Which EU files you should actually staff — and what to do first.

Size

What you do

• We sell, import, or operate in the EUThe usual on-switch for product and data rules.
• We hold customer or staff dataGDPR sits under almost everything else.
• We employ people in the EUPay transparency and workplace AI.
• We build or seriously deploy AIChat widgets vs hiring tools are different worlds.
• We run a site, app, shop, or marketplaceDSA scales with size; DMA is for giants.
• We import steel, aluminium, cement, fertiliser, electricity or hydrogenCBAM.
• Coffee, cocoa, soy, palm oil, cattle, rubber or woodDeforestation due diligence.
• We put packaged goods on the EU marketDesign, reuse, and labelling.
• We make or import connected devices or software productsCyber Resilience Act.
• Energy, health, transport, food, water, or digital infrastructureNIS2.
• We are large, listed, or a big non-EU group with EU businessCSRD and CSDDD waves.
• We own, let, or develop buildingsEnergy performance of buildings.
• We are a bank, insurer, investment firm, or their ICT providerDORA, MiCA, taxonomy.
• We make, import or distribute physical productsSafety, ecodesign, batteries, liability.
• We manufacture, import or use chemicals or articles with themREACH.
• We handle health, EHR or medical dataEHDS.
• We run energy-intensive sites, data centres, or energy techEED, NZIA.

Your stack

1. GDPR

   Act now

   We sell, import, or operate in the EU · We hold customer or staff data

   Anyone using your personal data needs a lawful reason, has to be clear about it, and you can ask to see, fix, or delete much of it.

   Do this first

   • Week 1: Write a one-page map: what data, why, where, who can see it.
   • Week 2: Pick a lawful basis per purpose. Stop using consent as wallpaper.
   • Week 3: Fix vendor list and transfer clauses for the tools you actually use.
   Full impact and compliance notes

2. Digital Services Act

   Act now

   We sell, import, or operate in the EU

   Very large platforms have to explain their feeds, take illegal content seriously, and stop dark patterns — without making every comment section a courtroom.

   Do this first

   • Week 1: Decide your role: mere conduit, caching, hosting, online platform, or VLOP.
   • Week 2: Publish a usable notice channel and a statement-of-reasons template.
   • Month 2: If you are a platform: trader traceability, ToS in plain language, and points of contact for authorities.
   Full impact and compliance notes

3. CBAM

   Act now

   We sell, import, or operate in the EU

   If you import carbon-heavy goods like steel or cement into the EU, you start paying a carbon price similar to what EU factories already pay.

   Do this first

   • This week: List CN codes you import against the CBAM goods list.
   • This month: Register / authorise the declarant and pick the reporting tool.
   • This quarter: Ask mills for actual embedded emissions; agree a data format.
   Full impact and compliance notes

4. GPSR

   Act now

   We sell, import, or operate in the EU

   Anything sold to consumers in the EU — including via a marketplace and including from outside the Union — must be safe, traceable, and recallable, with a responsible economic operator in the EU.

   Do this first

   • Week 1: Map economic-operator role per SKU (manufacturer / importer / authorised rep / fulfilment).
   • Week 2: EU responsible person named and visible for extra-EU goods.
   • Month 1: Recall and accident-reporting playbook, including marketplace SKUs.
   Full impact and compliance notes

5. Accessibility Act

   Act now

   We sell, import, or operate in the EU

   Phones, computers, payment terminals, e-commerce, banking services, e-books and some transport ticketing must be usable by people with disabilities — by design, not by a hidden PDF.

   Do this first

   • This week: Decide which products/services are listed in Annex I.
   • This month: Audit the consumer site/app against EN 301 549 / WCAG 2.2 AA.
   • This quarter: Conformity documentation and an accessibility statement that matches reality.
   Full impact and compliance notes

6. Right to Repair

   Act now

   We sell, import, or operate in the EU

   Manufacturers of listed goods (phones, washers, TVs…) must offer repair beyond the legal guarantee, at a reasonable price, and sellers must mention repair before they push replacement.

   Do this first

   • This week: Map SKUs to Annex II.
   • 31 Jul 2026: Public repair-information page and a quote process using the European form.
   Full impact and compliance notes

7. REACH

   Act now

   We sell, import, or operate in the EU

   No data, no market: chemicals manufactured or imported at a tonne or more need a registration, and the most harmful ones can be restricted or need an authorisation to stay.

   Do this first

   • This month: Inventory substances, tonnages, and only-representative status.
   • This quarter: Article 33 process for candidate-list substances in articles.
   Full impact and compliance notes

8. Single-use plastics

   Act now

   We sell, import, or operate in the EU

   A list of throwaway plastic items is banned or restricted, bottles need recycled content and caps that stay attached, and producers pay for the litter.

   Do this first

   • This week: SKU check against the banned list and the EPR list.
   • This quarter: Bottle recycled-content and tethered-cap status; EPR registration.
   Full impact and compliance notes

9. AI Act

   This year's work

   We sell, import, or operate in the EU

   The EU sorts AI by how much harm it could do — banning a few uses, tightly watching high-risk ones, and asking chatbots to be honest about being machines.

   Do this first

   • Week 1: Inventory every AI system, including embedded vendor tools.
   • Week 2: Classify: prohibited / high-risk / GPAI / transparency-only.
   • Week 3: Kill or redesign anything that looks like social scoring, untargeted face scraping, or workplace emotion recognition.
   Full impact and compliance notes

10. Deforestation rules

    This year's work

    We sell, import, or operate in the EU

    Coffee, cocoa, soy, palm oil, cattle, rubber, wood — if it grew on land deforested after 2020, it should not be sold in the EU.

    Do this first

    • Now: Classify SKUs against the commodity/product annex.
    • Now: Decide operator vs trader for each flow.
    • 90 days: Collect geolocation and legality evidence; test a due-diligence statement in the information system.
    Full impact and compliance notes

11. Packaging rules

    This year's work

    We sell, import, or operate in the EU

    Less wrapping, more reuse, and packaging that can actually be recycled — including bans on some single-use formats.

    Do this first

    • This quarter: SKU-level packaging bill of materials: weight, polymer, recycled content, reuse vs single-use.
    • This quarter: Join or confirm EPR registration where you sell.
    Full impact and compliance notes

12. Data Act

    This year's work

    We sell, import, or operate in the EU

    If a connected product generates data — a tractor, a car, a factory sensor — you should be able to get that data and share it with a repair shop of your choice.

    Do this first

    • Before Sep 2025: Define user access and third-party sharing flows for product data.
    • Before Sep 2025: Rewrite B2B data terms against the unfair-terms list.
    Full impact and compliance notes

13. ESPR

    This year's work

    We sell, import, or operate in the EU

    Almost every physical product on the EU market will, over time, need a durability, repair and recycled-content story — and a Digital Product Passport that follows the item.

    Do this first

    • This month: Map SKUs to the Commission working plan.
    • This quarter: Stop destruction of unsold goods where the ban already bites; log the rest.
    • This year: Supplier data fields for composition and repair, ready for DPP.
    Full impact and compliance notes

14. Batteries Regulation

    This year's work

    We sell, import, or operate in the EU

    EV, industrial and portable batteries sold in the EU need carbon footprints, recycled content, due diligence on raw materials, and a passport — plus collection and recycling that actually happens.

    Do this first

    • Week 1: Classify every SKU: portable, LMT, industrial, EV, SLI.
    • Month 1: Producer-responsibility registration in the Member States you sell into.
    • This year: Footprint data path and due-diligence system for the 2027 wave.
    Full impact and compliance notes

15. Green-transition consumer rules

    This year's work

    We sell, import, or operate in the EU

    Vague green badges, fake durability scores and offset-only ‘climate neutral’ claims become unfair commercial practices — before a later, still-fought Green Claims Directive adds extra files.

    Do this first

    • This quarter: Inventory every environmental claim on pack, ads, and site.
    • This quarter: Kill generic badges and offset-only neutrality lines.
    • Before Sep 2026: Substantiation file or a recognised scheme for whatever remains.
    Full impact and compliance notes

16. Data Governance Act

    This year's work

    We hold customer or staff data · We sell, import, or operate in the EU

    Rules for sharing data that is not a free-for-all: public-sector reuse, trusted data intermediaries, and altruism — with a ban on using the intermediary hat to exploit the data.

    Do this first

    • This month: Decide whether any product is intermediation vs. a controller using its own data.
    • If intermediating: Notify the competent authority and split the commercial hat from the pipe.
    Full impact and compliance notes

17. eIDAS 2

    This year's work

    We hold customer or staff data

    A European digital identity wallet: you prove who you are — and only the attribute needed — to public services and to many private relying parties, without a new password zoo.

    Do this first

    • This quarter: Inventory where you currently require eIDAS, video-KYC, or a passport scan.
    • This year: Wallet-acceptance architecture and data-minimisation of the onboarding form.
    Full impact and compliance notes

18. Cyber Resilience Act

    Build toward

    We sell, import, or operate in the EU

    Connected products — from baby monitors to industrial sensors — must ship with security updates and without known gaping holes.

    Do this first

    • This year: Classify products (default vs important/critical) and set a support-period policy.
    • This year: Stand up vulnerability intake (security@) and coordinated disclosure.
    Full impact and compliance notes

19. Forced labour ban

    Build toward

    We sell, import, or operate in the EU

    Products made with forced labour cannot be sold, imported or exported in the EU — with investigations, a public database, and customs that can stop a shipment.

    Do this first

    • This quarter: Overlay CSDDD/EUDR maps with forced-labour risk indicators.
    • This year: Contract clauses: audit, information, and exit if an investigation opens.
    • Before 2027: A response pack for authority information requests.
    Full impact and compliance notes

20. Product Liability Directive

    Build toward

    We sell, import, or operate in the EU

    If a product — including software and AI — injures someone or damages property, it is easier to sue the company that put it on the EU market, with disclosure and presumptions built for black-box goods.

    Do this first

    • This year: Insurance and supplier-indemnity gap vs the recast (software, AI, component stacking).
    • This year: Preserve design, update and incident logs as if they will be disclosed.
    • Before Dec 2026: Confirm who is ‘manufacturer’ on extra-EU SKUs.
    Full impact and compliance notes

21. EHDS

    Build toward

    We hold customer or staff data

    Your health data should follow you across the Union for care, and — with safeguards — be reusable for research and policy, under a new set of health-data access bodies.

    Do this first

    • This year: Classify the product: EHR, wellness, medical device — or all three.
    • Before secondary use: Permit path via a health-data access body; do not scrape.
    Full impact and compliance notes

22. AML Regulation

    Build toward

    We sell, import, or operate in the EU

    Customer due diligence, beneficial ownership and cash limits become a single Union rulebook for banks, crypto, lawyers in scope, and many traders — watched by a new Authority in Frankfurt.

    Do this first

    • This year: Gap current 6AMLD/national CDD vs the Regulation text.
    • Before 2027: Beneficial-ownership data quality and group-wide policies under a regulation, not 27 manuals.
    Full impact and compliance notes