European Union country pack.
EU-level rules that apply in all 27 member states: GDPR, DORA, NIS2, the AI Act (as amended by the 2026 Digital Omnibus on AI), the 2024 AML package, the EBA guidelines on internal governance and third-party risk, the new Consumer Credit Directive, CSRD/ESRS after the 2026 Omnibus I changes, and the audit rules for public-interest entities. It is for banks, payment and e-money institutions, insurers, investment firms, non-bank lenders, listed companies and large enterprises. National transposing laws and national supervisors' own rules are not included and need a country pack.
Frameworks and regulations.
| Instrument | Applies to | Requirements | Status |
|---|---|---|---|
| Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) European Parliament and Council of the EU · Regulation (EU) 2016/679, OJ L 119, 4.5.2016; applies since 25 May 2018; no amendment to the articles adopted as of October 2026 | Banks, Insurers, Finance companies, Payment providers and more | 30 | Source checked |
| Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector (Digital Operational Resilience Act) European Parliament and Council of the EU; RTS/ITS by the European Commission on drafts of the ESAs (EBA, ESMA, EIOPA) · Regulation (EU) 2022/2554, OJ L 333, 27.12.2022; applies from 17 January 2025; with its RTS/ITS adopted 2024–2025 | Banks, Insurers, Payment providers, Capital market firms | 30 | Source checked |
| Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive) European Parliament and Council of the EU · Directive (EU) 2022/2555, OJ L 333, 27.12.2022; transposition deadline 17 October 2024; Implementing Regulation (EU) 2024/2690 | Critical infrastructure, Large enterprises, State-owned enterprises, Government bodies | 26 | Source checked |
| Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act), as amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI) European Parliament and Council of the EU; AI Office (European Commission) for GPAI · Regulation (EU) 2024/1689 (in force 1 August 2024), amended by Regulation (EU) 2026/1744 of 8 July 2026 (in force 27 July 2026) | Banks, Insurers, Finance companies, Payment providers and more | 23 | Being confirmed |
| EU AML/CFT package: Regulation (EU) 2024/1624 (AMLR), Directive (EU) 2024/1640 (AMLD6) and Regulation (EU) 2024/1620 (AMLA Regulation), with the current regime under Directive (EU) 2015/849 European Parliament and Council of the EU; AMLA (RTS and guidelines) · Regulation (EU) 2024/1624 of 31 May 2024, applies from 10 July 2027; until then Directive (EU) 2015/849 as amended by Directive (EU) 2018/843, as transposed nationally | Banks, Finance companies, Payment providers, Exchange houses and more | 21 | Source checked |
| EBA Guidelines on internal governance under Directive 2013/36/EU European Banking Authority · EBA/GL/2021/05 of 2 July 2021, applicable from 31 December 2021 (revision consulted as EBA/CP/2025/20) | Banks | 28 | Source checked |
| EBA Guidelines on the sound management of third-party risk related to non-ICT services European Banking Authority · EBA/GL/2026/09 of 18 September 2026, replacing the EBA Guidelines on outsourcing arrangements (EBA/GL/2019/02) from the application date set after translation | Banks, Payment providers, Capital market firms, Finance companies | 18 | Source checked |
| Directive (EU) 2023/2225 of the European Parliament and of the Council of 18 October 2023 on credit agreements for consumers and repealing Directive 2008/48/EC European Parliament and Council of the EU · Directive (EU) 2023/2225; transposition by 20 November 2025; applies from 20 November 2026 | Banks, Finance companies, Payment providers | 18 | Being confirmed |
| Corporate Sustainability Reporting Directive (Directive (EU) 2022/2464) and European Sustainability Reporting Standards (Delegated Regulation (EU) 2023/2772), as amended by Directive (EU) 2026/470 (Omnibus I) and Delegated Regulation (EU) 2026/1563 European Parliament and Council of the EU; European Commission (ESRS delegated acts, on EFRAG technical advice) · Directive (EU) 2022/2464 as amended by Directive (EU) 2025/794 (stop-the-clock) and Directive (EU) 2026/470 (OJ 26.2.2026, in force 18.3.2026); ESRS as amended by Delegated Regulations (EU) 2025/1416 and 2026/1563 | Listed companies, Large enterprises, Banks, Insurers and more | 15 | Source checked |
| Regulation (EU) No 537/2014 on specific requirements regarding statutory audit of public-interest entities, and Directive 2006/43/EC on statutory audits (Article 39, audit committees) European Parliament and Council of the EU · Regulation (EU) No 537/2014 (applies since 17 June 2016); Directive 2006/43/EC as amended by Directive 2014/56/EU, Directive (EU) 2022/2464 and Directive (EU) 2026/470 | Listed companies, Banks, Insurers | 18 | Being confirmed |
Checklists in the pack.
- GDPR Compliance Review
- DORA ICT Risk Management Review
- NIS2 Article 21 Measures Review
- EU AI Act Readiness Review
- EBA Internal Governance Review
Regulators.
- EC European Commission (incl. the AI Office)
- EBA European Banking Authority
- ESMA European Securities and Markets Authority
- EIOPA European Insurance and Occupational Pensions Authority
- ECB-SSM European Central Bank – Banking Supervision
- AMLA Authority for Anti-Money Laundering and Countering the Financing of Terrorism
- EDPB European Data Protection Board (national data protection authorities enforce GDPR)
- ENISA European Union Agency for Cybersecurity
- NCA National competent authorities of each member state (central banks, financial supervisors, data protection and cybersecurity authorities)
Who it is for
Banks, Insurers, Finance companies, Payment providers, Exchange houses, Capital market firms, Listed companies, State-owned enterprises, Government bodies, Large enterprises, Critical infrastructure.
Regulatory calendar.
20 recurring deliverables, each with the regulator, the instrument and the deadline rule. Some examples:
| Deliverable | Regulator | How often | Deadline |
|---|---|---|---|
| Notify a personal data breach to the lead supervisory authority | National DPA (EDPB members) | When it happens | Without undue delay and where feasible within 72 hours of becoming aware, unless the breach is unlikely to cause risk; explain any delay |
| Tell affected individuals about a high-risk personal data breach | National DPA (EDPB members) | When it happens | Without undue delay once a breach is assessed as likely to cause high risk |
| Answer data subject rights requests | National DPA (EDPB members) | When it happens | Within one month of receipt; extendable by two further months for complex or numerous requests, telling the person within the first month |
| DORA initial notification of a major ICT-related incident | National competent authority (financial supervisor) | When it happens | As early as possible within 4 hours of classifying the incident as major, and no later than 24 hours after becoming aware of it |
| DORA intermediate report on a major ICT-related incident | National competent authority (financial supervisor) | When it happens | Within 72 hours of the initial notification, and an update without undue delay once regular activities are restored; weekend relief does not apply to credit institutions and other excluded entities |
| DORA final report on a major ICT-related incident | National competent authority (financial supervisor) | When it happens | Within one month of the latest updated intermediate report |
Reporting conventions.
- Reports in English
- Amounts in EUR
EU acts are equally authentic in all 24 official languages. Reports to national supervisors are usually in the national language; many supervisors and the ESAs accept English. Dates are Gregorian, commonly DD.MM.YYYY or DD/MM/YYYY, and many member states use a decimal comma. EUR is the main currency, but some member states (for example Poland, Sweden, Czechia, Hungary, Romania, Denmark) keep their own. Supervisory reporting to the ESAs uses XBRL/xBRL-CSV templates (e.g. the DORA register of information). Listed issuers file annual financial reports in ESEF (XHTML with iXBRL tags), and CSRD sustainability statements sit inside the management report.
Kept current.
Content version 2026.10, reviewed 27 October 2026. Descriptions are AuditHD's own; each framework links to the official text. License this pack on its own or with other countries; International standards are always included.
See it with your own checklists.
Open the live demo now, or book a walkthrough and we will load one of your frameworks or work programmes.