European Union: data, AI and cyber laws

Access-by-design for new connected products

Art 3(1) design obligation (product data and related service data accessible to the user by default) applies to connected products and related services placed on the market after 12 Sep 2026.

Vulnerability and incident reporting obligations apply

Art 14: manufacturers must report actively exploited vulnerabilities and severe incidents (24-hour early warning, 72-hour notification) via the single reporting platform. Also covers products placed on the market before 11 Dec 2027 (Art 69(3)).

ChatGPT designated as VLOSE; Reddit and Roblox as VLOPs

Commission designated ChatGPT as a very large online search engine and Reddit and Roblox as very large online platforms. They have four months (by January 2027) to meet VLOP/VLOSE obligations.

General application: transparency obligations, GPAI fines, most other rules

The AI Act's general date of application. Article 50 transparency obligations (chatbot disclosure, deepfake labelling, machine-readable marking of synthetic content) and Commission fines on GPAI providers (Art 101) apply. Not deferred by the Omnibus.

Digital Omnibus on AI enters into force

Regulation (EU) 2026/1744 (adopted 8 July 2026, OJ 24 July 2026) enters into force on the third day after publication. Amended Articles 102 to 110 apply from this date (new Art 113(d)).

Conformity assessment body provisions apply

Chapter IV (Arts 35-51, notification of conformity assessment bodies) applies (Art 71(2)).

Legacy qualified trust service providers conformity report

QTSPs qualified before 20 May 2024 had to submit a conformity assessment report proving compliance with Art 24(1), (1a) and (1b) by 21 May 2026.

GDPR Procedural Regulation enters into force

Regulation (EU) 2025/2518, published in the OJ on 12 December 2025, enters into force on the twentieth day after publication.

GDPR Procedural Regulation adopted

Regulation (EU) 2025/2518 laying down additional procedural rules for cross-border GDPR enforcement signed by Parliament and Council.

First critical ICT third-party providers designated

The ESAs published the first list of 19 critical ICT third-party providers (including AWS, Google Cloud and Microsoft), which now come under direct EU oversight.

Latombe appeal lodged at the Court of Justice

Latombe appealed the General Court judgment to the Court of Justice on points of law (reported as Case C-703/25 P); the DPF stays valid while it is pending.

Legacy data intermediaries must comply

Entities that were already providing data intermediation services on 23 June 2022 had to comply with Chapter III by 24 Sep 2025 (Art 37).

Member States notify penalty rules

Member States had to notify the Commission of their penalty rules (Art 40(2)).

Data Act applies

Most obligations apply, including user data access and sharing (Chapters II-III), cloud switching (Chapter VI) and interoperability; Chapter IV unfair terms apply to contracts concluded after this date (Art 50).

General Court upholds DPF (Latombe v Commission)

General Court dismissed Philippe Latombe's action for annulment (Case T-553/23) and confirmed the US offered adequate protection when the decision was adopted.

GPAI, governance, notified bodies and penalties apply

Chapter III Section 4 (notifying authorities), Chapter V (general-purpose AI model obligations), Chapter VII (governance), Chapter XII (penalties, except Art 101) and Art 78 apply (Art 113(b)).

TLPT regulatory technical standards enter into force

Commission Delegated Regulation (EU) 2025/1190 (published 18 June 2025) sets criteria for which financial entities must run threat-led penetration testing, plus methodology and tester requirements.

First registers of information submitted to the ESAs

Competent authorities had to submit financial entities' registers of ICT third-party contractual arrangements (reference date 31 Mar 2025) to the ESAs by 30 Apr 2025. National authorities set earlier deadlines for entities.

Member States establish entity lists

Member States had to establish lists of essential and important entities and notify the Commission of entity numbers (Art 3(3) and (5)). Repeated every two years.

EHDS enters into force

Regulation (EU) 2025/327, published 5 Mar 2025, enters into force on the twentieth day following publication.

Prohibited practices and AI literacy apply

Chapters I and II apply, including the Article 5 bans on prohibited AI practices and the Article 4 AI literacy duty (Art 113(a)).

Digital infrastructure entities submit registration data

DNS providers, TLD registries, domain registration services, cloud, data centre, CDN, managed (security) service providers, marketplaces, search engines and social networks had to submit registration details to competent authorities (Art 27(2)).

DORA applies

All DORA obligations (ICT risk management, incident reporting, testing, third-party risk, register of information) apply from 17 Jan 2025 (Art 64).

First wallet implementing acts enter into force

Commission Implementing Regulations (EU) 2024/2977, 2024/2979, 2024/2980, 2024/2981 and 2024/2982 (adopted 28 Nov 2024, published 4 Dec 2024) enter into force. This starts the wallet deadline clocks in Arts 5a and 5f.

CRA enters into force

Entered into force on the twentieth day after publication in the OJ on 20 Nov 2024 (Art 71(1)).

New PLD enters into force

Directive entered into force on the twentieth day after publication in the OJ on 18 Nov 2024 (Art 23).

Implementing Regulation 2024/2690 enters into force

Commission Implementing Regulation (EU) 2024/2690 (published 18 Oct 2024) sets technical risk-management measures and significant-incident thresholds for DNS, TLD, cloud, data centre, CDN, managed (security) service providers, online marketplaces, search engines, social networks and trust service providers.

National NIS2 measures apply; NIS1 repealed

Member States apply their NIS2 measures from 18 Oct 2024 and Directive (EU) 2016/1148 (NIS1) is repealed (Arts 41(1), 44).

Transposition deadline

Member States had to adopt and publish national transposing measures by 17 Oct 2024 (Art 41(1)).

AI Act enters into force

Regulation (EU) 2024/1689 enters into force twenty days after publication on 12 July 2024 (Art 113).

eIDAS 2 enters into force

Regulation (EU) 2024/1183 entered into force on the twentieth day after publication on 30 Apr 2024 (Art 2).

Gatekeeper compliance deadline (first designations)

First-wave gatekeepers had to comply with Arts 5-7 obligations and submit compliance reports six months after the 6 Sep 2023 designation.

DSA applies to all intermediary services

Full application to all providers of intermediary services (Art 93(2)).

Reduced switching charges period begins

From 11 Jan 2024 to 12 Jan 2027, data processing providers may charge only reduced switching fees, capped at costs directly linked to switching (Art 29(2)-(3)).

Data Act enters into force

Entered into force on the twentieth day after publication in the OJ on 22 Dec 2023 (Art 50).

DGA applies

All DGA rules apply (Art 38).

First six gatekeepers designated

Commission designated Alphabet, Amazon, Apple, ByteDance, Meta and Microsoft (22 core platform services). They had six months to fully comply.

DPF adequacy decision adopted and effective

Commission adopted Implementing Decision (EU) 2023/1795, effective on notification to Member States; EU-US transfers to DPF-certified organisations may proceed without additional safeguards.

DMA applies

DMA becomes applicable; undertakings meeting thresholds must notify the Commission within two months (Arts 3(3), 54).

First VLOP/VLOSE designations

Commission designated the first 19 very large online platforms and search engines (e.g. Amazon Store, Facebook, Google Search, TikTok, X). Obligations apply four months after notification.