AI and data laws

Moving311Enacted704

311 moving · 704 enacted

European UnionEuropean UnionLawDirective (EU) 2022/2555

NIS2 Directive

Sets cybersecurity risk management and incident reporting obligations for medium and large entities in critical sectors and requires member states to supervise and enforce them.

In forceIntroducedCommitteeFloorLawIn force

Commission refers Ireland, Spain, France and the Netherlands to the Court of Justice for failing to transpose NIS2Jul 8 4 months ago

Body
European Parliament and Council
Session
9th parliamentary term
Introduced
Dec 16, 2020
In effect since
Jan 16, 20233 years ago
Topics
Cyber
Official page Source: EUR-Lex; European Parliament Legislative Observatory; European Commission

Timeline

  1. Jul 8 4 months ago

    Commission refers Ireland, Spain, France and the Netherlands to the Court of Justice for failing to transpose NIS2

  2. Jan 20 9 months ago

    Commission proposes targeted NIS2 amendments COM(2026) 13 on jurisdiction, ransomware reporting and cross-border supervision

  3. Nov 19, 2025 11 months ago

    Digital Omnibus proposal COM(2025) 837 proposes a single entry point for incident reporting

  4. May 7, 2025 1 year ago

    Commission sends reasoned opinions to member states that had not notified transposition

  5. Nov 28, 2024 1 year ago

    Commission sends letters of formal notice to member states that had not notified transposition

  6. Oct 17, 2024 2 years ago

    Transposition deadline for member states; Commission adopts Implementing Regulation (EU) 2024/2690 on technical and methodological requirements

  7. Jan 16, 2023 3 years ago

    Enters into force

  8. Dec 27, 2022 3 years ago

    Published in the Official Journal

  9. Dec 14, 2022 3 years ago

    Final act signed

  10. Nov 28, 2022 3 years ago

    Council adopts the act

  11. Nov 10, 2022 4 years ago

    Parliament adopts its first reading position

  12. Jul 13, 2022 4 years ago

    ITRE committee approves the text agreed in trilogue

  13. Oct 28, 2021 5 years ago

    ITRE committee vote and decision to open negotiations

  14. Dec 16, 2020 5 years ago

    Commission proposal COM(2020) 823 published, procedure 2020/0359(COD)

European Union
European Unionunverified

Digital Legislation Overhaul Package

The Council of the European Union agreed on its negotiating position regarding updates to data protection, cookie, data sharing, and incident reporting rules.

Passed one chamber
European Union
European UnionCOM(2026) 11

Cybersecurity Act 2 (revision of the Cybersecurity Act)

Proposed regulation that would replace the 2019 Cybersecurity Act, strengthening ENISA, simplifying the EU cybersecurity certification framework, and adding measures to reduce ICT supply chain risks from high-risk third-country suppliers.

Proposed
European Union
European UnionRegulation (EU) 2024/2847

Cyber Resilience Act

Sets mandatory cybersecurity requirements for hardware and software products with digital elements sold in the EU, including vulnerability handling and incident reporting duties for manufacturers.

In force
European Union
European UnionRegulation (EU) 2025/38

Cyber Solidarity Act

Sets up a European Cybersecurity Alert System of cross-border Cyber Hubs, a Cybersecurity Emergency Mechanism with an EU Cybersecurity Reserve, and a review mechanism for significant incidents.

In force
European Union
European UnionDirective (EU) 2024/2853

Product Liability Directive

Replaces the 1985 product liability rules and extends no-fault liability for defective products to software, including AI systems, digital manufacturing files and related digital services.

In force

Change log

  • AddedAdded to the list. Set by hand from the official record.Sep 27

Summaries of public legislative records, executive actions and court rulings, for reference, not legal advice. Check the official page linked on each item. First seen 2026-09-27. Checked against the official source.