binding law
the laws
Binding EU rules. Each has its own page: open the one that covers you and skip the rest.
- lawNIS2The EU cybersecurity directive for 18 sectors. It reaches you through your national law and comes with a board signature, 24-hour warnings and ten kinds of security work.open
- lawDORAICT resilience for finance, applying directly since 17 January 2025. If you sell software to a bank, it arrives on your desk as contract terms.open
- lawAI ActIf your staff use AI at work, you are probably a deployer. The high-risk dates moved in July 2026. The literacy duty and the bans did not.open
- lawGDPRIt almost certainly applies to you already. This page covers the security side: appropriate measures, processors, the 72-hour clock and being able to show your work.open
- lawCyber Resilience ActA regulation on the security of products that contain software: connected hardware and software sold in the EU. Reporting of exploited vulnerabilities has applied since 11 September 2026. The main duties start on 11 December 2027.open
- lawCER DirectiveThe EU directive on the resilience of critical entities: physical, operational and people risk for the operators a member state names. Identification was due by 17 July 2026, and duties start from the notice each entity receives.open
- lawData ActA regulation on who may access and use data from connected products, how cloud customers can leave a provider, and which data clauses between businesses do not bind. It has applied since 12 September 2025.open
- lawRED cybersecurityCybersecurity requirements for radio devices that connect to the internet, plus toys, childcare and wearable devices. They have applied since 1 August 2025 and give way to the Cyber Resilience Act on 11 December 2027.open
- lawProduct Liability DirectiveLiability law: who pays when a defective product harms a person. Software counts as a product, and the new rules reach products placed on the market after 9 December 2026.open