The EU Digital Law Pipeline: What Is Coming After the 2026 Deadlines

Most compliance content covers rules that already apply. That is useful for the next audit and useless for planning, because the expensive decisions are architectural and architecture gets set eighteen months before a deadline.

This is the other half of the picture: what is currently moving through the European legislative machine, roughly when it lands, and which of it should actually influence what you build now.

A warning up front. Proposals change, some die, and dates slip. Nothing here is a reason to build against an unadopted text. It is a reason to avoid building something that an obviously incoming rule will make expensive.

How to read the stages

European law moves through predictable stages, and where a file sits tells you how much to trust it.

Announced in the Work Programme. The Commission has said it intends to propose something. No text. Directionally useful, nothing more.

Proposal published. There is a text. It will change, often substantially, but the shape and the definitions are now visible.

Council general approach and Parliament mandate. Both co-legislators have positions. The negotiating range is now visible: anything both sides agree on is very likely to survive.

Trilogue. Closed-door negotiation between Parliament, Council and Commission. Outcomes are usually somewhere between the two mandates.

Political agreement, then formal adoption, then entry into force, then application. The gap between adoption and application is where you actually do the work, and it is typically eighteen months to three years.

The practical rule: once both co-legislators have published mandates, the parts they agree on are safe to plan around. Before that, treat everything as directional.

In negotiation now

The Digital Omnibus

The largest simplification package in the current cycle, proposed in November 2025. It touches GDPR, the AI Act, the Data Act, ePrivacy and cybersecurity reporting. The AI Act part was split off and is already law: Regulation (EU) 2026/1744, in force since 27 July 2026.

The parts that matter most to product teams are the Commission's proposed Articles 88a and 88b, which would move cookie consent rules out of the ePrivacy Directive and into GDPR itself, widen the exemptions where no consent is required, introduce a six month silence period after a refusal, and make browser-level machine-readable consent signals legally binding.

The GDPR and ePrivacy half has not reached trilogue. As of 10 October 2026 the Council has no negotiating mandate (a vote by EU ambassadors planned for 7 October was postponed, reportedly to 11 October), and Parliament's committees are still working through more than 1,750 amendments to their June 2026 draft report. The Council's compromise text keeps cookie rules in the ePrivacy Directive, drops Articles 88a and 88b, and shortens the wait after a refusal to four months. This is still the single most likely near-term change to how consent works in practice, and we covered our reading of it in cookie consent after the Digital Omnibus.

Who should care: anyone running a consent management platform, analytics, advertising or personalisation.

The digital euro package

Council position December 2025, Parliament committee mandate approved 43 to 14, trilogues opened July 2026, with all three institutions aiming to finish during 2026. The ECB pilot runs from the second half of 2027 with a target of first issuance in 2029.

Full detail in our digital euro implementation guide.

Who should care: banks, payment service providers, e-commerce platforms, point of sale vendors.

Financial Data Access, known as FiDA

The open finance file. It extends open-banking-style data access beyond payment accounts into investments, pensions, insurance and mortgages, and creates a new regulated category of financial information service provider.

FiDA has had the most troubled passage of anything in this list. Trilogues made little visible progress after mid 2025, and in April 2026 the Commission sent the Council a non-paper proposing a narrower scope to get them moving again. Application would be phased and is realistically not before the end of the decade.

Who should care: fintech, insurtech, wealth platforms, anyone whose product would benefit from permissioned access to financial data beyond current accounts.

Agreed but not yet applying

PSD3 and the Payment Services Regulation

Council and Parliament reached provisional political agreement on the payments framework on 27 November 2025. This is the overhaul of PSD2: stronger fraud prevention obligations, a broader liability allocation for certain fraud types including impersonation fraud, changes to strong customer authentication, performance requirements for open banking interfaces, and a merger of the payment institution and e-money institution regimes.

The agreed texts are not in the Official Journal yet. As of 10 October 2026, Parliament's procedure file shows them awaiting the Council's formal first reading position, with a final plenary vote indicatively set for 14 December 2026. Because it is a Regulation plus a Directive, part applies directly and part has to be transposed. Expect application towards the end of the decade rather than immediately.

Who should care: any product that initiates payments, holds customer funds, or consumes open banking APIs.

Proposed, positions forming

The European Business Wallet

Proposed as the corporate counterpart to the EU Digital Identity Wallet. Where the EUDI wallet holds a person's credentials, the business wallet holds a company's: registration data, mandates, representation rights, certificates, and the ability to exchange signed documents across borders.

The Council adopted its negotiating position on 9 June 2026, and Parliament's ITRE committee adopted its report and a mandate to negotiate on 10 September 2026, so trilogues can start. The ambition is political agreement by the end of 2026. The Commission proposed that public bodies accept business wallets within 24 months of entry into force; the Council's text replaces that deadline with a later one: two years after the last implementing acts start to apply.

Detail in our European Business Wallet guide.

Who should care: anyone building B2B onboarding, procurement, supplier verification, e-invoicing or regulated business processes.

The Cloud and AI Development Act

A flagship of the Commission's technology sovereignty agenda, proposed on 3 June 2026 as COM(2026) 502. It covers research and innovation, faster permitting for data centres (the stated aim is to at least triple EU data centre capacity by 2030), and a single EU framework of four sovereignty assurance levels for cloud services. Public buyers would have to procure at least level 1, and levels 2 to 4 for activities that matter to public order.

The subtext is dependency on non-European cloud providers, and the mechanism most likely to have teeth is public procurement rather than direct regulation of private buyers.

Detail in our Cloud and AI Development Act guide.

Who should care: cloud providers, anyone selling software to European public sector buyers, and anyone whose architecture assumes a single hyperscaler.

The Digital Networks Act

Introduced in January 2026 after several postponements. It rewrites telecoms governance: spectrum harmonisation, the single market for electronic communications, network security standards, and the long-running argument about whether large traffic originators should contribute to network costs.

Who should care: telecoms operators, CDN and connectivity providers, and any service whose economics depend on cheap transit.

The Digital Fairness Act

Targeted for the fourth quarter of 2026, so a proposal rather than a law for some time yet. It is aimed squarely at dark patterns, addictive design, influencer marketing, and personalisation practices that exploit consumer vulnerability, including personalised pricing.

This one deserves attention well before it applies, because it targets interface patterns that many products currently depend on for conversion. Detail in our Digital Fairness Act guide.

Who should care: consumer-facing products of every kind, especially subscription, gaming, marketplace and social.

Chips Act revision

The Commission proposed a Chips Act 2.0 on 3 June 2026 (COM(2026) 504), which would repeal and replace the 2023 Chips Act. The first Chips Act was widely seen as underpowered relative to its ambition. The new text adds crisis tools, including priority-rated orders for critical sectors, alongside support for production facilities and design. The funding side is covered in our Chips Act funding guide.

Who should care: semiconductor and hardware companies, and anyone tracking European industrial policy money.

Public procurement reform

The Commission proposed a Public Procurement Act on 9 September 2026 (COM(2026) 590). It would replace the three 2014 procurement directives with a single Regulation and add a European preference framework that lets public buyers restrict participation or favour EU origin in strategic areas. If you sell to European public buyers, procurement rules are the mechanism through which a surprising amount of technology policy actually reaches you.

Who should care: anyone with public sector revenue in Europe.

Announced, still shapeless

Several initiatives have been signalled without a text: a Quantum Act (planned for the second quarter of 2026, still not proposed on 10 October 2026, and reported to be at risk of slipping into 2027), further work on AI in science, and continuing work on the European Health Data Space rollout. There is also the long-running child sexual abuse regulation, commonly called chat control, which has repeatedly stalled over client-side scanning and remains unresolved.

Treat these as radar items. Knowing they exist is worth something. Designing around them is not.

What has gone the other way

It is worth knowing what has been withdrawn or deprioritised, because a lot of published commentary has not caught up.

The AI Liability Directive was withdrawn. The ePrivacy Regulation, which spent years going nowhere, was abandoned and its subject matter is being handled through the Digital Omnibus instead. The Green Claims Directive has had a difficult passage and its final shape is not settled, though the related Empowering Consumers Directive has applied since 27 September 2026 regardless.

Simplification is now an explicit political theme. That does not mean less regulation in aggregate, but it does mean some files are being consolidated rather than added.

How to use this without wasting effort

The temptation with a list like this is to build a tracker and assign an owner to each row. That produces a spreadsheet.

What actually works:

Sort by whether it requires a design decision. Consent architecture, identity and credential handling, payment method abstraction and data access interfaces are expensive to retrofit. Reporting processes and documentation are not. Only the first category justifies acting before adoption.

Look for the shared substrate. Consent infrastructure built well serves the Digital Omnibus changes. Credential verification built for the EUDI wallet largely serves the business wallet. Payment method abstraction serves instant payments, Wero and the digital euro alike. Three files, one piece of platform work.

Watch mandates, not proposals. When Council and Parliament both publish positions, the overlap is the safe zone. That is the moment to start building, not the day a proposal is published.

Write down what you decided and when. Most of these regimes expect you to be able to explain your reasoning. A short architecture decision record with a date beats a policy document written afterwards.

Where we fit

We build and maintain software for companies operating in Europe, which increasingly means building systems that can absorb regulatory change without a rewrite. The work is mostly unglamorous: abstraction at the right seams, explicit state, and configuration where the law has left a number deliberately adjustable.

If you want a view on which of these files actually touches a specific product, write to office@c9group.dev. The rules that already apply are mapped in our 2026 EU digital compliance guide, and more about our European work is on the EU market entry page.

We are engineers, not lawyers, and this is a planning map rather than legal advice. Everything above is a moving target until it is in the Official Journal.