Free tool

EU regulation check: which duties apply to your company

Six questions, five laws, one first assessment: NIS2, the AI Act, the Cyber Resilience Act, the Data Act and the e-invoicing duty converge in 2026. This check sorts what applies to you and links the in-depth article for each.

Your company

Which sector do you mainly operate in?
How large is your company?
Do you manufacture or distribute products containing software (devices, machines, own software)?
Do you use or develop AI systems?
Do your products or machines generate usage data transmitted over a network (IoT, telematics, connected devices)?
Do you invoice other businesses in Germany?

First assessment

  • EU AI Act

    Partly / checkAI literacy since February 2025, transparency since August 2026, high-risk from December 2027 (Annex III) and August 2028 (Annex I)

    As a deployer you have had to support your staff's AI literacy since February 2025 (Art. 4); since 27 July 2026 the law no longer requires a particular level. For Annex III high-risk systems, deployer duties apply from 2 December 2027.

    In-depth article

  • E-invoicing duty

    Applies to youreceipt since 2025, sending 2027/28

    Since 1 January 2025 you must be able to receive e-invoices. You must send them from 1 January 2027 if your total turnover in 2026 exceeded €800,000, otherwise from 1 January 2028. By EDI you may use another format until 31 December 2027 with the recipient’s consent.

    In-depth article

What this check is and what it is not

A first assessment in six questions, not legal advice. The thresholds follow the evidenced facts in the linked articles; in case of doubt, the statute and counsel prevail. What the check is for: knowing which of the five construction sites you have at all before spending effort on the wrong one.

Common questions

Does NIS2 apply to small companies too?

Usually not directly, but indirectly: regulated companies must demonstrate the security of their supply chain and send questionnaires to their suppliers. If you have large customers in critical sectors, you feel NIS2 through their requirements even when your own company is not covered.

When do the AI Act duties hit me?

The AI literacy duty of Art. 4 has applied to providers and deployers since 2 February 2025; since 27 July 2026 it requires measures that support literacy, not a guaranteed level. Since 2 August 2026 the transparency duties of Art. 50 apply: the notice that a chatbot is an AI must be built in by the provider; deployers must disclose deepfakes and AI-generated texts on matters of public interest that were not editorially reviewed. Those who market AI under their own name carry the provider duties. For Annex III high-risk systems, provider and deployer duties apply from 2 December 2027.

Does the CRA cover pure software?

Yes, if the software is placed on the EU market as a product; pure cloud and SaaS offerings are generally out of scope. Since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe security incidents: early warning without undue delay, at the latest 24 hours from becoming aware; notification without undue delay, at the latest 72 hours from becoming aware. All other duties apply from 11 December 2027, including the lighter ones for importers and distributors.

What is the e-invoicing duty in practice?

You have had to be able to receive e-invoices since January 2025, without consenting to the format, even if you do not invoice businesses yourself. You must send them from 2027 if your total turnover in the previous year exceeded €800,000, otherwise from 2028. By EDI you may use another format until 31 December 2027 with the recipient’s consent. Anyone still sending PDFs as "invoices" should not push the switch to the last year.

Five construction sites, one priority

The check shows what applies to you. The order in which the duties pay off for your company is settled faster in an initial call than by any checklist.

Book an initial call