Resources · Regulatory watch: UK and Europe
Compliance regulations Europe 2026: where UK and EU rules stand, and what changed
Twelve UK and EU rules, each with its current status and date.
How we track changes
Dates move. Read the source, then act.
Sterling tracks changes at source: each page below is written from EUR-Lex, the European Commission, the ICO, NCSC and IASME, and states only dates they confirm.
When a rule changes, confirm it is adopted and when it applies to you. Then map it to your controls, update your legal register and evidence, and brief management where the law makes it accountable. Sustain™ keeps a programme current; Revise™ handles scope changes and new frameworks.
Regulations and schemes
Twelve rules, one status line each
Start with the rule that reaches your sector or product.
- NIS2 Compliance Consulting (Directive 2022/2555)Four Member States were referred to the Court of Justice on 8 July 2026; most others have transposed.
- DORA Compliance Consulting for Financial EntitiesIn application since 17 January 2025 for financial entities in scope.
- EU AI Act Compliance Consulting (Regulation 2024/1689)Most rules apply from 2 August 2026; high-risk dates moved to 2 December 2027 and 2 August 2028.
- Cyber Resilience Act Compliance and Requirements: CE-Ready ProductsManufacturer reporting applies from 11 September 2026; main obligations from 11 December 2027.
- CSRD and ESRS Sustainability Reporting Consulting in 60+ CountriesNarrower scope in force since 18 March 2026; simplified ESRS adopted 3 July 2026, not yet in force.
- GDPR Compliance Consulting in 60+ CountriesThe Commission renewed its UK adequacy decisions on 19 December 2025.
- UK GDPR Compliance and Requirements: Data Protection Act 2018Amended by the Data (Use and Access) Act 2025 (Royal Assent 19 June 2025), commencing in stages.
- Cyber Essentials Certification ConsultingThe Danzell question set (v3.3) has applied since 27 April 2026.
- NCSC CAF Assessment and Requirements: UK Cyber Resilience OutcomesCAF v4.0, released on 6 August 2025, is the current version.
- EU MDR Compliance Consulting (Regulation 2017/745) in 60+ CountriesApplied since 26 May 2021; the December 2025 simplification proposal was not law in September 2026.
- EU IVDR Compliance Consulting (Regulation 2017/746)Applied since 26 May 2022; eligible legacy class D devices may be placed until 31 December 2027.
- UKCA Marking Compliance: GB Product Conformity and DocumentationThe UK government has extended recognition of CE marking in Great Britain; rules vary by sector.
Status as checked in September 2026. The full list, including CE marking and the EU Taxonomy, is in the menu.
- 60+countries where Sterling has delivered certification
- 21countries with a Sterling office, eight regions, one coordinated team
- 2003the year the group began implementing ISO management systems; the same method, refined, since
- 8,100+client engagements across the group, from single-site SMEs to multinationals
FAQs
Questions about UK and EU regulatory change
Short answers on what a change means for you.
Does a Commission proposal change what we must do today?
No. A proposal binds nobody until it is adopted and published in the Official Journal, as the AI Act’s Digital Omnibus was in July 2026.
Is there a certificate for NIS2 or DORA?
No. ISO/IEC 27001 supports both but does not equal compliance. Sterling prepares the programme and evidence; Sterling never certifies.
Talk to a consultant
Tell us which rules reach you; we will map what changes
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice