Operates a social platform, in Denmark

NIS 2-loven, §§ 12-13, 15 · Read the law's page

• This binds the same essential and important entities as this jurisdiction's companion risk-management row: Annex 1's digital-infrastructure entry (item 8) and Annex 2's digital-provider entry (item 6), at the size thresholds Sections 4 and 5 set; the wider sector classes are reached as on that row, and the entities Section 1(2) routes to Denmark's separate energy-sector, telecom-sector or financial-entity regimes are outside this Act.
• Notify your competent authority and Denmark's CSIRT of every significant incident, one that has caused or can cause serious operational disruption or financial loss for you, or has affected or can affect another person through significant physical or non-physical harm.
• Send an early warning without undue delay, and no later than 24 hours after becoming aware of the significant incident, stating whether it is suspected to result from an unlawful or malicious act and whether it may have a cross-border effect.
• Follow with a notification, without undue delay and in any case within 72 hours of becoming aware of the incident, updating the early warning with an initial assessment of the incident's severity and impact, including any indicators of compromise where available.
• Submit an interim report if your CSIRT asks for one, and a final report no later than one month after your notification, describing the incident in detail, its severity and impact, the likely threat or root cause, mitigating measures applied and under way, and any cross-border effects. If the incident is still ongoing at that point, submit a status report instead and the final report within one month of the incident being handled.
• If you are a trust-service provider, send the notification described in the previous step without undue delay and no later than 24 hours after becoming aware of the significant incident, rather than within 72 hours.
• Notify the recipients of your service, without undue delay, of a significant incident likely to adversely affect the delivery of your service to them, and inform any recipient potentially affected by a significant cyber threat of the measures or countermeasures they can take in response, and of the threat itself where relevant.

NIS 2-loven, §§ 6-10 · Read the law's page

• This binds an essential entity (Section 4) or an important entity (Section 5) drawn from Annex 1 or Annex 2; Annex 1's digital-infrastructure entry (item 8) names an internet-exchange-point provider, a DNS provider other than a root-server operator, a top-level-domain registry, a cloud-computing-service provider, a data-centre-service provider, a content-delivery-network provider, a trust-service provider, and a provider of a public electronic-communications network or service, and Annex 2's digital-provider entry (item 6) separately names an online marketplace, an online search engine, and a social-networking-services-platform provider, so a service in any of those lines is reached. Size matters for most: an essential entity has 250 or more staff, or turnover over EUR 50 million and a balance sheet over EUR 43 million (Section 4(1)), and an important entity 50 or more staff, or turnover and balance sheet each over EUR 10 million (Section 5(1)). It does not matter for a qualified trust-service provider, a top-level-domain registry or a DNS provider, each essential whatever its size (Section 4(3)(1)), nor for any other trust-service provider, which is important whatever its size (Section 5(3)). The wider sector classes (energy, transport, water, health, waste, chemicals, food, manufacturing and the rest) are reached too, by declaring that you are an essential or important entity; the entities Section 1(2) routes to Denmark's separate energy-sector, telecom-sector or financial-entity regimes are outside this Act.
• Take appropriate and proportionate technical, operational and organisational measures to manage the risks to the network and information systems you use for your operations or to provide your services, and to prevent an incident or minimise its impact on the recipients of your services and on other services.
• Cover at minimum: risk-analysis and information-system-security policies; incident handling; operational continuity, including backup management, disaster recovery and crisis management; supply-chain security, including your relationship with your direct suppliers and service providers; security in acquiring, developing and maintaining your network and information systems, including vulnerability handling and disclosure; policies and procedures for assessing the effectiveness of your cybersecurity risk-management measures; basic cyber-hygiene practices and cybersecurity training; policies and procedures on the use of cryptography and, where relevant, encryption; personnel security, access-control policies and asset management; and, where relevant, multi-factor or continuous authentication, secured voice, video and text communication, and secured internal emergency-communication systems.
• Where you fall short of any of these requirements, take without undue delay all necessary, appropriate and proportionate corrective measures.
• Have your management board (ledelsesorgan) approve these measures and oversee their implementation, and ensure its members attend relevant cybersecurity risk-management training and encourage similar training for your other staff.
• If you are a DNS provider, top-level-domain registry, domain-name-registration-service provider, or a provider of cloud-computing, data-centre, content-delivery-network, managed, managed-security, online-marketplace, online-search-engine or social-networking-services-platform services, register with the relevant competent authority within 3 months of first falling within the Act's scope, stating your name, address, sector and sub-sector, contact details, and the EU member states where you provide services. Other essential and important entities register within 2 weeks of first falling within scope. Anyone already in scope when the Act commenced had to register by 1 October 2025.

Forslag til Lov om produktansvar, L 32 (2026/1) · Read the law's page

• If you develop or make software, or have it developed or made, you answer as its manufacturer, unless it is free open-source software that you develop or supply outside commercial activity (Secs. 1(2), 3 point 1 and 3 point 10).
• Keep supplying the software updates and upgrades needed to keep the product safe while the product is within your control: a defect caused by software, by an update or upgrade, or by a missing necessary update is not excused because it arose after you put the product into circulation (Secs. 3 point 5 and 12(2)).
• Meet the product safety requirements that apply to your product, safety-relevant cybersecurity requirements included: they count in judging whether it is defective (Sec. 6(2) point 6), and failing a mandatory requirement that protects against the damage suffered presumes it defective (Sec. 11(2) point 2).
• Account for what your product learns or acquires after it is put into circulation: the effect of that ability is weighed in judging whether it is defective (Sec. 6(2) point 3).
• Keep records you could produce if a court orders disclosure on a claimant's supported request, because failing to comply with the order presumes the product defective (Secs. 10(1), 11(2) point 1).
• If you are a manufacturer established outside the European Union, your importer and your authorized representative answer as the manufacturer would, and where there is neither, the provider of distribution services answers (Sec. 7(1) point 3).
• If you substantially modify a product outside the manufacturer's control and then make it available on the market or put it into use, you answer as its manufacturer (Sec. 7(2)).
• If you are a distributor, or an online platform that lets consumers conclude distance contracts with traders, identify the operator established in the European Union or your own supplier within a month of the injured person's request, or you answer for the product (Sec. 7(3) and (4)).
• Do not rely on a contract term to limit or exclude your liability to an injured person, because the Act cannot be departed from to the injured person's detriment (Sec. 2).
• Be ready to prove a Section 12 defense: that you did not put the product into circulation, that the defect probably did not exist then, that it results from compliance with legal requirements, or that the objective scientific and technical knowledge then did not allow the defect to be discovered (Sec. 12(1)).
• If you integrate software made by a micro or small enterprise as a component, a recourse waiver agreed with that enterprise removes your recourse against it (Sec. 13(4)).
• Claims are time-barred 3 years after the injured person knew or should have known of the damage, the defect and the liable operator, and the right expires 10 years after the product was put into circulation or into use, or 25 years for a latent personal injury (Secs. 15 and 16).