🇪🇺 European Union

The GDPR is the EU's comprehensive data protection law governing how personal data of individuals in the EU is collected, processed, and secured. It has applied since 25 May 2018 and sets binding rules on lawful basis, consent, individual rights, security, and accountability. It is the global benchmark for privacy regulation.

eIDAS 2.0 establishes the European Digital Identity Framework, centered on the EU Digital Identity Wallet (EUDI Wallet) that lets citizens, residents, and businesses identify themselves and share verified attributes across the EU. It entered into force on 20 May 2024. The first implementing acts entered into force on 24 December 2024, which sets the deadline for every Member State to offer at least one wallet at 24 December 2026, with private relying parties that require strong user authentication and very large online platforms due to accept the wallet within 36 months of those acts (around December 2027).

NIS2 is the EU's cybersecurity directive raising security and incident-reporting obligations for essential and important entities across many critical sectors. Member States had to transpose it by 17 October 2024 and apply the measures from 18 October 2024, but many missed the deadline: the Commission sent reasoned opinions to 19 Member States in May 2025 and on 8 July 2026 referred Ireland, Spain, France and the Netherlands to the Court of Justice. It significantly expands the scope of the original 2016 NIS Directive.

The Cyber Resilience Act sets mandatory cybersecurity requirements for hardware and software products with digital elements placed on the EU market, covering design, development, and vulnerability handling for the product's support period. It entered into force on 10 December 2024. Manufacturers' reporting obligations apply from 11 September 2026 and the main obligations from 11 December 2027.

DORA is an EU regulation that strengthens the digital operational resilience of the financial sector, ensuring firms can withstand, respond to, and recover from ICT-related disruptions. It has applied since 17 January 2025 and harmonizes ICT risk management, incident reporting, resilience testing, and oversight of third-party providers.

PSD2 modernizes EU payment services and introduced Strong Customer Authentication (SCA) to reduce fraud in electronic payments. The SCA technical standards applied from 14 September 2019. SCA requires verifying the payer using at least two independent authentication factors plus dynamic linking for transactions.

The EU AI Act is the world's first comprehensive horizontal law governing artificial intelligence, using a risk-based approach that bans some uses outright, tightly regulates high-risk systems, and imposes transparency duties on others. It is especially relevant to identity because many of its strictest controls target biometric systems used to identify, categorize, or infer information about people. It entered into force on 1 August 2024 and applies in phases.

UN Regulation No. 155 makes cybersecurity a condition of vehicle type approval. Adopted under the UNECE 1958 Agreement, it entered into force on January 22, 2021, and the European Union is a contracting party that applies it from that date. A manufacturer needs a Certificate of Compliance for its Cyber Security Management System (CSMS), valid for up to three years, and must show for each vehicle type that it has assessed the risks in the regulation's Annex 5 and applied proportionate mitigations, several of which are access control and privilege controls. In the EU it has applied to new whole-vehicle type approvals from July 6, 2022 and to existing type approvals from July 7, 2024, according to the UK Vehicle Certification Agency's summary of EU dates.

UN Regulation No. 156 makes a managed, secure software update process a condition of vehicle type approval. It entered into force on January 22, 2021, and the European Union is a contracting party that applies it from that date. A manufacturer needs a Certificate of Compliance for its Software Update Management System (SUMS), valid for up to three years, and each vehicle type must protect the authenticity and integrity of software updates and protect its RX Software Identification Numbers (RXSWIN) against unauthorized modification. EU application is phased: the UK Vehicle Certification Agency lists dates from July 6, 2022 for new whole-vehicle type approvals where manufacturers update type-approved characteristics after registration, through July 7, 2029 for new completed vehicles. Amendments were notified to the UN depositary on June 12, 2026.