The New Wave of EU Regulation: What Manufacturers Must Know for 2026–2030

The European Union is in the middle of one of the most significant regulatory transformations in its history. Between 2023 and 2030, a wave of new legislation is reshaping the obligations of manufacturers, importers, and businesses that operate in or sell to the European market.

The EU is systematically restructuring its regulatory framework around four converging priorities: sustainability, digitalisation, cybersecurity, and product transparency. The result is a body of legislation broader in scope, more demanding in its documentation requirements, and more tightly enforced than anything that came before it.

The Shift from Directives to Regulations

A structural shift runs through almost all of the new EU regulatory output, and it matters before looking at any specific legislation: the move from directives to regulations.

EU directives require member states to transpose them into national law, which historically created inconsistencies in implementation across the single market. EU regulations, by contrast, are directly applicable in all member states without transposition. They come into force on the same date everywhere, with the same requirements, enforced by the same framework.

The one relevant exception to this shift is the Product Liability Directive, which keeps the directive format to regulate the treatment of defective products.

General Product Safety Regulation (GPSR)

The General Product Safety Regulation (EU) 2023/988 replaced the General Product Safety Directive in December 2024. While it applies to consumer products not covered by specific sector legislation, its broader significance lies in the new obligations it introduces for online marketplaces and non-EU manufacturers selling directly to EU consumers.

Key changes from the previous directive include:

• Mandatory EU-based responsible person: non-EU manufacturers must designate an EU-based responsible person before placing products on the EU market.
• Digital product traceability: products must carry a type, batch, or serial number, and a QR code or equivalent is increasingly expected.
• Online marketplace obligations: platforms are directly obligated to ensure the products offered through them are safe, creating new upstream pressure on manufacturers.
• Recall and corrective measure procedures: standardised processes for product recalls, with notification obligations to both authorities and consumers

For manufacturers selling through e-commerce channels to EU consumers, including via global marketplaces, the GPSR introduces obligations that go beyond what applied under the previous directive.

Digital Product Passport (DPP)

The Digital Product Passport is one of the most structurally significant innovations in the EU’s regulatory agenda. Introduced under the Ecodesign for Sustainable Products Regulation (ESPR), the DPP requires manufacturers to associate each product, or product type, with a digital record containing standardised data on its materials, components, repairability, recyclability, and environmental footprint.

The DPP is designed to be accessible to all actors in the value chain: consumers, repair technicians, recyclers, and regulatory authorities. It will be linked to the product via a physical data carrier such as a QR code or RFID chip, and must remain accessible throughout the product’s lifecycle.

Rollout is phased by product category. Batteries were the first category subject to DPP requirements under the Battery Regulation (EU) 2023/1542, with obligations already in force for industrial and EV batteries. Textiles, electronics, furniture, and construction products are among the categories scheduled to follow, with applicability dates staggered through 2030.

For manufacturers, the DPP represents a fundamental change in how product information is managed: a living data infrastructure that must be maintained and updated over the product’s commercial life, not a one-time label or declaration.

EU Artificial Intelligence Act

The EU AI Act is the world’s first comprehensive legal framework for artificial intelligence. It entered into force in August 2024, with obligations applying in phases through 2027.

The Act classifies AI systems into four risk tiers:

• Unacceptable risk: prohibited AI practices, such as social scoring, subliminal manipulation, and real-time biometric surveillance in public spaces.
• High risk: AI used in critical infrastructure, employment, education, law enforcement, and certain product safety functions, subject to strict conformity assessment, documentation, and human oversight requirements.
• Limited risk: transparency obligations, such as chatbots disclosing that they are AI.
• Minimal risk: no specific obligations.

For manufacturers, the most relevant category is high-risk AI embedded in regulated products. Under the AI Act, a machine, medical device, or vehicle that incorporates an AI system classified as high-risk must meet AI Act obligations in addition to the product-specific CE marking requirements. This creates overlapping compliance tracks that must be managed simultaneously.

The interaction between the AI Act and existing product regulations, particularly the Machinery Regulation and the Medical Devices Regulation, is one of the most technically complex areas of EU compliance today. The new Machinery Regulation (EU) 2023/1230 illustrates this overlap directly: it already integrates AI and cybersecurity obligations for machinery manufacturers, since it was finalised after the AI Act’s risk framework was in place.

Cyber Resilience Act (CRA)

The Cyber Resilience Act introduces mandatory cybersecurity requirements for all products with digital elements placed on the EU market. This covers an extraordinarily broad range of goods, from industrial control systems and connected machinery to consumer routers, smart home devices, and software sold as a standalone product.

The CRA entered into force in December 2024, with a 36-month transition period running to December 2027 for most obligations, and 21 months for vulnerability reporting requirements.

Key obligations under the CRA include:

• Security by design: products must be developed following a cybersecurity risk assessment, with vulnerabilities addressed throughout the development lifecycle.
• Vulnerability handling: manufacturers must have a process for identifying, documenting, and disclosing vulnerabilities, and must provide security updates for a defined support period.
• Incident reporting: from September 2026, actively exploited vulnerabilities and severe incidents must be reported through an early warning within 24 hours, a detailed notification within 72 hours, and a final report within one month.
• Conformity assessment: most products can self-assess; products classified as important (Annex III) or critical (Annex IV) require third-party assessment or, for critical products, a European cybersecurity certificate

The CRA significantly raises the bar for software-containing and connected products.

Packaging and Packaging Waste Regulation (PPWR)

Regulation (EU) 2025/40 entered into force in February 2025 and applies from 12 August 2026, replacing the Packaging and Packaging Waste Directive.

It covers all packaging placed on the EU market, regardless of material or origin, and sets binding requirements on recyclability, packaging minimisation, and recycled content.

Manufacturers face new obligations under the PPWR: a conformity assessment and EU declaration of conformity for packaging, limits on empty space in transport and e-commerce packaging, and extended producer responsibility duties that require registration in each member state where the packaging is placed on the market. All packaging must be recyclable by 2030, and harmonised digital labelling requirements are due to apply from 2027.

Carbon Border Adjustment Mechanism (CBAM)

The Carbon Border Adjustment Mechanism addresses carbon leakage, the risk that EU climate policy simply shifts production to countries with less stringent emissions rules. It applies to imports of cement, iron and steel, aluminium, fertilisers, electricity, and hydrogen, requiring importers to purchase certificates matching the carbon price those goods would have faced under the EU Emissions Trading System.

The definitive regime started on 1 January 2026. Certificate purchases begin in February 2027, covering emissions embedded in 2026 imports, and the October 2025 Omnibus simplification introduced a 50-tonne annual de minimis exemption and moved the annual declaration deadline to 30 September. For non-EU manufacturers, the practical implication stays the same: importers cannot meet their CBAM obligations without accurate embedded emissions data from the production level.

Ecodesign for Sustainable Products Regulation (ESPR)

The ESPR replaces the former Ecodesign Directive and expands its scope from energy-related products to virtually all physical products placed on the EU market. It sets requirements across the entire product lifecycle: durability and repairability, recyclability and recycled content, and lifecycle environmental disclosures that feed directly into the Digital Product Passport.

The ESPR operates through delegated acts, with the Commission publishing specific requirements per product category on a rolling basis. Textiles, furniture, iron and steel, and electronics are the first categories addressed in the 2024–2027 period, and manufacturers should track the delegated acts relevant to their sector as they are published.

What These Regulations Have in Common

Across all of the legislation described above, four structural themes recur consistently:

• Traceability. Every new regulation requires manufacturers to document their products, supply chains, and processes in greater detail and for longer periods.
• Sustainability. From CBAM’s carbon pricing to ESPR’s and PPWR’s lifecycle and recyclability requirements and the DPP’s material transparency, environmental accountability is being built directly into product compliance obligations.
• Cybersecurity. The CRA, the AI Act’s high-risk product provisions, and the RED cybersecurity standards collectively establish cybersecurity as a mainstream product compliance requirement, not an optional technical enhancement.
• Transparency. Consumers, repair technicians, recyclers, authorities, and supply chain partners are all being granted greater rights of access to product information. Manufacturers are expected to produce and maintain this information as a standard part of their operations.

Understanding these themes helps manufacturers prioritise. Rather than treating each new regulation as an isolated compliance project, the most efficient approach is to build the underlying data infrastructure, such as documentation systems, supply chain data flows, and cybersecurity processes, so it satisfies multiple regulatory requirements simultaneously.

How to Prepare Your Business

Given the volume and pace of regulatory change, manufacturers face a real risk of compliance fatigue: attempting to respond to each new obligation reactively, without a coherent strategy. A more sustainable approach involves three principles.

Early compliance. Engaging with regulatory requirements during the product design phase, rather than after the product is finalised, significantly reduces the cost and disruption of compliance. Design decisions that seem minor at the product level, such as material selection, software architecture, and repairability, often have major regulatory implications.

Regulatory monitoring. The EU’s legislative pipeline is publicly available, and delegated acts under ESPR, implementing acts under the AI Act, and technical standards under the CRA are published on a rolling basis. Manufacturers should have a process for tracking developments relevant to their product categories.

Integrated compliance management. The overlap between regulations, particularly between the AI Act, the CRA, the Machinery Regulation, and sector-specific CE marking requirements, means that siloed compliance teams managing each regulation separately will duplicate effort and risk inconsistencies.

Whether you are at the early stages of understanding which regulations apply to your product, or working through the documentation requirements of a specific framework, we can help you build a compliance approach that is both thorough and proportionate.

If you would like to discuss your regulatory situation, request a quote, no obligation, with a response focused on your specific context.

---

For authoritative and up-to-date information on EU regulatory developments, the EUR-Lex portal provides direct access to all EU legislation, official journal publications, and legislative proposals currently in progress.

Read this far? The next step is a free 30-min consultation