EU Regulatory News

If your company offers electronic communications, hosting, messaging, email, VoIP, domain-name registration, or IP-address services to users in the EU: The e-Evidence Regulation now applies. If your company was operating before 18 February 2026, your EU-designated contact point should already be in place as of 18 August 2026. If you have not yet designated a contact point, do so immediately and notify the competent national authority. Establish internal procedures for receiving, logging, and responding to EPOs and EPPOs, including the standard 10-day and emergency 8-hour execution deadlines. For content data orders: Build a legal review step into your response workflow - content data EPOs require judicial certification from the issuing state, and you may challenge orders that conflict with GDPR obligations or are otherwise unlawful. For data minimisation and retention: Review your GDPR data minimisation and retention policies in light of the obligation to disclose data on receipt of a valid EPO: data you do not hold cannot be disclosed. Assess your GDPR obligations with Verdaio\'s GDPR Quick Check.

If you make or commission unsolicited commercial telephone calls to consumers in France: From 11 August 2026, prior express consent is required before each call. The Bloctel opt-out register no longer provides a compliance basis for B2C telephone prospecting in France. Audit your French consumer telephone marketing lists and confirm that each contact entry is backed by documented prior opt-in consent. Calls made without consent carry fines of up to EUR 375,000 per call (companies) under Article L242-11 of the Consumer Code. Purge contacts for which you cannot demonstrate prior consent and implement a consent-at-collection flow for any new French consumer data. If you collect French consumer personal data (including telephone numbers) for marketing purposes: The new telephone marketing consent requirement reinforces the GDPR Article 7 consent standard. Review your consent collection flows to confirm they produce freely given, specific, informed and unambiguous consent that covers telephone contact, are documented in your records of processing activities (Article 30 GDPR), and can be withdrawn by the consumer at any time. Bundled or implied consent does not satisfy either the Consumer Code or GDPR requirements. If you supply CRM, marketing automation, or lead generation services to companies operating in France: Your clients' compliance with the French telephone marketing consent regime depends on the data quality and consent documentation your service provides. Ensure your platform captures and stores the consent basis for each contact, flags contacts without telephone marketing consent, and provides an easy mechanism for clients to filter French consumer contacts to those with documented prior consent. Assess your GDPR consent management posture with Verdaio's GDPR Quick Check.

If your organisation operates in the Netherlands in a sector covered by NIS2 (energy, transport, water, banking, financial market infrastructure, healthcare, digital infrastructure, public administration, postal services, waste management, chemicals, food, manufacturing, or digital providers): The Cyberbeveiligingswet entered into force on 15 August 2026. If you are an essential or important entity under NIS2, you now have immediate obligations: implement risk-based security measures covering risk management, supply chain security, access control, encryption, and incident handling; register with the NCSC within the period specified in the implementing regulations; and ensure incident reporting workflows are in place (24-hour early warning, 72-hour full notification to the NCSC for significant incidents). If you have not yet implemented NIS2-aligned procedures, you are in breach from 15 August 2026. If you are a member of the management body of a Dutch organisation in scope of the Cyberbeveiligingswet: The Dutch NIS2 transposition imposes personal responsibility on individual board members for cybersecurity governance. Ensure your organisation has board-level approval of its cybersecurity risk management measures and that cybersecurity is a standing agenda item at board level. The NCSC may require you to complete NIS2 compliance training if the organisation is found to be non-compliant. If you supply ICT products, services, or managed services to Dutch essential or important entities: Supply chain security is a core NIS2 obligation. Your Dutch customers must assess and manage supplier cybersecurity risk. Expect contractual cybersecurity requirements, supplier security questionnaires, and incident notification obligations in your agreements with Dutch NIS2-subject entities. Prepare your supplier security documentation now. Assess your NIS2 obligations with Verdaio's NIS2 Readiness Assessment.

If you manufacture or supply any of the 17 product categories covered by these ETSI draft ENs (password managers, anti-virus or anti-malware software, VPNs for individual users, home gateways or routers, smart home assistants, connected toys, wearable health devices, IP cameras or video doorbells, smart meters, connected door locks, alarm systems with network connectivity, network monitoring software, industrial IoT devices, remote access software, general-purpose operating systems, microprocessors or microcontrollers, or hypervisors): These draft European Standards, once adopted and OJ-referenced, will allow you to claim CRA presumption of conformity for the essential cybersecurity requirements they cover. Monitor the public enquiry process (mid-September through mid-November 2026) and consider submitting formal comments to shape the final standard for your product category. Begin evaluating whether your product security design aligns with the draft requirements now, to minimise the gap-closing work before December 2027. If you are preparing your CRA conformity assessment approach for products not covered by these 17 draft ENs: The CRA allows conformity assessment via other routes where no harmonised standard applies, including use of European cybersecurity certificates or third-party conformity assessment for Class I and II products. Track the CRA harmonised standards publication programme through ETSI and the Official Journal, as further standards covering additional product categories are expected. If you are a procurement or legal team sourcing digital products: Once harmonised standards are OJ-referenced, require suppliers to reference conformity with the relevant EN in their declarations of conformity. Until then, request that suppliers describe their intended CRA conformity assessment approach and timeline. Assess your CRA and NIS2 obligations with Verdaio's NIS2 Readiness Assessment.

If you produce, commission, or distribute AI-generated video or audio content depicting a real person's image, likeness, or voice in an EU-facing editorial, entertainment, or advertising context: The Garante's decision confirms that GDPR Articles 5 and 25 apply to the production and broadcast of AI-generated deepfake content and require disclosure to be clear, evident and comprehensible not only to attentive programme viewers but also to inattentive audiences and to viewers who encounter the content as a standalone clip on social media. Review your AI content production and distribution workflow and verify that all distribution channels carry disclosures that meet this comprehensibility standard, not only the original broadcast. If you use AI generation tools to create content depicting real identifiable people and distribute that content through digital channels: From 2 August 2026, EU AI Act Article 50 also requires machine-readable markings on AI-generated content and visible human-readable labels on deepfake video or audio depicting real people. Your compliance obligation now spans both GDPR Article 5 transparency and AI Act Article 50 disclosure. A disclaimer that is technically present in a broadcast setting but imperceptible on a social media clip does not satisfy either requirement. Review each distribution channel and ensure that compliant disclosures are embedded at the clip level, not only at the programme level. If you develop or supply AI tools that generate synthetic video or audio of real people: Article 25 of the GDPR requires data protection by design and by default. The Garante found that the absence of adequate built-in disclosure mechanisms constituted an Article 25 violation at the tool or production-process level. Assess whether your system provides controls that enable users to embed disclosure markers meeting the comprehensibility standard required by the Garante, alongside the machine-readable marking requirements of EU AI Act Article 50. Assess your data protection and AI obligations with Verdaio's GDPR Quick Check and AI Act Readiness Check.

If you develop, supply, or integrate biometric identification systems, facial recognition technology, or video-surveillance solutions for law enforcement, venue security, or access control in the EU: The Garante's opinion confirms that EU AI Act Article 5 imposes narrow, non-extensible exceptions for real-time remote biometric identification in public spaces. Any system that collects and retains biometric data from the general population present in a defined location - even for a short period and even for investigative purposes - is likely to fall outside the Article 5(1)(h) exceptions unless it is targeted at an identified suspect, an active specific threat, or a specific past serious offence listed in Annex II. Review the scope and purpose of your system against each permitted exception before deploying in public or quasi-public spaces in the EU. If you are a public authority, event organiser, or infrastructure operator planning to deploy facial recognition or biometric surveillance at stadiums, public spaces, or transportation hubs in the EU: The Garante's position indicates that preemptive collection and retention of biometric data from individuals present at a location - even framed as a public security measure - does not satisfy the specific, substantial, and imminent conditions of the Article 5(1)(h) exceptions. Obtain specialist legal advice before deploying any system with a population-wide data collection function, rather than a targeted identification function. Assess your EU AI Act obligations with Verdaio's AI Act Readiness Check.

If you send marketing or promotional emails to individuals who have started but not completed a registration process on your website or app: The Garante's decision confirms that GDPR Article 6(1)(b) (contractual performance) does not provide a valid legal basis for marketing emails to non-confirmed registrants. Sending marketing communications to partially registered users who have not finalised account creation and accepted your terms requires either consent under Article 6(1)(a) or a legitimate interests basis under Article 6(1)(f) with a documented proportionality assessment. Review your registration flow and email marketing triggers to confirm that marketing is only triggered for users with a confirmed, documented legal basis. If you use email addresses collected during incomplete or abandoned registration flows for any purpose other than account completion: Data collected before a registration is confirmed may only be used for the purpose for which it was collected at that stage. Using it for marketing or other secondary purposes requires an independent legal basis. Map your registration-to-communication data flow against GDPR Articles 5 and 6 and document the applicable legal basis at each stage. If your organisation handles data subjects' rights requests including erasure requests: The Garante found failures in responding to erasure requests within the one-month deadline of GDPR Article 12. Review your rights-handling process to ensure all incoming requests are routed to a responsible team and that response timelines are tracked and met. Assess your data protection obligations with Verdaio's GDPR Quick Check.

If you place AI systems on the German market or use AI systems in business operations in Germany: The Bundesnetzagentur is now your primary EU AI Act regulatory contact in Germany. It has authority to request information, conduct audits, order corrective measures, and refer infringements for enforcement. Identify which of your AI systems fall under the EU AI Act (Article 5 prohibitions, Annex III high-risk categories, or Article 50 transparency obligations), map them to the Bundesnetzagentur's scope or the sector-specific allocations to BaFin, and ensure you have a contact designation in place for regulatory correspondence. If you operate AI systems in financial services in Germany (credit assessment, insurance underwriting, algorithmic trading, or other regulated financial use cases): BaFin is your designated AI Act supervisory authority for those systems. BaFin has authority over both the AI Act Article 5 prohibitions and Annex III high-risk obligations for financial-sector AI applications, with administrative fines up to EUR 40 million. Ensure your AI system documentation (technical file, conformity assessment, EU database registration) reflects BaFin as the relevant national competent authority. If your AI systems process personal data and fall within both the EU AI Act and GDPR: The BfDI and Lander DPAs retain GDPR supervisory competence for the data processing dimension, including data protection impact assessments under GDPR Article 35 for high-risk processing involving AI. Coordinate your GDPR and AI Act compliance documentation to avoid conflicting assessments across two supervisory regimes. Assess your EU AI Act obligations with Verdaio's AI Act Readiness Check.

If you deploy AI chatbots, virtual assistants, or other AI systems that interact directly with users (customers, employees, or the public): Article 50 transparency obligations are now enforceable. Ensure that every interaction session with a conversational AI system includes a clear, timely, and intelligible disclosure that the user is communicating with an AI, not a human. A brief system prompt disclosure or persistent UI indicator is the minimum; the disclosure must be given before or at the start of the interaction, not buried in terms and conditions. If you generate, publish, or distribute audio, video, image, or text content using AI generation tools: AI-generated content must now carry machine-readable markings identifying it as AI-generated. Verify that your content pipeline includes machine-readable watermarking or metadata tagging for all synthetic outputs. For deepfake video or audio depicting real identifiable individuals, an additional visible human-readable disclosure is required. If you develop, fine-tune, or deploy GPAI models (large language models, multimodal foundation models) placed on the EU market: The AI Office's supervisory powers are now active. Ensure your Article 53 technical documentation and copyright policy are in order. If your model was on the market before 2 August 2026, the transitional period for machine-readable marking compliance runs until 2 December 2026. If your model exceeds the systemic-risk compute threshold, ensure adversarial testing results and incident reporting channels are in place. If you integrate third-party GPAI models into your products or services: Review the model provider's AI Act compliance documentation. As a deployer, your Article 50 disclosure obligations apply regardless of whether the underlying model was developed in-house or sourced externally. Assess your AI Act obligations with Verdaio's AI Act Readiness Check.

If you conduct or plan to conduct internal investigations that involve accessing employee email accounts, messaging systems, or other communications platforms: The Piaggio decision confirms that access to employee email is a processing activity subject to full GDPR compliance, including a valid legal basis under Article 6, data minimisation under Article 5(1)(c), and storage limitation under Article 5(1)(e). Define the scope of any email access in advance, limit the review to communications strictly necessary for the specific investigation, and document a proportionality assessment before any access is carried out. If you implement email backup or retention policies covering all employee communications for extended periods: The Garante's decision indicates that retaining email backups for the full employment period and five years post-termination, without scope limitations or controlled access mechanisms, may not be compatible with GDPR data minimisation and storage limitation principles. Review your email retention policy and ensure it is aligned with GDPR Article 5 and supported by a legitimate purpose with proportionate retention periods. If employees have previously been informed about potential access to their communications under a general acceptable use or IT policy: The Garante found that generic IT policies do not satisfy GDPR Articles 13 and 14 information obligations for investigation-specific email access. Review whether your employee privacy notices explicitly cover the circumstances under which email may be accessed as part of an internal investigation. Assess your data protection obligations with Verdaio's GDPR Quick Check.

If you use B2B data intelligence or contact enrichment platforms that source professional contact data from third parties, data brokers, or web scraping to identify or contact EU-based professionals: The Garante's decision confirms that the controller using such a platform shares responsibility for the lawfulness of the underlying data collection. Review whether your data enrichment provider can demonstrate a valid GDPR legal basis for the data they supply, compliant information notices to data subjects, and accessible rights channels. If the provider cannot demonstrate GDPR compliance, you face controller liability for using unlawfully processed data. If you are a B2B data broker, contact enrichment provider, or marketing data reseller that processes professional contact data of EU residents without an EU establishment: The Garante's decision confirms that GDPR Article 3(2)(b) applies to your processing if you maintain, update, and enrich profiles of EU individuals over time. Appoint an EU representative under GDPR Article 27, ensure a valid legal basis for each processing purpose, and implement Article 13/14 information notices accessible to data subjects whose data you hold. If you conduct outbound marketing or sales prospecting using purchased or enriched B2B contact lists targeting EU residents: Verify that the contact data was collected with a legal basis covering the specific marketing purpose for which you are using it. The Garante's decision reinforces that legitimate interests does not provide an open-ended right to use personal data for commercial prospecting directed at EU individuals. Assess your data protection obligations with Verdaio's GDPR Quick Check.

If you manufacture or supply products with digital elements placed or to be placed on the EU market (hardware with embedded software, connected consumer products, enterprise software, IoT devices, or industrial control systems): Article 14 reporting obligations for actively exploited vulnerabilities and CRA-related security incidents apply from 11 September 2026. Read Commission Notice C(2026) 5252 to verify your product is in scope and to understand the two-stage reporting process: 24-hour early warning to ENISA and 72-hour full notification. The guidance 67 practical examples cover the most common product categories. If you are uncertain whether your product meets the CRA scope definition or whether a planned update constitutes a substantial modification: The guidance provides a structured scope test and a substantial modification test with worked examples. Apply both before the September 2026 deadline to confirm your reporting obligations and avoid inadvertently triggering a new conformity assessment requirement. If you are an SME manufacturer with limited compliance resources: The guidance dedicated SME section provides a prioritised checklist for reaching Article 14 reporting readiness by 11 September 2026. Use it alongside the free ENISA CRA SME Maturity Assessment Model (published 13 July 2026) to identify and close your highest-priority gaps before the reporting deadline. If you are a procurement or legal team at an organisation sourcing digital products from manufacturers: CRA Article 14 reporting obligations sit with the manufacturer, not the customer. Verify that your key digital product suppliers have a documented Article 14 reporting process in place. Assess your CRA and NIS2 obligations with Verdaio's NIS2 Readiness Assessment.

If you transfer personal data from the EU to recipients in South Korea (including HR data, customer data, supplier data, or intra-group transfers to Korean affiliates): The Commission's positive outcome of the first periodic review means the 2021 adequacy decision remains in force. Your transfers under the adequacy decision remain lawful without supplementary measures. No action is required. Update your data transfer records and ROPA to note that the adequacy basis was reviewed in July 2026 and confirmed. If you had implemented standard contractual clauses or binding corporate rules as a precaution alongside the adequacy decision: These supplementary measures are not required for transfers covered by the adequacy decision. You may remove or archive them from your transfer documentation for EU-to-South Korea transfers, though retaining them as a risk mitigation layer for transfers beyond the adequacy decision's scope (for example, to entities not subject to PIPA) remains best practice. If you rely on other EU adequacy decisions for international data transfers (UK, Japan, Switzerland, US Data Privacy Framework, Argentina, Israel, or New Zealand): The Commission's completion of the South Korea review signals that the Article 45(3)(b) periodic review programme is now operationally active. Other adequacy decisions are expected to enter review by 2027. Monitor Commission announcements and be prepared to demonstrate continued lawfulness of your transfer arrangements. Map your international data transfer obligations with Verdaio's GDPR Quick Check.

If you are the EU subsidiary or branch of a non-EU group with net EU turnover above EUR 150 million: Verify whether your non-EU parent group crosses the Article 40a threshold (EUR 150 million EU net turnover in each of the last two consecutive financial years, plus an EU subsidiary or branch with net EU turnover above EUR 40 million). If in scope, the group must prepare CSRD-equivalent sustainability reports under ESRS-40a from the financial year starting 1 January 2028. The EFRAG consultation closes 31 October 2026: engage your group's sustainability or legal team to review the Exposure Draft and consider submitting a response. If you are a non-EU group assessing your EU regulatory footprint: Article 40a does not require your EU subsidiary to report separately; the reporting obligation sits at the non-EU parent group level on a consolidated basis. Your group's double materiality assessment and ESRS-40a reports will be filed in the EU register. Begin your gap analysis against the draft ESRS-40a standards now to scope the data collection and governance changes needed before 2028. Map your CSRD obligations and run your double materiality assessment with Verdaio's CSRD Readiness Assessment.

If you develop or deploy standalone high-risk AI systems in Annex III categories (biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, or justice): The compliance deadline for your system has been extended from 2 August 2026 to 2 December 2027 by Regulation (EU) 2026/1744. You are no longer required to be fully compliant by 2 August 2026, but your conformity assessment work, risk management documentation, technical file, and EU database registration must be completed before 2 December 2027. Do not stop your compliance preparations: use the extended timeline to close gaps rather than delay. If you develop or deploy AI-based products subject to Annex I sector legislation (medical devices, machinery, aviation, vehicles): Your compliance deadline has moved from 2 August 2027 to 2 August 2028. Review your current compliance roadmap and adjust your milestones against the new deadline. If you provide or deploy any AI system with Article 50 transparency obligations (interaction disclosure, synthetic content marking, deepfake labelling): Regulation (EU) 2026/1744 does not change the 2 August 2026 application date for Article 50 obligations. These apply on schedule. Review the Commission's guidelines on Article 50 published 20 July 2026 and ensure your implementation is live by 2 August 2026. If you develop AI systems that could generate intimate imagery or any content involving minors: The new prohibition under the revised Article 5 applies from 27 July 2026. Ensure your system includes controls that prevent generation of NCII or CSAM. Assess your EU AI Act obligations with Verdaio's AI Act Quick Check.

If you are a hospital, clinic, or healthcare provider subject to NIS2 as an essential entity: Review the ENISA procurement guidelines against your current supplier contract templates and ICT procurement specifications. The guidelines provide a structured checklist for NIS2 Article 21(2)(d) supply chain security obligations, and adopting them strengthens your compliance documentation ahead of the sector-specific requirements under Commission Implementing Regulation (EU) 2024/2690 that apply from 18 January 2027. If you are an ICT supplier to the healthcare sector: Expect procurement teams at hospital and clinic customers to introduce NIS2-aligned cybersecurity requirements into tender documents and contract terms based on the ENISA guidelines. Review your security documentation, incident response procedures, and software supply chain controls against the guidelines' supplier requirements. If you handle patient data or operate medical devices connected to hospital networks: Supply chain security controls under NIS2 apply to your contractual relationship with the healthcare operator. Assess your NIS2 obligations with Verdaio's NIS2 Quick Check.

If you provide or deploy any AI system that generates synthetic content, interacts with users, recognises emotions, or categorises users biometrically: Article 50 transparency obligations apply from 2 August 2026. Review the Commission's guidelines against each Article 50 category relevant to your system: interaction disclosure (Article 50(1)), machine-readable synthetic content marking (Article 50(2)), deepfake and manipulated media labelling (Article 50(4)), and emotion recognition or biometric categorisation notice (Article 50(3)). If you signed the Code of Practice on Transparency of AI-Generated Content by 22 July 2026, you benefit from a presumption of conformity with Articles 50(2), (4), and (5); demonstrate independent Article 50 compliance through technical documentation if you did not sign. If you provide a GPAI model whose outputs are used by downstream providers or deployers: Article 50(5) requires you to equip downstream operators with the information needed to comply with their own transparency obligations; review your API documentation and model cards against the guidelines' Article 50(5) requirements. If your AI system was already on the market before 2 August 2026: The legacy system grace period to 2 December 2026 applies for Articles 50(2) and (4) marking and labelling obligations under the AI Omnibus agreement; Article 50(1) and (3) obligations still apply from 2 August 2026. Assess your EU AI Act obligations with Verdaio's AI Act Quick Check.

If you operate in a sector where employees have access to customer data management systems (telecommunications, financial services, retail, healthcare, utilities): The Garante's WINDTRE decision identifies social engineering and IT support impersonation as a GDPR Article 32 risk that operators are expected to mitigate. Audit whether your employee security awareness training covers social engineering scenarios and whether your procedures for granting system access in response to support requests include verification steps that cannot be bypassed by social engineering. If you hold payment data or financial information belonging to customers: The presence of payment data (IBAN, partial card data) among the exfiltrated records was an aggravating factor in the Garante's fine calculation. Segment and restrict access to payment data more tightly than general customer data; apply a need-to-know principle and minimise which employees or systems can access IBAN and card data stores. If you are a DPO, security lead, or compliance officer preparing a GDPR security assessment under Article 32: The Garante held that an operator's internal security audits must be capable of identifying social engineering vulnerabilities. Document your threat modelling process to show that social engineering is treated as a foreseeable attack vector, and record the controls implemented in response. Map your GDPR security obligations with Verdaio's GDPR Quick Check.

If you are subject to supervisory investigations, audits, or information requests under the AI Act, DMA, DORA, NIS2, or AML Regulation, and also process personal data subject to GDPR: The EDPB statement signals that once a legal basis for cross-regulatory information sharing is in place, findings from one regulatory investigation may be shared with data protection supervisory authorities, and vice versa. Maintain consistent, accurate, and complete records across all regulatory filings, as inconsistencies between regulatory submissions and GDPR records will become more visible under coordinated enforcement. If you are an AI system provider or deployer subject to both the EU AI Act and GDPR: AI Act enforcement by national market surveillance authorities and GDPR enforcement by supervisory authorities are already substantively linked, as high-risk AI systems typically involve personal data processing. Expect these enforcement streams to become formally coordinated once cross-regulatory information sharing is authorised in EU law. If you are a financial entity subject to DORA and also process personal data under GDPR: DORA incident reporting and digital resilience testing obligations generate operational data that may intersect with GDPR. Align your DORA and GDPR compliance frameworks now to avoid exposure when cross-regulatory sharing is formalised. Map your GDPR obligations with Verdaio's GDPR Quick Check.

If you develop AI services or virtual assistants for Android: From the Android 18 release deadline (no later than 1 August 2027), Google must provide your product access to 11 Android system features on the same terms available to Gemini. Review the Commission's specification decision to identify which Android integration capabilities are now mandated, and plan your technical integration roadmap to leverage these openings. If you operate a search engine or AI chatbot that competes with Google Search in the EU: From January 2027, you may formally request access to anonymised Google Search data under FRAND terms. Begin assessing the technical and commercial requirements of a data access request and evaluate whether the Commission's anonymisation framework satisfies your data quality needs. If you are a large platform or gatekeeper under the DMA: This specification sets a precedent for how the Commission will enforce non-discrimination and interoperability obligations through binding technical measures. Audit your existing interoperability commitments under your DMA designation against this standard before the Commission issues similar specifications to you. Assess your digital platform obligations with Verdaio's GDPR Quick Check.

If you operate a video, content, or social platform that runs a revenue-sharing, partner, or creator programme: This judgment indicates that screening or reviewing creator channel content, themes, or past videos as part of a commercial partnership admission process may eliminate your hosting liability exemption for content posted on those channels. Review your partner programme admission criteria and procedures, and assess whether your screening practices constitute prior editorial review under the CJEU's standard. If you are a brand, advertiser, or network that uses influencer or partner channels on video platforms to reach audiences: The judgment creates new pressure on platforms to regulate partner channel content more closely. Monitor whether platforms update their partner programme terms and content policies in response to this ruling, as those changes will affect creator contracts and content permissions. If you provide legal or compliance counsel to platform operators: The CJEU's passive/active host distinction under the e-Commerce Directive now applies with additional clarity to commercial screening practices. Map each of your client's commercial programme admission procedures against the CJEU's test and advise on whether liability exemptions are preserved. Assess your platform compliance obligations with Verdaio's GDPR Quick Check.

If you are an AI developer or researcher building or planning to build large AI models in the EU: The report's call for legal certainty on training data is directly relevant to your planning. The AI Office has signalled it is aware of the GDPR-copyright intersection problem for AI training and intends to address it through guidance or legislation. Monitor AI Office and EDPB outputs on training data guidance, and document your current training data provenance and legal basis now to be in a strong position when guidance or legislative clarification arrives. If you are a general-purpose AI model developer potentially in scope of the EU AI Act's GPAI provisions: The AI Office's frontier AI expert findings will shape the final Code of Practice for GPAI models, which is the primary compliance mechanism for GPAI providers under the AI Act. The emphasis on transparency obligations and training data documentation signals that these will be heavily weighted in the Code. If you are a business deploying or integrating AI models for EU-facing applications: The report indicates that EU frontier AI policy is entering a high-priority phase. Regulatory posture toward GPAI models and high-capability AI systems is expected to tighten as the AI Act's GPAI provisions come into full effect. Map your AI system obligations with Verdaio's AI Act Quick Check.

If you operate a very large online platform or search engine designated under the DSA: The Commission's acceptance of X's corrective action plan signals how it will evaluate platform remediation proposals. Deceptive interface design (dark patterns under DSA Article 25), incomplete ad repository compliance (Article 39), and researcher access failures (Article 40) are active enforcement targets. Review your platform's interface design, ad repository completeness, and researcher data access programme against these requirements before an investigation is opened against you. If you are a researcher seeking data access from very large online platforms under DSA Article 40: X's accepted action plan includes commitments to provide a free public data access tier and transparent application criteria. This sets a benchmark that researchers can cite when requesting data access from other DSA-designated platforms. If you are a brand, agency, or compliance team assessing ad transparency obligations: The Commission's enforcement of the ad repository requirement under DSA Article 39 confirms it is actively monitored. Verify that all platforms on which you place advertising maintain a DSA-compliant ad repository and keep records of your own ad placements and targeting parameters. Assess your digital platform compliance with Verdaio's GDPR Quick Check.

If you operate a sports anti-doping organisation, sports federation, or national governing body that publishes sanction information involving athletes' names: This judgment requires you to implement an individual proportionality assessment before each publication of an athlete's name and violation details. Blanket automatic publication policies are not compatible with GDPR as interpreted by the CJEU. Review your sanctions publication procedures and introduce documented individual assessments. Also implement a sunset mechanism: remove or anonymise published entries when the sanction period expires. If you operate any public register, disciplinary registry, or transparency publication that discloses personal data on the basis of public interest or legitimate interests: The CJEU's proportionality analysis applies beyond the anti-doping context. Any blanket disclosure policy that does not include an individual interests-balancing step is at risk of GDPR challenge. Review your disclosure framework against the CJEU's two-condition standard: individual assessment before publication, and removal on expiry of the relevant period. If you are a data protection officer at a public body, regulator, or membership organisation that publishes enforcement or disciplinary outcomes: This ruling adds to the body of CJEU authority on when public transparency interests can override individual data protection rights. Audit your existing publications and introduce case-by-case review where it is currently absent. Map your GDPR obligations with Verdaio's GDPR Quick Check.

If you manufacture or supply products with digital elements placed or to be placed on the EU market (including software, IoT devices, connected consumer goods, or industrial control systems): CRA Article 14 reporting obligations for actively exploited vulnerabilities and CRA-related incidents apply from 11 September 2026. Use the free ENISA SME Maturity Assessment Model to benchmark your current practices against CRA requirements and identify gaps before that date. The tool provides a structured questionnaire, five maturity levels per pillar, and prioritised remediation guidance. If you are an SME with limited internal cybersecurity expertise: The ENISA tool is designed for your context. Complete the self-assessment across all four pillars (security design, vulnerability management, incident response, and documentation) before the September 2026 reporting deadline to identify your highest-priority gaps. If you are a larger enterprise sourcing hardware or software components from SME manufacturers: CRA Article 13 supply chain security obligations require you to assess and manage the security practices of your digital product suppliers. Share the ENISA tool with SME suppliers as a common reference framework for assessing their CRA readiness before the December 2027 full compliance date. Assess your CRA and NIS2 obligations with Verdaio's NIS2 Readiness Assessment.

If you operate a website or digital service with a cookie consent banner targeting EU visitors: EDPB Binding Decision 1/2026 signals active enforcement against cookie banner practices across the EU. The decision requires the Belgian DPA to examine VRT's banner substantively for GDPR compliance, including whether consent is freely given, specific, informed, and unambiguous under Article 7, and whether processing relies on a valid legal basis under Article 6(1). Audit your cookie banner against these standards: reject-all options must be presented with the same prominence as accept-all; pre-ticked boxes and consent by scrolling are invalid; and consent must be as easy to withdraw as to give (Article 7(3) GDPR). If you use consent management platforms (CMPs) for cookie consent: Verify that your CMP configuration results in valid consent under GDPR Article 7. The EDPB's Cookie Guidelines (Guidelines 05/2020) and national DPA guidance from CNIL, AEPD, and others set the baseline; ensure your banner does not use dark patterns, false equivalence, or misleading UI that undermines the validity of consent. If you have received a GDPR complaint that a supervisory authority dismissed without substantive examination: Binding Decision 1/2026 establishes that such dismissals are subject to EDPB review under Article 60(3). If you are a complainant, the decision confirms you can object to procedural dismissals; if you are a controller, a previously dismissed complaint may be re-examined on the merits. Map your GDPR cookie consent obligations with Verdaio's GDPR Quick Check.

If you operate in Ireland, Spain, France, or the Netherlands in a sector covered by NIS2 (energy, transport, water, healthcare, digital infrastructure, banking, financial market infrastructure, public administration, or space): The CJEU referral signals that national NIS2 transposition legislation is imminent in all four states. Monitor your national competent authority for the publication of implementing regulations; once transposed, you will be subject to the Article 21 security measures and Article 23 incident reporting obligations with minimal notice. Begin gap analysis against the NIS2 requirements now so you are ready to comply as soon as national law is in place. If you operate in other EU member states that have completed NIS2 transposition: The referral does not affect existing national obligations. However, if you have supply chain relationships with entities in the four referred states, note that those entities may not yet be subject to equivalent national NIS2 cybersecurity requirements, which may affect your own supply chain risk assessments under Article 21(2)(d) NIS2. If you provide digital infrastructure services, managed security services, or cloud services to entities in Ireland, Spain, France, or the Netherlands: Anticipate incoming NIS2 contractual requirements from customers in those states as national transposition advances and entities begin conforming their supplier contracts to NIS2 requirements. Map your NIS2 obligations with Verdaio's NIS2 Readiness Assessment.

If you provide or deploy AI systems that generate or manipulate synthetic audio, image, video, or text content (chatbots, image or video generation tools, voice synthesis, AI writing assistants): Article 50 transparency obligations under the EU AI Act apply from 2 August 2026. This deadline is not extended by the Digital Omnibus deal; the extension to December 2027 applies only to Annex III high-risk obligations. If your system falls within Article 50(2), (4), or (5) scope, you must implement machine-readable marking or disclosure by 2 August 2026. Assess whether to sign the Transparency Code before 22 July 2026 at 18:00 CET: signing creates a presumption of conformity and reduces enforcement risk. If you are a provider of a GPAI model (including models integrated into third-party products or services): Article 50(5) applies to your model's generated output. Assess whether the Code covers your output types and whether signing before the 22 July 2026 deadline is feasible. If you are within Article 50 scope but do not sign the Code: You must independently demonstrate Article 50 compliance through technical documentation and disclosure practices; the AI Office has indicated non-signatories within scope may receive information requests after 2 August 2026. Assess your AI Act obligations with Verdaio's EU AI Act Assessment.

If you operate a database, information service, or business intelligence platform that provides searchable access to personal data derived from court records, criminal proceedings, administrative decisions, or public registers: The CJEU's judgment in C-199/24 rules out the GDPR Article 85(2) journalism exemption for commercial database operators. Audit whether your legal basis for processing personal data from public sources is adequate under GDPR Article 6 independent of any journalism exemption claim, and ensure your processes for handling Article 17 erasure requests are operational and compliant with the ruling. If you process personal data derived from criminal proceedings, sanctions, or enforcement decisions as part of a commercial product or service: Article 10 of the GDPR (processing relating to criminal convictions and offences) imposes additional restrictions. Criminal conviction data can only be processed under the control of official authority or when authorised by member state law; the commercial database model in C-199/24 is likely to face additional Article 10 scrutiny following this judgment. If you rely on the Article 85 journalism exemption to resist data subject rights requests in any processing context: The CJEU in C-199/24 confirms the exemption applies only where processing is strictly necessary to reconcile data protection with freedom of expression and information, and the primary purpose is genuinely journalistic, academic, artistic, or literary. Review whether your claimed exemption meets this strict necessity standard. Map your GDPR obligations with Verdaio's GDPR Quick Check.

If you operate a consumer-facing AI platform, chatbot, or similar digital service accessible to minors across EU member states: The Garante's Character.AI decision establishes a GDPR compliance benchmark for age-gated AI services. As a minimum, implement effective age verification proportionate to the risk to minors, set minor profiles to private by default (Article 25), introduce a cooling-off period preventing banned minor users from immediately re-registering, and complete a DPIA under GDPR Article 35. If you are a non-EU controller processing personal data of EU data subjects on a systematic basis: The Article 27 EU representative requirement was among the five violations in this decision. Appoint an EU representative in writing, designate them as the point of contact for supervisory authorities, and inform data subjects of the representative's identity in your privacy notice. If you process personal data of minors under GDPR: Article 8 (age of consent for information society services) and Article 25 (data protection by design and by default) are increasingly enforced jointly. Review your age verification approach, default settings for minor users, and DPIA documentation against this decision. Use Verdaio's GDPR Quick Check to map your GDPR obligations.

If you train AI models or use web scraping to collect personal data at scale: The EDPB draft guidelines require a documented legal basis under GDPR Article 6 for each web scraping operation. Legitimate interest under Article 6(1)(f) is not automatically available and requires a documented balancing test; special category data under Article 9 requires explicit consent or another qualifying ground. Review your training data sourcing practices against the draft guidelines and consider submitting a consultation response by 30 October 2026. If you rely on anonymisation to take your processing outside GDPR scope: The draft guidelines update the anonymisation threshold in light of CJEU C-413/23 P. Review your anonymisation methodology against the updated standards before the consultation closes on 30 October 2026. If you use blockchain to record or share personal data of EU data subjects: The final blockchain guidelines are now the authoritative EDPB reference. Conduct a DPIA if one is not in place, and implement technical measures, such as off-chain storage, cryptographic deletion, or zero-knowledge proofs, to address the rights to erasure and rectification. Use Verdaio's GDPR Quick Check to map your GDPR obligations.

If you develop, provide or deploy AI systems or use AI tools in your operations and are subject to NIS2 or DORA: The Commission action plan confirms that national supervisory authorities and the AI Office will increasingly assess AI-specific cybersecurity risks as part of both AI Act and NIS2/DORA compliance reviews. Under NIS2 Article 21, your risk management measures must address all relevant threats, including AI-enabled attacks. The plan's secure testing platform (ENISA plus JRC) will be available to critical-sector operators; monitor ENISA for access details as the platform is developed. If you are a provider of GPAI models subject to Chapter V of the AI Act: The EU AI model evaluation capacity pillar signals that third-party evaluation practices will evolve rapidly from 2 August 2026 when AI Office enforcement activates. Align your technical documentation and safety evaluations with the GPAI Code of Practice before that date. If you manufacture connected products subject to the CRA: The plan signals increased Commission and ENISA attention to AI-driven vulnerability discovery and exploitation; ensure your vulnerability management and Article 14 incident reporting processes are operational before the 11 September 2026 CRA reporting deadline. Map your AI Act and NIS2 obligations with Verdaio's EU AI Act Assessment and NIS2 Readiness Assessment.

If you are currently in scope of CSRD (a large public-interest entity, large undertaking, or listed SME under Directive 2013/34/EU as amended by CSRD): The revised ESRS reduce your mandatory disclosure burden by more than 70%. Review whether topics you previously assessed as material remain material under the revised framework, and update your double materiality assessment and reporting templates accordingly. For your first report under the revised ESRS, transition guidance from EFRAG is expected in late 2026. If you are a listed SME or a company that will be in scope under the revised CSRD thresholds: The simplified ESRS set adopted simultaneously provides a proportionate reporting framework; begin your gap analysis against the simplified ESRS requirements now. If you are a large company between 250 and 1,000 employees that expected to enter CSRD scope: Review the revised in-scope thresholds (1,000 employees + turnover/balance sheet criteria) to confirm whether you remain subject to CSRD mandatory reporting from 2028. Map your CSRD obligations and run your double materiality assessment with Verdaio's CSRD Readiness Assessment.

If you process personal data of Italian data subjects, operate an establishment in Italy, or offer goods or services to individuals in Italy: The 2025 Annual Report confirms the Garante is in a phase of significantly expanded enforcement, with sanctions up 54.5% year-on-year and criminal referrals quadrupled. The Garante's 2026 inspection plan targets public-sector databases and new-technology deployments including AI systems; private-sector entities processing personal data with generative AI tools, biometric identification systems, or large-scale data warehouses face elevated inspection risk. If you develop, provide or deploy AI systems that process personal data of Italian users, generate synthetic content, or use biometric data: Review compliance with GDPR Articles 9 (special category data), 5(1)(a)(c)(e) (lawfulness, data minimisation, storage limitation), 13-14 (transparency), and 25 (data protection by design). The Garante's parallel application of GDPR and the EU AI Act prohibition on workplace emotion-inference AI in prior decisions signals that cross-regulatory enforcement is accelerating. Map your GDPR obligations with Verdaio's GDPR Quick Check.

If you are a financial entity subject to EU AML obligations (banks, credit institutions, payment institutions, e-money institutions, asset managers, virtual asset service providers, or other obligated entities under the AML Regulation): Article 75 information sharing becomes available from 10 July 2027. Monitor the EDPB-AMLA guidelines development: a draft is expected for public consultation in the first half of 2027. Begin reviewing your data governance architecture for AML information-sharing use cases now, and identify whether existing DPIAs need updating when the draft guidelines are published. If you are subject to both GDPR and DORA: Cross-entity AML information sharing creates additional ICT third-party risk obligations under DORA Articles 28-44; identify information-sharing counterparties in your DORA Register of Information. Map your GDPR obligations with Verdaio's GDPR Quick Check.

If you develop, provide or deploy AI systems classified as high-risk under Annex III of the EU AI Act (AI systems in critical infrastructure management, education and vocational training, employment and workforce management, access to essential private and public services, law enforcement, migration and border management, or administration of justice): The Annex III compliance deadline is legally confirmed as 2 December 2027 following the Council's formal adoption on 29 June 2026. Use the extension to complete conformity assessments, prepare technical documentation, align with harmonised standards as they are published, and register in the EU database. Do not wait for Official Journal publication to begin: the date is confirmed. If you build or deploy generative AI systems subject to Article 50 transparency obligations: Those obligations apply from 2 August 2026; the technical grace period for compliant watermarking extends to 2 December 2026. If you provide general-purpose AI models: Your Chapter V obligations from August 2025 are unchanged by the Digital Omnibus on AI. Map your EU AI Act obligations with Verdaio's EU AI Act Assessment.

If you operate across multiple EU or EEA member states and face conflicting GDPR guidance from different national supervisory authorities (for example, divergent positions on legitimate interest assessments, cookie consent requirements, or data retention periods): The EDPB consistency form gives you a direct channel to bring those divergences to the Board's attention. Submissions that document systemic inconsistencies may lead the EDPB to issue clarifying guidelines that benefit your compliance programme across all affected jurisdictions. The form does not produce individual rulings, but flagging a well-documented divergence is a practical step when cross-border inconsistency creates real compliance cost. If you submit a report: include specific regulatory references, the national authority positions involved, and the practical impact, to give the EDPB the structured information it needs to assess whether a consistency action is warranted. Map your GDPR obligations with Verdaio's GDPR Quick Check.

If you develop, provide or deploy AI systems classified as high-risk under Annex III of the EU AI Act (AI systems in critical infrastructure management, education and vocational training, employment and workforce management, access to essential private and public services, law enforcement, migration and border management, or administration of justice): Your compliance deadline for the core Annex III obligations (conformity assessment, technical documentation, registration in the EU AI Act database, transparency requirements for deployers, and post-market monitoring) has been extended to 2 December 2027. Use the additional time to complete a structured readiness assessment, align with the published harmonised standards once available, and prepare your technical documentation and conformity assessment process. If you build or deploy generative AI systems or systems covered by Article 50 transparency obligations: The Article 50 obligations still apply from 2 August 2026; the three-month technical grace period extends implementation of compliant watermarking and metadata solutions to 2 December 2026. If you develop or deploy nudifier applications that generate synthetic intimate images of real persons: These are now permanently prohibited under Article 5 of the AI Act. Map your EU AI Act obligations with Verdaio's EU AI Act Assessment.

If you manufacture, develop or place on the EU market hardware or software products with digital elements (IoT devices, routers, firewalls, network equipment, operating systems, security software, industrial control systems, or connected consumer products): The 11 September 2026 Article 14 deadline is now fewer than 90 days away. Complete your ENISA Single Reporting Platform registration during June 2026 while training and dry-run support is available, map your internal vulnerability management and incident response procedures to the 24-hour, 72-hour and 14-day reporting windows, and confirm your main establishment in the EU for CSIRT notification routing. If your product falls within Class II under Annex III of the CRA (firewalls, VPNs, hardware security modules, operating systems, microprocessors, industrial automation systems): Third-party conformity assessment is mandatory. Engage a designated conformity assessment body notified by a Member State under Chapter IV. Check your CRA product classification and prepare your technical documentation with Verdaio's CRA Product Compliance Checker.

If you operate critical infrastructure in the rail or maritime transport sector (port operators, railway infrastructure managers, vessel traffic services, freight logistics platforms, or passenger rail networks) as an essential entity under NIS2: Cyber Europe 2026 confirms that your sector is a priority target in EU-level threat scenario planning. Review your NIS2 Article 21 security measures, confirm your incident reporting readiness under Article 23 (24-hour early warning to your national CSIRT), and verify that your contacts in the national cybersecurity crisis management authority are current. If you provide services to transport-sector critical infrastructure operators as an important entity under NIS2, or supply operational technology (OT), industrial control systems (ICS) or vessel traffic management software to the transport sector: Supply chain security and OT/IT convergence are central to the NIS2 Article 21 risk management requirements. Check your NIS2 obligations and security controls with Verdaio's NIS2 Compliance Assessment.

If you build or deploy generative AI systems (text-to-image, voice synthesis, video generation, chatbots, or deepfake tools) that produce or manipulate audio, image, video or text for EU users: Your Article 50(2) marking obligation applies from 2 August 2026. Implement machine-readable metadata or watermarking in your output pipeline before that date; the Code of Practice sets the technical benchmark against which the EU AI Office and national market surveillance authorities will assess compliance. If you have not yet adopted a compliant technical mechanism, the 2 December 2026 transitional deadline applies to those implementation steps. If you operate a platform that publishes AI-generated or AI-manipulated content on matters of public interest (news, political advertising, public information campaigns): The Article 50(4) deepfake and public-interest text labelling obligation applies from 2 August 2026. Review your editorial workflows and label placement against the Code's Section 2 guidance. If you deploy chatbots or virtual assistants that interact directly with users: The Article 50(1) AI disclosure obligation also applies from 2 August 2026. Map your AI Act transparency obligations with Verdaio's EU AI Act Assessment.

If you act as a data controller operating in one or more EU or EEA Member States: The EDPB common breach notification template will, once finalised and adopted by national supervisory authorities, replace each DPA's current notification form with a single harmonised format. Review your incident response playbook now: your internal notification procedures, SIEM runbooks, and outsourced incident response arrangements should be structured around the Article 33(3) mandatory information elements so they can map cleanly onto the new fields when the template enters into force. If you operate across borders and currently maintain separate notification procedures for different national DPA forms: the common template will simplify cross-border breach response materially once it enters into force. Participate in the public consultation (open until 5 August 2026) if your organisation has practical experience with current breach notification forms. Map your GDPR controls and breach response readiness with Verdaio's GDPR Quick Check.

If you operate accommodation, travel, or vehicle rental services that collect guest or traveller data on behalf of police or regulatory mandates in any EU Member State: This infringement case signals that the Commission treats blanket traveller-data mandates as disproportionate under the LED, regardless of national security justifications. Audit the categories and retention periods of traveller data you are required by national law to collect and transmit, and document the LED legal basis and necessity analysis in your ROPA. If you operate in Spain under Real Decreto 933/2021: Monitor developments closely; if the Commission escalates to a reasoned opinion or Court referral, Spain may be required to amend or repeal the decree, which would alter your compliance obligations. Review your data mapping and subject-rights procedures with Verdaio's GDPR Quick Check.

If you sell cloud services, SaaS, or AI tools to EU public-sector bodies (central government, health, banking, energy, or justice): CADA introduces formal sovereignty risk assessments into public procurement. Prepare to answer questions about parent-company jurisdiction, third-country data access rights, software supply-chain transparency, and data escrow arrangements. Non-EU-owned providers face structural barriers to Levels 3 and 4 procurement tiers. If you build or deploy AI systems hosted on cloud infrastructure: The CADA sovereignty framework may affect your cloud provider options for regulated public-sector workloads once the act enters into force. Map your infrastructure against the four CADA levels and assess whether current provider arrangements would require renegotiation. Both proposals are early-stage and must pass the full EU legislative process. Map your AI Act obligations with Verdaio's EU AI Act Assessment and your CRA exposure with the CRA Product Compliance Checker.

If you provide, deploy, or integrate general-purpose AI models (including large language models, multimodal foundation models, or AI models made available via API) in your products or services: The Scientific Panel now gives the EU AI Office dedicated independent expertise to identify systemic risks in GPAI models, advise on classification, and coordinate cross-border enforcement from 2 August 2026. Review your GPAI model obligations under Articles 53-55 of the AI Act: technical documentation, transparency measures including copyright summaries, cooperation with the AI Office, and systemic risk assessments for high-impact capability models. If your GPAI model was on the market before 2 August 2025, you have until 2 August 2027 to achieve full compliance. If you build or deploy AI systems that use GPAI models as components: your obligations as a deployer depend on whether the downstream use creates a high-risk AI system. Classify your AI system and map your obligations with Verdaio's EU AI Act Assessment.

If you build, deploy or procure AI tools that score employee sentiment, mood, stress or wellbeing from communications data: Review the legal basis for any such product against both Article 9 GDPR (special category data) and the EU AI Act Article 5(1)(f) prohibition on workplace emotion-inference AI. Aggregation, anonymisation labels and "wellbeing" framings will not save a product that infers psychological states from chat or voice data. If you run collaboration suites such as Slack or Microsoft Teams across your workforce: Audit any third-party plug-ins or integrations that perform sentiment, emotion or stress analytics, document the lawful basis and DPIA, and tighten supplier terms before procurement. Map your AI Act exposure with Verdaio's EU AI Act Assessment and your GDPR controls with the GDPR Quick Check.

If you operate a data warehouse, research platform or other large-scale processing that you have characterised as anonymous: The CNIL's decision confirms that the GDPR anonymisation threshold is high and the test is whether re-identification remains reasonably possible. Re-assess your anonymisation methodology against the singling-out, linkability and inference criteria of the Article 29 Working Party opinion (WP216), and avoid relying on labels alone. If you collect personal data through pharmacies, doctors, brokers or other intermediaries: Article 14 GDPR transparency duties stay with the controller. You cannot rely on a third party to hand out a notice; you must verify the information actually reaches data subjects and that an effective right to object is available. Tighten your information notices, logging and access controls with Verdaio's GDPR Quick Check.

If your organisation is registered as an essential or important entity under NIS2: The 2026 NIS360 is the most authoritative public benchmark of where each high-criticality sector stands on cyber maturity, and a signal of where supervisory attention is likely to land first. Compare your governance, risk management, incident response and supply-chain controls against ENISA's four pillars (legislation, company preparedness, authority capacity and ecosystem) and prioritise the gaps that pull your sector's profile down. If you operate in a sector flagged as falling within the risk zone: expect closer scrutiny from your national competent authority during the next supervision cycle and budget for accelerated remediation. Map your NIS2 obligations and identify gaps with Verdaio's NIS2 Readiness Assessment.

If you are an essential or important entity under NIS2 with operations in more than one Member State: Common templates will materially reduce the cost of complying with the Article 23 reporting clock by replacing parallel national forms with a single EU-wide format. Track the implementing act expected from the Commission, then update your internal incident playbooks, SIEM runbooks and outsourcing contracts so your 24-hour, 72-hour and one-month reports map cleanly onto the new fields. If you are a managed service provider or supplier to NIS2 entities: Expect customers to push the harmonised template requirements down through contractual clauses on incident notification and cooperation. Map your NIS2 obligations and tighten your incident response process with Verdaio's NIS2 Readiness Assessment.

If you operate any consumer service that handles personal data and receives data subject access requests under GDPR Article 15: The High Court ruling reinforces that regulators can pursue systemic access-right failures and propose substantial fines, even when an inquiry starts from a single complaint. Audit your end-to-end access-request workflow, ensure all categories of personal data (including data held in internal analytics warehouses, logs, and backend tools) are returned in a complete and intelligible form within the one-month deadline of Article 12, and document any restrictions you rely on under Article 15(4). If you are considering challenging a DPC or other EEA preliminary finding: Procedural arguments about the scope of an inquiry are unlikely to defeat findings on the merits where the regulator has identified systemic issues affecting many users. Map your data subject rights process with Verdaio's GDPR Quick Check.

If you handle personal data of users in France or sell into the French market: The CNIL's 2025 figures show enforcement intensity is rising on cookies, employee monitoring and data security, the three areas it identifies as driving the bulk of last year's fines. Review your cookie banners, monitor your data-breach response times against the Article 33 72-hour deadline, and audit your security controls against the storage-limitation and security principles of GDPR Articles 5 and 32. If you build, deploy or distribute AI systems used in France: The CNIL is positioning itself as one of the most active EU AI Act regulators and is on track to supervise several Annex III high-risk categories (biometrics, migration, law enforcement, employment, education) once formally designated. Map your AI systems against the prohibited practices in Article 5 and the high-risk categories in Annex III. Run a privacy review with Verdaio's GDPR Quick Check and an AI Act classification check with Verdaio's EU AI Act Assessment.

If you store user credentials or run any service that holds account passwords: Plain-text password storage and weak hashing remain among the clearest security failures a regulator can find. Hash passwords with a modern, salted algorithm, never keep them in readable form, and delete credentials for systems and accounts you no longer use, in line with the storage-limitation principle. If you handle personal data breaches: Notifying the supervisory authority within 72 hours under Article 33 is only half of the obligation. Where a breach poses a high risk to individuals, Article 34 requires you to inform those individuals without undue delay, and commercial or reputational concerns do not pause that clock. Map your breach-response plan and security controls with Verdaio's GDPR Quick Check.

If you build, deploy or distribute AI systems and are unsure whether they count as high-risk: These draft guidelines are the most detailed official steer yet on where the high-risk line sits. Map your AI systems against the Annex I product-safety route and the eight Annex III areas, and use the practical examples to test borderline cases such as HR, credit-scoring and biometric tools. If a specific use case is unclear, submit feedback to the consultation before 23 June 2026. Classification is the first step in every AI Act compliance programme: a system classified as high-risk triggers risk management, data governance, logging, transparency and human-oversight obligations. Run a classification check with Verdaio's EU AI Act Assessment.

If you build, deploy or distribute high-risk AI systems or general-purpose AI: The new deadlines (2 December 2027 for Annex III, 2 August 2028 for Annex I) are now locked in by Coreper but are not yet law until Parliament adopts at first reading. Until that adoption, the original 2 August 2026 deadline applies. If you build generative AI consumer products: The reduced three-month grace period means watermarking and content-provenance solutions must be in place by 2 December 2026, three months earlier than the originally proposed six-month grace. Audit your tooling against the new "nudification" and CSAM prohibitions before adoption. Run a classification check with Verdaio's EU AI Act Assessment.

If you provide AI systems to schools, universities or vocational training providers, or if you deploy AI in an education or training context: Education ministers are now formally aligned on a human-centred deployment model. Expect Member States to push procurement requirements that include teacher AI-literacy training, transparent evaluation criteria, and bias and misinformation safeguards. The conclusions also reinforce that the Article 4 AI literacy obligation applies to all AI deployers, not just those in high-risk sectors. If you sell AI tools for HR, recruitment, assessment or scoring in an education or training context: Classification as high-risk under Annex III is now coupled with these political conclusions, raising the bar for transparency, human oversight and evaluation. Run a classification check with Verdaio's EU AI Act Assessment and review your training programme with Verdaio's AI Literacy guide.

If you build or deploy generative AI, chatbots, deepfake tools, emotion recognition or biometric categorisation systems: The 2 August 2026 transparency deadline still stands. Plan now for chatbot disclosure, machine-readable watermarking of synthetic outputs, and clear deepfake labelling, and submit feedback before 3 June 2026 if your use case needs clarification. Run a classification check with Verdaio's EU AI Act Assessment.

If you operate a contact centre or any voice-channel customer service handling personal or financial data: Voice-channel social engineering remains a top regulatory concern. Map your caller-authentication procedures against Articles 5(1)(f) and 32(1), train staff on knowledge-based authentication weaknesses and impersonation indicators, and ensure your incident-response process can detect and notify the supervisory authority within the 72-hour window of Article 33. Run a structured posture check with Verdaio's GDPR Quick Check.

If you build, deploy or distribute high-risk AI systems (HR, education, credit scoring, biometrics, AI in regulated products) or general-purpose AI: Plan for a 2 December 2027 (Annex III) or 2 August 2028 (Annex I) deadline, but do not stop compliance work. Formal adoption is still pending and the original 2 August 2026 deadline applies until both co-legislators sign off. The extra time is best used to mature risk management, data governance and human-oversight controls, not to delay them. If you build generative AI consumer products: Audit your tooling against the new "nudification" and CSAM prohibitions before the deal is adopted. Run a classification check with Verdaio's EU AI Act Assessment.

If you are an undertaking in scope of the CSRD (1,000+ employees, €450M+ turnover): Review the draft revised ESRS now, especially the materiality assessment changes and reduced datapoint set, and decide whether to apply the revised standards early for FY 2026 or wait for FY 2027. Submit feedback before 3 June 2026 if you have specific concerns. If you are a smaller company in a CSRD value chain: The voluntary standard plus the value chain cap limits what your large clients can require from you on sustainability data. Run a gap-check with Verdaio's ESRS Gap Analysis.

If you operate or distribute services on a designated gatekeeper platform (App Store, Google Play, Amazon Marketplace, Facebook, Instagram, TikTok, Search, Booking.com): Expect the Commission to accelerate ongoing non-compliance proceedings and to focus on practical effects (real choice, real interoperability) rather than formal box-ticking. Plan for higher fines on repeat or continued non-compliance, and for closer scrutiny of AI-driven search and assistant tools when integrated with gatekeeper services. Track DMA developments and align your distribution, advertising and consent flows accordingly.

If you operate cross-border data transfers (especially to non-adequacy jurisdictions) or rely on Standard Contractual Clauses with supplementary measures: the DPC decision still stands as the EU benchmark on what 'essentially equivalent protection' under Article 46(1) GDPR requires. The stay only freezes enforcement while the Irish courts review the underlying decision; it does not weaken the substantive compliance obligation. Audit your transfer impact assessments, supplementary measures, and onward-access controls. Run a structured check with Verdaio's GDPR Quick Check.

If you operate a hotel, B&B, or short-term rental in Italy (or process Italian guest data from abroad): Audit your check-in workflow now. Stop photographing or storing identity documents after the Alloggiati Web reporting; keep only the transmission receipt. Review your retention policy, train front-desk staff on the new guidance, and ensure your booking and PMS systems do not preserve ID images by default. Run a gap-check with Verdaio's GDPR Quick Check.

If you build, deploy or distribute high-risk AI systems (particularly in HR, education, credit scoring, biometrics, or AI embedded in regulated products): Plan as if the 2 August 2026 deadline will hold. Trilogue uncertainty is not a basis for delaying compliance work. Even if a postponement is later agreed, an early start protects you from a compressed timeline. Run a classification check with Verdaio's EU AI Act Assessment.

If you operate a digital platform, ad-tech product, or any service whose terms condition access on data use: Expect EU competition authorities to assess your data-handling practices through a GDPR lens, and the EDPB to factor competition outcomes into its guidance. Review the alignment of your privacy notices, consent flows and data-portability mechanisms with both frameworks. Run a gap-check with Verdaio's GDPR Quick Check.

If you run email marketing, transactional emails or newsletters targeting Italian recipients: Review every pixel, open-tracker and click-tracker in your ESP or CRM stack, map each to a specific legal basis, and align your consent flows and privacy notices with the Guidelines. Revisit data-minimisation controls (pseudonymous IDs, short retention) and document the exemption you rely on where no consent is collected. Run a gap-check with Verdaio's GDPR Quick Check.

If you run a mobile app that reads device state (installed apps, running processes, device fingerprinting): The Garante's decision sets a clear precedent that mandatory, all-or-nothing authorisations to access device data are disproportionate, even for fraud prevention. Review data minimisation, user-information flows, DPIA coverage, and security/retention controls for your mobile apps. Run a gap-check with Verdaio's GDPR Quick Check.

If you process personal data for research: Start mapping your activities against the six indicative factors and review how you document consent, safeguards and the limits on data subject rights. If you transfer personal data outside the EU/EEA: Certification is now a practical alternative to Standard Contractual Clauses and BCRs, useful where providers are reluctant to sign SCCs, or where the destination jurisdiction creates uncertainty. Review your GDPR posture and see whether certification-based transfers fit your vendor stack.

If you deploy biometric systems (facial recognition, fingerprint) for access, authentication, or customer experience: Biometric processing in public or semi-public spaces must satisfy strict necessity, encryption, and retention standards, even with consent. Review the Article 9 GDPR legal basis, technical safeguards, and whether you offer a real non-biometric alternative. Biometric systems may also trigger EU AI Act obligations. Check your posture with Verdaio's GDPR Quick Check and EU AI Act Assessment.

If you conduct DPIAs: This is the first time the EU has offered a single, consistent DPIA format that will be recognised across Member States. Multinational controllers benefit most, one template, one structure, accepted by every DPA. Action: Review your current DPIA methodology against the draft template, submit feedback before 9 June if relevant, and plan to migrate existing DPIAs once national DPAs formally adopt it. Run a gap-check with Verdaio's GDPR Quick Check.

If you operate in any of the 18 NIS2 sectors: The compliance deadline is now less than 6 months away. Start with a gap assessment to understand your current posture, particularly around incident reporting (72-hour notification requirement), supply chain risk management, and board-level accountability. Not sure if NIS2 applies to you? Run the free NIS2 Readiness Assessment.

If you have under 1,000 employees: You are likely out of mandatory scope under the new threshold. However, large customers and financial institutions may still require CSRD-aligned disclosures through their own value chain reporting. If you have 1,000+ employees: Mandatory reporting continues, the core ESRS standards remain unchanged. Use the delay to strengthen your data collection processes.

If you deploy high-risk AI: The extension is very likely to pass, but it is not yet law. The responsible approach is to prepare for the August 2026 deadline while expecting the relief. If adopted as expected, you will have until December 2027 for Annex III systems. Use the time to build compliant processes rather than waiting. We will update this story when the final text is published.

If you report under ESRS: Even though the Omnibus reduces mandatory scope, the financial sector, your banks, investors, and insurers, still expects comprehensive sustainability data. Companies that only meet the minimum simplified requirements may face challenges accessing green finance or satisfying due diligence requests from larger clients.

If you're already reporting: Review which activities fall below the 10% threshold, you may be able to exclude a significant portion of your current assessment scope. If you haven't started: This simplification makes first-time Taxonomy reporting considerably more manageable. The threshold applies for reporting periods from 2025 onwards.

Immediate action required: If your organisation uses or deploys AI systems, review them against the Article 5 prohibited practices list now. Violations can result in fines of up to €35M or 7% of global annual turnover. Most business AI tools (productivity, analytics, customer service) are not prohibited, but AI used in recruitment, credit scoring, or affecting individuals in sensitive contexts requires careful review.

If you use gatekeeper platforms: These decisions signal that app stores, search rankings, and advertising systems on major platforms may change to comply with DMA requirements, potentially affecting your distribution and marketing strategies. If you are a gatekeeper platform: The DMA is now actively enforced. Non-compliance carries substantial financial risk.

For any company that transfers personal data outside the EU/EEA: This fine reinforces that transfer mechanisms must be watertight. Standard Contractual Clauses (SCCs) are not sufficient if the destination country's laws prevent the data importer from complying with them in practice. Review your data transfer impact assessments (DTIAs), particularly for transfers to the US, India, and China. Consider data localisation where technically feasible.