Free tool

EU regulation check: which duties apply to your company

Six questions, five laws, one first assessment: NIS2, the AI Act, the Cyber Resilience Act, the Data Act and the e-invoicing duty converge in 2026. This check sorts what applies to you and links the in-depth article for each.

Your company

Which sector do you mainly operate in?
How large is your company?
Do you manufacture or distribute products containing software (devices, machines, own software)?
Do you use or develop AI systems?
Do your products or machines generate usage data transmitted over a network (IoT, telematics, connected devices)?
Do you invoice other businesses in Germany?

First assessment

  • EU AI Act

    Partly / checkdeadline 2 August 2026

    As an operator you are covered at least by Art. 4 (staff AI competence). For Annex III systems, operator duties apply from December 2027.

    In-depth article

  • E-invoicing duty

    Applies to youreceipt since 2025, sending 2027/28

    You have had to be able to receive e-invoices since 2025; the sending duty follows in 2027/28 depending on turnover.

    In-depth article

What this check is and what it is not

A first assessment in six questions, not legal advice. The thresholds follow the evidenced facts in the linked articles; in case of doubt, the statute and counsel prevail. What the check is for: knowing which of the five construction sites you have at all before spending effort on the wrong one.

Common questions

Does NIS2 apply to small companies too?

Usually not directly, but indirectly: regulated companies must demonstrate the security of their supply chain and send questionnaires to their suppliers. If you have large customers in critical sectors, you feel NIS2 through their requirements even when your own company is not covered.

When do the AI Act duties hit me?

As an operator already since August 2026: at least the AI competence duty of Art. 4 and transparency duties for chatbots. Those who market AI under their own name carry the full provider duties. For Annex III high-risk systems, operator duties were moved to December 2027.

Does the CRA cover pure software?

Yes, with the reporting duty since September 2026: anyone placing software or devices containing software on the EU market must report exploited vulnerabilities within 24 hours. Distributors and importers carry lighter duties.

What is the e-invoicing duty in practice?

You have had to be able to receive e-invoices since January 2025, without consenting to the format. You must send them from 2027 or 2028 depending on turnover. Anyone still sending PDFs as "invoices" should not push the switch to the last year.

Five construction sites, one priority

The check shows what applies to you. The order in which the duties pay off for your company is settled faster in an initial call than by any checklist.

Book an initial call