This profile assumes the smallest company shape: a micro business (fewer than 10 staff, up to €2 million turnover) with nobody on payroll, so duties tied to employing staff are left out. It still covers the recurring basics almost every company has - VAT and other tax returns, the annual financial report - plus EU-wide rules such as the AI Act or the Cyber Resilience Act that apply no matter how small you are. Hire your first employee, or grow past micro size, and a different profile will fit better.
This page assumes a specific starting profile: micro company with no employees, in the EU. It's a starting point, not tailored advice - your actual obligations depend on your exact sector, turnover and how you operate.
Refine your exact profile on the home page
Generative AI systems that were already on the market before 2 August 2026 get until 2 December 2026 to implement machine-readable marking and detection of AI-generated output. From the same date AI systems built to generate non-consensual intimate or sexual imagery are prohibited outright.
Details →Directive (EU) 2024/2853 must be transposed by 9 December 2026 and applies to products placed on the market after that date. Software (including SaaS and AI), digital manufacturing files and related services count as products; missing security updates can make a product defective. Courts can order disclosure of evidence and presume defectiveness in complex cases. Free open-source software outside commercial activity is excluded.
Details →Each EU country must provide at least one certified EU Digital Identity Wallet so citizens and businesses can identify themselves, sign documents with qualified e-signatures and share verified attributes (company registration, licences) across the EU. Public administrations must accept it for online services.
Details →From this date cloud and data-processing providers may no longer charge customers for switching to another provider or for exporting their data (egress). Contracts must already allow termination and migration within 30 days, and providers must offer export in machine-readable formats.
Details →Regulation (EU) 2023/1230 applies to all machinery placed on the EU market from 20 January 2027 with no transition. It adds requirements for software safety, protection against malicious tampering, self-evolving (AI) behaviour, digital instructions, and mandatory third-party assessment for certain high-risk machinery categories.
Details →Under Regulation (EU) 2023/1542 every EV battery, light means of transport battery (e-bikes, scooters) and industrial battery over 2 kWh placed on the market must carry a QR code linking to a digital battery passport with data on chemistry, carbon footprint, recycled content, performance and durability.
Details →Micro and small companies dealing in the EUDR commodities (cattle, cocoa, coffee, palm oil, rubber, soy, wood and derived products) get six extra months. Small downstream traders mainly need to collect and pass on upstream due diligence reference numbers; small primary producers in low-risk countries file a simplified declaration.
Details →Payment providers in EU countries outside the euro area must offer euro instant transfers and the free name/IBAN check (Verification of Payee) from July 2027, completing the roll-out across the EU.
Details →General-purpose AI models that were already on the market before 2 August 2025 were given two years to catch up. From this date they must meet the same documentation, copyright and training-data-summary duties as new models.
Details →Since 1 January 2026 importers of more than 50 tonnes per year of CBAM goods (iron and steel, aluminium, cement, fertilisers; plus hydrogen and electricity without threshold) must be authorised CBAM declarants and buy CBAM certificates covering the embedded emissions. The first annual declaration and certificate surrender for 2026 imports is due in 2027. Importers under 50 tonnes are exempt but must monitor the threshold.
Details →Since 1 January 2026 crypto-asset service providers (exchanges, brokers, custodial wallet providers, some DeFi front-ends) must collect and verify customer identity and tax residence and record all exchange and transfer transactions of EU users. The first annual report to the tax authority is due in 2027, and data is exchanged between Member States. DAC7 already imposes similar annual reporting (by 31 January) on digital platforms for sellers.
Details →