EU Regulatory News

If you operate a consumer-facing AI platform, chatbot, or similar digital service accessible to minors across EU member states: The Garante's Character.AI decision establishes a GDPR compliance benchmark for age-gated AI services. As a minimum, implement effective age verification proportionate to the risk to minors, set minor profiles to private by default (Article 25), introduce a cooling-off period preventing banned minor users from immediately re-registering, and complete a DPIA under GDPR Article 35. If you are a non-EU controller processing personal data of EU data subjects on a systematic basis: The Article 27 EU representative requirement was among the five violations in this decision. Appoint an EU representative in writing, designate them as the point of contact for supervisory authorities, and inform data subjects of the representative's identity in your privacy notice. If you process personal data of minors under GDPR: Article 8 (age of consent for information society services) and Article 25 (data protection by design and by default) are increasingly enforced jointly. Review your age verification approach, default settings for minor users, and DPIA documentation against this decision. Use Verdaio's GDPR Quick Check to map your GDPR obligations.

If you train AI models or use web scraping to collect personal data at scale: The EDPB draft guidelines require a documented legal basis under GDPR Article 6 for each web scraping operation. Legitimate interest under Article 6(1)(f) is not automatically available and requires a documented balancing test; special category data under Article 9 requires explicit consent or another qualifying ground. Review your training data sourcing practices against the draft guidelines and consider submitting a consultation response by 30 October 2026. If you rely on anonymisation to take your processing outside GDPR scope: The draft guidelines update the anonymisation threshold in light of CJEU C-413/23 P. Review your anonymisation methodology against the updated standards before the consultation closes on 30 October 2026. If you use blockchain to record or share personal data of EU data subjects: The final blockchain guidelines are now the authoritative EDPB reference. Conduct a DPIA if one is not in place, and implement technical measures, such as off-chain storage, cryptographic deletion, or zero-knowledge proofs, to address the rights to erasure and rectification. Use Verdaio's GDPR Quick Check to map your GDPR obligations.

If you develop, provide or deploy AI systems or use AI tools in your operations and are subject to NIS2 or DORA: The Commission action plan confirms that national supervisory authorities and the AI Office will increasingly assess AI-specific cybersecurity risks as part of both AI Act and NIS2/DORA compliance reviews. Under NIS2 Article 21, your risk management measures must address all relevant threats, including AI-enabled attacks. The plan's secure testing platform (ENISA plus JRC) will be available to critical-sector operators; monitor ENISA for access details as the platform is developed. If you are a provider of GPAI models subject to Chapter V of the AI Act: The EU AI model evaluation capacity pillar signals that third-party evaluation practices will evolve rapidly from 2 August 2026 when AI Office enforcement activates. Align your technical documentation and safety evaluations with the GPAI Code of Practice before that date. If you manufacture connected products subject to the CRA: The plan signals increased Commission and ENISA attention to AI-driven vulnerability discovery and exploitation; ensure your vulnerability management and Article 14 incident reporting processes are operational before the 11 September 2026 CRA reporting deadline. Map your AI Act and NIS2 obligations with Verdaio's EU AI Act Assessment and NIS2 Readiness Assessment.

If you are currently in scope of CSRD (a large public-interest entity, large undertaking, or listed SME under Directive 2013/34/EU as amended by CSRD): The revised ESRS reduce your mandatory disclosure burden by more than 70%. Review whether topics you previously assessed as material remain material under the revised framework, and update your double materiality assessment and reporting templates accordingly. For your first report under the revised ESRS, transition guidance from EFRAG is expected in late 2026. If you are a listed SME or a company that will be in scope under the revised CSRD thresholds: The simplified ESRS set adopted simultaneously provides a proportionate reporting framework; begin your gap analysis against the simplified ESRS requirements now. If you are a large company between 250 and 1,000 employees that expected to enter CSRD scope: Review the revised in-scope thresholds (1,000 employees + turnover/balance sheet criteria) to confirm whether you remain subject to CSRD mandatory reporting from 2028. Map your CSRD obligations and run your double materiality assessment with Verdaio's CSRD Readiness Assessment.

If you process personal data of Italian data subjects, operate an establishment in Italy, or offer goods or services to individuals in Italy: The 2025 Annual Report confirms the Garante is in a phase of significantly expanded enforcement, with sanctions up 54.5% year-on-year and criminal referrals quadrupled. The Garante's 2026 inspection plan targets public-sector databases and new-technology deployments including AI systems; private-sector entities processing personal data with generative AI tools, biometric identification systems, or large-scale data warehouses face elevated inspection risk. If you develop, provide or deploy AI systems that process personal data of Italian users, generate synthetic content, or use biometric data: Review compliance with GDPR Articles 9 (special category data), 5(1)(a)(c)(e) (lawfulness, data minimisation, storage limitation), 13-14 (transparency), and 25 (data protection by design). The Garante's parallel application of GDPR and the EU AI Act prohibition on workplace emotion-inference AI in prior decisions signals that cross-regulatory enforcement is accelerating. Map your GDPR obligations with Verdaio's GDPR Quick Check.

If you are a financial entity subject to EU AML obligations (banks, credit institutions, payment institutions, e-money institutions, asset managers, virtual asset service providers, or other obligated entities under the AML Regulation): Article 75 information sharing becomes available from 10 July 2027. Monitor the EDPB-AMLA guidelines development: a draft is expected for public consultation in the first half of 2027. Begin reviewing your data governance architecture for AML information-sharing use cases now, and identify whether existing DPIAs need updating when the draft guidelines are published. If you are subject to both GDPR and DORA: Cross-entity AML information sharing creates additional ICT third-party risk obligations under DORA Articles 28-44; identify information-sharing counterparties in your DORA Register of Information. Map your GDPR obligations with Verdaio's GDPR Quick Check.

If you develop, provide or deploy AI systems classified as high-risk under Annex III of the EU AI Act (AI systems in critical infrastructure management, education and vocational training, employment and workforce management, access to essential private and public services, law enforcement, migration and border management, or administration of justice): The Annex III compliance deadline is legally confirmed as 2 December 2027 following the Council's formal adoption on 29 June 2026. Use the extension to complete conformity assessments, prepare technical documentation, align with harmonised standards as they are published, and register in the EU database. Do not wait for Official Journal publication to begin: the date is confirmed. If you build or deploy generative AI systems subject to Article 50 transparency obligations: Those obligations apply from 2 August 2026; the technical grace period for compliant watermarking extends to 2 December 2026. If you provide general-purpose AI models: Your Chapter V obligations from August 2025 are unchanged by the Digital Omnibus on AI. Map your EU AI Act obligations with Verdaio's EU AI Act Assessment.

If you operate across multiple EU or EEA member states and face conflicting GDPR guidance from different national supervisory authorities (for example, divergent positions on legitimate interest assessments, cookie consent requirements, or data retention periods): The EDPB consistency form gives you a direct channel to bring those divergences to the Board's attention. Submissions that document systemic inconsistencies may lead the EDPB to issue clarifying guidelines that benefit your compliance programme across all affected jurisdictions. The form does not produce individual rulings, but flagging a well-documented divergence is a practical step when cross-border inconsistency creates real compliance cost. If you submit a report: include specific regulatory references, the national authority positions involved, and the practical impact, to give the EDPB the structured information it needs to assess whether a consistency action is warranted. Map your GDPR obligations with Verdaio's GDPR Quick Check.

If you develop, provide or deploy AI systems classified as high-risk under Annex III of the EU AI Act (AI systems in critical infrastructure management, education and vocational training, employment and workforce management, access to essential private and public services, law enforcement, migration and border management, or administration of justice): Your compliance deadline for the core Annex III obligations (conformity assessment, technical documentation, registration in the EU AI Act database, transparency requirements for deployers, and post-market monitoring) has been extended to 2 December 2027. Use the additional time to complete a structured readiness assessment, align with the published harmonised standards once available, and prepare your technical documentation and conformity assessment process. If you build or deploy generative AI systems or systems covered by Article 50 transparency obligations: The Article 50 obligations still apply from 2 August 2026; the three-month technical grace period extends implementation of compliant watermarking and metadata solutions to 2 December 2026. If you develop or deploy nudifier applications that generate synthetic intimate images of real persons: These are now permanently prohibited under Article 5 of the AI Act. Map your EU AI Act obligations with Verdaio's EU AI Act Assessment.

If you manufacture, develop or place on the EU market hardware or software products with digital elements (IoT devices, routers, firewalls, network equipment, operating systems, security software, industrial control systems, or connected consumer products): The 11 September 2026 Article 14 deadline is now fewer than 90 days away. Complete your ENISA Single Reporting Platform registration during June 2026 while training and dry-run support is available, map your internal vulnerability management and incident response procedures to the 24-hour, 72-hour and 14-day reporting windows, and confirm your main establishment in the EU for CSIRT notification routing. If your product falls within Class II under Annex III of the CRA (firewalls, VPNs, hardware security modules, operating systems, microprocessors, industrial automation systems): Third-party conformity assessment is mandatory. Engage a designated conformity assessment body notified by a Member State under Chapter IV. Check your CRA product classification and prepare your technical documentation with Verdaio's CRA Product Compliance Checker.

If you operate critical infrastructure in the rail or maritime transport sector (port operators, railway infrastructure managers, vessel traffic services, freight logistics platforms, or passenger rail networks) as an essential entity under NIS2: Cyber Europe 2026 confirms that your sector is a priority target in EU-level threat scenario planning. Review your NIS2 Article 21 security measures, confirm your incident reporting readiness under Article 23 (24-hour early warning to your national CSIRT), and verify that your contacts in the national cybersecurity crisis management authority are current. If you provide services to transport-sector critical infrastructure operators as an important entity under NIS2, or supply operational technology (OT), industrial control systems (ICS) or vessel traffic management software to the transport sector: Supply chain security and OT/IT convergence are central to the NIS2 Article 21 risk management requirements. Check your NIS2 obligations and security controls with Verdaio's NIS2 Compliance Assessment.

If you build or deploy generative AI systems (text-to-image, voice synthesis, video generation, chatbots, or deepfake tools) that produce or manipulate audio, image, video or text for EU users: Your Article 50(2) marking obligation applies from 2 August 2026. Implement machine-readable metadata or watermarking in your output pipeline before that date; the Code of Practice sets the technical benchmark against which the EU AI Office and national market surveillance authorities will assess compliance. If you have not yet adopted a compliant technical mechanism, the 2 December 2026 transitional deadline applies to those implementation steps. If you operate a platform that publishes AI-generated or AI-manipulated content on matters of public interest (news, political advertising, public information campaigns): The Article 50(4) deepfake and public-interest text labelling obligation applies from 2 August 2026. Review your editorial workflows and label placement against the Code's Section 2 guidance. If you deploy chatbots or virtual assistants that interact directly with users: The Article 50(1) AI disclosure obligation also applies from 2 August 2026. Map your AI Act transparency obligations with Verdaio's EU AI Act Assessment.

If you act as a data controller operating in one or more EU or EEA Member States: The EDPB common breach notification template will, once finalised and adopted by national supervisory authorities, replace each DPA's current notification form with a single harmonised format. Review your incident response playbook now: your internal notification procedures, SIEM runbooks, and outsourced incident response arrangements should be structured around the Article 33(3) mandatory information elements so they can map cleanly onto the new fields when the template enters into force. If you operate across borders and currently maintain separate notification procedures for different national DPA forms: the common template will simplify cross-border breach response materially once it enters into force. Participate in the public consultation (open until 5 August 2026) if your organisation has practical experience with current breach notification forms. Map your GDPR controls and breach response readiness with Verdaio's GDPR Quick Check.

If you operate accommodation, travel, or vehicle rental services that collect guest or traveller data on behalf of police or regulatory mandates in any EU Member State: This infringement case signals that the Commission treats blanket traveller-data mandates as disproportionate under the LED, regardless of national security justifications. Audit the categories and retention periods of traveller data you are required by national law to collect and transmit, and document the LED legal basis and necessity analysis in your ROPA. If you operate in Spain under Real Decreto 933/2021: Monitor developments closely; if the Commission escalates to a reasoned opinion or Court referral, Spain may be required to amend or repeal the decree, which would alter your compliance obligations. Review your data mapping and subject-rights procedures with Verdaio's GDPR Quick Check.

If you sell cloud services, SaaS, or AI tools to EU public-sector bodies (central government, health, banking, energy, or justice): CADA introduces formal sovereignty risk assessments into public procurement. Prepare to answer questions about parent-company jurisdiction, third-country data access rights, software supply-chain transparency, and data escrow arrangements. Non-EU-owned providers face structural barriers to Levels 3 and 4 procurement tiers. If you build or deploy AI systems hosted on cloud infrastructure: The CADA sovereignty framework may affect your cloud provider options for regulated public-sector workloads once the act enters into force. Map your infrastructure against the four CADA levels and assess whether current provider arrangements would require renegotiation. Both proposals are early-stage and must pass the full EU legislative process. Map your AI Act obligations with Verdaio's EU AI Act Assessment and your CRA exposure with the CRA Product Compliance Checker.

If you provide, deploy, or integrate general-purpose AI models (including large language models, multimodal foundation models, or AI models made available via API) in your products or services: The Scientific Panel now gives the EU AI Office dedicated independent expertise to identify systemic risks in GPAI models, advise on classification, and coordinate cross-border enforcement from 2 August 2026. Review your GPAI model obligations under Articles 53-55 of the AI Act: technical documentation, transparency measures including copyright summaries, cooperation with the AI Office, and systemic risk assessments for high-impact capability models. If your GPAI model was on the market before 2 August 2025, you have until 2 August 2027 to achieve full compliance. If you build or deploy AI systems that use GPAI models as components: your obligations as a deployer depend on whether the downstream use creates a high-risk AI system. Classify your AI system and map your obligations with Verdaio's EU AI Act Assessment.

If you build, deploy or procure AI tools that score employee sentiment, mood, stress or wellbeing from communications data: Review the legal basis for any such product against both Article 9 GDPR (special category data) and the EU AI Act Article 5(1)(f) prohibition on workplace emotion-inference AI. Aggregation, anonymisation labels and "wellbeing" framings will not save a product that infers psychological states from chat or voice data. If you run collaboration suites such as Slack or Microsoft Teams across your workforce: Audit any third-party plug-ins or integrations that perform sentiment, emotion or stress analytics, document the lawful basis and DPIA, and tighten supplier terms before procurement. Map your AI Act exposure with Verdaio's EU AI Act Assessment and your GDPR controls with the GDPR Quick Check.

If you operate a data warehouse, research platform or other large-scale processing that you have characterised as anonymous: The CNIL's decision confirms that the GDPR anonymisation threshold is high and the test is whether re-identification remains reasonably possible. Re-assess your anonymisation methodology against the singling-out, linkability and inference criteria of the Article 29 Working Party opinion (WP216), and avoid relying on labels alone. If you collect personal data through pharmacies, doctors, brokers or other intermediaries: Article 14 GDPR transparency duties stay with the controller. You cannot rely on a third party to hand out a notice; you must verify the information actually reaches data subjects and that an effective right to object is available. Tighten your information notices, logging and access controls with Verdaio's GDPR Quick Check.

If your organisation is registered as an essential or important entity under NIS2: The 2026 NIS360 is the most authoritative public benchmark of where each high-criticality sector stands on cyber maturity, and a signal of where supervisory attention is likely to land first. Compare your governance, risk management, incident response and supply-chain controls against ENISA's four pillars (legislation, company preparedness, authority capacity and ecosystem) and prioritise the gaps that pull your sector's profile down. If you operate in a sector flagged as falling within the risk zone: expect closer scrutiny from your national competent authority during the next supervision cycle and budget for accelerated remediation. Map your NIS2 obligations and identify gaps with Verdaio's NIS2 Readiness Assessment.

If you are an essential or important entity under NIS2 with operations in more than one Member State: Common templates will materially reduce the cost of complying with the Article 23 reporting clock by replacing parallel national forms with a single EU-wide format. Track the implementing act expected from the Commission, then update your internal incident playbooks, SIEM runbooks and outsourcing contracts so your 24-hour, 72-hour and one-month reports map cleanly onto the new fields. If you are a managed service provider or supplier to NIS2 entities: Expect customers to push the harmonised template requirements down through contractual clauses on incident notification and cooperation. Map your NIS2 obligations and tighten your incident response process with Verdaio's NIS2 Readiness Assessment.

If you operate any consumer service that handles personal data and receives data subject access requests under GDPR Article 15: The High Court ruling reinforces that regulators can pursue systemic access-right failures and propose substantial fines, even when an inquiry starts from a single complaint. Audit your end-to-end access-request workflow, ensure all categories of personal data (including data held in internal analytics warehouses, logs, and backend tools) are returned in a complete and intelligible form within the one-month deadline of Article 12, and document any restrictions you rely on under Article 15(4). If you are considering challenging a DPC or other EEA preliminary finding: Procedural arguments about the scope of an inquiry are unlikely to defeat findings on the merits where the regulator has identified systemic issues affecting many users. Map your data subject rights process with Verdaio's GDPR Quick Check.

If you handle personal data of users in France or sell into the French market: The CNIL's 2025 figures show enforcement intensity is rising on cookies, employee monitoring and data security, the three areas it identifies as driving the bulk of last year's fines. Review your cookie banners, monitor your data-breach response times against the Article 33 72-hour deadline, and audit your security controls against the storage-limitation and security principles of GDPR Articles 5 and 32. If you build, deploy or distribute AI systems used in France: The CNIL is positioning itself as one of the most active EU AI Act regulators and is on track to supervise several Annex III high-risk categories (biometrics, migration, law enforcement, employment, education) once formally designated. Map your AI systems against the prohibited practices in Article 5 and the high-risk categories in Annex III. Run a privacy review with Verdaio's GDPR Quick Check and an AI Act classification check with Verdaio's EU AI Act Assessment.

If you store user credentials or run any service that holds account passwords: Plain-text password storage and weak hashing remain among the clearest security failures a regulator can find. Hash passwords with a modern, salted algorithm, never keep them in readable form, and delete credentials for systems and accounts you no longer use, in line with the storage-limitation principle. If you handle personal data breaches: Notifying the supervisory authority within 72 hours under Article 33 is only half of the obligation. Where a breach poses a high risk to individuals, Article 34 requires you to inform those individuals without undue delay, and commercial or reputational concerns do not pause that clock. Map your breach-response plan and security controls with Verdaio's GDPR Quick Check.

If you build, deploy or distribute AI systems and are unsure whether they count as high-risk: These draft guidelines are the most detailed official steer yet on where the high-risk line sits. Map your AI systems against the Annex I product-safety route and the eight Annex III areas, and use the practical examples to test borderline cases such as HR, credit-scoring and biometric tools. If a specific use case is unclear, submit feedback to the consultation before 23 June 2026. Classification is the first step in every AI Act compliance programme: a system classified as high-risk triggers risk management, data governance, logging, transparency and human-oversight obligations. Run a classification check with Verdaio's EU AI Act Assessment.

If you build, deploy or distribute high-risk AI systems or general-purpose AI: The new deadlines (2 December 2027 for Annex III, 2 August 2028 for Annex I) are now locked in by Coreper but are not yet law until Parliament adopts at first reading. Until that adoption, the original 2 August 2026 deadline applies. If you build generative AI consumer products: The reduced three-month grace period means watermarking and content-provenance solutions must be in place by 2 December 2026, three months earlier than the originally proposed six-month grace. Audit your tooling against the new "nudification" and CSAM prohibitions before adoption. Run a classification check with Verdaio's EU AI Act Assessment.

If you provide AI systems to schools, universities or vocational training providers, or if you deploy AI in an education or training context: Education ministers are now formally aligned on a human-centred deployment model. Expect Member States to push procurement requirements that include teacher AI-literacy training, transparent evaluation criteria, and bias and misinformation safeguards. The conclusions also reinforce that the Article 4 AI literacy obligation applies to all AI deployers, not just those in high-risk sectors. If you sell AI tools for HR, recruitment, assessment or scoring in an education or training context: Classification as high-risk under Annex III is now coupled with these political conclusions, raising the bar for transparency, human oversight and evaluation. Run a classification check with Verdaio's EU AI Act Assessment and review your training programme with Verdaio's AI Literacy guide.

If you build or deploy generative AI, chatbots, deepfake tools, emotion recognition or biometric categorisation systems: The 2 August 2026 transparency deadline still stands. Plan now for chatbot disclosure, machine-readable watermarking of synthetic outputs, and clear deepfake labelling, and submit feedback before 3 June 2026 if your use case needs clarification. Run a classification check with Verdaio's EU AI Act Assessment.

If you operate a contact centre or any voice-channel customer service handling personal or financial data: Voice-channel social engineering remains a top regulatory concern. Map your caller-authentication procedures against Articles 5(1)(f) and 32(1), train staff on knowledge-based authentication weaknesses and impersonation indicators, and ensure your incident-response process can detect and notify the supervisory authority within the 72-hour window of Article 33. Run a structured posture check with Verdaio's GDPR Quick Check.

If you build, deploy or distribute high-risk AI systems (HR, education, credit scoring, biometrics, AI in regulated products) or general-purpose AI: Plan for a 2 December 2027 (Annex III) or 2 August 2028 (Annex I) deadline, but do not stop compliance work. Formal adoption is still pending and the original 2 August 2026 deadline applies until both co-legislators sign off. The extra time is best used to mature risk management, data governance and human-oversight controls, not to delay them. If you build generative AI consumer products: Audit your tooling against the new "nudification" and CSAM prohibitions before the deal is adopted. Run a classification check with Verdaio's EU AI Act Assessment.

If you are an undertaking in scope of the CSRD (1,000+ employees, €450M+ turnover): Review the draft revised ESRS now, especially the materiality assessment changes and reduced datapoint set, and decide whether to apply the revised standards early for FY 2026 or wait for FY 2027. Submit feedback before 3 June 2026 if you have specific concerns. If you are a smaller company in a CSRD value chain: The voluntary standard plus the value chain cap limits what your large clients can require from you on sustainability data. Run a gap-check with Verdaio's ESRS Gap Analysis.

If you operate or distribute services on a designated gatekeeper platform (App Store, Google Play, Amazon Marketplace, Facebook, Instagram, TikTok, Search, Booking.com): Expect the Commission to accelerate ongoing non-compliance proceedings and to focus on practical effects (real choice, real interoperability) rather than formal box-ticking. Plan for higher fines on repeat or continued non-compliance, and for closer scrutiny of AI-driven search and assistant tools when integrated with gatekeeper services. Track DMA developments and align your distribution, advertising and consent flows accordingly.

If you operate cross-border data transfers (especially to non-adequacy jurisdictions) or rely on Standard Contractual Clauses with supplementary measures: the DPC decision still stands as the EU benchmark on what 'essentially equivalent protection' under Article 46(1) GDPR requires. The stay only freezes enforcement while the Irish courts review the underlying decision; it does not weaken the substantive compliance obligation. Audit your transfer impact assessments, supplementary measures, and onward-access controls. Run a structured check with Verdaio's GDPR Quick Check.

If you operate a hotel, B&B, or short-term rental in Italy (or process Italian guest data from abroad): Audit your check-in workflow now. Stop photographing or storing identity documents after the Alloggiati Web reporting; keep only the transmission receipt. Review your retention policy, train front-desk staff on the new guidance, and ensure your booking and PMS systems do not preserve ID images by default. Run a gap-check with Verdaio's GDPR Quick Check.

If you build, deploy or distribute high-risk AI systems (particularly in HR, education, credit scoring, biometrics, or AI embedded in regulated products): Plan as if the 2 August 2026 deadline will hold. Trilogue uncertainty is not a basis for delaying compliance work. Even if a postponement is later agreed, an early start protects you from a compressed timeline. Run a classification check with Verdaio's EU AI Act Assessment.

If you operate a digital platform, ad-tech product, or any service whose terms condition access on data use: Expect EU competition authorities to assess your data-handling practices through a GDPR lens, and the EDPB to factor competition outcomes into its guidance. Review the alignment of your privacy notices, consent flows and data-portability mechanisms with both frameworks. Run a gap-check with Verdaio's GDPR Quick Check.

If you run email marketing, transactional emails or newsletters targeting Italian recipients: Review every pixel, open-tracker and click-tracker in your ESP or CRM stack, map each to a specific legal basis, and align your consent flows and privacy notices with the Guidelines. Revisit data-minimisation controls (pseudonymous IDs, short retention) and document the exemption you rely on where no consent is collected. Run a gap-check with Verdaio's GDPR Quick Check.

If you run a mobile app that reads device state (installed apps, running processes, device fingerprinting): The Garante's decision sets a clear precedent that mandatory, all-or-nothing authorisations to access device data are disproportionate, even for fraud prevention. Review data minimisation, user-information flows, DPIA coverage, and security/retention controls for your mobile apps. Run a gap-check with Verdaio's GDPR Quick Check.

If you process personal data for research: Start mapping your activities against the six indicative factors and review how you document consent, safeguards and the limits on data subject rights. If you transfer personal data outside the EU/EEA: Certification is now a practical alternative to Standard Contractual Clauses and BCRs, useful where providers are reluctant to sign SCCs, or where the destination jurisdiction creates uncertainty. Review your GDPR posture and see whether certification-based transfers fit your vendor stack.

If you deploy biometric systems (facial recognition, fingerprint) for access, authentication, or customer experience: Biometric processing in public or semi-public spaces must satisfy strict necessity, encryption, and retention standards, even with consent. Review the Article 9 GDPR legal basis, technical safeguards, and whether you offer a real non-biometric alternative. Biometric systems may also trigger EU AI Act obligations. Check your posture with Verdaio's GDPR Quick Check and EU AI Act Assessment.

If you conduct DPIAs: This is the first time the EU has offered a single, consistent DPIA format that will be recognised across Member States. Multinational controllers benefit most, one template, one structure, accepted by every DPA. Action: Review your current DPIA methodology against the draft template, submit feedback before 9 June if relevant, and plan to migrate existing DPIAs once national DPAs formally adopt it. Run a gap-check with Verdaio's GDPR Quick Check.

If you operate in any of the 18 NIS2 sectors: The compliance deadline is now less than 6 months away. Start with a gap assessment to understand your current posture, particularly around incident reporting (72-hour notification requirement), supply chain risk management, and board-level accountability. Not sure if NIS2 applies to you? Run the free NIS2 Readiness Assessment.

If you have under 1,000 employees: You are likely out of mandatory scope under the new threshold. However, large customers and financial institutions may still require CSRD-aligned disclosures through their own value chain reporting. If you have 1,000+ employees: Mandatory reporting continues, the core ESRS standards remain unchanged. Use the delay to strengthen your data collection processes.

If you deploy high-risk AI: The extension is very likely to pass, but it is not yet law. The responsible approach is to prepare for the August 2026 deadline while expecting the relief. If adopted as expected, you will have until December 2027 for Annex III systems. Use the time to build compliant processes rather than waiting. We will update this story when the final text is published.

If you report under ESRS: Even though the Omnibus reduces mandatory scope, the financial sector, your banks, investors, and insurers, still expects comprehensive sustainability data. Companies that only meet the minimum simplified requirements may face challenges accessing green finance or satisfying due diligence requests from larger clients.

If you're already reporting: Review which activities fall below the 10% threshold, you may be able to exclude a significant portion of your current assessment scope. If you haven't started: This simplification makes first-time Taxonomy reporting considerably more manageable. The threshold applies for reporting periods from 2025 onwards.

Immediate action required: If your organisation uses or deploys AI systems, review them against the Article 5 prohibited practices list now. Violations can result in fines of up to €35M or 7% of global annual turnover. Most business AI tools (productivity, analytics, customer service) are not prohibited, but AI used in recruitment, credit scoring, or affecting individuals in sensitive contexts requires careful review.

If you use gatekeeper platforms: These decisions signal that app stores, search rankings, and advertising systems on major platforms may change to comply with DMA requirements, potentially affecting your distribution and marketing strategies. If you are a gatekeeper platform: The DMA is now actively enforced. Non-compliance carries substantial financial risk.

For any company that transfers personal data outside the EU/EEA: This fine reinforces that transfer mechanisms must be watertight. Standard Contractual Clauses (SCCs) are not sufficient if the destination country's laws prevent the data importer from complying with them in practice. Review your data transfer impact assessments (DTIAs), particularly for transfers to the US, India, and China. Consider data localisation where technically feasible.