Afghanistan: Compliance

The EU Cyber Resilience Act introduces mandatory cybersecurity requirements for software and digital products entering the European market, including CE marking and free security updates. With compliance deadlines approaching in December 2027, companies must begin preparing their conformity assessment processes now to meet these far-reaching obligations that may fundamentally reshape go-to-market strategies.

The European Commission has proposed replacing the EU's three public procurement directives with a single, directly applicable regulation that would fundamentally transform how public contracts are awarded across Member States. This comprehensive reform aims to simplify procurement procedures, strengthen economic security through European preference principles, and elevate environmental and social considerations to strategic priorities. The proposal introduces extensive digitalisation measures and consolida

The European Banking Authority and European System of Central Banks have published responses to the Markets in Crypto-Assets Regulation consultation that signal a fundamental shift in EU digital finance architecture. Rather than expanding MiCAR's scope, regulators are focusing on repairing critical interfaces between crypto regulation and traditional financial services, addressing stablecoin liquidity, bank issuance models, group supervision, and the private-law treatment of tokens.

Starting January 2027, the Classification, Labelling and Packaging Regulation will explicitly designate distributors as duty holders, fundamentally changing how companies manage Poison Centre Notification requirements across the European Union supply chain. This regulatory clarification particularly impacts businesses that sell mixtures not covered by existing notifications or rebrand products under their own labels. Companies must now assess whether their current compliance framework adequately addresses t

The EU Forced Labour Regulation establishes comprehensive requirements for all companies operating in the EU market, regardless of size or sector, to ensure their products and supply chains are free from forced labour. New guidelines provide practical implementation measures that will shape enforcement practices when the regulation takes effect in December 2027.

The EU Cyber Resilience Act introduces mandatory cybersecurity requirements for products with digital elements sold in the European market, establishing a comprehensive framework for hardware and software security. Starting September 11, 2026, manufacturers face new reporting obligations for actively exploited vulnerabilities and severe security incidents, with strict timelines ranging from 24 hours to one month depending on the type of report.

The EU institutions have reached consensus on replacing SFDR's Articles 8 and 9 with three product categories, but significant disagreements persist on fossil fuel exposure criteria and whether alternative investment funds marketed exclusively to professional investors should be exempt from the new categorisation regime. These unresolved issues carry particular weight for private markets participants navigating the evolving regulatory landscape.

The European Union's Artificial Intelligence Act continues to evolve with significant regulatory updates that reshape compliance timelines and clarify key obligations. Recent developments include the Digital Omnibus on AI, which extends implementation deadlines for high-risk systems and introduces new prohibitions on harmful AI applications, alongside comprehensive guidance from the European Commission on classification criteria, transparency requirements, and general-purpose AI model obligations.

The European Union's AI Act introduces sweeping transparency requirements for AI-generated content, fundamentally redefining what constitutes a "deep fake" and imposing disclosure obligations that extend far beyond traditional understanding. With enforcement beginning August 2, 2026, companies using AI to create advertising, marketing materials, or public communications must navigate complex compliance requirements that may apply even to organizations with no physical presence in Europe.