The EU has the world’s most comprehensive digital rulebook, and most of it applies to non-EU startups as soon as they serve EU users or customers. The good news is that the laws share a logic: know your data, your systems and your role, document your risk decisions, and be ready to report incidents.
Not every law applies to every startup. A B2B SaaS company may only need GDPR and contract work at first; an AI platform adds the AI Act; a marketplace adds the DSA; a fintech adds DORA; a connected device adds the Data Act and the Cyber Resilience Act. This guide helps you work out your stack.
- Core data law
- GDPR (Regulation 2016/679)
- AI law
- AI Act (Regulation 2024/1689), phasing in to 2028
- Regulators
- National DPAs, AI Office, Commission, national market surveillance
- Extraterritorial?
- Yes, for most of the rulebook
- Cyber
- NIS2, CRA (reporting from Sep 2026), DORA for finance
- Biggest upcoming dates
- PLD Dec 2026 · AI Act high-risk Dec 2027 · CRA Dec 2027
Who needs to comply
Any startup with EU users or customers
The GDPR applies to companies outside the EU that offer goods or services to, or monitor the behaviour of, people in the EU.
AI products and AI-powered features
The AI Act regulates providers and deployers by risk: banned practices, transparency for chatbots and synthetic content, and heavy duties for high-risk uses such as hiring, credit and education.
Marketplaces, social, UGC and hosting platforms
The Digital Services Act imposes notice-and-action, transparency, dark-pattern and minor-protection duties on intermediaries.
IoT, connected devices and cloud/SaaS providers
The Data Act gives users access to device data and requires cloud switching; the CRA requires security by design for products with digital elements.
Fintech, payments, crypto and vendors to banks
DORA governs ICT risk for financial entities and their contracts with tech vendors; MiCA governs crypto-asset services.
Cloud, data centre, MSP and digital infrastructure companies
NIS2 brings medium and large entities in these sectors into cybersecurity risk management and incident reporting.
Health-tech
GDPR special category rules, the Medical Devices Regulation for software as a medical device, and the European Health Data Space.
The laws, in detail
01General Data Protection Regulation (GDPR)
Processing of personal data, roles, lawful bases, rights, security, breach notification and international transfers.
When it applies
EU establishment, or offering goods/services to or monitoring people in the EU.
What you must do
- Lawful basis for every processing purpose; consent where required
- Transparent privacy notices and records of processing
- Data subject rights within one month
- Article 28 contracts with processors; subprocessor controls
- DPIAs for high-risk processing; DPO where required
- Breach notification to the DPA within 72 hours
- Transfer mechanisms (adequacy, DPF, SCCs) for data leaving the EU
- EU representative if you have no EU establishment
Regulator
National data protection authorities; EDPB
Penalties
Up to €20 million or 4% of worldwide annual turnover, whichever is higher.
02AI Act
Risk-based rules for AI systems and general-purpose AI models.
When it applies
Placing AI systems on the EU market, or using them in the EU, or where outputs are used in the EU.
What you must do
- No prohibited practices (Article 5)
- AI literacy measures for staff
- Tell people they are interacting with AI; mark synthetic content
- High-risk: risk management, data governance, documentation, logging, human oversight, conformity assessment
- GPAI providers: technical documentation, copyright policy, training-data summary
Regulator
AI Office (GPAI) and national market surveillance authorities
Penalties
Up to €35 million or 7% of turnover for prohibited practices; lower tiers for other breaches; SME and small mid-cap relief.
03Digital Services Act (DSA)
Responsibilities of intermediary services for illegal content, transparency and user protection.
When it applies
Offering intermediary services (conduit, caching, hosting, platforms) to users in the EU.
What you must do
- Single point of contact and, if non-EU, a legal representative
- Notice-and-action and statements of reasons
- Clear terms, advertising transparency, recommender transparency
- No dark patterns; protections for minors
- Trader traceability for marketplaces
Regulator
Digital Services Coordinators; Commission for very large platforms
Penalties
Up to 6% of worldwide annual turnover.
04Data Act
Access to connected-product data, B2B data sharing terms and cloud switching.
When it applies
Making connected products or related services, holding such data, or providing cloud/data-processing services.
What you must do
- Make product data accessible to users and, at their request, third parties
- Remove switching barriers and egress charges on a set timeline
- Avoid unfair terms in data-sharing contracts
Regulator
National competent authorities
Penalties
Set by member states; data protection breaches follow GDPR fines.
05NIS2 Directive
Cybersecurity risk management and incident reporting for essential and important entities.
When it applies
Medium or large entities in listed sectors, including cloud, data centres, MSPs, marketplaces, search and social platforms.
What you must do
- Risk-management measures including supply-chain security
- Early warning within 24 hours, notification within 72 hours, final report within a month
- Management body approval and training
Regulator
National competent authorities and CSIRTs
Penalties
Up to €10 million or 2% of turnover (essential); €7 million or 1.4% (important).
06Cyber Resilience Act (CRA)
Security requirements for products with digital elements, including software.
When it applies
Placing hardware or software products with digital elements on the EU market.
What you must do
- Report actively exploited vulnerabilities and severe incidents from 11 Sep 2026
- Secure-by-design development and vulnerability handling
- Security updates for the support period; SBOM; conformity assessment from Dec 2027
Regulator
ENISA and national market surveillance authorities
Penalties
Up to €15 million or 2.5% of worldwide turnover for essential requirements.
07DORA
Digital operational resilience for financial entities and their ICT providers.
When it applies
EU financial entities (including CASPs) and ICT third-party service providers serving them.
What you must do
- ICT risk framework and testing
- Major ICT incident reporting
- Mandatory contract clauses with ICT providers
Regulator
EBA, EIOPA, ESMA and national financial authorities
Penalties
Set by member states; supervisory measures for critical ICT providers.
08MiCA
Crypto-asset issuance and services.
When it applies
Issuing crypto-assets or providing crypto-asset services in the EU.
What you must do
- CASP authorisation and passporting
- White papers and marketing rules
- Stablecoin reserve and redemption rules
Regulator
National competent authorities; ESMA and EBA
Penalties
Administrative fines set by member states, including turnover-based caps.
09Product Liability Directive (revised)
No-fault liability for defective products, now including software and AI.
When it applies
Products, including software, placed on the EU market from 9 Dec 2026.
What you must do
- Account for strict liability in product design and update policies
- Keep security updates flowing during the product’s life
- Review contracts and insurance
Regulator
Civil courts
Penalties
Compensation for damage; not capped by contract with consumers.
Compliance checklist
01 · Before you launch in the EU
- Decide your GDPR role (controller/processor) for each product line
- Write a GDPR-grade privacy notice and records of processing
- Put a transfer mechanism in place for every flow out of the EU
- Appoint an EU representative if you have no EU establishment
- Classify each AI feature under the AI Act and add AI disclosures
- Check whether you are an intermediary under the DSA
02 · At launch
- Cookie consent that meets ePrivacy and GDPR standards
- Article 28 DPA for customers and subprocessor list
- Breach playbook: 72 hours (GDPR), 24 hours (NIS2/CRA where applicable)
- DSA notice-and-action and transparency pages if you host content
- Vulnerability disclosure policy and CRA reporting process
03 · As you scale
- DPIAs for new high-risk processing; DPO if required
- AI Act high-risk programme ahead of Dec 2027
- NIS2 scoping as you pass medium-size thresholds
- DORA clauses when you sell to EU financial entities
- PLD review of liability caps and update policy before Dec 2026
Key dates
- 25 May 2018GDPR applies
- 17 Feb 2024DSA fully applicable
- 17 Jan 2025DORA applies
- 2 Feb 2025AI Act bans and AI literacy
- 12 Sep 2025Data Act applies
- 2 Aug 2026AI Act transparency duties; GPAI enforcement
- 11 Sep 2026CRA reporting obligations
- 9 Dec 2026Revised Product Liability Directive applies
- 2 Dec 2027AI Act high-risk (Annex III); CRA main obligations 11 Dec 2027
Common mistakes
- Relying on consent for everything, or on legitimate interests without a documented balancing test.
- Forgetting the EU representative when you have no EU entity.
- Treating the AI Act deferral as an exemption rather than a runway.
- Using US-centric incident plans that miss 24-hour NIS2 and CRA clocks.
- Signing bank customers’ DORA addenda without checking you can deliver them.
FAQs
Do we need to incorporate in the EU?
Not for GDPR or most digital laws, but you may need an EU representative (GDPR, DSA) and, for MiCA or payments, an authorised EU entity.
Is the AI Act only for big AI labs?
No. Transparency duties apply to many chatbots and generative features, and high-risk rules can apply to startups in HR, credit, education and health.
Can we transfer EU data to the US?
Yes, using the EU–US Data Privacy Framework if the recipient is certified, or standard contractual clauses with a transfer risk assessment.
In the law library
Sources
Reviewed 12 October 2026. General information, simplified for planning; not legal advice. Check current law before relying on any requirement, and get advice for your facts. For markets outside India, advice is coordinated with locally qualified counsel.