You will be redirected to the website of our parent company, Schönherr Rechtsanwälte GmbH: www.schoenherr.eu
Welcome to the new edition of the Digital Law Monitor. Keeping up with developments in digital law is becoming increasingly challenging. To help you stay ahead of the curve, we created this comprehensive overview and will update it on a regular basis. It includes legal acts, draft legal acts, guidelines and, occasionally, other legal materials. If you haven’t already, subscribe here.
For weekly updates on legal acts and guidelines in Austria and the EU (in German), subscribe to the Schönherr Digitalrechtsmonitor.
Subscribe to Schoenherr’s other newsletters for regular briefings on digital law developments, monthly updates on financial regulation, litigation and white collar crime law, quarterly updates on healthcare and life sciences law, and much more.
Regulations (incl. drafts)
Commission Guidelines
European Data Protection Board
Regulations (incl. drafts)
Digital Omnibus Regulation on AI
· On 24 July 2026, the Digital Omnibus Regulation on AI, OJ L 2026/1744, was published. The Regulation has applied since 27 July 2026. It amends, in particular, the AI Act. Among other things, a definition of mid-cap companies is inserted. Furthermore, the dates for the entry into force of certain provisions of the AI Act are postponed.
Entry into Force of Article 50 AI Act
· On 2 August 2026, the transparency requirements under Article 50 AI Act (Regulation (EU) 2024/1689) entered into force. They therefore no longer concern only high-risk AI systems but, in principle, every undertaking that uses chatbots, generative AI tools or AI-assisted content creation. The provision is divided into four categories: (i) making the AI interaction recognisable, for example in the case of chatbots; (ii) the machine-readable marking of synthetically generated audio, image, video and text content; (iii) a disclosure obligation where emotion recognition or biometric categorisation systems are used; and (iv) the labelling of deep fakes and of AI-generated or AI-manipulated text concerning matters of public interest. For the labelling of synthetically generated content, systems that were already placed on the market before the relevant cut-off date are subject to a transitional period until 2 December 2026.
Entry into Force of Article 71 in conjunction with Article 14 CRA
· On 11 September 2026, the vulnerability reporting requirements under Article 71 in conjunction with Article 14 CRA (Cyber Resilience Act; Regulation (EU) 2024/2847) entered into force. All manufacturers of products with digital elements who are subject to the CRA are now required to report actively exploited vulnerabilities.
Proposal for an EU KIDS Act
· On 17 September 2026, the "Proposal for a Regulation of the European Parliament and of the Council EU KIDS Act – 'EU Keeping Internet Digital Spaces Accountable and Trustworthy'" (COM(2026) 681 final) was published. The aim of the EU KIDS Act is to establish and strengthen the protection of minors using online social networking services, video-sharing platform services, online games, AI companions and general conversational chatbots, and software application stores.
Proposal for a European Innovation Act
· On 9 September 2026, the "Proposal for a Regulation of the European Parliament and of the Council establishing a framework of measures for strengthening the Union innovation ecosystem and amending Regulation (EU) 2017/1001 (European Innovation Act)" (COM(2026) 567 final) was published. The European Innovation Act is meant to serve as a harmonised framework at Union level for R&D procurement.
Proposal for a Regulation of the digitalisation and coordination of social security systems
· On 15 September 2026, the "Proposal for a Regulation of the European Parliament and of the Council on digitalising the coordination of social security systems, laying down a framework for the European Social Security Pass (ESSPASS) and amending Regulations (EC) No 883/2004, (EC) No 987/2009 and (EU) No 2018/1724" (COM(2026) 980 final) was published. The Regulation is meant to manage the digitalisation of the cross-border transfer of information regarding social security, as well as the introduction of the European Social Security Pass (ESSPASS).
Commission Guidelines
Action Plan on Cybersecurity and Artificial Intelligence
· On 7 July 2026, the European Commission published the "Action Plan on Cybersecurity and Artificial Intelligence", COM(2026) 577 final. The Action Plan aims to support Member States and companies in addressing AI-generated cybersecurity threats.
Guidelines on Transparency Obligations for certain AI Systems
· On 20 July 2026, the "Guidelines on the implementation of the transparency obligations for certain AI systems under Article 50 of the AI Act", C(2026) 5054 final, together with the official FAQ. These Guidelines provide guidance on the practical interpretation of the transparency requirements, including, for example, the characteristics of a deep fake and the narrowly construed exception for chatbots.
European Data Protection Board
Guidelines 02/2026 on Anonymisation
· On 8 July 2026, the EDPB published the "Guidelines 02/2026 on Anonymisation", updating the former "Opinion 5/2014 on Anonymisation Techniques". The Guidelines take account of both technical and legal developments. Of particular practical relevance is the alignment of the Guidelines with the case law of the CJEU, under which data anonymisation must be assessed from the respective controller's perspective.
Guidelines 03/2026 on web scraping in the context of generative AI
· On 8 July 2026, the EDPB published the "Guidelines 03/2026 on web scraping in the context of generative AI". The EDPB sets out the circumstances in which web scraping may be based on legitimate interests. It also examines which technical and organisational measures may be taken, how compliance with the principle of data minimisation can be ensured, and the conditions under which the provision of information to data subjects may be omitted.
Guidelines 02/2025 on processing of personal data through blockchain technologies
· On 8 July 2026, the EDPB published the "Guidelines 02/2025 on processing of personal data through blockchain technologies2". The Guidelines provide guidance on the GDPR-compliant processing of personal data through blockchain technologies. They address the principles of "data protection by design" and "by default", as well as the principles of storage limitation and data minimisation.
Guidelines 03/2025 on the interplay between the DSA and the GDPR2
· On 17 September 2026, the EDPB published the second version of the "Guidelines 03/2025 on the interplay between the DSA and the GDPR". These guidelines address, among other things, the processing of personal data by hosting providers when reporting illegal content.
Guidelines 04/2026 on the application of the power to impose administrative fines
· On 17 September 2026, the EDPB published the "Guidelines 04/2026 on the application of the power to impose administrative fines in relation to other corrective powers under the GDPR". These guidelines establish a methodology for assessing whether a fine should be imposed pursuant to Article 83 GDPR in a specific case. The supervisory authorities have discretion when to impose, which will now be tied to objective criteria.
Ministerial draft of the Administrative Procedure Law amendment
· On 25 June 2026, the ministerial draft of a Federal Act amending the AVG, the VwGVG, the VwGG and the VfGG, 124/ME, was published. This amendment to the administrative procedure acts provides, among other things, that an unexcused failure to attend an oral hearing is deemed ex lege to constitute withdrawal of the complaint against the administrative decision, unless the complainant applies for the proceedings to be continued within the statutory period granted for that purpose. Proceedings under the DSG and the IFG may therefore be discontinued if the complainant fails to attend the oral hearing before the administrative court.
Ministerial draft of the Gambling Reform Act 2026
· On 29 June 2026, the ministerial draft concerning the Gambling Reform Act 2026, 125/ME, was published. The Gambling Reform Act 2026 is relevant to digitalisation because it provides for the opening-up of online gambling. Furthermore, the Anti-Fraud Office will be empowered to issue blocking orders against providers of information society services, such as hosting and caching providers and search engine operators. The TKG 2021 will also be amended to facilitate the enforcement of such blocking orders. In addition, payment blocks in respect of illegal gambling are envisaged (payment blocking).
Intelligent Metering Devices Requirements Ordinance 2026
· On 10 July 2026, the "Intelligent Metering Devices Requirements Ordinance 2026", Federal Law Gazette II 2026/183, was published. The ordinance lays down requirements for smart meters.
Location Ordinance (emergency calls)
· On 21 July 2026, the Location Ordinance issued by RTR-GmbH, Federal Law Gazette II 2026/216, was promulgated. The materials relating to the Regulation can be accessed here. The Location Regulation lays down requirements relating to emergency calls.
Amendment to the Audiovisual Media Services Act
· On 27 July 2026, the ministerial draft of the Federal Act amending the Audiovisual Media Services Act and the KommAustria Act, 132/ME, was published. The legislation is intended to introduce age-verification requirements for certain social media and video-sharing-platforms to protect minors under the age of 14.
Entry into force of the Network and Information Systems Security Act 2026
· On 1 October 2026, the Network and Information Systems Security Act 2026 (NISG 2026) entered into force. It implements the NIS2 Directive of the European Union on cybersecurity and requires numerous industries to implement effective protection measures for their IT systems and prompt reporting of significant cybersecurity incidents.
Entry into force of the Network and Information Systems Security Regulation 2026
· On 1 October 2026, the Network and Information Systems Security Regulation 2026 (NISV 2026) BGBl II 2026/290, was published. It further specifies requirements for cybersecurity risk management and additional criteria for determining the occurrence of a significant cybersecurity incident
Decision on the Ratification of the Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law
· The Decision was adopted by the Presidency of Bosnia and Herzegovina on 3 September 2026 and published in the Official Gazette of Bosnia and Herzegovina – International Agreements, No. 9/26. It ratifies the Framework Convention, which establishes principles and obligations to ensure that activities throughout the lifecycle of artificial intelligence systems comply with human rights, democracy and the rule of law. The Convention addresses risks such as discrimination, privacy violations and other adverse impacts of AI, and requires appropriate measures for risk management, oversight and international cooperation. The Decision entered into force on 28 September 2026.
Decision on the Establishment of the Instant Payment System of Bosnia and Herzegovina
· Published in the Official Gazette of Bosnia and Herzegovina, No. 50/26 and entered into force on 18 July 2026, the Decision establishes the instant payment system of Bosnia and Herzegovina under the responsibility of the Central Bank of Bosnia and Herzegovina. It provides the basis for establishing the domestic infrastructure for instant payments, while the detailed rules governing the system's operation are addressed in a separate decision.
Decision on the Rules Governing the Operation of the Central Bank of Bosnia and Herzegovina's Instant Payment System
· Published in the Official Gazette of Bosnia and Herzegovina, No. 50/26 and entering into force on 18 July 2026, the Decision establishes the operational and technical framework for the functioning of the country's instant payment system. It regulates participation requirements, the rights and obligations of participating banks and the Central Bank, the receipt and execution of instant payment orders, settlement procedures, settlement finality and liquidity management. The Decision also provides for additional services, including payee verification and alternative customer identification mechanisms, supporting secure, efficient and continuous electronic payments.
Rule 102/2026 on the Public "Do Not Call" Electronic Register
· Adopted on 23 September 2026 and published in the Official Gazette of Bosnia and Herzegovina, No. 75/26, the Rule establishes an electronic register through which users can opt out of unsolicited direct marketing calls and messages. It requires operators and marketing entities to verify telephone numbers against the register before sending promotional communications, strengthening consumer privacy and protection from unwanted marketing.
Law on Electronic Money of the Federation of Bosnia and Herzegovina
· Published in the Official Gazette of the Federation of Bosnia and Herzegovina, No. 59/26 on 5 August 2026 and entering into force on 13 August 2026, the Law establishes a regulatory framework for the issuance of electronic money and the operation and supervision of electronic money institutions. It regulates licensing requirements, the rights and obligations of electronic money issuers, and the protection of users' funds. The Law partially aligns the legal framework of the Federation of Bosnia and Herzegovina with Directive 2009/110/EC on the taking up, pursuit and prudential supervision of the business of electronic money institutions.
Law on Payment Accounts of the Federation of Bosnia and Herzegovina
· Published in the Official Gazette of the Federation of Bosnia and Herzegovina, No. 59/26 on 5 August 2026 and entering into force on 13 August 2026, the Law regulates payment accounts and related services, including basic payment accounts, switching accounts between payment service providers, account registers and the transparency and comparability of fees. It establishes a framework for the management and accessibility of payment accounts, supporting the modernisation of payment services and the development of digital financial services in the Federation of Bosnia and Herzegovina.
Law on Payment Services of the Federation of Bosnia and Herzegovina
· Published in the Official Gazette of the Federation of Bosnia and Herzegovina, No. 59/26 on 5 August 2026, the Law establishes the legal framework for the provision of payment services, regulating payment service providers, payment transactions, transparency and disclosure requirements, as well as the rights and obligations of providers and users. The Law partially aligns the Federation's legal framework with Directive (EU) 2015/2366 on payment services in the internal market. The Law entered into force on 13 August 2026 and will become applicable on 14 February 2027.
Law on Payment Services of the Republic of Srpska
· Published in the Official Gazette of the Republic of Srpska, No. 67/26 on 21 July 2026, the Law establishes a comprehensive legal framework for payment services and payment systems, including the rights and obligations of payment service providers and users, the execution of payment transactions, and the authorisation and supervision of payment institutions. It also regulates electronic money-related payment services and introduces rules aimed at improving the security, transparency and efficiency of electronic payments. It will become applicable on 1 January 2027, supporting the modernisation of the payment services framework in the Republic of Srpska.
Law on Amendments to the Law on Electronic Money of the Republic of Srpska
· Published in the Official Gazette of the Republic of Srpska, No. 67/26 on 21 July 2026, the Law amends the existing legal framework governing the issuance of electronic money and the operation and supervision of electronic money institutions. The amendments are linked to the new Law on Payment Services of the Republic of Srpska and will enter into force on 1 January 2027, alongside that Law.
Law on Amendments to the Law on Domestic Payment Transactions of the Republic of Srpska
· Published in the Official Gazette of the Republic of Srpska, No. 67/26 on 21 July 2026, the Law amends the existing legal framework by transferring the regulation of payment services to the new Law on Payment Services and narrowing the scope of the domestic payment transactions legislation, which will continue to govern matters such as current account registers, safe-deposit box registers and compulsory collection from bank accounts. The amendments will enter into force on 1 January 2027, alongside the new Law on Payment Services.
Decision on Granting Prior Approval for the Acquisition of a Qualifying Holding in an Electronic Money Issuer in the Republic of Srpska
· Published in the Official Gazette of the Republic of Srpska, No. 70/26 on 28 July 2026, the Decision amends the requirements and procedures for obtaining prior approval to acquire a qualifying holding in an electronic money issuer, including the regulatory approval process applicable to prospective acquirers. It entered into force on 5 August 2026.
Law on Supplementing the Consumer Protection Act
· On 26 June 2026, the "Law on Supplementing the Consumer Protection Act" was published in the State Gazette No. 58/2026. The supplement introduces a prohibition on increasing the prices of goods and services offered to consumers where the increase is not economically justified. The prohibition applies for a period of one year, from 9 August 2026 to 9 August 2027, and essentially continues the prohibition on unjustified price increases for goods and services offered to consumers that was in effect until 8 Augus 2026 under the law on the introduction of the euro in the Republic of Bulgaria. An increase is economically justified where it is in a direct and proportionate causal relationship with one or more objective economic factors. Under the Consumer Protection Act, objective economic factors are: (i) an increase in supply or production costs; (ii) an increase in labour costs; (iii) changes in the prices of energy, fuel or raw materials; (iv) changes in taxes, fees or other public charges; (v) changes in exchange rates or external economic conditions; (vi) other factors beyond the trader's control that have a material effect on costs or the conditions of supply.
Decision on the Use of the Radio Frequency Spectrum for Electronic Communications Networks
· On 18 August 2026, "Decision No. 259 of the Communications Regulation Commission of 30 July 2026 amending and supplementing the Rules for the Use of the Radio Frequency Spectrum for Electronic Communications Networks by the Mobile Radio Service after Licensing" was published in the State Gazette No. 74/2026. The amendments to the Rules for the Use of the Radio Frequency Spectrum for Electronic Communications Networks by the Mobile Radio Service after Licensing aim to bring Bulgarian legislation into line with Commission Implementing Decision (EU) 2026/291 of 9 February 2026 amending Implementing Decision (EU) 2021/1730 as regards additional use cases for the paired radio frequency bands 874.4-880 MHz and 919.4-925 MHz for mobile railway radio communications.
Instruction No. 3 on the Conditions and Procedure for Coordinating the Performance of Activities Arising from the Application of the Digital Services Act
· On 24 September 2026, "Instruction No. 3 of 30 July 2026 on the Conditions and Procedure for Coordinating the Performance of Activities Arising from the Application of Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a Single Market for Digital Services and Amending Directive 2000/31/EC (Digital Services Act)" was published in the State Gazette No. 87/2026. The Instruction was adopted by the Communications Regulation Commission, the Council for Electronic Media and the Commission for Personal Data Protection. It governs the conditions and procedure for coordination between the Communications Regulation Commission, the Council for Electronic Media and the Commission for Personal Data Protection in exercising their powers under the Digital Services Act and the Electronic Communications Act, and sets out the forms of interaction, exchange of information and coordination in connection with the supervision of providers of intermediary services under the Digital Services Act. The Instruction aims to ensure the effective, proportionate and consistent application of Regulation (EU) 2022/2065 and the Electronic Communications Act.
Regulation on the Implementation of the Cyber Solidarity Act
· The Regulation on the Implementation of the Cyber Solidarity Act, published in the Official Gazette No. 78/2026, entered into force on 25 July 2026. The Regulation designates the National Cyber Security Centre of the Security and Intelligence Agency (SOA) and the National CERT of the Croatian Academic and Research Network (CARNET) as the competent authorities for implementing Regulation (EU) 2025/38 (Cyber Solidarity Act). The National Cyber Security Centre acts as the national cyber hub and the single point of contact for requesting support from the EU Cybersecurity Reserve, while both authorities are responsible for coordinated preparedness testing and the review of significant and large-scale cybersecurity incidents.
Act on Amendments to the Civil Obligations Act
· The Act on Amendments to the Civil Obligations Act, published in the Official Gazette No. 69/2026, entered into force on 7 July 2026. The Act transposes Directive (EU) 2024/2853 on liability for defective products and extends the product liability regime to software, digital manufacturing files and related digital services integrated into or connected with products. The Act also expressly allows powers of attorney, demand bank guarantees and counter-guarantees to be issued in electronic form.
Act on Amendments to the Misdemeanour Act
· The Act on Amendments to the Misdemeanour Act, published in the Official Gazette No. 86/2026, entered into force on 15 August 2026, with the provisions on audio recording of main hearings applying from 1 July 2027. The Act further digitalises misdemeanour proceedings by introducing electronic filing and service through the courts' information system, including the use of qualified electronic signatures and seals. It also enables electronic creation, storage and archiving documents and, from 1 July 2027, introduces audio recording and automatic transcription of main hearings before courts.
Act on Amendments to the Road Transport Act
· The Act on Amendments to the Road Transport Act, published in the Official Gazette No. 77/2026, entered into force on 23 July 2026. The Act introduces new requirements for digital labour platforms through which taxi rides are ordered. Digital labour platforms must comply with the new requirements by 23 January 2027.
Act on Amendments to the Official Statistics Act
· The Act on Amendments to the Official Statistics Act, published in the Official Gazette No. 69/2026, entered into force on 7 July 2026. The Act implements Regulation (EC) No 223/2009 on European statistics, as amended by Regulation (EU) 2024/3018, and gives the Croatian Bureau of Statistics and other producers of official statistics the right to access, free of charge, data held by private data holders where necessary for official statistics.
Ordinance on the Manner of Temporary Seizure and Safekeeping of Virtual Assets
· The Ordinance on the Manner of Temporary Seizure and Safekeeping of Virtual Assets, adopted by the Ministry of the Interior and published in the Official Gazette No. 88/2026, entered into force on 20 August 2026. The Ordinance sets out the procedure for the temporary seizure and safekeeping of virtual assets, including virtual currencies and tokens, in criminal proceedings. It covers different forms of virtual asset wallets and regulates the transfer of seized assets to wallets controlled by the competent authority and the secure storage of private keys and seed phrases.
Ordinance on the Conversion of Accounting Documents Kept in Original Written Form into Electronic Records
· The Ordinance on the Conversion of Accounting Documents Kept in Original Written Form into Electronic Records, published in the Official Gazette No. 70/2026, entered into force on 9 July 2026, replacing the previous ordinance from 2019. The Ordinance sets out the conditions under which paper accounting documents may be converted into electronic records with the same legal effect as the originals.
Ordinance on Procurement Documents and Tenders in Public Procurement Procedures
· The Ordinance on Procurement Documents and Tenders in Public Procurement Procedures, published in the Official Gazette No. 94/2026, entered into force on 3 September 2026. The Ordinance regulates the electronic submission and processing of tenders through the Electronic Public Procurement Classifieds of the Republic of Croatia (EOJN RH).
Amendments to the Ordinance on the Operation of the eSpis System
· The Amendments to the Ordinance on the Operation of the eSpis System, published in the Official Gazette No. 84/2026, entered into force on 1 August 2026. The amendments further digitalise court case management, including by enabling certain documents in the e-Communication system and electronic case files to be signed using an application certificate of the eSpis system and introducing an algorithm for the random selection of judges to expanded panels of the Supreme Court.
Rules on Amendments to the Rules on the Keeping of, Access to and Use of the Electronic Archive of Notarial Deeds in Electronic Form
· The Rules on Amendments to the Rules on the Keeping of, Access to and Use of the Electronic Archive of Notarial Deeds in Electronic Form, published in the Official Gazette No. 69/2026, entered into force on 7 July 2026. The Rules provide that notarial acts performed without the parties being physically present may only be carried out through an electronic videoconferencing system approved by the Croatian Chamber of Notaries.
Amendments to the Court Rules of Procedure
· The Amendments to the Court Rules of Procedure, published in the Official Gazette No. 84/2026, entered into force on 1 August 2026. The amendments further digitalise court proceedings by enabling the use of application certificates of court information systems for authenticating court documents and allowing authorised public authorities to request certificates on pending criminal and misdemeanour proceedings through the Central Interoperability System.
Decision on Reports for the Purposes of Supervision of Credit Institutions
· The Decision on Reports for the Purposes of Supervision of Credit Institutions, adopted by the Croatian National Bank (HNB) and published in the Official Gazette No. 100/2026, entered into force on 30 September 2026, replacing the previous decision from 2021. The Decision regulates the IT solutions for the submission of supervisory reports to the HNB, including technical and validation requirements for reports submitted under the common EU reporting framework.
Government Regulation on Essential Services and Critical Infrastructure Significance Criteria
· The Government Regulation on essential services and significance criteria under the Critical Infrastructure Act published therein, published on 17 July 2026 in the Official Gazette No. 127/2026, entered into force on 18 July 2026. This Regulation specifies which services are essential and sets thresholds for identifying critical infrastructure entities. The sectors covered include electronic communications networks, internet exchange points, domain name system services, top-level domain registries, cloud computing, data centres and content delivery networks. The Regulation implements the framework of the Czech Critical Infrastructure Act and replaces the former rules for designating critical infrastructure elements.
Amendment to the Ordinance on Public-Sector Budget Reporting
· The Decree amending the rules on the submission of public-sector budget information published therein, published on 20 August 2026 in the Official Gazette No. 149/2026, will enter into force on 1 January 2027. The amendment updates Decree No. 5/2014 Coll. and requires state funds to submit and approve their FIN 1-12 SF financial reports in the Central State Accounting Information System, generally by the 20th day of the following month. It also revises the standardised structure of the report, including sections automatically generated from submitted data. The rules are relevant to electronic reporting and the processing of structured financial information in public administration.
Decree on Access to the Healthcare Education Administration Information System
· The Decree on access credentials for the Healthcare Education Administration Information System and the data maintained in that system published therein, published on 27 August 2026 in the Official Gazette No. 153/2026, entered into force on 1 September 2026. This Decree establishes procedures for identifying and authenticating healthcare professionals, healthcare providers and other authorised institutions, including electronic identification and the allocation of user access rights. It also defines the information recorded in electronic modules concerning professional training, accreditation, recognition of qualifications and evaluation.
Amendment concerning Distance Contracts for Financial Services
· The Act amending several laws in connection with distance contracts for financial services published therein, published on 2 September 2026 in the Official Gazette No.159/2026, will enter into force on 1 January 2027. The Act implements Directive (EU) 2023/2673 and strengthens consumer protection when financial services are purchased online. In particular, it addresses pre-contractual information, consumer explanations, the exercise of withdrawal rights through online interfaces and the prohibition of certain manipulative interface designs (dark patterns). The changes are relevant to digital financial services and online consumer contracting.
Draft Amendment on Liability for Defective Digital Products
· The Czech Government submitted a draft amendment to the Civil Code to the Chamber of Deputies (Parliamentary Print No. 295) on 3 September 2026. The proposal seeks to transpose Directive (EU) 2024/2853 on liability for defective products and modernise the liability regime for the digital economy. It extends the relevant product-liability concepts to software, including AI-based software, and digital manufacturing files, and addresses defects related to connected digital services and software updates. It also covers certain forms of damage involving data. The draft remained under parliamentary consideration as of 30 September 2026.
Draft Labour Code Amendment Accompanying the Platform Work Act
· The Czech Government submitted a draft amendment to the Labour Code and related legislation to the Chamber of Deputies (Parliamentary Print No. 300) on 8 September 2026. The proposal accompanies the new platform work legislation and addresses the implementation of the EU rules on pay transparency. In relation to digitalisation, it forms part of the proposed national framework for work arranged through digital labour platforms, including the treatment of employment relationships and the enforcement of workers' rights. The draft had not been enacted as of 30 September 2026.
Draft Act on Platform Work
· The Czech Government submitted the Draft Act on Platform Work to the Chamber of Deputies (Parliamentary Print No. 301) on 8 September 2026. The proposal aims to implement Directive (EU) 2024/2831 on improving working conditions in platform work. It introduces a framework for assessing employment status and regulating the use of automated monitoring and decision-making systems by digital labour platforms. The envisaged rules address transparency, the processing of workers' personal data, human oversight of algorithmic management and the review of significant automated decisions. As of 30 September 2026, the proposal was pending in the Chamber of Deputies.
Decree on the Critical Infrastructure Portal
· The Decree on the Critical Infrastructure Portal published therein, published on 30 September 2026 in the Official Gazette No. 178/2026, will enter into force on 1 October 2026. The Decree regulates the technical and organisational conditions for using an electronic portal through which critical infrastructure entities and the competent authorities exchange information and report incidents under the Critical Infrastructure Act. It establishes rules for authenticated access, identification of users, the management of access rights and the electronic submission of information. The portal is accessed through the crisis management information system.
Government Decree on promoting the right to repair
· On 23 July 2026, Government Decree No. 114/2026. (VII. 23.) on measures aimed at promoting the repair of goods and on the amendment of certain government decrees concerning consumer protection was published in Hungarian Gazette No. 2026/97. The decree transposes Directive (EU) 2024/1799 on common rules promoting the repair of goods into Hungarian law. The decree introduces new obligations for manufacturers, importers and distributors across the consumer goods sector, reflecting the EU's "right to repair" reform. Our detailed article on the topic can be found here.
Act on the repeal of certain provisions on crypto-asset conversion service
· On 30 July 2026, Act XXXVIII of 2026 on the repeal of certain legislative provisions concerning the crypto-asset conversion service was published in Hungarian Gazette No. 2026/102. The Act abolishes the obligation to validate crypto-asset conversions and removes the related criminal offence provisions from the Hungarian Criminal Code.
SARA Decree on cybersecurity conformity assessment bodies
· On 4 September 2026, Decree No. 9/2026. (IX. 4.) of the President of the Supervisory Authority for Regulatory Affairs (SARA) on certain rules applicable to conformity assessment bodies under the EU Cyber Resilience Act (Regulation (EU) 2024/2847) was published in Hungarian Gazette No. 2026/126. The decree establishes the national rules for notifying and registering conformity assessment bodies under the EU Cyber Resilience Act, as well as reporting requirements.
Law on the protection of personal data processed for the purpose of preventing and combating crime
· On 30 July 2026, Law No. 160 "on the protection of personal data processed for the purpose of preventing and combating crime" (Legea nr. 160/2026 privind protecția datelor cu caracter personal prelucrate în scopul prevenirii și combaterii infracțiunilor) was adopted by the Moldovan Parliament and published in the Official Gazette No. 382-385 Art. 404 of 20 August 2026. The law applies as of 23 August 2026 and establishes a separate framework for the processing of personal data by competent authorities for the prevention, detection and investigation of criminal offences, criminal prosecution, adjudication of criminal cases and execution of penalties. It provides for independent oversight of the lawfulness of processing and safeguards regarding the accuracy, security and confidentiality of data, complementing the general data protection framework under Law No. 195 of 25 July 2024 "on the protection of personal data".
Law on the market of crypto-assets
· On 24 August 2026, Law No. 180 "on the market of crypto-assets" (Legea privind piata criptoactivelor) was adopted by the Moldovan Parliament and published in the Official Gazette No. 456-459 Art. 479 of 17 September 2026. The law is to enter into force on 17 March 2027 and partially transposes Regulation (EU) 2023/1114 of the European Parliament and of the Council of 31 May 2023 on markets in crypto-assets and amending Regulations (EU) No 1093/2010 and (EU) No 1095/2010 and Directives 2013/36/EU and (EU) 2019/1937 (MiCAR). It sets and regulates the requirements for public offers and admission to trading on a trading platform of three types of crypto-asset: asset-referenced tokens, e-money tokens, and all other crypto-assets; the requirements for crypto-asset service providers; the transparency and disclosure rules for issuing, offering and admitting crypto-assets to trading; the mechanism of authorisation and supervision of service providers and of issuers of asset-referenced and e-money tokens, including rules on how they operate, are organised and are governed; the requirements for protection of crypto-asset holders and of the clients of service providers, as well as the measures against insider dealing, unlawful disclosure of inside information and market manipulation, to keep the crypto-asset market sound. The law's stated aim is to create a basic legal framework for a fair, transparent and secure crypto-asset market. It is meant to treat issuers and service providers proportionately and give them more legal certainty, and to protect the rights and legitimate interests of holders and investors, including through anti-money laundering requirements. It also aims to support financial stability and encourage technological development and innovation, in line with European and international standards.
Act on Data Protection
· On 4 September 2026, the new Act on Data Protection was adopted and published on 11 September 2026 in Montenegrin Official Gazette No. 133/2026. The Act transposes the majority of Regulation (EU) 2016/679 (GDPR) into Montenegrin law. The most significant difference is that the Montenegrin act sets ceilings for fines lower in absolute terms than the GDPR (the ceilings are set at EUR 1m / 2 % of worldwide annual turnover and EUR 2m / 4 % of worldwide annual turnover, whichever is higher). The Act entered into force on 19 September 2026, and will apply from 19 March 2027, giving organisations a six-month transition period to achieve full compliance.
Act on Electronic Identification and Trust Services
· On 26 June 2026, the new Act on Electronic Identification and Trust Services was adopted and published on 30 June 2026 in Montenegrin Official Gazette No. 92/2026. The Act transposes the majority of the eIDAS2 architecture into Montenegrin law, such as the European Digital Identity Wallet, voluntary use, user control, selective disclosure, trust services, assurance levels, electronic attestations of attributes and relying-party registration. The Act entered into force on 8 July 2026.
Act on Artificial Intelligence Systems
· On 27 July 2026, the Act of 3 July 2026 on Artificial Intelligence Systems (ustawa o systemach sztucznej inteligencji) was published. The Act establishes the national framework for the application of the EU AI Act (Regulation (EU) 2024/1689) in Poland and its main provisions entered into force on 11 August 2026. The Act creates the Commission for the Development and Security of Artificial Intelligence (Komisja Rozwoju i Bezpieczeństwa Sztucznej Inteligencji, KRiBSI) - an independent body responsible for market surveillance of AI systems, handling complaints regarding AI system malfunctions, issuing individual opinions for businesses and imposing penalties for violations. The Act also establishes the legal framework for regulatory sandboxes, allowing enterprises and institutions to test innovative AI solutions in a controlled environment under regulatory supervision. SMEs may participate in sandboxes free of charge. The remaining provisions concerning inspections, infringement proceedings and administrative fines will come into force on 28 October 2026.
Appointment of the Chair of the Commission for the Development and Security of Artificial Intelligence (KRiBSI)
· On 18 September 2026, the Sejm adopted a resolution on the appointment of the Chair of the Commission for the Development and Security of Artificial Intelligence, published in Monitor Polski 2026, item 945, on 25 September 2026. The Senate granted its consent on 24 September 2026 (Monitor Polski 2026, item 946). The appointment was made pursuant to the Act on Artificial Intelligence Systems, which requires the Chair to be appointed within two months of the Act's entry into force. The full Commission is to be established within three months, i.e. by November 2026.
Act on Data Governance
· On 23 July 2026, the Act of 27 March 2026 on Data Governance (ustawa o zarządzaniu danymi) entered into force. The Act supplements the EU Data Governance Act (Regulation (EU) 2022/868) by designating the President of the Personal Data Protection Office (UODO) as the national supervisory authority for data intermediation services and data altruism organisations. Since 23 July 2026, any provider of data intermediation services intending to operate in Poland must submit a notification to the President of UODO. The Act also establishes a framework for controlled access to public sector data, enabling, among other things, scientific and research institutions to request access to data held by public bodies, including data protected by trade secrets, intellectual property rights or containing personal data.
NIS2 implementation: KSC Register self-registration deadline approaching
· The amendment to the Act on the National Cybersecurity System (ustawa o krajowym systemie cyberbezpieczeństwa) of 23 January 2026, transposing Directive (EU) 2022/2555 (NIS2), entered into force on 3 April 2026. The self-registration window for key and important entities in the KSC Register (Wykaz KSC) opened on 7 May 2026 and closes on 3 October 2026. Entities subject to the new rules are required to analyse their activities against the criteria in the Act (in particular Article 5 and Annexes 1 and 2) and register via the dedicated application at wykaz-ksc.gov.pl. Around 38,000 entities, including approximately 27,000 public entities, may fall within the scope of the new framework. The full compliance deadline for implementing an Information Security Management System (SZBI), connecting to the S46 incident reporting system, and reporting incidents to CSIRTs is 3 April 2027.
Draft Act on the Protection of Minors from Access to Harmful Content on the Internet
· The Ministry of Digital Affairs continued work on the draft Act on the Protection of Minors from Access to Pornographic Content on the internet. The draft, finalised at the Council of Ministers stage in June 2026, prohibits age verification based solely on a user's self-declaration and envisages the use of electronic attestations of age delivered through the European Digital Identity Wallet as the preferred mechanism. The President of UODO issued comments on the draft, noting that while the direction of the legislative changes is correct, the draft raises concerns regarding the right to privacy and the protection of personal data, particularly in relation to the proposed age verification methods and the risk of overprocessing personal data or profiling users.
CNA Decision on influencers' notification obligation
· The National Audiovisual Council (CNA) Decision No. 116/2026 on the procedure for licensing, authorising and notifying audiovisual media services, was published in the Romanian Official Gazette, Part I, No. 718, and entered into force on 27 September 2026. The Decision regulates the granting, amendment, renewal and transfer of audiovisual licences and authorisation decisions for services distributed through electronic communications networks, digital terrestrial systems or terrestrial radio. It also establishes notification rules for on-demand audiovisual media services, including channels operated on video-sharing platforms. Users meeting the applicable criteria, including at least 100,000 followers or subscribers, 24 uploads in the preceding 12 months and a commercial benefit, must notify the CNA. The Decision further addresses local programming, accessibility for persons with disabilities, protection of minors, pluralism and electronic filing, and grants existing providers 60 days from entry into force to complete the required notifications.
Law No. 119/2026 on the inventory and administration of public digital infrastructure and the creation of the National Platform for Public Digital Infrastructure (PNIDP)
· On 3 July 2026, Law No. 119/2026 on the inventory and administration of public digital infrastructure and the creation of the National Platform for Public Digital Infrastructure (PNIDP), was published in the Romanian Official Gazette, Part I, No. 550. The Law establishes PNIDP as a national-interest IT system administered by the Authority for the Digitalisation of Romania (ADR) and requires public authorities and other entities under their authority to register their public digital resources. It introduces specialised registers for domains, websites, applications, software licences, hardware and digital projects, as well as persistent unique codes and source codes, minimum technical standards, interoperability and cybersecurity requirements. Public entities must appoint a digital officer and register their resources within six months of the Law's entry into force. The Law enters into force on 3 January 2027 and provides for fines ranging from RON 5,000 to RON 10,000 for non-compliance.
ANAF Procedure on the use of bodycams by antifraud inspectors
· On 7 July 2026, the Procedure on the conditions for using portable audio-video bodycams by antifraud inspectors of the National Fiscal Administration Agency (ANAF) in the performance of their duties, forming part of Order No. 851/2026, published in the Romanian Official Gazette, Part I, No. 555, entered into force. The Procedure regulates bodycam use during anti-fraud inspections, identity checks, financial-crime investigations, evidence gathering and the monitoring of transports, including through the RO e-Transport system. Bodycams are worn on the upper part of the inspector's uniform or protective equipment, and active recording must be signalled to the persons concerned. Recording starts when the inspection action begins and stops when it ends; persons must be informed, unless the circumstances prevent prior notification. Evidence intended for judicial proceedings must be marked, local downloads require approval, and access, consultation, duplication and destruction are recorded. Inspectors must receive training on operation and personal data protection, while improper use constitutes a disciplinary offence.
Law No. 123/2026 supplementing the Cybersecurity Framework and the Criminal Code
· Law No. 123/2026, supplementing Article 36 of Government Emergency Ordinance No. 155/2024 on the cybersecurity framework and the Criminal Code, was published in the Romanian Official Gazette, Part I, No. 550 on 3 July 2026 and entered into force on 6 July 2026. The Law requires the National Cybersecurity Directorate (DNSC) to consult an advisory committee composed of several authorities. It also introduces Article 3651 into the Criminal Code, providing that certain offences relating to unlawful access, interception or interference do not constitute offences where the conduct concerns the investigation and reporting of vulnerabilities in information and communication technology products or services and the statutory conditions are cumulatively met.
Orders and norms of DNSC
· DNSC adopted a series of orders and norms, such as:
Act on Measures to Reduce the Cost of Deploying Very High-Capacity Electronic Communications Networks
· On 31 August 2026, the Act on Measures to Reduce the Cost of Deploying Very High-Capacity Electronic Communications Networks was adopted and published in the Serbian Official Gazette No. 80/2026. The Act aims to reduce costs and to facilitate and accelerate the deployment of very high-capacity electronic communications networks. It regulates access to and use of existing physical infrastructure, coordination of civil works, and transparency regarding infrastructure and planned works. The Act entered into force on 8 September 2026.
Draft Act on Data Protection
· On 30 July 2026, the ministerial draft of the Act on Data Protection was published. The public consultation period ended on 10 September 2026, and the draft is yet to enter the parliamentary procedure. The draft is intended to update the current framework governing processing principles, individuals' rights, controllers' and processors' obligations, international transfers, supervision and remedies. Notable proposed changes include specific rules on artificial intelligence and video surveillance, a separate part governing processing by competent authorities for special purposes, and broader standard contractual clauses for international data transfers.
Act on the Implementation of the EU Regulation on the establishment of "Eurodac" for the comparison of biometric data
· On 1 July 2026, the Act on the Implementation of the EU Regulation on the establishment of "Eurodac" for the comparison of biometric data (Zakon o izvajanju Uredbe (EU) o vzpostavitvi sistema Eurodac za primerjavo biometričnih podatkov, Official Gazette of the Republic of Slovenia, No. 1100/26) was adopted. While Regulation (EU) 2024/1358 establishes the "Eurodac" system, the national implementing law regulates how biometric and other personal data is processed, stored and finally transmitted into the common "Eurodac" system. It designates the police and the Ministry of the Interior as the competent bodies for the processing of data, who are also entitled to finally transmit biometric and other personal data into the "Eurodac" system. The Act entered into force on 2 July 2026.
Act on the Implementation of the EU Regulation on establishing the European High-Performance Computing Joint Undertaking
· On 15 July 2026, the Act on the Implementation of the EU Regulation on establishing the European High-Performance Computing Joint Undertaking (Zakon o izvajanju Uredbe (EU) o ustanovitvi Skupnega podjetja za evropsko visokozmogljivostno računalništvo, Official Gazette of the Republic of Slovenia, No. 1265/26) was adopted. It designates the ministry responsible for science as the competent authority for facilitating the implementation of the EU Regulation (Regulation (EU) 2021/1173), with the ministry also responsible for ensuring Slovenia's financial contribution as a Participating State to the EuroHPC JU. The Act entered into force on 24 July 2026.
Rules amending the Rules on the Implementation of the Tax Procedure Act
· On 1 July 2026, the Rules amending the Rules on the implementation of Tax Procedure Act (Pravilnik o spremembah in dopolnitvah Pravilnika o izvajanju Zakona o davčnem postopku, Official Gazette of the Republic of Slovenia, No. 1121/26) were adopted. They specify how the provisions on reporting rules for reporting crypto-asset service providers are to be implemented in practice, such as the means of providing the required information, the fulfilment of due diligence obligations, and reporting of the value of transactions in crypto-assets. The Rules entered into force on 4 July 2026.
Regulation on the Sale of Refurbished Products
· On 27 June 2026, the new Yenilenmiş Ürünlerin Satışı Hakkında Yönetmelik (Regulation on the Sale of Refurbished Products – the "Regulation") was published. The Regulation, which entered into force on 1 August 2026, introduces a digital registration and tracking system through the Yenilenmiş Ürün Bilgi Sistemi ("YÜBİS"), expands the scope of products eligible for refurbishment to include televisions, and introduces new requirements concerning refurbishment centres and the sale of refurbished products.
Amendment to the Regulation on Commercial Advertising and Unfair Commercial Practices
· On 1 July 2026, the Ticari Reklam ve Haksız Ticari Uygulamalar Yönetmeliğinde Değişiklik Yapılmasına Dair Yönetmelik (Regulation Amending the Regulation on Commercial Advertising and Unfair Commercial Practices – the "Amendment Regulation") was published. The Amendment Regulation, which entered into force on 1 August 2026, introduces new rules on targeted advertising, AI-generated advertising and commercial content published by social media influencers. In particular, it introduces transparency requirements for targeted advertising based on consumers' online behaviour and personal data and prohibits targeted advertising based on profiling using children's personal data.
Principle Decision on the Processing of Personal Data of Accident Victims
· On 1 July 2026, the Kişisel Verileri Koruma Kurulu (Turkish Personal Data Protection Board – the "Board") published Principle Decision No. 2026/1095, dated 20 May 2026, concerning the processing of personal data of accident victims. The Principle Decision follows complaints concerning accident victims being contacted without their request by claims consultancy companies, lawyers and other persons. The Board requires data controllers processing accident victims' personal data to implement appropriate technical and organisational measures, including access restrictions based on the principle of least privilege, role-based access controls and logging and monitoring mechanisms. Failure to comply may result in administrative action under the Kişisel Verilerin Korunması Kanunu (Personal Data Protection Law – "KVKK").
Principle Decision on the Online Publication of Personal Data by Public-Sector Data Controllers
· On 28 July 2026, Principle Decision No. 2026/1301, dated 1 July 2026, concerning the online publication of personal data by public-sector data controllers was published in the Official Gazette. The Board emphasised that making documents containing personal data publicly available online constitutes processing of personal data and must have an appropriate legal basis and comply with the general principles under the KVKK. Public-sector data controllers must limit disclosures to data necessary for the relevant purpose and apply measures such as masking and anonymisation where appropriate. Existing online content must also be reviewed, and appropriate technical and organisational measures must be implemented to prevent unnecessary disclosure of personal data.
Guidelines on Personal Data Protection in Lawyers' Professional Activities
· On 22 September 2026, the Authority published the Avukatların Mesleki Faaliyetlerinde Kişisel Verilerin Korunmasına İlişkin Uygulama Rehberi (Guidelines on Personal Data Protection in Lawyers' Professional Activities – the "Guidelines"), prepared in cooperation with the Türkiye Barolar Birliği (Union of Turkish Bar Associations). The Guidelines provide practical guidance on compliance with data protection legislation in lawyers' professional activities, including the roles of data controllers and processors, legal bases for processing, special categories of personal data, domestic and international data transfers and data security. They also address data protection considerations arising from the use of generative AI tools in legal practice.
János
Böszörményi
Counsel
austria vienna