EU Regulatory News

If your organisation operates as an adtech platform, data broker, or data buyer in real-time bidding: The Datatilsynet decision confirms that receiving data from an app or service whose primary user base identifies with a protected characteristic under Article 9 GDPR is sufficient to trigger the Article 9(1) prohibition, regardless of whether your platform explicitly processes the protected characteristic as a labelled data field. If you receive device identifiers, location data, or behavioural signals from apps serving audiences associated with health conditions, religion, political opinions, sexual orientation, or other Article 9 categories, you carry Article 9 exposure. Audit your data supply chain: can you confirm the source of each data stream and whether it carries an implicit Article 9 attribute? If your organisation relies on consent under GDPR Articles 6 and 9 for adtech processing: The Datatilsynet and earlier Norwegian DPA rulings on the Grindr and adtech ecosystem confirm that the consent obtained by app operators for RTB data sharing does not satisfy the requirements for valid explicit consent under Article 9(2)(a) GDPR where users were not adequately informed that their data would reveal a special category attribute. Downstream buyers who rely on consent obtained by the app operator as a pass-through lawful basis should verify that the consent meets the Article 9 explicit consent standard. If your organisation is an adtech data buyer with potential exposure to EEA jurisdiction: Norway applies GDPR via the EEA Agreement. Datatilsynet's enforcement record is now among the most active in the EEA on adtech and consent. The NOK 92 million fine signals that Datatilsynet treats RTB data sharing violations involving Article 9 data as warranting fines at the upper end of its sanction range. Assess your GDPR posture with Verdaio's GDPR Quick Check.

If your organisation develops, deploys, or uses AI systems in Italy or on the Italian market: D.Lgs. 179/2026 establishes the enforcement authorities (AgID and ACN) and the sanction regime for AI Act violations in Italy. AgID can now investigate and impose fines for violations of the prohibited practices prohibition (up to EUR 35 million or 7% of worldwide turnover), non-compliant high-risk AI system deployments (up to EUR 15 million or 3% of worldwide turnover), and transparency violations (up to EUR 7.5 million or 1.5% of worldwide turnover). Map your AI systems against the AI Act risk tiers and confirm that any high-risk AI systems deployed in Italy are registered in the EU AI Office database. If your organisation uses AI in employment decision-making (hiring, promotion, performance, termination): Article 14 of D.Lgs. 179/2026 adds an Italian-specific prohibition on sole automated employment decisions without human oversight. Verify that your AI-assisted HR and people management tools include a human review mechanism and provide affected workers with the right to an explanation. If your organisation is developing or testing AI systems and considering a regulatory sandbox: AgID's national AI sandbox (Article 22 of the decree) is open for applications for up to 24 months per participant. Sandbox participation does not exempt you from post-sandbox compliance obligations. Use Verdaio's AI Act Assessment to map your AI system obligations under the EU AI Act framework.

If your organisation is established in Austria or has operations there that meet the NIS2 size thresholds: The NISG 2026 is in force from 1 October 2026. Determine whether your organisation falls within the essential or important entity categories for any of the 18 sectors covered by the law. You have until 1 October 2027 to register in the national entity register. Begin your NIS2 compliance programme now: asset inventory, risk assessment, security policy documentation, incident response plan, and supply chain security review. For Austrian-established entities, compliance with the NISG 2026 is legally required and non-compliance is subject to the administrative sanction regime described above. If your organisation is established in another EU Member State but provides services in Austria to entities that fall within NIS2 scope: The NISG 2026 creates obligations for your customers and partners. Their NIS2 supply chain security requirements under Article 21(2)(d) extend to you as a supplier. Expect requests for security questionnaires, contractual security clauses, and incident notification obligations in contracts with Austrian essential and important entities. If your organisation operates across multiple EU Member States and is already complying with NIS2 transpositions in those jurisdictions: The NISG 2026 is substantively aligned with NIS2, so your existing NIS2 framework should largely apply with limited Austrian-specific adaptations (register by 1 October 2027; use Austrian CIRC as the contact point for Austria-specific incidents). Review your multi-jurisdiction NIS2 compliance matrix and add Austria as in-force. Use Verdaio's NIS2 Readiness Check to assess your exposure.

If your organisation is a religious association, church, or faith-based body that maintains membership registers, baptismal records, confirmation records, or other personal data of members or former members: AG Medina's Opinion signals that the Article 91 GDPR church exemption requires substantive equivalence with the GDPR, not merely the existence of pre-existing rules. Review whether your data protection framework meets that standard. If it does not, the GDPR applies in full, including the right to erasure. Establish a process for handling Article 17 erasure requests from individuals who have left your community. If your organisation maintains historical archives, long-standing membership records, or other legacy databases containing personal data that pre-date the GDPR: Article 17(3)(d) allows you to resist erasure where retention serves archival, scientific, historical, or research purposes in the public interest, but this ground must be substantiated on the facts of each specific request - it is not a blanket defence. Review your Article 17 response workflow: do you assess each erasure request against the specific retention grounds in Article 17(3) and can you document your reasoning? If your organisation currently responds to Article 17 erasure requests by annotating records rather than deleting the data: Striking through a name, appending a deleted notation, or marking a record as inactive while keeping personal data legible and accessible does not satisfy the Article 17 erasure obligation if the CJEU confirms AG Medina's position. Personal data must be rendered unreadable or inaccessible, not merely flagged. Update your technical erasure procedures now. Assess your GDPR posture with Verdaio's GDPR Quick Check.

If your organisation processes health data at scale for analytics, research, or commercial purposes: The Garante's IQVIA decision confirms that claims of anonymisation do not remove GDPR obligations if re-identification is reasonably possible given the volume, specificity, and linkability of the data. Before relying on an anonymisation argument to avoid Article 9 GDPR requirements, conduct a formal re-identification risk assessment: can the records be linked to identifiable individuals through combinations of data points, auxiliary information, or longitudinal patterns? If there is a reasonable likelihood, the data are personal data, not anonymous, and a lawful basis under Article 9(2) is required. If your organisation uses a controller-processor structure to distance itself from GDPR controller obligations: The Garante found that contractual labels do not determine controller status: the entity that determines the purposes and means of processing is the controller, regardless of how the contract is drafted. If your organisation defines what data are collected, constructs the database, and determines how the processed data are commercially deployed, it is a controller. Audit your data processing chain to confirm whether your characterisation of controller and processor roles reflects the actual distribution of decision-making power over the processing. If your organisation processes special category data under Article 9 GDPR and has not conducted a DPIA: Large-scale processing of health, genetic, or biometric data is listed in Article 35(3)(b) as a case that systematically requires a DPIA prior to processing. The absence of a DPIA was a separate infringement in the IQVIA decision. Assess your GDPR posture with Verdaio's GDPR Quick Check.

If your organisation develops or deploys general-purpose AI models covered by the AI Act: Article 53(1)(c) already requires GPAI model providers to have a copyright compliance policy and to honour rights holder opt-outs. The Commission consultation does not change these obligations, but its outcome may result in more prescriptive requirements or a standardised opt-out mechanism. Review your Article 53 copyright compliance posture now: do you have a documented policy, and does your training data pipeline identify and respect machine-readable opt-outs? If your organisation trains AI models using web-scraped or licensed data: The consultation will directly inform any regulatory clarification of what constitutes an adequate opt-out under Article 4 of Directive 2019/790. If you rely on the Article 4 TDM exception and do not actively screen for machine-readable opt-outs, you carry legal exposure under both the Copyright Directive and the AI Act compliance policy obligation. If your organisation holds rights in content that may be used for AI training (publishers, media companies, collecting societies): The consultation is an opportunity to document opt-out implementation challenges for the Commission record. Submissions close 3 November 2026. Use Verdaio's AI Act Readiness Check to assess your GPAI compliance posture.

If your company is subject to mandatory CSRD reporting: The revised ESRS applies from financial years beginning on or after 1 January 2027, with optional early application for FY 2026. Update your ESRS gap analysis to reflect the simplified mandatory requirements and identify which previously mandatory datapoints have become voluntary. The reduction in mandatory disclosures does not remove materiality assessment obligations: you must still assess which topics are material to your business and disclose accordingly under ESRS 1 and the applicable topical standards. If your company is in the first CSRD reporting wave (reporting under the original 2023 ESRS for FY 2024 or FY 2025): The revised ESRS does not apply to your current reports. Complete your first report under Commission Delegated Regulation (EU) 2023/2772, then transition to the revised ESRS from FY 2027. If your company is outside mandatory CSRD scope: The VESRS, in force from 24 September 2026, provides a voluntary reporting template. Customers, investors, and supply-chain partners subject to CSRD may request VESRS-aligned disclosures from you as part of their Scope 3 and value-chain data collection. Use Verdaio's ESRS Gap Analysis to map your current disclosures against the revised ESRS requirements.

If your organisation displays data subject rights notices, including cookie banners, video surveillance signs, or privacy notices: Verify that the contact channels listed for exercising data subject rights are free of charge. A chargeable telephone number, even if accompanied by free alternatives, can constitute a failure to facilitate rights under Article 12(2) if it is the most prominent or only practical channel displayed. If your organisation uses video surveillance under the GDPR: Article 13(1)(a) requires the notice at the point of collection to identify the controller and provide contact details. If your video surveillance notice directs individuals to a telephone number to exercise their rights, confirm that the number is free of charge or that a free alternative is equally prominent in the notice. If your organisation operates in Spain or has a Spanish DPA as competent authority: The AEPD has shown a consistent enforcement focus on Article 12 compliance in data subject rights notices and response mechanisms. Audit your Article 12 compliance: are your rights notices clear, complete, and do they direct individuals to free contact channels? Assess your GDPR posture with Verdaio's GDPR Quick Check.

If your organisation uses location data in any capacity: The DPC's Google decision confirms that the GDPR's transparency requirements under Articles 13 and 14 apply rigorously to location data processing flows. A privacy notice or settings interface that is technically present but fragmented, misleading, or insufficiently clear to enable a user to understand what is being collected and why will not satisfy the lawfulness, fairness, and transparency requirement of Article 5(1)(a). Review your location data privacy notices now: are they written in plain language, do they identify each purpose and legal basis, and do they describe retention periods? If your organisation relies on user settings or dashboards to communicate data processing choices: The DPC found that Google's multi-layer settings interfaces did not satisfy GDPR transparency requirements. Settings flows that appear to offer user control but obscure default location data collection are a material enforcement risk. Audit your data collection defaults: is location data being collected by default until a user actively turns it off? Is that default adequately disclosed? If your organisation has not defined or applied retention periods for location data: The storage limitation finding confirms that Article 5(1)(e) requires controllers to define specific retention periods for each category of personal data, including location data, and to enforce those periods technically. A policy statement without technical implementation is insufficient. Assess your GDPR posture with Verdaio's GDPR Quick Check.

If your organisation is subject to GDPR and has faced, or could face, an administrative fine from a national DPA: EDPB Guidelines 04/2026 formalise the five-step methodology that DPAs across the EU will apply when calculating fines. The structured approach means that aggravating and mitigating circumstances at Step 4 are now the primary lever for reducing the quantum of a fine once an infringement is established. Document your compliance programme, cooperation with the DPA, and any remedial action taken: all are mitigating factors under Article 83(2)(f), (g), and (h). A voluntary disclosure of a breach or active cooperation during the investigation can be cited at Step 4 to reduce the fine amount. If your organisation operates as an intermediary service provider under the DSA (online platforms, hosting services, search engines, or very large online platforms): The final EDPB guidelines on the DSA-GDPR interplay are now the authoritative reference for how your obligations under both regulations interact. In particular, review whether the legal basis you rely on under the GDPR for data processing activities mandated or enabled by the DSA is consistent with the EDPB guidance. Misalignment between your DSA compliance posture and the GDPR requirements for the same processing activities creates dual regulatory exposure. If your organisation processes personal data in any context: The harmonised five-step fining methodology means that fines calculated by any EU DPA will now follow the same structural approach. Cross-border processing operations subject to the one-stop-shop mechanism should expect greater consistency in fine levels across DPAs. Assess your GDPR posture with Verdaio's GDPR Quick Check.

If your business operates an online platform or service accessible to minors in Portugal: The CNPD's Priority Channel means that complaints about the illicit sharing of minors' images or videos, unauthorised processing of children's personal data, or targeted advertising to minors will now receive expedited treatment by the CNPD. The CNPD can issue precautionary deletion orders enforceable within 48 hours without completing a full formal investigation. Ensure your content moderation and data removal workflows can respond to CNPD deletion orders at that speed. Failure to comply with a CNPD order is itself a GDPR violation exposing your organisation to administrative fines under Article 83. If your platform hosts user-generated content and operates in Portugal: Review whether your content removal procedures for reports involving minors are adequate to respond to a CNPD precautionary order. Map your CNPD contact point and ensure the legal or compliance team is notified immediately upon receipt of any CNPD communication. If your organisation collects or processes children's personal data under GDPR Article 8 or holds data originally collected when the data subject was a child: GDPR Article 17(1)(f) gives data subjects a right to erasure of data collected when they were a child. The CNPD's Priority Channel increases the likelihood that such erasure requests will be escalated directly to the CNPD if not handled promptly. Process children's erasure requests with priority, and ensure your right-to-erasure workflow includes an expedited track for requests involving minors. Assess your GDPR posture with Verdaio's GDPR Quick Check.

If your organisation receives data subject requests, including erasure requests under Article 17 of the GDPR: Article 12(3) requires you to respond to every request within one month of receipt. Silence is not compliance: you must confirm the action taken on each request, including requests you decline or partially decline. An unanswered request is both an Article 17 failure (if the data was not erased) and an Article 12(3) failure (no outcome communicated). Log every incoming erasure request, assign it for action, and ensure a written outcome is provided within the one-month deadline. If your organisation processes employee or former-employee personal data, including HR records, employment files, and payroll data: Former employees frequently exercise their right to erasure. Ensure your HR and IT systems support deletion workflows that cover all locations where former employee data is held, including backup systems, archives, and third-party HR platforms. Systematic failure to respond to employee erasure requests at scale is an active enforcement risk, as the EXTIA case confirms. If you use a high volume of employee data or process HR data as a service: The EDPB's 2025 Coordinated Enforcement Framework means that 25 DPAs across the EU are actively investigating erasure-right compliance this year. Audit your data subject request handling process now. Assess your GDPR posture with Verdaio's GDPR Quick Check.

If your organisation maintains paper records containing personal data, including patient records, HR files, financial documents, or any other paper-based personal data: The DPC's HSE decision confirms that Article 5(1)(f) security obligations apply equally to physical records. Storage in conditions that risk damage, contamination, or unauthorised access constitutes a GDPR violation. Audit your physical storage arrangements: unsecured or poorly controlled paper archives are an enforcement risk. If your organisation has a retention policy for paper records: Article 5(1)(e) requires that retention periods be defined and enforced for paper records as well as digital records. Identify records held beyond their required retention period and securely dispose of them in accordance with your retention schedule. The absence of a documented retention schedule for paper archives, or failure to implement one, is itself a compliance gap. If your organisation becomes aware that paper records have been damaged, lost, or accessed without authorisation: This constitutes a personal data breach triggering Article 33 notification obligations to your supervisory authority. If the breach is likely to result in a high risk to affected individuals, Article 34 requires you to notify them directly. Establish a breach identification and reporting workflow that covers physical records, not only digital incidents. If you are a public-sector body or healthcare organisation with legacy paper records: The HSE decision signals active DPC enforcement of physical records management. Assess your GDPR posture with Verdaio's GDPR Quick Check.

If your organisation is a healthcare facility, clinic, hospital, or any entity processing health data for patient care or administrative purposes: Article 32 of the GDPR requires appropriate technical access controls for systems holding patient and health data. The CNIL's decision confirms that operating without VPN for remote access and without MFA for medical data systems constitutes an Article 32 violation in the healthcare context. Audit your remote access architecture now: if VPN and MFA are not in place, implement them before the next regulatory inspection. If your organisation suffers a personal data breach involving health or medical data affecting multiple categories of data subject (patients, third-party healthcare professionals, administrative contacts): Under Article 34, you must notify all categories of affected individuals who face a high risk, not only the primary patient population. Update your breach notification workflow to cover third-party individuals, such as referring physicians and healthcare professionals, whose data was also exposed. Failure to notify all affected categories is a separate Article 34 violation, as the CNIL confirmed in deliberation SAN-2026-009. If your organisation processes personal data under contract with a hospital, clinic, or healthcare provider: Verify that your data processing agreements reflect current Article 32 standards for remote access security, and that your controls (VPN, MFA, network segmentation) meet the standard the CNIL applies to healthcare data processing. Assess your GDPR obligations with Verdaio's GDPR Quick Check.

If your organisation operates in the Netherlands or has its European headquarters there, making the Dutch AP your lead GDPR supervisory authority under the one-stop-shop mechanism: From 1 September 2026, any AP administrative sanction will be published with your organisation's name as a statutory default. Factor mandatory public naming into your GDPR risk assessment for Dutch operations. If your organisation receives an AP enforcement decision imposing a fine, an order subject to a penalty payment, or a processing ban: You have ten working days from the decision date before the AP publishes it. If you intend to apply to the court for interim relief, do so within the ten working day window: a timely application suspends publication until the court rules. Prepare a public statement in parallel in case publication proceeds. If you are a data processor or service provider whose processing contributed to a violation resulting in an AP sanction against a controller client: That client's sanction will be named and published. Ensure your data processing agreements and security measures are sound. If you monitor EU GDPR enforcement landscapes: The Dutch AP's mandatory publication regime joins the DPC, CNIL, and Garante in operating a default-public sanctions policy. This increases the reputational stakes of GDPR enforcement across the EU. Assess your GDPR posture with Verdaio's GDPR Quick Check.

If your company develops, fine-tunes, or deploys a general-purpose AI model accessible to users in the EU: Review your compliance with Chapter V of the EU AI Act as it applied from 2 August 2026. Confirm that your technical documentation is drawn up and kept up to date (Article 53), that a training data summary has been prepared and is ready for publication (Article 53(1)(d)), and that you have a documented copyright compliance policy in place (Article 53(1)(c)). If the AI Office issues you an information request under Article 91, respond within the deadline specified and ensure responses are accurate and complete: misleading or incomplete replies carry fines of up to EUR 15 million or 3% of global annual turnover. If your model has been designated by the AI Office as a GPAI model with systemic risk, or if you are uncertain whether your model meets the systemic risk threshold: Review whether you have conducted model evaluations and adversarial testing (Article 55(1)(a)), established post-deployment monitoring (Article 55(1)(c)), implemented cybersecurity measures (Article 55(1)(d)), and established a process for reporting serious incidents to the AI Office (Article 55(1)(b)). The August 2026 information requests explicitly cover model security, independent evaluations, post-deployment monitoring, and training data - all four are Chapter V and Article 55 compliance areas. If your company uses a GPAI model via an API or as a downstream user: GPAI Chapter V obligations fall on the provider, not the user. However, verify that your AI provider can produce evidence of its Chapter V compliance on request, and that your contracts reflect the applicable obligations. Assess your EU AI Act obligations with Verdaio's AI Act Readiness Assessment.

If you manufacture products with digital elements placed on the EU market, including connected hardware, embedded software, consumer IoT devices, industrial systems, or commercial software products: CRA Article 14 reporting applies from 11 September 2026. Register for and familiarise yourself with ENISA's Single Reporting Platform (SRP) now. When you discover an actively exploited vulnerability in any of your products, whether reported by a researcher, found internally, or disclosed by a third party, you have 24 hours to file an early warning with ENISA via the SRP. A 72-hour full notification with preliminary impact assessment follows, and a 14-day final report once resolved. Establish an internal vulnerability triage and reporting workflow before the first triggering event, and designate a team or individual responsible for SRP submissions and ENISA coordination. If your vulnerability disclosure or product security team currently operates under a responsible disclosure policy or coordinates with national CSIRTs under NIS2: The CRA Article 14 reporting channel (ENISA SRP) is separate from NIS2 CSIRT notification. If your organisation is both a CRA manufacturer and a NIS2-subject entity, map both reporting obligations and confirm that your incident response procedures route product vulnerability notifications to ENISA and service-level incidents to your national CSIRT, without conflating the two. If you supply ICT products, software tools, or connected devices to essential or important entities subject to NIS2: A vulnerability in your product may trigger both a CRA Article 14 obligation on you as manufacturer (report to ENISA via SRP) and a NIS2 obligation on your customer (report the service impact to their national CSIRT). Coordinate your disclosure timeline with your customer's NIS2 incident response team to ensure both reporting obligations are met within their respective deadlines. Assess your CRA and NIS2 obligations with Verdaio's NIS2 Readiness Assessment.

If your company uses automated systems to make decisions about individual accounts, employment, access, scoring, or similar matters: The AP's Uber decision confirms that GDPR Article 22 is enforced at scale, with fines calculated against global turnover. Audit every automated decision flow that produces a significant effect on an individual - account suspension or termination, credit or insurance scoring, access denial, pricing, ranking, or contract end - and confirm that the decision either (a) is necessary for a contract with the individual, (b) is authorised by applicable EU or Member State law, or (c) is based on the individual's explicit consent. If none of these conditions applies, the decision must not be made solely by automated means: implement a meaningful human review step before the decision takes effect, and give the individual the right to obtain human review, to express their point of view, and to contest the decision. For transparency obligations (Articles 13-14 GDPR): At the time of data collection, inform individuals clearly if automated decisions will be made about them, describe the logic involved in terms they can understand, and explain the significance and likely consequences. Generic disclaimers do not satisfy this obligation. If you develop or sell HR, contractor-management, scoring, or access-control platforms: Automated performance assessment, contract termination, or access-revocation features create Article 22 exposure for your clients and potentially for you as a (joint) controller. Review the legal basis for each automated decision type and document your human oversight architecture. Assess your GDPR obligations with Verdaio's GDPR Quick Check.

If your company offers electronic communications, hosting, messaging, email, VoIP, domain-name registration, or IP-address services to users in the EU: The e-Evidence Regulation now applies. If your company was operating before 18 February 2026, your EU-designated contact point should already be in place as of 18 August 2026. If you have not yet designated a contact point, do so immediately and notify the competent national authority. Establish internal procedures for receiving, logging, and responding to EPOs and EPPOs, including the standard 10-day and emergency 8-hour execution deadlines. For content data orders: Build a legal review step into your response workflow - content data EPOs require judicial certification from the issuing state, and you may challenge orders that conflict with GDPR obligations or are otherwise unlawful. For data minimisation and retention: Review your GDPR data minimisation and retention policies in light of the obligation to disclose data on receipt of a valid EPO: data you do not hold cannot be disclosed. Assess your GDPR obligations with Verdaio\'s GDPR Quick Check.

If you make or commission unsolicited commercial telephone calls to consumers in France: From 11 August 2026, prior express consent is required before each call. The Bloctel opt-out register no longer provides a compliance basis for B2C telephone prospecting in France. Audit your French consumer telephone marketing lists and confirm that each contact entry is backed by documented prior opt-in consent. Calls made without consent carry fines of up to EUR 375,000 per call (companies) under Article L242-11 of the Consumer Code. Purge contacts for which you cannot demonstrate prior consent and implement a consent-at-collection flow for any new French consumer data. If you collect French consumer personal data (including telephone numbers) for marketing purposes: The new telephone marketing consent requirement reinforces the GDPR Article 7 consent standard. Review your consent collection flows to confirm they produce freely given, specific, informed and unambiguous consent that covers telephone contact, are documented in your records of processing activities (Article 30 GDPR), and can be withdrawn by the consumer at any time. Bundled or implied consent does not satisfy either the Consumer Code or GDPR requirements. If you supply CRM, marketing automation, or lead generation services to companies operating in France: Your clients' compliance with the French telephone marketing consent regime depends on the data quality and consent documentation your service provides. Ensure your platform captures and stores the consent basis for each contact, flags contacts without telephone marketing consent, and provides an easy mechanism for clients to filter French consumer contacts to those with documented prior consent. Assess your GDPR consent management posture with Verdaio's GDPR Quick Check.

If your organisation operates in the Netherlands in a sector covered by NIS2 (energy, transport, water, banking, financial market infrastructure, healthcare, digital infrastructure, public administration, postal services, waste management, chemicals, food, manufacturing, or digital providers): The Cyberbeveiligingswet entered into force on 15 August 2026. If you are an essential or important entity under NIS2, you now have immediate obligations: implement risk-based security measures covering risk management, supply chain security, access control, encryption, and incident handling; register with the NCSC within the period specified in the implementing regulations; and ensure incident reporting workflows are in place (24-hour early warning, 72-hour full notification to the NCSC for significant incidents). If you have not yet implemented NIS2-aligned procedures, you are in breach from 15 August 2026. If you are a member of the management body of a Dutch organisation in scope of the Cyberbeveiligingswet: The Dutch NIS2 transposition imposes personal responsibility on individual board members for cybersecurity governance. Ensure your organisation has board-level approval of its cybersecurity risk management measures and that cybersecurity is a standing agenda item at board level. The NCSC may require you to complete NIS2 compliance training if the organisation is found to be non-compliant. If you supply ICT products, services, or managed services to Dutch essential or important entities: Supply chain security is a core NIS2 obligation. Your Dutch customers must assess and manage supplier cybersecurity risk. Expect contractual cybersecurity requirements, supplier security questionnaires, and incident notification obligations in your agreements with Dutch NIS2-subject entities. Prepare your supplier security documentation now. Assess your NIS2 obligations with Verdaio's NIS2 Readiness Assessment.

If you manufacture or supply any of the 17 product categories covered by these ETSI draft ENs (password managers, anti-virus or anti-malware software, VPNs for individual users, home gateways or routers, smart home assistants, connected toys, wearable health devices, IP cameras or video doorbells, smart meters, connected door locks, alarm systems with network connectivity, network monitoring software, industrial IoT devices, remote access software, general-purpose operating systems, microprocessors or microcontrollers, or hypervisors): These draft European Standards, once adopted and OJ-referenced, will allow you to claim CRA presumption of conformity for the essential cybersecurity requirements they cover. Monitor the public enquiry process (mid-September through mid-November 2026) and consider submitting formal comments to shape the final standard for your product category. Begin evaluating whether your product security design aligns with the draft requirements now, to minimise the gap-closing work before December 2027. If you are preparing your CRA conformity assessment approach for products not covered by these 17 draft ENs: The CRA allows conformity assessment via other routes where no harmonised standard applies, including use of European cybersecurity certificates or third-party conformity assessment for Class I and II products. Track the CRA harmonised standards publication programme through ETSI and the Official Journal, as further standards covering additional product categories are expected. If you are a procurement or legal team sourcing digital products: Once harmonised standards are OJ-referenced, require suppliers to reference conformity with the relevant EN in their declarations of conformity. Until then, request that suppliers describe their intended CRA conformity assessment approach and timeline. Assess your CRA and NIS2 obligations with Verdaio's NIS2 Readiness Assessment.

If you produce, commission, or distribute AI-generated video or audio content depicting a real person's image, likeness, or voice in an EU-facing editorial, entertainment, or advertising context: The Garante's decision confirms that GDPR Articles 5 and 25 apply to the production and broadcast of AI-generated deepfake content and require disclosure to be clear, evident and comprehensible not only to attentive programme viewers but also to inattentive audiences and to viewers who encounter the content as a standalone clip on social media. Review your AI content production and distribution workflow and verify that all distribution channels carry disclosures that meet this comprehensibility standard, not only the original broadcast. If you use AI generation tools to create content depicting real identifiable people and distribute that content through digital channels: From 2 August 2026, EU AI Act Article 50 also requires machine-readable markings on AI-generated content and visible human-readable labels on deepfake video or audio depicting real people. Your compliance obligation now spans both GDPR Article 5 transparency and AI Act Article 50 disclosure. A disclaimer that is technically present in a broadcast setting but imperceptible on a social media clip does not satisfy either requirement. Review each distribution channel and ensure that compliant disclosures are embedded at the clip level, not only at the programme level. If you develop or supply AI tools that generate synthetic video or audio of real people: Article 25 of the GDPR requires data protection by design and by default. The Garante found that the absence of adequate built-in disclosure mechanisms constituted an Article 25 violation at the tool or production-process level. Assess whether your system provides controls that enable users to embed disclosure markers meeting the comprehensibility standard required by the Garante, alongside the machine-readable marking requirements of EU AI Act Article 50. Assess your data protection and AI obligations with Verdaio's GDPR Quick Check and AI Act Readiness Check.

If you develop, supply, or integrate biometric identification systems, facial recognition technology, or video-surveillance solutions for law enforcement, venue security, or access control in the EU: The Garante's opinion confirms that EU AI Act Article 5 imposes narrow, non-extensible exceptions for real-time remote biometric identification in public spaces. Any system that collects and retains biometric data from the general population present in a defined location - even for a short period and even for investigative purposes - is likely to fall outside the Article 5(1)(h) exceptions unless it is targeted at an identified suspect, an active specific threat, or a specific past serious offence listed in Annex II. Review the scope and purpose of your system against each permitted exception before deploying in public or quasi-public spaces in the EU. If you are a public authority, event organiser, or infrastructure operator planning to deploy facial recognition or biometric surveillance at stadiums, public spaces, or transportation hubs in the EU: The Garante's position indicates that preemptive collection and retention of biometric data from individuals present at a location - even framed as a public security measure - does not satisfy the specific, substantial, and imminent conditions of the Article 5(1)(h) exceptions. Obtain specialist legal advice before deploying any system with a population-wide data collection function, rather than a targeted identification function. Assess your EU AI Act obligations with Verdaio's AI Act Readiness Check.

If you send marketing or promotional emails to individuals who have started but not completed a registration process on your website or app: The Garante's decision confirms that GDPR Article 6(1)(b) (contractual performance) does not provide a valid legal basis for marketing emails to non-confirmed registrants. Sending marketing communications to partially registered users who have not finalised account creation and accepted your terms requires either consent under Article 6(1)(a) or a legitimate interests basis under Article 6(1)(f) with a documented proportionality assessment. Review your registration flow and email marketing triggers to confirm that marketing is only triggered for users with a confirmed, documented legal basis. If you use email addresses collected during incomplete or abandoned registration flows for any purpose other than account completion: Data collected before a registration is confirmed may only be used for the purpose for which it was collected at that stage. Using it for marketing or other secondary purposes requires an independent legal basis. Map your registration-to-communication data flow against GDPR Articles 5 and 6 and document the applicable legal basis at each stage. If your organisation handles data subjects' rights requests including erasure requests: The Garante found failures in responding to erasure requests within the one-month deadline of GDPR Article 12. Review your rights-handling process to ensure all incoming requests are routed to a responsible team and that response timelines are tracked and met. Assess your data protection obligations with Verdaio's GDPR Quick Check.

If you place AI systems on the German market or use AI systems in business operations in Germany: The Bundesnetzagentur is now your primary EU AI Act regulatory contact in Germany. It has authority to request information, conduct audits, order corrective measures, and refer infringements for enforcement. Identify which of your AI systems fall under the EU AI Act (Article 5 prohibitions, Annex III high-risk categories, or Article 50 transparency obligations), map them to the Bundesnetzagentur's scope or the sector-specific allocations to BaFin, and ensure you have a contact designation in place for regulatory correspondence. If you operate AI systems in financial services in Germany (credit assessment, insurance underwriting, algorithmic trading, or other regulated financial use cases): BaFin is your designated AI Act supervisory authority for those systems. BaFin has authority over both the AI Act Article 5 prohibitions and Annex III high-risk obligations for financial-sector AI applications, with administrative fines up to EUR 40 million. Ensure your AI system documentation (technical file, conformity assessment, EU database registration) reflects BaFin as the relevant national competent authority. If your AI systems process personal data and fall within both the EU AI Act and GDPR: The BfDI and Lander DPAs retain GDPR supervisory competence for the data processing dimension, including data protection impact assessments under GDPR Article 35 for high-risk processing involving AI. Coordinate your GDPR and AI Act compliance documentation to avoid conflicting assessments across two supervisory regimes. Assess your EU AI Act obligations with Verdaio's AI Act Readiness Check.

If you deploy AI chatbots, virtual assistants, or other AI systems that interact directly with users (customers, employees, or the public): Article 50 transparency obligations are now enforceable. Ensure that every interaction session with a conversational AI system includes a clear, timely, and intelligible disclosure that the user is communicating with an AI, not a human. A brief system prompt disclosure or persistent UI indicator is the minimum; the disclosure must be given before or at the start of the interaction, not buried in terms and conditions. If you generate, publish, or distribute audio, video, image, or text content using AI generation tools: AI-generated content must now carry machine-readable markings identifying it as AI-generated. Verify that your content pipeline includes machine-readable watermarking or metadata tagging for all synthetic outputs. For deepfake video or audio depicting real identifiable individuals, an additional visible human-readable disclosure is required. If you develop, fine-tune, or deploy GPAI models (large language models, multimodal foundation models) placed on the EU market: The AI Office's supervisory powers are now active. Ensure your Article 53 technical documentation and copyright policy are in order. If your model was on the market before 2 August 2026, the transitional period for machine-readable marking compliance runs until 2 December 2026. If your model exceeds the systemic-risk compute threshold, ensure adversarial testing results and incident reporting channels are in place. If you integrate third-party GPAI models into your products or services: Review the model provider's AI Act compliance documentation. As a deployer, your Article 50 disclosure obligations apply regardless of whether the underlying model was developed in-house or sourced externally. Assess your AI Act obligations with Verdaio's AI Act Readiness Check.

If you conduct or plan to conduct internal investigations that involve accessing employee email accounts, messaging systems, or other communications platforms: The Piaggio decision confirms that access to employee email is a processing activity subject to full GDPR compliance, including a valid legal basis under Article 6, data minimisation under Article 5(1)(c), and storage limitation under Article 5(1)(e). Define the scope of any email access in advance, limit the review to communications strictly necessary for the specific investigation, and document a proportionality assessment before any access is carried out. If you implement email backup or retention policies covering all employee communications for extended periods: The Garante's decision indicates that retaining email backups for the full employment period and five years post-termination, without scope limitations or controlled access mechanisms, may not be compatible with GDPR data minimisation and storage limitation principles. Review your email retention policy and ensure it is aligned with GDPR Article 5 and supported by a legitimate purpose with proportionate retention periods. If employees have previously been informed about potential access to their communications under a general acceptable use or IT policy: The Garante found that generic IT policies do not satisfy GDPR Articles 13 and 14 information obligations for investigation-specific email access. Review whether your employee privacy notices explicitly cover the circumstances under which email may be accessed as part of an internal investigation. Assess your data protection obligations with Verdaio's GDPR Quick Check.

If you use B2B data intelligence or contact enrichment platforms that source professional contact data from third parties, data brokers, or web scraping to identify or contact EU-based professionals: The Garante's decision confirms that the controller using such a platform shares responsibility for the lawfulness of the underlying data collection. Review whether your data enrichment provider can demonstrate a valid GDPR legal basis for the data they supply, compliant information notices to data subjects, and accessible rights channels. If the provider cannot demonstrate GDPR compliance, you face controller liability for using unlawfully processed data. If you are a B2B data broker, contact enrichment provider, or marketing data reseller that processes professional contact data of EU residents without an EU establishment: The Garante's decision confirms that GDPR Article 3(2)(b) applies to your processing if you maintain, update, and enrich profiles of EU individuals over time. Appoint an EU representative under GDPR Article 27, ensure a valid legal basis for each processing purpose, and implement Article 13/14 information notices accessible to data subjects whose data you hold. If you conduct outbound marketing or sales prospecting using purchased or enriched B2B contact lists targeting EU residents: Verify that the contact data was collected with a legal basis covering the specific marketing purpose for which you are using it. The Garante's decision reinforces that legitimate interests does not provide an open-ended right to use personal data for commercial prospecting directed at EU individuals. Assess your data protection obligations with Verdaio's GDPR Quick Check.

If you manufacture or supply products with digital elements placed or to be placed on the EU market (hardware with embedded software, connected consumer products, enterprise software, IoT devices, or industrial control systems): Article 14 reporting obligations for actively exploited vulnerabilities and CRA-related security incidents apply from 11 September 2026. Read Commission Notice C(2026) 5252 to verify your product is in scope and to understand the two-stage reporting process: 24-hour early warning to ENISA and 72-hour full notification. The guidance 67 practical examples cover the most common product categories. If you are uncertain whether your product meets the CRA scope definition or whether a planned update constitutes a substantial modification: The guidance provides a structured scope test and a substantial modification test with worked examples. Apply both before the September 2026 deadline to confirm your reporting obligations and avoid inadvertently triggering a new conformity assessment requirement. If you are an SME manufacturer with limited compliance resources: The guidance dedicated SME section provides a prioritised checklist for reaching Article 14 reporting readiness by 11 September 2026. Use it alongside the free ENISA CRA SME Maturity Assessment Model (published 13 July 2026) to identify and close your highest-priority gaps before the reporting deadline. If you are a procurement or legal team at an organisation sourcing digital products from manufacturers: CRA Article 14 reporting obligations sit with the manufacturer, not the customer. Verify that your key digital product suppliers have a documented Article 14 reporting process in place. Assess your CRA and NIS2 obligations with Verdaio's NIS2 Readiness Assessment.

If you transfer personal data from the EU to recipients in South Korea (including HR data, customer data, supplier data, or intra-group transfers to Korean affiliates): The Commission's positive outcome of the first periodic review means the 2021 adequacy decision remains in force. Your transfers under the adequacy decision remain lawful without supplementary measures. No action is required. Update your data transfer records and ROPA to note that the adequacy basis was reviewed in July 2026 and confirmed. If you had implemented standard contractual clauses or binding corporate rules as a precaution alongside the adequacy decision: These supplementary measures are not required for transfers covered by the adequacy decision. You may remove or archive them from your transfer documentation for EU-to-South Korea transfers, though retaining them as a risk mitigation layer for transfers beyond the adequacy decision's scope (for example, to entities not subject to PIPA) remains best practice. If you rely on other EU adequacy decisions for international data transfers (UK, Japan, Switzerland, US Data Privacy Framework, Argentina, Israel, or New Zealand): The Commission's completion of the South Korea review signals that the Article 45(3)(b) periodic review programme is now operationally active. Other adequacy decisions are expected to enter review by 2027. Monitor Commission announcements and be prepared to demonstrate continued lawfulness of your transfer arrangements. Map your international data transfer obligations with Verdaio's GDPR Quick Check.

If you are the EU subsidiary or branch of a non-EU group with net EU turnover above EUR 150 million: Verify whether your non-EU parent group crosses the Article 40a threshold (EUR 150 million EU net turnover in each of the last two consecutive financial years, plus an EU subsidiary or branch with net EU turnover above EUR 40 million). If in scope, the group must prepare CSRD-equivalent sustainability reports under ESRS-40a from the financial year starting 1 January 2028. The EFRAG consultation closes 31 October 2026: engage your group's sustainability or legal team to review the Exposure Draft and consider submitting a response. If you are a non-EU group assessing your EU regulatory footprint: Article 40a does not require your EU subsidiary to report separately; the reporting obligation sits at the non-EU parent group level on a consolidated basis. Your group's double materiality assessment and ESRS-40a reports will be filed in the EU register. Begin your gap analysis against the draft ESRS-40a standards now to scope the data collection and governance changes needed before 2028. Map your CSRD obligations and run your double materiality assessment with Verdaio's CSRD Readiness Assessment.

If you develop or deploy standalone high-risk AI systems in Annex III categories (biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, or justice): The compliance deadline for your system has been extended from 2 August 2026 to 2 December 2027 by Regulation (EU) 2026/1744. You are no longer required to be fully compliant by 2 August 2026, but your conformity assessment work, risk management documentation, technical file, and EU database registration must be completed before 2 December 2027. Do not stop your compliance preparations: use the extended timeline to close gaps rather than delay. If you develop or deploy AI-based products subject to Annex I sector legislation (medical devices, machinery, aviation, vehicles): Your compliance deadline has moved from 2 August 2027 to 2 August 2028. Review your current compliance roadmap and adjust your milestones against the new deadline. If you provide or deploy any AI system with Article 50 transparency obligations (interaction disclosure, synthetic content marking, deepfake labelling): Regulation (EU) 2026/1744 does not change the 2 August 2026 application date for Article 50 obligations. These apply on schedule. Review the Commission's guidelines on Article 50 published 20 July 2026 and ensure your implementation is live by 2 August 2026. If you develop AI systems that could generate intimate imagery or any content involving minors: The new prohibition under the revised Article 5 applies from 27 July 2026. Ensure your system includes controls that prevent generation of NCII or CSAM. Assess your EU AI Act obligations with Verdaio's AI Act Quick Check.

If you are a hospital, clinic, or healthcare provider subject to NIS2 as an essential entity: Review the ENISA procurement guidelines against your current supplier contract templates and ICT procurement specifications. The guidelines provide a structured checklist for NIS2 Article 21(2)(d) supply chain security obligations, and adopting them strengthens your compliance documentation ahead of the sector-specific requirements under Commission Implementing Regulation (EU) 2024/2690 that apply from 18 January 2027. If you are an ICT supplier to the healthcare sector: Expect procurement teams at hospital and clinic customers to introduce NIS2-aligned cybersecurity requirements into tender documents and contract terms based on the ENISA guidelines. Review your security documentation, incident response procedures, and software supply chain controls against the guidelines' supplier requirements. If you handle patient data or operate medical devices connected to hospital networks: Supply chain security controls under NIS2 apply to your contractual relationship with the healthcare operator. Assess your NIS2 obligations with Verdaio's NIS2 Quick Check.

If you provide or deploy any AI system that generates synthetic content, interacts with users, recognises emotions, or categorises users biometrically: Article 50 transparency obligations apply from 2 August 2026. Review the Commission's guidelines against each Article 50 category relevant to your system: interaction disclosure (Article 50(1)), machine-readable synthetic content marking (Article 50(2)), deepfake and manipulated media labelling (Article 50(4)), and emotion recognition or biometric categorisation notice (Article 50(3)). If you signed the Code of Practice on Transparency of AI-Generated Content by 22 July 2026, you benefit from a presumption of conformity with Articles 50(2), (4), and (5); demonstrate independent Article 50 compliance through technical documentation if you did not sign. If you provide a GPAI model whose outputs are used by downstream providers or deployers: Article 50(5) requires you to equip downstream operators with the information needed to comply with their own transparency obligations; review your API documentation and model cards against the guidelines' Article 50(5) requirements. If your AI system was already on the market before 2 August 2026: The legacy system grace period to 2 December 2026 applies for Articles 50(2) and (4) marking and labelling obligations under the AI Omnibus agreement; Article 50(1) and (3) obligations still apply from 2 August 2026. Assess your EU AI Act obligations with Verdaio's AI Act Quick Check.

If you operate in a sector where employees have access to customer data management systems (telecommunications, financial services, retail, healthcare, utilities): The Garante's WINDTRE decision identifies social engineering and IT support impersonation as a GDPR Article 32 risk that operators are expected to mitigate. Audit whether your employee security awareness training covers social engineering scenarios and whether your procedures for granting system access in response to support requests include verification steps that cannot be bypassed by social engineering. If you hold payment data or financial information belonging to customers: The presence of payment data (IBAN, partial card data) among the exfiltrated records was an aggravating factor in the Garante's fine calculation. Segment and restrict access to payment data more tightly than general customer data; apply a need-to-know principle and minimise which employees or systems can access IBAN and card data stores. If you are a DPO, security lead, or compliance officer preparing a GDPR security assessment under Article 32: The Garante held that an operator's internal security audits must be capable of identifying social engineering vulnerabilities. Document your threat modelling process to show that social engineering is treated as a foreseeable attack vector, and record the controls implemented in response. Map your GDPR security obligations with Verdaio's GDPR Quick Check.

If you are subject to supervisory investigations, audits, or information requests under the AI Act, DMA, DORA, NIS2, or AML Regulation, and also process personal data subject to GDPR: The EDPB statement signals that once a legal basis for cross-regulatory information sharing is in place, findings from one regulatory investigation may be shared with data protection supervisory authorities, and vice versa. Maintain consistent, accurate, and complete records across all regulatory filings, as inconsistencies between regulatory submissions and GDPR records will become more visible under coordinated enforcement. If you are an AI system provider or deployer subject to both the EU AI Act and GDPR: AI Act enforcement by national market surveillance authorities and GDPR enforcement by supervisory authorities are already substantively linked, as high-risk AI systems typically involve personal data processing. Expect these enforcement streams to become formally coordinated once cross-regulatory information sharing is authorised in EU law. If you are a financial entity subject to DORA and also process personal data under GDPR: DORA incident reporting and digital resilience testing obligations generate operational data that may intersect with GDPR. Align your DORA and GDPR compliance frameworks now to avoid exposure when cross-regulatory sharing is formalised. Map your GDPR obligations with Verdaio's GDPR Quick Check.

If you develop AI services or virtual assistants for Android: From the Android 18 release deadline (no later than 1 August 2027), Google must provide your product access to 11 Android system features on the same terms available to Gemini. Review the Commission's specification decision to identify which Android integration capabilities are now mandated, and plan your technical integration roadmap to leverage these openings. If you operate a search engine or AI chatbot that competes with Google Search in the EU: From January 2027, you may formally request access to anonymised Google Search data under FRAND terms. Begin assessing the technical and commercial requirements of a data access request and evaluate whether the Commission's anonymisation framework satisfies your data quality needs. If you are a large platform or gatekeeper under the DMA: This specification sets a precedent for how the Commission will enforce non-discrimination and interoperability obligations through binding technical measures. Audit your existing interoperability commitments under your DMA designation against this standard before the Commission issues similar specifications to you. Assess your digital platform obligations with Verdaio's GDPR Quick Check.

If you operate a video, content, or social platform that runs a revenue-sharing, partner, or creator programme: This judgment indicates that screening or reviewing creator channel content, themes, or past videos as part of a commercial partnership admission process may eliminate your hosting liability exemption for content posted on those channels. Review your partner programme admission criteria and procedures, and assess whether your screening practices constitute prior editorial review under the CJEU's standard. If you are a brand, advertiser, or network that uses influencer or partner channels on video platforms to reach audiences: The judgment creates new pressure on platforms to regulate partner channel content more closely. Monitor whether platforms update their partner programme terms and content policies in response to this ruling, as those changes will affect creator contracts and content permissions. If you provide legal or compliance counsel to platform operators: The CJEU's passive/active host distinction under the e-Commerce Directive now applies with additional clarity to commercial screening practices. Map each of your client's commercial programme admission procedures against the CJEU's test and advise on whether liability exemptions are preserved. Assess your platform compliance obligations with Verdaio's GDPR Quick Check.

If you are an AI developer or researcher building or planning to build large AI models in the EU: The report's call for legal certainty on training data is directly relevant to your planning. The AI Office has signalled it is aware of the GDPR-copyright intersection problem for AI training and intends to address it through guidance or legislation. Monitor AI Office and EDPB outputs on training data guidance, and document your current training data provenance and legal basis now to be in a strong position when guidance or legislative clarification arrives. If you are a general-purpose AI model developer potentially in scope of the EU AI Act's GPAI provisions: The AI Office's frontier AI expert findings will shape the final Code of Practice for GPAI models, which is the primary compliance mechanism for GPAI providers under the AI Act. The emphasis on transparency obligations and training data documentation signals that these will be heavily weighted in the Code. If you are a business deploying or integrating AI models for EU-facing applications: The report indicates that EU frontier AI policy is entering a high-priority phase. Regulatory posture toward GPAI models and high-capability AI systems is expected to tighten as the AI Act's GPAI provisions come into full effect. Map your AI system obligations with Verdaio's AI Act Quick Check.

If you operate a very large online platform or search engine designated under the DSA: The Commission's acceptance of X's corrective action plan signals how it will evaluate platform remediation proposals. Deceptive interface design (dark patterns under DSA Article 25), incomplete ad repository compliance (Article 39), and researcher access failures (Article 40) are active enforcement targets. Review your platform's interface design, ad repository completeness, and researcher data access programme against these requirements before an investigation is opened against you. If you are a researcher seeking data access from very large online platforms under DSA Article 40: X's accepted action plan includes commitments to provide a free public data access tier and transparent application criteria. This sets a benchmark that researchers can cite when requesting data access from other DSA-designated platforms. If you are a brand, agency, or compliance team assessing ad transparency obligations: The Commission's enforcement of the ad repository requirement under DSA Article 39 confirms it is actively monitored. Verify that all platforms on which you place advertising maintain a DSA-compliant ad repository and keep records of your own ad placements and targeting parameters. Assess your digital platform compliance with Verdaio's GDPR Quick Check.

If you operate a sports anti-doping organisation, sports federation, or national governing body that publishes sanction information involving athletes' names: This judgment requires you to implement an individual proportionality assessment before each publication of an athlete's name and violation details. Blanket automatic publication policies are not compatible with GDPR as interpreted by the CJEU. Review your sanctions publication procedures and introduce documented individual assessments. Also implement a sunset mechanism: remove or anonymise published entries when the sanction period expires. If you operate any public register, disciplinary registry, or transparency publication that discloses personal data on the basis of public interest or legitimate interests: The CJEU's proportionality analysis applies beyond the anti-doping context. Any blanket disclosure policy that does not include an individual interests-balancing step is at risk of GDPR challenge. Review your disclosure framework against the CJEU's two-condition standard: individual assessment before publication, and removal on expiry of the relevant period. If you are a data protection officer at a public body, regulator, or membership organisation that publishes enforcement or disciplinary outcomes: This ruling adds to the body of CJEU authority on when public transparency interests can override individual data protection rights. Audit your existing publications and introduce case-by-case review where it is currently absent. Map your GDPR obligations with Verdaio's GDPR Quick Check.

If you manufacture or supply products with digital elements placed or to be placed on the EU market (including software, IoT devices, connected consumer goods, or industrial control systems): CRA Article 14 reporting obligations for actively exploited vulnerabilities and CRA-related incidents apply from 11 September 2026. Use the free ENISA SME Maturity Assessment Model to benchmark your current practices against CRA requirements and identify gaps before that date. The tool provides a structured questionnaire, five maturity levels per pillar, and prioritised remediation guidance. If you are an SME with limited internal cybersecurity expertise: The ENISA tool is designed for your context. Complete the self-assessment across all four pillars (security design, vulnerability management, incident response, and documentation) before the September 2026 reporting deadline to identify your highest-priority gaps. If you are a larger enterprise sourcing hardware or software components from SME manufacturers: CRA Article 13 supply chain security obligations require you to assess and manage the security practices of your digital product suppliers. Share the ENISA tool with SME suppliers as a common reference framework for assessing their CRA readiness before the December 2027 full compliance date. Assess your CRA and NIS2 obligations with Verdaio's NIS2 Readiness Assessment.

If you operate a website or digital service with a cookie consent banner targeting EU visitors: EDPB Binding Decision 1/2026 signals active enforcement against cookie banner practices across the EU. The decision requires the Belgian DPA to examine VRT's banner substantively for GDPR compliance, including whether consent is freely given, specific, informed, and unambiguous under Article 7, and whether processing relies on a valid legal basis under Article 6(1). Audit your cookie banner against these standards: reject-all options must be presented with the same prominence as accept-all; pre-ticked boxes and consent by scrolling are invalid; and consent must be as easy to withdraw as to give (Article 7(3) GDPR). If you use consent management platforms (CMPs) for cookie consent: Verify that your CMP configuration results in valid consent under GDPR Article 7. The EDPB's Cookie Guidelines (Guidelines 05/2020) and national DPA guidance from CNIL, AEPD, and others set the baseline; ensure your banner does not use dark patterns, false equivalence, or misleading UI that undermines the validity of consent. If you have received a GDPR complaint that a supervisory authority dismissed without substantive examination: Binding Decision 1/2026 establishes that such dismissals are subject to EDPB review under Article 60(3). If you are a complainant, the decision confirms you can object to procedural dismissals; if you are a controller, a previously dismissed complaint may be re-examined on the merits. Map your GDPR cookie consent obligations with Verdaio's GDPR Quick Check.

If you operate in Ireland, Spain, France, or the Netherlands in a sector covered by NIS2 (energy, transport, water, healthcare, digital infrastructure, banking, financial market infrastructure, public administration, or space): The CJEU referral signals that national NIS2 transposition legislation is imminent in all four states. Monitor your national competent authority for the publication of implementing regulations; once transposed, you will be subject to the Article 21 security measures and Article 23 incident reporting obligations with minimal notice. Begin gap analysis against the NIS2 requirements now so you are ready to comply as soon as national law is in place. If you operate in other EU member states that have completed NIS2 transposition: The referral does not affect existing national obligations. However, if you have supply chain relationships with entities in the four referred states, note that those entities may not yet be subject to equivalent national NIS2 cybersecurity requirements, which may affect your own supply chain risk assessments under Article 21(2)(d) NIS2. If you provide digital infrastructure services, managed security services, or cloud services to entities in Ireland, Spain, France, or the Netherlands: Anticipate incoming NIS2 contractual requirements from customers in those states as national transposition advances and entities begin conforming their supplier contracts to NIS2 requirements. Map your NIS2 obligations with Verdaio's NIS2 Readiness Assessment.

If you provide or deploy AI systems that generate or manipulate synthetic audio, image, video, or text content (chatbots, image or video generation tools, voice synthesis, AI writing assistants): Article 50 transparency obligations under the EU AI Act apply from 2 August 2026. This deadline is not extended by the Digital Omnibus deal; the extension to December 2027 applies only to Annex III high-risk obligations. If your system falls within Article 50(2), (4), or (5) scope, you must implement machine-readable marking or disclosure by 2 August 2026. Assess whether to sign the Transparency Code before 22 July 2026 at 18:00 CET: signing creates a presumption of conformity and reduces enforcement risk. If you are a provider of a GPAI model (including models integrated into third-party products or services): Article 50(5) applies to your model's generated output. Assess whether the Code covers your output types and whether signing before the 22 July 2026 deadline is feasible. If you are within Article 50 scope but do not sign the Code: You must independently demonstrate Article 50 compliance through technical documentation and disclosure practices; the AI Office has indicated non-signatories within scope may receive information requests after 2 August 2026. Assess your AI Act obligations with Verdaio's EU AI Act Assessment.

If you operate a database, information service, or business intelligence platform that provides searchable access to personal data derived from court records, criminal proceedings, administrative decisions, or public registers: The CJEU's judgment in C-199/24 rules out the GDPR Article 85(2) journalism exemption for commercial database operators. Audit whether your legal basis for processing personal data from public sources is adequate under GDPR Article 6 independent of any journalism exemption claim, and ensure your processes for handling Article 17 erasure requests are operational and compliant with the ruling. If you process personal data derived from criminal proceedings, sanctions, or enforcement decisions as part of a commercial product or service: Article 10 of the GDPR (processing relating to criminal convictions and offences) imposes additional restrictions. Criminal conviction data can only be processed under the control of official authority or when authorised by member state law; the commercial database model in C-199/24 is likely to face additional Article 10 scrutiny following this judgment. If you rely on the Article 85 journalism exemption to resist data subject rights requests in any processing context: The CJEU in C-199/24 confirms the exemption applies only where processing is strictly necessary to reconcile data protection with freedom of expression and information, and the primary purpose is genuinely journalistic, academic, artistic, or literary. Review whether your claimed exemption meets this strict necessity standard. Map your GDPR obligations with Verdaio's GDPR Quick Check.

If you operate a consumer-facing AI platform, chatbot, or similar digital service accessible to minors across EU member states: The Garante's Character.AI decision establishes a GDPR compliance benchmark for age-gated AI services. As a minimum, implement effective age verification proportionate to the risk to minors, set minor profiles to private by default (Article 25), introduce a cooling-off period preventing banned minor users from immediately re-registering, and complete a DPIA under GDPR Article 35. If you are a non-EU controller processing personal data of EU data subjects on a systematic basis: The Article 27 EU representative requirement was among the five violations in this decision. Appoint an EU representative in writing, designate them as the point of contact for supervisory authorities, and inform data subjects of the representative's identity in your privacy notice. If you process personal data of minors under GDPR: Article 8 (age of consent for information society services) and Article 25 (data protection by design and by default) are increasingly enforced jointly. Review your age verification approach, default settings for minor users, and DPIA documentation against this decision. Use Verdaio's GDPR Quick Check to map your GDPR obligations.

If you train AI models or use web scraping to collect personal data at scale: The EDPB draft guidelines require a documented legal basis under GDPR Article 6 for each web scraping operation. Legitimate interest under Article 6(1)(f) is not automatically available and requires a documented balancing test; special category data under Article 9 requires explicit consent or another qualifying ground. Review your training data sourcing practices against the draft guidelines and consider submitting a consultation response by 30 October 2026. If you rely on anonymisation to take your processing outside GDPR scope: The draft guidelines update the anonymisation threshold in light of CJEU C-413/23 P. Review your anonymisation methodology against the updated standards before the consultation closes on 30 October 2026. If you use blockchain to record or share personal data of EU data subjects: The final blockchain guidelines are now the authoritative EDPB reference. Conduct a DPIA if one is not in place, and implement technical measures, such as off-chain storage, cryptographic deletion, or zero-knowledge proofs, to address the rights to erasure and rectification. Use Verdaio's GDPR Quick Check to map your GDPR obligations.

If you develop, provide or deploy AI systems or use AI tools in your operations and are subject to NIS2 or DORA: The Commission action plan confirms that national supervisory authorities and the AI Office will increasingly assess AI-specific cybersecurity risks as part of both AI Act and NIS2/DORA compliance reviews. Under NIS2 Article 21, your risk management measures must address all relevant threats, including AI-enabled attacks. The plan's secure testing platform (ENISA plus JRC) will be available to critical-sector operators; monitor ENISA for access details as the platform is developed. If you are a provider of GPAI models subject to Chapter V of the AI Act: The EU AI model evaluation capacity pillar signals that third-party evaluation practices will evolve rapidly from 2 August 2026 when AI Office enforcement activates. Align your technical documentation and safety evaluations with the GPAI Code of Practice before that date. If you manufacture connected products subject to the CRA: The plan signals increased Commission and ENISA attention to AI-driven vulnerability discovery and exploitation; ensure your vulnerability management and Article 14 incident reporting processes are operational before the 11 September 2026 CRA reporting deadline. Map your AI Act and NIS2 obligations with Verdaio's EU AI Act Assessment and NIS2 Readiness Assessment.

If you are currently in scope of CSRD (a large public-interest entity, large undertaking, or listed SME under Directive 2013/34/EU as amended by CSRD): The revised ESRS reduce your mandatory disclosure burden by more than 70%. Review whether topics you previously assessed as material remain material under the revised framework, and update your double materiality assessment and reporting templates accordingly. For your first report under the revised ESRS, transition guidance from EFRAG is expected in late 2026. If you are a listed SME or a company that will be in scope under the revised CSRD thresholds: The simplified ESRS set adopted simultaneously provides a proportionate reporting framework; begin your gap analysis against the simplified ESRS requirements now. If you are a large company between 250 and 1,000 employees that expected to enter CSRD scope: Review the revised in-scope thresholds (1,000 employees + turnover/balance sheet criteria) to confirm whether you remain subject to CSRD mandatory reporting from 2028. Map your CSRD obligations and run your double materiality assessment with Verdaio's CSRD Readiness Assessment.

If you process personal data of Italian data subjects, operate an establishment in Italy, or offer goods or services to individuals in Italy: The 2025 Annual Report confirms the Garante is in a phase of significantly expanded enforcement, with sanctions up 54.5% year-on-year and criminal referrals quadrupled. The Garante's 2026 inspection plan targets public-sector databases and new-technology deployments including AI systems; private-sector entities processing personal data with generative AI tools, biometric identification systems, or large-scale data warehouses face elevated inspection risk. If you develop, provide or deploy AI systems that process personal data of Italian users, generate synthetic content, or use biometric data: Review compliance with GDPR Articles 9 (special category data), 5(1)(a)(c)(e) (lawfulness, data minimisation, storage limitation), 13-14 (transparency), and 25 (data protection by design). The Garante's parallel application of GDPR and the EU AI Act prohibition on workplace emotion-inference AI in prior decisions signals that cross-regulatory enforcement is accelerating. Map your GDPR obligations with Verdaio's GDPR Quick Check.

If you are a financial entity subject to EU AML obligations (banks, credit institutions, payment institutions, e-money institutions, asset managers, virtual asset service providers, or other obligated entities under the AML Regulation): Article 75 information sharing becomes available from 10 July 2027. Monitor the EDPB-AMLA guidelines development: a draft is expected for public consultation in the first half of 2027. Begin reviewing your data governance architecture for AML information-sharing use cases now, and identify whether existing DPIAs need updating when the draft guidelines are published. If you are subject to both GDPR and DORA: Cross-entity AML information sharing creates additional ICT third-party risk obligations under DORA Articles 28-44; identify information-sharing counterparties in your DORA Register of Information. Map your GDPR obligations with Verdaio's GDPR Quick Check.

If you develop, provide or deploy AI systems classified as high-risk under Annex III of the EU AI Act (AI systems in critical infrastructure management, education and vocational training, employment and workforce management, access to essential private and public services, law enforcement, migration and border management, or administration of justice): The Annex III compliance deadline is legally confirmed as 2 December 2027 following the Council's formal adoption on 29 June 2026. Use the extension to complete conformity assessments, prepare technical documentation, align with harmonised standards as they are published, and register in the EU database. Do not wait for Official Journal publication to begin: the date is confirmed. If you build or deploy generative AI systems subject to Article 50 transparency obligations: Those obligations apply from 2 August 2026; the technical grace period for compliant watermarking extends to 2 December 2026. If you provide general-purpose AI models: Your Chapter V obligations from August 2025 are unchanged by the Digital Omnibus on AI. Map your EU AI Act obligations with Verdaio's EU AI Act Assessment.

If you operate across multiple EU or EEA member states and face conflicting GDPR guidance from different national supervisory authorities (for example, divergent positions on legitimate interest assessments, cookie consent requirements, or data retention periods): The EDPB consistency form gives you a direct channel to bring those divergences to the Board's attention. Submissions that document systemic inconsistencies may lead the EDPB to issue clarifying guidelines that benefit your compliance programme across all affected jurisdictions. The form does not produce individual rulings, but flagging a well-documented divergence is a practical step when cross-border inconsistency creates real compliance cost. If you submit a report: include specific regulatory references, the national authority positions involved, and the practical impact, to give the EDPB the structured information it needs to assess whether a consistency action is warranted. Map your GDPR obligations with Verdaio's GDPR Quick Check.

If you develop, provide or deploy AI systems classified as high-risk under Annex III of the EU AI Act (AI systems in critical infrastructure management, education and vocational training, employment and workforce management, access to essential private and public services, law enforcement, migration and border management, or administration of justice): Your compliance deadline for the core Annex III obligations (conformity assessment, technical documentation, registration in the EU AI Act database, transparency requirements for deployers, and post-market monitoring) has been extended to 2 December 2027. Use the additional time to complete a structured readiness assessment, align with the published harmonised standards once available, and prepare your technical documentation and conformity assessment process. If you build or deploy generative AI systems or systems covered by Article 50 transparency obligations: The Article 50 obligations still apply from 2 August 2026; the three-month technical grace period extends implementation of compliant watermarking and metadata solutions to 2 December 2026. If you develop or deploy nudifier applications that generate synthetic intimate images of real persons: These are now permanently prohibited under Article 5 of the AI Act. Map your EU AI Act obligations with Verdaio's EU AI Act Assessment.

If you manufacture, develop or place on the EU market hardware or software products with digital elements (IoT devices, routers, firewalls, network equipment, operating systems, security software, industrial control systems, or connected consumer products): The 11 September 2026 Article 14 deadline is now fewer than 90 days away. Complete your ENISA Single Reporting Platform registration during June 2026 while training and dry-run support is available, map your internal vulnerability management and incident response procedures to the 24-hour, 72-hour and 14-day reporting windows, and confirm your main establishment in the EU for CSIRT notification routing. If your product falls within Class II under Annex III of the CRA (firewalls, VPNs, hardware security modules, operating systems, microprocessors, industrial automation systems): Third-party conformity assessment is mandatory. Engage a designated conformity assessment body notified by a Member State under Chapter IV. Check your CRA product classification and prepare your technical documentation with Verdaio's CRA Product Compliance Checker.

If you operate critical infrastructure in the rail or maritime transport sector (port operators, railway infrastructure managers, vessel traffic services, freight logistics platforms, or passenger rail networks) as an essential entity under NIS2: Cyber Europe 2026 confirms that your sector is a priority target in EU-level threat scenario planning. Review your NIS2 Article 21 security measures, confirm your incident reporting readiness under Article 23 (24-hour early warning to your national CSIRT), and verify that your contacts in the national cybersecurity crisis management authority are current. If you provide services to transport-sector critical infrastructure operators as an important entity under NIS2, or supply operational technology (OT), industrial control systems (ICS) or vessel traffic management software to the transport sector: Supply chain security and OT/IT convergence are central to the NIS2 Article 21 risk management requirements. Check your NIS2 obligations and security controls with Verdaio's NIS2 Compliance Assessment.

If you build or deploy generative AI systems (text-to-image, voice synthesis, video generation, chatbots, or deepfake tools) that produce or manipulate audio, image, video or text for EU users: Your Article 50(2) marking obligation applies from 2 August 2026. Implement machine-readable metadata or watermarking in your output pipeline before that date; the Code of Practice sets the technical benchmark against which the EU AI Office and national market surveillance authorities will assess compliance. If you have not yet adopted a compliant technical mechanism, the 2 December 2026 transitional deadline applies to those implementation steps. If you operate a platform that publishes AI-generated or AI-manipulated content on matters of public interest (news, political advertising, public information campaigns): The Article 50(4) deepfake and public-interest text labelling obligation applies from 2 August 2026. Review your editorial workflows and label placement against the Code's Section 2 guidance. If you deploy chatbots or virtual assistants that interact directly with users: The Article 50(1) AI disclosure obligation also applies from 2 August 2026. Map your AI Act transparency obligations with Verdaio's EU AI Act Assessment.

If you act as a data controller operating in one or more EU or EEA Member States: The EDPB common breach notification template will, once finalised and adopted by national supervisory authorities, replace each DPA's current notification form with a single harmonised format. Review your incident response playbook now: your internal notification procedures, SIEM runbooks, and outsourced incident response arrangements should be structured around the Article 33(3) mandatory information elements so they can map cleanly onto the new fields when the template enters into force. If you operate across borders and currently maintain separate notification procedures for different national DPA forms: the common template will simplify cross-border breach response materially once it enters into force. Participate in the public consultation (open until 5 August 2026) if your organisation has practical experience with current breach notification forms. Map your GDPR controls and breach response readiness with Verdaio's GDPR Quick Check.

If you operate accommodation, travel, or vehicle rental services that collect guest or traveller data on behalf of police or regulatory mandates in any EU Member State: This infringement case signals that the Commission treats blanket traveller-data mandates as disproportionate under the LED, regardless of national security justifications. Audit the categories and retention periods of traveller data you are required by national law to collect and transmit, and document the LED legal basis and necessity analysis in your ROPA. If you operate in Spain under Real Decreto 933/2021: Monitor developments closely; if the Commission escalates to a reasoned opinion or Court referral, Spain may be required to amend or repeal the decree, which would alter your compliance obligations. Review your data mapping and subject-rights procedures with Verdaio's GDPR Quick Check.

If you sell cloud services, SaaS, or AI tools to EU public-sector bodies (central government, health, banking, energy, or justice): CADA introduces formal sovereignty risk assessments into public procurement. Prepare to answer questions about parent-company jurisdiction, third-country data access rights, software supply-chain transparency, and data escrow arrangements. Non-EU-owned providers face structural barriers to Levels 3 and 4 procurement tiers. If you build or deploy AI systems hosted on cloud infrastructure: The CADA sovereignty framework may affect your cloud provider options for regulated public-sector workloads once the act enters into force. Map your infrastructure against the four CADA levels and assess whether current provider arrangements would require renegotiation. Both proposals are early-stage and must pass the full EU legislative process. Map your AI Act obligations with Verdaio's EU AI Act Assessment and your CRA exposure with the CRA Product Compliance Checker.

If you provide, deploy, or integrate general-purpose AI models (including large language models, multimodal foundation models, or AI models made available via API) in your products or services: The Scientific Panel now gives the EU AI Office dedicated independent expertise to identify systemic risks in GPAI models, advise on classification, and coordinate cross-border enforcement from 2 August 2026. Review your GPAI model obligations under Articles 53-55 of the AI Act: technical documentation, transparency measures including copyright summaries, cooperation with the AI Office, and systemic risk assessments for high-impact capability models. If your GPAI model was on the market before 2 August 2025, you have until 2 August 2027 to achieve full compliance. If you build or deploy AI systems that use GPAI models as components: your obligations as a deployer depend on whether the downstream use creates a high-risk AI system. Classify your AI system and map your obligations with Verdaio's EU AI Act Assessment.

If you build, deploy or procure AI tools that score employee sentiment, mood, stress or wellbeing from communications data: Review the legal basis for any such product against both Article 9 GDPR (special category data) and the EU AI Act Article 5(1)(f) prohibition on workplace emotion-inference AI. Aggregation, anonymisation labels and "wellbeing" framings will not save a product that infers psychological states from chat or voice data. If you run collaboration suites such as Slack or Microsoft Teams across your workforce: Audit any third-party plug-ins or integrations that perform sentiment, emotion or stress analytics, document the lawful basis and DPIA, and tighten supplier terms before procurement. Map your AI Act exposure with Verdaio's EU AI Act Assessment and your GDPR controls with the GDPR Quick Check.

If you operate a data warehouse, research platform or other large-scale processing that you have characterised as anonymous: The CNIL's decision confirms that the GDPR anonymisation threshold is high and the test is whether re-identification remains reasonably possible. Re-assess your anonymisation methodology against the singling-out, linkability and inference criteria of the Article 29 Working Party opinion (WP216), and avoid relying on labels alone. If you collect personal data through pharmacies, doctors, brokers or other intermediaries: Article 14 GDPR transparency duties stay with the controller. You cannot rely on a third party to hand out a notice; you must verify the information actually reaches data subjects and that an effective right to object is available. Tighten your information notices, logging and access controls with Verdaio's GDPR Quick Check.

If your organisation is registered as an essential or important entity under NIS2: The 2026 NIS360 is the most authoritative public benchmark of where each high-criticality sector stands on cyber maturity, and a signal of where supervisory attention is likely to land first. Compare your governance, risk management, incident response and supply-chain controls against ENISA's four pillars (legislation, company preparedness, authority capacity and ecosystem) and prioritise the gaps that pull your sector's profile down. If you operate in a sector flagged as falling within the risk zone: expect closer scrutiny from your national competent authority during the next supervision cycle and budget for accelerated remediation. Map your NIS2 obligations and identify gaps with Verdaio's NIS2 Readiness Assessment.

If you are an essential or important entity under NIS2 with operations in more than one Member State: Common templates will materially reduce the cost of complying with the Article 23 reporting clock by replacing parallel national forms with a single EU-wide format. Track the implementing act expected from the Commission, then update your internal incident playbooks, SIEM runbooks and outsourcing contracts so your 24-hour, 72-hour and one-month reports map cleanly onto the new fields. If you are a managed service provider or supplier to NIS2 entities: Expect customers to push the harmonised template requirements down through contractual clauses on incident notification and cooperation. Map your NIS2 obligations and tighten your incident response process with Verdaio's NIS2 Readiness Assessment.

If you operate any consumer service that handles personal data and receives data subject access requests under GDPR Article 15: The High Court ruling reinforces that regulators can pursue systemic access-right failures and propose substantial fines, even when an inquiry starts from a single complaint. Audit your end-to-end access-request workflow, ensure all categories of personal data (including data held in internal analytics warehouses, logs, and backend tools) are returned in a complete and intelligible form within the one-month deadline of Article 12, and document any restrictions you rely on under Article 15(4). If you are considering challenging a DPC or other EEA preliminary finding: Procedural arguments about the scope of an inquiry are unlikely to defeat findings on the merits where the regulator has identified systemic issues affecting many users. Map your data subject rights process with Verdaio's GDPR Quick Check.

If you handle personal data of users in France or sell into the French market: The CNIL's 2025 figures show enforcement intensity is rising on cookies, employee monitoring and data security, the three areas it identifies as driving the bulk of last year's fines. Review your cookie banners, monitor your data-breach response times against the Article 33 72-hour deadline, and audit your security controls against the storage-limitation and security principles of GDPR Articles 5 and 32. If you build, deploy or distribute AI systems used in France: The CNIL is positioning itself as one of the most active EU AI Act regulators and is on track to supervise several Annex III high-risk categories (biometrics, migration, law enforcement, employment, education) once formally designated. Map your AI systems against the prohibited practices in Article 5 and the high-risk categories in Annex III. Run a privacy review with Verdaio's GDPR Quick Check and an AI Act classification check with Verdaio's EU AI Act Assessment.

If you store user credentials or run any service that holds account passwords: Plain-text password storage and weak hashing remain among the clearest security failures a regulator can find. Hash passwords with a modern, salted algorithm, never keep them in readable form, and delete credentials for systems and accounts you no longer use, in line with the storage-limitation principle. If you handle personal data breaches: Notifying the supervisory authority within 72 hours under Article 33 is only half of the obligation. Where a breach poses a high risk to individuals, Article 34 requires you to inform those individuals without undue delay, and commercial or reputational concerns do not pause that clock. Map your breach-response plan and security controls with Verdaio's GDPR Quick Check.

If you build, deploy or distribute AI systems and are unsure whether they count as high-risk: These draft guidelines are the most detailed official steer yet on where the high-risk line sits. Map your AI systems against the Annex I product-safety route and the eight Annex III areas, and use the practical examples to test borderline cases such as HR, credit-scoring and biometric tools. If a specific use case is unclear, submit feedback to the consultation before 23 June 2026. Classification is the first step in every AI Act compliance programme: a system classified as high-risk triggers risk management, data governance, logging, transparency and human-oversight obligations. Run a classification check with Verdaio's EU AI Act Assessment.

If you build, deploy or distribute high-risk AI systems or general-purpose AI: The new deadlines (2 December 2027 for Annex III, 2 August 2028 for Annex I) are now locked in by Coreper but are not yet law until Parliament adopts at first reading. Until that adoption, the original 2 August 2026 deadline applies. If you build generative AI consumer products: The reduced three-month grace period means watermarking and content-provenance solutions must be in place by 2 December 2026, three months earlier than the originally proposed six-month grace. Audit your tooling against the new "nudification" and CSAM prohibitions before adoption. Run a classification check with Verdaio's EU AI Act Assessment.

If you provide AI systems to schools, universities or vocational training providers, or if you deploy AI in an education or training context: Education ministers are now formally aligned on a human-centred deployment model. Expect Member States to push procurement requirements that include teacher AI-literacy training, transparent evaluation criteria, and bias and misinformation safeguards. The conclusions also reinforce that the Article 4 AI literacy obligation applies to all AI deployers, not just those in high-risk sectors. If you sell AI tools for HR, recruitment, assessment or scoring in an education or training context: Classification as high-risk under Annex III is now coupled with these political conclusions, raising the bar for transparency, human oversight and evaluation. Run a classification check with Verdaio's EU AI Act Assessment and review your training programme with Verdaio's AI Literacy guide.

If you build or deploy generative AI, chatbots, deepfake tools, emotion recognition or biometric categorisation systems: The 2 August 2026 transparency deadline still stands. Plan now for chatbot disclosure, machine-readable watermarking of synthetic outputs, and clear deepfake labelling, and submit feedback before 3 June 2026 if your use case needs clarification. Run a classification check with Verdaio's EU AI Act Assessment.

If you operate a contact centre or any voice-channel customer service handling personal or financial data: Voice-channel social engineering remains a top regulatory concern. Map your caller-authentication procedures against Articles 5(1)(f) and 32(1), train staff on knowledge-based authentication weaknesses and impersonation indicators, and ensure your incident-response process can detect and notify the supervisory authority within the 72-hour window of Article 33. Run a structured posture check with Verdaio's GDPR Quick Check.

If you build, deploy or distribute high-risk AI systems (HR, education, credit scoring, biometrics, AI in regulated products) or general-purpose AI: Plan for a 2 December 2027 (Annex III) or 2 August 2028 (Annex I) deadline, but do not stop compliance work. Formal adoption is still pending and the original 2 August 2026 deadline applies until both co-legislators sign off. The extra time is best used to mature risk management, data governance and human-oversight controls, not to delay them. If you build generative AI consumer products: Audit your tooling against the new "nudification" and CSAM prohibitions before the deal is adopted. Run a classification check with Verdaio's EU AI Act Assessment.

If you are an undertaking in scope of the CSRD (1,000+ employees, €450M+ turnover): Review the draft revised ESRS now, especially the materiality assessment changes and reduced datapoint set, and decide whether to apply the revised standards early for FY 2026 or wait for FY 2027. Submit feedback before 3 June 2026 if you have specific concerns. If you are a smaller company in a CSRD value chain: The voluntary standard plus the value chain cap limits what your large clients can require from you on sustainability data. Run a gap-check with Verdaio's ESRS Gap Analysis.

If you operate or distribute services on a designated gatekeeper platform (App Store, Google Play, Amazon Marketplace, Facebook, Instagram, TikTok, Search, Booking.com): Expect the Commission to accelerate ongoing non-compliance proceedings and to focus on practical effects (real choice, real interoperability) rather than formal box-ticking. Plan for higher fines on repeat or continued non-compliance, and for closer scrutiny of AI-driven search and assistant tools when integrated with gatekeeper services. Track DMA developments and align your distribution, advertising and consent flows accordingly.

If you operate cross-border data transfers (especially to non-adequacy jurisdictions) or rely on Standard Contractual Clauses with supplementary measures: the DPC decision still stands as the EU benchmark on what 'essentially equivalent protection' under Article 46(1) GDPR requires. The stay only freezes enforcement while the Irish courts review the underlying decision; it does not weaken the substantive compliance obligation. Audit your transfer impact assessments, supplementary measures, and onward-access controls. Run a structured check with Verdaio's GDPR Quick Check.

If you operate a hotel, B&B, or short-term rental in Italy (or process Italian guest data from abroad): Audit your check-in workflow now. Stop photographing or storing identity documents after the Alloggiati Web reporting; keep only the transmission receipt. Review your retention policy, train front-desk staff on the new guidance, and ensure your booking and PMS systems do not preserve ID images by default. Run a gap-check with Verdaio's GDPR Quick Check.

If you build, deploy or distribute high-risk AI systems (particularly in HR, education, credit scoring, biometrics, or AI embedded in regulated products): Plan as if the 2 August 2026 deadline will hold. Trilogue uncertainty is not a basis for delaying compliance work. Even if a postponement is later agreed, an early start protects you from a compressed timeline. Run a classification check with Verdaio's EU AI Act Assessment.

If you operate a digital platform, ad-tech product, or any service whose terms condition access on data use: Expect EU competition authorities to assess your data-handling practices through a GDPR lens, and the EDPB to factor competition outcomes into its guidance. Review the alignment of your privacy notices, consent flows and data-portability mechanisms with both frameworks. Run a gap-check with Verdaio's GDPR Quick Check.

If you run email marketing, transactional emails or newsletters targeting Italian recipients: Review every pixel, open-tracker and click-tracker in your ESP or CRM stack, map each to a specific legal basis, and align your consent flows and privacy notices with the Guidelines. Revisit data-minimisation controls (pseudonymous IDs, short retention) and document the exemption you rely on where no consent is collected. Run a gap-check with Verdaio's GDPR Quick Check.

If you run a mobile app that reads device state (installed apps, running processes, device fingerprinting): The Garante's decision sets a clear precedent that mandatory, all-or-nothing authorisations to access device data are disproportionate, even for fraud prevention. Review data minimisation, user-information flows, DPIA coverage, and security/retention controls for your mobile apps. Run a gap-check with Verdaio's GDPR Quick Check.

If you process personal data for research: Start mapping your activities against the six indicative factors and review how you document consent, safeguards and the limits on data subject rights. If you transfer personal data outside the EU/EEA: Certification is now a practical alternative to Standard Contractual Clauses and BCRs, useful where providers are reluctant to sign SCCs, or where the destination jurisdiction creates uncertainty. Review your GDPR posture and see whether certification-based transfers fit your vendor stack.

If you deploy biometric systems (facial recognition, fingerprint) for access, authentication, or customer experience: Biometric processing in public or semi-public spaces must satisfy strict necessity, encryption, and retention standards, even with consent. Review the Article 9 GDPR legal basis, technical safeguards, and whether you offer a real non-biometric alternative. Biometric systems may also trigger EU AI Act obligations. Check your posture with Verdaio's GDPR Quick Check and EU AI Act Assessment.

If you conduct DPIAs: This is the first time the EU has offered a single, consistent DPIA format that will be recognised across Member States. Multinational controllers benefit most, one template, one structure, accepted by every DPA. Action: Review your current DPIA methodology against the draft template, submit feedback before 9 June if relevant, and plan to migrate existing DPIAs once national DPAs formally adopt it. Run a gap-check with Verdaio's GDPR Quick Check.

If you operate in any of the 18 NIS2 sectors: The compliance deadline is now less than 6 months away. Start with a gap assessment to understand your current posture, particularly around incident reporting (72-hour notification requirement), supply chain risk management, and board-level accountability. Not sure if NIS2 applies to you? Run the free NIS2 Readiness Assessment.

If you have under 1,000 employees: You are likely out of mandatory scope under the new threshold. However, large customers and financial institutions may still require CSRD-aligned disclosures through their own value chain reporting. If you have 1,000+ employees: Mandatory reporting continues, the core ESRS standards remain unchanged. Use the delay to strengthen your data collection processes.

If you deploy high-risk AI: The extension is very likely to pass, but it is not yet law. The responsible approach is to prepare for the August 2026 deadline while expecting the relief. If adopted as expected, you will have until December 2027 for Annex III systems. Use the time to build compliant processes rather than waiting. We will update this story when the final text is published.

If you report under ESRS: Even though the Omnibus reduces mandatory scope, the financial sector, your banks, investors, and insurers, still expects comprehensive sustainability data. Companies that only meet the minimum simplified requirements may face challenges accessing green finance or satisfying due diligence requests from larger clients.

If you're already reporting: Review which activities fall below the 10% threshold, you may be able to exclude a significant portion of your current assessment scope. If you haven't started: This simplification makes first-time Taxonomy reporting considerably more manageable. The threshold applies for reporting periods from 2025 onwards.

Immediate action required: If your organisation uses or deploys AI systems, review them against the Article 5 prohibited practices list now. Violations can result in fines of up to €35M or 7% of global annual turnover. Most business AI tools (productivity, analytics, customer service) are not prohibited, but AI used in recruitment, credit scoring, or affecting individuals in sensitive contexts requires careful review.

If you use gatekeeper platforms: These decisions signal that app stores, search rankings, and advertising systems on major platforms may change to comply with DMA requirements, potentially affecting your distribution and marketing strategies. If you are a gatekeeper platform: The DMA is now actively enforced. Non-compliance carries substantial financial risk.

For any company that transfers personal data outside the EU/EEA: This fine reinforces that transfer mechanisms must be watertight. Standard Contractual Clauses (SCCs) are not sufficient if the destination country's laws prevent the data importer from complying with them in practice. Review your data transfer impact assessments (DTIAs), particularly for transfers to the US, India, and China. Consider data localisation where technically feasible.