Europe · 15 laws · 80 requirements
European Union: the laws your website or app must follow
If your customers are in European Union, these are the privacy, consumer, security, accessibility and AI laws SafeLaunch checks your site against, with what each one requires and where in the law it says so.
Coming up in European Union
- 2026-12-02 · EU AI Act: Art. 50 transparency since 2 Aug 2026 (machine-readable marking: grace to 2 Dec 2026 for systems already on the market). New Art. 5 bans on AI that generates non-consensual intimate images or child sexual abuse material apply from 2 Dec 2026.
- 2026-12-09 · Product Liability Directive (2024): Member states must apply it by 9 December 2026, for products placed on the market after 9 December 2026; the 1985 directive keeps covering earlier products.
- 2027-01-12 · EU Data Act: Connected products placed on the market after 12 September 2026 must make their data accessible by design; switching charges for cloud and SaaS services end on 12 January 2027.
- 2027-12-02 · EU AI Act: High-risk duties postponed by the Digital Omnibus (Reg. 2026/1744) to 2 Dec 2027 (Annex III) and 2 Aug 2028 (Annex I).
- 2027-12-11 · Cyber Resilience Act: Vulnerability and incident reporting has applied since 11 September 2026, including for products already on the market (ENISA's single reporting platform is live); everything else, including CE marking, from 11 December 2027.
- 2028-08-02 · EU AI Act: High-risk duties postponed by the Digital Omnibus (Reg. 2026/1744) to 2 Dec 2027 (Annex III) and 2 Aug 2028 (Annex I).
How a SafeLaunch audit checks each one
- CheckedChecked automatically on every scan
- AI reviewLooked for by the AI analysis, reported only with evidence
- Your answersDecided from your answers to the audit questions
- PreparedPrepared for you in the report's compliance pack
- You confirmA scan can't see this; you need to confirm it
GDPR
In force since 25 May 2018.
Who it covers: Anyone established in the EU, or offering goods or services to, or monitoring, people in the EU (Art. 3).
What it requires of a website or app (18)
- Be able to show who consented, to what and when (consent records) (if if you rely on consent)CheckedArt. 7(1)
- A lawful basis for every use of personal dataAI reviewArt. 6
- A privacy notice at collection: identity and contact, purposes and legal basis, recipients, retention, rights, right to complain, transfersCheckedArt. 12–14
- The notice names every service that receives visitors' dataCheckedArt. 13(1)(e)
- Consent is freely given, specific, informed and as easy to withdraw as to giveCheckedArt. 7
- Explicit consent (or another Art. 9 condition) for health and other special-category data (if if you handle special-category data)Your answersArt. 9
- Parental consent for information-society services offered to children under 16 (or the national age, 13–16) (if if children use the product)Your answersArt. 8
- People can access, correct, delete and port their data, and objectCheckedArt. 15–22
- No solely automated decisions with legal or similar effects without safeguardsAI reviewArt. 22
- Security appropriate to the risk: encryption in transit, access control, no exposed secretsCheckedArt. 32
- Data protection by design and by default (collect only what's needed)AI reviewArt. 25
- Written contracts with processors (hosting, analytics, email, AI providers)PreparedArt. 28
- A record of processing activities (if 250+ staff, or processing that isn't occasional)PreparedArt. 30
- Breach notification to the authority within 72 hours and a response planCheckedArt. 33–34
- A DPIA before high-risk processing (large-scale sensitive data, systematic monitoring, profiling)PreparedArt. 35
- A DPO where core activities involve large-scale monitoring or special-category dataYour answersArt. 37
- Transfers outside the EEA rely on adequacy (e.g. EU–US Data Privacy Framework), SCCs or another Chapter V toolCheckedArt. 44–49
- An EU representative if you have no EU establishment (if if not established in the EU)CheckedArt. 27
Sources:GDPR (EUR-Lex)
ePrivacy Directive
In force; applied through each member state's law (e.g.
Who it covers: Anyone storing or reading information on EU users' devices, and anyone sending electronic marketing.
What it requires of a website or app (7)
- Prior consent before setting or reading non-essential cookies and similar storage (analytics, ads, replay)CheckedArt. 5(3)
- Rejecting is as easy as accepting, on the first layer of the banner (regulator guidance)CheckedArt. 5(3); EDPB 03/2022
- Trackers stay off after RejectCheckedArt. 5(3)
- Strictly necessary cookies are the only ones set before a choiceCheckedArt. 5(3)
- Cookie information: what each cookie does and how long it lastsAI reviewArt. 5(3)
- Prior consent for marketing emails, with a soft opt-in only for existing customers and similar products (if if you send marketing emails)Your answersArt. 13
- Every marketing email identifies the sender and has a free, working unsubscribe (if if you send marketing emails)Your answersArt. 13(4)
Sources:Directive 2002/58/EC (EUR-Lex)
EU AI Act
Prohibitions since 2 Feb 2025; general-purpose AI duties since 2 Aug 2025; Art.
Who it covers: Providers and deployers of AI systems used in the EU.
What it requires of a website or app (6)
- People are told they are interacting with an AI system (chatbots, assistants), unless it's obvious (if if the product uses AI)CheckedArt. 50(1)
- AI-generated audio, image, video or text is marked as AI-generated in a machine-readable way (if if you provide generative AI)AI reviewArt. 50(2)
- Deepfakes and AI text published to inform the public are disclosed (if if you deploy such content)AI reviewArt. 50(4)
- No prohibited practices (manipulative techniques, social scoring, emotion recognition at work or school, untargeted face scraping) and, from 2 Dec 2026, AI that generates non-consensual intimate images of real people or child sexual abuse materialAI reviewArt. 5
- Take measures to support AI literacy of staff using AI (no guaranteed level required)PreparedArt. 4
- High-risk uses (hiring, credit scoring, education, essential services) meet Chapter III duties (if if AI is used for these decisions; from 2 Dec 2027)Your answersArt. 6 & Annex III
Sources:Regulation (EU) 2024/1689 (EUR-Lex) Regulation (EU) 2026/1744, Digital Omnibus on AI (EUR-Lex)
Digital Services Act
Applies to all intermediary services since 17 Feb 2024.
Who it covers: Intermediary services offered in the EU: hosting, online platforms and marketplaces (anything that stores or shares users' content).
What it requires of a website or app (9)
- A single point of contact for authorities and one for users, published and easy to find (if if users can post or store content)Your answersArt. 11–12
- A legal representative in the EU if not established there (if if users can post or store content)CheckedArt. 13
- Terms that explain content moderation, in plain language (if if users can post or store content)Your answersArt. 14
- A notice-and-action mechanism for reporting illegal content, and statements of reasons for removals (if hosting services)Your answersArt. 16–17
- Platforms: no dark patterns, ad transparency (who paid, why shown), no profiling-based ads to minors (if online platforms above small-enterprise size)AI reviewArt. 25–28
- Marketplaces: trader traceability and information shown to consumers (if online marketplaces)AI reviewArt. 30–32
- Terms say, in plain language, what users may not post and how content is moderated (if if users can post or store content)CheckedArt. 14
- Online platforms protect minors' privacy, safety and security, including age assurance for adult content (if online platforms above small-enterprise size, if minors can reach the platform)CheckedArt. 28 & Commission guidelines (2025)
- Rights holders can notify infringing content, and notices are acted on (if if users can post or store content)CheckedArt. 16
European Accessibility Act
Applies to services provided to consumers from 28 June 2025 (existing contracts until they end, at most 5 years).
Who it covers: E-commerce, consumer banking, e-books, electronic communications, passenger transport and audiovisual access services for EU consumers.
What it requires of a website or app (3)
- The service meets accessibility requirements, in practice WCAG 2.1 AA / EN 301 549 (alt text, labels, keyboard use, contrast) (if consumer services in scope)CheckedArt. 4 & Annex I
- Accessibility information is published: how the service meets the requirements (if consumer services in scope)CheckedArt. 13(2) & Annex V
- A way to report accessibility problemsAI reviewArt. 13
Consumer Rights Directive
In force; amended by the Omnibus Directive 2019/2161 and, from 19 June 2026, by Directive (EU) 2023/2673 (an online withdrawal function for contracts made on websites and apps).
Who it covers: Traders selling to EU consumers at a distance (online).
What it requires of a website or app (8)
- Before purchase: trader identity and address, total price with taxes, delivery, duration and cancellation of subscriptions (if if you sell to consumers)CheckedArt. 6
- A 14-day right of withdrawal, and the model withdrawal form, unless an exception applies (if if you sell to consumers)CheckedArt. 9–11
- An online withdrawal function: a prominent, always-available "withdraw from contract here" button that leads to a short form and a "confirm withdrawal" step, then an acknowledgement on a durable medium such as email (if if you sell to consumers with a right of withdrawal; from 19 June 2026)AI reviewArt. 11a (added by Directive (EU) 2023/2673)
- The order button says "order with obligation to pay" or equivalent (if if you sell to consumers)AI reviewArt. 8(2)
- Digital content: consent and acknowledgement before withdrawal rights are lost (if digital content and services)AI reviewArt. 16(m)
- No pre-ticked boxes for extra payments (if if you sell to consumers)AI reviewArt. 22
- Subscriptions: the duration, renewal and how to end the contract are shown before purchase (if if you sell subscriptions)CheckedArt. 6(1)(o) & 8(2)
- Terms of sale give the trader's identity and address, the right of withdrawal and the legal guarantee (if if you sell to consumers)CheckedArt. 6(1)(b)–(c), (h), (l)
Sources:Directive 2011/83/EU (EUR-Lex) Directive (EU) 2023/2673, online withdrawal function (EUR-Lex)
Unfair Commercial Practices & Unfair Terms Directives
UCPD in force since 2005 and UCTD since 1993, both amended by the Omnibus Directive 2019/2161 (fines up to 4% of turnover for widespread infringements).
Who it covers: Businesses selling or marketing to consumers in the EU.
What it requires of a website or app (7)
- No misleading claims or omissions about the product, price or resultsCheckedUCPD Art. 6–7
- Reviews: say whether and how you check they come from real customers; no fake or bought reviews (if if you show reviews)AI reviewUCPD Art. 7(6); Annex I pt 23b–23c
- Price reductions show the lowest price of the previous 30 days (if if you announce discounts)AI reviewPrice Indication Directive 98/6/EC Art. 6a
- No aggressive or manipulative design (false urgency, hidden costs, hard-to-cancel flows)AI reviewUCPD Art. 8–9; Annex I
- No generic environmental claims ("eco-friendly", "green"), sustainability labels that aren't based on a certification scheme or set by a public authority, or "carbon neutral" claims based on offsetting (if if you make environmental or sustainability claims)AI reviewUCPD Art. 6(2)(d); Annex I pt 2a, 4a–4c (Directive (EU) 2024/825, from 27 Sep 2026)
- Don't present a software update as necessary for security when it only changes functionality, and don't hide that an update will reduce what the product can do (if if you sell digital content, services or goods with software)AI reviewUCPD Annex I pt 23d–23e (Directive (EU) 2024/825, from 27 Sep 2026)
- Standard terms don't take away consumers' rights or let the trader change them at will (if if you sell to consumers)CheckedUCTD Art. 3 & Annex
Sources:Directive 2005/29/EC (EUR-Lex) Directive 93/13/EEC (EUR-Lex) Directive (EU) 2024/825, empowering consumers for the green transition (EUR-Lex)
MiCA (crypto-asset marketing)
Applies in full since 30 Dec 2024.
Who it covers: Anyone offering or marketing crypto-assets or crypto-asset services to people in the EU.
What it requires of a website or app (2)
- Marketing is clearly identifiable, fair, clear and not misleading, and consistent with the white paper (if if you promote crypto-assets)CheckedArt. 7, 29 & 53
- Crypto-asset services are offered only by an authorised provider (CASP) (if if you provide crypto-asset services)AI reviewArt. 59
e-Commerce Directive (provider information)
In force since 2002, applied through each member state's law (Germany §5 DDG, France LCEN Art.
Who it covers: Every online service provider established in the EU.
What it requires of a website or app (1)
- Show who provides the service: name, geographic address, email, trade register and number, VAT number, and any supervisory authority or professional rulesCheckedArt. 5
Sources:EUR-Lex: Directive 2000/31/EC
Cyber Resilience Act
Regulation (EU) 2024/2847, in force since 10 December 2024.
Who it covers: Manufacturers of products with digital elements sold in the EU: apps, desktop and other downloadable software, and connected hardware. Websites and standalone SaaS are outside it; free open-source software made outside a commercial activity is excluded.
What it requires of a website or app (5)
- Report actively exploited vulnerabilities and severe incidents to the national CSIRT and ENISA: an early warning within 24 hours, a notification within 72 hours, and a final report (14 days after a fix for vulnerabilities, one month after the notification for incidents), all through ENISA's single reporting platform (if if you distribute an app or downloadable software in the EU)PreparedArt. 14
- Publish a contact for reporting vulnerabilities and a coordinated vulnerability disclosure policy (if if you distribute an app or downloadable software in the EU)CheckedAnnex I Part II (5)–(6)
- Ship without known exploitable vulnerabilities, and fix vulnerabilities through security updates (if if you distribute an app or downloadable software in the EU)CheckedAnnex I Part I (2)(a); Part II (2)
- Know your components: keep a software bill of materials (if if you distribute an app or downloadable software in the EU)PreparedAnnex I Part II (1)
- Secure by default and by design, with a support period and technical documentation; CE marking from 11 December 2027 (if if you distribute an app or downloadable software in the EU)PreparedArt. 13; Annex I Part I
Sources:EUR-Lex: Regulation (EU) 2024/2847 European Commission: CRA reporting (ENISA single reporting platform)
Product Liability Directive (2024)
Directive (EU) 2024/2853.
Who it covers: Manufacturers of products, which now include software however it is supplied (apps, SaaS, firmware, AI systems), for damage defective products cause: injury, damaged property and destroyed or corrupted data used for non-professional purposes.
What it requires of a website or app (2)
- Liability for defective products can't be excluded or limited by contract or termsCheckedArt. 15
- Keep software safe after release: a product that lacks the security updates it needs can be defective, and the manufacturer stays liableCheckedArt. 7; Art. 11(2)
General Product Safety Regulation
Regulation (EU) 2023/988, applies since 13 December 2024.
Who it covers: Anyone selling consumer products in the EU, including online shops and marketplace sellers.
What it requires of a website or app (2)
- Every online offer shows the manufacturer's name and postal and email address, the EU responsible person if the manufacturer is outside the EU, information identifying the product, and its warnings and safety information (if if you sell physical consumer products)CheckedArt. 19
- Products made outside the EU have an EU-based responsible person who holds the safety information (if if you sell physical consumer products)AI reviewArt. 16
EU Data Act
Regulation (EU) 2023/2854, applies since 12 September 2025.
Who it covers: Providers of cloud and SaaS services (data processing services), and makers of connected products and related services.
What it requires of a website or app (3)
- Customers can switch to another provider: contract terms on switching, at most two months' notice, a transition of up to 30 days, and export of their data in a structured, commonly used, machine-readable format (if if you provide a cloud or software service to business customers)AI reviewArt. 23, 25
- No switching or data export charges from 12 January 2027; until then, at most the direct cost of the switch (if if you provide a cloud or software service to business customers)AI reviewArt. 29
- Connected products and related services let users access the data they generate, easily and by design (if if you sell connected devices)AI reviewArt. 3(1)
EU Geo-blocking Regulation
Regulation (EU) 2018/302, applies since 3 December 2018.
Who it covers: Traders selling goods or services to consumers (and businesses buying for their own use) in the EU, including non-EU traders selling into it. Financial, transport, healthcare, audiovisual and gambling services are outside it.
What it requires of a website or app (3)
- Don't block or limit access to your online interface because of a customer's nationality, residence or establishment, and don't redirect them to another country's version without their explicit consent (if if you sell goods or services to consumers in more than one EU country)AI reviewArt. 3(1)–(3)
- Offer the same conditions to customers from other EU countries for goods you deliver to the countries you serve, and for electronically supplied services (if if you sell goods or services to consumers in more than one EU country)AI reviewArt. 4(1)
- Don't apply different payment conditions because of the customer's nationality, residence, payment account location or the card issuer's country (if if you sell goods or services to consumers in more than one EU country)AI reviewArt. 5(1)
Sources:EUR-Lex: Regulation (EU) 2018/302 Publications Office: Regulation (EU) 2018/302 (Official Journal text)
EU Digital Content Directive
Directive (EU) 2019/770, applied in national law since 1 January 2022 (national transposition not read; German and French provisions are not cited here).
Who it covers: Traders supplying digital content or digital services (apps, SaaS, streaming, cloud storage) to consumers who pay a price or provide personal data. Business-to-business services are outside it.
What it requires of a website or app (4)
- Tell consumers how long you provide updates, including security updates, and supply the ones needed to keep the product working as promised (if if you sell apps, software or online services to consumers in the EU, or give them away in exchange for personal data)AI reviewArt. 8(2)
- Refund within 14 days by the same payment method after termination, and on request let consumers get their own content back free of charge in a commonly used, machine-readable format (if if you sell apps, software or online services to consumers in the EU, or give them away in exchange for personal data)AI reviewArt. 16(2)–(4), 18
- Change the service only if the contract allows it for a valid reason, with notice in good time on a durable medium and a free right to terminate where the change is more than minor (if if you sell apps, software or online services to consumers in the EU, or give them away in exchange for personal data)AI reviewArt. 19
- Terms must not exclude or limit these consumer rights to the consumer's disadvantage (if if you sell apps, software or online services to consumers in the EU, or give them away in exchange for personal data)AI reviewArt. 22
Sources:EUR-Lex: Directive (EU) 2019/770 Publications Office: Directive (EU) 2019/770 (Official Journal text)
Licensed professionals in European Union
These regulators' advertising and conduct rules apply on top of the laws above, only to sites of that profession.
Check your site against European Union's rules
A free scan checks your website or app against these rules in about a minute and shows what applies, with evidence from your pages. The full report gives the exact fix for each finding.
Check my site freeOne free fix in your inbox each week
A new copy-paste prompt for Lovable, Cursor or Claude Code every week, with the rule behind it and how to check it worked, plus the Monday briefing on new laws and deadlines. No spam, unsubscribe in one click.
By signing up you agree to get these weekly emails. We send it with Kit, and you can unsubscribe at any time. What we share with Kit is in our privacy notice.
A plain-language summary of what each law requires of a website or app, from the SafeLaunch rulebook, with the provision and official sources. It is not legal advice and not every duty in each law is listed.