AI and data laws

311 moving · 704 enacted

European UnionEuropean UnionLawCommission Implementing Regulation (EU) 2024/2690

NIS2 Implementing Regulation on technical requirements and significant incidents

Sets the technical and methodological cybersecurity risk management requirements under NIS2 for digital infrastructure and digital service providers, such as cloud, data centre and managed security providers, and defines when their incidents count as significant.

In forceIntroducedCommitteeFloorLawIn force

Enters into force, repealing Implementing Regulation (EU) 2018/151Nov 7, 2024 2 years ago

Body
European Commission
Introduced
Oct 17, 2024
In effect since
Nov 7, 20242 years ago

Timeline

  1. Nov 7, 2024 2 years ago

    Enters into force, repealing Implementing Regulation (EU) 2018/151

  2. Oct 17, 2024 2 years ago

    Commission adopts the implementing regulation under Articles 21(5) and 23(11) of NIS2

European Union
European Unionunverified

Digital Legislation Overhaul Package

The Council of the European Union agreed on its negotiating position regarding updates to data protection, cookie, data sharing, and incident reporting rules.

Passed one chamber
European Union
European UnionCOM(2026) 11

Cybersecurity Act 2 (revision of the Cybersecurity Act)

Proposed regulation that would replace the 2019 Cybersecurity Act, strengthening ENISA, simplifying the EU cybersecurity certification framework, and adding measures to reduce ICT supply chain risks from high-risk third-country suppliers.

Proposed
European Union
European UnionCOM(2026) 502 (2026/0138(COD))

Cloud and AI Development Act

Proposed regulation to speed up permitting and deployment of data centres, aim to at least triple EU data centre capacity, and create an EU-wide four-level cloud and AI sovereignty framework with a public sector procurement mechanism.

Proposed
European Union
European UnionRegulation (EU) 2024/2847

Cyber Resilience Act

Sets mandatory cybersecurity requirements for hardware and software products with digital elements sold in the EU, including vulnerability handling and incident reporting duties for manufacturers.

In force
European Union
European UnionCouncil Regulation (EU) 2026/150

EuroHPC AI Gigafactories amendment

Amends the EuroHPC Joint Undertaking regulation to provide a legal basis for AI Gigafactories of more than 100,000 advanced AI processors and to expand quantum computing activities.

In force
European Union
European UnionDirective (EU) 2022/2555

NIS2 Directive

Sets cybersecurity risk management and incident reporting obligations for medium and large entities in critical sectors and requires member states to supervise and enforce them.

In force

Change log

  • AddedAdded to the list. Set by hand from the official record.Sep 27

Summaries of public legislative records, executive actions and court rulings, for reference, not legal advice. Check the official page linked on each item. First seen 2026-09-27. Checked against the official source.