October 2026 General EU Legal Update

Purpose

This update summarises the main legal, regulatory and international standards developments identified in the October 2026 - Monthly General EU Legislation Update. It highlights changes affecting Quality, Environment, Information Security, AI Governance, Health & Safety and wider compliance obligations.

The update supports organisations in identifying new and emerging requirements for legal registers, compliance evaluations and management system reviews. Applicability should be assessed by activity, product, service, site, jurisdiction and legal role. Publication of a measure does not necessarily mean that it entered into force during October 2026.

Download the full update

Upcoming legislation and future requirements

These measures were published or progressed during October 2026 but have later commencement dates, phased implementation arrangements or details that still require verification.

German Product Liability Act

Enacted: 22 October 2026
Published: 27 October 2026
Commencement: 9 December 2026

Germany’s replacement Product Liability Act implements Directive (EU) 2024/2853 and introduces a revised liability framework for defective products.

The new framework:

• Expressly includes software, electricity and digital manufacturing files within the definition of a product.
• Addresses connected services and components.
• Covers substantial modifications made after a product has been placed on the market.
• Extends potential liability to additional supply-chain actors where the statutory conditions apply.
• Introduces provisions concerning disclosure of evidence and statutory presumptions.
• Covers qualifying personal injury, property damage and the destruction or corruption of non-professional data.
• Excludes non-commercial free and open-source software where the specified statutory conditions are met.

The previous legislation continues to apply to products placed on the market or put into service before 9 December 2026.

Manufacturers, importers, component suppliers, authorised representatives, fulfilment providers and other potentially affected parties should review product and software change controls, release records, technical evidence, component traceability, incident response, insurance and claims-handling arrangements.

Italian recycled food-contact plastics legislation

Adopted: 9 October 2026
Published: 30 October 2026
Commencement: 14 November 2026

Legislative Decree No. 199 of 9 October 2026 adapts Italy’s enforcement arrangements to Regulation (EU) 2022/1616 on recycled plastic materials and articles intended to come into contact with food.

The Decree:

• Revises administrative sanctions relating to recycled food-contact plastics.
• Addresses infringements involving process authorisation, documentation, traceability and material requirements.
• Provides for a Ministry of Health database covering food-contact-material and recycling establishments.
• Requires the database’s operating arrangements to be established through a later ministerial decree.
• Amends official-control tariff provisions.

Recyclers, converters, distributors and relevant food businesses should review material specifications, supplier approvals, process authorisations, declarations and traceability records. Publication of the Decree does not create an immediate database submission deadline without the necessary implementing arrangements.

Polish Dolny Wieprz conservation amendment

Published: 21 October 2026
Commencement: 5 November 2026

The Regulation amends the designation framework for the Dolny Wieprz Natura 2000 site, PLH060051.

It replaces the annexes listing:

• Protected natural habitats.
• Protected animal species other than birds.

The revised habitat list includes oxbow lakes and natural eutrophic waters, muddy riverbanks, inland sandy grasslands, tall-herb communities, hay meadows and alluvial forests.

The amendment is relevant to land managers, developers and operators whose activities could affect the site’s protected features, including projects outside its boundary where effects on the site are possible. Potentially affected organisations should obtain the replacement annexes and review ecological assessments, permits and consultation requirements.

Luxembourg security-measures notification requirements

Adopted: 26 October 2026
Published: 30 October 2026
Commencement: 3 November 2026

ILR Regulation ILR/N26/10 establishes arrangements for essential entities supervised by Luxembourg’s ILR to notify the security measures taken under the Law of 5 May 2026.

The supervisory arrangements include:

• A description of implemented cybersecurity measures.
• An analysis of principal cyber-risk scenarios.
• A multi-year action plan.
• Information about direct supplier or service-provider dependencies where requested by ILR.

The requirement applies to essential entities within the relevant ILR supervisory framework. It should not automatically be extended to important entities or every organisation operating in Luxembourg.

Affected organisations should confirm their classification, obtain the final submission instructions, verify forms and deadlines, map existing controls and risk records to the required deliverables, and retain evidence of submission. This requirement is separate from incident-reporting obligations.

German price-indication sanctions

Enacted: 19 October 2026
Published: 22 October 2026
Commencement: 1 January 2027

The Act amends Germany’s sanctions framework for infringements of national and European price-indication requirements.

It covers:

• National consumer price-indication requirements.
• Specified requirements concerning prices, fees and customer information at publicly accessible electric-vehicle charging points.
• Relevant mobility-service provider obligations under Regulation (EU) 2023/1804.
• Administrative fines of up to €100,000 for applicable offences.

Businesses within scope should review total-price, unit-price, promotional and charging-price information across signs, websites, applications and payment interfaces. The revised penalties begin on 1 January 2027, although underlying disclosure duties may already apply.

German design-law reform

Enacted: 22 October 2026
Published: 27 October 2026
Main commencement: 9 December 2027

The Act modernises German design law and amends the Act against Unfair Competition.

The design-law changes include:

• Recognition of animated and digital designs.
• Revised design representation and procedural arrangements.
• Protection relating to preparatory 3D-printing activities.
• Provisions concerning goods under customs supervision.
• Implications for digital designs, spare parts and associated rights.

The Act has phased application:

• Article 5 applies retrospectively from 27 September 2026.
• The main provisions apply from 9 December 2027.
• Article 6 applies from 27 September 2028.

Article 5 introduces a proportionate enforcement provision for specified claims concerning ecological or social characteristics and circularity for goods placed on the market before 27 September 2026. It does not permit unsupported environmental or sustainability claims.

Organisations should record the separate commencement dates and review design portfolios, digital files, spare-parts arrangements and substantiation for relevant consumer claims.

Danish digital-bookkeeping requirements

Issued: 22 September 2026
Published: 28 September 2026
October development: Consolidated guidance was published on 5 October and updated on 19 October 2026.

The amending Order introduces phased changes for standard digital-bookkeeping systems marketed in Denmark.

The changes address:

• Definitions of customers, end customers and users.
• Locked CVR master data and supplementary information.
• MitID identity verification for customers.
• Identity verification for users changing supplementary master information.
• Storage of transaction information and supporting documents.
• SAF-T export requirements from 1 January 2027.
• Secure electronic invoicing requirements from 1 March 2027 and 1 January 2028.

System providers should map each requirement to its applicable date and test the necessary changes. Businesses using affected systems should obtain their provider’s implementation timetable, confirm responsibilities with external bookkeepers and prepare relevant finance users.

Malta Budget Measures Implementation Bill 2026

First Reading: 26 October 2026
Published: 27 October 2026
Status: Proposed legislation

Bill No. 15 is intended to implement budget measures for the 2027 financial year and other administrative measures.

No enactment or commencement was confirmed in the October update. Specific tax rates, reliefs, eligibility conditions and implementation dates require assessment against the full Bill and any final enacted legislation.

Finance, HR and legal teams should monitor the Bill but should not amend payroll, tax or financial arrangements solely on the basis of its title or First Reading.

New legislation and standards

These measures entered into force, became applicable or were substantively developed during October 2026.

Commission Implementing Regulation (EU) 2026/1963 on country-of-melt-and-pour evidence

Published: 31 August 2026
Application: 1 October 2026

The Regulation specifies the evidence that importers must provide to demonstrate the country in which covered steel was first melted and poured.

Importers must normally provide a Mill Test Certificate identifying:

• The country of melt and pour.
• The imported steel’s heat number.

Where information is missing, customs authorities may consider specified complementary records. Until 30 September 2027, specified documents may also be accepted as standalone evidence where no Mill Test Certificate is available, provided they contain both required details.

Potential evidence includes:

• Invoices and delivery notes.
• Quality certificates.
• Purchase-order or contractual clauses.
• Supplier declarations.
• Production and cost-accounting records.
• Export customs documents.
• Commercial correspondence.
• Production descriptions.

Covered importers should link the relevant evidence to each consignment and ensure that the country is declared using the correct TARIC document codes. Imports can be rejected where appropriate verifiable evidence is not provided.

Regulation (EU) 2026/1384 on the EU steel market

General application: 1 July 2026
October requirement: Country-of-melt-and-pour evidence required from 1 October 2026

The Regulation replaces the previous steel safeguard framework with tariff-rate quotas for specified steel products.

It provides for:

• Tariff-rate quotas for products listed in Annex I.
• A 50% ad valorem out-of-quota duty where the relevant quota is exhausted or an import does not benefit from a quota.
• Transparency concerning the country where the steel was first melted and cast.
• Verifiable melt-and-pour evidence from covered importers from 1 October 2026.

Importers should map their products against the relevant CN codes, confirm origin and exclusions, monitor quota availability and require appropriate evidence from suppliers before shipment.

Commission Delegated Regulation (EU) 2026/1278 on listed pesticides and industrial chemicals

Published: 12 August 2026
Application of amended controls: 1 October 2026

The Regulation amends the Prior Informed Consent listings under Regulation (EU) No 649/2012.

The changes:

• Amend pesticide and industrial-chemical listings in Annex I.
• Revise the Annex V export-prohibition list.
• May require export notification, explicit consent or Rotterdam Convention procedures.
• Add Dechlorane Plus, methoxychlor and UV-328 to Annex V, subject to the specified conditions and exemptions.

Affected exporters should screen substances, mixtures, articles and export destinations against the amended annexes. A chemical permitted for use within the EU may still be subject to notification, consent or prohibition when exported.

German Industrial Emissions Directive implementation

Enacted: 13 October 2026
Published: 19 October 2026
Core commencement: 21 October 2026

The German Act implements Directive (EU) 2024/1785 by amending industrial-emissions and related environmental legislation.

The changes address:

• Integrated pollution prevention.
• Emission and environmental-performance limits.
• Resource efficiency and circularity.
• Decarbonisation.
• Monitoring of emissions and the receiving environment.
• Environmental permits and related management arrangements.

Applicability depends on the installation, activity, capacity, permit and transitional provisions. Affected operators should assess each installation against the amended scope and review permits, applicable best available techniques conclusions, monitoring arrangements and environmental management controls. ISO 14001 certification does not itself establish legal compliance.

Repeal of the German EVPG Regulation

Amendment effective: 20 October 2026
Repeal effective: End of 31 October 2026

The Third Regulation amending the Energy-Related Products Act Regulation inserted an express provision ending the application of the EVPG Regulation on 31 October 2026.

This is a regulatory transition rather than a new universal energy-efficiency requirement. The repeal does not end relevant EU ecodesign or product-specific conformity obligations.

Legal registers should preserve the outgoing Regulation as a historical entry, identify the appropriate successor national provisions and update product-compliance procedures and enforcement references.

Italian environmental assessment, circular economy and remediation Decree-Law

Issued and published: 8 October 2026
Commencement: 9 October 2026

Decree-Law No. 177 of 8 October 2026 introduces urgent provisions concerning:

• Environmental impact assessment screening.
• State-level integrated environmental authorisations.
• Environmental and climate-related events.
• Excavated earth and rock.
• Solid recovered fuel.
• Circular-economy measures.
• Contaminated-land remediation.
• Targeted public funding.

The Decree-Law took immediate effect but requires parliamentary conversion. Affected organisations should review relevant projects, permits, excavation, material-management and remediation activities and monitor the conversion process for amendments or possible lapse.

Portuguese petroleum-storage and filling-station amendments

Published: 2 October 2026
Reported commencement: 3 October 2026

Decree-Law No. 198/2026 revises Portugal’s licensing and inspection framework for petroleum-product storage facilities and fuel-filling stations.

The changes seek to make administrative requirements more proportionate to installation risk and include:

• Conditional licensing exemptions for specified LPG-cylinder storage.
• Simplified treatment of capacity reductions resulting from deactivated or suspended tanks or compartments.
• Recording certain reductions through endorsement of the existing licence rather than a fresh licensing procedure.

Operators should confirm the applicable thresholds and conditions from the operative provisions before relying on an exemption. Administrative simplification does not remove installation-safety, inspection, fire or environmental controls.

ISO/IEC 27090:2026, AI-system security

Published: 14 October 2026
Status: First edition, voluntary international guidance

ISO/IEC 27090:2026 provides guidance on understanding, detecting and mitigating security threats and compromises affecting AI systems.

It addresses:

• Security across the AI-system lifecycle.
• Protection of training data and models.
• Data poisoning.
• Model theft.
• Consequences of AI-system compromise.
• Security of operational data used for model updates or retraining.
• AI supplier and supply-chain assurance.

The standard complements ISO/IEC 27001 and ISO/IEC 27002 rather than replacing them. Organisations should assess the guidance against their AI inventory, risk treatment, supplier controls and incident-response arrangements. Publication does not itself create a statutory duty or demonstrate compliance with AI legislation.

Italian AI governance legislation

Adopted: 7 October 2026
Published: 8 October 2026
Commencement: 23 October 2026

Legislative Decree No. 179 of 7 October 2026 adapts Italian legislation to the EU AI Act.

It establishes national arrangements concerning:

• Coordination of AI authorities.
• Notification and market surveillance.
• Sanctions.
• Regulatory sandboxes.
• AI use in training and education.
• AI in professions, employment, healthcare and public administration.
• Confidential business information involving data, algorithms and mathematical methods.

Organisations should update their AI inventories and legal-role assessments, identify the relevant national and sectoral authorities, and review approvals, supplier terms, documentation, competence and regulatory-response arrangements.

The Decree does not replace the EU AI Act’s separate phased application dates or mean that every AI system is automatically high risk.

Malta Micromobility (Amendment) Regulations 2026

Published: 23 October 2026
Status: Detailed requirements remain under verification

Legal Notice 303 of 2026 amends Malta’s Micromobility Regulations. Contemporary reporting described the change as making helmets compulsory for e-scooter riders, but the October update did not independently verify the full operative wording, commencement, device scope, exemptions or penalties.

Organisations authorising e-scooters for work-related travel should obtain the complete Legal Notice, confirm the applicable requirements and review travel risk assessments, rider guidance, licensing, insurance and equipment controls. The reported helmet requirement should not be treated as confirmation that every device, rider or journey is otherwise legally authorised.

Swedish occupational-injury insurance amendment

Published: 27 October 2026
Status: Operative details under review

SFS 2026:1810 amends Regulation (1977:284) on occupational-injury insurance and state personal-injury protection.

The official index confirms the instrument’s identity and publication, but the October update did not verify:

• The specific provisions changed.
• The affected categories of person.
• Commencement.
• Transitional arrangements.
• Changes to benefits, forms or reporting deadlines.

Relevant organisations should retain existing injury-reporting and insurance procedures until the full amendment has been assessed. The publication should not be assumed to impose a new obligation on every Swedish employer.

Swedish hazardous-goods prohibition amendment

Published: 27 October 2026
Status: Operative details under review

SFS 2026:1803 amends Regulation (1999:58) prohibiting certain goods hazardous to health.

The source confirms publication but does not establish the affected goods, amended provisions, commencement, exemptions or transitional arrangements.

Organisations should obtain the full amendment before changing purchasing, handling or distribution controls. The measure concerns a specific public-health framework and should not be treated as a general prohibition affecting all hazardous chemicals or consumer products.

ISO/IEC 38501-1:2026, governance of IT implementation guidance

Published: 7 October 2026
Status: First edition, voluntary international guidance

ISO/IEC 38501-1:2026 supports implementation of effective IT governance in accordance with ISO/IEC 38500.

It provides guidance on:

• Designing and establishing governance arrangements.
• Identifying governance activities.
• Defining decision-making responsibilities.
• Clarifying the roles of key organisational stakeholders.
• Establishing leadership oversight, reporting and assurance.

The standard focuses on governance and accountability rather than detailed technical security controls. Organisations can use it to review decision rights, leadership sponsorship, reporting and assurance over IT-related performance, risks and obligations.

Austrian energy legislation amendments

Published: 29 October 2026
Status: Provision-specific commencement requires confirmation

Austria amended:

• The Electricity Industry Act.
• The Energy Steering Act 2012.
• The Petroleum Stockholding Act 2012.
• The Gas Industry Act 2011.

The amendments concern energy administration, security of supply, federal competence and the duration of specified provisions. Dates within the Electricity Industry Act and Energy Steering Act were extended to 1 April 2029.

Regulated electricity, gas and petroleum-stockholding organisations should confirm the amended provisions and operative dates. Ordinary energy users should consider critical supply dependencies through existing business-continuity arrangements rather than assume that duties applicable to regulated operators also apply to them.

Belgian driver-training contribution arrangements

Royal Decree: 18 October 2026
Published: 27 October 2026

The Royal Decree makes binding a collective labour agreement concerning contributions towards:

• Category C and CE driving-licence costs.
• Initial qualification for category C professional drivers.
• Statutory examinations following qualifying training.

The measure applies to specified employers and workers within the road freight transport for third parties and goods-handling for third parties subsectors under the relevant Joint Committee.

Employers should confirm sector coverage, eligible workers and training, contribution amounts, payment arrangements, evidence requirements and applicable deadlines from the complete agreement. The funding arrangement does not replace licensing, professional-qualification or road-safety requirements.

Bosnia and Herzegovina ILO ratification decision

Published: 5 October 2026
Status: Final coverage and legal effect require verification

The official publication index records a decision ratifying five International Labour Organization conventions and protocols.

A preparatory consultation referred to Conventions Nos. 130, 152, 160, 167 and 170 and the Protocol to Convention No. 155. However, the October update did not confirm that this list matched the final published decision.

Domestic ratification, ILO registration, international entry into force and the creation of enforceable domestic obligations are separate stages. Organisations should not assign new workplace duties or deadlines until the final instruments and their domestic effect have been verified.

French natural-disaster recognition Order

Signed: 27 October 2026
Published: 29 October 2026

The Order recognises a state of natural disaster for flooding and mudflows in the communes and event periods specified in its annex.

Recognition may support insurance claims for qualifying direct material damage where:

• The affected location and event period are listed.
• The natural phenomenon was the determining cause.
• Normal preventive measures could not prevent the damage or could not be taken.
• The claim meets the applicable legislative and policy conditions.

Recognition does not guarantee payment. Affected organisations should check site addresses and damage dates against the annex, notify their insurer or broker promptly and retain photographs, inventories, invoices and incident records.

German foreign-trade and sanctions amendments

Published: 16 October 2026
Commencement: 17 October 2026

The Twenty-third Regulation amending the Foreign Trade and Payments Regulation revises:

• Selected embargo provisions.
• Section 76a concerning case-specific exceptions.
• Administrative-offence provisions in section 82.
• Enforcement references connected with EU sanctions and the German foreign-trade framework.

Specified exceptions concern particular public-authority activities and protection of diplomatic or consular representations and international organisations. They do not provide a general exemption for ordinary commercial transactions.

Organisations should review transaction screening, goods classification, sanctions escalation and authorisation controls. A cleared counterparty does not by itself establish that a transaction, service or export is permitted.

German digital driving-licence provisions

Technical prerequisites confirmed: 14 October 2026
Notice published: 22 October 2026

The Notice confirms that Articles 2, 4 and 7 of the Fifth Act amending the Road Traffic Act entered into force on 14 October 2026 following confirmation of the technical prerequisites for creating digital driving licences.

The Notice does not:

• Require every employer or driver to adopt a digital licence.
• Confirm universal application availability.
• Confirm recognition outside Germany.
• Treat an ordinary photograph or screenshot as an official verifiable credential.
• Remove the need to hold valid driving entitlement.

Fleet and HR teams should review official eligibility, presentation and verification arrangements before changing licence-checking procedures.

Italian insolvency-related continuity legislation

Promulgated: 23 October 2026
Published: 26 October 2026
Commencement: 27 October 2026

Law No. 196 of 23 October 2026 converts Decree-Law No. 154 of 28 August 2026 with amendments.

The conversion changes the original focus from continuity of nationally strategic installations to continuity of undertakings in a state of insolvency and removes the specified strategic-installation qualification from part of Article 1.

Organisations assessing applicability should use the coordinated Decree rather than relying solely on the original title. The measures do not generally suspend environmental, health and safety or contractual obligations.

Italian road-haulage, agriculture and fisheries support measures

Issued and published: 23 October 2026
Commencement: 24 October 2026

Decree-Law No. 193 introduces support measures and operational changes affecting road haulage, agriculture, fisheries and aquaculture.

The provisions include:

• Adjustments to road-haulage fuel support.
• Separate qualifying expenditure periods.
• Fuel-cost references in haulage contracts.
• Certain leasing arrangements.
• National electronic consignment documentation.
• Support measures for agriculture and fisheries.

Eligibility, funding limits, application procedures and implementation dates vary by measure. Transport, legal and finance teams should review the role-specific provisions and retain relevant fuel, vehicle, expenditure and sector-registration evidence. The Decree-Law remains subject to parliamentary conversion.

Malta development-planning amendment

Published: 23 October 2026
Status: Detailed requirements under review

Legal Notice 301 of 2026 amends Malta’s Development Planning Use Classes Order.

The confirmed publication does not establish:

• Which use classes changed.
• The commencement date.
• Transitional arrangements.
• Whether a particular change of use is permitted.
• Whether existing planning conditions have been amended.

Property owners, occupiers and developers should obtain the complete Legal Notice and compare affected premises and proposed activities against existing permissions, planning history and lease conditions before changing use.

Malta vehicle tolls and user charges amendment

Published: 23 October 2026
Status: Detailed requirements under review

Legal Notice 302 of 2026 amends the Application of Tolls and User Charges to Vehicles Regulations.

The October source confirms publication but does not verify:

• The affected vehicles or roads.
• Revised rates.
• Payment deadlines.
• Exemptions.
• Technical requirements.
• Commencement or transitional arrangements.

Fleet owners and transport operators should obtain the full amendment before changing route costing, payment processes or vehicle classifications.

Swedish Population Registration Regulation amendment

Published: 27 October 2026
Status: Operative details under review

SFS 2026:1814 amends Sweden’s Population Registration Regulation.

The available information did not confirm the changed provisions, commencement or affected administrative bodies. The amendment should not be interpreted as creating a general new employer reporting, staff-address verification or personal-data collection duty.

Organisations with a relevant statutory administrative role should obtain the complete amendment and assess any resulting personal-data processing against applicable privacy requirements.

Countries with no applicable updates identified

The October update identified no applicable legislation updates for:

• Netherlands.
• Norway.
• Republic of Ireland.
• Spain.
• Switzerland.

This means that no applicable items were selected for inclusion in the update. It is not confirmation that no legal or regulatory changes occurred in those countries during October 2026.

Significant amendments and emerging compliance issues

The principal changes and emerging issues identified in the October 2026 update are:

• A new requirement for covered steel importers to provide verifiable country-of-melt-and-pour and heat-number evidence from 1 October 2026.
• Introduction of tariff-rate quotas and a 50% out-of-quota duty for specified EU steel imports.
• Revised EU Prior Informed Consent listings and export controls for pesticides and industrial chemicals.
• Modernisation of German product-liability law, including software, digital manufacturing files, connected services and qualifying data loss.
• New Italian enforcement arrangements for recycled plastic food-contact materials.
• Implementation of revised industrial-emissions requirements in Germany.
• Repeal of Germany’s EVPG Regulation at the end of 31 October 2026, without removing underlying EU ecodesign obligations.
• Italian changes concerning environmental assessments, integrated authorisations, circular-economy activities and remediation.
• Amended protected habitat and species lists for Poland’s Dolny Wieprz Natura 2000 site.
• Revised Portuguese licensing and administrative arrangements for petroleum storage and filling stations.
• New Luxembourg notification requirements concerning security measures taken by essential entities.
• Publication of ISO/IEC 27090:2026 on AI-system security.
• New Italian national supervision, enforcement and sectoral arrangements supporting the EU AI Act.
• Micromobility, occupational-injury and hazardous-goods amendments requiring further verification in Malta and Sweden.
• Publication of ISO/IEC 38501-1:2026 on governance of IT implementation.
• Future German sanctions of up to €100,000 for applicable price-indication infringements.
• Phased German reforms affecting product liability, design rights and certain consumer-facing claims.
• New German foreign-trade and sanctions enforcement provisions.
• Activation of specified German digital driving-licence provisions.
• Phased Danish digital-bookkeeping, SAF-T, identity-verification and electronic-invoicing requirements.
• Sector-specific Belgian arrangements for contributions towards professional driver training and qualification.
• Italian measures concerning insolvency-related continuity, road haulage, agriculture and fisheries.
• Continuing need to distinguish enacted requirements from proposals, later commencement dates, voluntary standards and items whose operative details remain under review.
• Increased importance of supplier evidence, technical documentation, traceability, product and software records, customs evidence, sanctions screening and documented applicability assessments.