Cyber
Applying
Cyber Resilience Act
Regulation (EU) 2024/2847
11 Dec 2027Key deadline
Full application of all requirements
GovernsCybersecurity of products with digital elements on the EU market.
Applies toManufacturers, importers, distributors and open-source stewards of products with digital elements.
The EU's cybersecurity rules for products with digital elements. Vulnerability and incident reporting under Article 14 has applied since 11 September 2026, including to products already on the market. Full application follows on 11 December 2027.
Cyber
Transposing
NIS2 Directive
Directive (EU) 2022/2555
7 Nov 2024Passed
Implementing Regulation (EU) 2024/2690 starts to apply.
GovernsBaseline cyber-risk management, ICT supply-chain security and incident reporting.
Applies toEssential and important entities across 18 sectors providing critical services in the EU.
The EU's baseline cybersecurity directive for essential and important entities, extended by the digital-infrastructure implementing regulation and the NIS Cooperation Group's ICT supply-chain toolbox.
Cyber
In negotiation
Cybersecurity Act revision (CSA2)
COM(2026) 11
In negotiation
ITRE draft report tabled
GovernsRevision of the Cybersecurity Act: ENISA mandate and certification, ICT supply-chain security framework.
Applies toENISA, national cybersecurity authorities, ICT product and service vendors and customers.
Reworks the EU Cybersecurity Act by updating ENISA’s mandate, reshaping certification and adding an ICT supply-chain security framework.
Cyber
In negotiation
NIS2 targeted amendment
COM(2026) 13
In negotiation
ITRE draft report tabled
GovernsSimplification of NIS2 and alignment with the proposed Cybersecurity Act 2.
Applies toEssential and important entities under NIS2, and national competent authorities.
A targeted amendment to NIS2, tabled with CSA2, that simplifies parts of the directive and aligns it with the revised Cybersecurity Act.
Data & AI
In negotiation
Digital Omnibus (data)
COM(2025) 837
In negotiation
Council negotiating mandate agreed (Coreper).
GovernsSimplification of the data and cyber acquis; single incident-reporting entry point; merges DGA, Open Data Directive, Free Flow of Non-Personal Data and P2B into the Data Act.
Applies toAnyone under the EU data and cybersecurity acquis.
The Commission’s clean-up pass on the EU data rulebook, cutting overlap across GDPR, the Data Act, ePrivacy and NIS2.
Data & AI
Applying
Digital Omnibus on AI
Regulation (EU) 2026/1744
Applying
Published in the Official Journal as Regulation (EU) 2026/1744
GovernsSimplification of the AI Act: timing of high-risk obligations ("stop-the-clock"), a new prohibition on nudifier and CSAM-generating AI systems, and relief for small mid-caps.
Applies toAnyone in scope of the AI Act.
Eases AI Act implementation, chiefly by deferring high-risk obligations to December 2027 (Annex III) and August 2028 (Annex I). It also adds a prohibition on nudifier and CSAM-generating AI systems, applying from 2 December 2026.
Data & AI
Applying
Artificial Intelligence Act
Regulation (EU) 2024/1689
2 Dec 2027Key deadline
High-risk (Annex III) obligations apply
GovernsAI systems placed on the EU market, regulated by risk tier.
Applies toProviders, deployers, importers and distributors of AI systems placed on the EU market.
The EU's risk-based AI rulebook. Under the Digital Omnibus on AI (Regulation (EU) 2026/1744), high-risk obligations apply from December 2027 (Annex III) and August 2028 (Annex I). On 2 December 2026, a new prohibition on nudifier and CSAM-generating systems applies, together with the watermarking deadline for systems already on the market.
Data & AI
Applying
Data Act
Regulation (EU) 2023/2854
12 Sep 2027Key deadline
Chapter IV (unfair terms in B2B data contracts) extends to earlier contracts of indefinite duration or running at least 10 years from 11 January 2024.
GovernsAccess to and sharing of connected-product data; cloud switching.
Applies toMakers, holders and recipients of connected-product data, and the public sector.
Rules on who can access and share data from connected products and related services, now being amended by the data omnibus.
Data & AI
Being merged
Data Governance Act
Regulation (EU) 2022/868
Being merged
Repeal and merge into the Data Act via the data omnibus (COM(2025) 837)
GovernsData-sharing framework, data intermediaries, data altruism.
Applies toData intermediaries, public-sector bodies, data-altruism organisations.
The EU’s framework for data intermediaries and data altruism, set to be repealed and folded into the Data Act.
Data & AI
In negotiation
EUDPR amendment (operational personal data)
COM(2026) 314
In negotiation
Proposal published (COM(2026) 314, 2026/0173(COD))
GovernsProcessing of operational personal data by Union bodies, offices and agencies in judicial cooperation in criminal matters and police cooperation.
Applies toUnion bodies, offices and agencies processing operational personal data.
Revises the data protection rules for operational personal data handled by EU bodies and agencies in judicial and police cooperation.
Infrastructure
In negotiation
Digital Networks Act
COM(2026) 16
In negotiation
Proposal published by the Commission
GovernsTelecoms framework reform replacing the EECC: spectrum, a single authorisation passport, satellite connectivity and IP interconnection.
Applies toElectronic-communications operators and providers.
A rewrite of EU telecom rules covering spectrum, investment, satellite connectivity and IP interconnection, with a voluntary conciliation procedure for interconnection disputes.
Infrastructure
In negotiation
Cloud and AI Development Act
COM(2026) 502
In negotiation
Proposal published (COM(2026) 502 final)
GovernsCloud sovereignty tiers, public procurement and EU compute capacity.
Applies toCloud and AI infrastructure providers, and public buyers.
Sets sovereignty tiers for cloud and AI infrastructure, especially in public procurement, while pushing EU compute capacity.
Infrastructure
In negotiation
Chips Act 2.0
COM(2026) 504
In negotiation
Proposal published (COM(2026) 504 final)
GovernsReplaces the 2023 Chips Act: supply-chain resilience, demand-side measures, emergency powers.
Applies toThe semiconductor supply chain and end markets.
The semiconductor arm of the tech-sovereignty package. It repeals and replaces the 2023 Chips Act, updating resilience tools, investment rules and crisis powers.
Infrastructure
In negotiation
EU Space Act
COM(2025) 335
1 Jan 2030Proposed
Application under the current draft
GovernsSafety, resilience and sustainability of space activities; the proposal makes it lex specialis to NIS2 for space operators.
Applies toSpace operators and operators of ground and space infrastructure.
Tailored safety, resilience and cybersecurity rules for space activities. The Commission frames the text as lex specialis to NIS2, while the Council and Parliament each propose a different relationship between the two.
Corporate
In negotiation
EU Inc (28th regime)
COM(2026) 321
1 Jan 2028Proposed
Application date under the Commission proposal; the Council mandate provides 21 months after entry into force.
GovernsOptional EU-wide corporate legal form for innovative companies, digital-only.
Applies toStartups and scaleups incorporating across borders.
Creates an optional EU-wide company form for innovative firms to incorporate digitally across borders under one regime.
Corporate
In negotiation
European Business Wallets
COM(2025) 838
In negotiation
Public bodies to accept within 24 months of entry into force
GovernsSecure cross-border identification, e-signing and document exchange for businesses.
Applies toEconomic operators and public-sector bodies.
A business digital wallet for cross-border identification, signing and document exchange, built on the eIDAS framework.
Corporate
Announced
Digital Fairness Act (DFA)
Commission initiative (Have Your Say 14622)
GovernsConsumer protection online: dark patterns, addictive design, unfair personalisation, influencer marketing and subscription cancellation.
Applies toTraders selling to consumers online, platforms, app and game providers, influencers and advertisers.
The Commission's planned update of EU consumer law for the digital environment, following the 2024 fitness check. No text exists yet: scope, legal form and application dates will be known only once the proposal is published.