The EU digital regulatory landscape features key deadlines from GDPR to the AI Act and CRA, with obligations applying in stages from 2018 through 2027. European SMEs must monitor transposition dates and prepare early for compliance, especially with complex new laws like NIS2 and the CRA.
The central question for every European SME in 2026 is: When do which EU digital regulations apply, and what must businesses do to comply? This timeline-driven guide answers that directly, offering a practical overview of the most important laws, their deadlines, and specific actions for small and midsize companies. From the GDPR in 2018 to the NIS2 Directive, Digital Services Act, AI Act and Cyber Resilience Act (CRA), the compliance calendar is crowded and complex—but every business can map its core obligations and timeline starting here.
- Key laws include GDPR (since 2018), NIS2 (October 2024), the AI Act (starting 2026) and CRA (from 2026–2027).
- Deadlines for transposing and applying these rules differ; directives like NIS2 require national implementation.
- SMEs must identify which laws apply to them and prepare for technical and documentation requirements ahead of time.
EU digital regulation timeline: key dates at a glance
The European Union has introduced a sequence of major digital rules, each with staggered compliance deadlines. Regulations like the GDPR, Digital Services Act (DSA), Digital Markets Act (DMA), and AI Act generally apply directly, while directives such as NIS2 must be transposed by Member States—creating both EU-wide and country-specific dates. For clarity, businesses should track both entry-into-force and application deadlines, noting transitional provisions where relevant.
2018–2023: GDPR and the first platform rules
The EU General Data Protection Regulation (GDPR) has set the baseline for digital compliance since 25 May 2018, imposing strict obligations on any entity processing the personal data of EU residents, regardless of sector or company size. Privacy by design, mandatory reporting of data breaches, and clear consent management became standard, affecting every digital business model.
From August 2023, the DSA started applying to very large online platforms and search engines. By February 2024, all other intermediaries and marketplaces joined the scope, mandating risk assessments, content moderation transparency, and tighter cooperation with authorities on illegal content.
The DMA, meanwhile, entered force for ‘gatekeeper’ platforms in March 2024, demanding new simplicity, fairness, and interoperability in core digital services.
2024–2025: NIS2, DORA, the AI Act and Data Act
From 17 October 2024, every EU Member State must have transposed the revised NIS2 Directive into national law. NIS2 expands cybersecurity obligations to many more sectors—including healthcare, transport, energy, digital infrastructure, and, for the first time, various types of SMEs—setting standards for risk assessment, technical controls, incident reporting, and board-level accountability. Early legal reviews urged businesses to start gap assessments and staff training before the deadline, due to the technical and policy scope involved.
[5]
The Digital Operational Resilience Act (DORA) applies from 17 January 2025, mainly impacting financial services and technology suppliers, with its own set of ICT risk management guidelines and reporting demands. The Data Act is due to take effect from 12 September 2025, focusing on data sharing obligations and user rights in digital and connected product ecosystems.
The EU Artificial Intelligence Act (AI Act) entered into force in 2024, but its obligations unfold over several years. Some transparency provisions affect general-purpose AI from mid-2025, while high-risk AI systems face more extensive requirements later.
2026–2027: AI Act and Cyber Resilience Act deadlines
The AI Act is phased: transparency requirements relevant to high-impact AI models apply by 2 August 2026. The most stringent rules, including conformity assessments and registry obligations for high-risk AI systems, become mandatory from December 2027. Embedded high-risk AI in regulated products (such as medical or industrial devices) faces additional requirements from August 2028.
The Cyber Resilience Act (CRA)—finalized in 2024–2025—ushers in obligations for manufacturers and importers of ‘products with digital elements’: reporting major cyber incidents from 11 September 2026, full compliance with security by design and documentation controls by 11 December 2027. The CRA goes beyond traditional software rules, imposing lifecycle security and vulnerability handling for the first time.
Which EU digital rules apply to your business?
For SMEs and mid-sized companies, the answer depends on sector, role in the supply chain, and location. GDPR applies to all entities handling EU residents’ personal data. NIS2 reaches beyond large infrastructure providers to select SMEs in sectors deemed ‘essential’ or ‘important’ by national law. DORA primarily targets the financial sector. The DSA and DMA catch online platforms and digital gatekeepers, while the AI Act and CRA are broad but risk and product-type specific.
[5]
Certain deadlines are fixed at EU level, but others (especially under NIS2) rest on national legislation—so individual Member States may interpret or scope the rules differently. Mapping your company’s size, sector, and digital touchpoints is the essential starting point for compliance planning.
Practical compliance actions for SMEs
While the regulations themselves are complex, the SME’s basic playbook is straightforward: track regulatory deadlines, conduct a detailed scoping assessment, and assign clear internal responsibility. For GDPR and DSA, this means reviewing and updating privacy, consent, and moderation processes. NIS2 and the CRA typically require IT upgrades, strengthened incident management, and documented risk assessments. With the AI Act, SMEs deploying or supplying high-risk AI must implement transparency, data governance, and rigorous technical documentation.
[5]
Legal commentators stress the importance of starting compliance work early—especially given ongoing uncertainties about some implementing acts and official guidance, particularly under the CRA and AI Act.
How to manage overlapping obligations
Multiple EU digital rules often apply at once—sometimes imposing separate but related obligations on the same teams or IT systems. For example, the DSA and DMA overlap with aspects of GDPR (data processing) and the Data Act (data sharing), while NIS2 and the CRA both address cybersecurity and incident reporting, but via different mechanisms.
The best approach for SMEs is to centralize compliance monitoring, develop cross-referenced policies, and use transition checklists tailored to both EU-wide and national requirements. Coordination across legal, IT, and business teams is especially crucial for companies operating in multiple Member States, since varying national implementations can add to the complexity.
[5]
Typical problems
Many businesses, especially SMEs, initially underestimate the technical scale and required resources for new regulations like NIS2 and the CRA, risking late or incomplete compliance and potential penalties.
[5]
Meanwhile, uncertainty due to delayed or evolving guidance for implementing acts—particularly with the AI Act and CRA—can make advance planning challenging, even for diligent companies.
Recent updates and policy developments
The final text of the AI Act was approved by the European Council in spring 2024, clarifying staged deadlines based on the risk category of AI systems. Several Member States are now actively transposing NIS2 into national law, with the October 2024 deadline driving consultations and draft legislation. Monitoring these updates is essential, as timelines or interpretations may still shift at national level.
[5]
Sources
[5] NIS2 Directive: What to Expect in 2024 (DLA Piper, 2024-03-06)
