; old PLD repealedMember States must transpose by 9 Dec 2026 (Art 22). Directive 85/374/EEC is repealed from that date but still applies to products placed on the market before it (Art 21).European UnioneIDAS 2 / EU Digital Identity WalletMember States must provide EU Digital Identity WalletsEach Member State must provide at least one wallet within 24 months of the entry into force of the implementing acts under Arts 5a(23) and 5c(6) (Art 5a(1)).European UnionEU Data ActCloud switching charges abolishedProviders of data processing services may no longer impose any switching charges on customers (Art 29(1)).European UnionEU Cyber Solidarity ActFirst Commission evaluationCommission evaluates the Regulation and reports to Parliament and Council, then every 4 years (Article 25).European UnionDigital Services ActDSA SME impact reportCommission report under Article 91 on effects on SMEs.European UnionEuropean Health Data Space (EHDS)EHDS general application dateThe regulation applies generally from 26 Mar 2027, subject to the phased exceptions below (final article).European UnionGDPRGDPR Procedural Regulation appliesHarmonised rules for cross-border complaint admissibility, rights to be heard and access to preliminary findings, and investigation timelines apply to DPAs from 2 April 2027 (Regulation (EU) 2025/2518, final article).European UnionNIS2Next biennial entity notificationCompetent authorities notify the Commission and Cooperation Group of the number of essential and important entities, repeated every two years after 17 Apr 2025 (Art 3(5)).European UnionEU AI ActLegacy GPAI models must comply; national AI sandboxes operationalProviders of GPAI models placed on the market before 2 Aug 2025 must comply (Art 111(3)). Each Member State must have at least one national AI regulatory sandbox operational (Art 57(1) as amended by the Omnibus).European UnionEU Data ActUnfair-terms rules extend to older long-term contractsChapter IV (unfair contractual terms) applies to contracts concluded on or before 12 Sep 2025 that are of indefinite duration or expire at least 10 years from 11 Jan 2024 (Art 50).European UnionNIS2Commission review of NIS2Commission must review the functioning of NIS2 and report to Parliament and Council, then every 36 months (Art 40).European UnionEU AI ActHigh-risk obligations apply to Annex III systemsChapter III Sections 1-3 (high-risk requirements and provider/deployer obligations) apply to AI systems classified high-risk under Art 6(2) and Annex III (employment, credit scoring, education, biometrics, essential services and similar). Deferred from 2 Aug 2026 by Regulation (EU) 2026/1744.European UnionCyber Resilience ActCRA fully appliesAll remaining obligations, including essential cybersecurity requirements, conformity assessment and CE marking, apply (Art 71(2)). Products placed on the market earlier are covered only if substantially modified (Art 69(2)).European UnioneIDAS 2 / EU Digital Identity WalletPrivate relying parties must accept walletsPrivate relying parties required by law or contract to use strong user authentication must accept wallets on user request within 36 months of the implementing acts' entry into force (Art 5f(2)).European UnionEU CSAM Interim RegulationCommission implementation reportCommission report on implementation, including proportionality and error rates (Article 9).European UnionEU CSAM Interim RegulationInterim derogation expiresThe Regulation applies until this date.European UnionCyber Resilience ActLegacy type-examination certificates expireEU type-examination certificates and approval decisions on cybersecurity requirements under other harmonisation legislation remain valid until this date unless they expire earlier (Art 69(1)).European UnionEU AI ActHigh-risk obligations apply to Annex I product-embedded systemsChapter III Sections 1-3 apply to AI systems classified high-risk under Art 6(1) and Annex I (safety components of products covered by EU harmonisation legislation). Deferred from 2 Aug 2027 by Regulation (EU) 2026/1744.European UnionCyber Resilience ActReport on single reporting platformCommission report assessing the single reporting platform's effectiveness (Art 70(2)).European UnionEU Data ActCommission evaluationCommission evaluation report due, including the impact of cloud switching rules (Arts 23-31) (Art 49(2)).European UnionEuropean Health Data Space (EHDS)Primary use for first data categories; secondary use framework appliesPatient rights and EHR rules apply to patient summaries, ePrescriptions and eDispensations (Art 14(1)(a)-(c)). Chapter IV secondary-use rules (data permits, Health Data Access Bodies) apply.European UnionEU AI ActPublic-authority high-risk systems must complyProviders and deployers of high-risk AI systems intended for use by public authorities that were placed on the market before the Chapter III application date must comply (Art 111(2), as replaced by the Omnibus).European UnionCyber Resilience ActFirst CRA evaluationCommission evaluation and review report, then every four years (Art 70(1)).European UnionEU AI ActLarge-scale EU IT systems must complyAI systems that are components of the large-scale IT systems in Annex X (e.g. SIS, VIS, Eurodac, EES, ETIAS) placed on the market before 2 Aug 2027 must be brought into compliance (Art 111(1)).European UnionEuropean Health Data Space (EHDS)Primary use for second data categories; EHR systems in service; extra secondary-use categoriesPrimary-use rules extend to medical images, lab results and discharge reports (Art 14(1)(d)-(f)). Chapter III applies to EHR systems put into service under Art 26(2). Additional secondary-use categories in Art 51(1)(b),(f),(g),(m),(p) apply.European UnionEuropean Health Data Space (EHDS)Third-country participation in secondary useArt 75(5) applies from 26 Mar 2035.European Union
Past deadlines
EU Data ActAccess-by-design for new connected productsArt 3(1) design obligation (product data and related service data accessible to the user by default) applies to connected products and related services placed on the market after 12 Sep 2026.European UnionCyber Resilience ActVulnerability and incident reporting obligations applyArt 14: manufacturers must report actively exploited vulnerabilities and severe incidents (24-hour early warning, 72-hour notification) via the single reporting platform. Also covers products placed on the market before 11 Dec 2027 (Art 69(3)).European UnionDigital Services ActChatGPT designated as VLOSE; Reddit and Roblox as VLOPsCommission designated ChatGPT as a very large online search engine and Reddit and Roblox as very large online platforms. They have four months (by January 2027) to meet VLOP/VLOSE obligations.European UnionEU e-Evidence Packagee-Evidence Regulation appliesEuropean Production and Preservation Orders become available.European UnionEU AI ActGeneral application: transparency obligations, GPAI fines, most other rulesThe AI Act's general date of application. Article 50 transparency obligations (chatbot disclosure, deepfake labelling, machine-readable marking of synthetic content) and Commission fines on GPAI providers (Art 101) apply. Not deferred by the Omnibus.European UnionEU CSAM Interim RegulationNew interim regulation enters into forcePublished in the OJ on 2026-07-28; enters into force on the third day.European UnionEU AI ActDigital Omnibus on AI enters into forceRegulation (EU) 2026/1744 (adopted 8 July 2026, OJ 24 July 2026) enters into force on the third day after publication. Amended Articles 102 to 110 apply from this date (new Art 113(d)).European UnionCyber Resilience ActConformity assessment body provisions applyChapter IV (Arts 35-51, notification of conformity assessment bodies) applies (Art 71(2)).European UnioneIDAS 2 / EU Digital Identity WalletLegacy qualified trust service providers conformity reportQTSPs qualified before 20 May 2024 had to submit a conformity assessment report proving compliance with Art 24(1), (1a) and (1b) by 21 May 2026.European UnionDigital Markets ActDMA first reviewCommission evaluation of the DMA under Article 53, then every 3 years.European UnionEU CSAM Interim RegulationPrevious interim regulation expiresRegulation (EU) 2021/1232, as extended by Regulation (EU) 2024/1307, applied until this date.European UnionEU e-Evidence PackageLegal representatives Directive transpositionMember States must transpose Directive (EU) 2023/1544 on designated establishments and legal representatives.European UnionEU Cybersecurity ActCybersecurity Act 2 proposedCommission proposal COM(2026) 11 to repeal and replace the Act, adding ICT supply chain security rules. Now in the ordinary legislative procedure (2026/0011(COD)).European UnionEU Political Advertising Regulation (TTPA)Member States notify sanction rulesDeadline for Member States to notify the Commission of their sanction rules under Article 25(3).European UnionGDPRGDPR Procedural Regulation enters into forceRegulation (EU) 2025/2518, published in the OJ on 12 December 2025, enters into force on the twentieth day after publication.European UnionDigital Services ActDSA first harmonised transparency reporting cycleFirst full annual reporting period (to 2026-12-31) under the harmonised templates for all intermediary services.European UnionGDPRGDPR Procedural Regulation adoptedRegulation (EU) 2025/2518 laying down additional procedural rules for cross-border GDPR enforcement signed by Parliament and Council.European UnionEU Consumer Credit Directive 2 (CCD2)Transposition deadlineMember States must adopt and publish transposing laws (Article 48).European UnionDORAFirst critical ICT third-party providers designatedThe ESAs published the first list of 19 critical ICT third-party providers (including AWS, Google Cloud and Microsoft), which now come under direct EU oversight.European UnionDigital Services ActDSA review report on VLOP scope and interplayCommission report under Article 91 on Article 33 scope and interaction with other laws.European UnionEU-US Data Privacy FrameworkLatombe appeal lodged at the Court of JusticeLatombe appealed the General Court judgment to the Court of Justice on points of law (reported as Case C-703/25 P); the DPF stays valid while it is pending.European UnionDigital Services ActDSA delegated act on researcher data access in forceDelegated Regulation (EU) 2025/2050 sets the procedure for vetted researchers to access VLOP and VLOSE data under Article 40(4). Published in the OJ on 2025-10-09; in force on the 20th day.European UnionEU Political Advertising Regulation (TTPA)TTPA appliesMost of the Regulation applies, including labelling, transparency notices and the targeting restrictions.European UnionData Governance ActLegacy data intermediaries must complyEntities that were already providing data intermediation services on 23 June 2022 had to comply with Chapter III by 24 Sep 2025 (Art 37).European UnionEU Data ActMember States notify penalty rulesMember States had to notify the Commission of their penalty rules (Art 40(2)).European UnionEU Data ActData Act appliesMost obligations apply, including user data access and sharing (Chapters II-III), cloud switching (Chapter VI) and interoperability; Chapter IV unfair terms apply to contracts concluded after this date (Art 50).European UnionEU-US Data Privacy FrameworkGeneral Court upholds DPF (Latombe v Commission)General Court dismissed Philippe Latombe's action for annulment (Case T-553/23) and confirmed the US offered adequate protection when the decision was adopted.European UnionEU AI ActGPAI, governance, notified bodies and penalties applyChapter III Section 4 (notifying authorities), Chapter V (general-purpose AI model obligations), Chapter VII (governance), Chapter XII (penalties, except Art 101) and Art 78 apply (Art 113(b)).European UnionDORATLPT regulatory technical standards enter into forceCommission Delegated Regulation (EU) 2025/1190 (published 18 June 2025) sets criteria for which financial entities must run threat-led penetration testing, plus methodology and tester requirements.European UnionDigital Services ActDSA transparency report templates mandatoryImplementing Regulation (EU) 2024/2835 requires all intermediary services to use harmonised templates for content moderation data collected from this date.European UnionDORAFirst registers of information submitted to the ESAsCompetent authorities had to submit financial entities' registers of ICT third-party contractual arrangements (reference date 31 Mar 2025) to the ESAs by 30 Apr 2025. National authorities set earlier deadlines for entities.European UnionNIS2Member States establish entity listsMember States had to establish lists of essential and important entities and notify the Commission of entity numbers (Art 3(3) and (5)). Repeated every two years.European UnionEuropean Health Data Space (EHDS)EHDS enters into forceRegulation (EU) 2025/327, published 5 Mar 2025, enters into force on the twentieth day following publication.European UnionEU Cyber Solidarity ActCyber Solidarity Act enters into forcePublished in the OJ on 2025-01-15; enters into force on the 20th day.European UnionEU AI ActProhibited practices and AI literacy applyChapters I and II apply, including the Article 5 bans on prohibited AI practices and the Article 4 AI literacy duty (Art 113(a)).European UnionNIS2Digital infrastructure entities submit registration dataDNS providers, TLD registries, domain registration services, cloud, data centre, CDN, managed (security) service providers, marketplaces, search engines and social networks had to submit registration details to competent authorities (Art 27(2)).European UnionDORADORA appliesAll DORA obligations (ICT risk management, incident reporting, testing, third-party risk, register of information) apply from 17 Jan 2025 (Art 64).European UnionInteroperable Europe ActInteroperability assessments mandatoryArticle 3(1) to (4) (interoperability assessments) and Article 17 apply.European UnioneIDAS 2 / EU Digital Identity WalletFirst wallet implementing acts enter into forceCommission Implementing Regulations (EU) 2024/2977, 2024/2979, 2024/2980, 2024/2981 and 2024/2982 (adopted 28 Nov 2024, published 4 Dec 2024) enter into force. This starts the wallet deadline clocks in Arts 5a and 5f.European UnionCyber Resilience ActCRA enters into forceEntered into force on the twentieth day after publication in the OJ on 20 Nov 2024 (Art 71(1)).European Union