LawbsterAnalysis, timelines, and explainers on EU digital law.
The Digital Services Act (DSA) sets EU-wide rules for online intermediaries, from hosting providers to social networks. It has applied in full since 17 February 2024, with obligations that increase with the size and role of the service. This page collects the key dates, the obligations by tier and answers to the questions raised most often by users and platform teams.
The EU AI Act applies in phases from 2024 to 2030. This page collects every deadline that matters in practice: what applies when, what the Digital Omnibus changed, which provision each date comes from, and answers to the questions raised most often on scope, definitions and obligations.
The Cyber Resilience Act (CRA) sets cybersecurity requirements for nearly every hardware and software product sold in the EU. Its obligations apply in three waves between 2026 and 2027, including reporting duties that extend to products already on the market. This page collects every deadline, together with answers to the questions raised most often in practice.
The Data Act gives users of connected products a right to the data those products generate, sets fairness rules for business-to-business data sharing, lets public bodies request data in exceptional need and enshrines the right to switch cloud services. Most of it has applied since 12 September 2025; the remaining obligations arrive between September 2026 and September 2027, and national enforcement is taking shape, in Germany since 30 May 2026.
The EU has pushed back the AI Act's toughest deadlines, narrowed what counts as high-risk and added new prohibitions. It is the most consequential change to Europe's flagship AI law since it took effect.