ADOPTED2 Dec 2026 · AI Act
EU AI Act — new prohibitions apply
Reg. (EU) 2026/1744 adds prohibitions (non-consensual intimate content, CSAM) and a content-marking deadline.
— Resources
EU law first. Always dated.
The instruments every DPOne assessment is built on. Snapshot 2026-11-12; statuses are re-verified against EUR-Lex, the EDPB and the Dutch AP before each release. Proposals are never presented as law.
Regulatory intelligence
IN_FORCE15 Aug 2026 · NIS2
Cyberbeveiligingswet (NIS2) in force
Replaces the Wbni. Screen whether you are in a covered sector or supply one.
IN_FORCE11 Sep 2026 · CRA
Cyber Resilience Act reporting duties
Actively exploited vulnerabilities must be reported for products with digital elements.
PROPOSAL21 Oct 2026 · Proposal
Digital Omnibus — still a proposal
Council mandate agreed; not law. Current GDPR and cookie rules apply in full.
Instruments in scope
| Instrument | Status | Why it matters |
|---|---|---|
| GDPR Regulation (EU) 2016/679 | APPLICABLE Applies since 25 May 2018 | Principles, lawful basis, rights, accountability, processors, security, breaches, DPIA, DPO, transfers. |
| UAVG Uitvoeringswet AVG (NL) | IN_FORCE In force since 25 May 2018 | Dutch rules on special-category data, criminal data and BSN. |
| ePrivacy / Telecommunicatiewet art. 11.7a Directive 2002/58/EC | IN_FORCE In force | Consent before non-essential cookies and similar technologies. |
| EU AI Act Regulation (EU) 2024/1689 (as amended by Reg. (EU) 2026/1744) | PHASED In force since 1 Aug 2024; general application 2 Aug 2026; Annex III high-risk from 2 Dec 2027 | AI inventory, risk tier, prohibited practices, AI literacy, transparency. |
| NIS2 / Cyberbeveiligingswet Directive (EU) 2022/2555 | IN_FORCE Cbw in force since 15 Aug 2026 | Applicability screening for covered sectors and their suppliers. |
| Data Act Regulation (EU) 2023/2854 | APPLICABLE Applies since 12 Sep 2025 | Connected-product data access and cloud switching (SaaS/IoT). |
| Digital Services Act Regulation (EU) 2022/2065 | APPLICABLE Fully applicable since 17 Feb 2024 | Hosting services and online platforms (conditional). |
| Data Governance Act Regulation (EU) 2022/868 | APPLICABLE Applies since 24 Sep 2023 | Data intermediation & altruism (conditional). |
| Cyber Resilience Act Regulation (EU) 2024/2847 | PHASED Reporting duties from 11 Sep 2026; main obligations 11 Dec 2027 | Products with digital elements: secure by design, vulnerability handling. |
| International transfers GDPR Ch. V · DPF (2023/1795) · SCCs (2021/914) | IN_FORCE DPF upheld by General Court 3 Sep 2025 (T-553/23); appeal C-703/25 P pending | Vendor and AI-provider transfer mapping. |
| eIDAS Regulation (EU) No 910/2014 (amended 2024/1183) | IN_FORCE In force | Legal effect of electronic signatures (Art. 25). |
| Digital Omnibus (proposal) COM(2025) 837 | PROPOSAL Council mandate 21 Oct 2026; Parliament position pending — NOT law | Horizon item only; current GDPR/ePrivacy apply in full. |