27 texts. 27 dated deadlines.

Cloud and AI Development Act

COM(2026) 502 final

A framework of measures to strengthen Europe's cloud and AI ecosystem. Its article 16 establishes a Union cloud computing sovereignty framework with FOUR ASSURANCE LEVELS defined in Annex II. Level 1: data processed and stored on infrastructure located in the Union. Level 2: independence from third countries and transparency over the software supply chain. Level 3: the provider is owned and controlled from the Union, with criteria extending to the nationality of personnel. Level 4: full transparency and control over the software supply chain, and no interference from a third country.

Who Cloud computing service providers, and public sector bodies choosing their assurance level according to their risk assessment.

Authority Audits conduits par les États membres

in preparation our third-party-call measurement bears on level 2 — independence and supply-chain transparency — but awards no level

Procedure 2026/0138(COD). The stated ground: three non-EU providers control over 70% of the European cloud market, and answer to jurisdictions whose extraterritorial laws may conflict with European law.

⚠️ Commission proposal — legislative procedure under way, not yet applicable

Deadlines 3 June 2026 — Proposal adopted by the Commission

Cloud Sovereignty Framework

Cadre d'évaluation de la Commission européenne (no ELI)

A tool for assessing the sovereignty of a cloud service. 48 criteria in 8 categories — strategic, legal, operational, environmental, supply chain transparency, technological openness, security, compliance with EU laws — scored as SEAL levels, from SEAL-0 (complete lack of sovereignty) to SEAL-4 (a full EU supply chain, from chips to software).

Who Anyone bidding for a Union cloud procurement. The Commission explicitly encourages ALL organisations, public and private, to use it.

Authority Commission européenne

in preparation our third-party-call measurement bears on the “supply chain transparency” category, not on the 48 criteria

This framework is NOT a law and does not need to be: it is already in use. The four providers awarded in April 2026 are European — Post Telecom with OVHcloud and CleverCloud, STACKIT, Scaleway, and Proximus with S3NS, Clarence and Mistral.

Deadlines 17 April 2026 — First contract awarded on this framework — €180m over six years, four providers, SEAL-2 minimum

European Accessibility Act

Directive 2019/882

Accessibility requirements for products and services.

Who Companies supplying a covered service to the public: e-commerce, consumer banking, passenger transport, electronic communications, e-books. Microenterprises supplying services are exempt.

In France Ordonnance n° 2023-859 du 6 septembre 2023 · décret n° 2023-931 du 9 octobre 2023 · arrêté du 9 octobre 2023

Authority DGCCRF

Penalty Fifth-class contravention (article R. 451-4 of the French consumer code), per breach found. source

instrumented sonde-a11y.py — 14 of the 19 RGAA criteria establishable on the served document, the rest declared out of reach

Deadlines 28 June 2022 — Transposition by the Member States · 28 June 2025 — Applies to services supplied from this date

Public sector accessibility

Directive 2016/2102

Accessibility of public sector bodies' websites and mobile applications.

Who The State, local authorities, public establishments and delegated public service operators.

In France Loi n° 2005-102 du 11 février 2005, article 47 ; sanctions à l'article 47-1

Authority ARCOM

Penalty Up to €50,000 for the breach under article 47 I; €25,000 for those under III and IV; renewable where the breach persists six months after a penalty. source

instrumented sonde-a11y.py — 14 of the 19 RGAA criteria establishable on the served document, the rest declared out of reach

GDPR

Regulation 2016/679

Protection of natural persons with regard to the processing of personal data.

Who Any controller or processor established in the Union, and outside it where it targets people located there.

In France Loi n° 78-17 du 6 janvier 1978 modifiée

Authority CNIL

Deadlines 25 May 2018 — Applies

ePrivacy — trackers and communications

Directive 2002/58/CE (no ELI)

Privacy in electronic communications: trackers, cookies, direct marketing.

Who Any publisher writing to or reading from a user's terminal.

In France Article 82 de la loi n° 78-17

Authority CNIL

Le Digital Omnibus propose d'en moderniser les règles sur les traceurs.

Data Act

Regulation (EU) 2023/2854

Fair rules on access to and use of data generated by connected products.

Who Manufacturers, data holders, related service providers, and users of connected products.

Authority à désigner par les États membres

Deadlines 11 January 2024 — Entry into force · 12 September 2025 — Applies — access and transfer rights · 12 September 2026 — Design obligation: products placed on the market from this date

Data Governance Act

Regulation 2022/868

European data governance: re-use, intermediation, altruism.

Who Public sector bodies and data intermediation services.

⚠️ repeal proposed by the Digital Omnibus (COM(2025) 837) — still applicable

Deadlines 24 September 2023 — Applies

Free flow of non-personal data

Regulation 2018/1807

Prohibition of data localisation requirements for non-personal data.

Who Providers and users of data processing services.

⚠️ repeal proposed by the Digital Omnibus (COM(2025) 837) — still applicable

Open data

Directive 2019/1024

Open data and the re-use of public sector information.

Who Public sector bodies and public undertakings.

⚠️ repeal proposed by the Digital Omnibus (COM(2025) 837) — still applicable

Deadlines 17 July 2021 — Transposition

Digital Services Act

Regulation 2022/2065

Single market for digital services: moderation, transparency, notice and action.

Who Hosting services, marketplaces, social networks, search engines.

Authority ARCOM (coordinateur pour les services numériques en France)

Deadlines 17 February 2024 — Applies to all covered services

Digital Markets Act

Regulation 2022/1925

Contestable and fair markets in the digital sector.

Who Gatekeepers designated by the Commission.

Authority Commission européenne

Deadlines 2 May 2023 — Applies

Platform-to-business fairness (P2B)

Regulation 2019/1150

Fairness and transparency for business users of intermediation services.

Who Marketplaces, app stores, search engines.

⚠️ repeal proposed by the Digital Omnibus (COM(2025) 837) — still applicable

AI Act

Regulation (EU) 2024/1689

Harmonised rules on artificial intelligence, by level of risk.

Who Providers, deployers, importers and distributors of AI systems.

Amended by Regulation (EU) 2026/1744 of 8 July 2026, in force on 27 July 2026.

Deadlines 2 February 2025 — Prohibited practices and AI literacy obligation · 2 August 2025 — General-purpose models and governance · 2 December 2026 — Transparency of AI-generated content · 2 August 2027 — National regulatory sandboxes · 2 December 2027 — Stand-alone high-risk AI (Annex III) — postponed from 2 August 2026 · 2 August 2028 — High-risk AI embedded in a product (Annex I)

Digital Omnibus on AI

Regulation (EU) 2026/1744

Simplification of the AI Act's implementation; postponement of the high-risk rules.

Who The same actors as the AI Act.

Deadlines 27 July 2026 — Entry into force

NIS 2

Directive 2022/2555

A high common level of cybersecurity across the Union.

Who Essential and important entities across eighteen sectors.

Authority ANSSI

Deadlines 17 October 2024 — Transposition by the Member States

Critical entities resilience (CER)

Directive 2022/2557

Resilience of critical entities against disruption, beyond the digital sphere.

Who Critical entities designated by the Member States.

DORA

Regulation 2022/2554

Digital operational resilience for the financial sector.

Who Financial entities and their critical third-party ICT providers.

Authority ACPR · AMF

Cyber Resilience Act

Regulation 2024/2847

Horizontal cybersecurity requirements for products with digital elements.

Who Manufacturers, importers and distributors of connected products and software.

Deadlines 11 June 2026 — Notification of conformity assessment bodies · 11 September 2026 — Reporting of actively exploited vulnerabilities · 11 December 2027 — Main obligations

Cybersecurity Act

Regulation 2019/881

ENISA's mandate and the European cybersecurity certification framework.

Who Providers of ICT products, services and processes.

eIDAS 2 — European Digital Identity Wallet

Regulation (EU) 2024/1183

European digital identity framework; amends Regulation (EU) No 910/2014.

Who Member States, trust service providers, and services requiring strong authentication.

Deadlines 17 September 2014 — eIDAS 1 — applies

Interoperable Europe Act

Regulation (EU) 2024/903

Interoperability of public digital services across the Union.

Who Public sector bodies providing cross-border digital services.

Deadlines 11 April 2024 — Entry into force · 12 July 2024 — Applies · 12 January 2025 — Interoperability assessments and solution sharing

Digital content and services

Directive 2019/770

Contracts for the supply of digital content and services, including where the price paid is personal data.

Who Any trader supplying digital content or a digital service to a consumer.

In France Code de la consommation, articles L. 224-25-1 et suivants

Sale of goods

Directive 2019/771

Conformity of goods, including goods with digital elements and their updates.

Who Any seller of goods to a consumer.

Consumer omnibus

Directive 2019/2161

Modernisation of consumer protection: online reviews, rankings, price reduction announcements.

Who Online marketplaces and traders.

Authority DGCCRF

Copyright in the digital single market

Directive 2019/790

Copyright and related rights; text and data mining; liability of content-sharing platforms.

Who Content-sharing platforms, press publishers, and users of data mining for model training.

In France Code de la propriété intellectuelle

European Media Freedom Act

Regulation (EU) 2024/1083

A common framework for media services in the internal market.

Who Media service providers and very large online platforms.