From 11 September 2026, manufacturers of products with digital elements sold in the EU must report actively exploited vulnerabilities and severe security incidents to ENISA reporting platform (SRP) and their national CSIRT under Article 14 of the Cyber Resilience Act (Regulation (EU) 2024/2847). The CRA vulnerability reporting cascade runs on three deadlines: a 24-hour early…

What the Data (Use and Access) Act 2025 changed, where the two regimes now differ, and what dual compliance actually requires. This guide reflects the EU GDPR, the UK GDPR as amended by the Data (Use and Access) Act 2025, and the European Commission’s adequacy decisions as at August 2026.

In GDPR, DPA is the Data Processing Agreement. Under Article 28 GDPR, a controller may only use a processor that provides sufficient guarantees, and the relationship must be governed by a written contract. That contract is the Data Processing Agreement, usually shortened to DPA. Most organisations have DPAs in place. Fewer have DPAs that would…

A practical legal guide to the Digital Operational Resilience Act (Regulation (EU) 2022/2554)

PCI compliance refers to adherence to the Payment Card Industry Data Security Standard (PCI DSS), a set of security requirements that applies to any organisation that stores, processes, or transmits payment card data. In the UK, PCI compliance is not a statutory legal obligation in the way that GDPR is, but it is a contractual…

A practical legal guide for manufacturers of connected products navigating Regulation (EU) 2023/2854 The EU Data Act has applied since 12 September 2025. It creates binding obligations for manufacturers of connected products and related service providers, covering data access rights, data sharing obligations, contractual fairness requirements, and cloud switching obligations. For IoT device manufacturers specifically,…

By Yuliia Habriiel, Regulatory Lawyer. Last reviewed 12 August 2026, against the AI Act as amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI). EU AI Act compliance requires between six and twenty-five documents, depending on your role and your risk tier. Every organisation using AI needs the same six baseline records: an AI system inventory,…

FRAND prohibits exploitative contracts, caps compensation costs for SMEs, and stops market incumbents from discriminating against competitors seeking data access.

July 2026 is the month AI compliance stopped being a European planning exercise and became a global operational reality simultaneously across multiple binding regimes. The question is no longer whether regulation is coming. It is whether your compliance infrastructure was built for one framework or for the world as it actually is. EU: Digital Omnibus…

Last updated: 29 July 2026 Summary The EU AI Act applies to anyone who develops, sells, or uses an AI system whose output reaches the EU market, regardless of where that company is based. It catches four main actors: providers (who build or sell the system), deployers (who use it in their own operations), importers,…