Global compliance guide

EU Technology Compliance Hub

Plain English guide to tech regulation in the EU — updated July 2026

1. EU AI Act

What it is: A risk-based framework for developing, supplying, and using AI in the European Union.
Who it applies to: AI providers, deployers, importers, and distributors in the EU, plus overseas organisations whose AI output is used in the EU.
Key deadlines: Phased application began in 2025. Major transparency duties apply from 2 August 2026; additional high-risk duties phase in through 2027.
Penalties for non-compliance: Depending on the breach, fines can reach €35 million or 7% of worldwide annual turnover.

Not sure if this applies to you? The free audit takes 4 minutes.

What it is: Cybersecurity governance, risk-management, supply-chain, and incident-reporting rules for important and essential entities.
Who it applies to: Medium and large organisations in covered sectors, plus some critical entities regardless of size.
Key deadlines: Member states were due to transpose NIS2 by 17 October 2024. National registration and implementation dates vary.
Penalties for non-compliance: Maximum administrative fines can reach €10 million or 2% of worldwide annual turnover for essential entities.

Not sure if this applies to you? The free audit takes 4 minutes.

What it is: A harmonised digital operational-resilience framework for the EU financial sector.
Who it applies to: Banks, insurers, investment firms, payment providers, crypto-asset providers, and relevant ICT suppliers.
Key deadlines: Applied from 17 January 2025; registers, contracts, testing, governance, and incident processes must remain current.
Penalties for non-compliance: Financial penalties and supervisory measures vary by member state; critical ICT providers can face periodic payments.

Not sure if this applies to you? The free audit takes 4 minutes.

What it is: Safety and conformity rules for machinery, including connected, autonomous, and AI-enabled products.
Who it applies to: Manufacturers, importers, distributors, and other economic operators placing machinery in the EU market.
Key deadlines: Regulation (EU) 2023/1230 generally applies from 20 January 2027.
Penalties for non-compliance: Member states set effective and proportionate penalties, alongside withdrawal, recall, and market-access action.

Not sure if this applies to you? The free audit takes 4 minutes.

What it is: Rules for access to and use of connected-product data, cloud switching, and unfair data-contract terms.
Who it applies to: Manufacturers of connected products, related service providers, data holders, users, and cloud providers.
Key deadlines: Most provisions applied from 12 September 2025, with some product-design duties applying later.
Penalties for non-compliance: Member-state penalties apply; personal-data breaches can also trigger GDPR-level sanctions.

Not sure if this applies to you? The free audit takes 4 minutes.

Operating across multiple jurisdictions? NudgeCompliant maps your obligations across all of them in one audit.

This guide is for information only — not legal advice. Requirements change, so confirm critical decisions with a qualified professional.

Tell us what technology you use and where you operate. Get a plain-English readout of what matters — and what doesn't.

No account. No card. Start with the obligations that matter now.