Regulations
Which rules apply to your business?
Know the rule before it knows you.
Short, plain-language briefings on the European and US laws that reach technology-driven companies. Each one answers three questions: does it apply to you, what does it ask of you, and what happens if you ignore it.
European Union and the Netherlands
GDPR
The rulebook for every byte of personal data you touch.
ExploreEU AI Act
Obligations follow the role you play: provider, deployer, importer or distributor.
ExploreDSA
If users can post, sell or be recommended things on your service, the DSA shapes your product.
ExploreDMA
Rules for gatekeepers, and rights for the businesses that depend on them.
ExploreDORA
Operational resilience rules for finance, pushed down the supply chain to every ICT provider.
ExploreNIS2
Cybersecurity duties, board accountability and incident reporting for essential and important entities.
ExploreData Act
Users get rights to the data their connected products generate; cloud customers get the right to switch.
ExploreCyber Resilience Act
Security-by-design and vulnerability handling for every product with digital elements, including software.
ExploreData Governance Act
Rules for data intermediaries, data altruism and re-use of protected public-sector data.
ExploreePrivacy & cookies
Consent for cookies, trackers and direct marketing, enforced in the Netherlands by the AP and the ACM.
ExploreMiCA
Licensing for crypto services and stablecoins, plus the travel rule for every transfer.
ExplorePSD2 / PSD3
If you move, hold or initiate payments, you may need a licence or an exemption.
ExploreAML / Wwft
Know your customer, monitor transactions, report the unusual.
ExploreEU consumer law
Your checkout, prices, reviews, subscriptions and cancellation buttons are all regulated.
ExploreProduct Liability Directive
Software and AI are products; defects now carry strict liability.
ExploreP2B Regulation
Marketplaces and app stores must treat business sellers transparently.
ExploreDutch immigration law
Hiring from outside the EU is fast if you are a recognised sponsor, and expensive if you get it wrong.
ExploreEU-US Data Privacy Framework
The current legal bridge for personal data flowing to the United States.
ExploreUnited States
CCPA / CPRA
California's privacy law reaches any business of size with Californian users.
ExploreUS state privacy laws
No federal privacy law, so around twenty states have written their own.
ExploreColorado AI Act
The first US state law on high-risk AI and algorithmic discrimination.
ExploreNYC Local Law 144
Bias audits and notices before AI screens candidates in New York City.
ExploreFTC Act, Section 5
The US catch-all for privacy, security and AI claims.
ExploreCOPPA
Verifiable parental consent before collecting data from children under 13 in the US.
ExploreHIPAA
Protected health information in the US: covered entities, business associates and everyone they contract.
ExploreIllinois BIPA
Written consent before any fingerprint, face or voice data, with a private right of action.
ExploreDoes this apply to you?
If you do this, you need that
Not sure which apply to you? Send us three lines about what you sell and to whom, and we will tell you which rules matter and which do not.
let employees use ChatGPT, Copilot or other generative tools
an AI use policy, AI literacy training (AI Act art. 4), a GDPR check on what goes into prompts, and updated confidentiality clauses with customers and staff
sell SaaS, PaaS or IaaS to customers in the EU
a data processing agreement (GDPR art. 28), transfer clauses, an SLA and security annex, Data Act switching terms and, if your customers are banks or insurers, DORA clauses
build or embed an artificial-intelligence feature in your product
a role and risk classification under the AI Act, a DPIA, a transparency plan for users and an AI addendum in your vendor and customer contracts
run a marketplace, app or community where users post or sell
DSA notice-and-action and complaint handling, trader verification, P2B terms, recommender transparency and consumer-law checkout rules
touch payments, bitcoin or other crypto-assets
a PSD2 licence or documented exemption, MiCA authorisation for crypto services or tokens, an AML/Wwft programme and travel-rule data on every transfer
supply software, cloud or data to banks or insurers
DORA contract clauses, entry in your client's register, incident support duties, audit rights and evidence of your ICT risk controls
sell to consumers online, including subscriptions
pre-contractual information, a 14-day withdrawal route, prior-price rules for discounts, monthly cancellation after renewal (Netherlands) and no dark patterns
hire talent from outside the EU
recognised sponsorship with the IND, a highly skilled migrant or EU Blue Card permit, right-to-work checks and a sponsor file that survives an inspection
are a US company entering the EU market
an EU representative (GDPR art. 27), a transfer mechanism (DPF or SCCs), DSA and AI Act representatives where required, and consumer terms per country
make connected devices or ship software products
Data Act access-by-design, Cyber Resilience Act conformity and vulnerability handling, NIS2 if you are an in-scope provider, and product-liability allocation in your supply contracts
serve users in California or other US states
a CCPA-grade privacy notice, 'Do Not Sell or Share' and opt-out signals, state-law rights processes and bias audits where AI screens candidates
Have a regulatory question?
Send a short description of your situation. We reply within one working day, usually with a view on scope and a fixed fee where possible.