NIS2, GDPR, EU AI Act, DORA and CRA, summarised and prioritised for SMB compliance leads.
Essential entities must now submit an early warning within 24 hours and a full incident report within 72 hours. The guidance clarifies what counts as a "significant incident" and replaces the May 2025 draft that left timing ambiguous.
Providers of GPAI models placed on the EU market will need to publish a sufficiently detailed summary of training data. Consultation closes 30 June; SMB providers fall in scope above the 10 PFLOPs threshold.
The board confirms that automated decision-making rules under Article 22 GDPR continue to apply alongside the AI Act high-risk obligations. Joint controllership clarified for fine-tuning customer data into vendor models.
Financial entities must maintain a register at solo, sub-consolidated and consolidated level and submit it annually. The RTS sets the exact data fields, including subcontractor chains down to the third tier.
Workplan published. Most products with digital elements will use self-assessment; "important" categories (II) require a notified body. SMBs producing connected hardware should plan documentation and SBOM workflows now.
Non-binding but strongly indicative of the French CSIRT's enforcement posture. Confirms that letters of comfort from suppliers are insufficient — contractual clauses with audit rights are now expected.
Critical regulatory updates summarised and prioritised for EU SMBs. Free while in beta.