EU cyber, data and AI regulation: what changes before October 2027

The European Union (EU) is doing two things at once. It is trimming and delaying parts of its digital rulebook, under a "Digital Omnibus" simplification drive. At the same time, new cyber duties are already live. Since 11 September 2026, makers of connected products and software sold in the EU must warn authorities within 24 hours of finding an actively exploited vulnerability [9]. Boards should not read "simplification" as "pause". The deadlines that moved are mostly for AI. The cyber reporting clocks are running now.

At a glance

• Cyber Resilience Act (CRA) reporting started on 11 September 2026, through a new single reporting platform run by ENISA, the EU cyber agency [9][11].
• High-risk AI rules are delayed to 2 December 2027 (stand-alone systems) and 2 August 2028 (AI built into products) [1].
• The AI Office has been able to fine providers of general-purpose AI models since 2 August 2026 [2].
• Four member states were taken to the EU Court of Justice on 8 July 2026 for not fully transposing NIS2, the main cyber law [4].
• Ireland's Data Protection Commission (DPC) fined Google €403m on 21 September 2026 [18].

The rulebook now

NIS2 Directive. Covers medium and large firms in 18 critical sectors. Member states had until 17 October 2024 to write it into national law [4]. Firms must send an early warning of a significant incident within 24 hours, a notification within 72 hours and a final report within a month [3]. Maximum fines must be at least €10m or 2% of global turnover for "essential" entities, and €7m or 1.4% for "important" ones. Senior managers can be held personally liable [3].

Digital Operational Resilience Act (DORA). Applies to banks, insurers, investment firms and other financial entities from 17 January 2025 [12]. A major ICT incident needs an initial notice within 4 hours of classifying it as major, and no later than 24 hours after detection. An intermediate report follows within 72 hours and a final report within a month [13]. Firms reported 3,383 major incidents in 2025. About 10% were cyber-related, and almost a third began with a failure at a third-party provider [15].

Cyber Resilience Act. In force since 10 December 2024. Rules for conformity-assessment bodies applied from 11 June 2026, and reporting from 11 September 2026. The main security-by-design duties and CE marking apply from 11 December 2027 [8][10]. Manufacturers report actively exploited vulnerabilities and severe incidents: an early warning within 24 hours, a notification within 72 hours, and a final report within 14 days of a fix (vulnerabilities) or one month (incidents) [9]. Micro and small firms cannot be fined for missing the 24-hour deadline for vulnerabilities [10].

AI Act. Banned practices and AI-literacy duties have applied since 2 February 2025. Rules for general-purpose AI (GPAI) models have applied since 2 August 2025 [1]. The Digital Omnibus on AI entered into force on 27 July 2026 and moved the high-risk dates back [1]. Fines reach €35m or 7% of global turnover for banned practices, and €15m or 3% for most other breaches, including GPAI duties [2].

Cyber Solidarity Act. In force since February 2025. It created an EU Cybersecurity Reserve of trusted private incident-response firms. ENISA runs it with €36m over three years, and it was due to be operational by the end of 2025 [27].

GDPR. Still the main data law. It is enforced mostly by national data protection authorities (DPAs), with Ireland's DPC leading on most big tech firms.

The regulators and how they behave

European Commission (DG CONNECT). Writes the rules and polices transposition. On 8 July 2026 it referred Ireland, Spain, France and the Netherlands to the Court of Justice over NIS2. It asked for lump sums and daily penalties [4]. The Netherlands' law then took effect on 15 August 2026, covering about 8,000 organisations [5]. Posture: firm on deadlines, but politically committed to cutting red tape.

AI Office. Part of the Commission. It supervises GPAI model providers and gained fining powers on 2 August 2026 [2]. Until then it focused on supporting implementation and holding compliance dialogues with providers [25]. No fines have been published so far. Posture: cooperative, now with enforcement powers.

ENISA. Not an enforcer, but its role is growing. It runs the CRA reporting platform, which went live on 11 September 2026 [11], and the Cybersecurity Reserve [27].

EDPB (European Data Protection Board) and the Irish DPC. The EDPB co-ordinates national DPAs. In March 2026, 25 DPAs launched a joint enforcement action on transparency, with findings due to be shared in the second half of 2026 [29]. The DPC issues the largest fines: €530m on TikTok in May 2025 for data transfers to China [17], and €403m on Google in September 2026 over location data [18]. The Google case looked at conduct from 2018 to 2020 [18]. DPC fines total over €4bn, but only about €20m has been collected, because fines must first be confirmed in court [19]. In 2025 the DPC received 6,521 breach notifications [20]. Posture: large fines, slow cases.

European Supervisory Authorities (EBA, EIOPA, ESMA). On 18 November 2025 they designated 19 critical ICT third-party providers (CTPPs) under DORA, including AWS, Google Cloud, Microsoft and Oracle [14]. They now oversee these providers directly. Posture: methodical, focused on supervision rather than fines.

CERT-EU. The cyber service for EU institutions. It tracked 174 threat actors in 2025, up from 110 the year before [30].

What's coming in the next 12 months

• Autumn 2026 to end 2026 (expected): Talks continue on the data part of the Digital Omnibus [21]. It would let firms report incidents under NIS2, GDPR, DORA and other laws through a single entry point run by ENISA [22]. It would also mean breaches go to DPAs only if they are likely to pose a high risk, with 96 hours to report rather than 72. The EDPB and EDPS (European Data Protection Supervisor) support both changes [23]. The Council aims to finish by the end of 2026. At the end of July, Parliament had not yet set its position [24].
• 2 December 2026: New AI Act bans on AI-generated intimate images and child sexual abuse material start [2]. The grace period for labelling AI-generated content also ends on this date [24].
• 9 December 2026: The new Product Liability Directive applies to products placed on the market from this date. It covers software, including AI systems [28].
• During 2026–27 (expected): Negotiations on the revised Cybersecurity Act and targeted NIS2 amendments, proposed on 20 January 2026 [7]. The NIS2 changes aim to ease compliance for 28,700 companies [6]. No adoption date has been set [CHECK].
• Expected 2027: Court of Justice cases against the states that still have not fully transposed NIS2 [4] [CHECK: whether the Netherlands case is withdrawn].
• 2 April 2027: The GDPR Procedural Regulation applies. It sets common rules and time limits for cross-border complaints: 15 months for standard investigations [26].
• During 2027: The ESAs plan on-site inspections and deep-dives at CTPPs, focusing on cybersecurity and frontier AI models, plus an annual update of the CTPP list [16][31].
• Just beyond the window: High-risk AI rules from 2 December 2027 [1]; full CRA obligations from 11 December 2027 [8].

What it means for organisations

• If you sell hardware or software in the EU, check that you can spot an actively exploited vulnerability and report it through ENISA's platform within 24 hours.
• Map which incident clocks apply to you: NIS2, DORA, GDPR and CRA run in parallel until a single entry point exists.
• Do not rely on NIS2 delays at home. Most states have national laws in force, and the duties attach wherever you operate.
• Financial firms should watch CTPP oversight findings and test exit plans for key cloud and IT suppliers.
• Use the extra AI time to classify systems now. High-risk duties still arrive in December 2027.
• Build product liability for software flaws into contracts and patching policies before 9 December 2026.

This article is for information only and is not legal advice.

Sources

1. European Commission, AI Act – regulatory framework for AI: https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
2. European Commission, The enforcement framework of the AI Act: https://digital-strategy.ec.europa.eu/en/policies/enforcement-ai-act
3. European Commission, NIS2 Directive FAQs: https://digital-strategy.ec.europa.eu/en/faqs/directive-measures-high-common-level-cybersecurity-across-union-nis2-directive-faqs
4. European Commission, Commission refers Ireland, Spain, France and the Netherlands to the Court of Justice (8 Jul 2026): https://digital-strategy.ec.europa.eu/en/news/commission-refers-ireland-spain-france-and-netherlands-court-justice-failing-transpose-rules
5. Rijksoverheid (Dutch government), Cyberbeveiligingswet en Wet weerbaarheid kritieke entiteiten vanaf 15 augustus 2026 van kracht (7 Jul 2026): https://www.rijksoverheid.nl/actueel/nieuws/2026/07/07/cyberbeveiligingswet-en-wet-weerbaarheid-kritieke-entiteiten-vanaf-15-augustus-2026-van-kracht
6. European Commission, NIS2 Directive policy page: https://digital-strategy.ec.europa.eu/en/policies/nis2-directive
7. European Commission, Commission strengthens EU cybersecurity resilience and capabilities (20 Jan 2026): https://digital-strategy.ec.europa.eu/en/news/commission-strengthens-eu-cybersecurity-resilience-and-capabilities
8. European Commission, Cyber Resilience Act: https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act
9. European Commission, Cyber Resilience Act – reporting obligations: https://digital-strategy.ec.europa.eu/en/policies/cra-reporting
10. European Commission, Cyber Resilience Act – summary of the legislative text: https://digital-strategy.ec.europa.eu/en/policies/cra-summary
11. ENISA, The CRA Single Reporting Platform is launched (11 Sep 2026): https://www.enisa.europa.eu/news/the-cra-single-reporting-platform-is-launched
12. ESMA, Digital Operational Resilience Act (DORA): https://www.esma.europa.eu/esmas-activities/digital-finance-and-innovation/digital-operational-resilience-act-dora
13. EBA, Joint technical standards on major incident reporting: https://www.eba.europa.eu/activities/single-rulebook/regulatory-activities/operational-resilience/joint-technical-standards-major-incident-reporting
14. ESAs, The European Supervisory Authorities designate critical ICT third-party providers under DORA (18 Nov 2025): https://www.eba.europa.eu/publications-and-media/press-releases/european-supervisory-authorities-designate-critical-ict-third-party-providers-under-digital ; list: https://www.esma.europa.eu/sites/default/files/2025-11/List_of_designated_CTPPs.pdf
15. ESAs, 2025 Report on major ICT-related incidents (JC 2026 16, 3 Jun 2026): https://www.eba.europa.eu/sites/default/files/2026-06/29b60c21-4ff3-4e1e-9308-7c8225d5cc01/ESAs%202025%20report%20on%20major%20ICT-related%20incidents.pdf
16. EBA, Work Programme 2027 (Sep 2026): https://www.eba.europa.eu/sites/default/files/2026-09/f6561915-4192-4d73-88ac-10f8bc09abca/EBA%20Work%20programme%202027.pdf
17. Data Protection Commission, DPC fines TikTok €530 million (2 May 2025): https://www.dataprotection.ie/en/news-media/latest-news/irish-data-protection-commission-fines-tiktok-eu530-million-and-orders-corrective-measures-following
18. Data Protection Commission, DPC fines Google €403 million (21 Sep 2026): https://www.dataprotection.ie/en/news-media/latest-news/data-protection-commission-fines-google-eu403-million-following-inquiry-googles-processing-location
19. Data Protection Commission, Decisions (fines explained): https://www.dataprotection.ie/en/dpc-guidance/decisions
20. Data Protection Commission, Annual Report for 2025 (30 Jun 2026): https://www.dataprotection.ie/en/data-protection-commission-publishes-2025-annual-report
21. European Commission, Simpler digital rules to help EU businesses grow (19 Nov 2025): https://commission.europa.eu/news-and-media/news/simpler-digital-rules-help-eu-businesses-grow-2025-11-19_en
22. European Commission, Digital Package – questions and answers: https://digital-strategy.ec.europa.eu/en/faqs/digital-package
23. EDPB-EDPS, Joint Opinion 2/2026 on the Digital Omnibus (10 Feb 2026): https://www.edpb.europa.eu/system/files/documents/2026-02/edpb_edps_jointopinion_202602_digitalomnibus_en.pdf
24. NautaDutilh, The Digital Omnibus: what changed, what survived and what remains open (31 Jul 2026): https://www.nautadutilh.com/en/insights/the-digital-omnibus-what-changed-what-survived-and-what-remains-open/
25. Wilson Sonsini, EU AI Act enforcement phase begins (3 Aug 2026): https://www.wsgrdataadvisor.com/2026/08/eu-ai-act-enforcement-phase-begins/
26. eucrim, New Regulation speeds up handling of cross-border GDPR complaints: https://eucrim.eu/news/new-regulation-speeds-up-handling-of-cross-border-gdpr-complaints/
27. ENISA, ENISA to operate the EU Cybersecurity Reserve with EUR 36 million: https://www.enisa.europa.eu/index.php/news/enisa-to-operate-the-eu-cybersecurity-reserve-with-eur-36-million
28. European Commission, Liability for defective products: https://single-market-economy.ec.europa.eu/single-market/goods/free-movement-sectors/liability-defective-products_en
29. EDPB, CEF 2026: coordinated enforcement action on transparency (19 Mar 2026): https://www.edpb.europa.eu/news/news/2026/cef-2026-edpb-launches-coordinated-enforcement-action-transparency-and-information_en
30. CERT-EU, Threat Landscape Report 2025 (8 Apr 2026): https://cert.europa.eu/publications/threat-intelligence/tlr2025/
31. ESMA, ESMA sets 2027 priorities (28 Sep 2026): https://www.esma.europa.eu/press-news/esma-news/esma-sets-2027-priorities-stronger-simpler-and-more-integrated-eu-capital