Tag
The Spanish draft law transposing NIS2 is still in parliament in 2026, but the directive's technical obligations have applied since October 2024. Practical map: the ten minimum security measures, the 24-hour, 72-hour and one-month incident notification window, and the new supply-chain security obligations.
On 2 August 2026 high-risk, transparency and Commission enforcement powers kick in. A per-system checklist with downloadable template.
The European AI Act took effect on 1 August 2024 with a staggered calendar, and its Annex III high-risk rules no longer land in August 2026. The Digital Omnibus, closed by the Parliament and the Council, moves that deadline 17 months to 2 December 2027. Prohibitions since February 2025 and general-purpose AI duties since August 2025 still apply.
European sovereign AI discourse has spent three years fueling headlines, public investment, and interstate agreements. We are starting to see which part of the promise has real technical substance and what a technical team expecting alternatives outside the US ecosystem can actually count on.
The European Accessibility Act became enforceable on 28 June 2025, and the first six months produced sanction files in Spain, Germany and the Netherlands along with several forced mass-remediation projects. Directive 2019/882 covers consumer-facing products and services, and the technical bar regulators apply is EN 301 549, which takes WCAG 2.1 level AA as its baseline.
Since 2 August 2025 the EU AI Act obligations for general-purpose models, national authorities, and the penalty regime are enforceable. A practical look at what changes for those of us deploying AI in Europe.
The EU AI Act (Regulation 2024/1689) entered force on 1 August 2024. It classifies AI systems into four risk levels with graduated deadlines: prohibitions in February 2025, GPAI obligations in August 2025, and high-risk requirements in August 2026. It applies to any company operating or selling in the EU, with fines exceeding GDPR levels.
The NIS2 Directive expands European cybersecurity from 7 to 18 sectors, mandates 10 minimum technical measures and 24-hour incident notification, and imposes fines of up to 10 million euros or 2% of global turnover, with personal liability for management bodies that fail to comply.
