European Union

High-risk AI systems must be technically capable of automatically recording events, in logs, over the system's lifetime. The logging capability must enable recording of events relevant to identifying a risk under Article 79(1) or a substantial modification, to supporting the post-market monitoring required by Article 72, and to the deployer monitoring required by Article 26(5).

For a remote biometric identification system, one of the Annex III use cases classified as high-risk under Article 6(2), the logs must at minimum record the start and end date and time of each use, the reference database checked against the input data, the input data for which a search produced a match, and the identity of the natural persons who verified the results under Article 14(5); this minimum contents list does not extend to high-risk systems generally.

Article 12 does not itself set how long a log must be kept or who may demand access to one: retention is Article 19's duty for a provider and Article 26(6)'s for a deployer, and access is Article 21(2)'s. Article 12 sits in Chapter III, Section 2, so it takes effect on the schedule the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026) wrote into Article 113: 2 December 2027 for a system classified as high-risk under Article 6(2) and Annex III, and 2 August 2028 for a system classified as high-risk under Article 6(1) and Annex I, rather than the Regulation's general 2 August 2026 application date.

Article 12 does not apply to a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.

The provider of a high-risk AI system must, for a period ending 10 years after the system has been placed on the market or put into service, keep at the disposal of the national competent authorities its technical documentation under Article 11, the documentation concerning its quality management system under Article 17, where applicable the documentation concerning changes approved by notified bodies and the decisions and other documents notified bodies issued, and the EU declaration of conformity under Article 47.

Each Member State must determine the conditions under which the documentation listed in Article 18(1) remains at the disposal of the national competent authorities for the period that paragraph sets where a provider, or its authorised representative, established on its territory goes bankrupt or ceases its activity before that period ends.

A provider that is a financial institution subject to internal-governance requirements under Union financial services law must maintain the technical documentation as part of the documentation kept under that law.

Article 18 sits in Chapter III, Section 3, so like Article 12 it takes effect on the schedule the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026) wrote into Article 113: 2 December 2027 for a system classified as high-risk under Article 6(2) and Annex III, and 2 August 2028 for a system classified as high-risk under Article 6(1) and Annex I, rather than the Regulation's general 2 August 2026 application date.

Under Article 111(2), as the Digital Omnibus on AI rewrote it, the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly; in any case, the providers and deployers of a high-risk AI system intended to be used by public authorities must take the necessary steps to comply with the Regulation's requirements and obligations by 2 August 2030.

Article 18 does not apply to a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.

Providers of a high-risk AI system must keep the logs the system automatically generates under Article 12(1), to the extent those logs are under the provider's control. The logs must be kept for a period appropriate to the system's intended purpose, at least six months, unless a different period is required under other Union or national law, in particular data-protection law.

A provider that is a financial institution subject to internal-governance requirements under Union financial services law satisfies this duty by keeping the logs as part of the documentation that law already requires it to maintain.

Article 19 sits in Chapter III, Section 3, so like Article 12 it takes effect on the schedule the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026) wrote into Article 113: 2 December 2027 for a system classified as high-risk under Article 6(2) and Annex III, and 2 August 2028 for a system classified as high-risk under Article 6(1) and Annex I, rather than the Regulation's general 2 August 2026 application date.

Under Article 111(2), as the Digital Omnibus on AI rewrote it, the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly; in any case, the providers and deployers of a high-risk AI system intended to be used by public authorities must take the necessary steps to comply with the Regulation's requirements and obligations by 2 August 2030.

Article 19 does not apply to a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.

Upon a reasoned request by a competent authority, a provider of a high-risk AI system must provide that authority all the information and documentation necessary to demonstrate the conformity of the system with the requirements set out in Section 2. The provider must give that information and documentation in a language which can be easily understood by the authority, in one of the official languages of the institutions of the Union as indicated by the Member State concerned.

Any information obtained by a competent authority pursuant to Article 21 must be treated in accordance with the confidentiality obligations set out in Article 78. Article 16, point (k), separately lists as an obligation of the provider that it demonstrate, upon a reasoned request of a national competent authority, the conformity of the high-risk AI system with the requirements set out in Section 2.

Article 21(2) separately requires the provider itself, upon a reasoned request by a competent authority, to give that authority access to the automatically generated logs of the high-risk AI system referred to in Article 12(1), to the extent such logs are under its control. Article 21 sits in Chapter III, Section 3, which is headed Obligations of providers and deployers of high-risk AI systems and other parties.

Under Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744, Chapter III, Sections 1, 2 and 3, with the exception of Article 6(5), apply from 2 December 2027 for a system classified as high-risk under Article 6(2) and Annex III, and from 2 August 2028 for a system classified as high-risk under Article 6(1) and Annex I. Under Article 111(2), as the Digital Omnibus on AI rewrote it, the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly; in any case, the providers and deployers of a high-risk AI system intended to be used by public authorities must take the necessary steps to comply with the Regulation's requirements and obligations by 2 August 2030.

For an AI system classified as high-risk under Article 6(1) and related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, Article 2(2), as replaced by Regulation (EU) 2026/1744, applies only Article 6(1), Article 60a and Articles 102 to 112, and applies Articles 57, 58 and 59 only in so far as the requirements for high-risk AI systems under the Regulation have been integrated in that Union harmonisation legislation.

Article 99(6a), inserted by Regulation (EU) 2026/1744, provides that in the case of small mid-cap enterprises each fine referred to in paragraphs 4 and 5 of Article 99 is up to the percentages or amount referred to there, whichever is lower.

Under Article 2(13), inserted by Regulation (EU) 2026/1744, the application of specific requirements or obligations laid down in Articles 9 to 15 and 17 to 25 to a high-risk AI system referred to in Article 6(1) may be limited where and to the extent that Union harmonisation legislation listed in Section A of Annex I lays down requirements or obligations providing an equivalent or higher level of protection of health, safety or fundamental rights, and the limitation does not reduce the overall level of protection provided for by the Regulation.

By 2 August 2027, the Commission is to adopt delegated acts under Article 97 specifying the high-risk AI systems concerned, the requirements or obligations that may be limited, the conditions under which the limitation applies, and the scope of the limitation.

Upon a reasoned request from a competent authority, a provider of a high-risk AI system must give that authority access to the logs automatically generated by the system under Article 12(1), to the extent the logs are under the provider's control. Any information a competent authority obtains under Article 21, including through this access, is subject to the confidentiality obligations of Article 78.

Article 21(2) is the access half of the record-keeping duty: Article 12 requires the logging capability to exist and Article 19 requires a provider to keep the logs, while Article 21(2) is what lets a competent authority reach them.

Article 21 sits in Chapter III, Section 3, so it takes effect on the same schedule as Articles 12, 19 and 26(6): 2 December 2027 for a system classified as high-risk under Article 6(2) and Annex III, and 2 August 2028 for a system classified as high-risk under Article 6(1) and Annex I, rather than the Regulation's general 2 August 2026 application date.

Article 21(2) does not apply to a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.

Providers established in third countries must, by written mandate, appoint an authorised representative established in the Union prior to making their high-risk AI systems available on the Union market.

An authorised representative is a natural or legal person located or established in the Union who has received and accepted a written mandate from a provider of an AI system or a general-purpose AI model to perform and carry out on its behalf the obligations and procedures established by the Regulation. For the purposes of the Regulation, the mandate empowers the authorised representative to carry out the tasks listed in Article 22(3).

Under Article 22(3), point (b), the authorised representative keeps at the disposal of the competent authorities and the national authorities or bodies referred to in Article 74(10), for a period of 10 years after the high-risk AI system has been placed on the market or put into service, the contact details of the provider that appointed it, a copy of the EU declaration of conformity, the technical documentation and, if applicable, the certificate issued by the notified body.

Under Article 22(3), point (c), the authorised representative provides a competent authority, upon a reasoned request, with all the information and documentation, including that referred to in point (b), necessary to demonstrate the conformity of a high-risk AI system with the requirements set out in Section 2, including access to the logs, as referred to in Article 12(1), automatically generated by the system, to the extent such logs are under the control of the provider.

Article 21(2) separately requires the provider itself, upon a reasoned request by a competent authority, to give that authority access to the automatically generated logs of the high-risk AI system referred to in Article 12(1), to the extent such logs are under its control. The authorised representative performs the tasks specified in the mandate it receives from the provider.

Article 22 sits in Chapter III, Section 3, so it takes effect on the schedule the Digital Omnibus on AI (Regulation (EU) 2026/1744) wrote into Article 113: 2 December 2027 for a system classified as high-risk under Article 6(2) and Annex III, and 2 August 2028 for a system classified as high-risk under Article 6(1) and Annex I, rather than the Regulation's general 2 August 2026 application date.

Under Article 111(2), as the Digital Omnibus on AI rewrote it, the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly; in any case, the providers and deployers of a high-risk AI system intended to be used by public authorities must take the necessary steps to comply with the Regulation's requirements and obligations by 2 August 2030.

Article 22 does not apply to a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.

A deployer of a high-risk AI system must keep the logs the system automatically generates, to the extent the logs are under the deployer's control, for a period appropriate to the system's intended purpose, at least six months, unless a different period is required under other Union or national law, in particular data-protection law.

A deployer that is a financial institution subject to internal-governance requirements under Union financial services law satisfies this duty by maintaining the logs as part of the documentation that law already requires it to keep. Article 26(6) is the deployer-side counterpart of Article 19: the two provisions state the same retention period, of a deployer and a provider respectively, in nearly identical wording.

Article 26 sits in Chapter III, Section 3, so like Articles 12, 19 and 21 it takes effect on the schedule the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026) wrote into Article 113: 2 December 2027 for a system classified as high-risk under Article 6(2) and Annex III, and 2 August 2028 for a system classified as high-risk under Article 6(1) and Annex I, rather than the Regulation's general 2 August 2026 application date.

Under Article 111(2), as the Digital Omnibus on AI rewrote it, the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly; in any case, the providers and deployers of a high-risk AI system intended to be used by public authorities must take the necessary steps to comply with the Regulation's requirements and obligations by 2 August 2030.

Article 26(6) does not apply to a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.

A deployer of a high-risk AI system that is a public authority, or a Union institution, body, office or agency, must comply with the Article 49 registration obligations. Where such a deployer finds that the high-risk AI system it plans to use has not been registered in the EU database, it must not use the system, and must inform the provider or the distributor.

Article 26 sits in Chapter III, Section 3, so it takes effect on the schedule the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026) wrote into Article 113: 2 December 2027 for a system classified as high-risk under Article 6(2) and Annex III, and 2 August 2028 for one classified under Article 6(1) and Annex I. Under Article 111(2), as the Digital Omnibus on AI rewrote it, the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly; in any case, the providers and deployers of a high-risk AI system intended to be used by public authorities must take the necessary steps to comply with the Regulation's requirements and obligations by 2 August 2030.

Article 26(8) does not apply to a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.

Where applicable, a deployer of a high-risk AI system must use the information the provider supplies under Article 13 to comply with the deployer's own duty to carry out a data protection impact assessment under Article 35 of the General Data Protection Regulation or Article 27 of the Law Enforcement Directive.

Article 26(9) does not itself create the impact-assessment duty, which is a data-protection duty owed under those instruments; it obligates a deployer already subject to one to draw on the provider's Article 13 disclosure when carrying it out.

Article 26 sits in Chapter III, Section 3, so it takes effect on the schedule the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026) wrote into Article 113: 2 December 2027 for a system classified as high-risk under Article 6(2) and Annex III, and 2 August 2028 for one classified under Article 6(1) and Annex I. Under Article 111(2), as the Digital Omnibus on AI rewrote it, the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly; in any case, the providers and deployers of a high-risk AI system intended to be used by public authorities must take the necessary steps to comply with the Regulation's requirements and obligations by 2 August 2030.

Article 26(9) does not apply to a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.

Providers and deployers of AI systems must take measures to support the development of AI literacy of their staff and other persons who operate or use AI systems on their behalf, taking into account their technical knowledge, experience, education, training, and the context of use, and considering the persons or groups the AI systems are used on.

The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026) replaced this Article: the original text required providers and deployers to ensure, to their best extent, a sufficient level of AI literacy; the current text asks them only to support its development and states expressly that it does not require guaranteeing any specific level of AI literacy of any individual.

The Commission and Member States must support and facilitate providers' and deployers' efforts, in particular for SMEs, including by publishing practical compliance examples, and the European Artificial Intelligence Board must adopt recommendations setting common objectives for the promotion of AI literacy.

Article 113, third paragraph, point (a), places this Article in Chapter I, which applies from 2 February 2025; the Digital Omnibus's amendment of that point carves out an exception only for the new Article 5(1), first subparagraph, points (ba) and (bb), and Article 5(1a) and (1b), so Article 4's own application date is unchanged.

Article 4a, inserted into the AI Act by the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026), is a conditional permission rather than a duty: it lets a provider of a high-risk AI system exceptionally process special categories of personal data where strictly necessary for the bias detection and correction the Article 10(2), points (f) and (g), data-governance duty requires, if all six conditions of paragraph 1 are met (no adequate substitute data, technical re-use limits and state-of-the-art security including pseudonymisation, strict access controls and documented access, no transmission to other parties, deletion once the bias is corrected or the data's own retention period ends, and a documented reason in the General Data Protection Regulation (GDPR) records of processing activities).

Paragraph 2 extends the same conditional permission, on a narrower necessity test, to providers and deployers of any other AI system or model and to deployers of high-risk AI systems, and states plainly that it creates no obligation to carry out bias detection or correction.

It applies from the Omnibus's entry into force on 27 July 2026: Article 113, third paragraph, point (a), as amended, applies Chapter I, which Article 4a joins, from 2 February 2025 with no exception for it, although recitals 9 and 40 of the Omnibus point to 2 August 2026.

Providers of general-purpose AI models established in third countries must, by written mandate, appoint an authorised representative established in the Union prior to placing a general-purpose AI model on the Union market. The provider of a general-purpose AI model must enable its authorised representative to perform the tasks specified in the mandate received from the provider.

For the purposes of the Regulation, the mandate for the authorised representative of a general-purpose AI model provider must empower the authorised representative to verify that the technical documentation specified in Annex XI has been drawn up and that all obligations referred to in Article 53 and, where applicable, Article 55 have been fulfilled by the provider.

The mandate for the authorised representative of a general-purpose AI model provider must empower the authorised representative to keep a copy of the technical documentation specified in Annex XI at the disposal of the AI Office and national competent authorities, for a period of 10 years after the model has been placed on the market, together with the contact details of the provider that appointed it.

The mandate for the authorised representative of a general-purpose AI model provider must empower the authorised representative to provide the AI Office, upon a reasoned request, with all the information and documentation necessary to demonstrate compliance with the obligations in Chapter V, and to cooperate with the AI Office and competent authorities, upon a reasoned request, in any action they take in relation to the model.

The mandate for the authorised representative of a general-purpose AI model provider must empower the authorised representative to be addressed, in addition to or instead of the provider, by the AI Office or the competent authorities on all issues related to ensuring compliance with the Regulation.

The authorised representative of a general-purpose AI model provider must provide a copy of the mandate to the AI Office upon request, in one of the official languages of the institutions of the Union.

The authorised representative of a general-purpose AI model provider must terminate the mandate if it considers or has reason to consider the provider to be acting contrary to its obligations under the Regulation, and in that case must immediately inform the AI Office about the termination and the reasons.

The obligation to appoint an authorised representative does not apply to providers of general-purpose AI models released under a free and open-source licence that allows for the access, usage, modification and distribution of the model, and whose parameters, including the weights, the information on the model architecture and the information on model usage, are made publicly available, unless the models present systemic risks.

Article 113 applies Chapter V, which contains Article 54, from 2 August 2025. A provider of a general-purpose AI model placed on the market before 2 August 2025 has until 2 August 2027 to take the necessary steps to comply with the obligations laid down in the Regulation.

The Commission may fine a provider of a general-purpose AI model up to 3% of its annual total worldwide turnover in the preceding financial year or EUR 15,000,000, whichever is higher, where it finds that the provider intentionally or negligently infringed the relevant provisions of the Regulation. Article 101 applies from 2 August 2026, the date from which the Regulation applies, because Article 113 excepts it from the earlier date given to Chapter V.

Article 55 binds providers of general-purpose AI models with systemic risk, in addition to the disclosure and copyright duties Article 53 places on providers of general-purpose AI models. The open-source exemption in Article 53(2) from the duties in Article 53(1), points (a) and (b), never applies to a model with systemic risk. A model is presumed to carry systemic risk when its training used more than 10^25 floating-point operations.

The Commission may also designate a model this way on the basis of equivalent capabilities or impact. Those providers must perform model evaluation using standardised, state-of-the-art protocols, including adversarial testing to identify and mitigate systemic risks. They must also assess and mitigate the systemic risks their model may pose at Union level, including where those risks originate.

They must keep track of, document, and report to the AI Office, and as appropriate to national competent authorities, without undue delay, relevant information about serious incidents involving their model and any corrective measures. And they must maintain an adequate level of cybersecurity protection for the model and its physical infrastructure.

The reporting duty names no fixed number of days and no explicit moment the clock runs from; it states only that the report must be made without undue delay. Article 73's reporting duty for high-risk AI systems sets a general ceiling of 15 days running from when the provider or, where applicable, the deployer becomes aware of the incident. That ceiling tightens to 10 days where the incident caused a person's death.

It tightens to 2 days for a widespread infringement or a serious and irreversible disruption of critical infrastructure. 'Serious incident' is defined once, in Article 3, point (49), for the whole Regulation, as an incident or malfunctioning that leads to a person's death or serious harm to health, a serious and irreversible disruption of critical infrastructure, an infringement of Union law protecting fundamental rights, or serious harm to property or the environment.

That definition is written for an AI system, a term the Regulation defines in Article 3, point (1). A general-purpose AI model is a separate defined term in the same Article. Article 55 supplies no definition of a serious incident keyed to a model rather than a system. A provider may rely on an AI Office code of practice, or a harmonised standard once one is published, to demonstrate compliance with these duties, and must show an alternative adequate means of compliance if it relies on neither.

Article 113's third paragraph, point (b), applies Chapter V, which contains Article 55, from 2 August 2025, a year ahead of the Regulation's general application date. The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026) left that point unchanged, replacing only points (a) and (c) and adding point (d). A provider whose model was already on the market before that date has until 2 August 2027 to come into compliance.

The AI Office encourages and facilitates the drawing up of codes of practice at Union level in order to contribute to the proper application of the Regulation, taking into account international approaches.

The AI Office and the Board aim to ensure that the codes of practice cover at least the obligations provided for in Articles 53 and 55, including the means to keep the Article 53(1) information up to date, the adequate level of detail for the summary about the content used for training, the identification of the type and nature of the systemic risks at Union level and the measures, procedures and modalities for assessing and managing them.

The AI Office may invite all providers of general-purpose AI models, as well as relevant national competent authorities, to participate in the drawing-up of codes of practice. The AI Office aims to ensure that participants in the codes of practice report regularly to the AI Office on the implementation of the commitments and the measures taken and their outcomes, including as measured against key performance indicators as appropriate.

As replaced by Regulation (EU) 2026/1744, Article 56(6) has the Commission and the Board regularly monitor and evaluate the achievement of the objectives of the codes of practice by the participants and their contribution to the proper application of the Regulation, and has the Commission, taking utmost account of the opinion of the Board, assess whether the codes of practice cover the obligations provided for in Articles 53 and 55 and publish its assessment of their adequacy.

Regulation (EU) 2026/1744 entered into force on the third day following that of its publication in the Official Journal of the European Union. The AI Office may invite all providers of general-purpose AI models to adhere to the codes of practice, and for providers of models not presenting systemic risks this adherence may be limited to the obligations provided for in Article 53, unless they declare explicitly their interest to join the full code.

Where a code of practice cannot be finalised by 2 August 2025, or the AI Office deems it not adequate following its assessment, the Commission may provide, by means of implementing acts, common rules for the implementation of the obligations provided for in Articles 53 and 55. In fixing the amount of a fine on a provider of a general-purpose AI model, the Commission also takes into account commitments made in relevant codes of practice in accordance with Article 56. Article 113 applies Chapter V, which contains Article 56, from 2 August 2025.

Each Member State must ensure that its competent authorities establish at least one AI regulatory sandbox at national level, operational by 2 August 2027, a date the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026) moved back one year from the original 2 August 2026 deadline; a Member State may instead participate in another Member State's sandbox if that gives equivalent national coverage.

A sandbox provides a controlled environment for developing, training, testing and validating innovative AI systems before they are placed on the market, under a plan agreed with the competent authority, and may include supervised real-world testing.

Article 57 creates no duty on a provider or a deployer: participation is voluntary, and a participating provider or prospective provider that follows its sandbox plan and the competent authority's guidance in good faith is shielded from an administrative fine under this Regulation, and from a fine under other Union or national law actively supervised in the sandbox, for the conduct the sandbox covers.

Such a participant remains liable under applicable Union and national liability law for any damage inflicted on third parties as a result of the experimentation taking place in the sandbox.

Competent authorities must give sandbox participants regulatory guidance and an exit report detailing the activities carried out in the sandbox and the related results and learning outcomes, and, on request, written proof of the activities successfully carried out; a provider may use that documentation to help demonstrate compliance.

Personal data lawfully collected for other purposes may be processed in an AI regulatory sandbox solely for the purpose of developing, training and testing certain AI systems in the sandbox when all of the listed conditions are met.

The AI systems must be developed for safeguarding substantial public interest, by a public authority or another natural or legal person, in one or more of these areas: public safety and public health, a high level of protection and improvement of the quality of the environment, energy sustainability, safety and resilience of transport systems and mobility, critical infrastructure and networks, and efficiency and quality of public administration and public services.

The data processed must be necessary for complying with one or more of the requirements referred to in Chapter III, Section 2, where those requirements cannot effectively be fulfilled by processing anonymised, synthetic or other non-personal data.

There must be effective monitoring mechanisms to identify whether any high risks to the rights and freedoms of the data subjects may arise during the sandbox experimentation, as well as response mechanisms to promptly mitigate those risks and, where necessary, stop the processing.

Any personal data to be processed must be in a functionally separate, isolated and protected data processing environment under the control of the prospective provider with access limited to authorised persons, the provider may share the originally collected data further only in accordance with Union data protection law, and personal data created in the sandbox cannot be shared outside the sandbox.

The processing of personal data in the sandbox must neither lead to measures or decisions affecting the data subjects nor affect the application of their rights laid down in Union law on the protection of personal data.

Personal data processed in the sandbox must be protected by appropriate technical and organisational measures and deleted once participation in the sandbox has terminated or the data has reached the end of its retention period, and the logs of the processing must be kept for the duration of the participation unless Union or national law provides otherwise.

A complete and detailed description of the process and rationale behind the training, testing and validation of the AI system must be kept together with the testing results as part of the technical documentation referred to in Annex IV.

A short summary of the AI project developed in the sandbox, its objectives and expected results must be published on the website of the competent authorities, but that obligation does not cover sensitive operational data in relation to the activities of law enforcement, border control, immigration or asylum authorities.

For the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including safeguarding against and preventing threats to public security, under the control and responsibility of law enforcement authorities, the processing of personal data in an AI regulatory sandbox must be based on a specific Union or national law and subject to the same cumulative conditions as in paragraph 1.

Article 59(1) is without prejudice to Union or national law which excludes processing of personal data for other purposes than those explicitly mentioned in that law, and to Union or national law laying down the basis for the processing of personal data necessary for developing, testing or training innovative AI systems or any other legal basis, in compliance with Union law on the protection of personal data.

Article 2(7), as replaced by Regulation (EU) 2026/1744, provides that, without prejudice to Articles 4a and 59, the Regulation does not affect Regulation (EU) 2016/679 or (EU) 2018/1725, or Directive 2002/58/EC or (EU) 2016/680. Article 59 sits in Chapter VI, to which Article 113 gives no date of its own, so it applies from the Regulation's general application date of 2 August 2026.

Regulation (EU) 2026/1744 replaced points (a) and (c) of Article 113's third paragraph and added point (d), and none of them names Chapter VI. Under Article 2(2), as replaced by Regulation (EU) 2026/1744, Articles 57, 58 and 59 apply to a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I only in so far as the requirements for high-risk AI systems under the Regulation have been integrated in that Union harmonisation legislation.

Member States may allow, in accordance with Article 60a, the testing of high-risk AI systems in real world conditions outside AI regulatory sandboxes by providers or prospective providers of AI enabled products covered by the Union harmonisation legislation listed in Section B of Annex I, with a view to assessing and verifying the conformity of those systems with the requirements laid down in Articles 8 to 15.

Member States that choose to allow that testing must, individually or jointly, adopt frameworks for real-world testing, and each Member State must notify the Commission of any real-world testing framework it adopts before implementing it.

Member States that have adopted real-world testing frameworks must ensure that the relevant national competent authorities, relevant authorities and public authorities responsible for the management and operation of infrastructure and products covered by the Section B legislation cooperate closely with each other in good faith and remove any practical obstacles.

The frameworks must lay down the requirements under which testing in real-world conditions occurs, including a mandatory real-world testing plan agreed between the provider or prospective provider and the national competent authority or relevant authority, compliance with the requirements laid down in Article 60(2), (3), (4)(d) to (j) and (5) to (9), effective governance and accountability arrangements, and a high level of protection of health, safety and fundamental rights.

The real-world testing must comply with the applicable provisions laid down in the Union harmonisation legislation listed in Section B of Annex I, and any requirements in those provisions do not affect the application of Article 60a to the extent necessary to enable the testing.

For a high-risk AI system classified under Article 6(1) and related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under the Regulation have been integrated in that legislation.

Where testing in real world conditions is based on Article 60a, a reference in Article 76 to a market surveillance authority is read as a reference to the national competent authority or appropriate authority under the Section B legislation, and references to Article 60 are read as references to Article 60a, as appropriate.

Article 113 provides that the Regulation applies from 2 August 2026, with exceptions for Chapters I and II, Chapter III Section 4, Chapter V, Chapter VII, Chapter XII, Article 78 and Article 6(1), none of which is Chapter VI, in which Article 60a sits between Articles 60 and 61. Regulation (EU) 2026/1744 entered into force on the third day following that of its publication in the Official Journal, 27 July 2026.

The AI Office is exclusively competent for the supervision and enforcement of the obligations under the Regulation in relation to AI systems based on general-purpose AI models where the model and the system are developed by the same provider, or by providers forming part of the same undertaking as that provider, with four exceptions.

The four exceptions to the AI Office's competence over AI systems based on general-purpose AI models are AI systems related to products covered by the Union harmonisation legislation listed in Annex I, AI systems referred to in point 2 of Annex III, AI systems provided by law enforcement authorities, border management authorities and financial institutions insofar as they fall under Article 74(6), and AI systems referred to in point 8 of Annex III as regards the administration of justice.

The AI Office is also exclusively competent in relation to AI systems that constitute or are integrated into a very large online platform or very large online search engine designated in accordance with Regulation (EU) 2022/2065. The AI Office's exclusive competence applies to the providers of the AI systems it covers, and to their deployers only when they are also the provider or form part of the same undertaking as the provider.

By way of derogation from Article 73, providers of high-risk AI systems subject to the competence of the AI Office must report any serious incidents to the AI Office, and Article 73(2) to (9) applies mutatis mutandis. The AI Office is responsible for conformity assessments and tests of the AI systems within its competence that are classified as high-risk and subject to a third-party conformity assessment, and the Commission entrusts their performance to notified bodies.

The fees for testing and assessment activities are levied on the provider of a high-risk AI system who has applied for a third-party conformity assessment to the Commission, and the provider pays the costs of the services entrusted to the notified bodies directly to the notified body.

A market surveillance authority with well-founded and sufficient reasons to suspect an infringement by a provider or deployer of an AI system within the AI Office's competence may request, through its single point of contact, that the AI Office assess the matter.

The AI Office informs a market surveillance authority's single point of contact, without undue delay and in any event no later than four months following receipt of its request for an assessment, of its intention to exercise its powers or of its reasons for not exercising them.

When it supervises and enforces the AI systems within its competence, the AI Office has all the powers of a market surveillance authority provided for in the Section of the Regulation that holds Article 75a and in Article 14(4) and Article 16(3) of Regulation (EU) 2019/1020.

The AI Office is authorised to fully reclaim from the relevant operator the totality of the costs of its supervision and enforcement activities with respect to instances of non-compliance, including costs for human and technical resources.

Where the AI Office has reasonable grounds to suspect non-compliance by a provider or a deployer of an AI system referred to in Article 75(1), it may adopt a decision to start an investigation, and upon starting the investigation it notifies the operator of the AI system concerned. The AI Office may exercise the powers listed in Article 14(4), points (a), (b) and (c) of Regulation (EU) 2019/1020 and Article 74(12) and (13) of the Regulation by simple request or by decision.

When requesting information, the AI Office states the legal basis and the purpose of the request, specifies what information is required and sets the period within which the information is to be provided.

A simple request for information from the AI Office must additionally indicate that, although there is no obligation to provide the information requested, in the case of a voluntary reply the information must be correct and not misleading, and must indicate the potential fines provided for in Article 99(5).

A request for information made by decision must additionally indicate the fines provided for in Article 99(5) for supplying incorrect, incomplete or misleading information and the right to have the decision reviewed by the Court of Justice of the European Union. The AI Office may conduct all necessary remote or on-site inspections pursuant to the powers laid down in Article 14(4), points (d) and (e) of Regulation (EU) 2019/1020 and Article 74(5) of the Regulation.

During an inspection, the officials of the AI Office are empowered to enter any of the business premises, land or property located in the Union of the operator concerned, to examine and copy books, data and other material relevant to their tasks, to ask for oral or written explanations and to seal business premises and books or records for the duration of, and to the extent necessary for, the inspection.

The AI Office may also order operators to provide access to, and explanations relating to, their AI systems, and may impose an obligation on an operator to retain all data and documents deemed to be necessary to assess the implementation of and compliance with the obligations under the Regulation.

If, during proceedings under Article 75a(2), the operator concerned offers commitments to ensure compliance, the AI Office may, by decision, make those commitments binding on the operator and declare that there are no further grounds for action.

The AI Office may reopen proceedings in which it made commitments binding where there has been a material change in the facts on which the decision was based, the operator acts contrary to its commitments, or the decision was based on incomplete, incorrect or misleading information provided by the operator.

Where the AI Office finds that an operator falling within the scope of Article 75(1) does not comply with the relevant provisions of the Regulation or with commitments made binding under Article 75b, it adopts a decision establishing such non-compliance.

Before adopting a decision establishing non-compliance, the AI Office communicates its preliminary findings to the operator concerned and explains the measures that it is considering taking, or that it considers the operator should take, to address them.

In a decision establishing non-compliance the AI Office orders, where relevant, the operator to take the necessary measures to ensure compliance within a reasonable period specified in the decision and to provide information on the measures it intends to take, and the operator then provides the AI Office with a description of the measures it has taken upon their implementation.

A decision establishing non-compliance may be accompanied by the imposition of penalties in accordance with Article 99(3) to (7), which apply mutatis mutandis to the AI Office in the execution of its supervision and enforcement tasks.

Infringement of any applicable provision of the Regulation, failure to comply with decisions or measures adopted under the powers in Article 14(4) or Article 16(3) of Regulation (EU) 2019/1020 and Article 75a, and failure to comply with a commitment made binding under Article 75b are subject to administrative fines as referred to in Article 99(4).

The supply of incorrect, incomplete or misleading information to the AI Office in reply to a request is subject to administrative fines as referred to in Article 99(5). Article 99(4) sets administrative fines of up to EUR 15,000,000 or, if the offender is an undertaking, up to 3% of its total worldwide annual turnover for the preceding financial year, whichever is higher.

Article 99(5) sets administrative fines of up to EUR 7,500,000 or, if the offender is an undertaking, up to 1% of its total worldwide annual turnover for the preceding financial year, whichever is higher, for the supply of incorrect, incomplete or misleading information. In the case of SMEs, including start-ups, Article 99(6) limits each fine to the percentage or amount referred to in paragraphs 3, 4 and 5, whichever is lower.

The AI Office may adopt a decision imposing periodic penalty payments to compel operators to submit to an investigation, to comply with an information request or an inspection ordered by decision, to provide correct or complete answers in an inspection, to comply with corrective actions, to comply with commitments made legally binding, or to comply with a decision establishing non-compliance.

Periodic penalty payments imposed by the AI Office are effective and proportionate and, where applicable, do not exceed 5% of the average daily income or worldwide annual turnover in the preceding financial year per day, calculated from the date appointed by the decision.

The Court of Justice of the European Union has unlimited jurisdiction to review decisions of the AI Office fixing a fine or periodic penalty payment, and may cancel, reduce or increase the fine or periodic penalty payment imposed. The AI Office's powers under Article 75c are subject to a limitation period of five years, which begins to run on the day the infringement is committed or, for continuing or repeated infringements, the day the infringement ceases.

The rights of defence and of access to the file of operators falling within the scope of Article 75(1) must be fully respected in proceedings, and those operators are entitled to have access to the AI Office file under the terms of a negotiated disclosure, subject to the legitimate interest in the protection of business secrets.

The AI Office publishes the decisions it adopts under Articles 75b and 75c, stating the names of the parties and the main content of the decision, including any penalties imposed.

Where market surveillance authorities have sufficient reason to consider general-purpose AI systems that can be used directly by deployers for at least one purpose classified as high-risk to be non-compliant, they cooperate with the AI Office to carry out compliance evaluations and inform the Board and other market surveillance authorities accordingly.

Where a market surveillance authority is unable to conclude its investigation of a high-risk AI system because it cannot access certain information related to the general-purpose AI model despite all appropriate efforts, it may submit a reasoned request to the AI Office, which supplies the information it considers relevant without delay and in any event within 30 days.

A general-purpose AI model is classified as a model with systemic risk if it has high impact capabilities, evaluated on the basis of appropriate technical tools and methodologies, including indicators and benchmarks.

A model is also classified as a model with systemic risk if, based on a decision of the Commission taken ex officio or following a qualified alert from the scientific panel, it has capabilities or an impact equivalent to those high impact capabilities, having regard to the criteria set out in Annex XIII. A model is presumed to have high impact capabilities when the cumulative amount of computation used for its training, measured in floating point operations, is greater than 10^25.

The Annex XIII criteria for equivalent capabilities or impact are the number of parameters of the model, the quality or size of the data set, the amount of computation used for training, the input and output modalities, the benchmarks and evaluations of capabilities, the impact on the internal market (presumed when the model has been made available to at least 10,000 registered business users established in the Union) and the number of registered end-users.

The provider of a model that meets the high impact capabilities condition must notify the Commission without delay and in any event within two weeks after that requirement is met or it becomes known that it will be met. The notification that Article 52(1) requires must include the information necessary to demonstrate that the requirement has been met.

If the Commission becomes aware of a model presenting systemic risks of which it has not been notified, it may decide to designate it as a model with systemic risk.

The provider of a model that meets the high impact capabilities condition may present, with its notification, sufficiently substantiated arguments that, exceptionally, although the model meets that requirement, it does not present systemic risks because of its specific characteristics and so should not be classified as a model with systemic risk.

Where the Commission concludes that arguments submitted under Article 52(2) are not sufficiently substantiated and the provider was not able to demonstrate that the model does not present systemic risks, it rejects the arguments and the model is considered a model with systemic risk. The Commission may designate a general-purpose AI model as presenting systemic risks, ex officio or following a qualified alert from the scientific panel, on the basis of the criteria set out in Annex XIII.

Upon a reasoned request of a provider whose model has been designated, the Commission takes the request into account and may decide to reassess whether the model can still be considered to present systemic risks on the basis of the Annex XIII criteria.

A request for reassessment must contain objective, detailed and new reasons that have arisen since the designation decision, and a provider may make it at the earliest six months after the designation decision or, where the Commission maintains the designation after reassessment, at the earliest six months after that decision.

The Commission publishes and keeps up to date a list of general-purpose AI models with systemic risk, without prejudice to the need to observe and protect intellectual property rights and confidential business information or trade secrets. Article 113 applies Chapter V, which contains Articles 51 and 52, from 2 August 2025.

A provider of a general-purpose AI model placed on the market before 2 August 2025 has until 2 August 2027 to take the necessary steps to comply with the obligations laid down in the Regulation. The Commission may fine a provider of a general-purpose AI model up to 3% of its annual total worldwide turnover in the preceding financial year or EUR 15,000,000, whichever is higher, where it finds that the provider intentionally or negligently infringed the relevant provisions of the Regulation.

Article 101 applies from 2 August 2026, the date from which the Regulation applies, because Article 113 excepts it from the earlier date given to Chapter V.

Where relevant and limited to what is necessary to fulfil their tasks, and without prejudice to the powers under Regulation (EU) 2019/1020, market surveillance authorities must be granted full access by providers to the documentation and to the training, validation and testing data sets used for the development of high-risk AI systems, including, where appropriate and subject to security safeguards, through application programming interfaces or other technical means enabling remote access.

Market surveillance authorities must be granted access to the source code of a high-risk AI system upon a reasoned request, and only when access to the source code is necessary to assess the system's conformity with the requirements of Chapter III, Section 2 and testing or auditing procedures and verifications based on the data and documentation the provider supplied have been exhausted or proved insufficient.

Any information or documentation a market surveillance authority obtains under Article 74 is treated in accordance with the confidentiality obligations of Article 78.

Under Article 77(1), as replaced by Regulation (EU) 2026/1744, national public authorities or bodies that supervise or enforce the respect of obligations under Union law protecting fundamental rights, including the right to non-discrimination, have the power to request and access from the relevant market surveillance authority any information or documentation created or maintained pursuant to the Regulation, in accessible language and machine-readable format by electronic means, where access is necessary for effectively fulfilling their mandates within the limits of their jurisdiction.

Under Article 77(1a), inserted by Regulation (EU) 2026/1744, the market surveillance authority must grant the public authority or body referred to in Article 77(1) access to such information or documentation, including by requesting it from the provider or the deployer, where necessary and without undue delay.

Where the documentation is insufficient to ascertain whether an infringement of obligations under Union law protecting fundamental rights has occurred, the public authority or body referred to in Article 77(1) may make a reasoned request to the market surveillance authority to organise testing of the high-risk AI system through technical means, which the market surveillance authority must organise with the close involvement of the requesting authority or body within a reasonable time.

Article 74(12) and (13) and Article 77 concern high-risk AI systems, and the Digital Omnibus on AI (Regulation (EU) 2026/1744) moved Chapter III, Sections 1 to 3, which hold the Article 6 rules that classify a system as high-risk, to 2 December 2027 for a system classified under Article 6(2) and Annex III and to 2 August 2028 for one classified under Article 6(1) and Annex I. The Omnibus also rewrote Article 111(2) so that the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly, and the providers and deployers of a system intended for use by public authorities must take the necessary steps to comply by 2 August 2030.

Article 74(12) and (13) and Article 77 do not apply to a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.

Articles 74 and 77 sit in Chapter IX, to which Article 113 gives no date of its own, so they apply to the authorities from the Regulation's general application date of 2 August 2026.

The Commission has exclusive powers to supervise and enforce Chapter V, taking into account the procedural guarantees under Article 94, and entrusts the implementation of these tasks to the AI Office.

Without prejudice to Article 75(3), market surveillance authorities may request the Commission to exercise the powers laid down in the Section on supervision of providers of general-purpose AI models, where that is necessary and proportionate to assist with the fulfilment of their tasks under the Regulation.

The AI Office may take the necessary actions to monitor the effective implementation of and compliance with the Regulation by providers of general-purpose AI models, including their adherence to approved codes of practice.

Downstream providers have the right to lodge a complaint alleging an infringement of the Regulation, and the complaint must be duly reasoned and indicate at least the point of contact of the provider of the model concerned, a description of the relevant facts and provisions, and any other information the downstream provider considers relevant.

The scientific panel may provide a qualified alert to the AI Office where it has reason to suspect that a general-purpose AI model poses concrete identifiable risk at Union level or meets the conditions referred to in Article 51. Upon a qualified alert from the scientific panel, the Commission, through the AI Office and after having informed the Board, may exercise the powers laid down in that Section for the purpose of assessing the matter.

The Commission may request the provider of the general-purpose AI model concerned to provide the documentation drawn up by the provider in accordance with Articles 53 and 55, or any additional information that is necessary for the purpose of assessing compliance of the provider with the Regulation. Before sending a request for information, the AI Office may initiate a structured dialogue with the provider of the general-purpose AI model.

Upon a duly substantiated request from the scientific panel, the Commission may issue a request for information to a provider of a general-purpose AI model, where access to the information is necessary and proportionate for the fulfilment of the tasks of the scientific panel under Article 68(2).

A Commission request for information to a provider of a general-purpose AI model must state the legal basis and the purpose of the request, specify what information is required, set a period within which the information is to be provided, and indicate the fines provided for in Article 101 for supplying incorrect, incomplete or misleading information.

The provider of a general-purpose AI model, or its representative, must supply the information the Commission requests under Article 91, and lawyers duly authorised to act may supply information on behalf of their clients, who remain fully responsible if the information supplied is incomplete, incorrect or misleading.

The AI Office, after consulting the Board, may conduct evaluations of the general-purpose AI model concerned to assess the provider's compliance with obligations under the Regulation where the information gathered under Article 91 is insufficient, or to investigate systemic risks at Union level of models with systemic risk, in particular following a qualified alert from the scientific panel.

The Commission may decide to appoint independent experts to carry out evaluations on its behalf, including from the scientific panel established pursuant to Article 68. For the purposes of an evaluation, the Commission may request access to the general-purpose AI model concerned through APIs or further appropriate technical means and tools, including source code.

A Commission request for access to a general-purpose AI model must state the legal basis, the purpose and reasons of the request and set the period within which the access is to be provided, and must indicate the fines provided for in Article 101 for failure to provide access.

A provider of a general-purpose AI model, or its representative, must supply the access the Commission requests for an evaluation under Article 92, and where the provider is a legal person the persons authorised to represent it by law or by its statutes provide the access on its behalf.

The Commission adopts implementing acts setting out the detailed arrangements and the conditions for the evaluations, including the arrangements for involving independent experts and the procedure for selecting them.

Prior to requesting access to a general-purpose AI model, the AI Office may initiate a structured dialogue with the provider to gather more information on the internal testing of the model, internal safeguards for preventing systemic risks, and other internal procedures and measures the provider has taken to mitigate such risks.

Where necessary and appropriate, the Commission may request providers to take appropriate measures to comply with the obligations set out in Articles 53 and 54, to implement mitigation measures where an evaluation has given rise to serious and substantiated concern of a systemic risk at Union level, or to restrict the making available on the market, withdraw or recall the model.

Before the Commission requests a measure from a provider of a general-purpose AI model, the AI Office may initiate a structured dialogue with the provider. If, during the structured dialogue before a measure is requested, the provider of a model with systemic risk offers commitments to implement mitigation measures to address a systemic risk at Union level, the Commission may, by decision, make those commitments binding and declare that there are no further grounds for action.

Article 18 of Regulation (EU) 2019/1020 applies mutatis mutandis to the providers of the general-purpose AI model, without prejudice to more specific procedural rights provided for in the Regulation. The Commission may fine a provider of a general-purpose AI model up to 3% of its annual total worldwide turnover in the preceding financial year or EUR 15,000,000, whichever is higher, where it finds that the provider intentionally or negligently infringed the relevant provisions of the Regulation.

Article 101(1), points (b) to (d), applies the same ceiling of 3% of annual total worldwide turnover or EUR 15,000,000, whichever is higher, where the Commission finds that the provider intentionally or negligently failed to comply with a request for a document or for information under Article 91, or supplied incorrect, incomplete or misleading information, failed to comply with a measure requested under Article 93, or failed to make available access to the model for an evaluation under Article 92.

Before fining a provider of a general-purpose AI model under Article 101, the Commission communicates its preliminary findings to the provider of the general-purpose AI model and gives it an opportunity to be heard. The Court of Justice of the European Union has unlimited jurisdiction to review decisions of the Commission fixing a fine under Article 101, and may cancel, reduce or increase the fine imposed.

Article 101 applies from 2 August 2026, the date from which the Regulation applies, because Article 113 excepts it from the earlier date given to Chapter V.

Article 37 requires a Commission-designated very large online platform or very large online search engine, one with 45,000,000 or more average monthly active recipients in the Union, to commission an independent audit, at its own expense and at least once a year, of its compliance with the whole of Chapter III's due diligence obligations, not only the AI-relevant systemic-risk mitigation measure for generated and manipulated content in Article 35(1)(k), and with any codes of conduct or crisis protocols it has undertaken.

Article 37 is not itself an AI-facing duty; it is the audit machinery that sits over a body of obligations that happens to include the AI-relevant ones.

The auditing organisation must be independent of the provider and free of conflicts of interest, must not have supplied non-audit services related to the matters audited to the provider or a legal person connected to it in the twelve months before the audit began, must have committed not to supply them in the twelve months after it is completed, must not have audited the same provider for more than ten consecutive years, and may not be paid on a result-contingent basis; Commission Delegated Regulation (EU) 2024/436 supplements Article 37 with procedural rules on selecting and cooperating with the auditor, scoping the audit period, and drawing up the audit report and audit implementation report on the Regulation's own templates.

The audit report must name the provider and the auditor, describe the elements audited and the methodology, summarise the findings, list third parties consulted, and reach an audit opinion of 'positive', 'positive with comments', or 'negative'; where the opinion is not positive, the provider must adopt, within one month, an audit implementation report describing the measures it took or its reasons for not taking them.

The provider must transmit both reports to its Digital Services Coordinator of establishment and the Commission without undue delay, and make them public, in a version stripped of confidential information where necessary, at the latest three months after receiving the audit report.

Article 37 sits, like Article 35, in Chapter III Section 5 (Articles 33 to 43), so Article 92's anticipated-application rule applies to it too: the obligation binds a designated very large online platform or search engine from four months after the Commission's notification of that designation, where that date precedes the Regulation's general application date of 17 February 2024.

The Commission's first designations took effect on 25 April 2023 for platforms including Facebook, Instagram, TikTok, and X, so the audit duty began applying to that cohort from 25 August 2023.

Article 5 bans eight AI practices outright: subliminal, manipulative or deceptive techniques that materially distort a person's behaviour and cause or are reasonably likely to cause significant harm; exploiting the vulnerabilities of a person or group due to age, disability, or social or economic situation to the same effect; evaluating or classifying people by social behaviour or personal characteristics in a way that leads to unjustified or unrelated detrimental treatment (social scoring); assessing or predicting a person's risk of committing a crime based solely on profiling or personality traits, unless supporting a human assessment already grounded in objective, verifiable facts; building or expanding facial recognition databases by untargeted scraping of facial images from the internet or CCTV footage; inferring emotions in the workplace or education, except for medical or safety reasons; biometric categorisation to infer race, political opinions, trade union membership, religious or philosophical beliefs, sex life, or sexual orientation, other than any labelling or filtering of lawfully acquired biometric datasets based on biometric data, or categorising of biometric data in the area of law enforcement; and 'real-time' remote biometric identification in publicly accessible spaces for law enforcement, unless a Member State has provided for it in national law and it is strictly necessary for a targeted search for a specific victim or missing person, a specific and imminent threat to life or a genuine terrorist threat, or the localisation or identification of a suspect of an Annex II offence punishable by a custodial sentence or detention order of at least four years' maximum, and, in the ordinary case, only after prior authorisation from a judicial or independent administrative authority and a fundamental rights impact assessment.

Non-compliance with any of these prohibitions is fined up to EUR 35,000,000 or 7% of worldwide annual turnover, whichever is higher, with the lower of the two applying to an SME.

The Regulation gives any natural or legal person a right to lodge a complaint with a market surveillance authority under Article 85, while the Commission's non-binding guidelines on prohibited practices read the prohibitions as having direct effect, so that affected parties can enforce them in national courts and request interim injunctions.

The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026) adds two further prohibited practices, on AI-generated non-consensual intimate imagery and AI-generated or manipulated child sexual abuse material, recorded as a separate instrument because they apply from a later date, 2 December 2026.

The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026) inserts two further prohibited practices into Article 5(1)'s first subparagraph.

Point (ba) bans placing on the market, putting into service, or using an AI system that generates or manipulates realistic intimate imagery, video, audio, or similar material of an identifiable person, or of an identifiable person engaged in sexually explicit activity, without that person's freely given, specific, informed, unambiguous and explicit consent to the generation or manipulation.

Point (bb) bans the same conduct for AI-generated or AI-manipulated child sexual abuse material within the meaning of Directive 2011/93/EU, Article 2, points (c) and (e), unless a 'without right' defence applies under national law.

New paragraph 1a narrows both bans: placing on the market or putting into service is prohibited only where the prohibited generation or manipulation is the system's intended purpose, or where the system's design, training, architecture, capabilities or user-facing functionalities make it a reasonably foreseeable and reproducible outcome, without requiring significant technical modification, and the system lacks reasonable and adequate technical safety measures and other safeguards against it; use is prohibited only where the deployer uses the system for the purpose of generating or manipulating that material.

New paragraph 1b clarifies that manipulating already-existing material in a way that neither increases the exposure of any depicted intimate parts nor alters the nature of any depicted sexually explicit activity is not 'manipulation' for point (ba). Article 113, third paragraph, point (a), as amended, applies these two prohibitions from 2 December 2026, later than the rest of Article 5.

Article 99(3) fines non-compliance up to EUR 35,000,000 or 7% of worldwide annual turnover, whichever is higher, the same tier as the rest of Article 5.

Providers of a high-risk AI system that uses techniques involving the training of AI models must develop it on training, validation and testing data sets that meet the quality criteria in paragraphs 2, 3 and 4 of Article 10 and in Article 4a(1), whenever such data sets are used.

Those data sets must be subject to data governance and management practices appropriate to the system's intended purpose, covering the provider's design choices, how the data was collected and, for personal data, why it was originally collected, data-preparation operations such as annotation, labelling, cleaning, updating, enrichment and aggregation, the assumptions made about what the data measures and represents, an assessment of whether the needed data sets are available, sufficient in quantity and suitable, examination for biases likely to affect health and safety, harm fundamental rights or lead to prohibited discrimination, especially where one operation's outputs become a later operation's inputs, measures to detect, prevent and mitigate any bias found, and identification of data gaps or shortcomings that would prevent compliance, with how they will be addressed.

The data sets must be relevant, sufficiently representative, as free of errors and as complete as possible for the intended purpose, with statistical properties appropriate to the persons or groups the system is intended to be used on, and must take into account the specific geographic, contextual, behavioural or functional setting the system is intended to be used in, to the extent the intended purpose requires it; where the system does not use training techniques, these criteria apply only to its testing data set.

The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026) deleted Article 10(5), which had let a provider exceptionally process special categories of personal data to detect and correct bias. That same permission now sits in a new Article 4a, which also reaches a deployer of a high-risk AI system and a provider or deployer of any other AI system or model.

Article 10 sits in Chapter III, Section 2, so it takes effect on the schedule the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026) wrote into Article 113: 2 December 2027 for a system classified as high-risk under Article 6(2) and Annex III, and 2 August 2028 for a system classified as high-risk under Article 6(1) and Annex I, rather than the Regulation's general 2 August 2026 application date.

Article 10 does not apply to a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.

The technical documentation of a high-risk AI system must be drawn up before the system is placed on the market or put into service, and kept up to date. Article 16, point (a), requires providers of high-risk AI systems to ensure that their systems are compliant with the requirements set out in Chapter III, Section 2, which include Article 11.

The technical documentation must be drawn up so as to demonstrate that the system complies with the requirements of Chapter III, Section 2, and to give national competent authorities and notified bodies the information they need, in a clear and comprehensive form, to assess that compliance, and it must contain at least the elements set out in Annex IV of the Regulation.

As amended by the Digital Omnibus on AI (Regulation (EU) 2026/1744), Article 11(1) lets an SME, including a start-up, or a small mid-cap enterprise (SMC) provide the Annex IV elements in a simplified manner, using the simplified technical documentation form the Commission is to establish for them, and notified bodies must accept that form for the purposes of the conformity assessment.

Where a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section A of Annex I is placed on the market or put into service, a single set of technical documentation must contain both the information Article 11(1) requires and the information those legal acts require.

The Commission may amend Annex IV by delegated act where necessary, in light of technical progress, so that the technical documentation provides all the information needed to assess compliance.

Article 11 sits in Chapter III, Section 2, so it takes effect on the schedule the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026) wrote into Article 113: 2 December 2027 for a system classified as high-risk under Article 6(2) and Annex III, and 2 August 2028 for a system classified as high-risk under Article 6(1) and Annex I, rather than the Regulation's general 2 August 2026 application date.

Under Article 111(2), as the Digital Omnibus on AI rewrote it, the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly; in any case, the providers and deployers of a high-risk AI system intended to be used by public authorities must take the necessary steps to comply with the Regulation's requirements and obligations by 2 August 2030.

Article 11 does not apply to a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.

Article 111(2) grandfathers a high-risk AI system already placed on the market or put into service before Chapter III's application date, exempting it from the Regulation unless it is significantly redesigned after that date; the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026) updated only the grandfather clause's own reference point, from the fixed date of 2 August 2026 to the Chapter III application date itself, now 2 December 2027 or 2 August 2028 depending on classification route.

In any case, the providers and deployers of a high-risk AI system intended to be used by public authorities must take the necessary steps to comply with the Regulation's requirements and obligations by 2 August 2030, whether or not the system is significantly redesigned; that sentence, and the 2 August 2030 date it sets, are unchanged by the Digital Omnibus, appearing in identical substance in both the original 2024 text and the Omnibus's replacement of the paragraph.

Article 13(1) requires high-risk AI systems to be designed and developed in such a way as to ensure that their operation is sufficiently transparent to enable deployers to interpret a system's output and use it appropriately. An appropriate type and degree of transparency must be ensured with a view to achieving compliance with the relevant obligations of the provider and deployer set out in Section 3.

High-risk AI systems must be accompanied by instructions for use in an appropriate digital format or otherwise that include concise, complete, correct and clear information that is relevant, accessible and comprehensible to deployers. Instructions for use means the information provided by the provider to inform the deployer of, in particular, an AI system's intended purpose and proper use.

The instructions for use must contain at least the identity and the contact details of the provider and, where applicable, of its authorised representative, and the characteristics, capabilities and limitations of performance of the system, including its intended purpose and the level of accuracy, robustness and cybersecurity against which it has been tested and validated.

The instructions for use must also cover any known or foreseeable circumstance that may lead to risks to health, safety or fundamental rights, the changes to the system pre-determined by the provider at the initial conformity assessment, the human oversight measures referred to in Article 14, the computational and hardware resources needed and the expected lifetime of the system, and, where relevant, a description of the mechanisms that allow deployers to properly collect, store and interpret the logs in accordance with Article 12.

A provider is a natural or legal person, public authority, agency or other body that develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark, whether for payment or free of charge. The provider carries the Article 13 requirement under Article 16, point (a), which obliges a provider of high-risk AI systems to ensure that they are compliant with the requirements set out in Section 2.

Article 13 sits in Chapter III, Section 2, so it takes effect on the schedule the Digital Omnibus on AI (Regulation (EU) 2026/1744) wrote into Article 113: 2 December 2027 for a system classified as high-risk under Article 6(2) and Annex III, and 2 August 2028 for a system classified as high-risk under Article 6(1) and Annex I, rather than the Regulation's general 2 August 2026 application date.

Under Article 111(2), as the Digital Omnibus on AI rewrote it, the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly; in any case, the providers and deployers of a high-risk AI system intended to be used by public authorities must take the necessary steps to comply with the Regulation's requirements and obligations by 2 August 2030.

Article 13 does not apply to a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.

Providers of a high-risk AI system must design and develop it, including its human-machine interface, so that a natural person can effectively oversee it while it is in use. Human oversight must aim to prevent or minimise the risks to health, safety or fundamental rights that may emerge when the system is used as intended or under reasonably foreseeable misuse, in particular where those risks persist despite the other Section 2 requirements.

The oversight measures must be commensurate with the system's risks, level of autonomy and context of use, built into the system before it is placed on the market or put into service, identified for the deployer to implement, or both, and the system must be provided to the deployer so that the assigned overseers can understand its capacities and limitations, monitor its operation, remain aware of the tendency to over-rely on its output, correctly interpret that output, decide not to use it or to disregard, override or reverse it, and intervene in or halt its operation through a stop mechanism.

For a remote biometric identification system under Annex III point 1(a), the oversight measures must ensure that no action or decision is taken on the identification result unless it has been separately verified and confirmed by at least two natural persons with the necessary competence, training and authority, except where the system serves law enforcement, migration, border control or asylum and Union or national law treats the two-person requirement as disproportionate.

A deployer of a high-risk AI system must separately assign that human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support.

Article 14 sits in Chapter III, Section 2, so it takes effect on the schedule the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026) wrote into Article 113: 2 December 2027 for a system classified as high-risk under Article 6(2) and Annex III, and 2 August 2028 for a system classified as high-risk under Article 6(1) and Annex I, rather than the Regulation's general 2 August 2026 application date.

Under Article 111(2), as the Digital Omnibus on AI rewrote it, the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly; in any case, the providers and deployers of a high-risk AI system intended to be used by public authorities must take the necessary steps to comply with the Regulation's requirements and obligations by 2 August 2030.

Article 14 does not apply to a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.

Providers of a high-risk AI system must design and develop it to achieve an appropriate level of accuracy, robustness and cybersecurity, performing consistently in those respects throughout its lifecycle. The system's accuracy levels and metrics must be declared in its accompanying instructions of use.

The system must be as resilient as possible to errors, faults or inconsistencies, including those arising from its interaction with people or other systems, through technical and organisational measures, and a system that continues to learn after deployment must be developed to eliminate or reduce as far as possible the risk of biased outputs feeding back into future operations, with mitigation measures for any feedback loop that remains.

The system must be resilient against attempts by unauthorised third parties to alter its use, outputs or performance by exploiting vulnerabilities, with technical solutions appropriate to the circumstances and the risk, including, where appropriate, measures against data poisoning, model poisoning, adversarial examples or model evasion, and confidentiality attacks.

A high-risk AI system that is a product with digital elements within the scope of the Cyber Resilience Act (Regulation (EU) 2024/2847), meets that Regulation's essential cybersecurity requirements and has a declaration of conformity under it that demonstrates the level of cybersecurity Article 15 requires is deemed to comply with Article 15's cybersecurity requirement, though no such presumption covers accuracy or robustness.

Article 15 sits in Chapter III, Section 2, so it takes effect on the schedule the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026) wrote into Article 113: 2 December 2027 for a system classified as high-risk under Article 6(2) and Annex III, and 2 August 2028 for a system classified as high-risk under Article 6(1) and Annex I, rather than the Regulation's general 2 August 2026 application date.

Article 15 does not apply to a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.

Article 16 lists the obligations of providers of high-risk AI systems, and most of its points make a duty set out in another Article the provider's own: compliance with the Chapter III, Section 2 requirements (point (a)), a quality management system complying with Article 17 (point (c)), keeping the documentation referred to in Article 18 (point (d)), keeping the logs referred to in Article 19 when they are under the provider's control (point (e)), and the corrective actions and information required by Article 20 (point (j)).

Article 16, points (f) to (i), require the provider to ensure the system undergoes the relevant conformity assessment procedure under Article 43 before it is placed on the market or put into service, to draw up an EU declaration of conformity under Article 47, to affix the CE marking under Article 48, and to comply with the registration obligations of Article 49(1).

Article 16 also requires the provider to indicate its name, registered trade name or registered trade mark and the address at which it can be contacted on the system or, where that is not possible, on its packaging or accompanying documentation (point (b)), to demonstrate the system's conformity with the Section 2 requirements upon a reasoned request of a national competent authority (point (k)), and to ensure the system complies with accessibility requirements in accordance with Directives (EU) 2016/2102 and (EU) 2019/882 (point (l)).

Article 99(4), point (a), sets the administrative fine for non-compliance with the obligations of providers pursuant to Article 16.

Article 16 sits in Chapter III, Section 3, so like Article 12 it takes effect on the schedule the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026) wrote into Article 113: 2 December 2027 for a system classified as high-risk under Article 6(2) and Annex III, and 2 August 2028 for a system classified as high-risk under Article 6(1) and Annex I, rather than the Regulation's general 2 August 2026 application date.

Under Article 111(2), as the Digital Omnibus on AI rewrote it, the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly; in any case, the providers and deployers of a high-risk AI system intended to be used by public authorities must take the necessary steps to comply with the Regulation's requirements and obligations by 2 August 2030.

Article 16 does not apply to a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.

Providers of a high-risk AI system must put a quality management system in place that ensures compliance with the Regulation, documented in a systematic and orderly manner in the form of written policies, procedures and instructions.

The quality management system must include at least a strategy for regulatory compliance, covering conformity assessment and the management of modifications to the system, the techniques and procedures for design, design control and design verification and for development, quality control and quality assurance, examination, test and validation procedures before, during and after development with their frequency, the technical specifications and standards applied, systems and procedures for data management, the Article 9 risk management system, a post-market monitoring system under Article 72, procedures for reporting a serious incident under Article 73, the handling of communication with authorities, notified bodies, other operators, customers and other interested parties, systems and procedures for record-keeping of all relevant documentation and information, resource management, including security-of-supply measures, and an accountability framework for management and other staff.

As amended by the Digital Omnibus on AI (Regulation (EU) 2026/1744), Article 17(2) requires the aspects listed in Article 17(1) to be implemented in proportion to the size of the provider's organization, in particular where the provider is an SME, including a start-up, or a small mid-cap enterprise, and providers must in any event respect the degree of rigor and the level of protection needed for their systems to comply.

Article 63(1), as replaced by the same Regulation, lets an SME, including a start-up, that has no partner enterprises or linked enterprises within the meaning of Recommendation 2003/361/EC comply with certain elements of the quality management system in a simplified manner, under guidelines the Commission is to develop.

The 2024 text of Article 63(1) allowed only microenterprises within the meaning of Recommendation 2003/361/EC to comply with certain elements of the quality management system in a simplified manner. Article 63(2) provides that Article 63(1) does not exempt the operators it covers from any other requirement or obligation of the Regulation, including those in Articles 9, 10, 11, 12, 13, 14, 15, 72 and 73.

A provider already subject to quality management system obligations, or an equivalent function, under relevant sectoral Union law may include the aspects listed in Article 17(1) in the quality management system under that law.

For a provider that is a financial institution subject to internal-governance requirements under Union financial services law, complying with those internal-governance rules is deemed to fulfill the duty to put a quality management system in place, except for the risk management system, the post-market monitoring system and the serious-incident reporting procedures of paragraph 1, points (g), (h) and (i), and harmonised standards referred to in Article 40 are taken into account to that end.

Article 17 sits in Chapter III, Section 3, so like Article 12 it takes effect on the schedule the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026) wrote into Article 113: 2 December 2027 for a system classified as high-risk under Article 6(2) and Annex III, and 2 August 2028 for a system classified as high-risk under Article 6(1) and Annex I, rather than the Regulation's general 2 August 2026 application date.

Under Article 111(2), as the Digital Omnibus on AI rewrote it, the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly; in any case, the providers and deployers of a high-risk AI system intended to be used by public authorities must take the necessary steps to comply with the Regulation's requirements and obligations by 2 August 2030.

Article 17 does not apply to a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.

A provider of a high-risk AI system that considers, or has reason to consider, that a system it has placed on the market or put into service is not in conformity with the Regulation must immediately take the necessary corrective actions to bring it into conformity, withdraw it, disable it or recall it, as appropriate. The provider must inform the distributors of the system and, where applicable, its deployers, the authorised representative and importers accordingly.

Where a high-risk AI system presents a risk within the meaning of Article 79(1) and its provider becomes aware of that risk, the provider must immediately investigate the causes, in collaboration with the reporting deployer where applicable, and inform the market surveillance authorities competent for the system and, where applicable, the notified body that issued a certificate for it under Article 44, in particular of the nature of the non-compliance and of any relevant corrective action taken.

Article 79(1) treats an AI system presenting a risk as a product presenting a risk under Regulation (EU) 2019/1020, in so far as it presents risks to the health or safety, or to fundamental rights, of persons.

Article 20 sits in Chapter III, Section 3, so like Article 12 it takes effect on the schedule the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026) wrote into Article 113: 2 December 2027 for a system classified as high-risk under Article 6(2) and Annex III, and 2 August 2028 for a system classified as high-risk under Article 6(1) and Annex I, rather than the Regulation's general 2 August 2026 application date.

Under Article 111(2), as the Digital Omnibus on AI rewrote it, the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly; in any case, the providers and deployers of a high-risk AI system intended to be used by public authorities must take the necessary steps to comply with the Regulation's requirements and obligations by 2 August 2030.

Article 20 does not apply to a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.

Prior to making their high-risk AI systems available on the Union market, providers established in third countries must, by written mandate, appoint an authorised representative established in the Union. The provider must enable its authorised representative to perform the tasks specified in the mandate received from the provider.

The authorised representative must perform the tasks specified in the mandate and provide a copy of the mandate to the market surveillance authorities upon request, in one of the official languages of the institutions of the Union, as indicated by the competent authority. For the purposes of the Regulation, the mandate empowers the authorised representative to carry out the tasks listed in Article 22(3).

Under Article 22(3), point (a), the mandate empowers the authorised representative to verify that the EU declaration of conformity referred to in Article 47 and the technical documentation referred to in Article 11 have been drawn up and that an appropriate conformity assessment procedure has been carried out by the provider.

Under Article 22(3), point (d), the mandate empowers the authorised representative to cooperate with competent authorities, upon a reasoned request, in any action the latter take in relation to the high-risk AI system, in particular to reduce and mitigate the risks posed by the high-risk AI system.

Under Article 22(3), point (e), the mandate empowers the authorised representative, where applicable, to comply with the registration obligations referred to in Article 49(1), or, if the registration is carried out by the provider itself, to ensure that the information referred to in point 3 of Section A of Annex VIII is correct.

The mandate empowers the authorised representative to be addressed, in addition to or instead of the provider, by the competent authorities, on all issues related to ensuring compliance with the Regulation. The authorised representative must terminate the mandate if it considers or has reason to consider the provider to be acting contrary to its obligations pursuant to the Regulation.

On such a termination, the authorised representative must immediately inform the relevant market surveillance authority, as well as, where applicable, the relevant notified body, about the termination of the mandate and the reasons therefor. Article 22 sits in Chapter III, Section 3, which is headed Obligations of providers and deployers of high-risk AI systems and other parties.

Under Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744, Chapter III, Sections 1, 2 and 3, with the exception of Article 6(5), apply from 2 December 2027 for a system classified as high-risk under Article 6(2) and Annex III, and from 2 August 2028 for a system classified as high-risk under Article 6(1) and Annex I. Under Article 111(2), as the Digital Omnibus on AI rewrote it, the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly; in any case, the providers and deployers of a high-risk AI system intended to be used by public authorities must take the necessary steps to comply with the Regulation's requirements and obligations by 2 August 2030.

For an AI system classified as high-risk under Article 6(1) and related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, Article 2(2), as replaced by Regulation (EU) 2026/1744, applies only Article 6(1), Article 60a and Articles 102 to 112, and applies Articles 57, 58 and 59 only in so far as the requirements for high-risk AI systems under the Regulation have been integrated in that Union harmonisation legislation.

Article 99(6a), inserted by Regulation (EU) 2026/1744, provides that in the case of small mid-cap enterprises each fine referred to in paragraphs 4 and 5 of Article 99 is up to the percentages or amount referred to there, whichever is lower.

Under Article 2(13), inserted by Regulation (EU) 2026/1744, the application of specific requirements or obligations laid down in Articles 9 to 15 and 17 to 25 to a high-risk AI system referred to in Article 6(1) may be limited where and to the extent that Union harmonisation legislation listed in Section A of Annex I lays down requirements or obligations providing an equivalent or higher level of protection of health, safety or fundamental rights, and the limitation does not reduce the overall level of protection provided for by the Regulation.

By 2 August 2027, the Commission is to adopt delegated acts under Article 97 specifying the high-risk AI systems concerned, the requirements or obligations that may be limited, the conditions under which the limitation applies, and the scope of the limitation.

An importer is a natural or legal person located or established in the Union that places on the market an AI system that bears the name or trademark of a natural or legal person established in a third country.

Before placing a high-risk AI system on the market, importers must ensure that the system is in conformity with the Regulation by verifying that the conformity assessment procedure referred to in Article 43 has been carried out by the provider, that the provider has drawn up the technical documentation in accordance with Article 11 and Annex IV, that the system bears the required CE marking and is accompanied by the EU declaration of conformity referred to in Article 47 and instructions for use, and that the provider has appointed an authorised representative in accordance with Article 22(1).

Where an importer has sufficient reason to consider that a high-risk AI system is not in conformity with the Regulation, or is falsified, or accompanied by falsified documentation, it must not place the system on the market until it has been brought into conformity. Where the high-risk AI system presents a risk within the meaning of Article 79(1), the importer must inform the provider of the system, the authorised representative and the market surveillance authorities to that effect.

Importers must indicate their name, registered trade name or registered trade mark, and the address at which they can be contacted on the high-risk AI system and on its packaging or its accompanying documentation, where applicable. Importers must ensure that, while a high-risk AI system is under their responsibility, storage or transport conditions, where applicable, do not jeopardise its compliance with the requirements set out in Section 2.

Importers must keep, for a period of 10 years after the high-risk AI system has been placed on the market or put into service, a copy of the certificate issued by the notified body, where applicable, of the instructions for use, and of the EU declaration of conformity referred to in Article 47.

Importers must provide the relevant competent authorities, upon a reasoned request, with all the necessary information and documentation, including that referred to in paragraph 5, to demonstrate the conformity of a high-risk AI system with the requirements set out in Section 2 in a language which can be easily understood by them, and must also ensure that the technical documentation can be made available to those authorities.

Importers must cooperate with the relevant competent authorities in any action those authorities take in relation to a high-risk AI system placed on the market by the importers, in particular to reduce and mitigate the risks posed by it. Article 23 sits in Chapter III, Section 3, which is headed Obligations of providers and deployers of high-risk AI systems and other parties.

Under Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744, Chapter III, Sections 1, 2 and 3, with the exception of Article 6(5), apply from 2 December 2027 for a system classified as high-risk under Article 6(2) and Annex III, and from 2 August 2028 for a system classified as high-risk under Article 6(1) and Annex I. Under Article 111(2), as the Digital Omnibus on AI rewrote it, the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly; in any case, the providers and deployers of a high-risk AI system intended to be used by public authorities must take the necessary steps to comply with the Regulation's requirements and obligations by 2 August 2030.

For an AI system classified as high-risk under Article 6(1) and related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, Article 2(2), as replaced by Regulation (EU) 2026/1744, applies only Article 6(1), Article 60a and Articles 102 to 112, and applies Articles 57, 58 and 59 only in so far as the requirements for high-risk AI systems under the Regulation have been integrated in that Union harmonisation legislation.

Article 99(6a), inserted by Regulation (EU) 2026/1744, provides that in the case of small mid-cap enterprises each fine referred to in paragraphs 4 and 5 of Article 99 is up to the percentages or amount referred to there, whichever is lower.

Under Article 2(13), inserted by Regulation (EU) 2026/1744, the application of specific requirements or obligations laid down in Articles 9 to 15 and 17 to 25 to a high-risk AI system referred to in Article 6(1) may be limited where and to the extent that Union harmonisation legislation listed in Section A of Annex I lays down requirements or obligations providing an equivalent or higher level of protection of health, safety or fundamental rights, and the limitation does not reduce the overall level of protection provided for by the Regulation.

By 2 August 2027, the Commission is to adopt delegated acts under Article 97 specifying the high-risk AI systems concerned, the requirements or obligations that may be limited, the conditions under which the limitation applies, and the scope of the limitation.

A distributor is a natural or legal person in the supply chain, other than the provider or the importer, that makes an AI system available on the Union market.

Before making a high-risk AI system available on the market, distributors must verify that it bears the required CE marking, that it is accompanied by a copy of the EU declaration of conformity referred to in Article 47 and instructions for use, and that the provider and the importer of that system, as applicable, have complied with their respective obligations as laid down in Article 16, points (b) and (c) and Article 23(3).

Where a distributor considers or has reason to consider, on the basis of the information in its possession, that a high-risk AI system is not in conformity with the requirements set out in Section 2, it must not make the system available on the market until the system has been brought into conformity with those requirements.

Where the high-risk AI system presents a risk within the meaning of Article 79(1), the distributor must also inform the provider or the importer of the system, as applicable, to that effect. Distributors must ensure that, while a high-risk AI system is under their responsibility, storage or transport conditions, where applicable, do not jeopardise the compliance of the system with the requirements set out in Section 2.

A distributor that considers or has reason to consider, on the basis of the information in its possession, that a high-risk AI system which it has made available on the market is not in conformity with the requirements set out in Section 2 must take the corrective actions necessary to bring that system into conformity with those requirements, to withdraw it or recall it, or must ensure that the provider, the importer or any relevant operator, as appropriate, takes those corrective actions.

Where such a system presents a risk within the meaning of Article 79(1), the distributor must immediately inform the provider or importer of the system and the authorities competent for the high-risk AI system concerned, giving details, in particular, of the non-compliance and of any corrective actions taken.

Upon a reasoned request from a relevant competent authority, distributors of a high-risk AI system must provide that authority with all the information and documentation regarding their actions pursuant to paragraphs 1 to 4 necessary to demonstrate the conformity of that system with the requirements set out in Section 2.

Distributors must cooperate with the relevant competent authorities in any action those authorities take in relation to a high-risk AI system made available on the market by the distributors, in particular to reduce or mitigate the risk posed by it. Article 24 sits in Chapter III, Section 3, which is headed Obligations of providers and deployers of high-risk AI systems and other parties.

Under Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744, Chapter III, Sections 1, 2 and 3, with the exception of Article 6(5), apply from 2 December 2027 for a system classified as high-risk under Article 6(2) and Annex III, and from 2 August 2028 for a system classified as high-risk under Article 6(1) and Annex I. Under Article 111(2), as the Digital Omnibus on AI rewrote it, the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly; in any case, the providers and deployers of a high-risk AI system intended to be used by public authorities must take the necessary steps to comply with the Regulation's requirements and obligations by 2 August 2030.

For an AI system classified as high-risk under Article 6(1) and related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, Article 2(2), as replaced by Regulation (EU) 2026/1744, applies only Article 6(1), Article 60a and Articles 102 to 112, and applies Articles 57, 58 and 59 only in so far as the requirements for high-risk AI systems under the Regulation have been integrated in that Union harmonisation legislation.

Article 99(6a), inserted by Regulation (EU) 2026/1744, provides that in the case of small mid-cap enterprises each fine referred to in paragraphs 4 and 5 of Article 99 is up to the percentages or amount referred to there, whichever is lower.

Under Article 2(13), inserted by Regulation (EU) 2026/1744, the application of specific requirements or obligations laid down in Articles 9 to 15 and 17 to 25 to a high-risk AI system referred to in Article 6(1) may be limited where and to the extent that Union harmonisation legislation listed in Section A of Annex I lays down requirements or obligations providing an equivalent or higher level of protection of health, safety or fundamental rights, and the limitation does not reduce the overall level of protection provided for by the Regulation.

By 2 August 2027, the Commission is to adopt delegated acts under Article 97 specifying the high-risk AI systems concerned, the requirements or obligations that may be limited, the conditions under which the limitation applies, and the scope of the limitation.

Article 25 decides who counts as the provider of a high-risk AI system along its supply chain. A distributor, importer, deployer, or other third party is treated as the provider, and takes on the Article 16 provider obligations, if it puts its own name or trademark on a high-risk system already on the market, makes a substantial modification that keeps it high-risk, or changes an AI system's intended purpose so it becomes high-risk.

As amended by the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026), paragraph 2 then requires the initial provider to closely cooperate with the new provider, in particular by making available technical documentation sufficient to assess Article 16 compliance, informing the new provider of known limitations and failure modes, and providing targeted technical access, including for testing and validation, unless the initial provider clearly specified that its system was not to be changed into a high-risk one.

A product manufacturer is treated as the provider where a high-risk AI system is a safety component placed on the market or put into service under the manufacturer's own name or trademark.

Paragraph 4, also amended by the Digital Omnibus to add 'AI model' to the list of what a third party may supply, requires the provider of a high-risk AI system and a third party supplying an AI system, AI model, tool, service, component, or process the system integrates to specify by written agreement the necessary information, technical access, and other assistance, unless the component is supplied under a free and open-source licence by a party other than a general-purpose AI model provider.

The Digital Omnibus inserted Article 99(4), point (da), fining non-compliance with the paragraph 2 and paragraph 4 obligations up to EUR 15,000,000 or 3% of worldwide annual turnover, whichever is higher, with the lower of the two for an SME or a small mid-cap enterprise.

Article 25 sits in Chapter III, Section 3, so like Articles 12, 19, 21 and 26 it takes effect on the schedule the Digital Omnibus wrote into Article 113: 2 December 2027 for a system classified as high-risk under Article 6(2) and Annex III, and 2 August 2028 for one classified under Article 6(1) and Annex I. Under Article 111(2), as the Digital Omnibus on AI rewrote it, the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly; in any case, the providers and deployers of a high-risk AI system intended to be used by public authorities must take the necessary steps to comply with the Regulation's requirements and obligations by 2 August 2030.

Article 25 does not apply to a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.

A deployer of a high-risk AI system must take appropriate technical and organisational measures to ensure it uses the system in accordance with the instructions for use accompanying it. That duty, and the deployer's duty to assign human oversight, are without prejudice to other deployer obligations under Union or national law and to the deployer's freedom to organise its own resources and activities for the purpose of implementing the human oversight measures the provider indicated.

A deployer of a high-risk AI system must assign human oversight of the system to natural persons who have the necessary competence, training and authority, as well as the necessary support. Without prejudice to a deployer's duties to use a high-risk AI system per its instructions and to assign human oversight, a deployer that exercises control over a high-risk AI system's input data must ensure that input data is relevant and sufficiently representative in view of the system's intended purpose.

A deployer of a high-risk AI system must monitor its operation on the basis of the instructions for use and, where relevant, inform the provider of that monitoring.

Where a deployer has reason to consider that using the system per its instructions may present a risk to health, safety or fundamental rights, it must, without undue delay, inform the provider or distributor and the relevant market surveillance authority, and suspend use of the system; where it has identified a serious incident, it must immediately inform the provider and then the importer or distributor and the relevant market surveillance authorities.

The duty does not cover sensitive operational data of a law-enforcement deployer, and a deployer that is a financial institution subject to Union financial-services internal-governance rules satisfies it by complying with those rules.

Article 26 sits in Chapter III, Section 3, so like the other deployer duties in this article it takes effect on the schedule the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026) wrote into Article 113: 2 December 2027 for a system classified as high-risk under Article 6(2) and Annex III, and 2 August 2028 for one classified under Article 6(1) and Annex I. Under Article 111(2), as the Digital Omnibus on AI rewrote it, the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly; in any case, the providers and deployers of a high-risk AI system intended to be used by public authorities must take the necessary steps to comply with the Regulation's requirements and obligations by 2 August 2030.

Article 26(1) to (5) do not apply to a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.

In the framework of a targeted search for a suspected or convicted person, a law-enforcement deployer of a high-risk AI system for post-remote biometric identification must request authorisation, in advance or without undue delay and no later than 48 hours, from a judicial authority or a binding, judicially reviewable administrative authority, except when the system is used for the initial identification of a potential suspect on objective and verifiable facts directly linked to the offence.

Use is limited to what is strictly necessary for a specific criminal investigation; a rejected authorisation request stops the linked use immediately and requires deletion of the personal data it used; untargeted use unconnected to a specific offence, proceeding or threat is never permitted; and no adverse legal decision may rest solely on such a system's output.

Every use must be documented in the relevant police file and made available to the market surveillance authority and the national data protection authority on request, and deployers must submit annual reports on their use of post-remote biometric identification systems.

Article 26 sits in Chapter III, Section 3, so it takes effect on the schedule the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026) wrote into Article 113: 2 December 2027 for a system classified as high-risk under Article 6(2) and Annex III, and 2 August 2028 for one classified under Article 6(1) and Annex I. Under Article 111(2), as the Digital Omnibus on AI rewrote it, the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly; in any case, the providers and deployers of a high-risk AI system intended to be used by public authorities must take the necessary steps to comply with the Regulation's requirements and obligations by 2 August 2030.

Article 26(10) does not apply to a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.

Recitals (40) and (41) record that, to the extent Article 26(10) relates to the processing of personal data by Member States in activities within Chapter 4 or Chapter 5 of Title V of Part Three of the TFEU, Denmark is not bound by it under Protocol No 22, and Ireland is not bound by it under Protocol No 21 where Ireland is not bound by the rules governing the forms of judicial cooperation in criminal matters or police cooperation that require compliance with provisions laid down on the basis of Article 16 TFEU.

Without prejudice to the Article 50 transparency duties, a deployer of a high-risk AI system listed in Annex III that makes a decision, or assists in making one, about a natural person must inform that person that they are subject to the use of the high-risk AI system. For a system used for law-enforcement purposes, Article 13 of the Law Enforcement Directive applies instead.

This individual-notification duty reaches the whole Annex III catalogue, including the Annex III point 4 employment use cases and the Annex III point 8(a) administration-of-justice use case. Article 26 sits in Chapter III, Section 3, so it takes effect on the schedule the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026) wrote into Article 113: 2 December 2027 for a system classified as high-risk under Article 6(2) and Annex III.

Article 26(11) reaches only a high-risk AI system referred to in Annex III, so the later date in that schedule for a system classified under Article 6(1) and Annex I brings no further system within it.

Under Article 111(2), as the Digital Omnibus on AI rewrote it, the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly; in any case, the providers and deployers of a high-risk AI system intended to be used by public authorities must take the necessary steps to comply with the Regulation's requirements and obligations by 2 August 2030.

Article 26(11) does not apply to a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.

Before putting into service or using a high-risk AI system at the workplace, a deployer that is an employer must inform workers' representatives and the affected workers that they will be subject to the use of the high-risk AI system, following, where applicable, the rules and procedures on informing workers and their representatives that Union and national law and practice already lay down.

The duty reaches, but is not limited to, the Annex III point 4 high-risk employment use cases (recruitment, evaluation of candidates, and decisions on the terms, promotion or termination of a work-related relationship).

Article 26 sits in Chapter III, Section 3, so it takes effect on the schedule the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026) wrote into Article 113: 2 December 2027 for a system classified as high-risk under Article 6(2) and Annex III, and 2 August 2028 for one classified under Article 6(1) and Annex I. Under Article 111(2), as the Digital Omnibus on AI rewrote it, the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly; in any case, the providers and deployers of a high-risk AI system intended to be used by public authorities must take the necessary steps to comply with the Regulation's requirements and obligations by 2 August 2030.

Article 26(7) does not apply to a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.

Before deploying a high-risk AI system classified under Article 6(2), other than an Annex III point 2 (critical infrastructure) system, a deployer that is a body governed by public law, a private entity providing a public service, or a deployer of an Annex III point 5(b) or (c) system (creditworthiness or life and health insurance risk assessment) must assess the impact the system's use may have on fundamental rights.

That assessment covers the deployer's intended process, the period and frequency of use, the categories of people likely affected, the specific risks of harm to them, the human oversight measures in place, and the measures planned if those risks materialise, including complaint and internal-governance arrangements. The assessment is required on first use, may draw on a similar prior assessment, and must be updated if a described element changes.

Once performed, the deployer must notify the market surveillance authority of the results on the AI Office's template, with a possible exemption in the case referred to in Article 46(1), where a market surveillance authority has authorised a specific high-risk AI system to be placed on the market or put into service for exceptional reasons such as public security or the protection of life and health; and where the deployer's data protection impact assessment under Article 35 General Data Protection Regulation (GDPR) or Article 27 of the Law Enforcement Directive already covers an element of this assessment, this one only needs to complement it.

Article 27 sits in Chapter III, Section 3, so it takes effect on the schedule the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026) wrote into Article 113: 2 December 2027 for a system classified as high-risk under Article 6(2) and Annex III. Article 27 reaches only a high-risk AI system referred to in Article 6(2), so the later date in that schedule for a system classified under Article 6(1) and Annex I brings no further system within it.

Under Article 111(2), as the Digital Omnibus on AI rewrote it, the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly; in any case, the providers and deployers of a high-risk AI system intended to be used by public authorities must take the necessary steps to comply with the Regulation's requirements and obligations by 2 August 2030.

Article 27 does not apply to a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.

Article 16, point (f), obliges the provider of a high-risk AI system to ensure that it undergoes the relevant conformity assessment procedure referred to in Article 43, prior to its being placed on the market or put into service. A provider is a natural or legal person, public authority, agency or other body that develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark, whether for payment or free of charge.

For high-risk AI systems listed in point 1 of Annex III, where the provider has applied the harmonised standards referred to in Article 40, or, where applicable, the common specifications referred to in Article 41, in demonstrating compliance with the Section 2 requirements, the provider must opt for either the internal control procedure of Annex VI or the assessment of the quality management system and of the technical documentation with the involvement of a notified body under Annex VII.

The provider must follow the Annex VII procedure where harmonised standards do not exist and common specifications are not available, where the provider has not applied, or has applied only part of, the harmonised standard, where it has not applied existing common specifications, or, as to the restricted part, where a harmonised standard has been published with a restriction.

For the Annex VII procedure the provider may choose any of the notified bodies, but where the high-risk AI system is intended to be put into service by law enforcement, immigration or asylum authorities or by Union institutions, bodies, offices or agencies, the market surveillance authority referred to in Article 74(8) or (9), as applicable, acts as a notified body.

For high-risk AI systems referred to in points 2 to 8 of Annex III, providers must follow the conformity assessment procedure based on internal control referred to in Annex VI, which does not provide for the involvement of a notified body.

Regulation (EU) 2026/1744 replaced Article 43(3), so that for high-risk AI systems covered by the Union harmonisation legislation listed in Section A of Annex I the provider of the system follows the relevant conformity assessment procedure as required in accordance with that legislation, and the Section 2 requirements apply to those systems and are part of that assessment.

Where a high-risk AI system is both covered by the Union harmonisation legislation listed in Section A of Annex I and within one of the categories listed in Annex III, the provider follows the conformity assessment procedure required pursuant to that Section A legislation.

A high-risk AI system that has already been subject to a conformity assessment procedure must undergo a new one in the event of a substantial modification, regardless of whether the modified system is intended to be further distributed or continues to be used by the current deployer.

For a system that continues to learn after being placed on the market or put into service, changes pre-determined by the provider at the moment of the initial conformity assessment and set out in the technical documentation referred to in point 2(f) of Annex IV do not constitute a substantial modification.

Under Annex VI the provider verifies that the established quality management system complies with the requirements of Article 17, examines the information in the technical documentation to assess the system's compliance with the Chapter III, Section 2 requirements, and verifies that the design and development process and the post-market monitoring referred to in Article 72 are consistent with the technical documentation.

Annex VII provides for the approved quality management system to be examined and to be subject to surveillance, and for the technical documentation of the AI system to be examined. Under Annex VII, point 5.3, the notified body carries out periodic audits to make sure that the provider maintains and applies the quality management system and provides the provider with an audit report.

For the assessment the provider must allow the notified body to access the premises where the design, development and testing of the AI systems take place and share with it all necessary information. The provider must inform the notified body that issued the Union technical documentation assessment certificate of its intention to introduce a change to the AI system that could affect compliance with the requirements or its intended purpose, or if it otherwise becomes aware of such a change.

Article 113 gives application dates of their own to Chapters I and II, Chapter III Section 4, Chapter V, Chapter VII, Chapter XII, Article 78 and Article 6(1), and none to Chapter III Section 5, in which Article 43 sits.

The Digital Omnibus on AI (Regulation (EU) 2026/1744) wrote into Article 113 that Chapter III, Sections 1, 2 and 3, which hold the Article 6 classification rules and the Article 16 provider obligations, apply from 2 December 2027 to a system classified as high-risk under Article 6(2) and Annex III and from 2 August 2028 to one classified under Article 6(1) and Annex I. Under Article 111(2), as the Digital Omnibus on AI rewrote it, the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly; in any case, the providers and deployers of a high-risk AI system intended to be used by public authorities must take the necessary steps to comply with the Regulation's requirements and obligations by 2 August 2030.

Recital 39 of Regulation (EU) 2026/1744 says that any significant change to the design of that AI system after the date specified in Article 111(2) should trigger the obligation of the provider to fully comply with all relevant provisions of the Regulation applicable to high-risk AI systems, including the conformity assessment requirements.

Article 6(1) makes an AI system high-risk where both of two conditions are fulfilled: the AI system is intended to be used as a safety component of a product, or is itself a product, covered by the Union harmonisation legislation listed in Annex I, and that product is required to undergo a third-party conformity assessment, with a view to its placing on the market or putting into service, pursuant to that legislation.

The classification applies irrespective of whether the AI system is placed on the market or put into service independently of those products. Annex I, Section A, lists Union harmonisation legislation based on the New Legislative Framework. As amended by Regulation (EU) 2026/1744, point 1 of Annex I, Section A, is deleted and Section B gains point 21, Regulation (EU) 2023/1230 on machinery.

For an AI system classified as high-risk under Article 6(1) and related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, Article 2(2), as replaced by Regulation (EU) 2026/1744, applies only Article 6(1), Article 60a and Articles 102 to 112, and applies Articles 57, 58 and 59 only in so far as the requirements for high-risk AI systems under the Regulation have been integrated in that Union harmonisation legislation.

Article 3, point (14), as amended by Regulation (EU) 2026/1744, defines a safety component as a component of a product or of an AI system which fulfils a safety function for that product or AI system, or the failure or malfunctioning of which endangers the health and safety of persons or property, and a component fulfils a safety function where its intended purpose is to prevent or mitigate risks to health and safety of persons or property.

Article 6(1a), inserted by Regulation (EU) 2026/1744, provides that AI systems solely used for non-safety related aspects of user assistance, performance optimisation, service efficiency, automation or convenience or quality control do not qualify as safety components. Article 6(1b), inserted by Regulation (EU) 2026/1744, provides that, notwithstanding paragraph 1a, AI systems the failure or malfunctioning of which would endanger health and safety qualify as safety components.

Article 6(1c), inserted by Regulation (EU) 2026/1744, provides that a product required to undergo a third-party conformity assessment solely due to risks other than risks to health and safety, in particular risks relating to the distribution of radio spectrum or electromagnetic interference that do not affect health and safety, is not considered as fulfilling the condition in Article 6(1), point (b).

A provider is a natural or legal person, public authority, agency or other body that develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark, whether for payment or free of charge. Article 16 sets out the obligations of providers of high-risk AI systems, the first of which is to ensure that their high-risk AI systems are compliant with the requirements set out in Section 2.

For a high-risk AI system covered by the Union harmonisation legislation listed in Section A of Annex I, Article 43(3), as replaced by Regulation (EU) 2026/1744, requires the provider to follow the relevant conformity assessment procedure required in accordance with that legislation, and the Section 2 requirements apply to the system and are part of that assessment.

Under Article 2(13), inserted by Regulation (EU) 2026/1744, the application of specific requirements or obligations laid down in Articles 9 to 15 and 17 to 25 to a high-risk AI system referred to in Article 6(1) may be limited where and to the extent that Union harmonisation legislation listed in Section A of Annex I lays down requirements or obligations providing an equivalent or higher level of protection of health, safety or fundamental rights, and the limitation does not reduce the overall level of protection provided for by the Regulation.

By 2 August 2027, the Commission is to adopt delegated acts under Article 97 specifying the high-risk AI systems concerned, the requirements or obligations that may be limited, the conditions under which the limitation applies, and the scope of the limitation. Article 6 sits in Chapter III, Section 1, which is headed Classification of AI systems as high-risk.

Under Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744, Chapter III, Sections 1, 2 and 3, with the exception of Article 6(5), apply from 2 December 2027 for a system classified as high-risk under Article 6(2) and Annex III, and from 2 August 2028 for a system classified as high-risk under Article 6(1) and Annex I. Under the original text of Article 113, Article 6(1) and the corresponding obligations applied from 2 August 2027.

Under Article 111(2), as the Digital Omnibus on AI rewrote it, the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly; in any case, the providers and deployers of a high-risk AI system intended to be used by public authorities must take the necessary steps to comply with the Regulation's requirements and obligations by 2 August 2030.

Article 99(6a), inserted by Regulation (EU) 2026/1744, provides that in the case of small mid-cap enterprises each fine referred to in paragraphs 4 and 5 of Article 99 is up to the percentages or amount referred to there, whichever is lower.

Annex III, point 5(b), lists AI systems intended to be used to evaluate the creditworthiness of natural persons or establish their credit score, with the exception of AI systems used for the purpose of detecting financial fraud. Under Article 6(2), the AI systems referred to in Annex III are considered high-risk, in addition to those referred to in Article 6(1).

A provider is a natural or legal person, public authority, agency or other body that develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark, whether for payment or free of charge. Article 16 obliges the provider of a high-risk AI system to ensure that the system complies with the requirements set out in Section 2 and to have a quality management system in place that complies with Article 17.

Article 16 also obliges the provider to keep the documentation referred to in Article 18 and, when under its control, the logs referred to in Article 19, and to ensure that the system undergoes the relevant conformity assessment procedure referred to in Article 43 before it is placed on the market or put into service.

Article 16 further obliges the provider to draw up an EU declaration of conformity, to affix the CE marking, to comply with the registration obligations referred to in Article 49(1), to take the necessary corrective actions and provide information as required in Article 20, and to demonstrate the conformity of the system with the Section 2 requirements upon a reasoned request of a national competent authority.

For an AI system referred to in points 2 to 8 of Annex III, which includes point 5(b), Article 43(2) requires the provider to follow the conformity assessment procedure based on internal control referred to in Annex VI, which does not provide for the involvement of a notified body.

Notwithstanding the Article 6(3) derogation, an AI system referred to in Annex III is always considered high-risk where it performs profiling of natural persons, so the derogation cannot take a point 5(b) system out of the high-risk class if the system performs that profiling. Profiling means profiling as defined in Article 4, point (4), of Regulation (EU) 2016/679.

Recital 58 adds that AI systems provided for by Union law for the purpose of detecting fraud in the offering of financial services and for prudential purposes to calculate credit institutions' and insurance undertakings' capital requirements should not be considered to be high-risk under the Regulation.

Annex III classification under Article 6(2) and the Article 16 obligations of the provider sit in Chapter III, Sections 1 and 3, so they take effect on the schedule the Digital Omnibus on AI (Regulation (EU) 2026/1744) wrote into Article 113: 2 December 2027 for a system classified as high-risk under Article 6(2) and Annex III.

The later date of 2 August 2028 for a system classified under Article 6(1) and Annex I brings no further system within a point 5(b) classification, which sits in Annex III.

Under Article 111(2), as the Digital Omnibus on AI rewrote it, the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly; in any case, the providers and deployers of a high-risk AI system intended to be used by public authorities must take the necessary steps to comply with the Regulation's requirements and obligations by 2 August 2030.

By derogation from the default rule that every AI system listed in Annex III is high-risk, Article 6(3) provides that an Annex III system is not high-risk where it does not pose a significant risk of harm to health, safety, or fundamental rights, including by not materially influencing a decision's outcome, and it performs only a narrow procedural task, improves the result of a previously completed human activity, detects deviations from prior human decision-making patterns and is not meant to replace or influence the previously completed human assessment without proper human review, or performs a preparatory task to an Annex III assessment; a system that profiles natural persons is always high-risk regardless.

A provider who relies on this derogation must document the assessment before placing the system on the market or putting it into service, is subject to the Article 49(2) EU database registration obligation, and must provide the documentation of the assessment to national competent authorities on request.

Article 6 sits in Chapter III, Section 1, so like Articles 9, 10, 12, 14, 15, 19, 21 and 26 it takes effect on the schedule the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026) wrote into Article 113: 2 December 2027 for a system classified as high-risk under Article 6(2) and Annex III, the only route this provision concerns, rather than the Regulation's general 2 August 2026 application date.

Article 6(5), the Commission's duty to publish classification guidelines by 2 February 2026, is expressly excluded from that deferral.

Under Article 111(2), as the Digital Omnibus on AI rewrote it, the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly; in any case, the providers and deployers of a high-risk AI system intended to be used by public authorities must take the necessary steps to comply with the Regulation's requirements and obligations by 2 August 2030.

Article 6(3) and (4) do not apply to a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.

Providers of a high-risk AI system must establish and document a post-market monitoring system in a manner proportionate to the nature of the AI technologies and the risks of the system.

The post-market monitoring system must actively and systematically collect, document and analyze relevant data on the performance of high-risk AI systems throughout their lifetime, provided by deployers or collected through other sources, which allow the provider to evaluate the continuous compliance of the systems with the requirements set out in Chapter III, Section 2.

Where relevant, post-market monitoring must include an analysis of the interaction with other AI systems, and the obligation does not cover sensitive operational data of deployers that are law-enforcement authorities.

The Regulation defines a post-market monitoring system as all activities carried out by providers of AI systems to collect and review experience gained from the use of the AI systems they place on the market or put into service, to identify any need to immediately apply any necessary corrective or preventive actions.

As amended by the Digital Omnibus on AI (Regulation (EU) 2026/1744), Article 72(3) bases the post-market monitoring system on a post-market monitoring plan that forms part of the technical documentation referred to in Annex IV, and requires the Commission, taking utmost account of the opinion of the Board, to adopt guidance, including a template, on that plan by 2 September 2027.

The 2024 text of Article 72(3) instead required the Commission to adopt an implementing act establishing a template for the post-market monitoring plan and the list of elements to be included in the plan by 2 February 2026. Recital 41 of Regulation (EU) 2026/1744 describes the change to Article 72(3) as the removal of the empowerment to adopt a harmonised template for a post-market monitoring plan, and calls the template the Commission's guidance is to include a voluntary template.

For a high-risk AI system covered by the Union harmonisation legislation listed in Section A of Annex I, where a post-market monitoring system and plan are already established under that legislation, the provider may integrate the necessary elements of Article 72(1) to (3), using the template referred to in Article 72(3), into the existing system and plan, provided that achieves an equivalent level of protection, and the same choice applies to a high-risk AI system referred to in point 5 of Annex III placed on the market or put into service by a financial institution subject to internal-governance requirements under Union financial services law.

Article 72 sits in Chapter IX, which keeps the Regulation's general application date of 2 August 2026, but its duty falls on providers of high-risk AI systems, and the Digital Omnibus moved Chapter III, Sections 1 to 3, which hold the Article 6 rules that classify a system as high-risk, to 2 December 2027 for a system classified under Article 6(2) and Annex III and to 2 August 2028 for one classified under Article 6(1) and Annex I. The Omnibus also rewrote Article 111(2) so that the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly, so no provider of a system placed on the market or put into service is bound by Article 72 before 2 December 2027; the providers and deployers of a system intended for use by public authorities must take the necessary steps to comply by 2 August 2030.

Article 72 does not apply to a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.

Providers of high-risk AI systems placed on the EU market must report a serious incident to the market surveillance authority of the Member State where it occurred. The report is due immediately after the provider establishes a causal link between the AI system and the incident, or the reasonable likelihood of one, and in any event not later than 15 days after becoming aware of it.

For a widespread infringement or a serious incident causing a serious and irreversible disruption to critical infrastructure, the report is due immediately and not later than 2 days after becoming aware of it. Where the incident caused a person's death, the report is due immediately after the provider or deployer establishes, or suspects, a causal relationship, but not later than 10 days after becoming aware of it.

Where necessary for timely reporting, the provider, or deployer where applicable, may file an initial report that is incomplete, followed by a complete report. Under Article 26(5), a deployer who identifies a serious incident must immediately inform the provider first, then the importer or distributor and the market surveillance authority, and reports directly under the same rules if the provider cannot be reached.

That deployer duty does not cover sensitive operational data of a deployer that is a law enforcement authority. After reporting, the provider must without delay carry out the necessary investigations, including a risk assessment of the incident and corrective action, must cooperate with the competent authorities, and must not run any investigation that alters the AI system in a way that could affect a later evaluation of the causes before telling those authorities.

Where the provider of an Annex III high-risk system is already subject to Union instruments laying down equivalent reporting obligations, notification is limited to incidents that infringe obligations under Union law intended to protect fundamental rights.

Where the high-risk AI system is, or is a safety component of, a device covered by Regulation (EU) 2017/745 or (EU) 2017/746, notification is limited to that same class of incident and goes to the national competent authority the Member State where the incident occurred chose for that purpose, rather than to its market surveillance authority.

The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026) inserted a new Article 75(1a) requiring a provider of a high-risk AI system within the AI Office's exclusive supervisory competence to report a serious incident to the AI Office instead, with Article 73(2) to (9) applying in the same way.

That competence under Article 75(1) covers an AI system based on a general-purpose AI model where the model and the system are developed by the same provider or by providers forming part of the same undertaking, subject to listed exceptions, and an AI system that constitutes or is integrated into a very large online platform or very large online search engine designated under Regulation (EU) 2022/2065.

Article 73 sits in Chapter IX, which keeps the Regulation's general application date of 2 August 2026, but its duty falls on providers of high-risk AI systems placed on the Union market, and the Digital Omnibus moved Chapter III, Sections 1 to 3, which hold the Article 6 rules that classify a system as high-risk, to 2 December 2027 for a system classified under Article 6(2) and Annex III and to 2 August 2028 for one classified under Article 6(1) and Annex I. The Omnibus also rewrote Article 111(2) so that the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly, which means no provider of a system placed on the market or put into service owes a report under this Article before 2 December 2027; the providers and deployers of a system intended for use by public authorities must take the necessary steps to comply by 2 August 2030.

Testing a high-risk AI system in real-world conditions outside an AI regulatory sandbox is not placing it on the market, and Article 60(7), in Chapter VI, which applies from 2 August 2026, requires a serious incident identified in the course of that testing to be reported to the national market surveillance authority in accordance with Article 73.

Any natural or legal person having grounds to consider that there has been an infringement of the provisions of the Regulation may submit complaints to the relevant market surveillance authority, without prejudice to other administrative or judicial remedies.

Complaints submitted under Article 85 are taken into account for the purpose of conducting market surveillance activities and are handled in line with the dedicated procedures the market surveillance authorities have established for them, in accordance with Regulation (EU) 2019/1020. Article 85 sits in Chapter IX, to which Article 113 gives no date of its own, so it applies from the Regulation's general application date of 2 August 2026.

Regulation (EU) 2026/1744 replaced points (a) and (c) of Article 113's third paragraph and added point (d), and none of them names Chapter IX.

A natural person subject to a deployer's decision based on the output of a high-risk AI system listed in Annex III, other than an Annex III point 2 (critical infrastructure) system, that produces legal effects or similarly significantly affects them in a way they consider to adversely impact their health, safety or fundamental rights, has the right to obtain from the deployer a clear and meaningful explanation of the role the AI system played in the decision-making procedure and the main elements of the decision taken.

The right does not apply where Union or national law, consistent with Union law, provides an exception or restriction, and it applies only to the extent no other provision of Union law already grants an equivalent right.

Article 86 sits in Chapter IX, Section 4 (remedies), which keeps the Regulation's general application date of 2 August 2026, but the right reaches only decisions based on a high-risk system listed in Annex III, and the Digital Omnibus on AI (Regulation (EU) 2026/1744) moved Chapter III, Sections 1 to 3, which hold the Article 6(2) rule that classifies an Annex III system as high-risk, to 2 December 2027.

The Omnibus also rewrote Article 111(2) so that the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before that date only if, from that date, the system's design changes significantly, which means no deployer of a system placed on the market or put into service owes an explanation under this Article before 2 December 2027; the providers and deployers of a system intended for use by public authorities must take the necessary steps to comply by 2 August 2030.

Providers of a high-risk AI system must establish, implement, document and maintain a risk management system for it, run as a continuous process across the system's whole lifecycle with regular review and updating, covering the identification and analysis of known and reasonably foreseeable risks to health, safety or fundamental rights, the estimation and evaluation of risks under intended use and reasonably foreseeable misuse, the evaluation of other risks surfaced by post-market monitoring, and the adoption of targeted risk management measures for the risks identified.

Those measures must bring residual risk, per hazard and overall, to an acceptable level, first by eliminating or reducing risk through design and development where technically feasible, then by mitigating what cannot be eliminated, then by providing required information and, where appropriate, deployer training, taking the deployer's likely expertise and context of use into account.

The system must be tested throughout development and, in any event, before it is placed on the market or put into service, against pre-defined metrics and probabilistic thresholds, to confirm the measures work and the system performs consistently for its intended purpose, and testing may draw on real-world testing under Article 60.

A provider must also consider whether the system is likely to adversely affect persons under 18 or other vulnerable groups when implementing this process, and a provider already bound by an internal risk-management regime under other Union law, for example as a manufacturer of a device under Annex I harmonisation legislation, may combine this risk management system with the existing one rather than running two.

Article 9 sits in Chapter III, Section 2, so it takes effect on the schedule the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026) wrote into Article 113: 2 December 2027 for a system classified as high-risk under Article 6(2) and Annex III, and 2 August 2028 for a system classified as high-risk under Article 6(1) and Annex I, rather than the Regulation's general 2 August 2026 application date.

Under Article 111(2), as the Digital Omnibus on AI rewrote it, the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly; in any case, the providers and deployers of a high-risk AI system intended to be used by public authorities must take the necessary steps to comply with the Regulation's requirements and obligations by 2 August 2030.

Article 9 does not apply to a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.

Providers or prospective providers of high-risk AI systems listed in Annex III or covered by the Union harmonisation legislation listed in Section A of Annex I may test them in real world conditions outside AI regulatory sandboxes, in accordance with Article 60 and the real-world testing plan, without prejudice to the prohibitions under Article 5.

They may conduct that testing at any time before the placing on the market or the putting into service of the system, on their own or in partnership with one or more deployers or prospective deployers. A provider is a natural or legal person, public authority, agency or other body that develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark, whether for payment or free of charge.

Article 2(8) excludes research, testing and development activity regarding AI systems prior to their being placed on the market or put into service, but testing in real world conditions is not covered by that exclusion. The testing is without prejudice to any ethical review that is required by Union or national law.

Providers or prospective providers may conduct the testing in real world conditions only where all of the conditions in Article 60(4) are met, the first being that they have drawn up a real-world testing plan and submitted it to the market surveillance authority in the Member State where the testing is to be conducted.

The market surveillance authority in that Member State must have approved the testing and the plan, and where it has not answered within 30 days they are understood to have been approved, although where national law does not provide for a tacit approval the testing remains subject to an authorisation.

The provider or prospective provider must have registered the testing in accordance with Article 71(4) with a Union-wide unique single identification number and the information specified in Annex IX, subject to separate registration routes for Annex III point 1, 6 and 7 systems in the areas of law enforcement, migration, asylum and border control management and for point 2 systems.

The provider or prospective provider must be established in the Union or have appointed a legal representative established in the Union, may transfer data collected for the testing to third countries only with appropriate and applicable safeguards under Union law, and may not test for longer than necessary and in any case not longer than six months, extendable by six months on prior notification with an explanation.

Subjects who belong to vulnerable groups due to their age or disability must be appropriately protected, and where deployers or prospective deployers take part they must be informed of all aspects of the testing relevant to their decision to participate, given the instructions for use referred to in Article 13, and bound by an agreement specifying roles and responsibilities. The subjects of the testing must have given informed consent in accordance with Article 61.

In the case of law enforcement, where the seeking of informed consent would prevent the AI system from being tested, the testing itself and its outcome must not have any negative effect on the subjects and their personal data must be deleted after the test is performed.

The testing must be effectively overseen by the provider or prospective provider, and by deployers or prospective deployers, through suitably qualified persons with the necessary capacity, training and authority, and the predictions, recommendations or decisions of the AI system must be capable of being effectively reversed and disregarded.

Under Article 61(1), freely-given informed consent must be obtained from the subjects of testing prior to their participation, after they have been duly informed of the nature and objectives of the testing, its conditions and expected duration, their rights, the arrangements for requesting the reversal or the disregarding of the system's predictions, recommendations or decisions, and the Union-wide unique single identification number of the testing and the contact details of the provider or its legal representative.

The informed consent must be dated and documented and a copy given to the subjects of testing or their legal representative. Subjects, or their legally designated representative, may without any resulting detriment and without having to provide any justification withdraw from the testing at any time by revoking their informed consent and may request the immediate and permanent deletion of their personal data, and the withdrawal does not affect the activities already carried out.

A serious incident is an incident or malfunctioning of an AI system that directly or indirectly leads to the death of a person or serious harm to a person's health, a serious and irreversible disruption of the management or operation of critical infrastructure, the infringement of obligations under Union law intended to protect fundamental rights, or serious harm to property or the environment.

Article 60(7) requires any serious incident identified in the course of the testing in real world conditions to be reported to the national market surveillance authority in accordance with Article 73. The provider or prospective provider must adopt immediate mitigation measures or, failing that, suspend the testing until such mitigation takes place, or otherwise terminate it.

The provider or prospective provider must also establish a procedure for the prompt recall of the AI system upon such termination of the testing.

Article 73 requires the report immediately after a causal link, or the reasonable likelihood of one, is established and in any event not later than 15 days after becoming aware of the serious incident, not later than two days in the event of a widespread infringement or a serious and irreversible disruption of critical infrastructure, and not later than 10 days after becoming aware of the serious incident in the event of the death of a person.

Providers or prospective providers must notify the national market surveillance authority in the Member State where the testing is to be conducted of the suspension or termination of the testing and of the final outcomes. The provider or prospective provider is liable under applicable Union and national liability law for any damage caused in the course of their testing in real world conditions.

Member States must confer on their market surveillance authorities the powers of requiring providers and prospective providers to provide information, of carrying out unannounced remote or on-site inspections, and of performing checks on the conduct of the testing and the related high-risk AI systems.

Member States lay down the rules on penalties and other enforcement measures, which may also include administrative fines, warnings and non-monetary measures, applicable to any infringement of the Regulation by operators. Article 113 provides that the Regulation applies from 2 August 2026, with exceptions for Chapters I and II, Chapter III Section 4, Chapter V, Chapter VII, Chapter XII, Article 78 and Article 6(1), none of which is Chapter VI, which holds Articles 60 and 61.

Regulation (EU) 2026/1744 replaced point (c) of Article 113, third paragraph, which now dates Chapter III, Sections 1, 2 and 3, and added a point (d) dating Articles 102 to 110 from 27 July 2026. Regulation (EU) 2026/1744 entered into force on the third day following that of its publication in the Official Journal, 27 July 2026.

An AI system presenting a risk is understood as a product presenting a risk as defined in Article 3, point 19 of Regulation (EU) 2019/1020, in so far as it presents risks to the health or safety, or to fundamental rights, of persons. Where the market surveillance authority of a Member State has sufficient reason to consider an AI system to present a risk, it must carry out an evaluation of the system's compliance with all the requirements and obligations laid down in the Regulation.

The relevant operators must cooperate as necessary with the market surveillance authority and with the other national public authorities or bodies referred to in Article 77(1).

Where the evaluation finds that the AI system does not comply with the requirements and obligations of the Regulation, the market surveillance authority must without undue delay require the relevant operator to take all appropriate corrective actions to bring the system into compliance, to withdraw it from the market or to recall it, within the period the authority prescribes and in any event within the shorter of 15 working days or the period in the relevant Union harmonisation legislation.

The operator must ensure that all appropriate corrective action is taken in respect of all the AI systems concerned that it has made available on the Union market.

Where the operator does not take adequate corrective action within the period set under Article 79(2), the market surveillance authority must take all appropriate provisional measures to prohibit or restrict the AI system's being made available on its national market or put into service, to withdraw the product or the standalone AI system from that market or to recall it.

Where a market surveillance authority raises objections to a measure taken by another such authority within three months of the notification under Article 79(5), or within 30 days for non-compliance with the prohibition of the AI practices referred to in Article 5, or where the Commission considers the measure contrary to Union law, the Commission must consult the market surveillance authority and the operator or operators, evaluate the measure and decide within six months, or within 60 days for non-compliance with Article 5, whether the national measure is justified.

The procedures in Articles 79 to 83 do not apply to AI systems related to products covered by the Union harmonisation legislation listed in Section A of Annex I where such legal acts already provide for procedures ensuring an equivalent level of protection and having the same objective, and the relevant sectoral procedures apply instead.

Articles 79 and 81 sit in Chapter IX, to which Article 113 gives no date of its own, so they apply from the Regulation's general application date of 2 August 2026. Regulation (EU) 2026/1744 replaced points (a) and (c) of Article 113's third paragraph and added point (d), and none of them names Chapter IX.

Where a market surveillance authority has sufficient reason to consider that an AI system the provider classified as non-high-risk under Article 6(3) is in fact high-risk, it must evaluate the system's classification against the conditions of Article 6(3) and the Commission guidelines.

If the evaluation finds the AI system high-risk, the market surveillance authority must without undue delay require the relevant provider to take all necessary actions to bring the system into compliance with the requirements and obligations of the Regulation and to take appropriate corrective action within the period the authority prescribes.

The provider must ensure that all necessary action is taken to bring the AI system into compliance, and a provider that does not bring it into compliance within the period set under Article 80(2) is subject to fines in accordance with Article 99. The provider must ensure that all appropriate corrective action is taken in respect of all the AI systems concerned that it has made available on the Union market.

Where the market surveillance authority establishes in its evaluation that the provider misclassified the AI system as non-high-risk in order to circumvent the application of requirements in Chapter III, Section 2, the provider is subject to fines in accordance with Article 99.

Where the market surveillance authority, after consulting the national public authority referred to in Article 77(1), finds that a high-risk AI system complies with the Regulation but nevertheless presents a risk to the health or safety of persons, to fundamental rights or to other aspects of public interest protection, it must require the relevant operator to take all appropriate measures so that the system, when placed on the market or put into service, no longer presents that risk without undue delay and within a period it may prescribe.

The provider or other relevant operator must ensure that corrective action is taken in respect of all the AI systems concerned that it has made available on the Union market within the timeline the market surveillance authority prescribes.

Where a market surveillance authority finds that the CE marking was affixed in violation of Article 48 or was not affixed, that the EU declaration of conformity was not drawn up or not drawn up correctly, that the registration in the EU database was not carried out, that no authorised representative was appointed where applicable, or that technical documentation is not available, it must require the relevant provider to put an end to the non-compliance within a period it may prescribe.

Where the non-compliance persists, the market surveillance authority must take appropriate and proportionate measures to restrict or prohibit the high-risk AI system's being made available on the market or to ensure that it is recalled or withdrawn from the market without delay.

The procedures in Articles 79 to 83 do not apply to AI systems related to products covered by the Union harmonisation legislation listed in Section A of Annex I where such legal acts already provide for procedures ensuring an equivalent level of protection and having the same objective, and the relevant sectoral procedures apply instead.

Articles 80, 82 and 83 concern high-risk AI systems, and the Digital Omnibus on AI (Regulation (EU) 2026/1744) moved Chapter III, Sections 1 to 3, which hold the Article 6 rules that classify a system as high-risk, to 2 December 2027 for a system classified under Article 6(2) and Annex III and to 2 August 2028 for one classified under Article 6(1) and Annex I. The Omnibus also rewrote Article 111(2) so that the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly, and the providers and deployers of a system intended for use by public authorities must take the necessary steps to comply by 2 August 2030.

Articles 80, 82 and 83 do not apply to a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.

Articles 80, 82 and 83 sit in Chapter IX, to which Article 113 gives no date of its own, so the chapter applies from the Regulation's general application date of 2 August 2026.

Article 75(1) allows members of partnerships for information sharing to share information among each other where strictly necessary for complying with the obligations under Chapter III and Article 69, and in accordance with fundamental rights and judicial procedural safeguards.

Article 75(4), point (g), provides that information generated through the use of artificial intelligence, machine learning technologies or algorithms may only be shared where those processes were subject to adequate human oversight. Article 3 of Regulation (EU) 2024/1624 lists credit institutions and financial institutions among the obliged entities.

Article 90 provides that the Regulation applies from 10 July 2027, except in relation to the obliged entities referred to in Article 3, points (3)(n) and (o), to which it applies from 10 July 2029.

Article 3 of Regulation (EU) 2024/1624 lists credit institutions and financial institutions among the obliged entities.

Article 69(1), point (a), requires obliged entities, and where applicable their directors and employees, to cooperate fully with the financial intelligence unit by promptly reporting to it, on their own initiative, where the obliged entity knows, suspects or has reasonable grounds to suspect that funds or activities, regardless of the amount involved, are the proceeds of criminal activity or are related to terrorist financing or criminal activity, and by responding to requests by the unit for additional information in such cases.

Article 69(1), point (b), requires obliged entities to provide the unit, at its request, with all necessary information, including information on transaction records, within the deadlines imposed. Article 69(1) requires all suspicious transactions, including attempted transactions and suspicions arising from the inability to conduct customer due diligence, to be reported.

Obliged entities must reply to requests for information by the unit within 5 working days, a deadline the unit may shorten in justified and urgent cases, including to less than 24 hours, and may extend where it considers that justified and the extension does not undermine its analysis.

Article 69(2) requires obliged entities to assess transactions or activities carried out by their customers on the basis of and against any relevant fact and information known to them or which they are in possession of, prioritizing the assessment where necessary according to the urgency of the transaction or activity and the risks affecting the Member State in which they are established.

Article 69(2) provides that a suspicion shall be based on the characteristics of the customer and their counterparts, the size and nature of the transaction or activity or the methods and patterns thereof, the link between several transactions or activities, the origin, destination or use of funds, or any other circumstance known to the obliged entity, including the consistency of the transaction or activity with the information obtained pursuant to Chapter III including the risk profile of the client.

Article 69(3) requires the Anti-Money Laundering Authority to develop by 10 July 2026 draft implementing technical standards specifying the format to be used for the reporting of suspicions and for the provision of transaction records. Article 69(5) requires the Authority to issue by 10 July 2027 guidelines on indicators of suspicious activity or behaviors.

Article 69(6) requires the compliance officer appointed in accordance with Article 11(2) to transmit the information to the unit of the Member State in whose territory the obliged entity transmitting the information is established.

Article 69(7) requires obliged entities to ensure that the compliance officer, and any employee or person in a comparable position, including agents and distributors, involved in these tasks are protected against retaliation, discrimination and any other unfair treatment for carrying out those tasks.

Article 70(2) exempts notaries, lawyers, other independent legal professionals, auditors, external accountants and tax advisors from Article 69(1) to the extent that the exemption relates to information they receive from, or obtain on, a client in the course of ascertaining the legal position of that client or performing their task of defending or representing that client in, or concerning, judicial proceedings, and the exemption does not apply where they take part in money laundering, its predicate offences or terrorist financing, provide legal advice for those purposes, or know that the client is seeking legal advice for those purposes.

Article 72 provides that disclosure of information to the unit in good faith by an obliged entity or by an employee or director of such an obliged entity in accordance with Articles 69 and 70 does not constitute a breach of any restriction on disclosure of information imposed by contract or by any legislative, regulatory or administrative provision, and does not involve the obliged entity or its directors or employees in liability of any kind.

Article 73(1) provides that obliged entities and their directors, employees, or persons in comparable positions, including agents and distributors, shall not disclose to the customer concerned or to other third persons the fact that transactions or activities are being or have been assessed in accordance with Article 69, that information is being, will be or has been transmitted in accordance with Article 69 or 70, or that a money laundering or terrorist financing analysis is being, or may be, carried out.

Article 73(2) provides that the prohibition does not apply to disclosures to competent authorities and to self-regulatory bodies where they perform supervisory functions, or to disclosure for the purposes of investigating and prosecuting money laundering, terrorist financing and other criminal activity.

Article 73(3) to (6) provide further derogations for disclosure within the same group, within the same legal person or larger structure of notaries, lawyers, other independent legal professionals, auditors, external accountants and tax advisors, between obliged entities in cases relating to the same transaction involving two or more obliged entities, and for an attempt to dissuade a client from engaging in illegal activity.

Article 90 provides that the Regulation applies from 10 July 2027, except in relation to the obliged entities referred to in Article 3, points (3)(n) and (o), to which it applies from 10 July 2029. Article 77 of Directive (EU) 2024/1640 repeals Directive (EU) 2015/849 with effect from 10 July 2027.

Article 89 provides that references to Directive (EU) 2015/849 are to be construed as references to the Regulation and to Directive (EU) 2024/1640 and read in accordance with the correlation table in Annex VI. Annex VI correlates Article 33(1) of Directive (EU) 2015/849 with Article 69(1) of the Regulation, Article 33(2) with Article 69(6), and Article 39 with Article 73.

Article 13(1) of Regulation (EU) 2024/1620 provides that credit institutions and financial institutions, and groups of them, whose residual risk profile has been classified as high pursuant to Article 12 qualify as selected obliged entities, and Article 13(2) provides that where more than 40 entities are identified the Authority may agree on limiting the selection to a specific different number that is greater than 40.

Article 13(4) of Regulation (EU) 2024/1620 provides that the Authority shall commence the first selection process by 1 July 2027 and conclude it within six months, and shall commence direct supervision of the selected obliged entities six months after publication of the list.

Article 74(1), as replaced by Directive (EU) 2024/1619, requires institutions to have robust governance arrangements, which include a clear organizational structure with well-defined, transparent and consistent lines of responsibility, effective processes to identify, manage, monitor and report the risks they are or might be exposed to, including ESG risks in the short, medium and long term, adequate internal control mechanisms, including sound administration and accounting procedures, network and information systems that are set up and managed in accordance with Regulation (EU) 2022/2554, and remuneration policies and practices that are consistent with and promote sound and effective risk management, including by taking into account the institutions' risk appetite in terms of ESG risks.

The remuneration policies and practices referred to in Article 74(1), point (e), shall be gender neutral.

Before that replacement, Article 74(1) provided that institutions shall have robust governance arrangements, which include a clear organizational structure with well-defined, transparent and consistent lines of responsibility, effective processes to identify, manage, monitor and report the risks they are or might be exposed to, adequate internal control mechanisms, including sound administration and accounting procedures, and remuneration policies and practices that are consistent with and promote sound and effective risk management.

Article 74(2) provides that the arrangements, processes and mechanisms referred to in paragraph 1 shall be comprehensive and proportionate to the nature, scale and complexity of the risks inherent in the business model and the institution's activities. Article 74(2) also provides that the technical criteria established in Articles 76 to 95 shall be taken into account.

Article 74(3) provides that EBA shall issue guidelines on the arrangements, processes and mechanisms referred to in paragraph 1, in accordance with paragraph 2.

Article 2(1) provides that the Directive applies to institutions. Article 3(1), point (3), defines an institution as an institution as defined in point (3) of Article 4(1) of Regulation (EU) No 575/2013. Article 4(2) requires Member States to ensure that the competent authorities monitor the activities of institutions so as to assess compliance with the requirements of the Directive and Regulation (EU) No 575/2013.

Article 67(1), point (d), as replaced by Directive (EU) 2024/1619, applies the Article's penalty provisions to an institution that fails to have in place governance arrangements and gender neutral remuneration policies required by the competent authorities in accordance with Article 74.

Article 67(2), as replaced by Directive (EU) 2024/1619, requires Member States to ensure that in those cases the measures that can be applied include at least administrative pecuniary penalties of up to 10 percent of the total annual net turnover of the undertaking in the case of a legal person, and of up to EUR 5 million in the case of a natural person.

Article 162(1) required Member States to adopt and publish by 31 December 2013 the laws, regulations and administrative provisions necessary to comply with the Directive, and to apply those provisions from 31 December 2013. Article 2(1) of Directive (EU) 2024/1619 requires Member States to apply the measures necessary to comply with that Directive from 11 January 2026, and to apply the amendments in Article 1, points (9) and (13), from 11 January 2027.

Article 18(1) requires Member States to require the creditor, before concluding a credit agreement, to carry out a thorough assessment of the consumer's creditworthiness. Article 18(1) provides that the assessment must be carried out in the interest of the consumer, to prevent irresponsible lending practices and over-indebtedness, and must take appropriate account of factors relevant to verifying the prospect of the consumer meeting his or her obligations under the credit agreement.

Article 18(2) requires Member States to ensure that credit intermediaries accurately submit the necessary information obtained from the consumer to the relevant creditor, in accordance with Regulation (EU) 2016/679, to enable the creditworthiness assessment to be carried out.

Article 18(3), second sentence, provides that the information for the assessment may include evidence of income or other sources of repayment, information on financial assets and liabilities, or information on other financial commitments. Article 18(3), fourth sentence, provides that the information is obtained from relevant internal or external sources, including the consumer and, where necessary, on the basis of a consultation of a database referred to in Article 19.

Article 18(3), last sentence, provides that the information obtained must be appropriately verified, where necessary through reference to independently verifiable documentation. Article 18(4) requires Member States to require the creditor to establish procedures for the assessment and to document and maintain those procedures. Article 18(4) also requires Member States to require the creditor to document and maintain the information referred to in paragraph 3.

Article 18(5) provides that, if the credit application is submitted jointly by more than one consumer, the creditor performs the creditworthiness assessment on the basis of the joint repayment capacity of the consumers.

Article 18(6) requires Member States to ensure that the creditor only makes the credit available to the consumer where the result of the creditworthiness assessment indicates that the obligations resulting from the credit agreement are likely to be met in the manner required under that agreement, taking into account the relevant factors referred to in paragraph 1.

Article 18(7), first sentence, requires Member States to ensure that a creditor that concludes a credit agreement does not subsequently cancel or modify the agreement to the detriment of the consumer on the grounds that the assessment of creditworthiness was incorrectly conducted. Article 18(7), second sentence, provides that the paragraph does not apply where it is demonstrated that the consumer knowingly withheld or falsified the information referred to in paragraph 3 provided to the creditor.

Article 18(9), first sentence, requires Member States to ensure that, where the credit application is rejected, the creditor is required to inform the consumer without delay of the rejection and, where relevant, to refer the consumer to easily accessible debt advisory services.

Article 18(10) requires Member States to ensure that, where the parties agree to change the total amount of credit after the conclusion of the credit agreement, the creditor is required to reassess the consumer's creditworthiness on the basis of updated information before any significant increase in the total amount of credit is granted.

Article 18(11), first sentence, allows Member States to require creditors to assess the creditworthiness of consumers on the basis of a consultation of the relevant database. Article 18(11), second sentence, provides that the assessment of creditworthiness shall not be based exclusively on the consumer's credit history.

Article 42(1) provides that, insofar as the Directive contains harmonized provisions, Member States may not maintain or introduce in their national law provisions diverging from those laid down in the Directive unless provided otherwise in the Directive.

Article 3, point (2), defines a creditor as a natural or legal person who grants or promises to grant credit in the course of that person's trade, business or profession. Article 3, point (1), defines a consumer as a natural person who acts for purposes which are outside his or her trade, business or profession.

Article 3, point (12), defines a credit intermediary as a natural or legal person that is not acting as a creditor or notary and not merely introducing a consumer to a creditor, and who, in the course of that person's trade, business or profession and for remuneration, presents or offers credit agreements to consumers, assists consumers by undertaking preparatory work or other pre-contractual administration in respect of credit agreements other than presenting or offering them, or concludes credit agreements with consumers on behalf of the creditor.

Article 2(1) provides that the Directive applies to credit agreements. Article 2(2), point (a), excludes from the Directive credit agreements secured by a mortgage, or by another comparable security commonly used in a Member State on immovable property, or secured by a right related to immovable property. Article 2(2), point (c), excludes from the Directive credit agreements involving a total amount of credit of more than EUR 100,000.

Article 2(3) applies the Directive to a credit agreement of more than EUR 100,000 that is not secured by a mortgage, by another comparable security on immovable property or by a right related to immovable property, where its purpose is the renovation of a residential immovable property.

Article 2(2), point (h), excludes from the Directive deferred payments whereby a supplier of goods or a provider of services, without a third party offering credit, gives the consumer time to pay, the purchase price is to be paid free of interest and without any other charges and with only limited charges payable by the consumer for late payments imposed in accordance with national law, and the payment is to be entirely executed within 50 days of the delivery of the good or service.

The second subparagraph of Article 2(2), point (h), provides that, for deferred payments offered by a supplier or provider that is not a micro, small or medium-sized enterprise and offers information society services consisting of the conclusion of distance contracts with consumers, the exclusion applies only where a third party is neither offering nor purchasing credit, the payment is to be entirely executed within 14 days of the delivery of the goods or services, and the purchase price is to be paid free of interest and without any other charges and with only limited charges for late payments.

Article 2(2), point (l), excludes from the Directive credit agreements existing on 20 November 2026, but Articles 23 and 24, Article 25(1), second sentence, Article 25(2) and Articles 28 and 39 apply to all open-end credit agreements existing on that date. Article 2(4) provides that, for credit agreements in the form of overrunning, Article 18 applies unless otherwise determined by Member States.

Article 2(6) allows Member States to determine that only the Articles it lists, which do not include Article 18, apply to credit agreements concluded by an organization whose membership is restricted to persons residing or employed in a particular location, to employees and retired employees of a particular employer, or to persons meeting other qualifications laid down under national law as the basis for a common bond between the members, where the organization meets the conditions in points (a) to (e).

Article 2(7) allows Member States to determine that only the Articles it lists, which do not include Article 18, apply to credit agreements between the creditor and the consumer in respect of deferred payment or of repayment methods, where the consumer is already in default or is likely to default on the initial credit agreement and the conditions in points (a) and (b) are fulfilled.

Article 44(1) requires Member States to lay down the rules on penalties applicable to infringements of the national provisions adopted pursuant to the Directive, and provides that the penalties must be effective, proportionate and dissuasive.

Article 40(1) requires Member States to ensure that consumers have access to adequate, prompt and effective out-of-court dispute resolution procedures for the settlement of disputes between consumers and creditors or credit intermediaries concerning rights and obligations relating to credit agreements established under the Directive.

Article 47 repeals Directive 2008/48/EC with effect from 20 November 2026, and provides that Directive 2008/48/EC continues to apply to credit agreements existing on 20 November 2026 until their termination. Article 48(1) requires Member States to adopt and publish by 20 November 2025 the laws, regulations and administrative provisions necessary to comply with the Directive, and to apply those measures from 20 November 2026.

Article 16d(1) of Directive 2011/83/EU, as inserted, requires Member States to ensure that traders provide the consumer, free of charge and before the contract is concluded, with adequate explanations of the proposed financial services contract that make it possible to assess whether the contract and ancillary services are adapted to the consumer's needs and financial situation.

Article 16d(3) requires Member States to ensure that, where the trader uses online tools, the consumer has a right to request and obtain human intervention at the pre-contractual stage and, in justified cases, after the distance contract has been concluded, in the same language as the pre-contractual information. Under Article 16d(4), the burden of proof of compliance with the adequate explanation requirements is on the trader.

Article 2(1) of Directive (EU) 2023/2673 requires Member States to adopt and publish the necessary measures by 19 December 2025 and to apply them from 19 June 2026.

Article 27(2) requires providers of AI systems considered high-risk under Article 6 of Regulation (EU) 2024/1689, that do not fall within the scope of Regulation (EU) 2017/745 or (EU) 2017/746 and that claim interoperability with the harmonised software components of EHR systems, to prove compliance with the essential requirements on the European interoperability software component and the European logging software component laid down in Section 2 of Annex II.

Article 27(2) applies Article 36 of the Regulation to those high-risk AI systems. Under Article 36(4), high-risk AI systems referred to in Article 27 that are in conformity with the common specifications adopted under Article 36(1) are considered to be in conformity with the essential requirements in Annex II that those specifications cover.

Article 105 applies Article 27, with Articles 3 to 15, 23(2) to (6), 25, 26, 47, 48 and 49, from 26 March 2029 to the priority categories of personal electronic health data in Article 14(1), points (a), (b) and (c), and to EHR systems intended by the manufacturer to process them, and from 26 March 2031 to the categories in points (d), (e) and (f).

Article 2(1) of Directive (EU) 2015/849 applies the Directive to obliged entities, which include credit institutions, financial institutions and the natural or legal persons acting in the exercise of their professional activities that the paragraph lists.

Article 33(1), point (a), requires obliged entities, and where applicable their directors and employees, to cooperate fully by promptly informing the financial intelligence unit, including by filing a report, on their own initiative, where the obliged entity knows, suspects or has reasonable grounds to suspect that funds, regardless of the amount involved, are the proceeds of criminal activity or are related to terrorist financing, and by promptly responding to requests by the unit for additional information in such cases.

Article 33(1), point (b), as replaced by Directive (EU) 2018/843, requires obliged entities to cooperate fully by promptly providing the financial intelligence unit directly, at its request, with all necessary information. Article 33(1) provides that all suspicious transactions, including attempted transactions, shall be reported.

Article 33(2) requires the person appointed in accordance with Article 8(4), point (a), to transmit the information to the unit of the Member State in whose territory the obliged entity transmitting the information is established.

Article 34(2) disapplies the obligations of Article 33(1) to notaries, other independent legal professionals, auditors, external accountants and tax advisors only to the strict extent that the exemption relates to information they receive from, or obtain on, one of their clients in the course of ascertaining the legal position of the client, or performing their task of defending or representing that client in, or concerning, judicial proceedings.

Article 39(1) provides that obliged entities and their directors and employees shall not disclose to the customer concerned or to other third persons the fact that information is being, will be or has been transmitted in accordance with Article 33 or 34 or that a money laundering or terrorist financing analysis is being, or may be, carried out.

Article 39(2) provides that the prohibition does not include disclosure to the competent authorities, including the self-regulatory bodies, or disclosure for law enforcement purposes.

Article 39(3), as replaced by Directive (EU) 2018/843, provides that the prohibition does not prevent disclosure between credit institutions and financial institutions from the Member States provided that they belong to the same group, or between those entities and their branches and majority owned subsidiaries established in third countries, provided that those branches and subsidiaries fully comply with the group-wide policies and procedures and that those policies and procedures comply with the requirements of the Directive.

Article 39(4) to (6) provide further exceptions for disclosure within the same legal person or larger structure of notaries, other independent legal professionals, auditors, external accountants and tax advisors, for disclosure between obliged entities in cases relating to the same customer and the same transaction, and for an attempt by those professionals to dissuade a client from engaging in illegal activity.

Article 67(1) of the Directive, as replaced by Directive (EU) 2018/843, requires Member States to bring into force the laws, regulations and administrative provisions necessary to comply with the Directive by 26 June 2017. Article 77 of Directive (EU) 2024/1640 repeals Directive (EU) 2015/849 with effect from 10 July 2027.

Annex VI to Regulation (EU) 2024/1624 correlates Article 33(1) of Directive (EU) 2015/849 with Article 69(1) of that Regulation, Article 33(2) with Article 69(6), and Article 39 with Article 73. Article 58(1) requires Member States to ensure that obliged entities can be held liable for breaches of the national provisions transposing the Directive, with any resulting sanction or measure effective, proportionate and dissuasive.

Article 59(1) requires the sanctions and measures of that Article to apply at least to breaches on the part of obliged entities that are serious, repeated, systematic, or a combination thereof, of the requirements laid down in Articles 33, 34 and 35 on suspicious transaction reporting, among others.

Article 59(2), point (e), and Article 59(3) require the maximum administrative pecuniary sanctions to be at least twice the amount of the benefit derived from the breach or at least EUR 1,000,000, and for a credit institution or financial institution at least EUR 5,000,000 or 10% of the total annual turnover in the case of a legal person and at least EUR 5,000,000 in the case of a natural person.

Article 25(2) requires the manufacturer, for a category of machinery or related product listed in Annex I, Part A, to apply one of three conformity assessment procedures: EU type-examination (module B) followed by conformity to type based on internal production control (module C), conformity based on full quality assurance (module H), or conformity based on unit verification (module G).

Annex I, Part A, point 5, lists safety components with fully or partially self-evolving behaviour using machine learning approaches ensuring safety functions. Annex I, Part A, point 6, lists machinery that has embedded systems with fully or partially self-evolving behaviour using machine learning approaches ensuring safety functions that have not been placed independently on the market, in respect only of those systems.

Recital 54 states that the conformity assessment of a safety component or a system with self-evolving behaviour ensuring safety functions should be carried out by a third party.

Regulation (EU) 2026/1744 requires the Commission to adopt delegated acts adding health and safety requirements for AI systems that are classified as high-risk under Article 6(1) of the AI Act because they are a safety component in a product covered by the Machinery Regulation or are themselves such a product, and those delegated acts apply by 2 August 2028. Article 54 provides that the Regulation applies from 14 January 2027.

Rule 11 of Annex VIII classifies software intended to provide information which is used to take decisions with diagnosis or therapeutic purposes as class IIa, except where such decisions have an impact that may cause death or an irreversible deterioration of a person's state of health, in which case it is class III. Where the decisions may cause a serious deterioration of a person's state of health or a surgical intervention, the software is class IIb.

Software intended to monitor physiological processes is class IIa, except that software intended for monitoring of vital physiological parameters, where the nature of variations of those parameters is such that it could result in immediate danger to the patient, is class IIb. All other software is class I. Software which drives a device or influences the use of a device falls within the same class as the device, and software independent of any other device is classified in its own right.

The Regulation defines a medical device to include software intended by the manufacturer to be used for human beings for specific medical purposes, among them the diagnosis, prevention, monitoring, prediction, prognosis, treatment or alleviation of disease. Before placing a device on the market, a manufacturer must assess its conformity under the applicable procedures in Annexes IX to XI.

The manufacturer of a class III device is subject to the conformity assessment in Annex IX, or may instead apply Annex X coupled with Annex XI. The manufacturer of a class IIb device is subject to the conformity assessment in Chapters I and III of Annex IX, including an assessment of the technical documentation of at least one representative device per generic device group (for most class IIb implantable devices, of every device), or may instead apply Annex X coupled with Annex XI.

The manufacturer of a class IIa device is subject to the conformity assessment in Chapters I and III of Annex IX, including an assessment of the technical documentation of at least one representative device for each category of devices, or may instead draw up the technical documentation in Annexes II and III coupled with a conformity assessment under Section 10 or Section 18 of Annex XI.

Under those procedures the manufacturer lodges an application for assessment of its quality management system with a notified body. The manufacturer of a class I device, other than a device placed on the market in sterile condition, with a measuring function or a reusable surgical instrument, declares conformity by issuing the EU declaration of conformity after drawing up the technical documentation set out in Annexes II and III.

Article 6(1) of the AI Act makes an AI system high-risk where the AI system is intended to be used as a safety component of a product, or is itself a product, covered by the Union harmonisation legislation listed in Annex I. The second condition is that the product, or the AI system itself as a product, is required to undergo a third-party conformity assessment under that legislation. Annex I of the AI Act lists Regulation (EU) 2017/745 among that legislation.

A device whose conformity assessment under the Directive 93/42/EEC did not require a notified body and whose declaration of conformity was drawn up before 26 May 2021, but for which the Regulation requires a notified body, may be placed on the market or put into service until 31 December 2028 if the conditions of Article 120(3c) are met. The Regulation applies from 26 May 2021, the date Regulation (EU) 2020/561 substituted in Article 123(2) for 26 May 2020.

The competent authorities of the Member States perform appropriate checks on the conformity characteristics and performance of devices. The Member States lay down the rules on penalties applicable for infringement of the Regulation, and the penalties must be effective, proportionate, and dissuasive.

On 16 December 2025 the Commission proposed a Regulation amending Regulations (EU) 2017/745 and (EU) 2017/746 as regards simplifying and reducing the burden of the rules on medical devices and in vitro diagnostic medical devices.

Its text replaces Rule 11 with a rule that classifies as class I software intended to generate an output that confers a clinical benefit and is used for diagnosis, treatment, prevention, monitoring, prediction, prognosis, compensation or alleviation of a disease or condition, unless the output is intended for a disease or condition in a critical, serious or non-serious situation, in which cases higher classes apply.

Article 4(1), point (39), of Directive 2014/65/EU defines algorithmic trading as trading in financial instruments where a computer algorithm automatically determines individual parameters of orders such as whether to initiate the order, the timing, price or quantity of the order or how to manage the order after its submission, with limited or no human intervention.

The definition does not include any system that is only used for the purpose of routing orders to one or more trading venues, for the processing of orders involving no determination of any trading parameters, for the confirmation of orders or for the post-trade processing of executed transactions.

Article 17(1) requires an investment firm that engages in algorithmic trading to have in place effective systems and risk controls suitable to the business it operates to ensure that its trading systems are resilient and have sufficient capacity, are subject to appropriate trading thresholds and limits, and prevent the sending of erroneous orders or the systems otherwise functioning in a way that may create or contribute to a disorderly market.

Article 17(1) also requires that firm to have in place effective systems and risk controls to ensure its trading systems cannot be used for any purpose that is contrary to Regulation (EU) No 596/2014 or to the rules of a trading venue to which it is connected, and effective business continuity arrangements to deal with any failure of its trading systems.

Article 17(1) requires the firm to ensure that its systems are fully tested and properly monitored to ensure that they meet the requirements of that paragraph. Article 17(2) requires an investment firm that engages in algorithmic trading in a Member State to notify this to the competent authorities of its home Member State and of the trading venue at which it engages in algorithmic trading as a member or participant of the trading venue.

Article 17(2) provides that the competent authority of the home Member State may require the firm to provide, on a regular or ad-hoc basis, a description of the nature of its algorithmic trading strategies, details of the trading parameters or limits to which the system is subject, the key compliance and risk controls that it has in place, and details of the testing of its systems.

Article 17(2) requires the firm to arrange for records to be kept in relation to those matters and to ensure that the records are sufficient to enable its competent authority to monitor compliance with the requirements of the Directive.

A firm that engages in a high-frequency algorithmic trading technique must also store in an approved form accurate and time sequenced records of all its placed orders, including cancellations of orders, executed orders and quotations on trading venues, and make them available to the competent authority upon request.

Article 4(1), point (40), defines a high-frequency algorithmic trading technique as one characterized by infrastructure intended to minimize network and other latencies, system-determination of order initiation, generation, routing or execution without human intervention for individual trades or orders, and high message intraday rates.

Article 17(3) requires a firm that engages in algorithmic trading to pursue a market making strategy to carry out that market making continuously during a specified proportion of the trading venue's trading hours, except under exceptional circumstances, to enter into a binding written agreement with the trading venue, and to have in place effective systems and controls to ensure that it fulfils its obligations under the agreement at all times.

Article 17(5) requires an investment firm that provides direct electronic access to a trading venue to have in place effective systems and controls which ensure a proper assessment and review of the suitability of clients using the service, that those clients are prevented from exceeding appropriate pre-set trading and credit thresholds, and that their trading is properly monitored, and it prohibits direct electronic access without such controls.

Article 17(6) requires an investment firm that acts as a general clearing member for other persons to have in place effective systems and controls to ensure clearing services are only applied to persons who are suitable and meet clear criteria.

Recital (5) of Delegated Regulation (EU) 2017/589 describes an investment decision algorithm as one that makes automated trading decisions by determining which financial instrument should be purchased or sold. The duties attach to the firm's use of automated systems that determine trading decisions.

Article 1 of the Delegated Regulation requires an investment firm to establish and monitor its trading systems and trading algorithms through a clear and formalized governance arrangement that sets out clear lines of accountability, including procedures to approve the development, deployment and subsequent updates of trading algorithms.

Article 2(1) requires the firm to ensure that its compliance staff has at least a general understanding of how the algorithmic trading systems and trading algorithms of the investment firm operate.

Article 5 requires the firm, before the deployment or a substantial update of an algorithmic trading system, trading algorithm or algorithmic trading strategy, to establish clearly delineated methodologies to develop and test it, and requires a person designated by senior management to authorize the deployment or update.

Article 5(4) requires the methodologies to ensure that the system, algorithm or strategy does not behave in an unintended manner, complies with the firm's obligations under the Delegated Regulation and with the rules and systems of the trading venues accessed, does not contribute to disorderly trading conditions, and continues to work effectively in stressed market conditions. Article 5(6) applies paragraphs 2 to 5 of that Article only to trading algorithms leading to order execution.

Article 7(1) requires testing of compliance with the criteria in Article 5(4), points (a), (b) and (d), to be undertaken in an environment that is separated from the firm's production environment and used specifically for the testing and development of algorithmic trading systems and trading algorithms.

Article 8 requires the firm, before deployment of a trading algorithm, to set predefined limits on the number of financial instruments being traded, the price, value and numbers of orders, the strategy positions, and the number of trading venues to which orders are sent.

Article 9 requires the firm to perform a self-assessment and validation process annually and to issue a validation report, which the risk management function draws up, the internal audit function audits where such a function exists, and senior management approves.

Article 10 requires the firm, as part of the annual self-assessment, to test that its algorithmic trading systems and the controls in Articles 12 to 18 can withstand increased order flows or market stresses, using the highest message and trade volumes of the previous six months multiplied by two. Article 12(1) requires the firm to be able to cancel immediately, as an emergency measure, any or all of its unexecuted orders submitted to any or all trading venues to which it is connected.

Article 12(3) requires the firm to be able to identify which trading algorithm and which trader, trading desk or, where applicable, which client is responsible for each order that has been sent to a trading venue. Article 15(1) requires the firm to carry out pre-trade controls on order entry for all financial instruments, namely price collars, maximum order values, maximum order volumes and maximum messages limits.

Article 16(1) requires the firm, during the hours it is sending orders to trading venues, to monitor in real time all algorithmic trading activity that takes place under its trading code, including that of its clients, for signs of disorderly trading. Article 16(5) requires real-time alerts to be generated within five seconds after the relevant event.

Article 28 requires a firm that engages in a high-frequency algorithmic trading technique to record the details of each submitted order immediately after order submission in the format set out in tables 2 and 3 of Annex II, and to keep the records for five years from the date of the submission of the order to a trading venue or to another investment firm for execution.

Article 29 provides that the Delegated Regulation applies from 3 January 2018 and is binding in its entirety and directly applicable in all Member States.

Article 1, point (7), of Directive (EU) 2016/1034 replaces in Article 93(1) of Directive 2014/65/EU the date for adopting and publishing the transposing measures, 3 July 2016, with 3 July 2017, and the date for applying them, 3 January 2017, with 3 January 2018. Article 70(3), point (a), of Directive 2014/65/EU lists Article 17(1) to (6) among the provisions an infringement of which Member States shall regard at least as an infringement of the Directive.

Article 70(1) requires Member States to lay down rules on, and ensure that their competent authorities may impose, administrative sanctions and measures applicable to all infringements of the Directive.

Article 70(6) requires Member States to give competent authorities the power to impose at least maximum administrative fines of at least EUR 5,000,000 on a legal person, or of up to 10% of its total annual turnover, of at least EUR 5,000,000 on a natural person, and of at least twice the amount of the benefit derived from the infringement where that benefit can be determined, so the amounts are floors for the maximum fines that Member States must make available and not fines that the Directive imposes on a firm directly.

Article 16(3) of Directive 2014/65/EU requires an investment firm that manufactures financial instruments for sale to clients to maintain, operate and review a process for the approval of each financial instrument and significant adaptations of existing financial instruments before it is marketed or distributed to clients.

The product approval process must specify an identified target market of end clients within the relevant category of clients for each financial instrument and ensure that all relevant risks to that target market are assessed and that the intended distribution strategy is consistent with it.

Article 16(3) also requires the firm to regularly review the financial instruments it offers or markets, taking into account any event that could materially affect the potential risk to the identified target market.

Where an investment firm offers or recommends financial instruments which it does not manufacture, Article 16(3) requires it to have in place adequate arrangements to obtain the information a manufacturer must make available and to understand the characteristics and identified target market of each financial instrument.

Article 24(2) requires an investment firm that manufactures financial instruments for sale to clients to ensure that they are designed to meet the needs of an identified target market of end clients, that the strategy for distribution is compatible with the identified target market, and that it takes reasonable steps to ensure that the instrument is distributed to the identified target market.

Article 24(2) also requires an investment firm to understand the financial instruments it offers or recommends, to assess the compatibility of the financial instruments with the needs of the clients to whom it provides investment services, also taking account of the identified target market, and to ensure that financial instruments are offered or recommended only when this is in the interest of the client.

Article 9(5) of Delegated Directive (EU) 2017/593 requires an investment firm to ensure that relevant staff involved in the manufacturing of financial instruments possess the necessary expertise to understand the characteristics and risks of the financial instruments they intend to manufacture.

Article 9(9), as replaced by Delegated Directive (EU) 2021/1269, requires a manufacturer to identify at a sufficiently granular level the potential target market for each financial instrument and to specify the type or types of client with whose needs, characteristics and objectives, including any sustainability related objectives, the financial instrument is compatible.

Article 9(10) requires a manufacturer to undertake a scenario analysis of its financial instruments that assesses the risks of poor outcomes for end clients posed by the product and in which circumstances these outcomes may occur.

Article 9(13) requires the information a manufacturer provides about a financial instrument to distributors to include information about the appropriate channels for distribution, the product approval process and the target market assessment, and to be of an adequate standard to enable distributors to understand and recommend or sell the financial instrument properly.

Article 10(1) requires a distributor to determine the target market for the respective financial instrument even if the manufacturer did not define it.

Article 10(2), as replaced by Delegated Directive (EU) 2021/1269, requires an investment firm to have in place adequate product governance arrangements to ensure that products and services it intends to offer or recommend are compatible with the needs, characteristics and objectives, including any sustainability related objectives, of an identified target market and that the intended distribution strategy is consistent with that target market.

Article 10(7) requires an investment firm to ensure that relevant staff possess the necessary expertise to understand the characteristics and risks of the products it intends to offer or recommend and the services provided, as well as the needs, characteristics and objectives of the identified target market.

None of these provisions requires a firm to explain a decision, and none refers to a decision made by an automated system or an algorithm; the duties run to the firm's staff, who must understand the instruments, and to the manufacturer, which must give distributors information of an adequate standard.

Article 14(1) of Delegated Directive (EU) 2017/593 requires Member States to adopt and publish the measures necessary to comply with it by 3 July 2017 at the latest and to apply them from 3 January 2018. Article 2(1) of Delegated Directive (EU) 2021/1269 requires Member States to adopt and publish the measures necessary to comply with it by 21 August 2022 at the latest and to apply them from 22 November 2022.

Article 1, point (7), of Directive (EU) 2016/1034 replaces in Article 93(1) of Directive 2014/65/EU the date for adopting and publishing the transposing measures, 3 July 2016, with 3 July 2017, and the date for applying them, 3 January 2017, with 3 January 2018. Article 70(3), point (a), of Directive 2014/65/EU lists Article 16(1) to (11) and Article 24(1) to (5) and (7) to (10) among the provisions an infringement of which Member States shall regard at least as an infringement of the Directive.

Article 70(1) requires Member States to lay down rules on, and ensure that their competent authorities may impose, administrative sanctions and measures applicable to all infringements of the Directive.

Article 70(6) requires Member States to give competent authorities the power to impose at least maximum administrative fines of at least EUR 5,000,000 on a legal person, or of up to 10% of its total annual turnover, of at least EUR 5,000,000 on a natural person, and of at least twice the amount of the benefit derived from the infringement where that benefit can be determined, so the amounts are floors for the maximum fines that Member States must make available and not fines that the Directive imposes on a firm directly.

Article 25(2) of Directive 2014/65/EU requires an investment firm that provides investment advice or portfolio management to obtain the necessary information regarding the client's or potential client's knowledge and experience in the investment field relevant to the specific type of product or service, financial situation including the ability to bear losses, and investment objectives including risk tolerance, so as to enable the firm to recommend the investment services and financial instruments that are suitable for the client.

Article 25(2), third subparagraph, as added by Directive (EU) 2021/338, requires an investment firm that provides investment advice or portfolio management involving the switching of financial instruments to obtain the necessary information on the client's investment and to analyze the costs and benefits of the switching, and, when providing investment advice, to inform the client whether or not the benefits of the switching are greater than the costs.

Article 4(1) of Directive (EU) 2021/338 requires Member States to adopt and publish the measures necessary to comply with it by 28 November 2021 and to apply them from 28 February 2022. Article 25(6) requires an investment firm that provides investment advice, before the transaction is made, to provide the client with a statement on suitability in a durable medium specifying the advice given and how that advice meets the preferences, objectives and other characteristics of the retail client.

Article 54(1) of Delegated Regulation (EU) 2017/565 provides that where investment advice or portfolio management services are provided in whole or in part through an automated or semi-automated system, the responsibility to undertake the suitability assessment lies with the investment firm providing the service and is not reduced by the use of an electronic system in making the personal recommendation or decision to trade.

Article 54(1) also requires the firm not to create any ambiguity or confusion about its responsibilities in the process when assessing suitability, and to inform clients or potential clients, clearly and simply, that the reason for assessing suitability is to enable the firm to act in the client's best interest.

Article 54(2) requires the firm to obtain from clients or potential clients such information as is necessary for the firm to understand the essential facts about the client and to have a reasonable basis for determining that the specific transaction to be recommended, or entered into in the course of providing a portfolio management service, satisfies the criteria the paragraph lists.

Delegated Regulation (EU) 2021/1253 replaced point (a) of Article 54(2) so that the first criterion is that the transaction meets the investment objectives of the client in question, including the client's risk tolerance and any sustainability preferences. Article 2 of Delegated Regulation (EU) 2021/1253 provides that it applies from 2 August 2022.

Article 54(7), point (b), requires the firm to take reasonable steps to ensure that the information collected about its clients is reliable, including by ensuring that all tools, such as risk assessment profiling tools or tools to assess a client's knowledge and experience, employed in the suitability assessment process are fit-for-purpose and appropriately designed for use with its clients, with any limitations identified and actively mitigated through the suitability assessment process.

Article 54(8) provides that where the firm does not obtain the information required under Article 25(2) of the Directive, it shall not recommend investment services or financial instruments to the client or potential client.

Article 54(10), as replaced by Delegated Regulation (EU) 2021/1253, provides that the firm shall not recommend or decide to trade where none of the services or instruments are suitable for the client, and that it shall explain to the client the reasons for not recommending an instrument as meeting the client's sustainability preferences when it does not meet them, and keep records of those reasons.

Article 54(12), as replaced by Delegated Regulation (EU) 2021/1253, requires the firm, when providing investment advice, to provide a report to the retail client that includes an outline of the advice given and that explains how the recommendation provided is suitable for the retail client, including how it meets the client's investment objectives, personal circumstances with reference to the investment term required, knowledge and experience, attitude to risk, capacity to sustain losses and sustainability preferences.

Article 54(13) requires an investment firm providing a periodic suitability assessment to review the suitability of the recommendations given at least annually. The only duties to explain in these provisions run to the client and concern why a recommendation is suitable, and Article 54 contains no provision requiring a firm to explain how an automated or semi-automated system reached a recommendation.

Article 91 of Delegated Regulation (EU) 2017/565 provides that it applies from the date that appears first in the second subparagraph of Article 93(1) of Directive 2014/65/EU and is binding in its entirety and directly applicable in all Member States.

Article 1, point (7), of Directive (EU) 2016/1034 replaces in Article 93(1) of Directive 2014/65/EU the date for adopting and publishing the transposing measures, 3 July 2016, with 3 July 2017, and the date for applying them, 3 January 2017, with 3 January 2018. Article 70(3), point (a), of Directive 2014/65/EU lists Article 25(1) to (6) among the provisions an infringement of which Member States shall regard at least as an infringement of the Directive.

Article 70(1) requires Member States to lay down rules on, and ensure that their competent authorities may impose, administrative sanctions and measures applicable to all infringements of the Directive.

Article 70(6) requires Member States to give competent authorities the power to impose at least maximum administrative fines of at least EUR 5,000,000 on a legal person, or of up to 10% of its total annual turnover, of at least EUR 5,000,000 on a natural person, and of at least twice the amount of the benefit derived from the infringement where that benefit can be determined, so the amounts are floors for the maximum fines that Member States must make available and not fines that the Directive imposes on a firm directly.

Article 4(1), point (1), of Directive 2014/65/EU defines an investment firm as any legal person whose regular occupation or business is the provision of one or more investment services to third parties and/or the performance of one or more investment activities on a professional basis.

Article 16(6) of Directive 2014/65/EU requires an investment firm to arrange for records to be kept of all services, activities and transactions undertaken by it, sufficient to enable the competent authority to fulfil its supervisory tasks and to perform the enforcement actions under the Directive, Regulation (EU) No 600/2014, Directive 2014/57/EU and Regulation (EU) No 596/2014.

The records must be sufficient in particular to ascertain that the investment firm has complied with all obligations, including those with respect to clients or potential clients and to the integrity of the market. Article 16(6) requires records of the services, activities and transactions themselves and states no duty to explain the reasoning behind a decision.

Article 25(1) of Regulation (EU) No 600/2014 requires an investment firm to keep at the disposal of the competent authority, for five years, the relevant data relating to all orders and all transactions in financial instruments which it has carried out, whether on own account or on behalf of a client. For a transaction carried out on behalf of a client, the records must contain all the information and details of the identity of the client and the information required under Directive 2005/60/EC.

Article 66 of Directive (EU) 2015/849 repealed Directive 2005/60/EC with effect from 26 June 2017 and provides that references to the repealed Directive are to be construed as references to Directive (EU) 2015/849. Article 25(1) provides that the European Securities and Markets Authority may request access to that information in accordance with the procedure and under the conditions set out in Article 35 of Regulation (EU) No 1095/2010.

Article 25(2) of Regulation (EU) No 600/2014 separately requires the operator of a trading venue to keep at the disposal of the competent authority, for at least five years, the relevant data relating to all orders in financial instruments which are advertised through its systems.

Article 1, point (7), of Directive (EU) 2016/1034 replaces in Article 93(1) of Directive 2014/65/EU the date for adopting and publishing the transposing measures, 3 July 2016, with 3 July 2017, and the date for applying them, 3 January 2017, with 3 January 2018. Article 1, point (14), of Regulation (EU) 2016/1033 replaces the second paragraph of Article 55 of Regulation (EU) No 600/2014 with the provision that the Regulation applies from 3 January 2018.

Article 70(3), point (a), of Directive 2014/65/EU lists Article 16(1) to (11) among the provisions an infringement of which Member States shall regard at least as an infringement of the Directive. Article 70(3), point (b), of that Directive lists Article 25(1) and (2) of Regulation (EU) No 600/2014 among the provisions an infringement of which Member States shall regard at least as an infringement of that Regulation.

Article 70(1) requires Member States to lay down rules on, and ensure that their competent authorities may impose, administrative sanctions and measures applicable to all infringements of the Directive.

Article 70(6) requires Member States to give competent authorities the power to impose at least maximum administrative fines of at least EUR 5,000,000 on a legal person, or of up to 10% of its total annual turnover, of at least EUR 5,000,000 on a natural person, and of at least twice the amount of the benefit derived from the infringement where that benefit can be determined, so the amounts are floors for the maximum fines that Member States must make available and not fines that the Directive imposes on a firm directly.

Article 25(1) requires manufacturers, before placing a toy on the market, to carry out a safety assessment that includes an analysis of the hazards the toy may present and an assessment of any potential exposure to them.

Under Article 25(2), point (c), for toys falling within the scope of Regulation (EU) 2024/1689, Regulation (EU) 2024/2847 or Directive 2014/53/EU, the safety assessment must take account of the particular vulnerabilities of children in relation to the use of such toys as intended, when assessing and addressing the hazards the toy may present. Article 25(3) requires the safety assessment to be included in the technical documentation referred to in Article 27.

Article 59 provides that the Regulation applies from 1 August 2030, except for Articles 28 to 44 and 49 to 55, which apply from 1 January 2026.

Providers of general-purpose AI models must draw up and keep up to date the model's technical documentation for the AI Office and national competent authorities, make information and documentation available to providers who intend to integrate the model into their own AI systems, put in place a policy to comply with Union copyright law and in particular to identify and comply with a reservation of rights expressed under Article 4(3) of Directive (EU) 2019/790, and draw up and make publicly available a sufficiently detailed summary of the content used for training, following a template provided by the AI Office.

Paragraph 2 exempts from the first two duties only a model released under a free and open-source licence that allows access, usage, modification and distribution and whose parameters, including the weights, and information on the model architecture and on model usage are made publicly available, and not at all where the model carries systemic risk, so the copyright policy and the training-content summary bind every provider of a general-purpose model.

Article 113(b) applies Chapter V, which contains this Article, from 2 August 2025, a year ahead of the Regulation's general application date.

Providers of AI systems that interact directly with people must ensure users are informed they are dealing with an AI system unless obvious from context, and providers of generative AI must mark synthetic audio, image, video, or text output in a machine-readable, detectable format.

Deployers of emotion-recognition or biometric-categorization systems must inform exposed individuals, and deployers of deepfakes or AI-generated public-interest text must disclose the artificial origin unless the content underwent human review with editorial responsibility. The Article reaches providers and deployers outside the EU whose system's output is used in the EU.

A four-month transition, to 2 December 2026, applies only to the machine-readable marking sub-duty for generative systems already on the market before 2 August 2026, added by the Digital Omnibus on AI.

As one of the listed, non-exhaustive systemic-risk mitigation measures a designated very large online platform or search engine may adopt, the provider should ensure that generated or manipulated content resembling real persons, objects, places, or events, and that would falsely appear authentic, is distinguishable through prominent markings when presented on the platform, alongside an easy-to-use flagging function.

This is materially narrower than AI Act Article 50: it binds only Commission-designated very large online platforms (VLOPs) and very large online search engines (VLOSEs) as a risk-mitigation option, not every provider or publisher as a freestanding labeling mandate.

Article 92 provides that this Regulation applies to a provider of a very large online platform or search engine designated under Article 33(4) from four months after the Commission's notification of that designation, where the notification date is earlier than 17 February 2024, the Regulation's general application date.

The Commission's first designation decisions under Article 33(4) took effect on 25 April 2023 for platforms including Facebook, Instagram, TikTok, and X, so this Article's obligations began applying to that cohort from 25 August 2023, four months later.

Article 7(1), point (f), provides that digital labour platforms shall not, by means of automated monitoring systems or automated decision-making systems, process any biometric data, as defined in Article 4, point (14), of Regulation (EU) 2016/679, of a person performing platform work to establish that person's identity by comparing that data to stored biometric data of natural persons in a database.

Recital 41 states that the ban does not affect the possibility for digital labour platforms to conduct biometric verification, namely verifying a person's identity by comparing his or her biometric data to data previously provided by that same person (one-to-one verification or authentication), where such processing of personal data is lawful under Regulation (EU) 2016/679 or other relevant Union and national law.

Recital 42 describes biometrics-based data as personal data which result from specific technical processing relating to the physical, physiological or behavioural features, signals or characteristics of a natural person, such as facial expressions, movements, pulse frequency, voice, keystrokes or gait, which may or may not allow or confirm the identification of a natural person.

Article 7(2) applies Article 7 to all persons performing platform work from the start of the recruitment or selection procedure, and Article 7(3) applies it also where digital labour platforms use automated systems taking or supporting decisions that affect persons performing platform work in any manner.

Article 1(2) states that the Directive provides measures on algorithmic management applicable to persons performing platform work in the Union, including those who do not have an employment contract or employment relationship. Article 2(1), point (c), defines a person performing platform work as an individual performing platform work, irrespective of the nature of the contractual relationship or the designation of that relationship by the parties involved.

Article 2(1), point (a), defines a digital labour platform as a natural or legal person providing a service that is provided, at least in part, at a distance by electronic means, at the request of a recipient of the service, that involves the organisation of work performed by individuals in return for payment as a necessary and essential component, and that involves the use of automated monitoring systems or automated decision-making systems.

Article 1(3) applies the Directive to digital labour platforms organising platform work performed in the Union, irrespective of their place of establishment or of the law otherwise applicable.

Article 24(1) makes the supervisory authorities responsible for monitoring the application of Regulation (EU) 2016/679 also responsible for monitoring and enforcing Articles 7 to 11 as far as data-protection matters are concerned, and applies the upper limit for administrative fines referred to in Article 83(5) of that Regulation to infringements of Articles 7 to 11.

Article 24(5) requires Member States to lay down the rules on penalties applicable to infringements of the national provisions adopted pursuant to the Directive, and the penalties must be effective, dissuasive and proportionate to the nature, gravity and duration of the undertaking's infringement and to the number of workers affected.

Article 29(1) requires Member States to bring into force the laws, regulations and administrative provisions necessary to comply with the Directive by 2 December 2026.

Article 1 applies the Regulation to the notification of personal data breaches by providers of publicly available electronic communications services. Article 2(1) requires the provider to notify all personal data breaches to the competent national authority.

Article 2(2) requires the provider to notify the breach to the competent national authority no later than 24 hours after its detection, where feasible, with the information set out in Annex I. Article 2(2) deems detection to have taken place when the provider has acquired sufficient awareness that a security incident has occurred that led to personal data being compromised.

Where all the information in Annex I is not available and further investigation is required, Article 2(3) permits an initial notification to the competent national authority no later than 24 hours after detection, containing the information in Section 1 of Annex I. The provider must make a second notification as soon as possible and at the latest within three days following the initial notification, containing the information in Section 2 of Annex I. A provider that cannot supply all the information within the three-day period must notify as much as it has within that period, submit a reasoned justification for the late notification of the remaining information, and notify the remaining information as soon as possible.

Article 3(1) requires the provider, when the breach is likely to adversely affect the personal data or privacy of a subscriber or individual, to notify that subscriber or individual of the breach in addition to the authority. Article 3(2) directs that the likelihood of adverse effect be assessed by taking account of the nature and content of the personal data, the likely consequences of the breach for the subscriber or individual, and the circumstances of the breach.

Article 3(3) requires the notification to the subscriber or individual to be made without undue delay after detection of the breach, whether or not the competent national authority has yet been notified. Article 3(4) requires the notification to the subscriber or individual to include the information set out in Annex II. The provider must not use that notification as an opportunity to promote or advertise new or additional services.

Article 3(5) permits the provider, in exceptional circumstances where notifying the subscriber or individual may put at risk the proper investigation of the breach, to delay that notification after obtaining the agreement of the competent national authority. Article 3(6) requires the provider to use, for the notification to the subscriber or individual, means of communication that ensure prompt receipt of information and that, according to the state of the art, are appropriately secured.

Article 4(1) dispenses with the notification to the subscriber or individual if the provider has demonstrated to the satisfaction of the competent national authority that it has implemented appropriate technological protection measures that were applied to the data concerned and that render the data unintelligible to any person who is not authorized to access it.

Article 4(2) treats data as unintelligible if it has been securely encrypted with a standardized algorithm, or replaced by its hashed value calculated with a standardized cryptographic keyed hash function, where in either case the key has not been compromised in any security breach and cannot be ascertained by available technological means by any person who is not authorized to access it.

Article 4(3) provides that the Commission may publish an indicative list of appropriate technological protection measures. Article 5 requires another provider contracted to deliver part of the service without a direct contractual relationship with subscribers to inform the contracting provider immediately in the case of a personal data breach.

The Regulation is adopted under Article 4(5) of Directive 2002/58/EC, which empowers the Commission to adopt technical implementing measures. Article 7 provides that the Regulation enters into force on 25 August 2013 and is binding in its entirety and directly applicable in all Member States.

Article 33(1) requires the controller to notify the competent supervisory authority without undue delay, and where feasible within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to risk individuals' rights and freedoms, and a processor must notify its controller without undue delay.

Article 34 requires notice to affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms, unless the exposed data was rendered unintelligible, for example by strong encryption, or the controller has since eliminated the high risk.

Article 4(3) requires the provider of publicly available electronic communications services, in the case of a personal data breach, to notify the breach to the competent national authority without undue delay.

Article 2, point (i), defines a personal data breach as a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed in connection with the provision of a publicly available electronic communications service in the Community.

When the breach is likely to adversely affect the personal data or privacy of a subscriber or individual, Article 4(3) requires the provider also to notify that subscriber or individual of the breach without undue delay. Notification of the subscriber or individual is not required if the provider has demonstrated to the satisfaction of the competent authority that it implemented appropriate technological protection measures and that they were applied to the data concerned by the breach.

Those technological protection measures must render the data unintelligible to any person who is not authorized to access it. Article 4(3) allows the competent national authority, having considered the likely adverse effects of the breach, to require the provider to notify the subscriber or individual if the provider has not already done so.

The notification to the subscriber or individual must at least describe the nature of the breach and the contact points where more information can be obtained, and recommend measures to mitigate the possible adverse effects of the breach. The notification to the competent national authority must in addition describe the consequences of the breach and the measures proposed or taken by the provider to address it.

Article 4(4) requires providers to maintain an inventory of personal data breaches comprising the facts surrounding the breach, its effects and the remedial action taken. The inventory may include only the information necessary to enable the competent national authorities to verify compliance.

Subject to any technical implementing measures adopted under paragraph 5, Article 4(4) provides that the competent national authorities may adopt guidelines and, where necessary, issue instructions concerning the circumstances in which providers are required to notify personal data breaches, the format of the notification and the manner in which it is made.

Article 4(4) also provides that the competent national authorities must be able to audit whether providers have complied with their notification obligations and must impose appropriate sanctions in the event of a failure to do so. Article 4(5) allows the Commission to adopt technical implementing measures concerning the circumstances, format and procedures applicable to the information and notification requirements of Article 4.

Directive 2009/136/EC, which added Article 4(3) to (5), required Member States in its Article 4(1) to adopt and publish the laws, regulations and administrative provisions necessary to comply with it by 25 May 2011. Article 15a(1) leaves penalties to the Member States, which must lay down the rules on penalties, including criminal sanctions where appropriate, and the penalties must be effective, proportionate and dissuasive.

The Commission's Digital Omnibus proposal, COM(2025) 837 of 19 November 2025, would delete Article 4 of Directive 2002/58/EC.

Establishes the lawful basis, purpose limitation, and controller and processor accountability framework for processing personal data of people in the EU. Article 6(1) requires one of six lawful bases for any processing, Articles 24-28 allocate duties between controllers, joint controllers and processors, and the Regulation applies extraterritorially to any controller or processor offering goods or services to, or monitoring, people in the EU (Article 3).

It binds public authorities as well as private sector controllers, though Article 83(7) lets Member States decide whether administrative fines apply to their own public bodies.

Article 5(1), point (a), provides that personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject. Article 5(1), point (b), provides that personal data shall be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes.

Article 5(1), point (c), provides that personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed. Article 5(1), point (d), provides that personal data shall be accurate and, where necessary, kept up to date, and that every reasonable step must be taken to ensure that inaccurate personal data are erased or rectified without delay.

Article 5(1), point (e), provides that personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.

Article 5(1), point (e), also provides that personal data may be stored for longer periods insofar as they will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1), subject to the appropriate technical and organizational measures the Regulation requires in order to safeguard the rights and freedoms of the data subject.

Article 5(1), point (f), provides that personal data shall be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures. Article 5(2) provides that the controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1.

Article 83(5), point (a), subjects infringements of the basic principles for processing, including conditions for consent, pursuant to Articles 5, 6, 7 and 9 to administrative fines up to EUR 20,000,000 or, in the case of an undertaking, up to 4 percent of the total worldwide annual turnover of the preceding financial year, whichever is higher.

Article 82(1) gives any person who has suffered material or non-material damage as a result of an infringement of the Regulation the right to receive compensation from the controller or processor for the damage suffered. Article 79(1) gives each data subject the right to an effective judicial remedy where he or she considers that his or her rights under the Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with the Regulation. Article 99(2) provides that the Regulation applies from 25 May 2018.

Article 4(1) defines personal data as any information relating to an identified or identifiable natural person, one who can be identified, directly or indirectly, and Article 4(5) defines pseudonymisation as the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that the additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.

Recital 26 provides that personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information, should be considered to be information on an identifiable natural person, and that, to determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person, with regard to objective factors such as the costs of and the amount of time required for identification, the available technology at the time of the processing and technological developments.

In Case C-582/14, Breyer, the Court of Justice held, under Directive 95/46, that a dynamic IP address registered by an online media services provider constitutes personal data in relation to that provider where it has the legal means that enable it to identify the data subject with additional data which the internet service provider has about that person.

In Case C-413/23 P, European Data Protection Supervisor v Single Resolution Board, judgment of 4 September 2025, the Court of Justice held, on the parallel definition in Regulation (EU) 2018/1725, which it said is to be interpreted in the same way as Article 4(1) of the General Data Protection Regulation (GDPR), that pseudonymised data must not be regarded as constituting, in all cases and for every person, personal data.

For a recipient, the Court held that pseudonymised data are not personal in nature only if the recipient is not in a position to lift the pseudonymisation measures during any processing under its control and the measures in fact prevent it from attributing the data to the data subject, including by cross-checking with other factors, and that where third parties have means reasonably allowing them to attribute the data to the data subject the data subject must be regarded as identifiable as regards the transfer and any subsequent processing by those third parties.

For the controller, the Court held that the identifiable nature of the data subject is assessed, for the purposes of the duty to inform the data subject of the recipients of the data, at the time of collection of the data and from the point of view of the controller, so that the duty applied before the transfer and irrespective of whether the data were personal data from the recipient's point of view.

Article 32(1), point (a), lists the pseudonymisation and encryption of personal data among the technical and organisational measures a controller and processor implement to ensure a level of security appropriate to the risk, and Article 25(1) names pseudonymisation as an example of an appropriate technical and organisational measure designed to implement data-protection principles.

Article 30(1) requires each controller and, where applicable, the controller's representative to maintain a record of processing activities under its responsibility.

Article 30(1) provides that the record shall contain the name and contact details of the controller, the purposes of the processing, a description of the categories of data subjects and of personal data, the categories of recipients, transfers to a third country or international organization where applicable, and, where possible, the envisaged time limits for erasure and a general description of the technical and organizational security measures.

Article 30(2) requires each processor and, where applicable, the processor's representative to maintain a record of all categories of processing activities carried out on behalf of a controller. Article 30(3) provides that the records shall be in writing, including in electronic form. Article 30(4) provides that the controller or the processor and, where applicable, their representative shall make the record available to the supervisory authority on request.

Article 30(5) provides that the record-keeping obligations do not apply to an enterprise or an organization employing fewer than 250 persons unless the processing it carries out is likely to result in a risk to the rights and freedoms of data subjects, the processing is not occasional, or the processing includes special categories of data referred to in Article 9(1) or personal data relating to criminal convictions and offences referred to in Article 10.

Article 83(4), point (a), subjects infringements of the obligations of the controller and the processor pursuant to Articles 8, 11, 25 to 39 and 42 and 43, a range that includes Article 30, to administrative fines up to EUR 10,000,000 or, in the case of an undertaking, up to 2 percent of the total worldwide annual turnover of the preceding financial year, whichever is higher.

Article 82(1) gives any person who has suffered material or non-material damage as a result of an infringement of the Regulation the right to receive compensation from the controller or processor for the damage suffered. Article 79(1) gives each data subject the right to an effective judicial remedy where he or she considers that his or her rights under the Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with the Regulation. Article 99(2) provides that the Regulation applies from 25 May 2018.

Article 1 provides that, for the purpose of Article 45 of Regulation (EU) 2016/679, Brazil ensures an adequate level of protection for personal data transferred from the European Union to controllers and processors in Brazil subject to the General Data Protection Law (LGPD). The Decision cites the LGPD as Law No 13.709 of 14 August 2018, the General Data Protection Law (Lei Geral de Proteção de Dados Pessoais).

Article 2 requires a Member State whose competent authorities exercise their powers under Article 58 of Regulation (EU) 2016/679 over data transfers within the scope of Article 1 to inform the Commission without delay. Article 3(1) requires the Commission to monitor continuously the application of the legal framework upon which the Decision is based with a view to assessing whether Brazil continues to ensure an adequate level of protection within the meaning of Article 1.

Article 3(2) requires the Member States and the Commission to inform each other of cases where the Brazilian Data Protection Authority (Agência Nacional de Proteção de Dados, ANPD), or any other competent Brazilian authority, fails to ensure compliance with the legal framework upon which the Decision is based.

Article 3(4) requires the Commission, after four years from the date of the notification of the Decision to the Member States and subsequently at least every four years, to evaluate the finding in Article 1 on the basis of all available information, including the information received as part of the review carried out together with the relevant Brazilian authorities.

Article 3(5) provides that, where the Commission has indications that an adequate level of protection is no longer ensured, it informs the competent Brazilian authorities and may suspend, repeal, or amend the Decision. Article 3(6) provides that the Commission may also suspend, repeal, or amend the Decision if the lack of cooperation of the Brazilian government prevents the Commission from determining whether the finding in Article 1 is affected. Article 4 provides that the Decision is addressed to the Member States.

Article 1 provides that, for the purpose of Article 45 of Regulation (EU) 2016/679, the United States ensures an adequate level of protection for personal data transferred from the Union to organizations in the United States that are included in the Data Privacy Framework List maintained and made publicly available by the United States Department of Commerce.

Article 2 requires a Member State whose competent authorities exercise their powers under Article 58 of Regulation (EU) 2016/679 over data transfers referred to in Article 1 to inform the Commission without delay.

Article 3(1) requires the Commission to monitor continuously the application of the legal framework that is the object of the Decision, including the conditions under which onward transfers are carried out, individual rights are exercised and public authorities in the United States have access to data transferred on the basis of the Decision.

Article 3(4) requires the Commission to evaluate the finding in Article 1(1) after one year from the date of the notification of the Decision to the Member States, and subsequently at a periodicity decided in close consultation with the committee established under Article 93(1) of Regulation (EU) 2016/679 and the European Data Protection Board.

Article 3(5) provides that, where the Commission has indications that an adequate level of protection is no longer ensured, it informs the competent authorities of the United States and, if necessary, decides to suspend, amend or repeal the Decision, or limit its scope, in accordance with Article 45(5) of Regulation (EU) 2016/679. Article 4 provides that the Decision is addressed to the Member States.

The Commission published its report on the first review of the functioning of the Decision on 9 October 2024. The General Court dismissed an action for annulment of the Decision in Latombe v Commission (Case T-553/23, 3 September 2025). An appeal against that judgment is pending before the Court of Justice as Case C-703/25 P.

Article 1 provides that, for the purpose of Article 45 of Regulation (EU) 2016/679, the European Patent Organisation ensures an adequate level of protection for personal data transferred from the Union to the European Patent Organisation. Recital 6 states that transfers from controllers and processors in the Union to the European Patent Organisation may take place without the need to obtain any further authorization.

Recital 6 adds that the Decision does not affect the direct application of Regulation (EU) 2016/679 to such entities where the conditions regarding the territorial scope laid down in Article 3 of that Regulation are fulfilled. Recital 14 identifies the Data Protection Rules adopted by the Administrative Council of the Organisation as the rules that regulate the processing of personal data by the European Patent Office.

Article 2 requires a Member State whose competent authorities exercise their powers under Article 58 of Regulation (EU) 2016/679 over data transfers within the scope of Article 1 to inform the Commission without delay. Article 3(3) requires the Commission, at least every four years, to evaluate the finding in Article 1 on the basis of all available information, including the information received as part of a review carried out together with the European Patent Organisation.

Article 3(4) provides that, where the Commission has indications that an adequate level of protection is no longer ensured, it informs the Organisation and, if necessary, may decide to suspend, amend or repeal the Decision, or limit its scope, in accordance with Article 45(5) of Regulation (EU) 2016/679. Article 4 provides that the Decision is addressed to the Member States.

Chapter V bars any transfer of personal data outside the EEA unless the European Commission has issued an adequacy decision (Article 45), the transfer is covered by an appropriate safeguard such as Binding Corporate Rules or Standard Contractual Clauses, or a narrow Article 49 derogation applies.

For transfers on standard clauses, the Court of Justice's Schrems II judgment (Case C-311/18, 16 July 2020) requires the exporter to verify case by case that the law of the destination country ensures adequate protection, adding safeguards where necessary. Transfers to United States organisations on the Data Privacy Framework List can rely on the EU-US Data Privacy Framework, found adequate by Commission Implementing Decision (EU) 2023/1795.

The General Court upheld that adequacy decision at first instance in Latombe v Commission (Case T-553/23, 3 September 2025). An appeal against that judgment is pending before the Court of Justice as Case C-703/25 P, with no hearing date set as of the date shown.

Article 1(1) provides that, for the purposes of Article 45 of Regulation (EU) 2016/679, Japan ensures an adequate level of protection for personal data transferred from the European Union to personal information handling business operators in Japan subject to the Act on the Protection of Personal Information as complemented by the Supplementary Rules set out in Annex I, together with the official representations, assurances and commitments contained in Annex II.

Article 1(2) provides that the Decision does not cover personal data transferred to broadcasting institutions, newspaper publishers, communication agencies or other press organizations, persons engaged in professional writing, universities and other academic organizations, religious bodies or political bodies, to the extent the purposes of processing correspond to the press, writing, academic, religious or political purposes listed.

Article 2 requires a Member State whose competent authorities exercise their powers under Article 58 of Regulation (EU) 2016/679 leading to the suspension or definitive ban of data flows to a specific business operator in Japan within the scope of Article 1 to inform the Commission without delay.

Article 3(4) requires the Commission, within two years from the date of the notification of the Decision to the Member States and subsequently at least every four years, to evaluate the finding in Article 1(1) on the basis of all available information, including the information received as part of the Joint Review carried out together with the relevant Japanese authorities.

Article 3(5) provides that, where the Commission has indications that an adequate level of protection is no longer ensured, it informs the competent Japanese authorities and, if necessary, may decide to suspend, amend or repeal the Decision, or limit its scope, in particular where business operators in Japan do not comply with the additional safeguards in the Supplementary Rules in Annex I or there is insufficient oversight and enforcement in this regard.

Article 4 provides that the Decision is addressed to the Member States. The Commission's report on the first review of the functioning of the Decision (COM(2023) 275 final) concludes that Japan continues to ensure an adequate level of protection for personal data from the European Union to personal information handling business operators in Japan subject to the Act on the Protection of Personal Information as complemented by the Supplementary Rules.

Article 1(1) provides that, for the purpose of Article 45 of Regulation (EU) 2016/679, the Republic of Korea ensures an adequate level of protection for personal data transferred from the European Union to entities in the Republic of Korea subject to the Personal Information Protection Act as complemented by the additional safeguards set out in Annex I, together with the official representations, assurances and commitments contained in Annex II.

Article 1(2) provides that the Decision does not cover personal data transferred to religious organizations processing it for their missionary activities, political parties processing it in the context of the nomination of candidates, or entities subject to oversight by the Financial Services Commission for the processing of personal credit information pursuant to the Credit Information Act, to the extent they process such information.

Article 2 requires a Member State whose competent authorities exercise their powers under Article 58 of Regulation (EU) 2016/679 over data transfers within the scope of Article 1 to inform the Commission without delay.

Article 3(4) requires the Commission, after three years from the date of the notification of the Decision to the Member States and subsequently at least every four years, to evaluate the finding in Article 1(1) on the basis of all available information, including the information received as part of the review carried out together with the relevant Korean authorities.

Article 3(5) provides that, where the Commission has indications that an adequate level of protection is no longer ensured, it informs the competent Korean authorities and, if necessary, may decide to suspend, amend or repeal the Decision, or limit its scope, in accordance with Article 45(5) of Regulation (EU) 2016/679. Article 4 provides that the Decision is addressed to the Member States.

The Commission announced on 23 July 2026 that it had concluded its first review of the Decision and found that the Republic of Korea continues to provide an adequate level of protection of personal data.

Article 1(1) provides that the standard contractual clauses set out in the Annex are considered to provide appropriate safeguards within the meaning of Article 46(1) and (2)(c) of Regulation (EU) 2016/679 for a transfer by a controller or processor to a controller or (sub-)processor whose processing of the data is not subject to that Regulation.

The Annex sets out the Clauses in four Modules: transfer controller to controller, controller to processor, processor to processor and processor to controller. Clause 2(a) treats the Clauses as appropriate safeguards provided they are not modified, except to select the appropriate Module or Modules or to add or update information in the Appendix.

Recital 7 states that the Clauses may be used for such transfers only to the extent that the processing by the importer does not fall within the scope of Regulation (EU) 2016/679. Under Clause 14(a) the Parties warrant that they have no reason to believe that the laws and practices of the third country of destination applicable to the processing of the personal data by the data importer prevent the data importer from fulfilling its obligations under the Clauses.

Clause 14(d) requires the Parties to document the assessment of those laws and practices and to make it available to the competent supervisory authority on request. Clause 14(f) requires the data exporter to suspend the data transfer if it considers that no appropriate safeguards can be ensured, or if instructed to do so by the competent supervisory authority or, in Module Three, by the controller.

Under Clause 15.1(a) the data importer notifies the data exporter and, where possible, the data subject promptly if it receives a legally binding request from a public authority for disclosure of the transferred personal data. Under Clause 15.2(a) the data importer reviews the legality of a request for disclosure and challenges it if, after careful assessment, it concludes that there are reasonable grounds to consider the request unlawful under the laws of the country of destination.

Article 2 requires a Member State whose competent authorities exercise corrective powers under Article 58 of Regulation (EU) 2016/679 in response to the data importer being or becoming subject to laws or practices that prevent compliance with the Clauses, leading to the suspension or ban of data transfers, to inform the Commission without delay.

Article 4(1) provides that the Decision enters into force on the twentieth day following that of its publication in the Official Journal of the European Union. Article 4(2) and (3) repeal Decision 2001/497/EC and Decision 2010/87/EU with effect from 27 September 2021.

Article 4(4) deems contracts concluded before 27 September 2021 on the basis of Decision 2001/497/EC or Decision 2010/87/EU to provide appropriate safeguards until 27 December 2022, provided the processing operations that are the subject matter of the contract remain unchanged and that reliance on those clauses ensures that the transfer is subject to appropriate safeguards.

Article 1(1) of Implementing Decision (EU) 2021/1772 provides that, for the purposes of Article 45 of Regulation (EU) 2016/679, the United Kingdom ensures an adequate level of protection for personal data transferred within the scope of that Regulation from the European Union to the United Kingdom. Article 4 of the original Decision provided that it would expire on 27 June 2025, unless extended in accordance with the procedure referred to in Article 93(2) of Regulation (EU) 2016/679.

Implementing Decision (EU) 2025/1226 of 24 June 2025 replaced Article 4 of the original Decision so that it would expire on 27 December 2025, unless extended in accordance with the procedure referred to in Article 93(2) of Regulation (EU) 2016/679.

Implementing Decision (EU) 2025/2574 of 19 December 2025 records the Commission's conclusion that, on the basis of its assessment of developments including the amendments introduced by the Data (Use and Access) Act, the United Kingdom continues to ensure an adequate level of protection for personal data transferred within the scope of Regulation (EU) 2016/679 from the European Union to the United Kingdom.

Article 4 of the Decision, as replaced by Implementing Decision (EU) 2025/2574, provides that the Decision expires on 27 December 2031, unless extended in accordance with the procedure referred to in Article 93(2) of Regulation (EU) 2016/679. Article 1(2) of the original Decision excluded personal data transferred for the purposes of United Kingdom immigration control from the finding. Article 1 of Implementing Decision (EU) 2025/2574 repealed Article 1(2) of the original Decision.

Article 3(1) requires the Commission to monitor continuously the application of the legal framework on which the Decision is based, including the conditions under which onward transfers are carried out, individual rights are exercised and United Kingdom public authorities have access to data transferred on the basis of the Decision.

Article 3(4) provides that, where the Commission has indications that an adequate level of protection is no longer ensured, it informs the competent United Kingdom authorities and may suspend, repeal or amend the Decision. Article 5 provides that the Decision is addressed to the Member States.

Article 3 of Regulation (EU) 2024/1624 lists credit institutions and financial institutions among the obliged entities. Article 76(5) provides that obliged entities may adopt decisions resulting from automated processes, including profiling as defined in Article 4, point (4), of Regulation (EU) 2016/679, or from processes involving AI systems as defined in Article 3, point (1), of the Artificial Intelligence Act, provided that the conditions in points (a) to (c) are met.

The footnote to Article 76(5) identifies the Regulation it cites as the Regulation laying down harmonised rules on artificial intelligence, the Artificial Intelligence Act. Point (a) of Article 76(5) requires that the data processed by such systems is limited to data obtained pursuant to Chapter III of the Regulation.

Point (b) requires that any decision to enter or refuse to enter into or maintain a business relationship with a customer, or to carry out or refuse to carry out an occasional transaction for a customer, or to increase or decrease the extent of the customer due diligence measures applied pursuant to Article 20, is subject to meaningful human intervention to ensure the accuracy and appropriateness of such a decision.

Point (c) requires that the customer may obtain an explanation of the decision reached by the obliged entity, and may challenge that decision, except in relation to a report as referred to in Article 69. Article 90 provides that the Regulation applies from 10 July 2027, except in relation to the obliged entities referred to in Article 3, points (3)(n) and (o), to which it applies from 10 July 2029.

Article 18(8) provides that, where the creditworthiness assessment involves the use of automated processing of personal data, Member States shall ensure that the consumer has the right to request and obtain from the creditor human intervention.

That right consists of the right to request and obtain from the creditor a clear and comprehensible explanation of the assessment of creditworthiness, including on the logic and risks involved in the automated processing of personal data as well as its significance and effects on the decision. It consists of the right to express the consumer's own point of view to the creditor.

It also consists of the right to request a review of the assessment of the creditworthiness and the decision on the granting of the credit by the creditor. Article 18(8) also requires Member States to ensure that the consumer is informed of that right.

Article 18(9), second sentence, provides that, where applicable, the creditor shall be required to inform the consumer of the fact that the assessment of creditworthiness is based on automated processing of data and about the consumer's right to human assessment and the procedure for contesting the decision.

Article 3, point (2), defines a creditor as a natural or legal person who grants or promises to grant credit in the course of that person's trade, business or profession. Article 2(1) provides that the Directive applies to credit agreements.

Article 2(2), point (a), excludes from the Directive credit agreements secured by a mortgage, or by another comparable security commonly used in a Member State on immovable property, or secured by a right related to immovable property. Article 2(2), point (c), excludes from the Directive credit agreements involving a total amount of credit of more than EUR 100,000.

Article 2(3) applies the Directive to a credit agreement of more than EUR 100,000 that is not secured by a mortgage, by another comparable security on immovable property or by a right related to immovable property, where its purpose is the renovation of a residential immovable property.

Article 2(2), point (l), excludes from the Directive credit agreements existing on 20 November 2026, but Articles 23 and 24, Article 25(1), second sentence, Article 25(2) and Articles 28 and 39 apply to all open-end credit agreements existing on that date.

Article 40(1) requires Member States to ensure that consumers have access to adequate, prompt and effective out-of-court dispute resolution procedures for the settlement of disputes between consumers and creditors or credit intermediaries concerning rights and obligations relating to credit agreements established under the Directive.

Article 44(1) requires Member States to lay down the rules on penalties applicable to infringements of the national provisions adopted pursuant to the Directive, and provides that the penalties must be effective, proportionate and dissuasive. Article 48(1) requires Member States to adopt and publish by 20 November 2025 the laws, regulations and administrative provisions necessary to comply with the Directive, and to apply those measures from 20 November 2026.

Article 1(5) provides that, insofar as users are data subjects, the rights laid down in Chapter II of the Regulation complement the rights of access by data subjects and rights to data portability under Articles 15 and 20 of Regulation (EU) 2016/679.

Article 1(5) provides that the Regulation is without prejudice to Union and national law on the protection of personal data, which applies to personal data processed in connection with the rights and obligations laid down in the Regulation, in particular Regulation (EU) 2016/679 and Directive 2002/58/EC.

Article 1(5) adds that, in the event of a conflict between the Regulation and Union law on the protection of personal data or privacy, or national legislation adopted in accordance with such Union law, the relevant Union or national law on the protection of personal data or privacy prevails.

Article 1(2) provides that the Regulation covers personal and non-personal data, and that point (a) applies Chapter II to data, with the exception of content, concerning the performance, use and environment of connected products and related services. Article 1(3), point (a), applies the Regulation to manufacturers of connected products placed on the market in the Union and providers of related services, irrespective of the place of establishment of those manufacturers and providers.

Article 1(3), point (c), applies the Regulation to data holders, irrespective of their place of establishment, that make data available to data recipients in the Union.

Article 2, point (5), defines a connected product as an item that obtains, generates or collects data concerning its use or environment and that is able to communicate product data via an electronic communications service, physical connection or on-device access, and whose primary function is not the storing, processing or transmission of data on behalf of any party other than the user.

Article 2, point (6), defines a related service as a digital service, other than an electronic communications service, including software, which is connected with the product at the time of the purchase, rent or lease in such a way that its absence would prevent the connected product from performing one or more of its functions, or which is subsequently connected to the product by the manufacturer or a third party to add to, update or adapt the functions of the connected product.

Article 2, point (12), defines a user as a natural or legal person that owns a connected product or to whom temporary rights to use that connected product have been contractually transferred, or that receives related services.

Article 2, point (13), defines a data holder as a natural or legal person that has the right or obligation, in accordance with the Regulation, applicable Union law or national legislation adopted in accordance with Union law, to use and make available data, including, where contractually agreed, product data or related service data which it has retrieved or generated during the provision of a related service.

Article 2, point (17), defines readily available data as product data and related service data that a data holder lawfully obtains or can lawfully obtain from the connected product or related service, without disproportionate effort going beyond a simple operation.

Article 3(1) provides that connected products shall be designed and manufactured, and related services designed and provided, in such a manner that product data and related service data, including the relevant metadata necessary to interpret and use those data, are, by default, easily, securely, free of charge, in a comprehensive, structured, commonly used and machine-readable format, and, where relevant and technically feasible, directly accessible to the user.

Article 3(2) requires the seller, rentor or lessor of a connected product, which may be the manufacturer, to provide the user with at least the information listed in points (a) to (d), in a clear and comprehensible manner, before concluding a contract for the purchase, rent or lease of the product.

Article 3(3) requires the provider of a related service to provide the user with at least the information listed in points (a) to (i), in a clear and comprehensible manner, before concluding a contract for the provision of the related service.

Article 4(1) requires data holders, where data cannot be directly accessed by the user from the connected product or related service, to make readily available data, as well as the relevant metadata necessary to interpret and use those data, accessible to the user without undue delay, of the same quality as is available to the data holder, easily, securely, free of charge, in a comprehensive, structured, commonly used and machine-readable format and, where relevant and technically feasible, continuously and in real-time.

Article 4(12) provides that, where the user is not the data subject whose personal data is requested, personal data generated by the use of a connected product or related service shall be made available by the data holder to the user only where there is a valid legal basis for processing under Article 6 of Regulation (EU) 2016/679 and, where relevant, the conditions of Article 9 of that Regulation and of Article 5(3) of Directive 2002/58/EC are fulfilled.

Article 5(1) requires the data holder, upon request by a user or by a party acting on behalf of a user, to make readily available data, as well as the relevant metadata necessary to interpret and use those data, available to a third party without undue delay, of the same quality as is available to the data holder, easily, securely, free of charge to the user, in a comprehensive, structured, commonly used and machine-readable format and, where relevant and technically feasible, continuously and in real-time.

Article 5(2) provides that Article 5(1) does not apply to readily available data in the context of the testing of new connected products, substances or processes that are not yet placed on the market, unless their use by a third party is contractually permitted. Article 5(3) provides that an undertaking designated as a gatekeeper pursuant to Article 3 of Regulation (EU) 2022/1925 shall not be an eligible third party under Article 5.

Article 7(1) provides that the obligations of Chapter II do not apply to data generated through the use of connected products manufactured or designed, or related services provided, by a microenterprise or a small enterprise, provided that the enterprise does not have a partner enterprise or a linked enterprise within the meaning of Article 3 of the Annex to Recommendation 2003/361/EC that does not qualify as a microenterprise or a small enterprise and is not subcontracted to manufacture or design a connected product or to provide a related service.

Article 7(1) applies the same exclusion to data generated through the use of connected products manufactured by, or related services provided by, an enterprise that has qualified as a medium-sized enterprise for less than one year, and to connected products for one year after the date on which a medium-sized enterprise placed them on the market.

Article 7(2) provides that any contractual term which, to the detriment of the user, excludes the application of, derogates from or varies the effect of the user's rights under Chapter II shall not be binding on the user.

Article 38(1) gives natural and legal persons the right to lodge a complaint, individually or collectively, with the relevant competent authority in the Member State of their habitual residence, place of work or establishment if they consider that their rights under the Regulation have been infringed.

Article 40(1) requires Member States to lay down the rules on penalties applicable to infringements of the Regulation, and provides that the penalties shall be effective, proportionate and dissuasive.

Article 40(4) provides that, for infringements of the obligations laid down in Chapters II, III and V, the supervisory authorities responsible for monitoring the application of Regulation (EU) 2016/679 may within their scope of competence impose administrative fines in accordance with Article 83 of that Regulation and up to the amount referred to in Article 83(5) of that Regulation.

Article 50 provides that the obligation resulting from Article 3(1) applies to connected products and the services related to them placed on the market after 12 September 2026.

Article 1(2), point (a), states that the Regulation specifies and complements the rights laid down in Regulation (EU) 2016/679 of natural persons in relation to the primary use and secondary use of their personal electronic health data.

Article 71(1) gives natural persons the right to opt out at any time, and without providing any reason, from the processing of personal electronic health data relating to them for secondary use under the Regulation, and provides that the exercise of that right shall be reversible.

Article 71(2) requires Member States to provide an accessible and easily understandable opt-out mechanism by which natural persons may explicitly state that they do not wish to have their personal electronic health data processed for secondary use.

Article 71(3) provides that, once a natural person has exercised the right to opt out, and where personal electronic health data relating to that person can be identified in a dataset, the data shall not be made available or otherwise processed pursuant to data permits issued under Article 68 or health data requests under Article 69 approved after the person exercised the right, and that this does not affect processing under data permits or health data requests issued or approved before.

Article 71(4) lets a Member State provide in its national law for a mechanism to make data for which a right to opt out has been exercised available, where a public sector body, a Union institution, body, office or agency with a public health mandate, or another entity entrusted with public tasks in the area of public health applies for processing necessary for the purposes in Article 53(1), points (a), (b) and (c), or for scientific research for important reasons of public interest, the data cannot be obtained by alternative means in a timely and effective manner under equivalent conditions, and the health data applicant has provided the required justification.

Article 71(8) provides that, when the purposes of the processing of personal electronic health data by a health data holder do not or no longer require the identification of a data subject by the controller, the health data holder shall not be obliged to maintain, acquire or process additional information in order to identify the data subject for the sole purpose of complying with the right to opt out.

Article 105 applies Chapter IV, in which Article 71 sits, from 26 March 2029, and applies Article 51(1), points (b), (f), (g), (m) and (p), from 26 March 2031. Article 81(4) provides that a complaint concerning the rights of natural persons pursuant to Article 71 is transmitted to the competent supervisory authority under Regulation (EU) 2016/679.

Article 99 requires Member States to lay down the rules on penalties applicable to infringements of the Regulation, in particular for infringements which are not subject to administrative fines pursuant to Articles 63 and 64. Article 100 gives any natural or legal person that has suffered material or non-material damage as a result of an infringement of the Regulation the right to receive compensation in accordance with Union and national law.

Article 1(2), point (a), states that the Regulation specifies and complements the rights laid down in Regulation (EU) 2016/679 of natural persons in relation to the primary use and secondary use of their personal electronic health data.

Article 3(1) gives natural persons the right to access at least the personal electronic health data relating to them that belong to the priority categories referred to in Article 14 and are processed for the provision of healthcare through the electronic health data access services referred to in Article 4.

Article 3(1) adds that access is provided immediately after the personal electronic health data have been registered in an EHR system, while respecting the need for technological practicability, free of charge and in an easily readable, consolidated and accessible format.

Article 3(2) gives natural persons, or their representatives, the right to download free of charge an electronic copy of at least the personal electronic health data in the priority categories of Article 14 related to them, in the European electronic health record exchange format referred to in Article 15.

Article 3(3) permits Member States, in accordance with Article 23 of Regulation (EU) 2016/679, to restrict the scope of the rights in Article 3(1) and (2), in particular by delaying access for a limited period until a health professional is able to properly communicate and explain information that can have a significant impact on a person's health.

Article 4(1) requires Member States to ensure that one or more electronic health data access services are established at national, regional or local level, enabling natural persons to access their personal electronic health data and exercise their rights provided for in Articles 3 and 5 to 10, free of charge for the natural persons and their representatives.

Article 5 gives natural persons, or their representatives, the right to insert information in their own EHR through electronic health data access services or applications linked to those services, and provides that they shall not be able to directly alter the electronic health data and related information inserted by health professionals.

Article 6 requires electronic health data access services to enable natural persons to easily request online the rectification of their personal electronic health data in accordance with Article 16 of Regulation (EU) 2016/679.

Article 7(1) gives natural persons the right to give access to, or to request a healthcare provider to transmit, all or part of their personal electronic health data to another healthcare provider of their choice immediately, free of charge and without hindrance from the healthcare provider or from the manufacturers of the systems used by that healthcare provider.

Article 7(2) gives natural persons, where the healthcare providers are located in different Member States, the right to request the transmission of their personal electronic health data in the European electronic health record exchange format through the cross-border infrastructure referred to in Article 23, and requires the receiving healthcare provider to accept such data and to be able to read them.

Article 7(3) gives natural persons the right to request a healthcare provider to transmit a part of their personal electronic health data to a clearly identified recipient in the social security or reimbursement services sector, immediately, free of charge, without hindrance and one-way only.

Article 8 gives natural persons the right to restrict the access of health professionals and healthcare providers to all or parts of their personal electronic health data as referred to in Article 3, and provides that the fact that a natural person has restricted access shall not be visible to healthcare providers.

Article 9(1) gives natural persons the right to obtain information, including through automatic notifications, on any access to their personal electronic health data through the health professional access service obtained in the context of healthcare.

Article 9(2) requires that information to be provided free of charge and without delay through the electronic health data access services, to be available for at least three years from each date of access, and to include at least who accessed the data, the date and time of access and which data were accessed.

Article 10(1) provides that Member States' laws may give natural persons the right to opt out from the access to their personal electronic health data registered in an EHR system through the electronic health data access services, and that in such cases Member States shall ensure that the exercise of that right is reversible.

Article 14(1) lists the priority categories of personal electronic health data for primary use as patient summaries, electronic prescriptions, electronic dispensations, medical imaging studies and related imaging reports, medical test results, and discharge reports.

Article 105 applies Articles 3 to 15 from 26 March 2029 to the priority categories of personal electronic health data in Article 14(1), points (a), (b) and (c), and to EHR systems intended by the manufacturer to process such categories of data, and from 26 March 2031 to the categories in points (d), (e) and (f), and to EHR systems intended by the manufacturer to process them.

Article 22 makes the supervisory authorities responsible for monitoring and enforcing Regulation (EU) 2016/679 also competent for monitoring and enforcing Articles 3 and 5 to 10 of the Regulation. Article 22 empowers those supervisory authorities to impose administrative fines up to the amount referred to in Article 83(5) of Regulation (EU) 2016/679.

Article 99 requires Member States to lay down the rules on penalties applicable to infringements of the Regulation, in particular for infringements which are not subject to administrative fines pursuant to Articles 63 and 64. Article 100 gives any natural or legal person that has suffered material or non-material damage as a result of an infringement of the Regulation the right to receive compensation in accordance with Union and national law.

Article 22(1) gives a data subject the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them.

Article 22(2) narrows that right where the decision is necessary to enter into or perform a contract with the data subject, is authorised by Union or Member State law that itself safeguards the data subject's rights, or rests on the data subject's explicit consent, and Article 22(3) conditions the contract and consent exceptions on suitable safeguards, at minimum the right to obtain human intervention, to express a point of view, and to contest the decision.

Article 22(4) forbids basing such a decision on special category data under Article 9(1) unless the data subject gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, again with suitable safeguards.

Articles 13(2)(f), 14(2)(g) and 15(1)(h) require the controller to tell the data subject, at collection (Article 13), within the Article 14(3) period where the data came from another source, and on an access request (Article 15), that automated decision-making of the kind Article 22(1) and (4) describes occurs and to give, at least in those cases, meaningful information about the logic involved, the significance, and the envisaged consequences.

The Court of Justice held in SCHUFA (Case C-634/21, 7 December 2023) that a credit information agency's automated credit score falls within Article 22 where a third party to which it is transmitted draws strongly on it to establish, implement or terminate a contractual relationship, even though the scoring entity is not the final decision maker.

Articles 12-21 give a data subject access (Article 15), rectification (Article 16), erasure (Article 17), restriction (Article 18), portability (Article 20) and objection (Article 21) rights against the controller, ordinarily to be honored within one month.

Article 22 itself applies only where a decision described in Article 22(1) is made, and the Article 13(2)(f), 14(2)(g) and 15(1)(h) duties to disclose the existence of automated decision-making, and meaningful information about its logic, cover at least the decisions described in Article 22(1) and (4).

Article 9(1) requires Member States to require digital labour platforms to inform persons performing platform work, platform workers' representatives and, upon request, national competent authorities, of the use of automated monitoring systems or automated decision-making systems.

For automated monitoring systems, Article 9(1), point (a), covers the fact that such systems are in use or are in the process of being introduced, the categories of data and action monitored, supervised or evaluated, the aim of the monitoring and how the system is to carry it out, and the recipients or categories of recipient of the personal data processed and any transmission or transfer of it, including within a group of undertakings.

For automated decision-making systems, Article 9(1), point (b), covers the fact that such systems are in use or are in the process of being introduced, the categories of decision taken or supported, the categories of data and the main parameters that such systems take into account and their relative importance, including the way the personal data or behaviour of the person performing platform work influence the decisions, and the grounds for decisions to restrict, suspend or terminate the account of the person performing platform work, to refuse the payment for work performed by them, as well as decisions on their contractual status or any decision of equivalent or detrimental effect.

Article 9(1), point (c), adds all categories of decision taken or supported by automated systems that affect persons performing platform work in any manner. Article 9(2) requires the information in the form of a written document, which may be in electronic form, presented in a transparent, intelligible and easily accessible form, using clear and plain language.

Article 9(3) requires digital labour platforms to give persons performing platform work, in a concise form, the information about the systems and their features that directly affect them, at the latest on the first working day, prior to the introduction of changes affecting working conditions, the organisation of work or monitoring work performance, and at any time upon their request.

Article 9(4) requires digital labour platforms to give workers' representatives, in a comprehensive and detailed form, the information about all relevant systems and their features prior to the use of those systems, prior to the introduction of changes affecting working conditions, the organisation of work or monitoring work performance, and at any time upon their request, and to give national competent authorities the same information at any time upon their request.

Article 9(5) requires digital labour platforms to give persons undergoing a recruitment or selection procedure concise information, concerning only the systems used in that procedure, before the start of the procedure.

Article 9(6) gives persons performing platform work the right to the portability of personal data generated through their performance of work in the context of a digital labour platform's automated monitoring systems or automated decision-making systems, including ratings and reviews, and requires the platform to provide free tools to exercise it and, on request, to transmit the data directly to a third party.

Article 10(1) requires Member States to ensure that digital labour platforms oversee and, with the involvement of workers' representatives, regularly and in any event every two years, evaluate the impact of individual decisions taken or supported by automated monitoring systems and automated decision-making systems on persons performing platform work.

Article 10(2) requires Member States to require digital labour platforms to ensure sufficient human resources for the effective oversight and evaluation of those decisions, with persons charged with that function who have the competence, training and authority necessary, including for overriding automated decisions.

Article 10(5) provides that any decision to restrict, suspend or terminate the contractual relationship or the account of a person performing platform work, or any other decision of equivalent detriment, shall be taken by a human being. Article 11(1) provides that persons performing platform work have the right to obtain an oral or written explanation from the digital labour platform for any decision taken or supported by an automated decision-making system without undue delay.

Article 11(2) gives persons performing platform work the right to request the digital labour platform to review the decisions referred to in Article 11(1), and requires a sufficiently precise and adequately substantiated written reply without undue delay and in any event within two weeks of receipt of the request.

Article 11(3) requires the digital labour platform, where such a decision infringes the rights of a person performing platform work, to rectify it without delay and in any case within two weeks of its adoption, or, where rectification is not possible, to offer adequate compensation for the damage sustained. Article 11(5) provides that Article 11 does not apply to persons performing platform work who are also business users as defined in Article 2, point (1), of Regulation (EU) 2019/1150.

Article 1(2) states that the Directive provides measures on algorithmic management applicable to persons performing platform work in the Union, including those who do not have an employment contract or employment relationship. Article 2(1), point (c), defines a person performing platform work as an individual performing platform work, irrespective of the nature of the contractual relationship or the designation of that relationship by the parties involved.

Article 2(1), point (a), defines a digital labour platform as a natural or legal person providing a service that is provided, at least in part, at a distance by electronic means, at the request of a recipient of the service, that involves the organisation of work performed by individuals in return for payment as a necessary and essential component, and that involves the use of automated monitoring systems or automated decision-making systems.

Article 1(3) applies the Directive to digital labour platforms organising platform work performed in the Union, irrespective of their place of establishment or of the law otherwise applicable.

Article 24(1) makes the supervisory authorities responsible for monitoring the application of Regulation (EU) 2016/679 also responsible for monitoring and enforcing Articles 7 to 11 as far as data-protection matters are concerned, and applies the upper limit for administrative fines referred to in Article 83(5) of that Regulation to infringements of Articles 7 to 11.

Article 24(5) requires Member States to lay down the rules on penalties applicable to infringements of the national provisions adopted pursuant to the Directive, and the penalties must be effective, dissuasive and proportionate to the nature, gravity and duration of the undertaking's infringement and to the number of workers affected.

Article 29(1) requires Member States to bring into force the laws, regulations and administrative provisions necessary to comply with the Directive by 2 December 2026.

Each Member State designates an independent supervisory authority (Article 51) with investigative and corrective powers, including orders and bans on processing (Article 58); cross border cases route through a lead authority under the one stop shop mechanism (Articles 56, 60-63), coordinated by the European Data Protection Board (Articles 68-76).

Article 83 sets administrative fines up to the higher of EUR 20,000,000 or 4 percent of global annual turnover for infringements of the basic processing principles, data subjects' rights, transfer rules and supervisory authority orders (Article 83(5)), and up to the higher of EUR 10,000,000 or 2 percent for the controller and processor obligations in Articles 8, 11, 25 to 39, 42 and 43 (Article 83(4)).

Article 82(1) arms a direct private right of action, letting any person who suffered material or non-material damage claim compensation from the controller or processor, though the Court of Justice held actual, if not necessarily serious, damage must be shown rather than the mere fact of infringement (UI v Österreichische Post, Case C-300/21, 4 May 2023). Article 80 lets a not for profit body pursue a complaint or judicial remedy on a data subject's behalf.

The Representative Actions Directive (EU) 2020/1828 separately lists Regulation (EU) 2016/679 in its Annex I, letting a qualified entity bring a representative action for collective consumer redress over a General Data Protection Regulation (GDPR) infringement. The Dutch, Italian and French data protection authorities each took enforcement action against Clearview AI over the same underlying conduct, the Netherlands imposing EUR 30.5 million in a decision dated 16 May 2024.

The Hellenic Data Protection Authority separately fined Clearview EUR 20,000,000 on 13 July 2022 for infringing the principles of lawfulness and transparency (Articles 5, 6 and 9) and Articles 12, 14, 15 and 27 in connection with its facial recognition service.

Regulation (EU) 2025/2518 of 26 November 2025, published in the Official Journal on 12 December 2025, lays down procedural rules for the handling of complaints and the conduct of investigations in complaint-based and ex officio cases by supervisory authorities in the enforcement of Regulation (EU) 2016/679 where those cases concern cross-border processing.

A party under investigation is the controller or processor investigated for an alleged infringement of Regulation (EU) 2016/679 that concerns cross-border processing. Under Article 19, the preliminary findings must set out clearly all the facts, the list of the evidence relied upon and the entire legal assessment raised against the parties under investigation, so that they can express their views before the lead supervisory authority submits a draft decision.

A complaint concerning cross-border processing is admissible if it includes the items Article 4(1) lists, among them the complainant's name and contact details, information which facilitates the identification of the controller or processor and a description of the alleged infringement, and no additional information may be required for admissibility. The Regulation enters into force on the twentieth day following that of its publication in the Official Journal and applies from 2 April 2027.

Article 2(1) applies the Directive to representative actions brought against infringements by traders of the provisions of Union law referred to in Annex I, including such provisions as transposed into national law, that harm or may harm the collective interests of consumers. Annex I, point (56), lists Regulation (EU) 2016/679, the General Data Protection Regulation, among those provisions.

The Directive applies to domestic and cross-border infringements, including infringements that ceased before the representative action was brought or concluded. Article 3, point (2), defines a trader as any natural person, or any legal person irrespective of whether privately or publicly owned, that acts for purposes relating to that person's trade, business, craft or profession.

Article 3, point (4), defines a qualified entity as an organization or public body representing consumers' interests that has been designated by a Member State as qualified to bring representative actions. Article 3, point (5), defines a representative action as an action for the protection of the collective interests of consumers that is brought by a qualified entity as a claimant party on behalf of consumers to seek an injunctive measure, a redress measure, or both.

Article 4(1) requires Member States to ensure that representative actions can be brought by qualified entities that the Member States have designated for this purpose. Article 7(4) requires Member States to ensure that qualified entities are entitled to seek at least injunctive measures and redress measures.

Article 8(1) requires Member States to make injunctive measures available as a provisional measure to cease or prohibit a practice deemed to be an infringement and as a definitive measure to cease or prohibit a practice found to be an infringement.

To seek an injunctive measure, Article 8(3) provides that individual consumers are not required to express their wish to be represented and that the qualified entity is not required to prove actual loss or damage to the consumers or intent or negligence on the part of the trader.

Article 9(1) provides that a redress measure requires a trader to provide the consumers concerned with remedies such as compensation, repair, replacement, price reduction, contract termination or reimbursement of the price paid, as appropriate and as available under Union or national law.

Article 9(8) requires Member States to ensure that qualified entities can bring representative actions for a redress measure without a court or administrative authority having previously established an infringement in separate proceedings. Article 19(1) requires Member States to lay down the rules on penalties applicable to the failure or refusal to comply with an injunctive measure.

Article 24(1) required Member States to adopt and publish the laws, regulations and administrative provisions necessary to comply with the Directive by 25 December 2022 and to apply those measures from 25 June 2023.

Article 76(1) provides that, to the extent that it is strictly necessary for the purposes of preventing money laundering and terrorist financing, obliged entities may process special categories of personal data referred to in Article 9(1) of Regulation (EU) 2016/679 and personal data relating to criminal convictions and offences referred to in Article 10 of that Regulation, subject to the safeguards in paragraphs 2 and 3 of Article 76.

Article 76(2) permits an obliged entity to process personal data covered by Article 9 of Regulation (EU) 2016/679 provided that it informs its customers or prospective customers that such categories of data may be processed for the purpose of complying with the requirements of the Regulation, the data originate from reliable sources and are accurate and up-to-date, it does not take decisions that would lead to biased and discriminatory outcomes on the basis of those data, and it adopts measures of a high level of security in accordance with Article 32 of Regulation (EU) 2016/679, in particular in terms of confidentiality.

Article 76(3) permits an obliged entity to process personal data covered by Article 10 of Regulation (EU) 2016/679 provided that it complies with the conditions of Article 76(2), the data relate to money laundering, its predicate offences or terrorist financing, and it has procedures in place that allow the distinction, in the processing of such data, between allegations, investigations, proceedings and convictions, taking into account the fundamental right to a fair trial, the right of defence and the presumption of innocence.

Article 76(4) provides that personal data shall be processed by obliged entities on the basis of the Regulation only for the purposes of the prevention of money laundering and terrorist financing and shall not be further processed in a way that is incompatible with those purposes. Article 76(4) prohibits the processing of personal data on the basis of the Regulation for commercial purposes.

Article 77(3) provides that the information referred to in Article 77(1) and (2) shall be retained for a period of 5 years commencing on the date of the termination of the business relationship, on the date of the carrying out of the occasional transaction, or on the date of refusal to enter into a business relationship or carry out an occasional transaction.

Article 77(3) provides that, without prejudice to retention periods for data collected for the purposes of other Union legal acts or national law complying with Regulation (EU) 2016/679, obliged entities shall delete personal data upon expiry of the five-year period.

Article 77(3) lets competent authorities require further retention on a case-by-case basis where it is necessary for the prevention, detection, investigation or prosecution of money laundering or terrorist financing, for a further period that shall not exceed 5 years.

Article 3 lists credit institutions and financial institutions among the obliged entities.

Article 3, point (3), lists as further obliged entities, when acting in the exercise of their professional activities and in the cases it describes, auditors, external accountants and tax advisors, notaries, lawyers and other independent legal professionals, trust or company service providers, estate agents and other real estate professionals, persons trading in precious metals and stones or in high-value goods, providers of gambling services, crowdfunding service providers and crowdfunding intermediaries, persons trading or acting as intermediaries in the trade of cultural goods, credit intermediaries for mortgage and consumer credits, investment migration operators, non-financial mixed activity holding companies, football agents, and professional football clubs in respect of the transactions it lists.

Article 90 provides that the Regulation applies from 10 July 2027, except in relation to the obliged entities referred to in Article 3, points (3)(n) and (o), to which it applies from 10 July 2029.

Article 18(3) requires the creditworthiness assessment to be carried out on the basis of relevant and accurate information on the consumer's income and expenses and other financial and economic circumstances that is necessary and proportionate to the nature, duration, value and risks of the credit for the consumer.

Article 18(3) provides that the information on which the assessment is carried out shall not include special categories of data referred to in Article 9(1) of Regulation (EU) 2016/679. Article 18(3) provides that social networks shall not be considered as an external source for the purpose of the Directive.

Article 19(5) provides that creditors and credit intermediaries shall not process special categories of data as referred to in Article 9(1) of Regulation (EU) 2016/679 and personal data processed from social networks that may be contained in the databases referred to in Article 19(1).

Article 3, point (2), defines a creditor as a natural or legal person who grants or promises to grant credit in the course of that person's trade, business or profession.

Article 3, point (12), defines a credit intermediary as a natural or legal person that is not acting as a creditor or notary and not merely introducing a consumer to a creditor, and who, in the course of that person's trade, business or profession and for remuneration, presents or offers credit agreements to consumers, assists consumers by undertaking preparatory work or other pre-contractual administration in respect of credit agreements other than presenting or offering them, or concludes credit agreements with consumers on behalf of the creditor. Article 2(1) provides that the Directive applies to credit agreements.

Article 2(2), point (a), excludes from the Directive credit agreements secured by a mortgage, or by another comparable security commonly used in a Member State on immovable property, or secured by a right related to immovable property. Article 2(2), point (c), excludes from the Directive credit agreements involving a total amount of credit of more than EUR 100,000.

Article 2(3) applies the Directive to a credit agreement of more than EUR 100,000 that is not secured by a mortgage, by another comparable security on immovable property or by a right related to immovable property, where its purpose is the renovation of a residential immovable property.

Article 2(2), point (l), excludes from the Directive credit agreements existing on 20 November 2026, but Articles 23 and 24, Article 25(1), second sentence, Article 25(2) and Articles 28 and 39 apply to all open-end credit agreements existing on that date.

Article 44(1) requires Member States to lay down the rules on penalties applicable to infringements of the national provisions adopted pursuant to the Directive, and provides that the penalties must be effective, proportionate and dissuasive. Article 48(1) requires Member States to adopt and publish by 20 November 2025 the laws, regulations and administrative provisions necessary to comply with the Directive, and to apply those measures from 20 November 2026.

Article 53(1) provides that health data access bodies shall only grant access to electronic health data referred to in Article 51 for secondary use to a health data user where the processing by that health data user is necessary for one of six purposes: the public interest in the areas of public or occupational health, policymaking and regulatory activities to support public sector bodies or Union institutions, bodies, offices or agencies in the health or care sector, statistics related to health or care sectors, education or teaching activities in health or care sectors at vocational or higher education level, scientific research related to health or care sectors, and improvement of the delivery of care based on the electronic health data of other natural persons.

Article 53(2) reserves access for the purposes in Article 53(1), points (a), (b) and (c), to public sector bodies and Union institutions, bodies, offices and agencies exercising the tasks conferred on them by Union or national law, including where a third party processes the data on their behalf.

Article 54 provides that health data users shall only process electronic health data for secondary use on the basis of and in accordance with the purposes contained in a data permit issued pursuant to Article 68, health data requests approved pursuant to Article 69 or, in situations referred to in Article 67(3), an access approval from the relevant authorised participant in HealthData@EU referred to in Article 75.

Article 54, points (a) and (b), prohibit seeking access to and processing electronic health data obtained via a data permit or an approved health data request for taking decisions detrimental to a natural person or a group of natural persons based on their electronic health data, and for taking decisions in relation to job offers, less favourable terms in the provision of goods or services, including exclusion from an insurance or credit contract, or other decisions that discriminate against them on the basis of the health data obtained.

Article 54, points (c), (d) and (e), prohibit the same access and processing for carrying out advertising or marketing activities, for developing products or services that may harm individuals, public health or society at large, and for carrying out activities in conflict with ethical provisions laid down in national law.

Article 68(1), point (a), requires a health data access body to assess whether the purposes described in the health data access application correspond to one or more of the purposes listed in Article 53(1) before it grants access to electronic health data. Article 2(2), point (c), defines electronic health data as personal or non-personal electronic health data.

Article 2(2), point (a), defines personal electronic health data as data concerning health and genetic data, processed in an electronic form. Article 2(2), point (u), defines a health data user as a natural or legal person, including Union institutions, bodies, offices or agencies, which has been granted lawful access to electronic health data for secondary use pursuant to a data permit, a health data request approval or an access approval by an authorised participant in HealthData@EU.

Article 2(2), point (v), defines a data permit as an administrative decision issued to a health data user by a health data access body to process certain electronic health data specified in the data permit for specific secondary use purposes, based on conditions laid down in Chapter IV.

Article 51(1) lists the categories of electronic health data that health data holders make available for secondary use, among them, at points (b), (f), (g), (m) and (p), data on factors impacting on health, human genetic, epigenomic and genomic data, other human molecular data, data from clinical trials, clinical studies, clinical investigations and performance studies, and data from research cohorts, questionnaires and surveys related to health after the first publication of the related results.

Article 1(2), point (a), states that the Regulation specifies and complements the rights laid down in Regulation (EU) 2016/679 of natural persons in relation to the primary use and secondary use of their personal electronic health data.

Article 64(5), point (a), subjects health data users processing electronic health data obtained via a data permit issued pursuant to Article 68 for the uses referred to in Article 54 to administrative fines of a maximum of EUR 20 000 000 or, in the case of an undertaking, of a maximum of 4 % of its total worldwide annual turnover in the preceding financial year, whichever is higher.

Article 99 requires Member States to lay down the rules on penalties applicable to infringements of the Regulation, in particular for infringements which are not subject to administrative fines pursuant to Articles 63 and 64. Article 100 gives any natural or legal person that has suffered material or non-material damage as a result of an infringement of the Regulation the right to receive compensation in accordance with Union and national law.

Article 105 applies Chapter IV, in which Articles 53 and 54 sit, from 26 March 2029, and applies Article 51(1), points (b), (f), (g), (m) and (p), from 26 March 2031.

Article 61(3) provides that health data users shall not re-identify or attempt to re-identify the natural persons to whom the electronic health data obtained on the basis of a data permit, a health data request or an access approval by an authorised participant in HealthData@EU relate.

Article 61(2) provides that, when processing electronic health data within the secure processing environments referred to in Article 73, health data users shall not provide access to the electronic health data, or make those data available, to third parties not mentioned in the data permit.

Article 61(4) provides that health data users shall make public the results or output of secondary use within 18 months of the completion of the processing of the electronic health data in the secure processing environment or of having received the response to the health data request, and that the results or output of secondary use shall contain only anonymous data.

Article 66(2) provides that health data access bodies shall provide electronic health data in an anonymised format, where the purpose of processing by the health data user can be achieved with such data.

Article 66(3) provides that, where the health data user has sufficiently demonstrated that the purpose of processing cannot be achieved with anonymised data, health data access bodies shall provide access to electronic health data in pseudonymised format, and that the information necessary to reverse the pseudonymisation shall be available only to the health data access body or an entity that acts as a trusted third party in accordance with national law.

Article 73(1) provides that health data access bodies shall provide access to electronic health data pursuant to a data permit only through a secure processing environment subject to technical and organisational measures and security and interoperability requirements, including restriction of access to the authorised natural persons listed in the data permit, individual and unique user identities and confidential access modes, and identifiable logs of access to and activities in the secure processing environment, with logs of access kept for at least one year.

Article 73(2) provides that health data access bodies shall review the electronic health data included in a download request to ensure that health data users are only able to download non-personal electronic health data, including electronic health data in an anonymised statistical format, from the secure processing environment.

Article 73(3) provides that health data access bodies shall ensure that audits of the secure processing environments are carried out on a regular basis, including by third parties, and shall take corrective action for any shortcomings, risks or vulnerabilities identified by those audits.

Article 64(5), points (b) and (c), subjects health data users extracting personal electronic health data from secure processing environments, and health data users re-identifying or attempting to re-identify the natural persons to whom the electronic health data relate, to administrative fines of a maximum of EUR 20 000 000 or, in the case of an undertaking, of a maximum of 4 % of its total worldwide annual turnover in the preceding financial year, whichever is higher.

Article 64(4) subjects infringements of the duties of the health data holder or health data user pursuant to Article 60 and Article 61(1), (5) and (6) to administrative fines of a maximum of EUR 10 000 000 or, in the case of an undertaking, of a maximum of 2 % of its total worldwide annual turnover in the preceding financial year, whichever is higher.

Article 99 requires Member States to lay down the rules on penalties applicable to infringements of the Regulation, in particular for infringements which are not subject to administrative fines pursuant to Articles 63 and 64. Article 100 gives any natural or legal person that has suffered material or non-material damage as a result of an infringement of the Regulation the right to receive compensation in accordance with Union and national law.

Article 105 applies Chapter IV, in which Articles 61, 66 and 73 sit, from 26 March 2029, and applies Article 73(5), which requires the Commission to lay down by implementing act the requirements for the secure processing environments by 26 March 2027, from 26 March 2027.

Article 9(1) prohibits processing special categories of personal data, namely personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation, unless a listed Article 9(2) exception applies, such as the data subject's explicit consent.

Article 4(14) defines biometric data as data from specific technical processing of physical, physiological or behavioural characteristics, with the statute's own examples (facial images, fingerprint data) stated as non-exhaustive, so the same definition reaches a voiceprint once a system derives an identification capable template from audio, even though the text never uses the word voice.

Recital 51 confirms an ordinary photograph is not itself biometric data and only becomes covered when processed through a specific technical means allowing unique identification, so a faceprint a controller derives from one, even from a publicly available photograph, is newly covered special category data; the General Data Protection Regulation (GDPR) text does not separately discuss audio recordings.

The Dutch data protection authority fined Clearview AI EUR 30.5 million (decision dated 16 May 2024, publicly announced 3 September 2024) for building a facial recognition database from photographs scraped off the public internet without an Article 9 basis.

The Dutch decision itself catalogs parallel GDPR enforcement against Clearview by other Member State authorities on the same underlying conduct, including the Italian Garante (decision dated 10 February 2022) and the French CNIL (decision dated 17 October 2022). The Hellenic Data Protection Authority separately fined Clearview EUR 20,000,000 for the same conduct on 13 July 2022.

Article 7(1), points (a) to (c), provides that digital labour platforms shall not, by means of automated monitoring systems or automated decision-making systems, process any personal data on the emotional or psychological state of a person performing platform work, process any personal data in relation to private conversations, or collect any personal data of a person performing platform work while that person is not offering or performing platform work.

Article 7(1), points (d) and (e), adds that they shall not process personal data to predict the exercise of fundamental rights, including the freedom of association, the right of collective bargaining and action or the right to information and consultation as laid down in the Charter, or process any personal data to infer the racial or ethnic origin, migration status, political opinions, religious or philosophical beliefs, disability, state of health, including chronic disease or HIV status, emotional or psychological state, trade union membership, sex life or sexual orientation.

Article 7(2) applies Article 7 to all persons performing platform work from the start of the recruitment or selection procedure, and Article 7(3) applies it also where digital labour platforms use automated systems taking or supporting decisions that affect persons performing platform work in any manner.

Article 1(2) states that the Directive provides measures on algorithmic management applicable to persons performing platform work in the Union, including those who do not have an employment contract or employment relationship. Article 2(1), point (c), defines a person performing platform work as an individual performing platform work, irrespective of the nature of the contractual relationship or the designation of that relationship by the parties involved.

Article 2(1), point (a), defines a digital labour platform as a natural or legal person providing a service that is provided, at least in part, at a distance by electronic means, at the request of a recipient of the service, that involves the organisation of work performed by individuals in return for payment as a necessary and essential component, and that involves the use of automated monitoring systems or automated decision-making systems.

Article 2(2) provides that the definition of a digital labour platform does not include providers of a service whose primary purpose is to exploit or share assets or by means of which individuals who are not professionals can resell goods. Article 1(3) applies the Directive to digital labour platforms organising platform work performed in the Union, irrespective of their place of establishment or of the law otherwise applicable.

Article 8(1) provides that the processing of personal data by a digital labour platform by means of automated monitoring systems or automated decision-making systems is a type of processing which is likely to result in a high risk to the rights and freedoms of natural persons within the meaning of Article 35(1) of Regulation (EU) 2016/679.

Recital 39 states that digital labour platforms should not process the personal data of persons performing platform work on the basis that the person has given consent to the processing of his or her personal data.

Article 24(1) makes the supervisory authorities responsible for monitoring the application of Regulation (EU) 2016/679 also responsible for monitoring and enforcing Articles 7 to 11 as far as data-protection matters are concerned, and applies the upper limit for administrative fines referred to in Article 83(5) of that Regulation to infringements of Articles 7 to 11.

Article 24(5) requires Member States to lay down the rules on penalties applicable to infringements of the national provisions adopted pursuant to the Directive, and the penalties must be effective, dissuasive and proportionate to the nature, gravity and duration of the undertaking's infringement and to the number of workers affected.

Article 29(1) requires Member States to bring into force the laws, regulations and administrative provisions necessary to comply with the Directive by 2 December 2026.

Article 2(1) applies the Regulation to political advertising where the political advertisement is disseminated in the Union, is brought into the public domain in one or several Member States or is directed to Union citizens, irrespective of the place of establishment of the provider of political advertising services or of the place of residence or establishment of the sponsor.

Article 3, point (2), defines political advertising as the preparation, placement, promotion, publication, delivery or dissemination, by any means, of a message that is normally provided for remuneration or through in-house activities or as part of a political advertising campaign, and that is either by, for or on behalf of a political actor, unless it is of a purely private or a purely commercial nature, or liable and designed to influence the outcome of an election or referendum, voting behavior or a legislative or regulatory process, at Union, national, regional or local level.

The definition excludes (i) messages from official sources of Member States or the Union that are strictly limited to the organization and modalities for participating in elections or referendums, including the announcement of candidacies or the question put to the referendum, or for promoting participation in them, (ii) official public communication by or for a public authority that is not liable and designed to influence the outcome of an election or referendum, voting behavior or a legislative or regulatory process, and (iii) the presentation of candidates in specified public spaces or in the media where law explicitly provides for it and allocates it free of charge, with equal treatment of candidates.

Article 3, point (11), defines targeting techniques as techniques that are used to address a political advertisement only to a specific person or group of persons, or to exclude them, on the basis of the processing of personal data.

Article 3, point (12), defines ad-delivery techniques as optimization techniques that are used to increase the circulation, reach or visibility of a political advertisement on the basis of the automated processing of personal data and that can serve to deliver the political advertisement to a specific person or group of persons only.

Article 3, point (14), defines a controller by reference to Article 4, point 7, of Regulation (EU) 2016/679 or, where applicable, Article 3, point 8, of Regulation (EU) 2018/1725.

Article 18(1) permits targeting techniques or ad-delivery techniques that involve the processing of personal data in the context of online political advertising only when three conditions are fulfilled, set out in points (a) to (c). Under Article 18(1)(a) the controller must have collected the personal data from the data subject.

Under Article 18(1)(b) the data subject must have provided explicit consent, within the meaning of Regulations (EU) 2016/679 and (EU) 2018/1725, to the processing of personal data separately for the purpose of political advertising. Under Article 18(1)(c) those techniques must not involve profiling, as defined in Article 4, point 4, of Regulation (EU) 2016/679, using the special categories of personal data referred to in Article 9(1) of that Regulation.

Article 18(2) prohibits, in the context of political advertising, targeting techniques or ad-delivery techniques that involve the processing of the personal data of a data subject that the controller knows with reasonable certainty to be at least one year under the voting age established by national rules. Compliance with Article 18(2) does not oblige the controller to process additional personal data in order to assess whether the data subject is one year under the voting age.

Article 18 does not apply to communications of a political party, foundation, association or other non-profit body to its members and former members, or to communications such as newsletters linked to its political activities, as long as they are solely based on subscription data, are strictly limited to members, former members or subscribers, are based on personal data provided by them, and do not involve processing personal data to target or otherwise further select the recipients and the messages they receive.

Article 18(4)(a) requires controllers to make sure that a data subject is not requested to consent if he or she has already indicated by automated means that he or she does not consent to data processing for political advertising purposes, unless the request is justified by a substantial change of circumstances.

Article 18(4)(b) requires controllers to make sure that a data subject who does not consent is offered an equivalent alternative for using the online service without receiving political advertising.

Article 19(1) requires controllers that use targeting techniques or ad-delivery techniques in online political advertising involving the processing of personal data, in addition to their other duties under the Regulation and under Regulations (EU) 2016/679 and (EU) 2018/1725, to comply with the requirements in points (a) to (e).

Under Article 19(1)(a) the controller must adopt, implement and make publicly available an internal policy describing clearly and in plain language how such techniques are used, and retain that policy for seven years from the last use of the techniques. Under Article 19(1)(b) the controller must keep records on the use of such techniques and the relevant mechanisms and parameters used.

Under Article 19(1)(c) the controller must provide, together with the indication that the advertisement is political, additional information that lets the individual concerned understand the logic involved and the main parameters of the techniques used, including whether an artificial intelligence system has been used to target or deliver the advertisement.

Under Article 19(1)(d) the controller must prepare an internal annual risk assessment of the use of targeting techniques or ad-delivery techniques on fundamental rights and freedoms, the results of which are to be made publicly available.

Under Article 19(1)(e) the controller must provide, together with the advertisement unless it is included in the transparency notice required under Article 12(1), a reference to effective means to support individuals in exercising their rights under Regulations (EU) 2016/679 or (EU) 2018/1725, including a link to an interface for exercising them.

Where the controller is different from the political advertising publisher, Article 19(2) requires the controller to ensure that the information referred to in Article 19(1), points (c) and (e), is communicated to the publisher. Article 19(3) requires providers of political advertising services to transmit to the controllers, as necessary, the information the controllers need to comply with Article 19(1) and (2).

Article 22(1) makes the supervisory authorities referred to in Article 51 of Regulation (EU) 2016/679 and the European Data Protection Supervisor competent to monitor the application of Articles 18 and 19 in their respective fields of competence.

Article 25(6) provides that, for infringements of the obligations laid down in Articles 18 and 19, the supervisory authorities may within their competence impose fines in line with Article 83 of Regulation (EU) 2016/679 and up to the amount referred to in Article 83(5) of that Regulation.

Article 83(5) of Regulation (EU) 2016/679 sets that ceiling at EUR 20,000,000 or, in the case of an undertaking, 4 percent of the total worldwide annual turnover of the preceding financial year, whichever is higher. Article 25(1) leaves the sanctions for infringements of Articles 5 to 17, 20 and 21 to the Member States.

Article 25(2) sets the maximum amount of the financial penalties that may be imposed at 6 percent of the annual income or budget of the sponsor or of the provider of political advertising services, as applicable and whichever is the highest, or at 6 percent of the annual worldwide turnover of the sponsor or the provider in the preceding financial year.

For infringements of Articles 18 and 19, Article 25(7) lets the European Data Protection Supervisor impose fines within its competence in line with Article 66 of Regulation (EU) 2018/1725 and up to the amount referred to in Article 66(3) of that Regulation.

Article 25(5) treats an infringement of Article 18 as particularly serious where it concerns political advertising published or disseminated during the last month preceding an election or referendum and directed to citizens in the Member State in which the election or referendum is being organized. Article 30(2) applies the Regulation from 10 October 2025.

Article 16(1) required Member States to bring into force the laws, regulations and administrative provisions necessary to comply with the Directive by 4 September 2015. Recital 32 records that Denmark is not taking part in the adoption of the Directive and is not bound by it or subject to its application.

Article 2, point (d), defines without right as conduct, including access, interference or interception, that is not authorized by the owner or by another right holder of the system or of part of it, or not permitted under national law.

Article 3 requires Member States to make intentional access without right to the whole or any part of an information system punishable as a criminal offense where it is committed by infringing a security measure, at least for cases which are not minor.

Article 4 requires Member States to make seriously hindering or interrupting the functioning of an information system by inputting computer data, by transmitting, damaging, deleting, deteriorating, altering or suppressing such data, or by rendering such data inaccessible, intentionally and without right, punishable as a criminal offense, at least for cases which are not minor.

Article 5 requires Member States to make deleting, damaging, deteriorating, altering or suppressing computer data on an information system, or rendering such data inaccessible, intentionally and without right, punishable as a criminal offense, at least for cases which are not minor.

Article 6 requires Member States to make intercepting, by technical means, non-public transmissions of computer data to, from or within an information system, intentionally and without right, punishable as a criminal offense, at least for cases which are not minor.

Article 7 requires Member States to make the intentional production, sale, procurement for use, import, distribution or other making available of a computer program designed or adapted primarily for committing an offense under Articles 3 to 6, or of a computer password, access code or similar data by which an information system can be accessed, without right and with the intention that it be used to commit one of those offenses, punishable as a criminal offense, at least for cases which are not minor.

Article 8 requires Member States to make incitement, aiding and abetting an offense under Articles 3 to 7 punishable as a criminal offense, and to do the same for an attempt to commit an offense under Articles 4 and 5.

Article 9(2) requires Member States to provide a maximum term of imprisonment of at least two years for the offenses in Articles 3 to 7, at least for cases which are not minor. Article 9(3) requires a maximum term of at least three years for the offenses in Articles 4 and 5, when committed intentionally, where a significant number of information systems have been affected through the use of a tool referred to in Article 7 designed or adapted primarily for that purpose.

Article 9(4) requires a maximum term of at least five years for the offenses in Articles 4 and 5 where they are committed within the framework of a criminal organization, as defined in Framework Decision 2008/841/JHA, cause serious damage, or are committed against a critical infrastructure information system.

Article 10(1) requires Member States to ensure that legal persons can be held liable for the offenses in Articles 3 to 8 committed for their benefit by any person, acting individually or as part of a body of the legal person, who has a leading position within it based on a power of representation, an authority to take decisions on its behalf or an authority to exercise control within it.

Article 10(2) extends that liability to cases where a lack of supervision or control by such a person has allowed a person under its authority to commit one of those offenses for the benefit of the legal person.

When establishing jurisdiction over an offense committed in whole or in part within its territory, Article 12(2) requires a Member State to ensure that it has jurisdiction where the offender commits the offense when physically present on its territory, whether or not the offense is against an information system on its territory, or where the offense is against an information system on its territory, whether or not the offender is physically present there.

Recital 11 leaves it to each Member State to determine under its national law and practice what constitutes a minor case. Recital 17 states that contractual obligations or agreements to restrict access to information systems by way of a user policy or terms of service should not incur criminal liability where the access under such circumstances would be deemed unauthorized and thus would constitute the sole basis for criminal proceedings.

Article 11(1) lets a data holder apply appropriate technical protection measures, including smart contracts and encryption, to prevent unauthorized access to data, including metadata, and to ensure compliance with Articles 4, 5, 6, 8 and 9 and with the agreed contractual terms for making data available.

Those measures must not discriminate between data recipients or hinder a user's right to obtain a copy of, retrieve, use or access data, to provide data to third parties under Article 5 or any right of a third party under Union law or national legislation adopted in accordance with Union law. Article 11(1) provides that users, third parties and data recipients shall not alter or remove such technical protection measures unless agreed by the data holder.

Article 11(3) applies the Article 11(2) remedies where a third party or a data recipient has, for the purposes of obtaining data, provided false information to a data holder, deployed deceptive or coercive means or abused gaps in the technical infrastructure of the data holder designed to protect the data; used the data made available for unauthorized purposes, including the development of a competing connected product within the meaning of Article 6(2), point (e); unlawfully disclosed data to another party; not maintained the technical and organizational measures agreed pursuant to Article 5(9); or altered or removed technical protection measures applied by the data holder pursuant to Article 11(1) without the agreement of the data holder.

Under Article 11(2), in those circumstances the third party or data recipient shall comply without undue delay with the requests of the data holder and, where applicable and where they are not the same person, the trade secret holder or the user, to erase the data made available by the data holder and any copies thereof.

Article 11(2) also requires compliance with requests to end the production, offering or placing on the market or use of goods, derivative data or services produced on the basis of knowledge obtained through the data, or the importation, export or storage of infringing goods for those purposes, and to destroy any infringing goods, where there is a serious risk that the unlawful use of the data will cause significant harm to the data holder, the trade secret holder or the user or where such a measure would not be disproportionate in light of their interests.

Article 11(2) further requires compliance with requests to inform the user of the unauthorized use or disclosure of the data and of the measures taken to put an end to it, and to compensate the party suffering from the misuse or disclosure of such unlawfully accessed or used data.

Article 11(4) applies Article 11(2) also where a user alters or removes technical protection measures applied by the data holder, or does not maintain the technical and organizational measures taken by the user in agreement with the data holder or the trade secrets holder to preserve trade secrets, and in respect of any other party that receives the data from the user by means of an infringement of the Regulation.

Article 12(1) applies Chapter III, in which Article 11 sits, where, in business-to-business relations, a data holder is obliged under Article 5 or under applicable Union law or national legislation adopted in accordance with Union law to make data available to a data recipient. Article 50 applies the Regulation from 12 September 2025.

Article 50 also applies Chapter III in relation to obligations to make data available under Union law or national legislation adopted in accordance with Union law that enters into force after 12 September 2025.

Article 4 requires Member States to provide an exception or limitation for reproductions and extractions of lawfully accessible works for the purposes of text and data mining, and paragraph 2 permits retaining those copies for as long as the mining requires.

Unlike the Article 3 exception, which is confined to research organisations and cultural heritage institutions acting for scientific research, Article 4 is limited by neither purpose nor actor, and recital 18 records that mining techniques are widely used by private and public entities alike, including for the development of new applications and technologies.

Paragraph 3 makes the exception conditional on the rightholder not having expressly reserved the use in an appropriate manner, which the Article illustrates as machine-readable means for content made publicly available online, so a reservation removes the exception rather than merely signalling a preference. Article 7(1) renders contractual override unenforceable for Articles 3, 5 and 6 but does not list Article 4.

Article 6(1) requires Member States to provide adequate legal protection against the circumvention of any effective technological measures, which the person concerned carries out in the knowledge, or with reasonable grounds to know, that he or she is pursuing that objective.

Article 6(3) defines a technological measure as any technology, device or component that, in the normal course of its operation, is designed to prevent or restrict acts, in respect of works or other subject-matter, which are not authorised by the rightholder of any copyright, any right related to copyright or the sui generis database right.

Under the second subparagraph of Article 6(3), a technological measure is deemed effective where the use of a protected work or other subject-matter is controlled by the rightholders through application of an access control or protection process, such as encryption, scrambling or other transformation of the work or other subject-matter or a copy control mechanism, which achieves the protection objective.

Article 6(2) requires the same protection against the manufacture, import, distribution, sale, rental, advertisement for sale or rental, or possession for commercial purposes of devices, products or components, and against the provision of services, that are promoted for circumvention, have only a limited commercially significant purpose or use other than circumvention, or are primarily designed to enable or facilitate it.

Under Article 6(4), where rightholders have taken no voluntary measures, Member States must take appropriate measures to ensure that rightholders make available to the beneficiary of certain listed exceptions or limitations the means of benefiting from them, to the extent necessary and where the beneficiary has legal access to the protected work.

Article 7(2) of Directive (EU) 2019/790 applies the first, third and fifth subparagraphs of Article 6(4) of this Directive to Articles 3 to 6 of that Directive, which include its text and data mining exceptions in Articles 3 and 4.

Article 7(1) requires Member States to provide adequate legal protection against any person who knowingly and without authority removes or alters electronic rights-management information, or who distributes, imports for distribution, broadcasts, communicates or makes available to the public works from which it has been removed or altered without authority, if that person knows or has reasonable grounds to know that doing so induces, enables, facilitates or conceals an infringement.

Article 7(2) defines rights-management information as information provided by rightholders that identifies the work, the author or another rightholder, or states the terms and conditions of use of the work, together with any numbers or codes that represent that information.

Article 8(1) requires Member States to provide appropriate sanctions and remedies for infringements of the rights and obligations in the Directive, and to ensure that they are applied, and the sanctions must be effective, proportionate and dissuasive.

Article 8(2) requires each Member State to ensure that rightholders whose interests are affected by an infringing activity carried out on its territory can bring an action for damages and/or apply for an injunction and, where appropriate, for the seizure of infringing material and of the devices, products or components referred to in Article 6(2).

Article 43 provides that the sui generis right provided for in Article 7 of Directive 96/9/EC does not apply when data is obtained from or generated by a connected product or related service falling within the scope of the Regulation, in particular in relation to Articles 4 and 5 of the Regulation.

Recital 112 states the purpose as eliminating the risk that holders of data in databases obtained or generated by means of physical components, such as sensors, of a connected product and a related service, or other machine-generated data, claim the sui generis right and so hinder the effective exercise of users' rights to access and use data and to share data with third parties under the Regulation.

Recital 112 adds that this does not affect the possible application of the sui generis right to databases containing data falling outside the scope of the Regulation, provided that the requirements for protection under paragraph 1 of Article 7 of Directive 96/9/EC are fulfilled.

Article 2, point (5), defines a connected product as an item that obtains, generates or collects data concerning its use or environment and that is able to communicate product data via an electronic communications service, physical connection or on-device access, and whose primary function is not the storing, processing or transmission of data on behalf of any party other than the user.

Article 2, point (6), defines a related service as a digital service, other than an electronic communications service, including software, which is connected with the product at the time of the purchase, rent or lease in such a way that its absence would prevent the connected product from performing one or more of its functions, or which is subsequently connected to the product by the manufacturer or a third party to add to, update or adapt the functions of the connected product.

Article 50 applies the Regulation from 12 September 2025. Article 50 provides that the Regulation is binding in its entirety and directly applicable in all Member States.

Article 7(1) gives the maker of a database that shows a substantial investment, evaluated qualitatively or quantitatively, in obtaining, verifying or presenting its contents a sui generis right to prevent extraction or re-utilization of the whole or a substantial part of that content.

Article 7(2) defines extraction as the permanent or temporary transfer of all or a substantial part of the contents to another medium by any means or in any form, and re-utilization as any form of making that content available to the public by distribution or another means.

Article 7(5) separately bars the repeated and systematic extraction or re-utilization of insubstantial parts where doing so conflicts with the database's normal exploitation or unreasonably prejudices the maker's legitimate interests, so a scraper cannot evade the substantial-part threshold by taking small pieces on a recurring basis.

Article 8 lets a lawful user of a database made available to the public extract or re-utilize insubstantial parts for any purpose without the maker's authorization (only of the part the user is authorized to use, where the authorization covers only part of the database), but bars any act conflicting with the database's normal exploitation or unreasonably prejudicing the maker's legitimate interests, or causing prejudice to a copyright or related right in the database's contents; Article 15 makes a contractual provision contrary to Article 8 void.

Article 9 lets a Member State permit a lawful user of a database made available to the public to extract a substantial part of its contents without the maker's authorization for private purposes from a non-electronic database or for illustration in teaching or scientific research with the source indicated and to a non-commercial extent, and to extract or re-utilize a substantial part for public security or an administrative or judicial procedure.

Article 24(1)(b) of Directive (EU) 2019/790 replaced point (b) of Article 9 so that the teaching and scientific-research exception is without prejudice to the exceptions and limitations in that Directive.

Article 10 makes the right expire fifteen years from the first of January of the year following the database's completion or, where the database is made available to the public before that period expires, fifteen years from the first of January of the year following the date it was first made available to the public; a substantial new investment in the database's contents, evaluated qualitatively or quantitatively, gives the resulting database its own fresh fifteen-year term.

Article 43 of Regulation (EU) 2023/2854 provides that the sui generis right does not apply when data is obtained from or generated by a connected product or related service within that Regulation's scope. A Member State's own transposition of this Directive, such as France's Code de la propriete intellectuelle Articles L341-1 to L343-7, is that state's own law.

Article 19(1) required Member States to bring into force the laws, regulations and administrative provisions necessary to comply with the Directive by 9 June 2018.

Article 2, point (1), defines a trade secret as information that is secret in the sense that it is not, as a body or in the precise configuration and assembly of its components, generally known among or readily accessible to persons within the circles that normally deal with the kind of information in question, that has commercial value because it is secret, and that has been subject to reasonable steps under the circumstances, by the person lawfully in control of the information, to keep it secret.

Article 3(1) makes the acquisition of a trade secret lawful when it is obtained by independent discovery or creation; by observation, study, disassembly or testing of a product or object that has been made available to the public or that is lawfully in the possession of the acquirer of the information who is free from any legally valid duty to limit the acquisition of the trade secret; by exercise of the right of workers or workers' representatives to information and consultation in accordance with Union law and national laws and practices; or by any other practice which, under the circumstances, is in conformity with fair dealing in commercial practice.

Recital 16 states that reverse engineering of a lawfully acquired product should be considered a lawful means of acquiring information, except when otherwise contractually agreed.

Article 4(2) makes the acquisition of a trade secret without the consent of the trade secret holder unlawful when carried out by unauthorized access to, appropriation of, or copying of any documents, objects, materials, substances or electronic files, lawfully under the control of the trade secret holder, containing the trade secret or from which the trade secret can be deduced, or by any other conduct which, under the circumstances, is considered contrary to fair dealing in commercial practice.

Article 4(3) makes the use or disclosure of a trade secret without the holder's consent unlawful when carried out by a person who acquired it unlawfully, who is in breach of a confidentiality agreement or any other duty not to disclose it, or who is in breach of a contractual or any other duty to limit its use.

Article 4(4) makes the acquisition, use or disclosure unlawful as well when a person, at the time, knew or ought, under the circumstances, to have known that the trade secret had been obtained directly or indirectly from another person who was using or disclosing it unlawfully within the meaning of Article 4(3).

Article 5 requires Member States to ensure that an application for the Directive's measures, procedures and remedies is dismissed where the acquisition, use or disclosure was carried out for exercising the right to freedom of expression and information, for revealing misconduct, wrongdoing or illegal activity, provided that the respondent acted for the purpose of protecting the general public interest, for disclosure by workers to their representatives as part of the legitimate exercise by those representatives of their functions in accordance with Union or national law, provided that the disclosure was necessary for that exercise, or for the purpose of protecting a legitimate interest recognized by Union or national law.

Article 4(1) requires Member States to ensure that trade secret holders are entitled to apply for the measures, procedures and remedies the Directive provides in order to prevent, or obtain redress for, the unlawful acquisition, use or disclosure of their trade secret. Article 6(1) requires Member States to provide for the measures, procedures and remedies necessary to ensure the availability of civil redress against the unlawful acquisition, use and disclosure of trade secrets.

Directive (EU) 2019/2161 inserted point 23a into Annex I to Directive 2005/29/EC. Point 23a covers reselling event tickets to consumers if the trader acquired them by using automated means to circumvent any limit imposed on the number of tickets that a person can buy or any other rules applicable to the purchase of tickets.

Article 5(5) provides that Annex I contains the list of commercial practices which shall in all circumstances be regarded as unfair, and that the same single list applies in all Member States. Article 5(1) provides that unfair commercial practices shall be prohibited.

Article 3(1) applies the Directive to unfair business-to-consumer commercial practices, before, during and after a commercial transaction in relation to a product. Article 2, point (b), defines a trader as any natural or legal person who, in commercial practices covered by the Directive, is acting for purposes relating to his trade, business, craft or profession, and anyone acting in the name of or on behalf of a trader.

Recital 50 of Directive (EU) 2019/2161 states that traders should be prohibited from reselling to consumers tickets to cultural and sports events that they have acquired by using software such as bots enabling them to buy tickets in excess of the technical limits imposed by the primary ticket seller or to bypass any other technical means put in place by the primary seller to ensure accessibility of tickets for all individuals.

Recital 50 adds that the prohibition is without prejudice to any other national measures that Member States can take to protect the legitimate interests of consumers and to secure cultural policy and broad access of all individuals to cultural and sports events, such as regulating the resale price of the tickets.

Article 7(1) of Directive (EU) 2019/2161 required Member States to adopt and publish the measures necessary to comply with it by 28 November 2021 and to apply them from 28 May 2022. Article 13(1) requires Member States to lay down the rules on penalties applicable to infringements of the national provisions adopted pursuant to the Directive, which must be effective, proportionate and dissuasive.

Article 13(3) requires that, when penalties are to be imposed in accordance with Article 21 of Regulation (EU) 2017/2394, Member States include the possibility of fines whose maximum amount is at least 4 % of the trader's annual turnover in the Member State or Member States concerned.

Article 2(1) provides that the technical description of the categories of products with digital elements under classes I and II listed in Annex III to Regulation (EU) 2024/2847 is as set out in Annex I to the Regulation. Article 2(2) provides that the technical description of the categories listed in Annex IV to Regulation (EU) 2024/2847 is as set out in Annex II to the Regulation.

The Commission adopted the Regulation under Article 7(4) of Regulation (EU) 2024/2847, which requires an implementing act by 11 December 2025 specifying those technical descriptions.

Regulation (EU) 2024/2847 uses the categories to decide the conformity assessment procedure: Article 7(1) makes a product whose core functionality is a category set out in Annex III an important product subject to the procedures referred to in Article 32(2) and (3).

Article 32(4) of that Regulation requires a critical product listed in Annex IV to demonstrate conformity by a European cybersecurity certification scheme under Article 8(1) or, where the conditions of Article 8(1) are not met, by a procedure of Article 32(3). Under Article 71(2), Regulation (EU) 2024/2847 applies from 11 December 2027, with Article 14 applying from 11 September 2026 and Chapter IV from 11 June 2026.

Annex I describes nineteen categories of important products in class I and four in class II, and Annex II describes three categories of critical products. The class I category of identity management systems and privileged access management software and hardware includes single sign-on software, federated identity management software, one-time password software and multi-factor authentication software.

The class I category of standalone and embedded browsers includes browsers with AI agent integration. Class I also lists password managers, software that searches for, removes or quarantines malicious software, products with the function of virtual private network (virtual private network (VPN)), operating systems, and smart home general purpose virtual assistants.

Class II describes hypervisors and container runtime systems, firewalls and intrusion detection and prevention systems, tamper-resistant microprocessors and tamper-resistant microcontrollers. A tamper-resistant microprocessor or microcontroller in class II is designed to provide protection of AVA_VAN level 2 or 3, as set out in the Common Criteria and the Common Evaluation Methodology.

A secure element in Annex II is designed to provide protection of at least AVA_VAN.4, as set out in the Common Criteria or the Common Evaluation Methodology.

The recitals explain that integrating an embedded browser into a news app does not in itself make the news app subject to the conformity assessment procedure for browsers. The recitals explain that performing functions other than or additional to those in a technical description does not in itself mean a product lacks the core functionality of a category.

The recitals explain that a smartphone, whose core functionality is not that of an operating system or of a password manager, is generally not considered to meet the technical description of those categories. The recitals state that the examples they give are illustrative only and not an exhaustive list.

Article 13 requires a manufacturer placing a product with digital elements on the EU market to design, develop and produce it in accordance with the essential cybersecurity requirements of Annex I, Part I, which, on the basis of the manufacturer's cybersecurity risk assessment and where applicable, include shipping without known exploitable vulnerabilities, a secure default configuration (unless otherwise agreed with a business user for a tailor-made product), protection against unauthorised access, protection of the confidentiality of stored, transmitted or otherwise processed data, such as by encrypting relevant data at rest or in transit, data minimisation, and protection of the availability of essential and basic functions, including through resilience and mitigation measures against denial-of-service attacks.

Annex I, Part II requires the manufacturer to identify and document vulnerabilities, including through a software bill of materials, remediate them without delay, operate a coordinated vulnerability disclosure policy, and provide security updates without delay and, unless otherwise agreed with a business user for a tailor-made product, free of charge; under Article 13(8) and (9) the manufacturer must set a support period of not less than five years, or the product's expected use time if shorter, and keep each security update available for ten years after it is issued or for the remainder of the support period, whichever is longer.

Article 13(6) requires a manufacturer that identifies a vulnerability in a component integrated in its product, including an open-source component, to report the vulnerability to the person or entity manufacturing or maintaining the component, to address and remediate it in accordance with the vulnerability handling requirements of Annex I, Part II, and, where it has developed a software or hardware modification to address it, to share the relevant code or documentation with that person or entity, where appropriate in a machine-readable format.

The Regulation does not reach free and open source software that its manufacturer does not monetise. Monetising covers charging a price for the software, charging for technical support beyond recovering costs, providing a platform through which the manufacturer monetises other services, requiring personal-data processing as a condition of use for reasons other than improving security, compatibility or interoperability, and accepting donations that exceed costs.

Its remote data processing requirements reach only data processing at a distance for which the software is designed and developed by the manufacturer, or under its responsibility, and the absence of which would prevent the product from performing one of its functions, not a service the product could operate without. Article 65 makes Directive (EU) 2020/1828 on representative actions apply to an infringement of this Regulation that harms, or may harm, the collective interests of consumers.

Under that Directive a qualified entity, meaning an organisation or public body representing consumers' interests, brings the action as claimant on consumers' behalf.

Article 24 binds an open-source software steward, which Article 3(14) defines as a legal person, other than a manufacturer, that has the purpose or objective of systematically providing support on a sustained basis for the development of specific products with digital elements, qualifying as free and open-source software and intended for commercial activities, and that ensures the viability of those products.

Article 24(1) requires a steward to put in place and document in a verifiable manner a cybersecurity policy to foster the development of a secure product with digital elements and an effective handling of vulnerabilities by the developers of that product.

That policy must also foster the voluntary reporting of vulnerabilities under Article 15 by those developers and take into account the steward's specific nature and its legal and organizational arrangements, and it must in particular include aspects related to documenting, addressing and remediating vulnerabilities and promote the sharing of information concerning discovered vulnerabilities within the open-source community.

Article 24(2) requires a steward to cooperate with the market surveillance authorities, at their request, with a view to mitigating the cybersecurity risks posed by a product with digital elements qualifying as free and open-source software, and, on a reasoned request, to give the authority the documentation of its policy in a language that authority can easily understand, in paper or electronic form.

Article 24(3) applies the obligations of Article 14(1) to a steward to the extent that it is involved in the development of the products with digital elements, and applies those of Article 14(3) and (8) to the extent that severe incidents having an impact on the security of those products affect network and information systems that the steward provides for their development. Article 71(2) makes the Regulation, Article 24 included, apply from 11 December 2027.

Article 64(10), point (b), exempts any infringement of the Regulation by an open-source software steward from the administrative fines of Article 64(3) to (9).

Article 46 of Regulation (EU) 2019/881, as replaced by Regulation (EU) 2025/37, establishes the European cybersecurity certification framework to improve the functioning of the internal market by increasing the level of cybersecurity within the Union and enabling a harmonised approach to European cybersecurity certification schemes for ICT products, ICT services, ICT processes and managed security services.

Regulation (EU) 2025/37 extended the certification framework to managed security services. Article 56(2) provides that cybersecurity certification is voluntary, unless otherwise specified by Union law or Member State law. Under Article 56(1), as replaced by Regulation (EU) 2025/37, ICT products, ICT services, ICT processes and managed security services certified under a European cybersecurity certification scheme are presumed to comply with the requirements of that scheme.

Article 56(8), as replaced by Regulation (EU) 2025/37, requires the holder of a European cybersecurity certificate to inform the authority or body that issues it of any subsequently detected vulnerabilities or irregularities concerning the security of the certified ICT product, ICT service, ICT process or managed security service that may have an impact on its compliance with the requirements related to the certification.

Article 55(1) requires the manufacturer or provider of certified ICT products, ICT services or ICT processes, or of those for which an EU statement of conformity has been issued, to make publicly available guidance and recommendations for secure configuration, installation, deployment, operation and maintenance; the period during which security support will be offered, in particular the availability of cybersecurity related updates; contact information and accepted methods for receiving vulnerability information from end users and security researchers; and a reference to online repositories listing publicly disclosed vulnerabilities and to any relevant cybersecurity advisories.

Article 55(2) requires the supplementary cybersecurity information to be available in electronic form and to remain available and be updated as necessary at least until the expiry of the corresponding European cybersecurity certificate or EU statement of conformity.

Article 53, as replaced by Regulation (EU) 2025/37, lets a scheme allow conformity self-assessment under the sole responsibility of the manufacturer or provider, only for products, services, processes and managed security services that present a low risk corresponding to assurance level basic.

A manufacturer or provider that issues an EU statement of conformity assumes responsibility for the compliance of the product, service, process or managed security service with the requirements of the scheme, and must make the statement, the technical documentation and all other relevant information available to the national cybersecurity certification authority and submit a copy of the statement to that authority and to ENISA.

Article 65 requires Member States to lay down the rules on penalties applicable to infringements of Title III and of European cybersecurity certification schemes, and the penalties must be effective, proportionate and dissuasive. Article 69(1) provides that the Regulation enters into force on the twentieth day following its publication in the Official Journal, and Article 69(2) applies Articles 58, 60, 61, 63, 64 and 65 from 28 June 2021.

Article 27(8) of Regulation (EU) 2024/2847 presumes that products with digital elements and processes put in place by the manufacturer, for which an EU statement of conformity or certificate has been issued under a European cybersecurity certification scheme adopted pursuant to Regulation (EU) 2019/881, conform with the essential cybersecurity requirements in Annex I in so far as the statement or certificate covers those requirements.

Article 24(1) of Directive (EU) 2022/2555 allows Member States, to demonstrate compliance with particular requirements of Article 21, to require essential and important entities to use particular ICT products, ICT services and ICT processes that are certified under European cybersecurity certification schemes adopted pursuant to Article 49 of Regulation (EU) 2019/881.

Commission Implementing Regulation (EU) 2024/482 lays down the rules for the application of Regulation (EU) 2019/881 as regards the adoption of the European Common Criteria-based cybersecurity certification scheme (EUCC).

Article 36(1) of Regulation (EU) 2023/2854 requires the vendor of an application using smart contracts, or in the absence of one the person whose trade, business or profession involves the deployment of smart contracts for others, to ensure that the smart contracts used to execute an agreement to make data available meet five essential requirements.

The first is robustness and access control: the smart contract must be designed to offer access control mechanisms and a very high degree of robustness to avoid functional errors and to withstand manipulation by third parties.

The second is safe termination and interruption: a mechanism must exist to terminate the continued execution of transactions, and the smart contract must include internal functions which can reset or instruct the contract to stop or interrupt the operation, in particular to avoid future accidental executions.

The third is data archiving and continuity: where a smart contract must be terminated or deactivated, there must be a possibility to archive the transactional data, smart contract logic and code in order to keep the record of operations performed on the data in the past. The fourth is access control: the smart contract must be protected through rigorous access control mechanisms at the governance and smart contract layers.

The fifth is consistency with the terms of the data sharing agreement that the smart contract executes. Article 36(2) requires the vendor of a smart contract, or in the absence of one the person who deploys smart contracts for others, to perform a conformity assessment with a view to fulfilling the essential requirements and, on the fulfilment of those requirements, to issue an EU declaration of conformity.

Article 36(3) makes the party that draws up the EU declaration of conformity responsible for compliance with the essential requirements. Article 36(4) presumes a smart contract that meets harmonised standards whose references are published in the Official Journal to be in conformity with the essential requirements, to the extent that those standards cover them.

Article 1(3), point (g), applies the Regulation to vendors of applications using smart contracts and to persons whose trade, business or profession involves the deployment of smart contracts for others in the context of executing an agreement.

Article 2, point (39), defines a smart contract as a computer program used for the automated execution of an agreement or part thereof, using a sequence of electronic data records and ensuring their integrity and the accuracy of their chronological ordering. Article 37(1) requires each Member State to designate one or more competent authorities to be responsible for the application and enforcement of the Regulation.

Article 40(1) requires Member States to lay down the rules on penalties applicable to infringements of the Regulation, which must be effective, proportionate and dissuasive. Article 50 applies the Regulation from 12 September 2025. The Commission proposal COM(2025) 837 final would delete Article 36 of the Regulation.

Article 32 of Commission Implementing Regulation (EU) 2024/482 provides that Chapter VI applies to ICT products for which an EUCC certificate was issued. Article 1 applies the Regulation to all ICT products, including their documentation, that are submitted for certification under the EUCC.

Article 33(1) requires the holder of an EUCC certificate to establish and maintain all necessary vulnerability management procedures, supplemented where necessary by the procedures set out in EN ISO/IEC 30111. Article 33(2) requires the holder to maintain and publish appropriate methods for receiving information on vulnerabilities related to its products from external sources, including users, certification bodies and security researchers.

Article 33(3) requires the holder, when it detects or receives information about a potential vulnerability affecting a certified ICT product, to record it and carry out a vulnerability impact analysis. Article 33(4) requires the holder, when a potential vulnerability impacts a composite product, to inform the holder of dependent EUCC certificates.

Article 33(5) requires the holder, in response to a reasonable request by the certification body that issued the certificate, to transmit all relevant information about potential vulnerabilities to that certification body. Article 34(1) requires the vulnerability impact analysis to refer to the target of evaluation and the assurance statements contained in the certificate and to be carried out in a timeframe appropriate for the exploitability and criticality of the potential vulnerability.

Article 34(2) requires, where applicable, an attack potential calculation to determine the exploitability of the vulnerability, and requires the AVA_VAN level of the certificate to be taken into account. Article 35(5) provides that Article 36 applies where the vulnerability impact analysis report determines that the vulnerability is not residual and that it can be remedied. Article 36 requires the holder to submit a proposal for an appropriate remedial action to the certification body.

Article 29(1), point (b), requires the certification body, where the holder does not comply with Chapter VI, to set a time period of not more than 30 days within which the holder shall take remedial action. Article 29(2) provides that, where the holder does not propose appropriate remedial action in that period, the certificate shall be suspended or withdrawn.

Article 25(1), point (b), makes the national cybersecurity certification authority responsible for monitoring the compliance of holders of an EUCC certificate with their obligations. Article 50 applies the Regulation from 27 February 2025.

Article 1(1) of Commission Regulation (EU) 2019/424 establishes ecodesign requirements for the placing on the market and putting into service of servers and online data storage products. Article 1(2) excludes servers intended for embedded applications, small scale servers, servers with more than four processor sockets, server appliances, large servers, fully fault tolerant servers, network servers, small data storage products and large data storage products.

Article 3 requires servers and online data storage products to comply with Annex II, point 1.2.3, from 1 March 2021. Annex II, point 1.2.3, requires the latest available version of the firmware to be made available from two years after the placing on the market of the first product of a model for a minimum period of eight years after the placing on the market of the last product of that model, free of charge or at a fair, transparent and non-discriminatory cost.

It also requires the latest available security update to the firmware to be made available free of charge from the time a product model is placed on the market until at least eight years after the placing on the market of the last product of that model. Annex I, point (34), defines firmware as system, hardware, component, or peripheral programming provided with the product to provide basic instructions for hardware to function inclusive of all applicable programming and hardware updates.

Article 5 requires Member States to apply the verification procedure in Annex IV when performing the market surveillance checks referred to in Article 3(2) of Directive 2009/125/EC. Article 10 provides that the Regulation enters into force on the twentieth day following that of its publication in the Official Journal.

Article 1(1) of Commission Regulation (EU) 2023/1670 establishes ecodesign requirements for the placing on the market of smartphones, other mobile phones, cordless phones and slate tablets. Article 1(2) excludes mobile phones and tablets with a flexible main display which the user can unroll and roll up partly or fully, and smartphones for high security communication.

Annex II, Part B, point (6)(a), requires manufacturers, importers or authorized representatives of smartphones that provide security updates, corrective updates or functionality updates to an operating system to make them available at no cost for all units of a product model with the same operating system, from the date of end of placement on the market to at least 5 years after that date. Annex II, Part A, point (6)(a), imposes the same requirement for mobile phones other than smartphones.

Annex II, Part D, point (5)(a), imposes the same requirement for slate tablets. Point (b) applies the requirement both to operating system updates offered voluntarily by manufacturers, importers or authorized representatives and to operating system updates provided to comply with Union law.

Point (c) requires security updates and corrective updates to be available to the user at the latest 4 months after the public release of the source code of an update of the underlying operating system or, if the source code is not publicly released, after an update of the same operating system is released by the operating system provider or on any other product of the same brand.

Point (d) requires functionality updates to be available to the user at the latest 6 months after the corresponding release.

Annex II, Part B, point (6)(f), requires a manufacturer, importer or authorized representative whose functionality update shows a negative impact on device performance to modify the released operating system to ensure at least the same performance as before the update, within a reasonable period of time, free of charge and without causing significant inconvenience to the end-user, except if the end-user has given explicit consent for the negative impact prior to the update.

Annex II, Part D, point (5)(f), imposes the same requirement for slate tablets. Annex I, point (34), defines a security update as an operating system update, including security patches, if relevant for a given device, whose main purpose is to provide enhanced security for the device. Annex II, Part B, section 1.2, which contains point (6), applies from 20 June 2025. Article 10 applies Commission Regulation (EU) 2023/1670 from 20 June 2025.

Article 5 requires Member States to apply the verification procedure in Annex IV when performing the market surveillance checks referred to in Article 3(2) of Directive 2009/125/EC.

Article 30(1), point (a), of Regulation (EU) 2025/327 requires a manufacturer of an EHR system to ensure that the harmonised software components of its EHR systems and the EHR systems themselves, to the extent that Chapter III establishes requirements for them, are in conformity with the essential requirements in Annex II and with the common specifications adopted under Article 36.

Article 2, point (k), defines an EHR system as any system whereby the software, or a combination of the hardware and the software of that system, allows personal electronic health data that belong to the priority categories to be stored, intermediated, exported, imported, converted, edited or viewed, and intended by the manufacturer to be used by healthcare providers when providing patient care or by patients when accessing their electronic health data.

Article 25(1) provides that EHR systems shall include a European interoperability software component for EHR systems and a European logging software component for EHR systems, which together are the harmonised software components of EHR systems. Article 25(2) provides that Chapter III does not apply to general purpose software used in a healthcare environment.

Article 26(2) treats an EHR system manufactured and used within a health institution established in the Union, and an EHR system offered as a service to a person established in the Union, as put into service. Annex II applies its essential requirements mutatis mutandis to medical devices, in vitro diagnostic medical devices, AI systems and wellness applications claiming interoperability with EHR systems.

Annex II, point 1.3, requires an EHR system to be designed and developed in such a way that its interoperability, safety and security features uphold the rights of natural persons. Annex II, point 2.1, requires an EHR system designed to store or intermediate personal electronic health data to provide an interface enabling access to that data in the European electronic health record exchange format.

Annex II, point 2.2, requires an EHR system designed to store or intermediate personal electronic health data to be able to receive that data in the European electronic health record exchange format. Annex II, point 3.1, requires an EHR system designed to be used by health professionals to provide reliable mechanisms for the identification and authentication of health professionals.

Annex II, point 3.2, requires the logging component of an EHR system designed to enable access to personal electronic health data to record at least, on every access event or group of events, the identification of the healthcare provider or other individuals who accessed the data, the identification of the specific natural person or persons who accessed it, the categories of data accessed, the time and date of access and the origin or origins of the data.

Annex II, point 3.3, requires the harmonised software components to include tools or mechanisms to review and analyze the log data, or to support the connection and use of external software for the same purposes. Annex II, point 3.4, requires the harmonised software components that store personal electronic health data to support different retention periods and access rights that take into account the origins and categories of electronic health data.

The recitals state that the security requirements of the harmonised software components should cover elements specific to EHR systems, as more general security properties should be supported by other mechanisms such as those under Regulation (EU) 2024/2847.

Article 104 inserts Article 32(5a) into Regulation (EU) 2024/2847, under which a manufacturer of a product with digital elements that is classified as an EHR system demonstrates conformity with the essential requirements in Annex I to that Regulation using the conformity assessment procedure in Chapter III of Regulation (EU) 2025/327.

Article 36(1) requires the Commission to adopt, by 26 March 2027, common specifications in respect of the essential requirements in Annex II by means of implementing acts. Article 105 applies Regulation (EU) 2025/327 from 26 March 2027.

Article 105 applies Articles 25, 26 and 27 from 26 March 2029 to EHR systems intended by the manufacturer to process the priority categories of personal electronic health data in Article 14(1), points (a), (b) and (c), and from 26 March 2031 to those intended to process points (d), (e) and (f). Article 105 applies Chapter III to EHR systems put into service in the Union under Article 26(2) from 26 March 2031.

Article 105 applies the implementing acts referred to in Article 36(1) from the dates that depend on the category of personal electronic health data. Article 43(2) requires each Member State to designate the market surveillance authority or authorities responsible for the implementation of Chapter III. Article 99 requires Member States to lay down the rules on penalties applicable to infringements of Regulation (EU) 2025/327, which must be effective, proportionate and dissuasive.

Article 100 gives any natural or legal person that has suffered material or non-material damage as a result of an infringement the right to receive compensation in accordance with Union and national law.

Article 5 of the General Product Safety Regulation provides that economic operators shall place or make available on the market only safe products. Article 3, point (8), defines a manufacturer as any natural or legal person who manufactures a product or has a product designed or manufactured, and markets that product under that person's name or trademark.

Under Article 9(1), a manufacturer placing a product on the market must ensure that it has been designed and manufactured in accordance with that general safety requirement. Article 3, point (1), defines a product as any item, whether or not interconnected to other items, supplied or made available whether for consideration or not, which is intended for consumers or is likely, under reasonably foreseeable conditions, to be used by consumers even if not intended for them.

Article 6(1) lists the aspects to be taken into account in assessing whether a product is safe, and point (g) names, when required by the nature of the product, the appropriate cybersecurity features necessary to protect the product against external influences, including malicious third parties, where such an influence might have an impact on the safety of the product, including the possible loss of interconnection.

Point (h) names, when required by the nature of the product, the evolving, learning and predictive functionalities of the product. Point (c) names the effect that other products might have on the product, including the effect of non-embedded items that are meant to determine, change or complete the way the product works.

Under Article 13(2), a person other than the manufacturer that substantially modifies a product is deemed to be a manufacturer, subject to the obligations of Article 9 for the part of the product affected by the modification, or for the entire product if the substantial modification has an impact on its safety. Article 13(3) provides that a modification of a product, by physical or digital means, is substantial where it has an impact on the safety of the product and three criteria are met.

The criteria are that the modification changes the product in a manner not foreseen in the initial risk assessment, that the nature of the hazard has changed, a new hazard has been created or the level of risk has increased, and that the modification was not made by the consumers themselves or on their behalf for their own use.

Article 2(1) applies the Regulation to products that are placed or made available on the market insofar as there are no specific provisions with the same objective under Union law which regulate the safety of the products concerned. Where products are subject to specific safety requirements imposed by Union law, the Regulation applies only to those aspects and risks or categories of risks which are not covered by those requirements.

For products subject to specific requirements imposed by Union harmonisation legislation, Chapter II, which holds Articles 5 and 6, does not apply insofar as the risks or categories of risks covered by that legislation are concerned.

Recital 26 states that specific cybersecurity risks affecting the safety of consumers can be dealt with by sectoral legislation, and that where such legislation does not apply the relevant economic operators and national authorities should take into consideration risks linked to new technologies, when designing the products and assessing them respectively. Article 52 provides that the Regulation applies from 13 December 2024.

Article 23(1) applies provisions of Regulation (EU) 2019/1020 on market surveillance, including Article 10, Article 11(1) to (7), Articles 12 to 15 and Articles 21 to 24 of that Regulation, to products covered by the General Product Safety Regulation. Article 44 leaves the rules on penalties for infringements of the Regulation to the Member States, which the Article requires to be effective, proportionate and dissuasive.

Article 39 applies Directive (EU) 2020/1828 to representative actions brought against infringements by economic operators and providers of online marketplaces of provisions of the Regulation that harm, or may harm, the collective interests of consumers.

Article 2 applies the General Safety Regulation to vehicles of categories M, N and O, as defined in Article 4 of Regulation (EU) 2018/858, and to systems, components and separate technical units designed and constructed for such vehicles. Article 3 applies the definitions laid down in Article 3 of Regulation (EU) 2018/858 to the General Safety Regulation.

Article 4(5) requires manufacturers to ensure that vehicles, systems, components and separate technical units comply with the applicable requirements listed in Annex II with effect from the dates specified in that Annex, including the requirements relating to on-board instruments, electrical system, vehicle lighting and protection against unauthorized use including cyberattacks.

Annex II lists item D4, Protection of vehicle against cyberattacks, under the heading of on-board instruments, electrical system, vehicle lighting and protection against unauthorized use, including cyberattacks, and marks it with the date note B. Note B gives 6 July 2022 as the date for refusal to grant EU type-approval and 7 July 2024 as the date for the prohibition of the registration of vehicles, and of the placing on the market and entry into service of components and separate technical units.

Article 16 requires national authorities, with effect from the dates specified in Annex II, to refuse EU type-approval or national type-approval to a new type of vehicle, system, component or separate technical unit that does not comply with a requirement listed there. It also requires them, from those dates, to consider certificates of conformity for new vehicles that do not comply to be no longer valid and to prohibit the registration of such vehicles.

Recital 26 states that, in view of the risk of unauthorized remote access to in-vehicle data and of illegal modification of software over the air, UN Regulations or other regulatory acts on cyber security should be applied on a mandatory basis as soon as possible after their entry into force. Article 19 provides that the Regulation applies from 6 July 2022.

Recital 2 states that the administrative provisions of Regulation (EU) 2018/858, including the provisions on corrective measures and penalties, are fully applicable to the General Safety Regulation.

Commission Delegated Regulation (EU) 2022/1398 of 8 June 2022 replaced the row for item D4 in Annex II so that it names UN Regulation No 155 as the regulatory act for protection of the vehicle against cyberattacks, with the same date note B. UN Regulation No 155 is titled Uniform provisions concerning the approval of vehicles with regards to cybersecurity and cybersecurity management system. Delegated Regulation (EU) 2022/1398 was published in the Official Journal on 16 August 2022.

Under Article 2 of Delegated Regulation (EU) 2022/1398, that Regulation entered into force on the twentieth day following publication, which is 5 September 2022. Recital 27 states that UN Regulations or other regulatory acts regarding software update processes should be applied on a mandatory basis as soon as possible after their entry into force.

The software update requirement is carried by Regulation (EU) 2018/858, whose Annex IV point 5, added by Commission Delegated Regulation (EU) 2022/2236, requires the software update management system of the manufacturer as well as the whole vehicle type to comply with UN Regulation 156.

Article 1(1) applies the In Vitro Diagnostic Medical Devices Regulation to the placing on the market, making available on the market or putting into service of in vitro diagnostic medical devices for human use and accessories for such devices in the Union.

Article 2, point (2), defines an in vitro diagnostic medical device as any medical device which is a reagent, reagent product, calibrator, control material, kit, instrument, apparatus, piece of equipment, software or system, intended by the manufacturer to be used in vitro for the examination of specimens derived from the human body, solely or principally to provide information on listed matters.

Article 2, point (23), defines a manufacturer as a natural or legal person who manufactures or fully refurbishes a device or has a device designed, manufactured or fully refurbished, and markets that device under its name or trademark. Under Article 10(1), a manufacturer placing a device on the market or putting it into service must ensure that it has been designed and manufactured in accordance with the requirements of the Regulation.

Section 16.2 of Annex I requires software that is a device in itself, or that is incorporated in a device, to be developed and manufactured in accordance with the state of the art, taking into account the principles of development life cycle, risk management, including information security, verification and validation.

Section 16.3 adds that such software intended to be used in combination with mobile computing platforms must be designed and manufactured taking into account the specific features of the mobile platform and the external factors related to their use. Section 16.4 requires manufacturers to set out minimum requirements concerning hardware, IT networks characteristics and IT security measures, including protection against unauthorized access, necessary to run the software as intended.

Section 20.4.1, point (ah), requires the instructions for use of a device that incorporates electronic programmable systems, including software, or of software that is a device in itself, to contain those minimum requirements concerning hardware, IT networks characteristics and IT security measures. Article 113(2) provides that the Regulation applies from 26 May 2022.

Article 110, as amended by Regulation (EU) 2024/1860, lets devices with a valid certificate issued under Directive 98/79/EC, and certain devices declared to conform under that Directive without a notified body, be placed on the market or put into service until dates fixed in that Article, provided the conditions of its paragraph 3c are met. Article 106 leaves the rules on penalties to the Member States, which the Article requires to be effective, proportionate and dissuasive.

Article 88(1) requires the competent authorities to perform appropriate checks on the conformity characteristics and performance of devices.

Delegated Regulation (EU) 2025/1455 amends Delegated Regulation (EU) No 44/2014 by adding UN Regulation No 155 on cyber security and cyber security management system to the table in Annex I and by adding an Annex XVIII on the protection of vehicles against cyberattacks. Recital 1 states that the scope of UN Regulation No 155 has been extended to include rules on cybersecurity for L-category vehicles, meaning two- and three-wheel vehicles and quadricycles.

Point 1.2 of Annex XVIII requires vehicles of categories L1e, L2e, L3e, L4e, L5e, L6e and L7e, except L1e vehicles designed to pedal referred to in Article 3, point (94)(b), of Regulation (EU) No 168/2013, to meet all the relevant requirements of UN Regulation No 155.

Point 1.1 of Annex XVIII defines a type of vehicle with regard to cybersecurity as a category of vehicles which do not differ in the manufacturer's designation of the vehicle type or in essential aspects of the electric and electronic architecture and external interfaces with respect to cyber security. Point 1.3 of Annex XVIII applies points 1.1 and 1.2 to new vehicle types from 11 December 2027 and to existing vehicle types from 11 June 2029.

Annex I to Delegated Regulation (EU) No 44/2014, as amended, lists UN Regulation No 155 in the version Supplement 3 to the 00 series of amendments, published in the Official Journal on 10 January 2025 as 2025/5. The Official Journal text of UN Regulation No 155 is a documentation copy, since only the original UN/ECE texts have legal effect under international public law.

Paragraph 1.1 of UN Regulation No 155 applies it to vehicles, with regard to cyber security, of categories L, M, N and O, if fitted with at least one electronic control unit. Paragraph 7.2.2.1 requires the vehicle manufacturer to demonstrate that its Cyber Security Management System applies to the development phase, the production phase and the post-production phase.

Paragraph 7.3.1 requires the manufacturer to have a valid Certificate of Compliance for the Cyber Security Management System relevant to the vehicle type being approved.

For type approvals of vehicles of category L first issued before 1 July 2029, and each extension of them, a manufacturer that can demonstrate that the vehicle type could not be developed in compliance with the Cyber Security Management System must instead demonstrate that cyber security was adequately considered during the development phase.

Paragraph 7.3.3 requires the manufacturer to identify the critical elements of the vehicle type and perform an exhaustive risk assessment for it, treating the identified risks appropriately. Paragraph 7.3.4 requires the manufacturer to protect the vehicle type against the risks identified in its risk assessment, with proportionate mitigations that include all mitigations referred to in Annex 5, Parts B and C that are relevant for those risks.

Paragraph 7.3.7 requires measures to detect and prevent cyber-attacks against vehicles of the type, to support the manufacturer's monitoring of threats, vulnerabilities and cyber-attacks, and to provide data forensic capability to enable analysis of attempted or successful cyber-attacks. Paragraph 7.2.2.3 requires the manufacturer's processes to ensure that cyber threats and vulnerabilities which require a response are mitigated within a reasonable timeframe.

Paragraph 7.2.2.4 requires the monitoring of cyber-attacks, threats and vulnerabilities to be continual and to include vehicles after first registration. Paragraph 7.4.1 requires the manufacturer to report at least once a year, or more frequently if relevant, the outcome of its monitoring activities, including information on new cyber-attacks, and to confirm that the mitigations implemented are still effective.

Recital 3 states that L1e category vehicles designed to pedal are subject to the requirements of Regulation (EU) 2024/2847 under Commission Delegated Regulation (EU) 2025/1535. Article 18(1) of Regulation (EU) No 168/2013 requires L-category vehicles and the systems, components and separate technical units intended for them to comply with the requirements listed in its Annexes II to VIII applicable to the relevant vehicle sub-categories.

Article 76(1) of Regulation (EU) No 168/2013 leaves the penalties for infringement of that Regulation and its delegated acts to the Member States, which the Article requires to be effective, proportionate and dissuasive.

Article 2(1) applies the Machinery Regulation to machinery and to the related products interchangeable equipment, safety components, lifting accessories, chains, ropes and webbing, and removable mechanical transmission devices, and to partly completed machinery.

Article 3, point (3), defines a safety component as a physical or digital component, including software, of a product within the scope of the Regulation that is designed or intended to fulfil a safety function and is independently placed on the market.

Article 3, point (18), defines a manufacturer as any natural or legal person who manufactures products within the scope of the Regulation, or has them designed or manufactured, and markets them under its name or trademark, or who manufactures such products and puts them into service for its own use.

Article 10(1) requires a manufacturer placing machinery or a related product on the market or putting it into service to ensure that it has been designed and constructed in accordance with the essential health and safety requirements of Annex III.

Section 1.1.9 of Annex III requires the product to be designed and constructed so that the connection to it of another device, via any feature of the connected device itself or via any remote device that communicates with it, does not lead to a hazardous situation.

A hardware component transmitting signal or data, relevant for connection or access to software that is critical for the compliance of the product with the relevant essential health and safety requirements, must be designed so that it is adequately protected against accidental or intentional corruption. Software and data that are critical for that compliance must be identified as such and adequately protected against accidental or intentional corruption.

The product must identify the software installed on it that is necessary for it to operate safely and be able to provide that information at all times in an easily accessible form. It must collect evidence of a legitimate or illegitimate intervention in the software or a modification of the software installed on it or its configuration.

Section 1.2.1 requires control systems to be designed and constructed so that they can withstand, where appropriate to the circumstances and the risks, the intended operating stresses and intended and unintended external influences, including reasonably foreseeable malicious attempts from third parties leading to a hazardous situation.

It requires the tracing log of the data generated in relation to an intervention, and of the versions of safety software uploaded after the product has been placed on the market or put into service, to be enabled for five years after each upload, exclusively to demonstrate conformity further to a reasoned request from a competent national authority.

For control systems with fully or partially self-evolving behavior or logic that are designed to operate with varying levels of autonomy, it requires recording of data on the safety related decision-making process for software based safety systems to be enabled after the product is placed on the market or put into service, and that data to be retained for one year after its collection.

It also requires that it be possible at all times to correct such a product in order to maintain its inherent safety. Under Article 20(9), machinery and related products certified, or covered by a statement of conformity, under a cybersecurity certification scheme adopted under Regulation (EU) 2019/881 whose references are published in the Official Journal are presumed to conform to sections 1.1.9 and 1.2.1 insofar as the certificate or statement covers those requirements.

Article 2(2) leaves out motor vehicles and their trailers, and the systems, components, separate technical units, parts and equipment designed and constructed for them, that fall within the scope of Regulation (EU) 2018/858, except for machinery mounted on those vehicles.

It also leaves out household appliances, audio and video equipment, information technology equipment and certain other electrical and electronic products insofar as they fall within the scope of Directive 2014/35/EU or of Directive 2014/53/EU. Article 54 provides that the Regulation applies from 14 January 2027. Article 51(2) repeals Directive 2006/42/EC with effect from 14 January 2027.

Article 50(1) leaves the rules on penalties to the Member States, requires them to be effective, proportionate and dissuasive, and provides that they may include criminal penalties for serious infringements.

Article 1(1) applies the Medical Devices Regulation to the placing on the market, making available on the market or putting into service of medical devices for human use and accessories for such devices in the Union.

Article 2, point (1), defines a medical device as any instrument, apparatus, appliance, software, implant, reagent, material or other article intended by the manufacturer to be used, alone or in combination, for human beings for specific medical purposes such as diagnosis, prevention, monitoring, prediction, prognosis, treatment or alleviation of disease.

Article 2, point (30), defines a manufacturer as a natural or legal person who manufactures or fully refurbishes a device or has a device designed, manufactured or fully refurbished, and markets that device under its name or trademark. Article 5(2) requires a device to meet the general safety and performance requirements set out in Annex I which apply to it, taking into account its intended purpose.

Under Article 10(1), a manufacturer placing a device on the market or putting it into service must ensure that it has been designed and manufactured in accordance with the requirements of the Regulation.

Section 17.2 of Annex I requires software that is a device in itself, or that is incorporated in a device, to be developed and manufactured in accordance with the state of the art, taking into account the principles of development life cycle, risk management, including information security, verification and validation.

Section 17.3 adds that such software intended to be used in combination with mobile computing platforms must be designed and manufactured taking into account the specific features of the mobile platform and the external factors related to their use. Section 17.4 requires manufacturers to set out minimum requirements concerning hardware, IT networks characteristics and IT security measures, including protection against unauthorized access, necessary to run the software as intended.

Section 23.4, point (ab), requires the instructions for use of a device that incorporates electronic programmable systems, including software, or of software that is a device in itself, to contain those minimum requirements concerning hardware, IT networks characteristics and IT security measures. Article 1(8) of Regulation (EU) 2020/561 replaced the date of application in Article 123(2) with 26 May 2021.

Article 120, as replaced by Regulation (EU) 2023/607, lets devices with a valid certificate issued under Directive 90/385/EEC or Directive 93/42/EEC be placed on the market or put into service until dates fixed in that Article by device class, provided the conditions of its paragraph 3c are met. Article 113 leaves the rules on penalties to the Member States, which the Article requires to be effective, proportionate and dissuasive.

Article 93(1) requires the competent authorities to perform appropriate checks on the conformity characteristics and performance of devices.

Delegated Regulation (EU) 2022/30 supplements the Radio Equipment Directive, Directive 2014/53/EU, by specifying which radio equipment must meet the essential requirements of Article 3(3), points (d), (e) and (f), of that Directive.

The Directive defines radio equipment as an electrical or electronic product that intentionally emits and/or receives radio waves for the purpose of radio communication and/or radiodetermination, or one that must be completed with an accessory, such as an antenna, to do so.

Article 2(1), point (12), of the Directive defines a manufacturer as any natural or legal person who manufactures radio equipment or has radio equipment designed or manufactured, and markets that equipment under its name or trade mark. Article 1(1) applies point (d) to any radio equipment that can communicate itself over the internet, whether directly or via any other equipment, which the Regulation calls internet-connected radio equipment.

Point (d) requires that radio equipment does not harm the network or its functioning nor misuse network resources, thereby causing an unacceptable degradation of service. Article 1(2) applies point (e) to internet-connected radio equipment, to radio equipment designed or intended exclusively for childcare, to radio equipment covered by Directive 2009/48/EC on the safety of toys, and to radio equipment designed or intended to be worn on, strapped to, or hung from the human body or clothing.

Article 1(2) applies point (e) to that equipment only if it is capable of processing personal data, or traffic data or location data, within the meaning of Regulation (EU) 2016/679 and Article 2, points (b) and (c), of Directive 2002/58/EC, a wording that Article 2 of Delegated Regulation (EU) 2023/2444 corrected. Point (e) requires that radio equipment incorporates safeguards to ensure that the personal data and privacy of the user and of the subscriber are protected.

Article 1(3) applies point (f) to any internet-connected radio equipment that enables the holder or user to transfer money, monetary value or virtual currency as defined in Article 2, point (d), of Directive (EU) 2019/713. Point (f) requires that radio equipment supports certain features ensuring protection from fraud.

Article 2(1) provides that points (d), (e) and (f) do not apply to radio equipment to which Regulation (EU) 2017/745 on medical devices or Regulation (EU) 2017/746 on in vitro diagnostic medical devices also applies. Article 2(2) provides that points (e) and (f) do not apply to radio equipment to which Regulation (EU) 2018/1139 on civil aviation, Regulation (EU) 2019/2144 on motor vehicle type-approval or Directive (EU) 2019/520 on electronic road toll systems also applies.

Article 3, as replaced by Article 1 of Delegated Regulation (EU) 2023/2444, provides that Delegated Regulation (EU) 2022/30 applies from 1 August 2025. Under Article 10(1) of the Directive, a manufacturer placing radio equipment on the market must ensure that it has been designed and manufactured in accordance with the essential requirements of Article 3.

Article 49(1) of the Directive required Member States to adopt and publish the measures necessary to comply with it by 12 June 2016 and to apply them from 13 June 2016. Article 46 of the Directive leaves the rules on penalties to the Member States and provides that they may include criminal penalties for serious infringements.

Commission Delegated Regulation (EU) 2022/2236 of 20 June 2022 amends Annexes I, II, IV and V to Regulation (EU) 2018/858 as regards, among other things, software update. The recitals of Delegated Regulation (EU) 2022/2236 state that it is necessary to add UN Regulation No 156 to the list of regulatory acts setting out the requirements for the EU whole-vehicle type-approval.

The table in Part I of Annex II to Regulation (EU) 2018/858, as replaced by the Delegated Regulation, lists item H2, Software update, with Annex IV to Regulation (EU) 2018/858 and UN Regulation No 156 as the regulatory acts. Point 5 added to Annex IV to Regulation (EU) 2018/858 provides that the software update management system of the manufacturer as well as the whole vehicle type shall comply with the requirements set out in UN Regulation 156.

UN Regulation No 156 is titled Uniform provisions concerning the approval of vehicles with regards to software update and software update management system. The recitals state that manufacturers should establish a software update management system as part of their conformity of production process.

With effect from 6 July 2022, national authorities must refuse to grant EU whole-vehicle type-approval or national type-approval to any new type of vehicles, where the manufacturer executes software updates that affect type-approved characteristics of those vehicles after their registration, if the vehicles do not comply with Regulation (EU) 2018/858 as amended with regard to software update.

With effect from 7 July 2024, national authorities must consider, on grounds relating to software update, certificates of conformity for new vehicles to be no longer valid and prohibit the registration, placing on the market or entry into service of vehicles, where the manufacturer executes software updates that affect type-approved characteristics after registration, if the vehicles do not comply.

With effect from 7 July 2024, national authorities must also refuse, on grounds relating to software update, to grant EU whole-vehicle type-approval or national type-approval to any new type of vehicles that do not comply. With effect from 7 July 2026 the certificate and registration consequences of Article 2(3) apply, on grounds relating to software update, to new complete vehicles, and with effect from 7 July 2029 they apply to new completed vehicles.

Commission Delegated Regulation (EU) 2022/2236 was published in the Official Journal on 16 November 2022. Article 3 of Delegated Regulation (EU) 2022/2236 provides that it enters into force on the twentieth day following publication, which is 6 December 2022.

Article 1 of Regulation (EU) 2022/1645 sets out the requirements to be met by the organizations referred to in Article 2 in order to identify and manage information security risks with potential impact on aviation safety.

Article 2(1) applies the Regulation to production organizations and design organizations subject to Subparts G and J of Section A of Annex I (Part 21) to Regulation (EU) No 748/2012, and to aerodrome operators and apron management service providers subject to Annex III (Part-ADR.OR) to Regulation (EU) No 139/2014.

Point IS.D.OR.200(a) requires the organization to set up, implement and maintain an information security management system with a policy on information security, risk identification and treatment, internal and external reporting schemes, detection of information security events, response to and recovery from incidents, and compliance monitoring. Point IS.D.OR.200(b) requires a continuous improvement process.

Point IS.D.OR.200(e) lets the competent authority approve an organization not to implement these requirements if it demonstrates that its activities, facilities, resources and services pose no information security risks with a potential impact on aviation safety to itself or to other organizations. Point IS.D.OR.205(a) requires the organization to identify all its elements that could be exposed to information security risks.

Point IS.D.OR.205(c) requires the organization to identify the information security risks that may have a potential impact on aviation safety and to assign each risk a level according to a predefined classification. Point IS.D.OR.205(d) requires the organization to review and update the risk assessment when the elements, the interfaces, the information used to classify risks or the lessons learnt from incidents change.

Point IS.D.OR.210(a) requires the organization to develop measures to address unacceptable risks, implement them in a timely manner and check their continued effectiveness. Point IS.D.OR.215(a) requires an internal reporting scheme to collect and evaluate information security events, including those to be reported externally.

Point IS.D.OR.220 requires measures to detect incidents and vulnerabilities, measures to respond to events that may develop into an information security incident, and measures to recover from incidents. Point IS.D.OR.225(a) requires the organization, after the competent authority notifies findings, to identify the root causes, define a corrective action plan and demonstrate the correction to the authority's satisfaction.

Point IS.D.OR.235(a) requires the organization to ensure that the activities it contracts out comply with the Regulation and that the contracted organization works under its oversight. Point IS.D.OR.240(a) requires the accountable manager to ensure that the resources needed to comply are available, to establish and promote the information security policy and to demonstrate a basic understanding of the Regulation.

Point IS.D.OR.245 requires the organization to keep archived and traceable records of approvals, contracts, key processes, risks and risk treatment measures, reported incidents and vulnerabilities, and events that may need reassessment. The records of key processes, of risks and risk treatment measures, and of reported incidents and vulnerabilities are kept for at least 5 years. The Regulation applies from 16 October 2025.

Article 4(1) treats compliance with equivalent security requirements laid down in accordance with Article 14 of Directive (EU) 2016/1148 as compliance with this Regulation. Directive (EU) 2022/2555 repealed Directive (EU) 2016/1148 with effect from 18 October 2024, and references to the repealed Directive are construed as references to Directive (EU) 2022/2555.

The authority responsible for certifying and overseeing compliance is, for each class of organization, the competent authority designated under the regulation that governs that class (Article 5(1)). Article 131 of Regulation (EU) 2018/1139 requires Member States to lay down the rules on penalties applicable to infringement of that Regulation and of the delegated and implementing acts adopted on the basis of it.

The Regulation enters into force on the twentieth day following its publication in the Official Journal of the European Union.

Article 2(1) applies the Regulation to the activities of the listed entities if they are identified as high-impact or critical-impact entities in accordance with Article 24, among them electricity undertakings, nominated electricity market operators, organized market places that arrange transactions on products relevant to cross-border electricity flows, critical ICT service providers, balancing responsible parties, operators of recharging points, regional coordination centers and managed security service providers.

Article 1 establishes a network code that lays down sector-specific rules for cybersecurity aspects of cross-border electricity flows, including rules on common minimum requirements, planning, monitoring, reporting and crisis management.

Recital 7 notes that many of these entities will be identified both as essential entities under Article 3 of Directive (EU) 2022/2555 and as high-impact or critical-impact entities, while the Regulation's own criteria refer only to their role and impact in the electricity processes affecting cross-border flows.

Article 24(1) has each competent authority identify the high-impact and critical-impact entities in its Member State, using the electricity cybersecurity impact index and the thresholds in the Union-wide cybersecurity risk assessment report. Article 24(6) has each competent authority notify the entities on its list that they have been identified, within nine months after it is notified of the Union-wide cybersecurity risk assessment report and in any case no later than 13 June 2028.

Article 48(3) provides that the entities on a provisional list may voluntarily fulfill their obligations on a precautionary basis, and that the competent authorities notify them by 13 March 2025. The Regulation enters into force on the twentieth day following its publication in the Official Journal of the European Union.

Article 26 requires each high-impact and critical-impact entity to perform cybersecurity risk management for all its assets in its high-impact and critical-impact perimeters every three years. The risk management comprises four phases: context establishment, cybersecurity risk assessment at entity level, cybersecurity risk treatment and cybersecurity risk acceptance. Article 26(7) requires the entity to register the assets in an asset inventory that is not part of the risk assessment report.

Article 27 requires the entity, within 12 months after the Article 24(6) notification and every three years thereafter, to give the competent authority a report listing the controls selected for its risk mitigation plan with their implementation status, an estimate of the risk to each Union-wide high-impact or critical-impact process, and its critical ICT service providers for critical-impact processes.

Article 28 requires high-impact entities to apply the minimum cybersecurity controls within their high-impact perimeter and critical-impact entities to apply the advanced cybersecurity controls within their critical-impact perimeter. Article 29(1) has the TSOs, with the assistance of the ENTSO for Electricity and in cooperation with the EU DSO entity, develop the proposal for the minimum and advanced cybersecurity controls.

Article 29(6) sets the time for applying the controls at 12 months after the approval of the minimum and advanced cybersecurity controls, or after each update. Article 31 requires a critical-impact entity to be able to demonstrate its compliance with the cybersecurity management system and the controls at the request of the competent authority, no later than 24 months after the controls are adopted and the management system is established.

A critical-impact entity meets that duty by independent third-party security audits or by taking part in a national verification scheme. The verification is repeated at the latest 36 months after the end of the first verification and every 3 years thereafter. Article 32 requires each such entity to establish a cybersecurity management system within 24 months after the Article 24(6) notification and to review it every three years thereafter.

Article 4(1) has each Member State designate a national governmental or regulatory authority as the competent authority responsible for carrying out the tasks the Regulation assigns.

Article 4(1) of Regulation (EU) 2023/203 requires the organizations referred to in Article 2(1) to comply with the requirements of Annex II (Part-IS.I.OR) to that Regulation. Article 2(1) applies the Regulation to the following classes of organization, subject to the exceptions it lists for organizations solely involved in the activities it names.

The classes are maintenance organizations under Part-145, continuing airworthiness management organizations under Part-CAMO, air operators under Part-ORO, approved training organizations, aircrew aero-medical centers, flight simulation training device operators, air traffic controller training organizations and aero-medical centers, organizations under Part-ATM/ANS.OR, and U-space service providers and single common information service providers.

Point IS.I.OR.200(a) requires the organization to set up, implement and maintain an information security management system with a policy on information security, risk identification and treatment, internal and external reporting schemes, detection of information security events, response to and recovery from incidents, and compliance monitoring. Point IS.I.OR.200(b) requires a continuous improvement process.

Point IS.I.OR.200(e) lets the competent authority approve an organization not to implement these requirements if it demonstrates that its activities, facilities, resources and services pose no information security risks with a potential impact on aviation safety to itself or to other organizations. Point IS.I.OR.205(a) requires the organization to identify all its elements that could be exposed to information security risks.

Point IS.I.OR.205(c) requires the organization to identify the information security risks that may have a potential impact on aviation safety and to assign each risk a level according to a predefined classification. Point IS.I.OR.205(d) requires the organization to review and update the risk assessment when the elements, the interfaces, the information used to classify risks or the lessons learnt from incidents change.

Point IS.I.OR.210(a) requires the organization to develop measures to address unacceptable risks, implement them in a timely manner and check their continued effectiveness. Point IS.I.OR.215(a) requires an internal reporting scheme to collect and evaluate information security events, including those to be reported externally.

Point IS.I.OR.220 requires measures to detect incidents and vulnerabilities, measures to respond to events that may develop into an information security incident, and measures to recover from incidents. Point IS.I.OR.225(a) requires the organization, after the competent authority notifies findings, to identify the root causes, define a corrective action plan and demonstrate the correction to the authority's satisfaction.

Point IS.I.OR.235(a) requires the organization to ensure that the activities it contracts out comply with the Regulation and that the contracted organization works under its oversight. Point IS.I.OR.240(a) requires the accountable manager to ensure that the resources needed to comply are available, to establish and promote the information security policy and to demonstrate a basic understanding of the Regulation.

Point IS.I.OR.245 requires the organization to keep archived and traceable records of approvals, contracts, key processes, risks and risk treatment measures, reported incidents and vulnerabilities, and events that may need reassessment. The records of key processes, of risks and risk treatment measures, and of reported incidents and vulnerabilities are kept for at least 5 years.

The Regulation applies from 22 February 2026, and from 1 January 2026 to the air navigation service provider of the European Geostationary Navigation Overlay Service. Article 5(1) treats compliance with equivalent security requirements laid down in accordance with Article 14 of Directive (EU) 2016/1148 as compliance with this Regulation.

Directive (EU) 2022/2555 repealed Directive (EU) 2016/1148 with effect from 18 October 2024, and references to the repealed Directive are construed as references to Directive (EU) 2022/2555. The authority responsible for certifying and overseeing compliance is, for each class of organization, the competent authority designated under the regulation that governs that class (Article 6(1)).

Article 131 of Regulation (EU) 2018/1139 requires Member States to lay down the rules on penalties applicable to infringement of that Regulation and of the delegated and implementing acts adopted on the basis of it. The Regulation enters into force on the twentieth day following its publication in the Official Journal of the European Union.

Article 2(1) sets out, in the Annex, the technical and methodological requirements of the cybersecurity risk-management measures referred to in Article 21(2), points (a) to (j), of Directive (EU) 2022/2555.

Article 1 lays down the requirements with regard to DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, providers of online marketplaces, online search engines and social networking services platforms, and trust service providers, which it calls the relevant entities.

Article 2(2) requires the relevant entities to ensure a level of security of network and information systems appropriate to the risks posed when they implement the requirements. In doing so they take due account of their exposure to risks, their size, the likelihood of occurrence of incidents and their severity, including their societal and economic impact.

Where the Annex applies a requirement where appropriate, where applicable or to the extent feasible, and an entity considers it not appropriate, not applicable or not feasible to apply it, the entity must document its reasoning in a comprehensible manner.

The Annex has thirteen sections, covering the security policy, risk management, incident handling, business continuity and crisis management, supply chain security, security in the acquisition, development and maintenance of network and information systems, assessment of the effectiveness of the measures, cyber hygiene and security training, cryptography, human resources security, access control, asset management, and environmental and physical security.

Point 6.2.1 requires an entity, before it develops a network and information system including software, to lay down rules for secure development and to apply them to in-house and outsourced development. Point 6.6.1 requires procedures ensuring that security patches are applied within a reasonable time after they become available.

Point 6.6.2 lets an entity choose not to apply a security patch when the disadvantages of applying it outweigh the cybersecurity benefits, provided the entity documents and substantiates its reasons. Point 6.10.2 requires an entity to lay down a procedure for disclosing vulnerabilities in accordance with the applicable national coordinated vulnerability disclosure policy.

Point 11.7.1 requires an entity to ensure, where appropriate and in accordance with the classification of the asset to be accessed, that users are authenticated by multiple authentication factors or continuous authentication mechanisms. Point 3.4.2 requires an entity to assess the existence of recurring incidents under Article 4 on a quarterly basis.

Point 3.2.1 requires an entity to lay down procedures and use tools to monitor and log activities on its network and information systems to detect events that could be considered as incidents. Point 3.2.3 requires an entity to maintain, document and review logs, and to establish a list of the assets to be subject to logging based on the results of its risk assessment.

Point 3.2.3 also lists what the logs include where appropriate: relevant outbound and inbound network traffic, the creation, modification or deletion of users and the extension of permissions, access to systems and applications, authentication-related events, all privileged access and the activities of administrative accounts, access to or changes of critical configuration and backup files, event logs and logs from security tools, use of system resources and their performance, physical access to facilities, access to and use of network equipment and devices, the activation, stopping and pausing of the various logs, and environmental events.

Point 3.2.4 requires an entity to review the logs regularly for unusual or unwanted trends and to ensure that, when an alarm is triggered, a qualified and appropriate response is initiated in a timely manner. Point 3.2.5 requires an entity to maintain and back up logs for a predefined period and to protect them from unauthorized access or changes.

Point 3.2.6 requires an entity, to the extent feasible, to ensure that all systems have synchronized time sources so that logs can be correlated between systems, to keep a list of all assets being logged, and to ensure that its monitoring and logging systems are redundant.

Article 3(1) of Regulation (EU) 2025/38 establishes the European Cybersecurity Alert System as a pan-European network of National Cyber Hubs and Cross-Border Cyber Hubs that join on a voluntary basis. Article 4(1) requires a Member State that decides to participate in the European Cybersecurity Alert System to designate or, where applicable, establish a National Cyber Hub.

Article 8(1) requires Member States participating in the European Cybersecurity Alert System to ensure a high level of cybersecurity, including confidentiality and data security, as well as physical security of the network. Article 6(1) requires the members of a Hosting Consortium to ensure that their National Cyber Hubs share relevant information among themselves within the Cross-Border Cyber Hub, in accordance with the written consortium agreement.

Article 12(1) has the Cybersecurity Emergency Mechanism support the voluntary coordinated preparedness testing of entities operating in sectors of high criticality. Article 12(7) requires the Member State authority responsible for the coordinated preparedness testing, where appropriate, to review the follow-up of the measures that a voluntarily participating entity could integrate into a remediation plan.

Article 14(3) names the users of the EU Cybersecurity Reserve as the cyber crisis management authorities and computer security incident response teams (CSIRTs) of the Member States, CERT-EU, and the competent authorities of third countries associated with the Digital Europe Programme. Article 15(2) requires a user of the EU Cybersecurity Reserve, to receive support, to take all appropriate measures to mitigate the effects of the incident for which the support is requested.

Article 17(2), point (j), has the contracting authority require a provider in the EU Cybersecurity Reserve, once a European cybersecurity certification scheme for managed security services is in place, to be certified under it within 2 years from the date of application of the scheme.

Article 21(1) requires ENISA, at the request of the Commission or EU-CyCLONe and with the approval of the Member States concerned, to review and assess cyber threats, known exploitable vulnerabilities and mitigation actions with respect to a specific significant cybersecurity incident or large-scale cybersecurity incident. ENISA then delivers an incident review report to EU-CyCLONe, the CSIRTs network, the Member States concerned and the Commission.

Article 21(3) bars the report from including any details about actively exploited vulnerabilities that remain unpatched. Article 26 provides that the Regulation enters into force on the twentieth day following that of its publication in the Official Journal of the European Union.

Commission Delegated Regulation (EU) 2024/1774 supplements Regulation (EU) 2022/2554 with regulatory technical standards that specify ICT risk management tools, methods, processes and policies and the simplified ICT risk management framework.

Article 1 requires a financial entity to take into account its size and overall risk profile, and the nature, scale and elements of increased or reduced complexity of its services, activities and operations, when it develops and implements the policies, procedures, protocols and tools of Title II and the simplified framework of Title III.

Article 2(1) requires a financial entity to embed its ICT security policies, information security and related procedures, protocols and tools in its ICT risk management framework. Article 3 requires ICT risk management policies and procedures that contain a procedure and a methodology to conduct the ICT risk assessment, ICT risk treatment measures, and provisions on the review of the accepted residual ICT risks at least once a year.

Article 10(2) requires a financial entity to perform automated vulnerability scanning and assessments on the ICT assets supporting critical or important functions on at least a weekly basis. Article 10(2) also requires the vulnerability management procedures to include procedures for the responsible disclosure of vulnerabilities to clients, counterparties and the public.

Article 10(4) requires patch management procedures that identify emergency procedures for patching and updating ICT assets and that set deadlines for installing patches and updates, with escalation procedures for deadlines that cannot be met.

Article 12 requires logging procedures, protocols and tools that identify the events to be logged and their retention period, log events related to access control, capacity management, change management, ICT operations and network traffic, protect the logs against tampering, deletion and unauthorized access, and synchronize the clocks of the ICT systems.

Article 12 also requires a financial entity to establish the retention period of its logs taking into account its business and information security objectives, the reason for recording the event in the logs, and the results of its ICT risk assessment.

Article 13 requires network security management policies that include segregation and segmentation of ICT systems and networks, a separate and dedicated network for the administration of ICT assets and encryption of network connections, and requires the adequacy of firewall rules and connection filters for ICT systems supporting critical or important functions to be verified at least every 6 months.

Article 21 requires access control policies that update access rights at least once a year for ICT systems other than those supporting critical or important functions and at least every 6 months for ICT systems supporting critical or important functions.

Article 22 requires an ICT-related incident policy that documents the incident management process, establishes a list of relevant contacts, sets up mechanisms to support incident management and retains all evidence relating to ICT-related incidents for a period no longer than necessary.

Article 23(2) requires mechanisms to identify anomalous activities and to implement tools generating alerts at least for the ICT assets and information assets supporting critical or important functions, with the alerts prioritized both during and outside working hours.

Article 24(3) and (4) set a recovery time objective of not longer than 2 hours for the critical or important functions of a central securities depository, and require a trading venue to be able to resume trading within or close to 2 hours of a disruptive incident.

Article 25(2) requires the testing of the ICT business continuity plans to use test scenarios that simulate potential disruptions, including severe but plausible scenarios, and to include the ICT services provided by ICT third-party service providers where applicable. Article 27(1) requires the report on the review of the ICT risk management framework to be submitted in a searchable electronic format.

Article 28(1) requires the financial entities referred to in Article 16(1) of Regulation (EU) 2022/2554 to have in place an internal governance and control framework that ensures an effective and prudent management of ICT risk. Article 40(1) requires the financial entities referred to in Article 16(1) of Regulation (EU) 2022/2554 to test their business continuity plans at least once every year for the back-up and restore procedures, or upon every major change of the business continuity plan.

Article 42 provides that the Regulation enters into force on the twentieth day following that of its publication in the Official Journal of the European Union. The penalties for a breach are those of the parent Regulation, whose Article 50(3) requires Member States to lay down effective, proportionate and dissuasive administrative penalties and remedial measures.

Article 17(1) requires a financial entity to define, establish and implement an ICT-related incident management process to detect, manage and notify ICT-related incidents. Article 17(2) requires a financial entity to record all ICT-related incidents and significant cyber threats, and to establish procedures and processes that ensure consistent and integrated monitoring, handling and follow-up of ICT-related incidents so that root causes are identified, documented and addressed.

Article 17(3), point (b), requires the process to establish procedures to identify, track, log, categorize and classify ICT-related incidents according to their priority and severity and the criticality of the services impacted, in accordance with the criteria set out in Article 18(1).

Article 17(3) also requires the process to put in place early warning indicators, assign roles and responsibilities for different incident types and scenarios, set out plans for communication and internal escalation, ensure that at least major ICT-related incidents are reported to relevant senior management and to the management body, and establish response procedures to mitigate impacts and make services operational and secure in a timely manner. Article 64 makes the Regulation apply from 17 January 2025.

Article 24(1) requires a financial entity other than a microenterprise to establish, maintain and review a sound and comprehensive digital operational resilience testing program as an integral part of its ICT risk-management framework. Article 24(4) requires a financial entity other than a microenterprise to ensure that tests are undertaken by independent parties, whether internal or external.

Article 24(6) requires a financial entity other than a microenterprise to ensure, at least yearly, that appropriate tests are conducted on all ICT systems and applications supporting critical or important functions. Article 25(1) requires the testing program to provide for appropriate tests such as vulnerability assessments and scans, network security assessments, source code reviews where feasible, scenario-based tests and penetration testing.

Article 25(2) requires central securities depositories and central counterparties to perform vulnerability assessments before any deployment or redeployment of new or existing applications and infrastructure components, and ICT services supporting critical or important functions. Article 25(3) requires a microenterprise to perform the Article 25(1) tests by combining a risk-based approach with a strategic planning of ICT testing.

Article 26(1) requires the financial entities that a competent authority identifies under Article 26(8), other than microenterprises and the entities named in Article 16(1), first subparagraph, to carry out advanced testing by means of threat-led penetration testing (TLPT) at least every 3 years. Article 26(1) also lets the competent authority, where necessary and based on the entity's risk profile and operational circumstances, request the entity to reduce or increase that frequency.

Article 26(8) has competent authorities identify the financial entities that must perform TLPT on an assessment of impact-related factors, possible financial stability concerns including systemic character, and the entity's specific ICT risk profile, level of ICT maturity or technology features.

Article 26(2) requires each threat-led penetration test to cover several or all critical or important functions of the financial entity and to be performed on live production systems supporting those functions. Article 26(3) requires the financial entity to take the necessary measures and safeguards to ensure the participation of ICT third-party service providers included in the scope of TLPT, and to retain at all times full responsibility for compliance with the Regulation.

Article 26(4) lets the financial entity and the ICT third-party service provider, where the provider's participation in the TLPT is reasonably expected to have an adverse impact on the quality or security of its services to customers outside the scope of the Regulation or on the confidentiality of the data related to those services, agree in writing that the provider contracts directly with an external tester, under the direction of one designated financial entity, for a pooled TLPT involving several financial entities.

Article 26(6) requires the financial entity and any external testers, once reports and remediation plans have been agreed, to give the designated authority a summary of the relevant findings, the remediation plans and the documentation demonstrating that the TLPT was conducted in accordance with the requirements.

Article 26(8) requires a financial entity that uses internal testers to contract external testers every three tests, and requires a credit institution classified as significant under Regulation (EU) No 1024/2013 to use only external testers.

Article 27(1) requires testers for TLPT to be of the highest suitability and reputability, to have technical and organizational capabilities and specific expertise in threat intelligence, penetration testing and red team testing, to be certified or adhere to formal codes of conduct, to provide independent assurance or an audit report, and to be covered by professional indemnity insurance.

Article 27(2) allows internal testers only with the approval of the competent authority or the designated single public authority, requires the competent authority to have verified sufficient dedicated resources and the avoidance of conflicts of interest, and requires the threat intelligence provider to be external to the financial entity.

Article 26(11) tasks the European Supervisory Authorities, in agreement with the ECB, with developing joint draft regulatory technical standards in accordance with the TIBER-EU framework that specify the TLPT criteria, scope and methodology further. Article 50(3) requires Member States to lay down rules establishing appropriate administrative penalties and remedial measures for breaches of the Regulation, which must be effective, proportionate and dissuasive. Article 64 applies the Regulation from 17 January 2025.

Article 28 requires a financial entity to manage ICT third-party risk as an integral component of its ICT risk management framework, proportionate to the nature, scale, complexity and criticality of its ICT-related dependencies.

Article 28(2) requires the entity, other than a microenterprise or one covered by Article 16(1), to adopt and regularly review a strategy on ICT third-party risk, and Article 28(3) requires it to maintain and update a register of information on all its ICT services contracts, distinguishing those supporting a critical or important function, report on the register at least yearly to its competent authority, and produce it in full on request.

Article 28(4) requires the entity, before entering into a contractual arrangement, to assess whether it covers a critical or important function, whether supervisory conditions for contracting are met, the risks the arrangement poses including the concentration risk Article 29 describes, and to undertake due diligence on the prospective provider and to identify and assess any conflicts of interest the arrangement may cause.

Article 29 is that preliminary assessment of ICT concentration risk: whether the provider is easily substitutable, whether the entity already has multiple critical-function contracts with the same or a closely connected provider, where subcontracting is possible, the benefits and risks of it, in particular for an ICT subcontractor established in a third country, and the risk a long or complex subcontracting chain poses to the entity's ability to monitor the function and to the competent authority's ability to supervise it; for any contract supporting a critical or important function it also requires the entity to consider the insolvency law provisions that would apply if the provider became bankrupt and any constraint on the urgent recovery of its data, and, for a provider established in a third country, compliance with Union data protection rules and the effective enforcement of the law in that country.

Article 30(1) and (2) require every ICT services contract to be in writing, in a single document, and to cover at minimum a description of the functions and services provided, the locations where the service and any subcontracted part of it will run and where data will be processed, provisions on the availability, authenticity, integrity and confidentiality of data including personal data, the entity's right to access, recover and return its data if the provider becomes insolvent or the contract ends, service level descriptions, the provider's duty to assist the entity on an ICT incident, the provider's duty to cooperate with the entity's competent and resolution authorities, termination rights and notice periods, and the provider's participation in the entity's security awareness and training programme.

Article 30(3) requires a contract supporting a critical or important function to add, on top of those elements, quantitative and qualitative service level targets, notice of anything that could materially affect the provider's ability to perform, the provider's duty to implement and test business contingency plans and to have in place ICT security measures, tools and policies, the provider's cooperation in the entity's threat-led penetration testing, the entity's right to monitor the provider's performance on an ongoing basis, with unrestricted rights of access, inspection and audit, and an exit strategy with a mandatory transition period letting the entity move to another provider or bring the function in-house.

A microenterprise and its provider may agree that the entity's rights of access, inspection and audit are delegated to an independent third party the provider appoints.

Article 31(1) has the European Supervisory Authorities, through the Joint Committee and on recommendation from the Oversight Forum, designate the ICT third-party service providers that are critical for financial entities and appoint a Lead Overseer for each.

Article 31(2) bases the designation on the systemic impact of a large scale operational failure, the systemic character of the financial entities that rely on the provider, their reliance on it for critical or important functions, and its degree of substitutability.

Article 31(8) takes out of the designation financial entities providing ICT services to other financial entities, ICT intra-group service providers, providers subject to oversight frameworks that support the tasks referred to in Article 127(2) of the Treaty on the Functioning of the European Union, and providers that provide ICT services solely in one Member State to financial entities that are only active in that Member State.

Article 31(5) has the Lead Overseer notify the provider of the outcome of the assessment, lets the provider submit a reasoned statement within 6 weeks of the notification, and sets a starting date for oversight activities that is no later than one month after the notification of the designation. Article 31(7) provides that the designation is not used until the Commission has adopted a delegated act specifying the criteria in Article 31(2).

Article 31(4) requires critical ICT third-party service providers that are part of a group to designate one legal person as a coordination point to ensure adequate representation and communication with the Lead Overseer. Article 31(5) also requires the provider to notify the financial entities to which it provides services of its designation as critical.

Article 31(12) allows financial entities to use the services of a designated provider established in a third country only if it has established a subsidiary in the Union within the 12 months following the designation, and Article 31(13) requires that provider to notify the Lead Overseer of any changes to the structure of the management of the subsidiary.

Article 33(1) has the Lead Overseer conduct the oversight of the assigned critical ICT third-party service providers and act as their primary point of contact for all matters related to oversight.

Article 33(2) and (3) have the Lead Overseer assess whether each critical provider has comprehensive, sound and effective rules, procedures, mechanisms and arrangements to manage the ICT risk it may pose to financial entities, covering service security, availability, continuity, scalability and quality, physical security, risk management processes, governance, incident reporting, data portability, testing and audits.

Article 33(4) has the Lead Overseer adopt an individual oversight plan describing the annual oversight objectives and the main oversight actions planned for each critical provider, communicated to the provider yearly. Article 35(1) gives the Lead Overseer the powers to request information, to conduct general investigations and inspections, to request reports on the actions taken after its recommendations, and to issue recommendations on the areas referred to in Article 33(3).

Article 35(5) requires critical ICT third-party service providers to cooperate in good faith with the Lead Overseer and to assist it in the fulfillment of its tasks. Article 35(6) requires the Lead Overseer, after at least 30 calendar days from the provider's receipt of notification of the measures, to adopt a decision imposing a periodic penalty payment on a provider that wholly or partly fails to comply with the measures required under Article 35(1), points (a), (b) and (c).

Article 35(7) and (8) set the periodic penalty payment daily until compliance is achieved, for no more than six months, at up to 1 % of the average daily worldwide turnover of the critical provider in the preceding business year. Article 35(9) makes the penalty payments administrative in nature and enforceable, and allocates their amounts to the general budget of the European Union.

Article 37(1) lets the Lead Overseer, by simple request or by decision, require critical providers to provide all information necessary for its duties, including business or operational documents, contracts, policies, documentation, ICT security audit reports and ICT-related incident reports. Article 38(4) requires the representatives of critical providers to submit to investigations on the basis of a decision of the Lead Overseer.

Article 39(6) requires a critical provider to submit to on-site inspections ordered by decision of the Lead Overseer. Article 42(1) requires a critical provider, within 60 calendar days of receiving the Lead Overseer's recommendations, to notify the Lead Overseer of its intention to follow them or to provide a reasoned explanation for not following them.

Article 42(6) lets competent authorities, as a measure of last resort, require financial entities to suspend, in part or completely, the use or deployment of a service provided by a critical provider until the risks identified in the recommendations have been addressed, and where necessary to terminate the relevant contractual arrangements.

Article 42(9) requires a critical provider affected by such a decision to fully cooperate with the financial entities impacted, in particular in the suspension or termination of their contractual arrangements. Article 43(1) provides that the fee charged to a critical provider covers all costs derived from the execution of the oversight duties and is proportionate to its turnover. Article 64 applies the Regulation from 17 January 2025.

Regulation (EU) 2022/2554 (DORA) applies to the financial entities listed in Article 2(1), points (a) to (t), among them credit institutions, payment institutions, electronic money institutions, investment firms, crypto-asset service providers, central counterparties, trading venues and insurance and reinsurance undertakings.

Article 2(3) takes six classes of entity out of the Regulation, among them insurance and reinsurance undertakings referred to in Article 4 of Directive 2009/138/EC, institutions for occupational retirement provision with no more than 15 members in total, and post office giro institutions. Article 2(4) lets a Member State exclude from the Regulation the entities referred to in Article 2(5), points (4) to (23), of Directive 2013/36/EU that are located within its territory.

Article 4 requires a financial entity to implement the rules of Chapter II in proportion to its size and overall risk profile and to the nature, scale and complexity of its services, activities and operations. Article 5(1) requires a financial entity to have an internal governance and control framework that ensures an effective and prudent management of ICT risk.

Article 5(2) makes the management body of the financial entity define, approve, oversee and be responsible for the implementation of all arrangements related to the ICT risk management framework. Article 5(4) requires the members of the management body to keep up to date with sufficient knowledge and skills to understand and assess ICT risk, including by following specific training on a regular basis.

Article 6(1) requires a financial entity to have a sound, comprehensive and well-documented ICT risk management framework as part of its overall risk management system. Article 6(5) requires the framework to be documented and reviewed at least once a year, or periodically in the case of microenterprises, and upon the occurrence of major ICT-related incidents.

Article 6(4) requires a financial entity other than a microenterprise to assign responsibility for managing and overseeing ICT risk to a control function with an appropriate level of independence. Article 6(8) requires the framework to include a digital operational resilience strategy that sets the risk tolerance level for ICT risk and information security objectives and covers the implementation of digital operational resilience testing.

Article 7 requires a financial entity to use and maintain updated ICT systems, protocols and tools that are appropriate to the magnitude of its operations, reliable, equipped with sufficient capacity and technologically resilient. Article 8 requires a financial entity to identify, classify and document all ICT supported business functions and the information assets and ICT assets supporting them, and to review the adequacy of that classification at least yearly.

Article 9(4) requires a financial entity to document an information security policy, access-limiting policies, strong authentication mechanisms, ICT change management and policies for patches and updates. Article 10(1) requires mechanisms to promptly detect anomalous activities, including ICT network performance issues and ICT-related incidents, and to identify potential material single points of failure.

Article 11 requires a comprehensive ICT business continuity policy and, under Article 11(3), ICT response and recovery plans, which Article 11(6) requires to be tested at least yearly. Article 12(1) requires a financial entity to develop and document backup policies and procedures and restoration and recovery procedures and methods. Article 13(2) requires post ICT-related incident reviews after a major ICT-related incident disrupts the financial entity's core activities.

Article 14(1) requires crisis communication plans that enable a responsible disclosure of, at least, major ICT-related incidents or vulnerabilities to clients and counterparts and to the public. Article 15 delegates to the Commission the adoption of regulatory technical standards that specify these elements further.

Article 16(1) disapplies Articles 5 to 15 to small and non-interconnected investment firms, payment institutions exempted pursuant to Directive (EU) 2015/2366, institutions exempted pursuant to Directive 2013/36/EU in respect of which Member States have decided not to apply the option referred to in Article 2(4), electronic money institutions exempted pursuant to Directive 2009/110/EC and small institutions for occupational retirement provision, and requires those entities to meet the simplified framework of Article 16 instead.

Article 50(3) requires Member States to lay down rules establishing appropriate administrative penalties and remedial measures for breaches of the Regulation, which must be effective, proportionate and dissuasive. Article 64 applies the Regulation from 17 January 2025.

Article 21 requires each Member State to ensure that essential and important entities, defined by the Annex I and Annex II sector lists together with a medium-enterprise size threshold set under Article 2, take appropriate and proportionate technical, operational and organisational measures to manage the cybersecurity risks to the network and information systems they use, based on an all-hazards approach covering at least risk analysis and information system security, incident handling, business continuity, supply chain security, security in system acquisition and maintenance, the effectiveness of the measures, basic cyber hygiene and training, cryptography, human resources security and access control, and multi-factor or continuous authentication.

Annex II names online marketplaces, online search engines and social networking services platforms among the digital providers this duty reaches once they cross the medium-enterprise size threshold, or regardless of size where Article 2(2), points (b) to (e), applies, for example where the provider is the sole provider in a Member State of a service essential for the maintenance of critical societal or economic activities.

Annex I separately names public administration entities, which Article 2(2), point (f), brings in regardless of size when they are central government entities as a Member State defines them, or regional entities that, following a risk-based assessment, provide services whose disruption could have a significant impact on critical societal or economic activities, and Article 2(7) excludes public administration entities carrying out activities in the areas of national security, public security, defence or law enforcement.

A provider of an online marketplace, online search engine or social networking services platform that is not established in the Union but offers its service within it must designate a representative in the Union, established in one of the Member States where the service is offered, and falls under the jurisdiction of the Member State where that representative is established.

Article 1(1) of Directive (EU) 2015/2366 (PSD2) names the payment service providers the Directive covers: credit institutions, electronic money institutions, post office giro institutions, payment institutions, the ECB and national central banks when not acting in their capacity as monetary authority or other public authorities, and Member States or their regional or local authorities when not acting in their capacity as public authorities.

Article 95(1) requires payment service providers to establish a framework with appropriate mitigation measures and control mechanisms to manage the operational and security risks relating to the payment services they provide, including effective incident management procedures for the detection and classification of major operational and security incidents.

Article 95(2) requires them to give the competent authority, annually or at shorter intervals the authority sets, an updated and comprehensive assessment of those risks and of the adequacy of the mitigation measures and control mechanisms they have implemented.

Article 96(1) requires a provider, in the case of a major operational or security incident, to notify the competent authority in its home Member State without undue delay and, where the incident has or may have an impact on the financial interests of its users, to inform them without undue delay of the incident and of the measures they can take to mitigate its adverse effects.

Article 96(6) requires providers to give their competent authorities statistical data on fraud relating to the different means of payment at least once a year.

Article 96(7), which Directive (EU) 2022/2556 added, provides that paragraphs 1 to 5 of Article 96 do not apply to the payment service providers referred to in points (a), (b) and (d) of Article 1(1), to account information service providers, or to payment institutions and electronic money institutions that benefit from an exemption or waiver.

Recital 23 of Regulation (EU) 2022/2554 (DORA) states that the incident reporting requirement of Directive (EU) 2015/2366 should cease to apply to payment service providers that fall within DORA's scope, and that credit institutions, e-money institutions, payment institutions and account information service providers should report those incidents under DORA instead.

Article 96(7) does not name post office giro institutions, the ECB and national central banks, or Member States, which points (c), (e) and (f) of Article 1(1) list as providers.

Article 97 requires a provider to apply strong customer authentication where the payer accesses its payment account online, initiates an electronic payment transaction, or carries out any action through a remote channel which may imply a risk of payment fraud or other abuses, and to have adequate security measures in place to protect the confidentiality and integrity of its users' personalized security credentials.

Article 97(2) adds that for electronic remote payment transactions the authentication must include elements which dynamically link the transaction to a specific amount and a specific payee, and Article 97(4) extends these duties to payments initiated through a payment initiation service provider and to information requested through an account information service provider.

Article 98(1) tasked the European Banking Authority with draft regulatory technical standards specifying the requirements of strong customer authentication and the security measures that protect personalized security credentials, and Commission Delegated Regulation (EU) 2018/389 supplements the Directive with technical standards for strong customer authentication.

Article 3(j) takes out of the Directive services provided by technical service providers which support the provision of payment services without them entering at any time into possession of the funds to be transferred, including the provision and maintenance of terminals and devices used for payment services, with the exclusion of payment initiation services and account information services.

Article 100(1) requires each Member State to designate competent authorities to ensure and monitor effective compliance with the Directive, and Article 103(1) requires Member States to lay down penalties for infringements of the national law transposing it that are effective, proportionate and dissuasive, without setting a sum of its own.

The European Parliament's procedure file for a proposed successor Directive (2023/0209(COD)) lists it as repealing Directive 2015/2366 and shows the stage reached as awaiting the Council's first reading position, and the file for the companion proposed Payment Services Regulation (2023/0210(COD)) shows the same stage.

Commission Delegated Regulation (EU) 2018/389 supplements Directive (EU) 2015/2366 with regulatory technical standards for strong customer authentication and common and secure open standards of communication.

Article 97(1) of the Directive requires a payment service provider to apply strong customer authentication where the payer accesses its payment account online, initiates an electronic payment transaction, or carries out any action through a remote channel which may imply a risk of payment fraud or other abuses.

Article 1 sets the requirements that payment service providers must meet to apply strong customer authentication, to exempt its application on specified and limited conditions, to protect the confidentiality and integrity of the personalized security credentials of the payment service user, and to establish common and secure open standards for communication between account servicing payment service providers, payment initiation service providers, account information service providers, payers, payees and other payment service providers.

Article 11, as one of the exemptions in Chapter III, allows payment service providers not to apply strong customer authentication, subject to compliance with Article 2, to a contactless electronic payment transaction at the point of sale that meets the conditions of that Article.

Article 2 requires payment service providers to have transaction monitoring mechanisms that detect unauthorized or fraudulent payment transactions and that take into account, at a minimum, lists of compromised or stolen authentication elements, the amount of each payment transaction, known fraud scenarios, signs of malware infection in any session of the authentication procedure and, where the provider supplies the access device or software, a log of its use and its abnormal use.

Article 3 requires the implementation of the security measures to be documented, periodically tested, evaluated and audited by auditors with expertise in IT security and payments who are operationally independent, and requires a provider that uses the transaction risk analysis exemption of Article 18 to have the methodology, the model and the reported fraud rates audited at a minimum on a yearly basis.

Article 4(1) requires strong customer authentication to be based on two or more elements categorized as knowledge, possession and inherence and to result in an authentication code that the payment service provider accepts only once.

Article 4(3) requires that the number of consecutive failed authentication attempts after which the action is blocked does not exceed five within a given period of time, and that the maximum time without activity by the payer after authentication for online access to a payment account does not exceed 5 minutes.

Article 5(1) requires, where strong customer authentication is applied under Article 97(2) of the Directive, an authentication code that is specific to the amount of the payment transaction and the payee agreed to by the payer, with any change to the amount or the payee invalidating the code.

Articles 6 to 8 require measures that mitigate the risk that authentication elements categorized as knowledge are uncovered by or disclosed to unauthorized parties, that elements categorized as possession are used by unauthorized parties, and that elements categorized as inherence and read by access devices and software are uncovered by unauthorized parties.

Article 9 requires measures ensuring that the breach of one authentication element does not compromise the reliability of the other elements, and measures that mitigate the risk of a multi-purpose device being compromised, including separated secure execution environments.

Article 22(1) requires payment service providers to ensure the confidentiality and integrity of the personalized security credentials of the payment service user, including authentication codes, during all phases of the authentication.

Article 23 requires the creation of personalized security credentials to be performed in a secure environment, and Article 24 requires that only the payment service user is associated, in a secure manner, with the credentials, the authentication devices and the software.

Article 25(1) requires the delivery of personalized security credentials, authentication devices and software to the payment service user to be carried out in a secure manner designed to address the risks related to their unauthorized use due to their loss, theft or copying. Article 27 requires payment service providers to have effective processes for the secure destruction, deactivation or revocation of the personalized security credentials, authentication devices and software.

Article 28 requires payment service providers to ensure secure identification when communicating between the payer's device and the payee's acceptance devices for electronic payments, and to mitigate the risks of misdirection of communication to unauthorized parties in mobile applications and other interfaces for electronic payment services.

Article 29 requires processes that make all payment transactions and other interactions traceable, with a unique identifier of each communication session, detailed logging of the transaction and timestamps synchronized according to an official time signal.

Article 30(1) requires an account servicing payment service provider that offers a payment account accessible online to have in place at least one interface through which account information service providers, payment initiation service providers and card-based payment instrument issuers can identify themselves and through which the first two can communicate securely.

Article 30(3) requires the interfaces to follow standards of communication issued by international or European standardization organizations and the technical specification to be documented and made available free of charge on request to authorized providers, with a summary published on the provider's website.

Article 30(4) requires, except for emergency situations, any change to the technical specification of the interface to be made available in advance and not less than 3 months before the change is implemented. Article 30(5) requires account servicing payment service providers to make available a testing facility, including support, for connection and functional testing, and no sensitive information may be shared through it.

Delegated Regulation (EU) 2022/2360 inserted Article 30(4a), which requires account servicing payment service providers to make available the changes made to the technical specifications of their interfaces in order to comply with Article 10a not less than 2 months before those changes are implemented. Delegated Regulation (EU) 2022/2360 applies from 25 July 2023.

Article 32 requires an account servicing payment service provider with a dedicated interface to ensure that it offers at all times the same level of availability and performance, including support, as the interfaces made available to the payment service user, to define transparent key performance indicators and service level targets at least as stringent, and to ensure that the interface does not create obstacles to payment initiation and account information services.

Article 32(4) requires account servicing payment service providers to publish on their website quarterly statistics on the availability and performance of the dedicated interface and of the interface used by their payment service users.

Article 33(1) requires account servicing payment service providers to include in the design of the dedicated interface a strategy and plans for contingency measures for the event that the interface does not perform in compliance with Article 32, is unavailable or breaks down, and allows unplanned unavailability to be presumed when five consecutive requests are not replied to within 30 seconds.

Article 33(3) requires both the account servicing payment service provider and the payment service providers referred to in Article 30(1) to report problems with dedicated interfaces to their respective competent national authorities without delay. Article 34(1) requires payment service providers to rely on qualified certificates for electronic seals or for website authentication under Regulation (EU) No 910/2014 for the purpose of identification.

Article 35(1) requires secure encryption, using strong and widely recognized encryption techniques, to be applied between the communicating parties throughout the communication session when data are exchanged by means of the internet. Article 35(5) requires a provider, in case of loss of confidentiality of personalized security credentials under its sphere of competence, to inform without undue delay the payment services user associated with them and the issuer of the credentials.

Article 36(1) requires an account servicing payment service provider to give account information service providers the same information from designated payment accounts and associated payment transactions made available to the user, excluding sensitive payment data, to give payment initiation service providers immediately after receipt of the payment order the same information on the initiation and execution, and to confirm upon request in a simple yes or no format whether the amount necessary for a payment transaction is available.

Article 36(5) lets account information service providers access the information from designated payment accounts whenever the payment service user is actively requesting it and otherwise no more than four times in a 24-hour period, unless a higher frequency is agreed between the account information service provider and the account servicing payment service provider with the payment service user's consent.

Article 38 applies the Regulation from 14 September 2019, and Article 30(3) and (5) from 14 March 2019. Article 74(2) of the Directive provides that where the payer's payment service provider does not require strong customer authentication, the payer does not bear any financial losses unless the payer has acted fraudulently.

Article 103(1) of the Directive requires Member States to lay down rules on penalties applicable to infringements of the national law transposing it, which must be effective, proportionate and dissuasive.

Article 19a(1), point (a), requires a non-qualified trust service provider providing non-qualified trust services to have appropriate policies and take corresponding measures to manage legal, business, operational and other direct or indirect risks to the provision of the service.

Those measures include, notwithstanding Article 21 of Directive (EU) 2022/2555, at least measures relating to registration and onboarding procedures for a trust service, the procedural or administrative checks needed to provide trust services, and the management and implementation of trust services.

Article 19a(2) provides that compliance with Article 19a is presumed where the reference standards, specifications and procedures that the Commission establishes by implementing act for point (a) are met.

Article 3, point (16), of Regulation (EU) No 910/2014 defines a trust service as an electronic service normally provided for remuneration which consists of any of the listed activities, the first being the issuance of certificates for electronic signatures, certificates for electronic seals, certificates for website authentication or certificates for the provision of other trust services.

Qualified trust service providers carry the parallel duty in Article 24(2), point (fa), of Regulation (EU) No 910/2014. Article 2(2), point (a)(ii), of Directive (EU) 2022/2555 applies that Directive to entities of a type referred to in Annex I or II, whatever their size, where their services are provided by trust service providers. Article 3(2) of that Directive treats an entity of a type referred to in Annex I or II that does not qualify as an essential entity as an important entity.

Article 13(1) gives any natural or legal person who has suffered material or non-material damage as a result of an infringement of the Regulation by a trust service provider the right to seek compensation in accordance with Union and national law. The burden of proving the intention or negligence of a non-qualified trust service provider lies with the person claiming the damage.

Article 16(2) requires Member States to subject infringements by qualified and non-qualified trust service providers to administrative fines of a maximum of at least EUR 5,000,000 for a natural person or, for a legal person, EUR 5,000,000 or 1 percent of the total worldwide annual turnover, whichever is higher. Regulation (EU) 2024/1183 enters into force on the twentieth day following its publication in the Official Journal of the European Union.

Point IS.D.OR.230(b) requires the organization to ensure that any information security incident or vulnerability that may represent a significant risk to aviation safety is reported to its competent authority.

Where the incident or vulnerability affects an aircraft or associated system or component, the organization also reports it to the design approval holder, and where it affects a system or constituent the organization uses, to the organization responsible for the design of that system or constituent.

Point IS.D.OR.230(c) requires a notification as soon as the condition is known, a report as soon as possible and not exceeding 72 hours from the time the condition has been known to the organization, and a follow-up report on the recovery and prevention actions. The report is made in the form the competent authority defines and contains all relevant information about the condition known to the organization.

Point IS.D.OR.230(a) requires an information security reporting system that complies with Regulation (EU) No 376/2014 and its delegated and implementing acts where that Regulation is applicable to the organization.

Article 4(2) treats the cybersecurity requirements in point 1.7 of the Annex to Implementing Regulation (EU) 2015/1998 as equivalent to the requirements of this Regulation for an operator or entity in the national civil aviation security programs, except as regards point IS.D.OR.230, which must be complied with as such. The Regulation applies from 16 October 2025.

The authority responsible for certifying and overseeing compliance is, for each class of organization, the competent authority designated under the regulation that governs that class (Article 5(1)). Article 131 of Regulation (EU) 2018/1139 requires Member States to lay down the rules on penalties applicable to infringement of that Regulation and of the delegated and implementing acts adopted on the basis of it.

Article 2(1) applies the Regulation to the activities of the listed entities if they are identified as high-impact or critical-impact entities in accordance with Article 24, among them electricity undertakings, nominated electricity market operators, organized market places that arrange transactions on products relevant to cross-border electricity flows, critical ICT service providers, balancing responsible parties, operators of recharging points, regional coordination centers and managed security service providers.

Article 1 establishes a network code that lays down sector-specific rules for cybersecurity aspects of cross-border electricity flows, including rules on common minimum requirements, planning, monitoring, reporting and crisis management. Article 24(1) has each competent authority identify the high-impact and critical-impact entities in its Member State, using the electricity cybersecurity impact index and the thresholds in the Union-wide cybersecurity risk assessment report.

Article 24(6) has each competent authority notify the entities on its list that they have been identified, within nine months after it is notified of the Union-wide cybersecurity risk assessment report and in any case no later than 13 June 2028.

Article 38(1) requires each high-impact and critical-impact entity to establish, for all assets within its cybersecurity perimeter, at least the capabilities of a cybersecurity operation center to ensure that systems provide security logs, to conduct security monitoring including detecting intrusions and assessing vulnerabilities, to analyze and take the actions needed to protect the entity, and to participate in the information collection and sharing described in that Article.

The entity may procure all or parts of those capabilities through managed security service providers but remains responsible for them and supervises their efforts. The entity designates a single point of contact at entity level for the purpose of information sharing.

Article 38(3) requires each critical-impact and high-impact entity to share relevant information related to a reportable cyber-attack with its computer security incident response teams (CSIRTs) and its competent authority without undue delay and no later than four hours of becoming aware that the incident is reportable. Information related to a cyber-attack is reportable when the affected entity assesses its criticality as ranging from high to critical following the cyber-attack classification scale methodology under Article 37(8).

Article 37(8) has the TSOs, with the assistance of the ENTSO for Electricity and in cooperation with the EU DSO entity, develop the cyber-attack classification scale methodology by 13 June 2025. Article 38(6) requires the entity to provide its CSIRTs without undue delay with any information related to a reportable cyber threat that may have a cross-border effect.

Article 38(7) requires the entity, when sharing information under that Article, to specify that the information is submitted pursuant to the Regulation, among other particulars. Where an entity notifies a significant incident under Article 23 of Directive (EU) 2022/2555 and that report contains the information Article 38(3) requires, the Article 23(1) report constitutes the Article 38(3) report.

Article 4(1) has each Member State designate a national governmental or regulatory authority as the competent authority responsible for carrying out the tasks the Regulation assigns.

Point IS.I.OR.230(b) requires the organization to ensure that any information security incident or vulnerability that may represent a significant risk to aviation safety is reported to its competent authority.

Where the incident or vulnerability affects an aircraft or associated system or component, the organization also reports it to the design approval holder, and where it affects a system or constituent the organization uses, to the organization responsible for the design of that system or constituent.

Point IS.I.OR.230(c) requires a notification as soon as the condition is known, a report as soon as possible and not exceeding 72 hours from the time the condition has been known to the organization, and a follow-up report on the recovery and prevention actions. The report is made in the form the competent authority defines and contains all relevant information about the condition known to the organization.

Point IS.I.OR.230(a) requires an information security reporting system that complies with Regulation (EU) No 376/2014 and its delegated and implementing acts where that Regulation is applicable to the organization.

Article 5(2) treats the cybersecurity requirements in point 1.7 of the Annex to Implementing Regulation (EU) 2015/1998 as equivalent to the requirements of this Regulation for an operator or entity in the national civil aviation security programs, except as regards point IS.I.OR.230, which must be complied with as such. The Regulation applies from 22 February 2026, and from 1 January 2026 to the air navigation service provider of the European Geostationary Navigation Overlay Service.

The authority responsible for certifying and overseeing compliance is, for each class of organization, the competent authority designated under the regulation that governs that class (Article 6(1)). Article 131 of Regulation (EU) 2018/1139 requires Member States to lay down the rules on penalties applicable to infringement of that Regulation and of the delegated and implementing acts adopted on the basis of it.

Article 3(1) makes an incident significant, for the purposes of Article 23(3) of Directive (EU) 2022/2555 and with regard to the relevant entities, where one or more of the criteria in points (a) to (g) are fulfilled. Point (a) is direct financial loss, caused or capable of being caused, that exceeds EUR 500,000 or 5 percent of the entity's total annual turnover in the preceding financial year, whichever is lower.

Points (b) to (d) cover an incident that has caused or is capable of causing the exfiltration of trade secrets, the death of a natural person, or considerable damage to a natural person's health, and point (e) covers a successful, suspectedly malicious and unauthorised access to network and information systems that is capable of causing severe operational disruption. Points (f) and (g) bring in the recurring incidents of Article 4 and the criteria of Articles 5 to 14 for each class of entity.

Recital 30 states that the criteria in the Regulation should be considered exhaustive, without prejudice to Article 5 of Directive (EU) 2022/2555. Recital 31 states that an entity is regarded as aware of a significant incident when, after its initial assessment, it has a reasonable degree of certainty that a significant incident has occurred.

Article 3(2) excludes scheduled interruptions of service and the planned consequences of scheduled maintenance operations carried out by or on behalf of the entities.

For the user-based criteria of Articles 7 and 9 to 14, Article 3(3) requires an entity calculating the number of users impacted to consider the number of customers that have a contract giving them access to its network and information systems or services, and the number of natural and legal persons associated with business customers that use them.

Article 4 treats incidents that are individually not significant as one significant incident where they occurred at least twice within 6 months, have the same apparent root cause, and collectively meet the financial loss criterion of Article 3(1), point (a).

Article 5 makes an incident significant for a DNS service provider where a recursive or authoritative domain name resolution service is completely unavailable for more than 30 minutes, where for more than one hour the average response time of such a service to DNS requests is more than 10 seconds, or where the integrity, confidentiality or authenticity of data related to the authoritative resolution service is compromised, except where the data of fewer than 1,000 domain names, amounting to no more than 1 percent of the domain names the provider manages, are not correct because of misconfiguration.

Article 6 makes an incident significant for a top-level domain (TLD) name registry where an authoritative domain name resolution service is completely unavailable, where for more than one hour the average response time of such a service to DNS requests is more than 10 seconds, or where the integrity, confidentiality or authenticity of data related to the technical operation of the TLD is compromised.

Article 7 makes an incident significant for a cloud computing service provider where a cloud computing service is completely unavailable for more than 30 minutes, where its availability is limited for more than one hour for more than 5 percent of its users in the Union or for more than 1 million of them, whichever number is smaller, where the integrity, confidentiality or authenticity of related data is compromised as a result of a suspectedly malicious action, or where it is compromised with an impact on more than 5 percent of its users in the Union or on more than 1 million of them, whichever number is smaller.

Article 8 makes an incident significant for a data centre service provider where a data centre service of a data centre it operates is completely unavailable, where its availability is limited for more than one hour, where the integrity, confidentiality or authenticity of related data is compromised as a result of a suspectedly malicious action, or where physical access to a data centre it operates is compromised.

Article 9 makes an incident significant for a content delivery network provider where a content delivery network is completely unavailable for more than 30 minutes, where its availability is limited for more than one hour for more than 5 percent of its users in the Union or for more than 1 million of them, whichever number is smaller, where the integrity, confidentiality or authenticity of related data is compromised as a result of a suspectedly malicious action, or where it is compromised with an impact on more than 5 percent of its users in the Union or on more than 1 million of them, whichever number is smaller.

Article 10 applies to managed service providers and managed security service providers the same four criteria and figures as Article 9, measured against the users of the managed service or managed security service in the Union.

Article 11 makes an incident significant for a provider of an online marketplace where the marketplace is completely unavailable for more than 5 percent of its users in the Union or for more than 1 million of them, whichever number is smaller, where more than 5 percent of its users in the Union, or more than 1 million of them, whichever number is smaller, are impacted by its limited availability, where the integrity, confidentiality or authenticity of related data is compromised as a result of a suspectedly malicious action, or where it is compromised with an impact on more than 5 percent of its users in the Union or on more than 1 million of them, whichever number is smaller.

Article 12 applies the same four criteria and figures as Article 11 to a provider of an online search engine, measured against its users in the Union. Article 13 applies the same four criteria and figures as Article 11 to a provider of a social networking services platform, measured against its users in the Union.

Article 14 makes an incident significant for a trust service provider where a trust service is completely unavailable for more than 20 minutes, where it is unavailable to users or relying parties for more than one hour calculated on a calendar week basis, where more than 1 percent of the users or relying parties in the Union, or more than 200,000 of them, whichever number is smaller, are impacted by its limited availability, where physical access to an area where network and information systems are located and to which access is restricted to trusted personnel of the provider, or the protection of that access, is compromised, or where the integrity, confidentiality or authenticity of related data is compromised with an impact on more than 0.1 percent of users or relying parties, or more than 100 of them, whichever number is smaller.

Commission Delegated Regulation (EU) 2024/1772 supplements Regulation (EU) 2022/2554 with regulatory technical standards that specify the criteria for the classification of ICT-related incidents and cyber threats, set out materiality thresholds and specify the details of reports of major incidents.

Article 8(1) makes an incident a major incident for the purposes of Article 19(1) of Regulation (EU) 2022/2554 where it has affected critical services as referred to in Article 6 and either the materiality threshold of Article 9(5), point (b), is met or two or more of the other materiality thresholds of Article 9(1) to (6) are met.

Article 6 treats services as critical where the incident affects ICT services or network and information systems that support critical or important functions, affects financial services that require authorization, registration or supervision, or constitutes a successful, malicious and unauthorized access to the network and information systems of the financial entity.

Article 9(1) sets the threshold for clients, financial counterparts and transactions at more than 10 % of all clients using the affected service, more than 100,000 affected clients, more than 30 % of the financial counterparts carrying out activities related to the affected service, more than 10 % of the daily average number or value of transactions of the affected service, or the affecting of clients or financial counterparts identified as relevant.

Article 9(2) treats the threshold for reputational impact as met where any of the conditions set out in Article 2, points (a) to (d), is fulfilled.

Article 2(1) treats a reputational impact as having occurred where the incident has been reflected in the media, has resulted in repetitive complaints from different clients or financial counterparts, will or is likely to leave the entity unable to meet regulatory requirements, or will or is likely to lose it clients or financial counterparts with a material impact on its business.

Article 9(3) treats the threshold for duration and service downtime as met where the duration of the incident is longer than 24 hours or the service downtime is longer than 2 hours for ICT services that support critical or important functions. Article 9(4) treats the threshold for geographical spread as met where the incident has an impact in two or more Member States.

Article 9(5) treats the threshold for data losses as met where any impact on the availability, authenticity, integrity or confidentiality of data has or will have an adverse impact on the entity's business objectives or ability to meet regulatory requirements, or where a successful, malicious and unauthorized access to network and information systems that may result in data losses occurs.

Article 9(6) treats the threshold for economic impact as met where the costs and losses incurred have exceeded or are likely to exceed 100,000 euro. Article 8(2) treats recurring incidents that individually are not major as one major incident where they have occurred at least twice within 6 months, have the same apparent root cause and collectively fulfill Article 8(1), and requires the entity to assess recurrence on a monthly basis.

Article 8(2) does not apply to microenterprises or to the financial entities listed in Article 16(1) of Regulation (EU) 2022/2554. Article 3(1) requires the duration of an incident to be measured from the moment the incident occurs until the moment when it is resolved, or from the moment it was detected where the entity cannot determine when it occurred.

Article 7(1) requires the entity, without accounting for financial recoveries, to take into account the direct and indirect costs and losses it has incurred, including expropriated funds, replacement costs, staff costs, fees for non-compliance with contractual obligations, redress and compensation to customers, forgone revenues, communication costs and advisory costs.

Article 10 treats a cyber threat as significant where it could affect critical or important functions or other financial entities, has a high probability of materialisation, and could if materialised meet the criticality criterion of Article 6 or the thresholds of Article 9(1) or Article 9(4). Article 13 provides that the Regulation enters into force on the twentieth day following that of its publication in the Official Journal of the European Union.

The penalties for a breach are those of the parent Regulation, whose Article 50(3) requires Member States to lay down effective, proportionate and dissuasive administrative penalties and remedial measures.

Commission Implementing Regulation (EU) 2025/302 lays down implementing technical standards for the application of Regulation (EU) 2022/2554 with regard to the standard forms, templates and procedures for financial entities to report a major ICT-related incident and to notify a significant cyber threat.

Article 1(1) requires financial entities to use the template laid down in Annex I to submit the initial notification, the intermediate report and the final report referred to in Article 19(4) of Regulation (EU) 2022/2554.

Article 1(2) and (3) require the information in the initial notification and in the intermediate and final reports to be complete and accurate, with estimated values based on other available data where accurate data are not available for the initial notification or the intermediate report. Article 1(5) requires financial entities to follow the data glossary and instructions set out in Annex II when completing the template.

Article 2 lets financial entities combine the submission of the initial notification, the intermediate report and the final report where regular activities have recovered or the root cause analysis has been completed, provided that the time limits of Article 5 of Delegated Regulation (EU) 2025/301 are met.

Article 3 requires financial entities that provide information on non-major recurring ICT-related incidents that cumulatively meet the conditions for one major incident under Article 8(2) of Delegated Regulation (EU) 2024/1772 to provide it in an aggregated form. Article 4(1) requires financial entities to use the secure electronic channels made available by their competent authority to submit the initial notification and the intermediate and final reports.

Article 4(2) requires a financial entity that cannot use those channels to inform its competent authority of a major ICT-related incident through other secure means in agreement with the competent authority.

Article 5 requires a financial entity that concludes after further assessment that an incident reported as major at no time fulfilled the classification criteria and thresholds of Article 8 of Delegated Regulation (EU) 2024/1772 to notify the competent authority that it has reclassified the incident from major to non-major.

Article 6 requires a financial entity that has outsourced the obligation to report major ICT-related incidents under Article 19(5) of Regulation (EU) 2022/2554 to inform its competent authority of the arrangement as soon as it is concluded and at the latest before the first notification or report, giving the name, contact details and identification code of the third party.

Article 7(1) lets a third-party service provider to which reporting has been outsourced use the Annex I template to report a major incident affecting multiple financial entities in one notification where the incident originates from a third-party ICT service provider that provides the relevant service to more than one financial entity or to a group, each entity classifies it as major, the entities are in a single Member State under the same competent authority, and competent authorities have explicitly permitted this type of aggregation.

Article 7(2) excludes credit institutions of significant relevance, operators of trading venues and central counterparties from aggregated reporting, so that they submit notifications and reports individually to their competent authority. Article 8(1) requires financial entities that notify significant cyber threats under Article 19(2) of Regulation (EU) 2022/2554 to use the template laid down in Annex III and to follow the data glossary and instructions set out in Annex IV.

Article 9 provides that the Regulation enters into force on the twentieth day following that of its publication in the Official Journal of the European Union. The penalties for a breach are those of the parent Regulation, whose Article 50(3) requires Member States to lay down effective, proportionate and dissuasive administrative penalties and remedial measures.

Regulation (EU) 2022/2554 (DORA) is the financial sector's own digital operational resilience regime, and Article 19 sets its major ICT-related incident reporting duty, together with Commission Delegated Regulation (EU) 2025/301, which Article 20 required to specify the report content and time limits Article 19 itself leaves open.

Article 19 requires a financial entity listed in Article 2(1), points (a) to (t), such as a credit institution, payment institution, investment firm, insurance or reinsurance undertaking, or crypto-asset service provider, to report a major ICT-related incident to the competent authority designated for it under Article 46.

Article 2(3) takes six classes out of the Regulation altogether, among them insurance and reinsurance undertakings referred to in Article 4 of Directive 2009/138/EC, institutions for occupational retirement provision that operate pension schemes with no more than 15 members in total, insurance, reinsurance and ancillary insurance intermediaries that are microenterprises or small or medium-sized enterprises, and post office giro institutions.

Under Article 2(4) a Member State may exclude the entities referred to in Article 2(5), points (4) to (23), of Directive 2013/36/EU that are located in its territory. Article 2(1) also names ICT third-party service providers as point (u), but Article 2(2) confines the defined term financial entities to points (a) to (t), so Article 19's own reporting duty does not bind an ICT third-party service provider directly.

A financial entity may instead outsource the Article 19 reporting task to a third-party service provider while remaining fully responsible for fulfilling it. Separately, every contract for the use of ICT services must oblige the provider to assist the financial entity, at no additional cost or at a pre-agreed cost, when an ICT incident related to that service occurs, and a contract covering a critical or important function carries further terms on top of that baseline.

The duty runs through three stages under Article 19(4): an initial notification, an intermediate report once the incident's status or handling changes significantly or new information becomes available, and a final report once the root cause analysis is complete and the actual impact figures are known.

Commission Delegated Regulation (EU) 2025/301 supplies the clock Article 20 left to be specified: the initial notification is due as early as possible and in any case within four hours of classifying the incident as major, and no later than 24 hours from becoming aware of it. Where classification of an incident as major happens more than 24 hours after the financial entity became aware of it, the initial notification is instead due within four hours of that later classification.

The intermediate report is due at the latest within 72 hours of the initial notification. An updated intermediate report is due without undue delay and in any case when regular activities have been recovered. The final report is due no later than one month after the intermediate report, or, where the entity filed an updated one, after the latest updated intermediate report.

A financial entity unable to meet one of these deadlines must tell the competent authority without undue delay and before the deadline itself lapses, explaining the reason for the delay. A deadline that falls on a weekend or a bank holiday moves to noon of the next working day.

That extension does not apply to an initial notification or an intermediate report from a credit institution, a central counterparty, a trading venue operator, or an entity identified as essential or important under the NIS2 Directive.

A competent authority may also decide that the extension does not apply to an initial notification or an intermediate report from other financial entities that are significant or have a systemic character for the financial sector at national or Union level, and it notifies its decision to the entities it identifies, the decision applying only to incidents reported after that notification.

Notifying a significant cyber threat under Article 19(2) is voluntary, made only where the financial entity itself judges the threat relevant to the financial system, service users, or clients. Where a major ICT-related incident has an impact on the financial interests of clients, Article 19(3) requires the financial entity to inform those clients without undue delay as soon as it becomes aware of the incident, describing the incident and the mitigation measures taken.

For a significant cyber threat, Article 19(3) requires the financial entity to inform a potentially affected client of protection measures it could take, where applicable. Unlike the Cyber Resilience Act's and the NIS2 Directive's own fine tiers, DORA leaves the amount of an administrative penalty for a breach of Article 19 to each Member State's own law, requiring only that the penalty be effective, proportionate, and dissuasive. DORA applies from 17 January 2025.

Commission Delegated Regulation (EU) 2025/301, which supplies the four-hour, 24-hour, 72-hour, and one-month figures above, entered into force on 12 March 2025, 54 days after DORA's own application date, closing the gap during which Article 19's reporting duty applied without a specified clock.

Article 35(1) of Commission Implementing Regulation (EU) 2024/482 requires the holder of an EUCC certificate to produce a vulnerability impact analysis report where the impact analysis shows that the vulnerability has a likely impact on the conformity of the ICT product with its certificate.

Article 35(2) requires the report to assess the impact of the vulnerability on the certified ICT product, possible risks associated with the proximity or availability of an attack, whether the vulnerability may be remedied and, where it may, possible resolutions of the vulnerability.

Article 35(3) requires the report, where applicable, to contain details about the possible means of exploitation of the vulnerability, which must be handled under appropriate security measures to protect its confidentiality and ensure, where necessary, its limited distribution. Article 35(4) requires the holder to transmit the report to the certification body or the national cybersecurity certification authority, in accordance with Article 56(8) of Regulation (EU) 2019/881, without undue delay.

Article 35(6) provides that, where the report determines that the vulnerability is not residual and that it cannot be remedied, the EUCC certificate shall be withdrawn in accordance with Article 14. Article 35(7) requires the holder to monitor any residual vulnerabilities to ensure that they cannot be exploited if the operational environment changes.

Article 39 requires the holder, upon withdrawal of a certificate, to disclose and register any publicly known and remediated vulnerability in the ICT product on the European vulnerability database established under Article 12 of Directive (EU) 2022/2555 or on the other online repositories referred to in Article 55(1), point (d), of Regulation (EU) 2019/881.

Article 37(2) provides that the information the certification body gives to the national cybersecurity certification authority shall not contain details of the means of exploitation of the vulnerability, without prejudice to the investigative powers of that authority. Article 38(1) requires the national cybersecurity certification authority to share the relevant information it receives under Article 37 with other national cybersecurity certification authorities and ENISA.

Article 29(1), point (b), gives a holder that does not comply with Article 56(8) of Regulation (EU) 2019/881 or Chapter VI a period of not more than 30 days to take remedial action. Article 29(3) provides that continued or recurring infringement of those obligations by the holder triggers the withdrawal of the certificate. Article 50 applies the Regulation from 27 February 2025.

Article 44(7) of Regulation (EU) 2025/327 requires manufacturers of EHR systems placed on the market or put into service to report any serious incident involving an EHR system to the market surveillance authorities of the Member States where the serious incident occurred and of the Member States where the EHR systems are placed on the market or put into service. The report must also include a description of the corrective action taken or envisaged by the manufacturer.

Article 44(7) sets the time for the report at immediately after the manufacturer has established a causal link between the EHR system and the serious incident or the reasonable likelihood of such a link and, in any event, not later than three days after the manufacturer becomes aware of the serious incident. The report is made without prejudice to incident notification requirements under Directive (EU) 2022/2555.

Article 44(7) lets Member States provide for users of EHR systems to report such incidents.

Article 2, point (r), defines a serious incident as any malfunction or deterioration in the characteristics or performance of an EHR system made available on the market that directly or indirectly leads, might have led or might lead to the death of a natural person or serious harm to a natural person's health, serious prejudice to a natural person's rights, or serious disruption of the management and operation of critical infrastructure in the health sector.

Article 44(10) lets the market surveillance authorities, in the event of incidents putting at risk patient safety or information security, take immediate action and require the manufacturer, its authorized representative and other economic operators to take immediate corrective action.

Article 2, point (k), defines an EHR system as any system whereby the software, or a combination of the hardware and the software of that system, allows personal electronic health data that belong to the priority categories to be stored, intermediated, exported, imported, converted, edited or viewed, and intended by the manufacturer to be used by healthcare providers when providing patient care or by patients when accessing their electronic health data.

Article 105 applies Regulation (EU) 2025/327 from 26 March 2027. Article 105 applies Articles 25, 26 and 27 from 26 March 2029 to EHR systems intended by the manufacturer to process the priority categories of personal electronic health data in Article 14(1), points (a), (b) and (c), and from 26 March 2031 to those intended to process points (d), (e) and (f).

Article 43(2) requires each Member State to designate the market surveillance authority or authorities responsible for the implementation of Chapter III. Article 99 requires Member States to lay down the rules on penalties applicable to infringements of Regulation (EU) 2025/327, which must be effective, proportionate and dissuasive.

Article 100 gives any natural or legal person that has suffered material or non-material damage as a result of an infringement the right to receive compensation in accordance with Union and national law.

Article 23 requires each Member State to ensure that an essential or important entity notifies its computer security incident response team (CSIRT), or the competent authority where applicable, of any incident that has a significant impact on the provision of its services, on a staged clock: an early warning within 24 hours of becoming aware of the significant incident, an incident notification within 72 hours of becoming aware (24 hours for a trust service provider), an intermediate report on relevant status updates when its CSIRT or competent authority asks for one, and a final report no later than one month after the incident notification, or, for an incident still ongoing at that point, a progress report then and a final report within one month of its handling.

Where appropriate, the entity must also notify, without undue delay, the recipients of its services that a significant incident is likely to adversely affect, and must communicate to service recipients potentially affected by a significant cyber threat any measures or remedies they can take. An incident is significant where it has caused or is capable of causing severe operational disruption or financial loss to the entity, or considerable material or non-material damage to another person.

For the DNS, top-level domain (TLD), cloud, data centre, content delivery network, managed service, managed security service, online marketplace, online search engine, social networking and trust service providers that Commission Implementing Regulation (EU) 2024/2690 names, Articles 3 to 14 of that Regulation specify the cases in which an incident is significant, and its recital 30 states that those criteria should be considered exhaustive, without prejudice to Article 5 of the Directive.

Article 19a(1), point (b), requires a non-qualified trust service provider to notify the supervisory body, the identifiable affected individuals, the public if it is of public interest and, where applicable, other relevant competent authorities of any security breaches or disruptions that have a significant impact on the trust service provided or on the personal data maintained in it.

The notification is due without undue delay and in any case no later than 24 hours after the provider becomes aware of the security breach or disruption.

Article 3, point (16), of Regulation (EU) No 910/2014 defines a trust service as an electronic service normally provided for remuneration which consists of any of the listed activities, the first being the issuance of certificates for electronic signatures, certificates for electronic seals, certificates for website authentication or certificates for the provision of other trust services.

Qualified trust service providers carry the parallel duty in Article 24(2), point (fb), of Regulation (EU) No 910/2014. Article 2(2), point (a)(ii), of Directive (EU) 2022/2555 applies that Directive to entities of a type referred to in Annex I or II, whatever their size, where their services are provided by trust service providers. Article 3(2) of that Directive treats an entity of a type referred to in Annex I or II that does not qualify as an essential entity as an important entity.

Article 13(1) gives any natural or legal person who has suffered material or non-material damage as a result of an infringement of the Regulation by a trust service provider the right to seek compensation in accordance with Union and national law. The burden of proving the intention or negligence of a non-qualified trust service provider lies with the person claiming the damage.

Article 16(2) requires Member States to subject infringements by qualified and non-qualified trust service providers to administrative fines of a maximum of at least EUR 5,000,000 for a natural person or, for a legal person, EUR 5,000,000 or 1 percent of the total worldwide annual turnover, whichever is higher. Regulation (EU) 2024/1183 enters into force on the twentieth day following its publication in the Official Journal of the European Union.

Annex I, point 26, lists making persistent and unwanted solicitations by telephone, fax, e-mail or other remote media, except in circumstances and to the extent justified under national law to enforce a contractual obligation. Article 5(5) provides that Annex I contains the list of commercial practices which shall in all circumstances be regarded as unfair, and that the same single list applies in all Member States.

Point 26 states that it is without prejudice to Article 10 of Directive 97/7/EC and to Directives 95/46/EC and 2002/58/EC. Article 3(1) applies the Directive to unfair business-to-consumer commercial practices, as laid down in Article 5, before, during and after a commercial transaction in relation to a product.

Article 2, point (b), defines a trader as any natural or legal person acting for purposes relating to a trade, business, craft or profession in commercial practices covered by the Directive, and anyone acting in the name of or on behalf of a trader. Article 3(4) provides that, in the case of conflict between the Directive and other Community rules regulating specific aspects of unfair commercial practices, the latter prevail and apply to those specific aspects.

Article 13(1), as replaced by Directive (EU) 2019/2161, requires Member States to lay down the rules on penalties applicable to infringements of the national provisions adopted pursuant to the Directive, and the penalties must be effective, proportionate and dissuasive.

Article 13(3), as replaced by Directive (EU) 2019/2161, requires Member States to ensure that penalties imposed in accordance with Article 21 of Regulation (EU) 2017/2394 include the possibility of fines whose maximum amount is at least 4 % of the trader's annual turnover in the Member State or Member States concerned.

Article 11a(1), inserted by Directive (EU) 2019/2161, provides that consumers harmed by unfair commercial practices have access to proportionate and effective remedies, including compensation for damage suffered by the consumer and, where relevant, a price reduction or the termination of the contract.

Article 6 requires Member States to ensure that commercial communications which are part of, or constitute, an information society service are clearly identifiable as such and that the natural or legal person on whose behalf the commercial communication is made is clearly identifiable.

Article 6 also requires promotional offers and promotional competitions or games, where permitted in the Member State where the service provider is established, to be clearly identifiable as such, with the conditions for qualifying or participating easily accessible and presented clearly and unambiguously.

Article 2, point (f), defines a commercial communication as any form of communication designed to promote, directly or indirectly, the goods, services or image of a company, organisation or person pursuing a commercial, industrial or craft activity or exercising a regulated profession. Article 2, point (b), defines a service provider as any natural or legal person providing an information society service.

Article 7(1) requires Member States which permit unsolicited commercial communication by electronic mail to ensure that such a communication by a service provider established in their territory is identifiable clearly and unambiguously as such as soon as the recipient receives it.

Article 7(2) requires Member States to take measures to ensure that service providers undertaking unsolicited commercial communications by electronic mail consult regularly and respect the opt-out registers in which natural persons not wishing to receive such commercial communications can register themselves.

Recital 30 states that the question of consent by the recipient of certain forms of unsolicited commercial communications is not addressed by the Directive but has already been addressed, in particular, by Directive 97/7/EC and by Directive 97/66/EC. Recital 31 places the opt-out register duty on Member States which allow the sending of unsolicited commercial communications by electronic mail without prior consent of the recipient.

Article 19 of Directive 2002/58/EC repeals Directive 97/66/EC and provides that references made to the repealed Directive are construed as being made to Directive 2002/58/EC. Article 13(1) of Directive 2002/58/EC allows direct marketing by electronic mail only in respect of subscribers or users who have given their prior consent. Article 13(4) of Directive 2002/58/EC prohibits direct-marketing electronic mail that contravenes Article 6 of Directive 2000/31/EC.

Article 20 requires Member States to determine the sanctions applicable to infringements of the national provisions adopted pursuant to the Directive, and the sanctions must be effective, proportionate and dissuasive.

Article 13 requires prior consent before using an automatic calling machine, a fax machine, or electronic mail (a category the Directive's own Article 2(h) definition frames broadly enough to reach a text message) to send direct marketing to a subscriber or user.

A seller that obtained a customer's electronic contact details in the context of a sale, in accordance with Directive 95/46/EC, may market its own similar products or services to that customer without fresh consent if the customer was clearly offered a free, easy way to object at collection and with every message, unless the customer initially refused. For unsolicited direct marketing by any other means, each Member State chooses whether to require consent or only to honour an objection.

Those consent and national-choice rules apply to subscribers who are natural persons; for other subscribers, such as companies, Member States need only ensure their legitimate interests are sufficiently protected.

For direct-marketing electronic mail, disguising or concealing the sender's identity, sending a message that itself contravenes e-Commerce Directive Article 6, omitting a valid address to which the recipient can send a request that the messages cease, or encouraging the recipient to visit a website that contravenes that Article is prohibited outright.

An affected natural or legal person, including a competing electronic communications provider, may bring its own legal proceedings over an infringement.

Article 5(3), as rewritten by Directive 2009/136/EC, requires that storing information, or gaining access to information already stored, in a subscriber's or user's terminal equipment is allowed only where the subscriber or user has given consent after being provided clear and comprehensive information about the purposes of the processing, with an exemption for storage or access that is strictly technical to carry a communication or strictly necessary for an information-society service the user explicitly requested.

The Court of Justice held in Planet49 (C-673/17) that a pre-ticked consent checkbox the user must deselect to refuse does not satisfy this Article, that the rule applies whether or not the stored or accessed information is personal data, and that the information a service provider must give before consent includes the duration cookies will operate and whether third parties can access them.

Article 16a(3), second sentence, inserted into Directive 2011/83/EU by Article 1, point (4), of Directive (EU) 2023/2673, requires the trader, when a call is being recorded or might be recorded, also to notify the consumer that this is the case. Unlike the first sentence of Article 16a(3), which names the call initiated by the trader, the second sentence names a call that is being recorded or might be recorded without saying who initiated it.

Article 3(1b), inserted by the same Directive, applies Articles 16a to 16e of Directive 2011/83/EU to distance contracts concluded between a trader and a consumer for the supply of financial services. Article 2, point (2), of Directive 2011/83/EU defines a trader as any natural or legal person, irrespective of whether privately or publicly owned, who is acting for purposes relating to a trade, business, craft or profession.

Member States apply the measures transposing Directive (EU) 2023/2673 from 19 June 2026. Article 24(6), inserted by Directive (EU) 2023/2673, requires Member States to ensure that penalties imposed in accordance with Article 21 of Regulation (EU) 2017/2394 for infringements of the measures adopted under Article 3(1b) include the possibility of fines through administrative procedures or legal proceedings.

Article 68(9) of Regulation (EU) 2023/1114 requires crypto-asset service providers to arrange for records to be kept of all crypto-asset services, activities, orders, and transactions undertaken by them. The records are provided to clients upon request and are kept for five years and, where requested by the competent authority before five years have elapsed, for up to seven years.

Article 68(10) of that Regulation provides for regulatory technical standards that further specify the records to be kept of all crypto-asset services, activities, orders and transactions undertaken.

Article 3(1), point (15), of that Regulation defines a crypto-asset service provider as a legal person or other undertaking whose occupation or business is the provision of one or more crypto-asset services to clients on a professional basis, and that is allowed to provide crypto-asset services in accordance with Article 59.

Article 2(2) of Commission Delegated Regulation (EU) 2025/1140 requires crypto-asset service providers to keep the records listed in Section 1 of its Annex, depending upon the nature of their services and activities.

The Annex lists, under communication with clients, records of telephone conversations or electronic communications relating to transactions or to the reception, transmission and execution of client orders, including where such conversations or communications do not result in the conclusion of a transaction or in the provision of the services of reception and transmission of orders or execution of order.

Article 2(1) requires the records to be retained in a medium that lets the competent authority access them readily, ascertain any corrections and the contents before them, and that does not allow the records to be manipulated or altered.

Article 111(1) of Regulation (EU) 2023/1114 requires Member States to provide for competent authorities to have the power to take administrative penalties and other administrative measures for infringements of Articles 65 to 83, which include Article 68, and lets Member States decline to lay down administrative penalties for infringements already subject to criminal penalties in their national law by 30 June 2024. Regulation (EU) 2023/1114 applies from 30 December 2024.

Article 18 of the Delegated Regulation provides that it enters into force on the twentieth day following that of its publication in the Official Journal of the European Union.

Article 16(7) of Directive 2014/65/EU requires the records of an investment firm to include the recording of telephone conversations or electronic communications relating to, at least, transactions concluded when dealing on own account and the provision of client order services that relate to the reception, transmission and execution of client orders.

Those telephone conversations and electronic communications include the ones intended to result in such transactions or services, even if they do not result in them. An investment firm must take all reasonable steps to record relevant telephone conversations and electronic communications made with, sent from or received by equipment the firm provides to an employee or contractor, or whose use by an employee or contractor the firm has accepted or permitted.

The firm must notify new and existing clients that telephone communications or conversations between the firm and its clients that result or may result in transactions will be recorded, and the notification may be made once, before the provision of investment services.

The firm may not provide, by telephone, investment services and activities relating to the reception, transmission and execution of client orders to a client who has not been notified in advance about the recording of the client's telephone communications or conversations. The records are provided to the client involved upon request and are kept for five years and, where requested by the competent authority, for up to seven years.

Article 76(1) of Commission Delegated Regulation (EU) 2017/565 requires an investment firm to establish, implement and maintain an effective written policy on recording telephone conversations and electronic communications, appropriate to the size and organization of the firm and the nature, scale and complexity of its business.

Article 76(8) of that Delegated Regulation requires the firm to inform the client, before providing services relating to the reception, transmission and execution of orders, that conversations and communications are being recorded and that a copy of the recording will be available on request for five years and, where requested by the competent authority, for up to seven years.

Article 76(9) requires the firm to record in a durable medium all relevant information related to relevant face-to-face conversations with clients, including at least the date and time, the location, the attendees, the initiator and relevant information about the client order. Article 76(10) requires records to be stored in a durable medium that allows them to be replayed or copied and to be retained in a format that does not allow the original record to be altered or deleted.

Article 4(1), point (1), of Directive 2014/65/EU defines an investment firm as any legal person whose regular occupation or business is the provision of one or more investment services to third parties and/or the performance of one or more investment activities on a professional basis. Article 93(1) of Directive 2014/65/EU, as originally adopted, required Member States to apply the measures transposing it from 3 January 2017.

Article 1, point (7), of Directive (EU) 2016/1034 replaced the date 3 January 2017 in Article 93(1) of Directive 2014/65/EU with 3 January 2018. Article 91 of the Delegated Regulation applies that Regulation from the date that appears first in the second subparagraph of Article 93(1) of Directive 2014/65/EU.

Article 70(1) of Directive 2014/65/EU requires Member States to ensure that their competent authorities may impose administrative sanctions and measures that are effective, proportionate and dissuasive for infringements of the Directive. Article 70(3), point (a)(iv), lists Article 16(1) to (11) among the provisions whose infringement Member States must regard as an infringement of the Directive.

Regulation (EU) 2026/1881 lays down temporary and strictly limited rules derogating from certain obligations laid down in Directive 2002/58/EC, with the sole objective of enabling providers of certain number-independent interpersonal communications services to use specific technologies to detect online child sexual abuse on their services and report it and to remove online child sexual abuse material from their services.

Article 2, point (1), defines a number-independent interpersonal communications service by reference to Article 2, point (7), of Directive (EU) 2018/1972. Article 3(1) provides that Article 5(1) and Article 6(1) of Directive 2002/58/EC do not apply to the confidentiality of communications involving the processing by providers of personal and other data in connection with the provision of number-independent interpersonal communications services, provided that the conditions it lists are met.

Among those conditions, the processing must be strictly necessary for the use of specific technology for the sole purpose of detecting and removing online child sexual abuse material and reporting it to law enforcement authorities and to organizations acting in the public interest against child sexual abuse, and of detecting solicitation of children and reporting it, and must not be applied to interpersonal communications to which end-to-end encryption is, has been or will be applied.

Article 1(2) provides that the Regulation does not apply to the scanning of audio communications. Article 1(3) provides that the Regulation does not apply to interpersonal communications to which end-to-end encryption is, has been or will be applied. Article 3(1), point (c), requires a prior data protection impact assessment and a prior consultation procedure for any specific technology used for those purposes.

Until 1 April 2027, the condition in Article 3(1), point (c), does not apply to a provider that was using a specific technology before 31 July 2026 without having completed a prior consultation procedure, starts a prior consultation procedure before 1 September 2026 and duly cooperates with the competent supervisory authority.

Article 3(1), point (g)(v), requires providers to inform users in a clear, prominent and comprehensible way that they have invoked the derogation, of the logic behind the measures they have taken and of the impact on the confidentiality of users' communications.

Article 3(1), point (g)(vii), requires providers to publish and submit to the competent supervisory authority and to the Commission, by 1 February 2027 and by 31 January every year thereafter, a report on the processing of personal data under the Regulation. Article 3(1), point (i), requires the data to be stored no longer than strictly necessary for the relevant purposes and, in any event, no longer than 12 months from the date of the identification of the suspected online child sexual abuse.

Article 7(1) requires providers to communicate to the Commission, by 1 September 2026, a list of the names of organizations acting in the public interest against child sexual abuse to which they report online child sexual abuse under the Regulation. Article 5 gives users the right to an effective judicial remedy where they consider that their rights have been infringed as a result of the processing of personal and other data for those purposes.

Article 6 provides that the supervisory authorities designated pursuant to Chapter VI, Section 1, of Regulation (EU) 2016/679 monitor processing falling within the scope of the Regulation. Article 11 provides that the Regulation enters into force on the third day following that of its publication in the Official Journal of the European Union and applies until 3 April 2028.

Recital 12 records that Regulation (EU) 2021/1232 has expired because the co-legislators were not able to reach an agreement by 3 April 2026 on the Commission's proposal to extend it.

Article 18(2) of Directive (EU) 2019/1937 gives legal entities in the private and public sector and competent authorities, where a recorded telephone line or another recorded voice messaging system is used for reporting and subject to the consent of the reporting person, the right to document the oral reporting by making a recording of the conversation in a durable and retrievable form or through a complete and accurate transcript prepared by the staff members responsible for handling the report.

Those legal entities and competent authorities must offer the reporting person the opportunity to check, rectify and agree the transcript of the call by signing it. Where a person requests a meeting for reporting purposes under Articles 9(2) and 12(2), Article 18(4) requires those legal entities and competent authorities to ensure, subject to the consent of the reporting person, that complete and accurate records of the meeting are kept in a durable and retrievable form.

Those legal entities and competent authorities have the right to document the meeting by making a recording of the conversation in a durable and retrievable form or through accurate minutes of the meeting prepared by the staff members responsible for handling the report. Those legal entities and competent authorities must offer the reporting person the opportunity to check, rectify and agree the minutes of the meeting by signing them.

Article 9(2) requires the internal reporting channels to enable reporting in writing or orally, or both, with oral reporting possible by telephone or through other voice messaging systems and, upon request by the reporting person, by means of a physical meeting within a reasonable timeframe. Article 8(3) applies the obligation to establish internal reporting channels to legal entities in the private sector with 50 or more workers.

Article 8(4) provides that the threshold in Article 8(3) does not apply to the entities falling within the scope of the Union acts referred to in Parts I.B and II of the Annex. Article 8(9) applies the obligation to all legal entities in the public sector, including any entity owned or controlled by such entities. Member States may exempt municipalities with fewer than 10,000 inhabitants or fewer than 50 workers, or other public-sector entities with fewer than 50 workers, from that obligation.

Article 11(1) requires Member States to designate the authorities competent to receive, give feedback and follow up on reports. Article 26(1) required Member States to bring into force the measures necessary to comply with the Directive by 17 December 2021. Article 26(2) required Member States to bring into force, by 17 December 2023, the measures for the obligation to establish internal reporting channels under Article 8(3) as regards legal entities in the private sector with 50 to 249 workers.

Article 23(1) requires Member States to provide for effective, proportionate and dissuasive penalties applicable to natural or legal persons that hinder or attempt to hinder reporting, retaliate against reporting persons, bring vexatious proceedings against them, or breach the duty of maintaining the confidentiality of the identity of reporting persons.

Article 5(1) requires Member States to prohibit listening to, tapping, storing, or otherwise intercepting or surveilling a communication and its related traffic data by anyone other than the users, without the users' consent, except where legally authorised under Article 15(1), which lets a Member State restrict that confidentiality by legislation when the restriction is a necessary, appropriate and proportionate measure to safeguard national security, defence or public security, or for the prevention, investigation, detection and prosecution of criminal offences or of unauthorised use of the electronic communication system.

Article 5(2) leaves untouched any legally authorised recording made in the course of lawful business practice to provide evidence of a commercial transaction or of any other business communication; the Directive's own recitals expect the parties to be told before such a recording is made, though that expectation is not stated as an operative duty of the Article itself, and whether a given recording is legally authorised, and on what further conditions, is for each Member State's own law.

Article 15(1) lets Member States adopt legislative measures to restrict the scope of the rights and obligations in Article 5, Article 6, Article 8(1) to (4) and Article 9 of the Directive.

A restriction is permitted when it constitutes a necessary, appropriate and proportionate measure within a democratic society to safeguard national security, defence or public security, or for the prevention, investigation, detection and prosecution of criminal offences or of unauthorised use of the electronic communication system. To this end, Member States may adopt legislative measures providing for the retention of data for a limited period justified on those grounds.

All such measures must be in accordance with the general principles of Community law, including those referred to in Article 6(1) and (2) of the Treaty on European Union.

Article 16a(3), first sentence, inserted into Directive 2011/83/EU by Article 1, point (4), of Directive (EU) 2023/2673, requires that, in the case of voice telephony communications, the identity of the trader and the commercial purpose of the call initiated by the trader are made explicitly clear at the beginning of any call with the consumer.

Article 3(1b), inserted by the same Directive, applies Articles 16a to 16e of Directive 2011/83/EU to distance contracts concluded between a trader and a consumer for the supply of financial services. Article 2, point (2), of Directive 2011/83/EU defines a trader as any natural or legal person, irrespective of whether privately or publicly owned, who is acting for purposes relating to a trade, business, craft or profession.

Member States apply the measures transposing Directive (EU) 2023/2673 from 19 June 2026. Article 24(6), inserted by Directive (EU) 2023/2673, requires Member States to ensure that penalties imposed in accordance with Article 21 of Regulation (EU) 2017/2394 for infringements of the measures adopted under Article 3(1b) include the possibility of fines through administrative procedures or legal proceedings.

Article 10 of Directive 2002/65/EC required the consumer's prior consent to a supplier's use of automated calling systems without human intervention (automatic calling machines) and fax machines. Article 3 of Directive (EU) 2023/2673 repeals Directive 2002/65/EC with effect from 19 June 2026. The correlation table in the Annex to Directive (EU) 2023/2673 shows no provision of Directive 2011/83/EU, as amended, corresponding to Article 10 of Directive 2002/65/EC.

Article 8(5) requires a trader who makes a telephone call to a consumer with a view to concluding a distance contract to disclose, at the beginning of the conversation, the trader's identity, the identity of any person on whose behalf the call is made, and the commercial purpose of the call.

Article 8(6) lets a Member State provide that, where a distance contract is to be concluded by telephone, the trader has to confirm the offer to the consumer, who is bound only once the consumer has signed the offer or has sent written consent, and that such confirmations are made on a durable medium.

Article 2 defines a trader as any natural or legal person, irrespective of whether privately or publicly owned, who is acting for purposes relating to a trade, business, craft or profession, and a consumer as a natural person acting for purposes outside a trade, business, craft or profession.

Article 2, point (7), defines a distance contract as a contract concluded between the trader and the consumer under an organised distance sales or service-provision scheme, without the simultaneous physical presence of the trader and the consumer, with the exclusive use of one or more means of distance communication up to and including the time at which the contract is concluded.

Article 3(3) lists contracts to which the Directive does not apply, among them contracts for social services, for healthcare and for gambling. For a distance contract for the supply of financial services, Article 3(1b), inserted by Directive (EU) 2023/2673, applies only the Articles it lists, which include Article 8(6) and do not include Article 8(5).

Article 24(1), as replaced by Directive (EU) 2019/2161, requires Member States to lay down the rules on penalties applicable to infringements of the national provisions adopted pursuant to the Directive, and the penalties must be effective, proportionate and dissuasive.

Article 24(3), as replaced by Directive (EU) 2019/2161, requires Member States to ensure that penalties imposed in accordance with Article 21 of Regulation (EU) 2017/2394 include the possibility of fines whose maximum amount is at least 4 % of the trader's annual turnover in the Member State or Member States concerned.

Article 115(1) requires Member States to ensure that competent authorities, in coordination where relevant with national regulatory authorities, are able to require all providers of internet access services or publicly available number-based interpersonal communications services to make available free of charge all or part of the additional facilities listed in Part B of Annex VI, subject to technical feasibility, as well as all or part of those listed in Part A of Annex VI.

Annex VI, Part B, point (a), lists calling-line identification, namely that the calling party's number is presented to the called party prior to the call being established, among the facilities referred to in Article 115.

The facility is to be provided in accordance with the relevant law on protection of personal data and privacy, in particular Directive 2002/58/EC, and operators are to provide, to the extent technically feasible, data and signals to facilitate the offering of calling-line identity and tone dialling across Member State boundaries.

Article 115(3) lets a Member State waive the application of paragraph 1 in all or part of its territory if it considers, after taking into account the views of interested parties, that there is sufficient access to those facilities.

Article 2, point (6), defines a number-based interpersonal communications service as an interpersonal communications service which connects with publicly assigned numbering resources, or which enables communication with a number or numbers in national or international numbering plans.

Article 29(1) requires Member States to lay down rules on penalties, including, where necessary, fines and non-criminal predetermined or periodic penalties, applicable to infringements of the national provisions adopted pursuant to the Directive.

Articles 4 to 6 of the Digital Services Act exempt a provider from liability for information it transmits (mere conduit), stores temporarily to make its onward transmission more efficient or more secure (caching), or stores at the request of a recipient of the service (hosting), on the conditions each Article sets.

The hosting exemption in Article 6 holds while the provider has no actual knowledge of illegal activity or illegal content and, as regards claims for damages, is not aware of facts or circumstances from which it is apparent, or, on obtaining that knowledge or awareness, acts expeditiously to remove or disable access to the illegal content.

Article 7 provides that a provider is not deemed ineligible for the exemptions from liability in Articles 4, 5 and 6 solely because, in good faith and in a diligent manner, it carries out voluntary own-initiative investigations, takes other measures to detect, identify and remove illegal content or disable access to it, or takes the necessary measures to comply with the requirements of Union law and of national law in compliance with Union law, including the requirements set out in the Regulation.

Article 8 bars imposing a general obligation to monitor the information that providers transmit or store, or actively to seek facts or circumstances indicating illegal activity.

Article 9 requires a provider that receives an order to act against specific items of illegal content, issued by the relevant national judicial or administrative authority on the basis of applicable Union or national law in compliance with Union law, to inform the issuing authority without undue delay of any effect given to the order.

Article 10 requires a provider that receives an order to provide specific information about specific individual recipients of the service, issued by the relevant national judicial or administrative authority on the basis of applicable Union or national law in compliance with Union law, to inform the issuing authority without undue delay of its receipt and of the effect given to it.

Article 89 of the Regulation deleted Articles 12 to 15 of Directive 2000/31/EC and construes references to them as references to Articles 4, 5, 6 and 8. The Regulation applies to intermediary services offered to recipients that have their place of establishment or are located in the Union, irrespective of where the providers have their place of establishment.

Article 2(1) applies the Regulation to intra-Union infringements, widespread infringements and widespread infringements with a Union dimension, even if those infringements have ceased before enforcement starts or is completed. Article 3, point (1), defines Union laws that protect consumers' interests as the Regulations and the Directives, as transposed into the internal legal order of the Member States, that are listed in the Annex.

Article 9(1) requires each competent authority to have the minimum investigation and enforcement powers set out in Article 9(3), (4), (6) and (7) that are necessary for the application of the Regulation. Article 9(2) lets Member States decide not to confer all the powers on every competent authority, provided that each of those powers can be exercised effectively and as necessary in relation to any infringement covered by the Regulation.

Article 9(4), point (g), gives a competent authority, where no other effective means are available to bring about the cessation or the prohibition of the infringement and in order to avoid the risk of serious harm to the collective interests of consumers, the power to remove content or to restrict access to an online interface or to order the explicit display of a warning to consumers when they access an online interface, the power to order a hosting service provider to remove, disable or restrict access to an online interface, and, where appropriate, the power to order domain registries or registrars to delete a fully qualified domain name and to allow the competent authority concerned to register it, including by requesting a third party or other public authority to implement such measures.

Article 10(1) provides that the powers in Article 9 are exercised directly by competent authorities, by recourse to other competent authorities or other public authorities where appropriate, by instructing designated bodies, or by application to courts competent to grant the necessary decision.

Article 10(2) requires the exercise of the powers to be proportionate and to comply with Union and national law, including applicable procedural safeguards and the principles of the Charter of Fundamental Rights of the European Union.

The Directive binds the Member States, which had to bring into force the laws, regulations and administrative provisions necessary to comply with it by 7 June 2021.

Article 2(6) defines an online content-sharing service provider as a provider of an information society service of which the main or one of the main purposes is to store and give the public access to a large amount of copyright-protected works or other protected subject matter uploaded by its users, which it organizes and promotes for profit-making purposes.

The definition excludes not-for-profit online encyclopedias, not-for-profit educational and scientific repositories, open source software-developing and sharing platforms, providers of electronic communications services, online marketplaces, business-to-business cloud services and cloud services that allow users to upload content for their own use.

Article 17(1) provides that an online content-sharing service provider performs an act of communication to the public or an act of making available to the public when it gives the public access to copyright-protected works or other protected subject matter uploaded by its users.

Article 17(1) therefore requires such a provider to obtain an authorization from the rightholders, for instance by concluding a licensing agreement, in order to communicate to the public or make available to the public works or other subject matter.

Article 17(2) provides that an authorization obtained by such a provider also covers acts carried out by users of the services falling within the scope of Article 3 of Directive 2001/29/EC when they are not acting on a commercial basis or where their activity does not generate significant revenues.

Article 17(3) provides that the limitation of liability established in Article 14(1) of Directive 2000/31/EC does not apply to the situations covered by Article 17, without affecting its possible application to those service providers for purposes falling outside the scope of the Directive. Article 89(2) of Regulation (EU) 2022/2065 construes references to Articles 12 to 15 of Directive 2000/31/EC as references to Articles 4, 5, 6 and 8 of that Regulation, respectively.

Article 17(4) provides that, if no authorization is granted, an online content-sharing service provider is liable for unauthorized acts of communication to the public, including making available to the public, of copyright-protected works and other subject matter, unless it demonstrates the matters in its points (a) to (c).

Points (a) and (b) require best efforts to obtain an authorization and, in accordance with high industry standards of professional diligence, best efforts to ensure the unavailability of specific works and other subject matter for which the rightholders have provided the service providers with the relevant and necessary information.

Point (c) requires the provider, in any event, to act expeditiously, upon receiving a sufficiently substantiated notice from the rightholders, to disable access to, or to remove from its website, the notified works or other subject matter, and to make best efforts to prevent their future uploads in accordance with point (b).

Article 8(2) of Directive 2001/29/EC requires each Member State to take the measures necessary to ensure that rightholders whose interests are affected by an infringing activity carried out on its territory can bring an action for damages and/or apply for an injunction.

Article 17(5) provides that, in determining whether the provider has complied with Article 17(4) and in light of the principle of proportionality, the type, audience and size of the service, the type of works uploaded by its users, and the availability and cost of suitable and effective means are among the elements taken into account.

Article 17(6) applies a lighter regime to new online content-sharing service providers the services of which have been available to the public in the Union for less than three years and which have an annual turnover below a ceiling the paragraph states in euros.

For those providers the conditions under Article 17(4) are limited to compliance with point (a) and to acting expeditiously, upon receiving a sufficiently substantiated notice, to disable access to the notified works or other subject matter or to remove them from their websites.

Where the average number of monthly unique visitors of such a provider, calculated on the basis of the previous calendar year, exceeds the level the paragraph states, it must also demonstrate that it has made best efforts to prevent further uploads of the notified works and other subject matter for which the rightholders have provided relevant and necessary information.

Article 16 requires a provider of hosting services to put mechanisms in place that allow any individual or entity to notify it of specific items of information on its service that they consider to be illegal content. The mechanisms must be easy to access and user-friendly and must allow notices to be submitted exclusively by electronic means.

A notice that allows a diligent provider of hosting services to identify the illegality without a detailed legal examination is considered to give rise to actual knowledge or awareness of that item for the purposes of the hosting exemption in Article 6. Where a notice carries the notifier's electronic contact information, the provider must send a confirmation of receipt without undue delay.

The provider must also notify the notifier, without undue delay, of its decision on the information and of the possibilities for redress. Notices must be processed, and decisions taken, in a timely, diligent, non-arbitrary and objective manner.

Article 17 separately requires a provider of hosting services to give an affected recipient a clear and specific statement of reasons for restrictions, including removal or demotion of content, imposed on the ground that the information is illegal content or incompatible with the provider's terms and conditions.

Article 3, point (54), defines a provider of an online marketplace as a provider of an intermediary service using an online interface which allows customers to conclude distance contracts with economic operators for the sale of products covered by delegated acts adopted pursuant to Article 4. The heading of Article 35 reads Obligations of providers of online marketplaces and online search engines.

Article 35(1) provides that the general obligations in Articles 11 and 30 of Regulation (EU) 2022/2065 apply for the purposes of the Regulation. Article 35(1) also requires providers of online marketplaces to cooperate with the market surveillance authorities, at the request of those authorities and in specific cases, to facilitate any action taken to eliminate or, if that is not possible, to mitigate the non-compliance of a product that is or was offered for sale online through their services.

Article 35(2) requires Member States to confer on their market surveillance authorities, for all products covered by a relevant delegated act adopted pursuant to Article 4, the power to order a provider of an online marketplace to act against one or more specific items of content referring to a non-compliant product, including by removing them, treats that content as illegal content within the meaning of Article 3, point (h), of Regulation (EU) 2022/2065, and provides that the authorities may issue such orders in accordance with Article 9 of that Regulation.

Article 35(3) requires providers of online marketplaces to establish a single contact point for direct communication with Member States' market surveillance authorities in relation to compliance with the Regulation, which may be the contact point referred to in Article 22(1) of Regulation (EU) 2023/988 or Article 11(1) of Regulation (EU) 2022/2065.

Article 74 requires Member States to lay down the rules on penalties applicable to infringements of the Regulation, and provides that they must at least be able to impose fines and a time-limited exclusion from public procurement procedures. Article 80 provides that the Regulation enters into force on the twentieth day following that of its publication in the Official Journal.

Article 3, point (14), defines a provider of an online marketplace as a provider of an intermediary service using an online interface which allows consumers to conclude distance contracts with traders for the sale of products. Article 2(2) provides that the Regulation does not apply to medicinal products, food, feed, living plants and animals, animal by-products, plant protection products, certain equipment on which consumers ride or travel, certain aircraft or antiques.

Article 22(1) and (2) require a provider of an online marketplace to designate a single point of contact for direct electronic communication with the market surveillance authorities of the Member States on product safety issues, to register with the Safety Gate Portal and indicate that contact point there, and to designate a single point of contact enabling consumers to communicate directly and rapidly with it on product safety issues.

Article 22(3) requires a provider of an online marketplace to have internal processes for product safety in place in order to comply without undue delay with the relevant requirements of the Regulation.

Article 22(4) requires Member States to confer on their market surveillance authorities the power to issue an order requiring a provider of an online marketplace to remove content referring to an offer of a dangerous product from its online interface, to disable access to it or to display an explicit warning, and requires the provider to act without undue delay and in any event within two working days from receipt of the order and to inform the issuing authority of the effect given by electronic means.

Article 22(5) allows an order under Article 22(4) to require the provider to remove, disable access to or warn on all identical content referring to an offer of the dangerous product for the prescribed period, provided that the search is limited to the information identified in the order, needs no independent assessment of that content and can be carried out in a proportionate manner by reliable automated tools.

Article 22(6) requires a provider of an online marketplace to take into account the regular information on dangerous products that market surveillance authorities notify through the Safety Gate Portal when it applies voluntary measures to detect, identify, remove or disable access to offers of dangerous products, and to inform the notifying authority of any action taken.

Article 22(7) requires a provider of an online marketplace, for the purpose of compliance with Article 31(3) of Regulation (EU) 2022/2065 as regards product safety, to use at least the Safety Gate Portal. Article 22(8) requires a provider of an online marketplace to process notices related to product safety issues, received in accordance with Article 16 of Regulation (EU) 2022/2065, without undue delay and in any event within three working days from receipt of the notice.

Article 22(9) requires a provider of an online marketplace to design and organize its online interface so that traders can provide, and consumers can see or easily access on the product listing, the manufacturer's name and address, the responsible person where the manufacturer is not established in the Union, information identifying the product including a picture, and any warning or safety information.

Article 22(10) requires the internal processes to include mechanisms through which traders provide that information and their self-certification committing to offer only products that comply with the Regulation, together with additional identification information in accordance with Article 30(1) of Regulation (EU) 2022/2065 where applicable.

Article 22(11) requires a provider of an online marketplace, for the purpose of compliance with Article 23 of Regulation (EU) 2022/2065, to suspend for a reasonable period of time and after a prior warning the provision of its services to traders that frequently offer products which are non-compliant with the Regulation.

Article 22(12) requires a provider of an online marketplace to cooperate with the market surveillance authorities, with traders and with relevant economic operators to facilitate any action taken to eliminate or, if that is not possible, to mitigate the risks presented by a product that is or was offered online through its services.

Article 22(12), point (a), requires it to notify directly all affected consumers who bought the relevant product through its interface of a product safety recall or safety warning of which it has actual knowledge, and to publish information on product safety recalls on its online interfaces.

Article 22(12), points (b) and (c), require it to inform the relevant economic operator of a decision to remove or disable access to content referring to an offer of a dangerous product, and to cooperate with market surveillance authorities and economic operators to ensure effective product recalls, including by abstaining from obstructing them.

Article 22(12), points (d) and (e), require it to inform the market surveillance authorities of the Member States concerned, through the Safety Business Gateway, about dangerous products offered on its interfaces of which it has actual knowledge, and to cooperate with regard to accidents notified to it, including by notifying without undue delay through the Safety Business Gateway any accident it has been informed of that resulted in a serious risk or actual damage to the health or safety of a consumer.

Article 22(12), points (f) to (i), require it to cooperate with law enforcement agencies at Union and national level, to allow market surveillance authorities access to its interfaces for their online tools, to cooperate in identifying the supply chain of dangerous products by responding to data requests, and to allow data scraping only for product safety purposes on a reasoned request of the market surveillance authorities.

Article 39 applies Directive (EU) 2020/1828 to representative actions brought against infringements by economic operators and providers of online marketplaces of provisions of the Regulation that harm, or may harm, the collective interests of consumers. Article 44 requires Member States to lay down the rules on penalties applicable to infringements of the Regulation that impose obligations on providers of online marketplaces, which must be effective, proportionate and dissuasive.

Article 14(1) requires Member States to confer on their market surveillance authorities the powers of market surveillance, investigation and enforcement necessary for the application of the Regulation and of Union harmonisation legislation.

Article 14(2) requires the authorities to exercise the powers efficiently and effectively and in accordance with the principle of proportionality, and requires the powers to be conferred and exercised in accordance with Union and national law, including the Charter of Fundamental Rights of the European Union, national principles on freedom of expression and the freedom and pluralism of the media, applicable procedural safeguards and the Union rules on data protection.

Article 14(3) allows Member States to provide for a power to be exercisable directly by the market surveillance authorities, by recourse to other public authorities, or upon application to courts competent to grant the necessary decision. Article 14(4) provides that the powers conferred on market surveillance authorities include at least the powers it lists.

Article 14(4), point (k)(i), lists among them the power, where no other effective means are available to eliminate a serious risk, to require the removal of content referring to the related products from an online interface or to require the explicit display of a warning to end users when they access an online interface.

Article 14(4), point (k)(ii), adds the power, where a request according to point (i) has not been complied with, to require information society service providers to restrict access to the online interface, including by requesting a relevant third party to implement such measures.

Article 7(2) requires information society service providers to cooperate with the market surveillance authorities, at the request of those authorities and in specific cases, to facilitate any action taken to eliminate or, if that is not possible, to mitigate the risks presented by a product that is or was offered for sale online through their services.

Article 3, point (14), defines an information society service provider as a provider of a service as defined in point (b) of Article 1(1) of Directive (EU) 2015/1535. Article 2(1) applies the Regulation to products that are subject to the Union harmonisation legislation listed in Annex I, in so far as that legislation holds no specific provisions with the same objective that regulate particular aspects of market surveillance and enforcement in a more specific manner.

Article 41(1) requires Member States to lay down the rules on penalties applicable to infringements of the Regulation and of the Union harmonisation legislation listed in Annex II that impose obligations on economic operators, and Article 41(2) requires those penalties to be effective, proportionate and dissuasive.

Article 15(1) requires political advertising publishers to have in place the necessary mechanisms to enable natural or legal persons to notify them if a particular political advertisement that they have published does not comply with the Regulation. Article 3(13) defines a political advertising publisher as a provider of political advertising service that publishes, delivers or disseminates political advertising through any medium.

Article 3(5) defines a political advertising service as a service consisting of political advertising, with the exception of an online intermediary service, as defined in Article 3, point (g), of Regulation (EU) 2022/2065, that is provided without consideration for the preparation, placement, promotion, publication, delivery or dissemination for the specific message.

Article 15(2) requires the mechanisms to be free of charge, user-friendly and easy to access, including from the transparency notice, and, where technically possible, to allow notifications to be made in electronic form.

Article 15(3) requires the mechanisms to facilitate precise and substantiated notifications, and publishers to enable and facilitate notifications that contain a substantiated explanation of why the notifier alleges that the advertisement does not comply with the Regulation, information enabling its identification, and the notifier's name and email address.

Article 15(4) requires political advertising publishers to send a confirmation of receipt of the notification to the person who submitted it without undue delay. Article 15(5) requires a political advertising publisher that is a very large online platform or a very large online search engine to examine and address notifications without undue delay in a diligent, non-arbitrary and objective manner, and to inform the notifier of the follow-up given.

Article 15(6) requires other political advertising publishers to make best efforts, without undue delay, to examine and address notifications in a diligent, non-arbitrary and objective manner and to inform the notifier, at least upon request, of the follow-up given, and micro-undertakings under Article 3(1) of Directive 2013/34/EU make best efforts to ensure their compliance with that point.

Article 15(7) requires political advertising publishers, in the last month preceding an election or a referendum, to process any notification about a political advertisement linked to it within 48 hours provided the notification can be processed completely on the basis of the information included in it, and micro, small and medium-sized undertakings make best efforts to process such notifications without undue delay.

Article 15(8) requires political advertising publishers to provide clear and user-friendly information on the possibilities for redress in respect of the political advertisement to which the notification relates and, where applicable, on the use of automated means for the processing of notifications.

Article 15(9) requires political advertising publishers to inform the sponsors or providers of political advertising services concerned, without undue delay, of any measures they take following notifications that affect the availability or the presentation of the political advertisement concerned.

Article 25(1) requires Member States to lay down rules on sanctions or other measures applicable to sponsors or providers of political advertising services for infringements of Articles 5 to 17, 20 and 21, which must be effective, proportionate and dissuasive.

Article 25(2) sets the maximum amount of the financial penalties at 6 % of the annual income or budget of the sponsor or of the provider of political advertising services, whichever is the highest, or 6 % of their annual worldwide turnover in the preceding financial year.

Article 25(5) provides that infringements of Article 15, among others, are considered particularly serious where they concern political advertising published or disseminated during the last month preceding an election or referendum and directed to citizens in the Member State in which it is being organised. Article 30(2) applies the Regulation from 10 October 2025, with Article 3 and Article 5(1) applying from the date of its entry into force.

Article 2(1) applies the Regulation to providers of online short-term rental platforms that offer services to hosts providing short-term accommodation rental services in the Union, irrespective of their place of establishment, and to hosts providing short-term accommodation rental services.

Article 3, point (5), defines an online short-term rental platform as an online platform within the meaning of Article 3, point (i), of Regulation (EU) 2022/2065 that allows guests to conclude distance contracts with hosts for the provision of short-term accommodation rental services.

Article 6(1) and (2) let competent authorities verify, at any time after a registration number has been issued, the declaration and supporting documentation a host submitted, and give them the power to ask the host to rectify incomplete or incorrect information within a reasonable period they specify.

Article 6(3) gives a competent authority, where a host fails to rectify the requested information or documentation, the power to suspend the validity of the affected registration number or numbers and to issue an order requesting online short-term rental platforms to remove, or to disable access to, any listing relating to the unit or units in question without undue delay.

Article 6(4) gives a competent authority, where it finds manifest and serious doubts about the authenticity and validity of the information or documentation a host submitted, the power to suspend the validity of the affected registration number or numbers and to issue an order requesting online short-term rental platforms to provide further information to enable verification, or to remove, or to disable access to, any listing relating to the unit or units in question without undue delay.

Article 6(5) requires a competent authority that intends to suspend or withdraw a registration number to notify the host in writing stating the reasons for that intention and to give the host the opportunity to be heard and, where appropriate, to rectify the information or documentation within a reasonable period.

Article 6(6) gives a competent authority, where a host has failed through wilful misconduct or gross negligence to rectify the information requested, or has provided unauthentic or invalid information, the power to withdraw the registration number or numbers and to issue an order requesting online short-term rental platforms to remove, or to disable access to, any listing relating to the unit or units in question without undue delay.

Article 6(7) requires an order under Article 6(3), (4), (6) and (11) to contain a statement of reasons, clear information enabling the provider of the platform to identify and locate the listing or listings concerned, such as one or more exact URLs and the identity of the competent authority, and, where available, the identity of the host and the registration number of the unit.

Article 6(11) requires Member States, where a registration procedure applies, to ensure that national law enables competent authorities to order providers of online short-term rental platforms to provide the requested information and to remove listings concerning units offered without a registration number or with an invalid registration number, or in cases involving the misuse of a registration number.

Article 15(2) makes the authorities designated by the Member State of the relevant single digital entry point competent to enforce Article 6, and Article 15(3) requires Member States to lay down rules on penalties, which must be effective, proportionate and dissuasive, applicable to infringements of Article 6 by online short-term rental platforms and, where appropriate, by hosts. Article 19 applies the Regulation from 20 May 2026.

Article 3, point (9), defines a provider of an online marketplace by reference to the definition in Article 3, point (14), of Regulation (EU) 2023/988. Article 14(1) provides that information referring to an offer of toys sold or promoted in online marketplaces intermediating between economic operators and consumers which are not in conformity with the Regulation is considered to be illegal content for the purposes of Regulation (EU) 2022/2065 and subject to the measures established in it.

Article 14(2) requires providers of online marketplaces to comply with the requirements of Articles 30 to 32 of Regulation (EU) 2022/2065 and Article 22 of Regulation (EU) 2023/988, and provides that compliance is enforced within the enforcement structures set out in those Regulations.

Article 14(3) requires providers of online marketplaces, for the purposes of Article 31(2), point (c), of Regulation (EU) 2022/2065 and in addition to the information required in Article 22(9) of Regulation (EU) 2023/988, to ensure that their online interface allows economic operators to provide the CE marking, any warning to be clearly visible to the consumer before purchase, and the data carrier or weblink through which the digital product passport is accessible.

Article 14(4) provides that a toy that does not comply with the particular safety requirements, or that complies with them but poses a risk to the health and safety of children or other persons, is considered a dangerous product for the purposes of compliance with Article 22 of Regulation (EU) 2023/988. Article 55 requires Member States to lay down the rules on penalties applicable to infringements of the Regulation, which must be effective, proportionate and dissuasive.

Article 59 applies the Regulation from 1 August 2030, except that Articles 28 to 44 and Articles 49 to 55 apply from 1 January 2026.

Article 18 requires a provider of hosting services that becomes aware of information giving rise to a suspicion that a criminal offence involving a threat to the life or safety of a person or persons has taken place, is taking place or is likely to take place to promptly inform the law enforcement or judicial authorities of the Member State or Member States concerned of its suspicion and provide all relevant information available.

Where the provider cannot identify with reasonable certainty the Member State concerned, it must inform the law enforcement authorities of the Member State in which it is established or where its legal representative resides or is established, or inform Europol, or both.

The Member State concerned is the Member State in which the offence is suspected to have taken place, to be taking place or to be likely to take place, or the Member State where the suspected offender or the victim resides or is located.

The Directive binds the Member States, which must bring into force the laws, regulations and administrative provisions necessary to comply with it by 14 June 2027. Article 5(1) requires Member States to ensure that the intentional conduct it lists is punishable as a criminal offence.

Article 5(1), point (a), covers making accessible to the public, by means of information and communication technologies, images, videos or similar material depicting sexually explicit activities or the intimate parts of a person, without that person's consent, where such conduct is likely to cause serious harm to that person.

Article 5(1), point (b), covers producing, manipulating or altering and subsequently making accessible to the public, by means of ICT, images, videos or similar material making it appear as though a person is engaged in sexually explicit activities, without that person's consent, where such conduct is likely to cause serious harm to that person. Article 7 requires Member States to ensure that the conduct it lists as cyber harassment is punishable as a criminal offence.

Article 8(1) requires Member States to ensure that intentionally inciting violence or hatred directed against a group of persons or a member of such a group, defined by reference to gender, by publicly disseminating, by means of ICT, material containing such incitement is punishable as a criminal offence.

Article 23(1) requires Member States, without prejudice to Regulation (EU) 2022/2065, to take the necessary measures to ensure that online publicly accessible material as referred to in Article 5(1), points (a) and (b), and Articles 7 and 8 is promptly removed or that access to it is disabled.

Those measures include the possibility for the competent authorities to issue binding legal orders to remove or to disable access to such material, and Member States must ensure that such orders meet, at least, the conditions set out in Article 9(2) of Regulation (EU) 2022/2065.

Article 23(2) provides that such orders are addressed to hosting service providers and that, where removal would not be feasible, the competent authorities may also address orders to disable access to the material to relevant intermediary service providers other than hosting service providers that have the technical and operational ability to take action regarding it.

Article 23(3) requires Member States to ensure that, where criminal proceedings regarding an offence under Article 5(1), point (a) or (b), Article 7 or Article 8 are terminated without leading to a finding that an offence has been committed, the orders are discharged and the addressees of the orders are informed.

Article 23(4) requires Member States to ensure that hosting service providers, other relevant intermediary service providers and content providers affected by an order have a right to an effective judicial remedy, including the right to challenge the order before the courts of the Member State of the competent authority that issued it.

Article 23(5) requires Member States to ensure that the relevant content providers affected by an order are informed, where appropriate by the hosting service providers or by any other relevant intermediary service providers concerned, of the reasons for the removal or disabling of access and of the possibility to have access to judicial redress.

Article 1(2) applies the Regulation to hosting service providers offering services in the Union, irrespective of their place of main establishment, insofar as they disseminate information to the public. Article 2(1) defines a hosting service provider as a provider of services, as defined in point (b) of Article 1 of Directive (EU) 2015/1535, consisting of the storage of information provided by and at the request of a content provider.

Article 2(7) defines terrorist content as material that incites the commission of one of the offences referred to in points (a) to (i) of Article 3(1) of Directive (EU) 2017/541, where it, directly or indirectly, such as by the glorification of terrorist acts, advocates the commission of terrorist offences, thereby causing a danger that one or more such offences may be committed; that solicits a person or a group of persons to commit or contribute to the commission of such an offence or to participate in the activities of a terrorist group; that provides instruction on the making or use of explosives, firearms or other weapons or noxious or hazardous substances, or on other specific methods or techniques for the purpose of committing or contributing to such an offence; or that constitutes a threat to commit such an offence.

Article 1(3) provides that material disseminated to the public for educational, journalistic, artistic or research purposes, or for the purposes of preventing or countering terrorism, is not considered to be terrorist content. Article 3(1) gives the competent authority of each Member State the power to issue a removal order requiring hosting service providers to remove terrorist content or to disable access to terrorist content in all Member States.

Article 3(2) requires a competent authority that has not previously issued a removal order to a hosting service provider to provide it with information on the applicable procedures and deadlines at least 12 hours before issuing the order, except in duly justified cases of emergency. Article 3(3) requires hosting service providers to remove terrorist content or disable access to it in all Member States as soon as possible and in any event within one hour of receipt of the removal order.

Article 3(4) requires competent authorities to issue removal orders using the template set out in Annex I. Article 3(6) requires the hosting service provider to inform the competent authority without undue delay, using the template set out in Annex II, of the removal or the disabling of access, indicating in particular the time of the removal or disabling.

Article 3(7) requires a hosting service provider that cannot comply with a removal order on grounds of force majeure or de facto impossibility not attributable to it to inform the competent authority without undue delay using the template set out in Annex III, and the deadline in Article 3(3) starts to run once those grounds have ceased to exist.

Article 3(8) requires a hosting service provider that cannot comply with a removal order because it contains manifest errors or does not contain sufficient information for its execution to inform the competent authority without undue delay and request the necessary clarification, and the deadline in Article 3(3) starts to run once it has received the clarification.

Article 18(1) requires Member States to lay down the rules on penalties for infringements of the Regulation by hosting service providers, limits them to infringements of listed provisions that include Article 3(3) and (6), and requires them to be effective, proportionate and dissuasive.

Article 18(3) requires Member States to ensure that a systematic or persistent failure to comply with the obligations in Article 3(3) is subject to financial penalties of up to 4 % of the hosting service provider's global turnover of the preceding business year. Article 24 provides that the Regulation applies from 7 June 2022 and is binding in its entirety and directly applicable in all Member States.

Article 1(2) applies the Regulation to hosting service providers offering services in the Union, irrespective of their place of main establishment, insofar as they disseminate information to the public. Article 2(1) defines a hosting service provider as a provider of services, as defined in point (b) of Article 1 of Directive (EU) 2015/1535, consisting of the storage of information provided by and at the request of a content provider.

Article 5(4) provides that a hosting service provider is exposed to terrorist content where the competent authority of the Member State of its main establishment, or where its legal representative resides or is established, has taken a decision, on the basis of objective factors such as the provider having received two or more final removal orders in the previous 12 months, finding that it is exposed to terrorist content, and has notified the decision to the provider.

Article 5(1) requires a hosting service provider exposed to terrorist content to include in its terms and conditions, where applicable, and apply provisions to address the misuse of its services for the dissemination to the public of terrorist content, in a diligent, proportionate and non-discriminatory manner.

Article 5(2) requires such a provider to take specific measures to protect its services against the dissemination to the public of terrorist content, and leaves the choice of specific measures with the provider. Article 5(3) requires specific measures to be effective in mitigating the level of exposure, targeted and proportionate, applied in a manner that takes full account of the rights and legitimate interest of the users, and applied in a diligent and non-discriminatory manner.

Article 5(5) requires such a provider to report to the competent authority on the specific measures it has taken and intends to take within three months of receipt of the decision and on an annual basis thereafter. That reporting obligation ceases once the competent authority has decided, upon the provider's request, that the provider is no longer exposed to terrorist content.

Article 5(6) provides that, where the competent authority considers, based on the reports and, where relevant, any other objective factors, that the specific measures taken do not comply with Article 5(2) and (3), it addresses a decision to the provider requiring it to take the necessary measures, and the provider may choose the type of specific measures to take.

Article 5(8) provides that a requirement to take specific measures entails neither a general obligation to monitor the information which hosting service providers transmit or store nor a general obligation actively to seek facts or circumstances indicating illegal activity, and does not include an obligation to use automated tools.

Article 6(1) requires hosting service providers to preserve terrorist content which has been removed or access to which has been disabled as a result of a removal order or of specific measures, with any related data removed as a consequence, where necessary for administrative or judicial review proceedings, for complaint-handling under Article 10, or for the prevention, detection, investigation and prosecution of terrorist offences.

Article 6(2) requires the content and related data to be preserved for six months from the removal or disabling, and for a further specified period on request of the competent authority or court only if and for as long as necessary for ongoing administrative or judicial review proceedings.

Article 6(3) requires hosting service providers to ensure that the preserved content and data are subject to appropriate technical and organizational safeguards, so that they are accessed and processed only for the purposes of Article 6(1) and a high level of security of the personal data concerned is ensured.

Article 7(1) requires hosting service providers to set out clearly in their terms and conditions their policy for addressing the dissemination of terrorist content, including, where appropriate, a meaningful explanation of the functioning of specific measures and, where applicable, the use of automated tools.

Article 7(2) requires a hosting service provider that has taken action to address the dissemination of terrorist content, or has been required to take action under the Regulation, in a given calendar year to make publicly available a transparency report on those actions for that year, published before 1 March of the following year.

Article 7(3) requires the transparency report to include at least the provider's measures to identify and remove or disable terrorist content and to address its reappearance, the number of items removed or disabled following removal orders or specific measures, the number and outcome of complaints and of review proceedings, and the cases in which content or access was reinstated.

Article 10(1) requires each hosting service provider to establish an effective and accessible mechanism allowing content providers whose content has been removed or access to which has been disabled as a result of specific measures under Article 5 to submit a complaint requesting reinstatement.

Article 10(2) requires each hosting service provider to examine all complaints expeditiously, reinstate the content or access without undue delay where the removal or disabling was unjustified, inform the complainant of the outcome within two weeks of receipt, and provide the reasons where the complaint is rejected.

Article 18(1) requires Member States to lay down the rules on penalties for infringements of the Regulation by hosting service providers, limits them to infringements of listed provisions that include Article 5(1), (2), (3), (5) and (6) and Articles 6, 7 and 10, and requires them to be effective, proportionate and dissuasive. Article 24 provides that the Regulation applies from 7 June 2022 and is binding in its entirety and directly applicable in all Member States.

The Directive binds the Member States, which had to bring into force the laws, regulations and administrative provisions necessary to comply with it by 7 June 2021.

Article 2(6) defines an online content-sharing service provider as a provider of an information society service of which the main or one of the main purposes is to store and give the public access to a large amount of copyright-protected works or other protected subject matter uploaded by its users, which it organizes and promotes for profit-making purposes.

The definition excludes not-for-profit online encyclopedias, not-for-profit educational and scientific repositories, open source software-developing and sharing platforms, providers of electronic communications services, online marketplaces, business-to-business cloud services and cloud services that allow users to upload content for their own use. Article 17(8) provides that the application of Article 17 is not to lead to any general monitoring obligation.

Article 17(8) requires Member States to provide that online content-sharing service providers give rightholders, at their request, adequate information on the functioning of their practices with regard to the cooperation referred to in paragraph 4 and, where licensing agreements are concluded, information on the use of content covered by the agreements.

Article 17(9) requires Member States to provide that online content-sharing service providers put in place an effective and expeditious complaint and redress mechanism that is available to users in disputes over the disabling of access to, or the removal of, works or other subject matter they uploaded. Complaints under that mechanism must be processed without undue delay, and decisions to disable access to or remove uploaded content are subject to human review.

Where rightholders request to have access to their specific works or other subject matter disabled or removed, they must duly justify the reasons for their requests. Article 17(9) requires online content-sharing service providers to inform their users in their terms and conditions that they can use works and other subject matter under exceptions or limitations to copyright and related rights provided for in Union law.

Article 17(9) also requires Member States to ensure that out-of-court redress mechanisms are available for the settlement of disputes and that users have access to a court or another relevant judicial authority to assert the use of an exception or limitation.

The Digital Markets Act applies to core platform services that a gatekeeper provides to business users established in the Union or end users established or located in the Union, wherever the gatekeeper is established.

A core platform service is an online intermediation service, online search engine, online social networking service, video-sharing platform service, number-independent interpersonal communications service, operating system, web browser, virtual assistant or cloud computing service, or an online advertising service provided by an undertaking that provides one of those.

The Commission designates an undertaking as a gatekeeper if it has a significant impact on the internal market, provides a core platform service that is an important gateway for business users to reach end users, and enjoys an entrenched and durable position. An undertaking providing core platform services that meets all of the thresholds in Article 3(2) must notify the Commission without delay and in any event within 2 months after those thresholds are met.

The Commission designates an undertaking that meets all the thresholds in Article 3(2) without undue delay and at the latest within 45 working days after receiving the complete information. The gatekeeper must comply with Articles 5, 6 and 7 within 6 months after a core platform service has been listed in the designation decision.

Article 5 bars a gatekeeper from combining or cross-using an end user's personal data across its services, or signing end users in to other services to combine it, unless the end user has been presented with the specific choice and has given consent within the meaning of Regulation (EU) 2016/679. Article 5 also bars a gatekeeper from preventing business users from offering the same products or services through other channels at different prices or conditions.

Article 5 also bars a gatekeeper from requiring end users or business users to use, offer or interoperate with the gatekeeper's identification service, web browser engine or payment service. Article 6 requires a gatekeeper to allow end users to un-install software applications on its operating system, and to change the default settings of its operating system, virtual assistant and web browser.

Article 6 requires a gatekeeper to allow the installation and effective use of third-party software applications and software application stores that use or interoperate with its operating system. Article 6 bars a gatekeeper from treating its own services and products more favorably in ranking and related indexing and crawling than similar services or products of a third party.

Article 6 requires a gatekeeper to give providers of services and of hardware free-of-charge effective interoperability with the same hardware and software features accessed or controlled via its operating system or virtual assistant that are available to its own services or hardware. Article 6 requires a gatekeeper to give end users effective portability of the data they provide or generate, and to give business users access to the data generated in the use of its core platform services.

Article 6 requires a gatekeeper to apply fair, reasonable and non-discriminatory general conditions of access for business users to its software application stores, online search engines and online social networking services. Article 7 requires a gatekeeper that provides number-independent interpersonal communications services to make their basic functionalities interoperable, on request and free of charge, with those of another provider offering or intending to offer such services in the Union.

Article 7 requires the gatekeeper to publish a reference offer laying down the technical details and general terms and conditions of that interoperability. A gatekeeper must ensure and demonstrate compliance with Articles 5, 6 and 7. A gatekeeper must provide the Commission with a report on the measures it has implemented to comply with Articles 5, 6 and 7.

A gatekeeper must inform the Commission of any intended concentration where the merging entities or the target provide core platform services or other digital-sector services. A gatekeeper must submit an independently audited description of its consumer profiling techniques. The Commission may fine a gatekeeper that intentionally or negligently fails to comply with Articles 5, 6 and 7.

The ceiling on the fine is higher for a repeat of the same or a similar infringement in relation to the same core platform service within the 8 preceding years. The Commission may also impose periodic penalty payments to compel compliance. The Commission is the sole authority empowered to enforce the Regulation. Directive (EU) 2020/1828 applies to representative actions against gatekeeper infringements that harm the collective interests of consumers. The Regulation applies from 2 May 2023.

Article 1 lays down the procedures and technical conditions for providing vetted researchers with access to data held by providers of very large online platforms and of very large online search engines, pursuant to Article 40(4) of the Digital Services Act. Article 40(13) of the Digital Services Act requires the Commission, after consulting the European Board for Digital Services, to adopt delegated acts laying down the technical conditions under which those providers share data.

Article 2(5) defines a data provider as a provider of a very large online platform or of a very large online search engine designated under Article 33(4) of the Digital Services Act, to which a reasoned request might be addressed. Article 3(4) requires data providers to have an account on the Digital Services Act (DSA) data access portal that the Commission establishes and hosts.

Article 6(1) requires each Digital Services Coordinator and each data provider to establish a dedicated point of contact to provide information and support on the data access process.

Article 6(4) requires data providers to make available and easily findable on their online interfaces the details of their point of contact, a link to the DSA data access portal, a DSA data catalogue of the data assets that may be accessed under Article 40(4) of the Digital Services Act with their data structure and metadata, and suggested access modalities for the data in the catalogue.

Article 6(5) requires the catalogue and the suggested access modalities to be regularly updated, in particular to reflect data related to the risk assessments under Article 34 and the audits under Article 37 of the Digital Services Act. Article 7(1) has the Digital Services Coordinator of establishment decide, within 80 working days of the submission of a data access application, whether a reasoned request can be formulated.

Article 10(1) requires a reasoned request to contain at least the date by which the data provider is to give access and the date on which that access ends, the access modalities determined under Article 9, and the summary of the data access application. Article 13(1) lets a data provider that disagrees with the decision of the Digital Services Coordinator of establishment on an amendment request ask it in writing, within five working days, to participate in mediation.

Article 13(6) makes the data provider bear all costs of the mediation. Article 15(1) requires a data provider to notify the Digital Services Coordinator of establishment within three working days that access has been provided to vetted researchers and within three working days that their access has been terminated.

Article 15(2) requires a data provider to give vetted researchers any additional information needed to access and understand the requested data, such as codebooks, changelogs and architectural documentation.

Article 15(3) bars a data provider from imposing on vetted researchers data management requirements such as archiving, storage, refresh and deletion requirements, or limits on the use of standard analytical tools, that may hinder the research, unless the reasoned request explicitly mentions them.

Where personal data are processed, Article 15(4) bars a data provider from imposing on vetted researchers any conditions on the processing of the shared personal data other than those specified in the reasoned request. Article 16 provides that the Regulation enters into force on the twentieth day following that of its publication in the Official Journal of the European Union.

The Commission's press release of 29 October 2025 states that data access is now possible following the entry into force of the delegated act on data access.

Article 1(1) requires providers of intermediary services, of hosting services, of online platforms, of very large online platforms and of very large online search engines to use the CSV or XLSX version of the templates in Annex I for the transparency reports they owe under Articles 15, 24 and 42 of the Digital Services Act.

Article 15(3) of the Digital Services Act lets the Commission adopt implementing acts laying down templates for the form, content and other details of those reports, including harmonized reporting periods. Article 2(1) sets the yearly reporting period for providers of intermediary services, of hosting services and of online platforms from 1 January until 31 December.

Article 2(2) has providers of very large online platforms and of very large online search engines publish their transparency reports at least every six months, covering 1 January until 30 June and 1 July until 31 December. Article 2(3) requires providers of intermediary services, of hosting services, of online platforms, of very large online platforms and of very large online search engines to make their reports publicly available at the latest two months after the end of each reporting period.

Article 2(4) bases the transparency reports on the templates in Annex I as of 1 July 2025. Article 3(1) requires a provider to retain its transparency reports for at least five years after their publication. Article 3(2) keeps every published version of a report publicly available for the entire duration of the retention period. Annex II requires a provider to publish the filled-in templates in an Open Document Format CSV file that complies with Request for Comments (RFC) 4180 and uses UTF-8 encoding.

Annex II requires a provider to publish one transparency report per service that it offers. Annex II treats a report that omits one of the two templates, or parts of them, without a specific and objective reason as incomplete. Annex II requires counting indicators as integers, percentage indicators as floating numbers in the interval from 0 to 1, and median times in hours.

Annex II provides that the first full annual reporting cycle of providers of intermediary services, of hosting services and of online platforms that follows the templates covers 1 January until 31 December 2026. Annex II provides that the first reporting cycle of providers of very large online platforms and of very large online search engines that follows the templates covers 1 July until 31 December 2025.

Annex II sets the minimum threshold for sufficient linguistic expertise for content moderation at level B2 of the Common European Framework of Reference for Languages in the category Understanding. Recital 2 records that Article 15(2) of the Digital Services Act exempts providers of intermediary services that are micro or small enterprises and not very large online platforms from the Article 15(1) reporting obligation.

Article 4 provides that the Regulation enters into force on the twentieth day following that of its publication in the Official Journal of the European Union.

Article 17 requires a provider of hosting services to give any affected recipient of the service a clear and specific statement of reasons for a restriction it imposes on the ground that the information the recipient provided is illegal content or incompatible with its terms and conditions.

The restrictions covered are limits on the visibility of specific items of information, including removal, disabling of access and demotion, the suspension, termination or other restriction of monetary payments, the suspension or termination of the service in whole or in part, and the suspension or termination of the recipient's account.

Article 17(1) applies only where the relevant electronic contact details are known to the provider, applies at the latest from the date the restriction is imposed, and does not apply where the information is deceptive high-volume commercial content.

The statement must at least set out the decision and, where relevant, its territorial scope and duration, the facts and circumstances relied on, any use of automated means, the legal ground or the contractual ground relied on with an explanation, and clear and user-friendly information on the possibilities for redress.

The information must be clear and easily comprehensible and as precise and specific as reasonably possible under the given circumstances, and such as to reasonably allow the recipient to exercise the possibilities for redress effectively. Article 17 does not apply to orders referred to in Article 9.

Article 24(2) requires providers to publish for each online platform or online search engine, by 17 February 2023 and at least once every six months thereafter, in a publicly available section of their online interface, information on the average monthly active recipients of the service in the Union, calculated as an average over the past six months and in accordance with the methodology in the delegated acts referred to in Article 33(3), where those delegated acts have been adopted.

Article 24(3) requires providers of online platforms or of online search engines to communicate that information, updated to the moment of the request, to the Digital Services Coordinator of establishment and the Commission, upon their request and without undue delay. Either authority may require additional information on the calculation, including explanations and substantiation in respect of the data used, and that information must not include personal data.

Article 19(1) excludes providers of online platforms that qualify as micro or small enterprises as defined in Recommendation 2003/361/EC from Section 3 of Chapter III, with the exception of Article 24(3), so a micro or small online platform is bound by Article 24(3) but not by Article 24(2).

Article 43(1) requires the Commission to charge providers of very large online platforms and of very large online search engines an annual supervisory fee upon their designation pursuant to Article 33. A provider is charged annually a supervisory fee for each service for which it has been designated, in the amount the Commission establishes by implementing act for each provider.

The fee must be proportionate to the number of average monthly active recipients in the Union of each very large online platform or very large online search engine, and the overall amount charged on a given provider is capped at 0.05 % of its worldwide annual net income in the preceding financial year. Article 43(4) has the Commission adopt delegated acts laying down the detailed methodology and procedures for determining the fees, including the detailed arrangements necessary to make payments.

Article 11 requires a provider of intermediary services to designate a single point of contact to communicate directly, by electronic means, with Member States' authorities, the Commission and the Board referred to in Article 61. The provider must make public the information needed to identify and communicate with that point of contact, keep it easily accessible and up to date, and specify the official languages that can be used to communicate with it.

Article 12 requires a provider of intermediary services to designate a single point of contact that lets recipients of the service communicate directly and rapidly with it, by electronic means and in a user-friendly manner, including by choosing the means of communication, which must not rely solely on automated tools. The provider must also make public the information recipients need to identify and communicate with that point of contact, kept easily accessible and up to date.

Article 13 requires a provider of intermediary services that has no establishment in the Union but offers services in the Union to designate, in writing, a legal or natural person to act as its legal representative in one of the Member States where it offers its services.

The provider must mandate the legal representative to be addressed, in addition to or instead of the provider, by Member States' competent authorities, the Commission and the Board on all issues necessary for the receipt of, compliance with and enforcement of decisions issued under the Regulation, and must give it the necessary powers and sufficient resources.

The designated legal representative can be held liable for non-compliance with the obligations under the Regulation, without prejudice to the liability and legal actions that could be initiated against the provider.

The provider must notify the name, postal address, email address and telephone number of its legal representative to the Digital Services Coordinator in the Member State where that representative resides or is established, and keep that information publicly available, easily accessible, accurate and up to date. The designation of a legal representative in the Union does not constitute an establishment in the Union.

Article 14 requires a provider of intermediary services to include in its terms and conditions information on any restrictions it imposes on the use of its service in respect of information provided by recipients, including the policies, procedures, measures and tools it uses for content moderation and the rules of procedure of its internal complaint handling system.

That information must be set out in clear, plain, intelligible, user-friendly and unambiguous language and be publicly available in an easily accessible and machine-readable format. The provider must inform recipients of any significant change to the terms and conditions. Where a service is primarily directed at minors or predominantly used by them, the provider must explain the conditions for, and any restrictions on, the use of the service in a way that minors can understand.

The provider must act in a diligent, objective and proportionate manner in applying and enforcing the restrictions in its terms and conditions, with due regard to the rights and legitimate interests of all parties involved, including the fundamental rights of the recipients of the service.

A provider of a very large online platform or very large online search engine must also give recipients a concise, easily accessible and machine-readable summary of its terms and conditions, including the available remedies and redress mechanisms. It must publish its terms and conditions in the official languages of all the Member States in which it offers its services.

Article 15 requires a provider of intermediary services to make publicly available, in a machine-readable format and in an easily accessible manner, at least once a year, clear, easily comprehensible reports on any content moderation it engaged in during the relevant period.

The reports must cover, as applicable, the orders received from Member States' authorities, the notices submitted under Article 16, content moderation at the provider's own initiative including automated tools, the complaints received through internal complaint-handling systems, and any use of automated means for content moderation.

Article 15(1) does not apply to providers of intermediary services that qualify as micro or small enterprises as defined in Recommendation 2003/361/EC and are not very large online platforms within the meaning of Article 33. Article 3, point (j), defines an online search engine as an intermediary service, which is the category of provider that Articles 11 to 15 bind.

The Regulation applies to intermediary services offered to recipients of the service that have their place of establishment or are located in the Union, irrespective of where the providers have their place of establishment.

Article 19(1) excludes providers of online platforms that qualify as micro or small enterprises as defined in Recommendation 2003/361/EC from Section 3 of Chapter III, with the exception of Article 24(3), and keeps the exclusion for 12 months after a provider loses that status, except for very large online platforms.

Article 19(2) applies Section 3 to a provider of an online platform designated as a very large online platform in accordance with Article 33, whether or not it qualifies as a micro or small enterprise.

Article 20 requires a provider of an online platform to give recipients of the service, including those who submitted a notice, access for at least six months after the decision to an effective internal complaint-handling system that lets them lodge complaints, electronically and free of charge, against its decision on a notice and against its decisions, taken on the ground that information is illegal content or incompatible with its terms and conditions, whether or not to remove or restrict that information, to suspend or terminate the service or the account, or to restrict monetisation.

The complaint system must be easy to access and user-friendly, complaints must be handled in a timely, non-discriminatory, diligent and non-arbitrary manner, and the provider must reverse its decision without undue delay where a complaint contains sufficient grounds of the kinds Article 20(4) lists.

The provider must inform complainants without undue delay of its reasoned decision and of the possibility of out-of-court dispute settlement, and the decisions must be taken under the supervision of appropriately qualified staff, and not solely on the basis of automated means.

Article 21 entitles recipients of the service, including individuals or entities that have submitted notices, to select any certified out-of-court dispute settlement body to resolve disputes relating to the decisions referred to in Article 20(1). A provider of an online platform must make information about that possibility easily accessible on its online interface, clear and user-friendly.

Both parties must engage, in good faith, with the selected certified body with a view to resolving the dispute, although a provider may refuse to engage if a dispute has already been resolved concerning the same information and the same grounds of alleged illegality or incompatibility of content.

If the body decides the dispute in favour of the recipient, the provider must bear all the fees charged by the body and reimburse the recipient for any other reasonable expenses it paid in relation to the dispute settlement.

Article 22 requires a provider of an online platform to take the necessary technical and organisational measures to ensure that notices submitted by trusted flaggers, acting within their designated area of expertise, through the Article 16 mechanisms are given priority and are processed and decided upon without undue delay.

A provider that has information indicating that a trusted flagger has submitted a significant number of insufficiently precise, inaccurate or inadequately substantiated notices must communicate that information to the Digital Services Coordinator that awarded the status, with the necessary explanations and supporting documents.

Article 23 requires a provider of an online platform to suspend, for a reasonable period of time and after issuing a prior warning, the provision of its services to recipients that frequently provide manifestly illegal content.

It must likewise suspend, for a reasonable period of time and after a prior warning, the processing of notices and complaints submitted through its notice and action mechanisms and internal complaint-handling systems by individuals, entities or complainants that frequently submit manifestly unfounded notices or complaints.

When deciding on a suspension it must assess, case by case and in a timely, diligent and objective manner, whether the misuse occurs, taking into account at least the absolute numbers and the relative proportion of manifestly illegal items or manifestly unfounded notices or complaints, the gravity of the misuse and, where it can be identified, the intention of the person concerned.

It must set out in its terms and conditions, in a clear and detailed manner, its policy on that misuse, with examples of the facts and circumstances it takes into account and the duration of the suspension.

Article 24(1) requires a provider of an online platform to include in its Article 15 reports, in addition to the information Article 15 requires, the number of disputes submitted to out-of-court dispute settlement bodies, their outcomes, the median time to complete them and the share of disputes where the provider implemented the body's decisions, and the number of suspensions imposed under Article 23.

Article 24(5) requires a provider of an online platform to submit to the Commission, without undue delay, the decisions and statements of reasons referred to in Article 17(1) for inclusion in a publicly accessible machine-readable database managed by the Commission, and to ensure that the information submitted does not contain personal data.

Article 19(1) excludes providers of online platforms that qualify as micro or small enterprises as defined in Recommendation 2003/361/EC from Section 3 of Chapter III, with the exception of Article 24(3), and keeps the exclusion for 12 months after a provider loses that status, except for very large online platforms.

Article 19(2) applies Section 3 to a provider of an online platform designated as a very large online platform in accordance with Article 33, whether or not it qualifies as a micro or small enterprise. Article 25 prohibits a provider of an online platform from designing, organising or operating its online interfaces in a way that deceives or manipulates the recipients of its service, or that otherwise materially distorts or impairs their ability to make free and informed decisions.

The prohibition does not apply to practices covered by Directive 2005/29/EC or Regulation (EU) 2016/679.

Article 26(1) requires a provider of an online platform that presents advertisements on its online interfaces to ensure that, for each specific advertisement presented to each individual recipient, the recipient can identify in a clear, concise and unambiguous manner and in real time that the information is an advertisement, the person on whose behalf it is presented, the person who paid for it if different, and the main parameters used to determine the recipient.

Article 26(2) requires the provider to give recipients a functionality to declare whether the content they provide is or contains commercial communications, and to ensure that other recipients can identify such content in a clear and unambiguous manner and in real time, including through prominent markings.

Article 26(3) prohibits presenting advertisements to recipients based on profiling as defined in Article 4, point (4), of Regulation (EU) 2016/679 using the special categories of personal data referred to in Article 9(1) of that Regulation.

Article 27(1) requires a provider of an online platform that uses recommender systems to set out in its terms and conditions, in plain and intelligible language, the main parameters used in its recommender systems and any options for recipients to modify or influence those parameters.

The main parameters must explain why certain information is suggested to the recipient and include at least the criteria most significant in determining the information suggested and the reasons for their relative importance.

Where several options are available for recommender systems that determine the relative order of information presented, the provider must make available a functionality that lets the recipient select and modify their preferred option at any time, directly and easily accessible from the specific section of the interface where information is being prioritised.

Article 29(1) excludes providers of online platforms allowing consumers to conclude distance contracts with traders that qualify as micro or small enterprises as defined in Recommendation 2003/361/EC from Section 4 of Chapter III, and keeps the exclusion for 12 months after a provider loses that status, except for very large online platforms. Article 29(2) applies Section 4 to such a provider designated as a very large online platform, whether or not it qualifies as a micro or small enterprise.

Article 30(1) requires a provider of an online platform allowing consumers to conclude distance contracts with traders to ensure that traders can only use the platform to promote messages on or to offer products or services to consumers located in the Union if, prior to that use, the provider has obtained the trader's name, address, telephone number and email address, identification document or electronic identification, payment account details, trade register details where applicable, and a self-certification that it will only offer products or services complying with the applicable rules of Union law.

Before allowing the trader to use its services, the provider must make best efforts to assess whether that information is reliable and complete, through any freely accessible official online database or interface made available by a Member State or the Union or through requests to the trader for supporting documents from reliable sources.

For traders already using the platform on 17 February 2024 the provider must make best efforts to obtain the information within 12 months and, where a trader fails to provide it in that period, must suspend the provision of its services to that trader until it has provided all the information.

Where the provider obtains sufficient indications or has reason to believe that any of that information is inaccurate, incomplete or not up-to-date, it must request that the trader remedy the situation without delay or within the period set by Union and national law, and where the trader fails to correct or complete it, must swiftly suspend the provision of its service to that trader in relation to the offering of products or services to consumers located in the Union until the request has been fully complied with.

A trader that is refused or suspended under Article 30 has the right to lodge a complaint as provided for in Articles 20 and 21. The provider must store the information obtained in a secure manner for six months after the end of the contractual relationship with the trader, and must then delete it.

It may disclose the information to third parties only where so required in accordance with the applicable law, including orders under Article 10 and orders issued by Member States' competent authorities or the Commission for the performance of their tasks under the Regulation.

It must make the information referred to in Article 30(1), points (a), (d) and (e), available on its online platform to recipients of the service in a clear, easily accessible and comprehensible manner, at least on the online interface where the information on the product or service is presented.

Article 31 requires such a provider to ensure that its online interface is designed and organised in a way that enables traders to comply with their obligations on pre-contractual information, compliance and product safety information under Union law, and that allows traders to provide the information identifying the products or services offered to consumers in the Union, any sign identifying the trader, and the applicable labelling and marking information.

The provider must make best efforts to assess whether traders have provided that information before allowing them to offer products or services on the platform, and after allowing them must make reasonable efforts to check randomly, in any official, freely accessible and machine-readable online database or interface, whether the products or services offered have been identified as illegal.

Article 32(1) requires a provider that becomes aware, irrespective of the means used, that a trader has offered an illegal product or service to consumers located in the Union through its services to inform, insofar as it has their contact details, the consumers who purchased it of the fact that it is illegal, the identity of the trader and any relevant means of redress, limited to purchases made within the six months preceding the moment the provider became aware.

Where the provider does not have the contact details of all consumers concerned, it must make publicly available and easily accessible on its online interface the information concerning the illegal product or service, the identity of the trader and any relevant means of redress.

Article 33 has the Commission adopt a decision designating an online platform or online search engine as a very large online platform or very large online search engine, and whether a provider is covered turns on the scale and designation test in Article 33(1). The obligations of the Section apply, or cease to apply, to the provider concerned from four months after the Commission notifies it of its decision.

The Commission terminates the designation if, during an uninterrupted period of one year, the platform or search engine does not reach the number of average monthly active recipients that Article 33(1) sets.

Article 38 requires a provider of a very large online platform or search engine that uses recommender systems to provide, in addition to the requirements of Article 27, at least one option for each recommender system that is not based on profiling as defined in Article 4, point (4), of Regulation (EU) 2016/679.

Article 39 requires a provider of a very large online platform or search engine that presents advertisements on its online interfaces to compile and make publicly available, through a searchable and reliable tool and through application programming interfaces, a repository of information about each advertisement. The repository must be kept for the entire period during which the provider presents an advertisement and until one year after it was presented for the last time.

The repository must not contain any personal data of the recipients to whom the advertisement was or could have been presented.

Article 92 applies the Regulation to a provider of a very large online platform or very large online search engine designated under Article 33(4) from four months after the notification of the designation, where that date is earlier than 17 February 2024. The Commission's first designation decisions under Article 33(4) are dated 25 April 2023, so for the providers designated then Articles 34 to 36 apply from 25 August 2023.

Article 34 requires a provider of a very large online platform or very large online search engine to diligently identify, analyse and assess any systemic risks in the Union stemming from the design or functioning of its service and its related systems, including algorithmic systems, or from the use made of its services.

It must carry out the risk assessments by the date of application referred to in Article 33(6), second subparagraph, at least once every year thereafter, and in any event before deploying functionalities that are likely to have a critical impact on the risks identified.

The assessment must be specific to its services and proportionate to the systemic risks, and must include the dissemination of illegal content, negative effects for the exercise of fundamental rights, negative effects on civic discourse, electoral processes and public security, and negative effects in relation to gender-based violence, the protection of public health and minors and serious negative consequences to a person's physical and mental well-being.

It must take into account whether and how the design of its recommender systems and other algorithmic systems, its content moderation systems, its terms and conditions and their enforcement, its systems for selecting and presenting advertisements, and its data related practices influence those risks.

It must preserve the supporting documents of the risk assessments for at least three years after they are performed and, upon request, communicate them to the Commission and the Digital Services Coordinator of establishment. Article 35 requires such a provider to put in place reasonable, proportionate and effective mitigation measures, tailored to the specific systemic risks identified under Article 34, with particular consideration to the impacts of such measures on fundamental rights.

The measures the Article lists as possible include adapting the design, features or functioning of the service, its terms and conditions, its content moderation processes, its algorithmic, recommender and advertising systems and its internal processes, cooperating with trusted flaggers and implementing the decisions of out-of-court dispute settlement bodies, cooperating through codes of conduct and crisis protocols, awareness-raising measures, and targeted measures to protect the rights of the child.

Article 36 allows the Commission, acting upon a recommendation of the Board where a crisis occurs, to adopt a decision requiring one or more such providers to assess whether and how their services significantly contribute to a serious threat, to identify and apply specific, effective and proportionate measures to prevent, eliminate or limit that contribution, and to report to the Commission by the date or at the intervals the decision specifies.

A crisis is deemed to have occurred where extraordinary circumstances lead to a serious threat to public security or public health in the Union or in significant parts of it. The choice of the specific measures remains with the provider addressed by the decision.

Article 92 applies the Regulation to a provider of a very large online platform or very large online search engine designated under Article 33(4) from four months after the notification of the designation, where that date is earlier than 17 February 2024. The Commission's first designation decisions under Article 33(4) are dated 25 April 2023, so for the providers designated then Articles 40 to 42 apply from 25 August 2023.

Article 40(1) requires a provider of a very large online platform or very large online search engine to give the Digital Services Coordinator of establishment or the Commission, at their reasoned request and within a reasonable period specified in that request, access to data that are necessary to monitor and assess compliance with the Regulation.

At the request of either, the provider must explain the design, the logic, the functioning and the testing of its algorithmic systems, including its recommender systems.

Upon a reasoned request from the Digital Services Coordinator of establishment, the provider must within a reasonable period provide access to data to vetted researchers who meet the requirements in Article 40(8), for the sole purpose of research that contributes to the detection, identification and understanding of systemic risks in the Union and to the assessment of the adequacy, efficiency and impacts of the risk mitigation measures.

Within 15 days of receiving such a request the provider may ask the Digital Services Coordinator of establishment to amend it, where it does not have access to the data or giving access would lead to significant vulnerabilities in the security of its service or the protection of confidential information, in particular trade secrets.

The provider must facilitate and provide access to data under Article 40(1) and (4) through appropriate interfaces specified in the request, including online databases or application programming interfaces.

It must also give access without undue delay to data, including where technically possible real-time data, provided that the data is publicly accessible in its online interface, to researchers who comply with the conditions in Article 40(8), points (b), (c), (d) and (e), and use the data solely for research that contributes to the detection, identification and understanding of systemic risks in the Union.

Article 41(1) requires such a provider to establish a compliance function, independent from its operational functions and composed of one or more compliance officers, including the head of the compliance function, with sufficient authority, stature and resources and access to the management body.

The head of the compliance function must be an independent senior manager with distinct responsibility for the function, must report directly to the management body, and must not be removed without the prior approval of the management body.

Compliance officers must cooperate with the Digital Services Coordinator of establishment and the Commission, ensure that all risks referred to in Article 34 are identified and properly reported on and that risk-mitigation measures are taken under Article 35, organise and supervise the activities relating to the independent audit under Article 37, inform and advise management and the workforce about relevant obligations, and monitor compliance with the Regulation and with commitments made under codes of conduct and crisis protocols.

The provider must communicate the name and contact details of the head of the compliance function to the Digital Services Coordinator of establishment and to the Commission. Its management body must define, oversee and be accountable for governance arrangements that ensure the independence of the compliance function, approve and review at least once a year the strategies and policies for managing the risks identified under Article 34, and devote sufficient time to decisions on risk management.

Article 42(1) requires such a provider to publish the reports referred to in Article 15 at the latest by two months from the date of application referred to in Article 33(6), second subparagraph, and thereafter at least every six months.

A provider of a very large online platform must also specify in those reports the human resources it dedicates to content moderation in the Union, broken down by official language, the qualifications and linguistic expertise of those persons and the training and support given to them, and the indicators of accuracy broken down by official language. Such a provider must also include in those reports the information on the average monthly recipients of the service for each Member State.

It must transmit to the Digital Services Coordinator of establishment and the Commission, without undue delay upon completion, and make publicly available at the latest three months after the receipt of each audit report, a report on the results of the risk assessment, the specific mitigation measures put in place, the audit report, the audit implementation report and, where applicable, information about the consultations conducted in support of the risk assessments.

The provider may remove information from the public versions where publication might result in the disclosure of confidential information, cause significant vulnerabilities for the security of its service, undermine public security or harm recipients, but must then transmit the complete reports to the Digital Services Coordinator of establishment and the Commission with a statement of the reasons for removing the information.

Article 18(1) requires a provider of a very large online platform to provide a functionality allowing recipients of its service to declare that they are media service providers and to make the other declarations listed in points (b) to (e).

Article 18(1) also requires the functionality to let them provide their legal name and contact details, including an email address, and the contact details of the relevant national regulatory authorities or bodies or representatives of the co-regulatory or self-regulatory mechanisms.

Where there is reasonable doubt about a media service provider's declaration of regulatory oversight or adherence to a recognized mechanism, Article 18(1) requires the provider of the very large online platform to seek confirmation from the relevant national regulatory authority or body or the relevant co-regulatory or self-regulatory mechanism.

Article 18(2) requires the declared information, except the legal name and contact details provided under point (f), to be made publicly available in an easily accessible manner on the platform's online interface. Article 18(3) requires the provider to acknowledge receipt of declarations and to provide contact details, including an email address, through which the media service provider can communicate directly and quickly with it.

Article 18(3) also requires the provider to indicate without undue delay whether it accepts or rejects each declaration.

Before a decision to suspend its online intermediation services in relation to content provided by a media service provider that has submitted a declaration, or to restrict the visibility of that content, on the ground that the content is incompatible with its terms and conditions takes effect, Article 18(4) requires the provider to communicate to that media service provider a statement of reasons.

Article 18(4) also requires the provider to give that media service provider the opportunity to reply to the statement of reasons within 24 hours of receiving it or, in a crisis as referred to in Article 36(2) of the Digital Services Act, within a shorter timeframe that allows a meaningful reply. Where, following or in the absence of a reply, the provider decides to suspend or restrict visibility, Article 18(4) requires it to inform the media service provider without undue delay.

Article 18(4) does not apply where the provider suspends or restricts visibility in compliance with its obligations under Articles 28, 34 and 35 of the Digital Services Act and Article 28b of Directive 2010/13/EU or with its obligations relating to illegal content under Union law.

Article 18(5) requires the provider to take all the necessary technical and organizational measures to ensure that complaints lodged by media service providers under Article 11 of Regulation (EU) 2019/1150 or Article 20 of the Digital Services Act are processed and decided upon with priority and without undue delay.

Where a media service provider that has submitted a declaration considers that a provider of a very large online platform has repeatedly restricted or suspended, without sufficient grounds, the provision of its services in relation to the media service provider's content, Article 18(6) requires the provider of the platform to engage, at the media service provider's request, in a meaningful and effective dialogue in good faith with a view to finding an amicable solution.

Where a provider rejects or invalidates a declaration, or no amicable solution is found after a dialogue, Article 18(7) allows the media service provider to resort to mediation under Article 12 of Regulation (EU) 2019/1150 or to out-of-court dispute settlement under Article 21 of the Digital Services Act.

Article 18(8) requires the provider to make publicly available on an annual basis detailed information on the restrictions and suspensions it imposed on the ground that the content of a declaring media service provider is incompatible with its terms and conditions and the grounds for them, the dialogues, the declarations it rejected and the declarations it invalidated.

Article 18(9) has the Commission issue guidelines to facilitate the effective implementation of the functionality referred to in Article 18(1). Article 2(10) defines a provider of a very large online platform as a provider of an online platform that has been designated as a very large online platform pursuant to Article 33(4) of the Digital Services Act.

Article 29 applies the Regulation from 8 August 2025, except for Article 3, Article 4(1) and (2), Article 6(3), Articles 7 to 13, Articles 14 to 17, Article 20 and Article 28, which apply from other dates.

Article 7(1), point (a), requires an online short-term rental platform to design and organize its online interface in a way that requires hosts to self-declare whether the unit offered for short-term accommodation rental services is located in an area where a registration procedure has been established or applies.

Article 7(1), point (b), requires it to design and organize the interface so that, when a host declares that the unit is in such an area, users can identify the unit through a registration number, to ensure that the host has provided a registration number before allowing the offering of the services for that unit, and to ensure that the host displays that number clearly as part of the listing.

Article 7(1), point (c), requires it to make reasonable efforts to check at random, on a regular basis, the hosts' declarations about whether a registration procedure exists and, where one does, the validity of the registration number provided, through the functionalities of the single digital entry points, after allowing the offering of the services by the host.

Article 7(2) requires it to inform the competent authorities and the hosts, without undue delay, of the results of the random checks concerning incorrect declarations of hosts, the misuse of a registration number or invalid registration numbers.

Article 7(3) requires it to inform hosts adequately of the applicability in a given area of registration procedures, taking into consideration the lists Member States make available under Article 13 and the information in Annex I to Regulation (EU) 2018/1724.

Article 8 requires it, upon receiving the self-declaration referred to in Article 7(1), point (a), and before allowing the host to use its services, to make best efforts, using the lists Member States make available under Article 13(1), point (a), to assess whether the self-declaration is complete, provided the assessment can be carried out in a proportionate manner by automated tools, and provides that this gives rise to no general monitoring obligation.

Article 15(1) applies Chapter IV of Regulation (EU) 2022/2065 to the enforcement of Article 7(1) and Article 8, reads references in that Chapter to compliance with the relevant provisions of that Regulation as including Article 7(1) and Article 8, and extends the Commission's powers under that Chapter to their application.

Article 15(2) and (3) make the authorities designated by the Member State of the relevant single digital entry point competent to enforce Article 7(2) and (3), and require Member States to lay down effective, proportionate and dissuasive penalty rules for infringements of Article 7(2) and (3) by online short-term rental platforms. Article 19 applies the Regulation from 20 May 2026.

Article 1 makes the producer liable for damage caused by a defect in his product. As replaced by Directive 1999/34/EC, Article 2 defines a product as all movables, even if incorporated into another movable or into an immovable, and says a product includes electricity. Directive 1999/34/EC extended the principle of liability without fault to all types of product, including agricultural products. Directive 1999/34/EC required Member States to apply its measures from 4 December 2000.

Article 3(2) deems a person who imports a product into the Community for sale, hire, leasing or any form of distribution in the course of his business to be a producer. Article 3(3) treats each supplier of a product as its producer where the producer cannot be identified, unless the supplier informs the injured person within a reasonable time of the identity of the producer or of the person who supplied the product.

Article 4 requires the injured person to prove the damage, the defect and the causal relationship between defect and damage. Article 6(1) treats a product as defective when it does not provide the safety which a person is entitled to expect, taking all circumstances into account.

Article 7(e) frees the producer who proves that the state of scientific and technical knowledge at the time when he put the product into circulation was not such as to enable the existence of the defect to be discovered. Article 15(1)(b) lets a Member State maintain, or introduce subject to the procedure in Article 15(2), a rule that the producer is liable even if he proves that the state of scientific and technical knowledge did not enable the defect to be discovered.

Article 9 covers damage caused by death or by personal injuries, and damage to or destruction of an item of property other than the defective product itself, with a lower threshold of 500 ECU, where the item is of a type ordinarily intended for private use or consumption and was used by the injured person mainly for his own private use or consumption.

Article 10(1) sets a limitation period of three years, running from the day on which the plaintiff became aware, or should reasonably have become aware, of the damage, the defect and the identity of the producer. Article 11 extinguishes the rights of the injured person on the expiry of 10 years from the date on which the producer put into circulation the actual product which caused the damage, unless the injured person has in the meantime instituted proceedings against the producer.

Article 12 provides that the liability of the producer may not, in relation to the injured person, be limited or excluded by a provision limiting his liability or exempting him from liability. Article 16(1) lets a Member State limit a producer’s total liability for death or personal injury caused by identical items with the same defect to an amount of not less than 70 million ECU.

Article 17 provides that the Directive does not apply to products put into circulation before the date on which the national provisions referred to in Article 19 enter into force. Article 19(1) required Member States to bring into force the laws, regulations and administrative provisions necessary to comply with the Directive not later than three years from the date of its notification. The Directive records that it was notified to the Member States on 30 July 1985.

Article 21 of Directive (EU) 2024/2853 repeals Directive 85/374/EEC with effect from 9 December 2026 and keeps it in application for products placed on the market or put into service before that date.

Article 1 lays down common rules on the liability of economic operators for damage suffered by natural persons and caused by defective products. Article 4(1) defines a product to include software. Recital 13 says software is a product irrespective of the mode of its supply or usage, whether it is stored on a device, accessed through a communication network or cloud technologies, or supplied through a software-as-a-service model.

Recital 13 says a developer or producer of software, including an AI system provider within the meaning of Regulation (EU) 2024/1689, should be treated as a manufacturer. Article 2(1), as corrected by a corrigendum published on 7 May 2026, applies the Directive to products placed on the market or put into service after 8 December 2026.

Article 2(2) provides that the Directive does not apply to free and open-source software that is developed or supplied outside the course of a commercial activity. Recital 14 says the Directive applies where software is supplied in exchange for a price, or for personal data used other than exclusively for improving the security, compatibility or interoperability of the software.

Article 7(2)(f) counts relevant product safety requirements, including safety-relevant cybersecurity requirements, among the circumstances taken into account in assessing the defectiveness of a product. Article 9(1) requires a defendant to disclose relevant evidence at its disposal when the claimant has presented facts and evidence sufficient to support the plausibility of the claim for compensation.

Article 10(2)(a) presumes the product defective where the defendant fails to disclose relevant evidence under Article 9(1). Article 10(2)(b) and (c) also presume defectiveness where the claimant demonstrates non-compliance with mandatory product safety requirements intended to protect against the risk of the damage suffered, or that the damage was caused by an obvious malfunction of the product during reasonably foreseeable use or under ordinary circumstances.

Article 10(3) presumes the causal link where it has been established that the product is defective and that the damage caused is of a kind typically consistent with the defect in question.

Article 10(4) requires a national court to presume defectiveness or the causal link, or both, where, despite the disclosure of evidence under Article 9, the claimant faces excessive difficulties, in particular due to technical or scientific complexity, and demonstrates that it is likely that the product is defective or that there is a causal link.

Article 8(1) makes liable the manufacturer of a defective product and the manufacturer of a defective component that was integrated into or inter-connected with a product within the manufacturer’s control and caused that product to be defective. Where the manufacturer is established outside the Union, Article 8(1)(c) makes the importer, the authorized representative and, where there is neither, the fulfilment service provider liable.

Article 8(2) treats a person that substantially modifies a product outside the manufacturer’s control and thereafter makes it available on the market or puts it into service as its manufacturer. Article 8(4) applies the distributor rule of Article 8(3) to a provider of an online platform that allows consumers to conclude distance contracts with traders and is not an economic operator, where the conditions of Article 6(3) of Regulation (EU) 2022/2065 are fulfilled.

Article 6(1) covers death or personal injury, damage to or destruction of property except the defective product itself, a product damaged by a defective component integrated into or inter-connected with it by its manufacturer or within that manufacturer’s control, and property used exclusively for professional purposes, and the destruction or corruption of data that are not used for professional purposes.

Article 11(1)(e) exempts an economic operator that proves the objective state of scientific and technical knowledge at the time the product was placed on the market or put into service, or during the period in which it was within the manufacturer’s control, was not such that the defectiveness could be discovered.

Article 11(2) removes the exemption of Article 11(1), point (c), for a defect that did not exist when the product was placed on the market or came into being afterwards, where the defectiveness is due, within the manufacturer’s control, to a related service, software including updates or upgrades, a lack of software updates or upgrades necessary to maintain safety, or a substantial modification.

Article 15 bars limiting or excluding an economic operator’s liability to the injured person by a contractual provision or by national law. Article 16 sets a limitation period of three years from the day the injured person became aware, or should reasonably have become aware, of the damage, the defectiveness and the identity of the economic operator that can be held liable.

Article 17(1) ends the right to compensation on the expiry of 10 years from the date the defective product was placed on the market or put into service, or, for a substantially modified product, made available on the market or put into service after the modification, unless the injured person has in the meantime initiated proceedings against an economic operator that can be held liable.

Article 17(2) extends that period to 25 years where the injured person could not initiate proceedings within 10 years because a personal injury was latent. Article 3 forbids Member States from maintaining or introducing provisions diverging from the Directive, including more stringent or less stringent provisions, unless the Directive provides otherwise.

Article 18(1) lets a Member State maintain, by derogation from Article 11(1)(e), existing measures under which economic operators are liable even if they prove that the state of scientific and technical knowledge did not allow the defectiveness to be discovered, if it notifies the text of the measures to the Commission no later than 9 December 2026.

Article 21 repeals Directive 85/374/EEC with effect from 9 December 2026, and that Directive continues to apply to products placed on the market or put into service before that date. Article 22(1) requires Member States to bring into force the laws, regulations and administrative provisions necessary to comply with the Directive by 9 December 2026. Article 23 provides that the Directive enters into force on the twentieth day following that of its publication in the Official Journal. The Directive was published in the Official Journal on 18 November 2024.

Article 7(1) of Directive 2010/13/EU, as replaced by Directive (EU) 2018/1808, requires Member States to ensure, without undue delay, that services provided by media service providers under their jurisdiction are made continuously and progressively more accessible to persons with disabilities through proportionate measures.

Article 7(2) requires Member States to ensure that media service providers report on a regular basis to the national regulatory authorities or bodies on the implementation of those measures, and Article 7(3) requires Member States to encourage media service providers to develop accessibility action plans, any such plan to be communicated to national regulatory authorities or bodies.

Article 7(4) requires each Member State to designate a single, easily accessible, including by persons with disabilities, and publicly available online point of contact for providing information and receiving complaints regarding any accessibility issues referred to in the Article.

Article 7(5) requires Member States to ensure that emergency information, including public communications and announcements in natural disaster situations, which is made available to the public through audiovisual media services, is provided in a manner which is accessible to persons with disabilities.

Directive (EU) 2018/1808 required Member States to bring into force the laws, regulations and administrative provisions necessary to comply with it by 19 September 2020 (Article 2(1)), so the duties reach a media service provider through the law of the Member State with jurisdiction over it.

The Directive applies to the following products placed on the market after 28 June 2025 (Article 2(1)): consumer general purpose computer hardware systems and operating systems for those hardware systems; payment terminals; automated teller machines, ticketing machines, check-in machines and interactive self-service terminals providing information (excluding terminals installed as integrated parts of vehicles, aircrafts, ships or rolling stock), where they are self-service terminals dedicated to the provision of services covered by the Directive; consumer terminal equipment with interactive computing capability used for electronic communications services; consumer terminal equipment with interactive computing capability used for accessing audiovisual media services; and e-readers.

Article 3(39) defines a consumer general purpose computer hardware system as the combination of hardware which forms a complete computer, characterised by its multipurpose nature, its ability to perform, with the appropriate software, most common computing tasks requested by consumers and intended to be operated by consumers, including personal computers, in particular desktops, notebooks, smartphones and tablets.

Article 3(38) defines an operating system as software, which, inter alia, handles the interface to peripheral hardware, schedules tasks, allocates storage, and presents a default interface to the user when no application program is running, including a graphical user interface, whether it is an integral part of consumer general purpose computer hardware or free-standing software intended to be run on such hardware, excluding an operating system loader, basic input/output system, or other firmware required at boot time or when installing the operating system.

Article 4(2) requires all products to comply with the accessibility requirements set out in Section I of Annex I, and all products except for self-service terminals to comply with those set out in Section II of Annex I. Section I of Annex I requires a product, including its user interface, to contain features, elements and functions that allow persons with disabilities to access, perceive, operate, understand and control the product.

Article 7(1) requires a manufacturer, when placing its products on the market, to ensure that the products have been designed and manufactured in accordance with the applicable accessibility requirements of the Directive.

Article 7(2) requires a manufacturer to draw up the technical documentation in accordance with Annex IV, to carry out the conformity assessment procedure set out in that Annex or have it carried out, and, where compliance has been demonstrated by that procedure, to draw up an EU declaration of conformity and affix the CE marking.

Article 7(3) requires a manufacturer to keep the technical documentation and the EU declaration of conformity for five years after the product has been placed on the market. Article 9(1) requires an importer to place only compliant products on the market. Article 10(1) requires a distributor, when making a product available on the market, to act with due care in relation to the requirements of the Directive.

Article 11 treats an importer or distributor as a manufacturer, subject to the obligations of Article 7, where it places a product on the market under its name or trademark or modifies a product already placed on the market in such a way that compliance with the requirements of the Directive may be affected.

Articles 7(8), 9(8) and 10(5) require a manufacturer, importer or distributor who considers or has reason to believe that a product it has made available is not in conformity to take, or to make sure that others take, the corrective measures necessary to bring it into conformity or, if appropriate, to withdraw it, and to inform immediately the competent national authorities of the Member States in which it made the product available.

Article 14(1) provides that the accessibility requirements apply only to the extent that compliance does not require a significant change in a product or service that results in the fundamental alteration of its basic nature and does not result in the imposition of a disproportionate burden on the economic operators concerned.

Article 14(2) and (3) require an economic operator to assess whether compliance would introduce a fundamental alteration or, based on the criteria in Annex VI, impose a disproportionate burden, to document the assessment, to keep all relevant results for five years from the last making available of the product on the market, and to give a copy to the market surveillance authorities on request.

Article 14(4) exempts microenterprises dealing with products from the requirement to document their assessment, but a microenterprise that has chosen to rely on Article 14(1) shall provide a market surveillance authority that so requests with the facts relevant to the assessment, and Article 14(8) does not require a microenterprise to send information that it relies on Article 14(1).

Article 16(1) requires the EU declaration of conformity, where Article 14 has been used, to state which accessibility requirements are subject to that exception.

A product or service in conformity with harmonized standards or parts thereof, the references of which have been published in the Official Journal of the European Union, shall be presumed to be in conformity with the accessibility requirements of this Directive in so far as those standards or parts thereof cover those requirements (Article 15(1)), and Article 15(4) gives the same presumption to conformity with the technical specifications the Commission may adopt by implementing acts (Article 15(3)).

The Directive itself names no standard. Article 32(2) lets Member States provide that self-service terminals lawfully used by service providers for the provision of services before 28 June 2025 may continue to be used in the provision of similar services until the end of their economically useful life, but no longer than 20 years after their entry into use. Recital 57 states that the obligations of the Directive should apply equally to economic operators from the public and private sectors.

The Directive is addressed to the Member States (Article 35). Article 31 has Member States adopt and publish the laws, regulations and administrative provisions necessary to comply with the Directive by 28 June 2022 and apply those measures from 28 June 2025.

Article 29(2) has Member States provide that a consumer may take action before the courts or before the competent administrative bodies, in accordance with national law, to ensure that the national provisions transposing the Directive are complied with, and that public bodies or private associations, organizations or other legal entities which have a legitimate interest in ensuring that the Directive is complied with may engage in those proceedings on behalf or in support of the complainant, with his or her approval.

Article 30 has each Member State lay down the rules on penalties applicable to infringements of national provisions adopted pursuant to the Directive, and says the penalties provided for shall be effective, proportionate and dissuasive, shall be accompanied by effective remedial action in case of non-compliance of the economic operator, and shall take into account the extent of the non-compliance, including its seriousness, and the number of units of non-complying products or services concerned, as well as the number of persons affected. The Directive sets no penalty amount of its own.

The Directive applies to the following services provided to consumers after 28 June 2025 (Article 2(2)): electronic communications services with the exception of transmission services used for the provision of machine-to-machine services, services providing access to audiovisual media services, the website, mobile application, electronic ticketing, travel-information and interactive self-service terminal elements of air, bus, rail and waterborne passenger transport services (for urban, suburban and regional transport services only the interactive self-service terminals apply), consumer banking services, e-books and dedicated software, and e-commerce services.

Article 3(4) defines a service provider as any natural or legal person who provides a service on the Union market or makes offers to provide such a service to consumers in the Union. Article 3(30) defines e-commerce services as services provided at a distance, through websites and mobile device-based services by electronic means and at the individual request of a consumer with a view to concluding a consumer contract.

The Directive does not apply to the following content of websites and mobile applications: pre-recorded time-based media published before 28 June 2025, office file formats published before 28 June 2025, online maps and mapping services if essential information is provided in an accessible digital manner for maps intended for navigational use, third-party content that is neither funded, developed by, or under the control of the economic operator concerned, and content of websites and mobile applications qualifying as archives, meaning that they only contain content that is not updated or edited after 28 June 2025 (Article 2(4)).

Subject to Article 4(5), Article 4(3) requires all services, except urban and suburban transport services and regional transport services, to comply with the accessibility requirements set out in Section III of Annex I, and all services to comply with those set out in Section IV of Annex I. Section III of Annex I requires websites, including the related online applications, and mobile device-based services, including mobile applications, to be accessible in a consistent and adequate way by making them perceivable, operable, understandable and robust.

Article 4(5) exempts microenterprises providing services from the accessibility requirements of Article 4(3) and from any obligations relating to compliance with those requirements.

Under Article 5, services complying with the requirements on the provision of accessible information and of information on accessibility laid down in Regulations (EC) No 261/2004, (EC) No 1107/2006, (EC) No 1371/2007, (EU) No 1177/2010 and (EU) No 181/2011 and relevant acts adopted on the basis of Directive 2008/57/EC are deemed to comply with the corresponding requirements of the Directive, and the Directive's additional requirements apply in full.

Article 13(1) requires service providers to design and provide services in accordance with the accessibility requirements of the Directive. Article 13(2) requires a service provider to prepare the necessary information in accordance with Annex V and to explain how the services meet the applicable accessibility requirements.

Annex V requires the service provider to include the information assessing how the service meets the accessibility requirements in the general terms and conditions, or equivalent document. Article 13(4) requires a service provider, in the case of non-conformity, to take the corrective measures necessary to bring the service into conformity with the applicable accessibility requirements.

Article 14(1) provides that the accessibility requirements apply only to the extent that compliance does not require a significant change in a product or service that results in the fundamental alteration of its basic nature and does not result in the imposition of a disproportionate burden on the economic operators concerned.

Article 14(2) and (3) require an economic operator to assess whether compliance would introduce a fundamental alteration or, based on the criteria in Annex VI, impose a disproportionate burden, to document the assessment, to keep all relevant results for five years after the service was last provided, and to give a copy of the assessment to the authorities responsible for checking compliance of services on request.

Article 14(6) bars an economic operator that receives funding from other sources than its own resources, public or private, provided for the purpose of improving accessibility, from relying on disproportionate burden, and Article 14(8) requires an economic operator relying on Article 14(1) for a specific service to send information to that effect to the authorities responsible for checking compliance of services of the Member State where the service is provided.

Article 14(5) requires a service provider relying on the disproportionate burden ground to renew its assessment, with regard to each category or type of service, when the service offered is altered, when requested to do so by the authorities responsible for checking compliance of services, and in any event at least every five years.

A product or service in conformity with harmonized standards or parts thereof, the references of which have been published in the Official Journal of the European Union, shall be presumed to be in conformity with the accessibility requirements of this Directive in so far as those standards or parts thereof cover those requirements (Article 15(1)), and Article 15(4) gives the same presumption to conformity with the technical specifications the Commission may adopt by implementing acts (Article 15(3)).

The Directive itself names no standard. Article 32(1) has Member States provide for a transitional period ending on 28 June 2030 during which service providers may continue to provide their services using products which were lawfully used by them to provide similar services before that date, and lets service contracts agreed before 28 June 2025 continue without alteration until they expire, but no longer than five years from that date.

Article 32(2) lets Member States provide that self-service terminals lawfully used by service providers for the provision of services before 28 June 2025 may continue to be used in the provision of similar services until the end of their economically useful life, but no longer than 20 years after their entry into use. Recital 57 states that the obligations of the Directive should apply equally to economic operators from the public and private sectors.

The Directive is addressed to the Member States (Article 35). Article 31 has Member States adopt and publish the laws, regulations and administrative provisions necessary to comply with the Directive by 28 June 2022 and apply those measures from 28 June 2025.

Article 29(2) has Member States provide that a consumer may take action before the courts or before the competent administrative bodies, in accordance with national law, to ensure that the national provisions transposing the Directive are complied with, and that public bodies or private associations, organizations or other legal entities which have a legitimate interest in ensuring that the Directive is complied with may engage in those proceedings on behalf or in support of the complainant, with his or her approval.

Article 30 has each Member State lay down the rules on penalties applicable to infringements of national provisions adopted pursuant to the Directive, and says the penalties provided for shall be effective, proportionate and dissuasive, shall be accompanied by effective remedial action in case of non-compliance of the economic operator, and shall take into account the extent of the non-compliance, including its seriousness, and the number of units of non-complying products or services concerned, as well as the number of persons affected. The Directive sets no penalty amount of its own.

Regulation (EU) 2021/782 applies to international and domestic rail journeys and services throughout the Union provided by one or more railway undertakings licensed in accordance with Directive 2012/34/EU (Article 2(1)).

Member States may exempt services operated strictly for historical or touristic use (Article 2(2)), urban, suburban and regional rail passenger services, and international rail passenger services of which a significant part is operated outside the Union (Article 2(6)), but an exemption of urban, suburban and regional services does not apply in relation to Articles 21 and 22, among others (Article 2(8)).

Article 9(3) requires the travel information that railway undertakings, tour operators and ticket vendors provide under Article 9(1) and (2) to be provided in the most appropriate format, including by using appropriate communication technologies, and says particular attention shall be paid to ensuring that this information is accessible in accordance with Directive (EU) 2019/882 and Regulations (EU) No 454/2011 and (EU) No 1300/2014.

Article 21(2) requires reservations and tickets to be offered to persons with disabilities and persons with reduced mobility at no additional cost, and bars a railway undertaking, ticket vendor or tour operator from refusing to accept a reservation from, or to issue a ticket to, such a person, or requiring that the person be accompanied, unless this is strictly necessary in order to comply with the access rules referred to in Article 21(1).

Article 22(1) requires a station manager, a railway undertaking, a ticket vendor or a tour operator, upon request, to provide persons with disabilities and persons with reduced mobility with information, including in accessible formats, on the accessibility of the station and associated facilities and of rail services and on the access conditions of rolling stock, and Article 22(2) requires a written statement of reasons, upon request, within five working days where the Article 21(2) derogation is used.

Article 24 requires railway undertakings, station managers, ticket vendors and tour operators to offer a single notification mechanism for assistance, to accept notifications without additional costs, irrespective of the means of communication being used, and to take all measures necessary for the reception of notifications, a ticket vendor unable to process them indicating alternative points of purchase or alternative means to make the notification.

Each Member State designates a body or bodies responsible for the enforcement of the Regulation (Article 31(1)), and Article 35(1) has the Member States lay down the rules on penalties applicable to infringements of the Regulation, which shall be effective, proportionate and dissuasive; the Regulation sets no amount. The Regulation applies from 7 June 2023 and repeals Regulation (EC) No 1371/2007 with effect from that day (Articles 40 and 41).

Regulation (EC) No 1107/2006 establishes rules for the protection of and provision of assistance to disabled persons and persons with reduced mobility travelling by air, both to protect them against discrimination and to ensure that they receive assistance (Article 1(1)).

It applies to disabled persons and persons with reduced mobility using or intending to use commercial passenger air services on departure from, on transit through, or on arrival at an airport situated in the territory of a Member State, and Articles 3, 4 and 10 also apply to passengers departing from an airport in a third country to an airport in a Member State if the operating carrier is a Community air carrier (Article 1(2) and (3)).

Article 3 bars an air carrier or its agent or a tour operator from refusing, on the grounds of disability or of reduced mobility, to accept a reservation for a flight departing from or arriving at an airport to which the Regulation applies, or to embark a disabled person or a person with reduced mobility at such an airport who has a valid ticket and reservation.

Article 4(1) allows such a refusal in order to meet applicable safety requirements or if the size of the aircraft or its doors makes the embarkation or carriage physically impossible, and requires reasonable efforts to propose an acceptable alternative when a reservation is refused on those grounds.

Article 4(4) requires the carrier, agent or tour operator to inform the person immediately of the reasons for a derogation and, on request, to communicate them in writing within five working days of the request.

Article 4(3) requires an air carrier or its agent to make publicly available, in accessible formats and in at least the same languages as the information made available to other passengers, the safety rules that it applies to the carriage of disabled persons and persons with reduced mobility, as well as any restrictions on their carriage or on that of mobility equipment due to the size of aircraft, and a tour operator to make such safety rules and restrictions available for flights included in package travel, package holidays and package tours which it organizes, sells or offers for sale.

Article 6(1) requires air carriers, their agents and tour operators to take all measures necessary for the receipt, at all their points of sale in the territory of the Member States, including sale by telephone and via the Internet, of notifications of the need for assistance made by disabled persons or persons with reduced mobility, and Article 6(2) and (3) set when the information is to be transmitted to the airports and the operating air carrier.

Each Member State designates a body or bodies responsible for the enforcement of the Regulation (Article 14(1)), and a person who considers that the Regulation has been infringed may bring the matter to the attention of the airport managing body or the air carrier and, failing satisfaction, complain to that body (Article 15(1) and (2)).

Article 16 has the Member States lay down rules on penalties applicable to infringements of the Regulation, and says the penalties provided for must be effective, proportionate and dissuasive; the Regulation sets no amount. Articles 3 and 4 apply with effect from 26 July 2007 and the rest of the Regulation from 26 July 2008, and the Regulation is binding in its entirety and directly applicable in all Member States (Article 18).

Regulation (EU) No 181/2011 applies to regular bus and coach services for non-specified categories of passengers whose boarding or alighting point is situated in the territory of a Member State. Articles 9, 10(1), 24 and 25 apply to such services whatever their scheduled distance, while Articles 10(2), 11 and 14 apply only where it is 250 km or more (Article 2(1) and (2)), and none of these Articles applies to occasional services (Article 2(3)).

Article 9 bars carriers, travel agents and tour operators from refusing to accept a reservation from, to issue or otherwise provide a ticket to, or to take on board, a person on the grounds of disability or of reduced mobility, and requires reservations and tickets to be offered to disabled persons and persons with reduced mobility at no additional cost.

Article 10(1) allows a refusal in order to meet applicable safety requirements or health and safety requirements, or where the design of the vehicle or the infrastructure makes safe and operationally feasible carriage physically impossible, and Article 10(2) then requires the carrier, travel agent or tour operator to inform the person about any acceptable alternative service operated by the carrier.

Article 11(2) requires carriers and terminal managing bodies to make their access conditions for the transport of disabled persons and persons with reduced mobility publicly available physically or on the Internet, in accessible formats on request, in the same languages as those in which information is generally made available to all passengers.

Article 14(3) requires carriers, terminal managing bodies, travel agents and tour operators to take all measures necessary to facilitate the receipt of notifications of the need for assistance at all designated terminals and their points of sale, including sale by telephone and via the Internet.

Article 24 requires carriers and terminal managing bodies to provide passengers with adequate information throughout their travel, in accessible formats upon request where feasible, and Article 25(1) requires them to provide information regarding passengers' rights at terminals and, where applicable, on the Internet, in an accessible format at the request of a disabled person or person with reduced mobility where feasible.

Each Member State designates a body or bodies responsible for the enforcement of the Regulation as regards regular services from points situated on its territory and regular services from a third country to such points (Article 28(1)), and Article 31 has the Member States lay down rules on penalties, which shall be effective, proportionate and dissuasive; the Regulation sets no amount.

The Regulation applies from 1 March 2013 and is binding in its entirety and directly applicable in all Member States (Article 34).

Regulation (EU) No 1177/2010 applies in respect of passengers travelling on passenger services where the port of embarkation is situated in the territory of a Member State, on passenger services from a port outside the Union to a port in a Member State operated by a Union carrier, and on a cruise where the port of embarkation is situated in the territory of a Member State (Article 2(1)).

It does not apply in respect of passengers travelling on ships certified to carry up to 12 passengers, on ships whose crew responsible for the operation of the ship is composed of not more than three persons or where the distance of the overall passenger service is less than 500 meters one way, on excursion and sightseeing tours other than cruises, or on ships not propelled by mechanical means and certain historical passenger ships (Article 2(2)).

Article 7 bars carriers, travel agents and tour operators from refusing to accept a reservation, to issue or otherwise provide a ticket or to embark persons on the grounds of disability or of reduced mobility as such, and requires reservations and tickets to be offered to disabled persons and persons with reduced mobility at no additional cost under the same conditions that apply to all other passengers.

Article 8(1) allows a refusal in order to meet applicable safety requirements or where the design of the passenger ship or port infrastructure and equipment makes safe or operationally feasible embarkation, disembarkation or carriage impossible, and Article 8(2) then requires all reasonable efforts to propose an acceptable alternative transport.

Article 9(2) requires carriers and terminal operators to make their access conditions for the transport of disabled persons and persons with reduced mobility publicly available physically or on the Internet, in accessible formats on request, and in the same languages as those in which information is generally made available to all passengers.

Article 9(4) requires carriers, travel agents and tour operators to ensure that all relevant information, including online reservation and information, concerning the conditions of carriage, journey information and access conditions is available in appropriate and accessible formats for disabled persons and persons with reduced mobility.

Article 12(1) requires carriers, terminal operators, travel agents and tour operators to take all measures necessary for the request for, and the reception of, notifications of the need for assistance, at all their points of sale, including sale by telephone and over the Internet.

Each Member State designates a body or bodies responsible for the enforcement of the Regulation as regards passenger services and cruises from ports situated on its territory and passenger services from a third country to such ports (Article 25(1)), and Article 28 has the Member States lay down rules on penalties, which shall be effective, proportionate and dissuasive; the Regulation sets no amount.

The Regulation applies from 18 December 2012 and is binding in its entirety and directly applicable in all Member States (Article 31).

Article 42(1) of Directive 2014/24/EU requires that, for all procurement which is intended for use by natural persons, whether general public or staff of the contracting authority, the technical specifications be drawn up, except in duly justified cases, so as to take into account accessibility criteria for persons with disabilities or design for all users.

Where mandatory accessibility requirements are adopted by a legal act of the Union, technical specifications shall, as far as accessibility criteria for persons with disabilities or design for all users are concerned, be defined by reference thereto. Article 24(1) of Directive (EU) 2019/882 makes the accessibility requirements set out in its Annex I mandatory accessibility requirements within the meaning of Article 42(1) for the products and services referred to in its Article 2.

Where a contracting authority refers to a standard or other technical specification under Article 42(3)(b), Article 42(5) bars it from rejecting a tender on the grounds that what is tendered does not comply with it, once the tenderer proves in its tender by any appropriate means, including the means of proof referred to in Article 44, that the solutions proposed satisfy in an equivalent manner the requirements defined by the technical specifications.

The Directive applies to procurements with a value net of value-added tax estimated to be equal to or greater than the thresholds in Article 4, which the Commission verifies every two years and revises where necessary (Article 6). It is addressed to the Member States (Article 94), which were to bring into force the laws, regulations and administrative provisions necessary to comply with it by 18 April 2016 (Article 90(1)).