The regulations that matter, explained simply.

The EU's risk-based law for AI systems and general-purpose AI models, with phased obligations and fines up to EUR 35m or 7% of turnover.

EU directive setting cybersecurity risk-management, governance, and incident-reporting duties across 18 critical sectors.

The EU's data protection law governing how personal data of people in the EU/EEA is collected, used, and protected.

US federal law setting national standards to protect the privacy and security of individuals' health information held by health entities.

EU rules making online intermediaries accountable for illegal content, transparency, and systemic risks, with fines up to 6% of global turnover.

EU law requiring large companies to run human-rights and environmental due diligence across their chain of activities; delayed and narrowed by Omnibus I.

EU directive requiring large and listed companies to report standardised sustainability information; significantly narrowed and delayed by the 2026 Omnibus reform.

EU law banning placement/export of 7 commodities and derived products linked to deforestation after 31 Dec 2020; due diligence applies from 30 Dec 2026.

UK law requiring large businesses to publish an annual statement on steps taken to address slavery and human trafficking in their operations and supply chains.

EU rules strengthening equal pay for equal work through pay transparency, gender pay gap reporting, and stronger enforcement.

ISO 14001:2015 is the international standard for environmental management systems, helping organizations manage environmental responsibilities via a PDCA framework.

The EU 2024 AML package: a single rulebook (AMLR), a sixth directive (AMLD6) and a new EU authority (AMLA) in Frankfurt.

DORA is the EU regulation setting uniform ICT and cyber resilience rules for financial entities and their tech providers, applying from 17 Jan 2025.

EU-wide rules for crypto-asset issuers and service providers; ART/EMT rules apply from 30 Jun 2024, CASP rules from 30 Dec 2024.

EU framework regulating investment firms and trading venues, strengthening investor protection, best execution, transparency and reporting.

EU directive modernising payment services: opens bank-account access to third parties and mandates strong customer authentication for electronic payments.

EU directive requiring organisations with 50+ workers to set up reporting channels and protect whistleblowers from retaliation.

ISO 45001:2018 is the international standard for occupational health and safety management systems, helping organizations prevent work-related injury and ill health.

ISO/IEC 27001:2022 is the international standard for information security management systems (ISMS), specifying requirements and 93 controls.

Global security standard for organizations that store, process, or transmit cardholder data; enforced by the card brands, not a law.

SOC 2 is an AICPA attestation report in which a licensed CPA examines a service organization's controls against the Trust Services Criteria.

ISO 9001 is the international standard for quality management systems, setting requirements organisations can be certified against. Voluntary.

EU classification system defining when an economic activity counts as environmentally sustainable, used for sustainability disclosures.

EU rules requiring financial firms to disclose how they handle sustainability risks and ESG impacts at entity and product level.