Primary Law
9 instrumentsWorld's first comprehensive AI governance framework. Risk-based classification: unacceptable (banned), high-risk (conformity assessment), limited (transparency), minimal. GPAI model obligations for providers of general-purpose AI. EU AI Office established for GPAI oversight. Penalties up to €35M or 7% global turnover. Central pillar of EU digital sovereignty strategy.
Overhauls EU telecoms framework for 5G/6G era. Enables cross-border spectrum coordination, incentivises fiber investment, addresses telecom-Big Tech fair share debate. Controversial: telcos want Big Tech to pay for network usage; tech companies oppose. €174B investment gap to meet 2030 Digital Decade targets.
Harmonises rules on fair access to and use of data. IoT data portability, cloud switching rights (within 30 days), government access to private sector data in emergencies. Directly impacts hyperscaler cloud providers. Cloud switching provisions key for EU sovereign cloud alternatives.
Creates framework for voluntary data sharing across EU. Establishes rules for re-use of public sector data, data intermediaries, and data altruism organisations. European Data Innovation Board coordinates national practices. Commission published first review report late 2025; identified low uptake of data intermediary registration. Foundation layer for EU data sovereignty — ensures data sharing on European terms rather than US/CN hyperscaler platforms.
€43B mobilised (public + private) to double EU semiconductor market share to 20% by 2030. Intel suspended/cancelled its €30B Magdeburg fab in Sep 2024, severely undermining the 20% target. Remaining strategic projects: TSMC Dresden (ESMC JV), GlobalFoundries Dresden expansion, STMicro Agrate (IT). EU currently at 8% global chip production. Crisis response mechanism for supply disruptions.
Extends cybersecurity obligations to 18 sectors including cloud, data centers, DNS providers. Mandatory incident reporting within 24 hours. As of early 2026, only ~10 of 27 member states fully transposed NIS2 by the Oct 2024 deadline. Commission launched infringement proceedings against 23 member states in Nov 2024. Belgium, Germany, France, Spain among those that missed the deadline. Directly applies to all major DC operators in EU.
DSA: platform accountability for illegal content, algorithmic transparency, risk assessments for VLOPs. DMA (EUR-Lex: CELEX:32022R1925): designates 7 gatekeepers (Alphabet, Amazon, Apple, ByteDance, Meta, Microsoft, Samsung) with strict obligations: interoperability, data portability, no self-preferencing. Commission actively enforcing — Apple fined €1.84B, multiple non-compliance investigations. Core instruments for EU digital sovereignty against dominant US/CN platforms.
Voluntary (initially) EU-wide cloud security certification. Controversy: original 2024 draft included "High+" sovereignty tier requiring EU-headquartered providers and no extraterritorial data access (targeting CLOUD Act). Under industry/US pressure, sovereignty provisions were weakened in leaked Mar 2024 draft. France, Germany push to restore strong sovereignty requirements. Critical for determining whether EU institutions can use US hyperscaler clouds.
Protects media pluralism and editorial independence. Bans spyware against journalists. Requires transparency on media ownership and state advertising allocation. Obliges VLOPs to notify media before content removal. European Board for Media Services operational since Aug 2025. Full application since Aug 2025 — now in enforcement phase. Directly relevant to information sovereignty and countering foreign information manipulation.