EU implements new cybersecurity and data regulations

The European Union is implementing a wave of cybersecurity and data regulations, including NIS2, the Digital Operational Resilience Act (DORA), and the Cyber Resilience Act (CRA). These mandates are being integrated into national laws, such as in Germany, requiring companies to evolve their governance, risk, and compliance structures.

To meet these standards, experts suggest an integrated approach that combines information security with risk and quality management. A structured assessment is recommended to identify gaps between current company status and new regulatory requirements.

In an effort to boost competitiveness, the European Commission introduced the ‘Digital Omnibus’ in late 2025. This initiative aims to simplify rules regarding data, cybersecurity, and artificial intelligence to reduce administrative burdens. Henna Virkkunen, EU Commissioner for Technological Sovereignty, Security and Democracy, stated that rules should create value rather than acting as a burden. However, despite these simplification efforts, the regulatory landscape is expected to remain complex and challenging for organizations through 2026 due to the gradual nature of legislative changes.