EU digital regulation for startups: GDPR, AI Act, CRA, Data Act
Hephaestus Technology7 min read
EU digital regulation for startups now rests on six main laws: the GDPR for personal data, the AI Act for AI systems, the Cyber Resilience Act for products with software, the Data Act for data access and cloud switching, the European Accessibility Act for consumer services and NIS2 for cybersecurity in key sectors. Which ones apply depends on what you build and who you sell to, and several key dates fall between late 2026 and 2028. The tables below set out scope, dates and maximum penalties, each linked to the official text.
Key takeaways
- The GDPR has applied since 25 May 2018 and covers almost every startup; fines reach EUR 20 million or 4% of worldwide turnover.
- The Digital Omnibus on AI, Regulation (EU) 2026/1744, moved high-risk AI obligations to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems.
- Cyber Resilience Act reporting obligations have applied since 11 September 2026, and its main requirements apply from 11 December 2027.
- The Data Act has applied since 12 September 2025, and cloud switching charges are banned from 12 January 2027.
- The European Accessibility Act has applied since 28 June 2025; in Ireland, offences carry fines of up to EUR 60,000 on indictment.
Which EU digital laws apply to startups?
Most startups face two or three of the six laws, not all of them. This table summarises scope.
| Law | Official reference | Who it mainly affects |
|---|---|---|
| GDPR | Regulation (EU) 2016/679 | Anyone processing personal data of people in the EU |
| AI Act | Regulation (EU) 2024/1689, amended by Regulation (EU) 2026/1744 | Providers and deployers of AI systems and general-purpose AI models |
| Cyber Resilience Act (CRA) | Regulation (EU) 2024/2847 | Manufacturers, importers and distributors of products with digital elements |
| Data Act | Regulation (EU) 2023/2854 | Makers of connected products, data holders, cloud and data processing providers |
| European Accessibility Act (EAA) | Directive (EU) 2019/882 | Consumer e-commerce, banking, e-books, telecoms, certain hardware |
| NIS2 | Directive (EU) 2022/2555 | Medium and large entities in listed critical sectors, including some digital providers |
What are the key dates?
The dates below come from the application articles of each law. Dates already passed are marked as applying.
| Date | Law | What applies |
|---|---|---|
| 25 May 2018 | GDPR | Entire regulation applies |
| 18 October 2024 | NIS2 | Member States to apply national measures (transposition due 17 October 2024) |
| 2 February 2025 | AI Act | Chapters I and II: definitions, AI literacy and prohibited practices |
| 28 June 2025 | EAA | Accessibility requirements apply to in-scope products and services |
| 2 August 2025 | AI Act | General-purpose AI model rules, governance and penalties chapters |
| 12 September 2025 | Data Act | Regulation applies, including data sharing and cloud switching rules |
| 11 June 2026 | CRA | Rules on conformity assessment bodies (Chapter IV) |
| 2 August 2026 | AI Act | General date of application, including Article 50 transparency duties |
| 11 September 2026 | CRA | Article 14 reporting of actively exploited vulnerabilities and severe incidents |
| 12 September 2026 | Data Act | Design obligations for connected products placed on the market after this date |
| 2 December 2026 | AI Act | New prohibitions on non-consensual intimate deepfakes and AI-generated child abuse material; Article 50(2) marking deadline for generative systems already on the market before 2 August 2026 |
| 12 January 2027 | Data Act | Switching charges for cloud and data processing services banned |
| 12 September 2027 | Data Act | Unfair contract terms chapter extends to certain older long-term contracts |
| 2 December 2027 | AI Act | High-risk obligations for Annex III systems |
| 11 December 2027 | CRA | Main obligations, including essential cybersecurity requirements |
| 2 August 2028 | AI Act | High-risk obligations for Annex I systems (AI in regulated products) |
The AI Act dates for high-risk systems, the new prohibitions and the Article 50(2) transitional deadline come from Article 113 as amended by Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026. The original high-risk dates of 2 August 2026 and 2 August 2027 no longer apply. For the full AI Act sequence, see our EU AI Act timeline after the Digital Omnibus.
What are the maximum penalties?
Maximum fines vary widely, and for SMEs some laws apply the lower of the two caps.
| Law | Maximum fine | Note |
|---|---|---|
| GDPR | EUR 20 million or 4% of worldwide annual turnover, whichever is higher | Lower tier: EUR 10 million or 2% (Article 83) |
| AI Act | EUR 35 million or 7% for prohibited practices; EUR 15 million or 3% for most other obligations; EUR 7.5 million or 1% for misleading information | For SMEs and startups, whichever is lower applies (Article 99(6)) |
| CRA | EUR 15 million or 2.5% for essential requirements and Articles 13 and 14 | Further lower tiers for other obligations (Article 64) |
| Data Act | Set by Member States | Must be effective, proportionate and dissuasive |
| EAA (Ireland) | Fine up to EUR 60,000 or up to 18 months' imprisonment on indictment | S.I. No. 636 of 2023, Regulation 32 |
The AI Act's SME rule matters for early-stage companies: Article 99(6) says that for SMEs, including start-ups, each fine is capped at whichever of the percentage or the amount is lower.
What do the enforcement and adoption numbers tell founders?
They show regulators are active and that compliance is a common reason firms hesitate.
- The DPC received 6,521 personal data breach notifications in 2025, and half arose from correspondence sent to the wrong recipient (DPC Annual Report 2025).
- Among EU enterprises that had considered AI but did not use it in 2025, 52.52% cited lack of clarity about legal consequences and 48.83% concerns about data protection and privacy (Eurostat).
- 17% of small EU enterprises used AI in 2025, against 55.03% of large ones (Eurostat, same source).
- The Commission estimated its November 2025 digital omnibus could save up to EUR 5 billion in administrative costs by 2029 (European Commission).
For founders, the message is that legal uncertainty is a competitive factor: a startup that can answer compliance questions clearly removes a reason for customers to hesitate.
Which laws apply to my product?
Use the product type as a shortcut:
- B2B SaaS without AI: GDPR; possibly CRA if you ship downloadable software or apps; Data Act cloud switching rules if you provide data processing services. Our guide to whether the CRA applies to software and SaaS explains the line.
- Consumer app or e-commerce: GDPR and ePrivacy cookie rules; EAA unless you are a microenterprise; see what the European Accessibility Act requires.
- AI product: GDPR and the AI Act, with role (provider or deployer) and risk category deciding the obligations.
- IoT or hardware: CRA, Data Act connected-product rules, GDPR if devices collect personal data, plus existing product safety and radio rules.
- Supplier to critical sectors: NIS2 may apply directly or through customer contracts.
What is still changing?
Several proposals are in negotiation and should be tracked but not treated as law. The Commission's digital omnibus proposal of 19 November 2025 would amend the GDPR and cookie rules, create a single entry point for incident reporting and give SMEs targeted exemptions from some Data Act cloud-switching rules. Only the AI part has been adopted so far, as Regulation (EU) 2026/1744. Check the status of the rest before relying on it.
This map is general information, not legal advice. Take professional advice on how each law applies to your product.
Frequently asked questions
Which EU digital law should a startup tackle first?
The GDPR, because it applies to almost every business that handles customer or user data and buyers check it first. Then add the laws triggered by your product: the AI Act for AI features, the CRA for software or hardware products, the EAA for consumer services.
Did the Digital Omnibus delay the whole AI Act?
No. It moved the high-risk obligations to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems. Prohibitions, AI literacy and general-purpose AI rules already apply, and the general application date of 2 August 2026 has passed.
When does the Cyber Resilience Act apply?
Its reporting obligations under Article 14 have applied since 11 September 2026, and most other obligations apply from 11 December 2027. Rules for conformity assessment bodies applied from 11 June 2026.
Are startups exempt from these laws?
Generally not. Some laws soften obligations: the EAA exempts microenterprises providing services, the AI Act caps SME fines at the lower amount, and the GDPR's record-keeping exemption for organisations under 250 staff is narrow. Size rarely removes the core duties.
Does the Data Act apply to software companies?
It can. Its cloud switching rules apply to providers of data processing services, including many SaaS businesses, and its data access rules apply to makers of connected products and related services.
Mapping which rules apply to your product? Book a free 30-minute call.
Cover photo by RDNE Stock project on Pexels.