EDPB adopts new guidelines on calculating GDPR fines
21 Sep 2026
The EDPB has adopted Guidelines 04/2026 on administrative fines, replacing the 2017 guidelines, and finalised its DSA–GDPR guidelines.
Europe
Insights for the EU, the EEA, and the rest of Europe.
Cyber Resilience Act: vulnerability and incident reporting begins
11 Sep 2026
Manufacturers must now report actively exploited vulnerabilities and severe incidents under the EU Cyber Resilience Act.
EU e-Evidence Regulation now applies
18 Aug 2026
EU authorities can now issue European Production and Preservation Orders directly to service providers.
EU AI Omnibus in force: high-risk obligations deferred
27 Jul 2026
Amendments to the EU AI Act defer high-risk obligations and soften the AI literacy duty.
EU renews UK adequacy decisions until 2031
19 Dec 2025
The European Commission has renewed its adequacy decisions for the UK, so personal data can continue to flow freely from the EU.
Germany’s NIS2 Implementation Act comes into force
6 Dec 2025
Germany’s NIS2 Implementation Act takes effect, significantly expanding the number of organisations subject to cyber security duties.
CyFun 2025: Belgium’s CyberFundamentals framework updated
29 Oct 2025
The CCB has published CyFun 2025, with more emphasis on supply chain and operational technology security.
EU Data Act applies
12 Sep 2025
The EU Data Act now applies, covering access to connected-product data and cloud switching obligations.
EU AI Act: general-purpose AI obligations apply
2 Aug 2025
Obligations for providers of general-purpose AI models under the EU AI Act apply from today.
Switzerland makes cyber attack reporting mandatory for critical infrastructure
1 Apr 2025
Swiss critical infrastructure operators must now report cyber attacks to the National Cyber Security Centre within 24 hours.
EU AI Act: first obligations now apply
2 Feb 2025
Prohibited AI practices are now banned in the EU, and AI literacy obligations apply.
DORA now applies across the EU financial sector
17 Jan 2025
The Digital Operational Resilience Act applies from today to EU financial entities and their ICT third-party providers.