September 2026 General EU Legal Update

Purpose

This update summarises key legal, regulatory and international standards developments identified in the September 2026 General EU legal update. It highlights changes affecting Quality, Environment, Information Security, AI Governance, Health & Safety and other compliance obligations, supporting organisations in identifying new and emerging requirements for legal registers, compliance evaluations and management system reviews.

Download the full update

Upcoming legislation

These measures were published or updated during September 2026 but have future commencement dates, application dates or transitional requirements.

Commission Delegated Regulation (EU) 2026/1563 simplifying certain sustainability reporting standards

Published: 21 September 2026
Application: Financial years beginning on or after 1 January 2027

The Regulation simplifies the European Sustainability Reporting Standards by:

• Reducing the number of mandatory data points.
• Clarifying the materiality assessment.
• Distinguishing more clearly between mandatory and voluntary disclosures.
• Improving consistency with international sustainability reporting frameworks.
• Reducing unnecessary reporting effort while retaining decision-useful sustainability information.

Organisations subject to mandatory sustainability reporting should review their materiality methodology, disclosure register, data inventory, reporting systems, controls and assurance evidence before the first affected reporting period.

Second Regulation amending German low-emission vehicle identification requirements

Published: 30 September 2026
Commencement: 1 January 2027

The Regulation updates Germany’s vehicle-emissions identification rules by recognising the official identification carried by qualifying electrically powered vehicles for relevant low-emission-zone access requirements.

Organisations operating vehicles in Germany should:

• Identify electric vehicles entering low-emission zones.
• Confirm whether each vehicle carries the qualifying German identification.
• Update fleet and driver guidance.
• Check leased, hired and foreign-registered vehicles before travel.
• Retain suitable registration or rental evidence.

Machinery Commodities Act Decree 2026, Netherlands

Published: 16 September 2026
Principal application: Aligned with the EU Machinery Regulation from 20 January 2027

The Decree establishes the Dutch implementation and enforcement framework for Regulation (EU) 2023/1230 on machinery. It includes:

• National enforcement arrangements for manufacturers, authorised representatives, importers and distributors.
• Designation and supervision of conformity assessment bodies.
• Transitional arrangements replacing the previous Dutch machinery framework.
• Continuing inspection and certification requirements for specified cranes and lifting equipment used for professional passenger transport.
• Amendments to related occupational safety, building, administrative penalty and lift legislation.

Affected organisations should review product classification, risk assessments, technical files, instructions, declarations, CE marking, substantial modifications, supply-chain responsibilities and inspection arrangements.

Belgian Civil Code Book 7 on special contracts

Published: 23 September 2026
Commencement: 1 September 2027

The Law modernises Belgium’s rules for special contracts, including:

• Sales and exchanges.
• Leases and loans for use.
• Service contracts.
• Mandates and deposits.
• Real-estate intermediary services.
• Certain aleatory contracts.
• Sequestration and settlements.

The changes clarify contract classification, conformity, delivery, acceptance, defects, transfer of ownership and risk, maintenance, payment, subcontracting, remedies and liability.

Organisations entering or renewing Belgian contracts from 1 September 2027 should review their standard terms, procurement conditions, customer agreements and contract-approval procedures.

Nuclear energy framework, Italy

Commencement: 15 October 2026

Law No. 169 of 29 September 2026 delegates powers to the Italian Government to develop a national framework for sustainable nuclear energy. Future implementing legislation is expected to address:

• Advanced and innovative nuclear technologies.
• Research and industrial development.
• Construction and operating controls.
• Nuclear and radiation safety.
• Physical protection and safeguards.
• Emergency preparedness.
• Radioactive-waste and spent-fuel management.
• Decommissioning.
• Authorisation and regulatory oversight.
• Workforce competence and supply-chain development.
• Stakeholder engagement and public information.

The Law is an enabling measure rather than a complete operating regime. Organisations with potential involvement in the Italian nuclear supply chain should monitor the implementing decrees and assess their capabilities in quality assurance, safety culture, security, competence, traceability and environmental management.

Minimum youth wage changes, Netherlands

Commencement: 1 January 2027

The Decree increases statutory minimum youth wage percentages in the European Netherlands to:

• 87.5% of the adult minimum wage for workers aged 20.
• 75% for workers aged 19.
• 62.5% for workers aged 18.
• 50% for workers aged 17.
• 40% for workers aged 16.
• 30% for workers aged 15.

It also:

• Removes the separate lower minimum wage rates for students following the vocational work-based learning pathway.
• Introduces a 55% minimum wage percentage for 15-year-olds in the Caribbean Netherlands.

Employers should update payroll tables, employment contracts, pay policies, apprenticeship arrangements and workforce budgets before the first affected payroll.

Swiss Climate Protection Ordinance

Status: In force, with amendments taking effect on 31 October 2026

The Ordinance implements Switzerland’s Federal Climate Protection Act and covers:

• Company and sector net-zero roadmaps.
• Separate calculation of direct, indirect and value-chain greenhouse-gas emissions.
• Support for innovative climate technologies and processes.
• Risk coverage for public infrastructure needed for net zero.
• Climate-adaptation networks.
• Voluntary climate-alignment testing of financial flows.

Organisations using Swiss climate incentives or making transition claims should maintain credible emissions data, defined baselines, measurable reduction pathways and evidence supporting planned measures.

New legislation and standards

These legal texts and standards were published, commenced or became applicable during September 2026.

ISO 9001:2026, Quality management systems, Requirements

Published: 16 September 2026
Status: Sixth edition, replacing ISO 9001:2015

The revised standard retains the established process-based quality management framework covering:

• Organisational context.
• Leadership.
• Planning.
• Support.
• Operations.
• Performance evaluation.
• Improvement.

The revision improves clarity and usability, aligns terminology with ISO 9000:2026 and reflects changes in digital operations and stakeholder expectations.

Organisations using or certified to ISO 9001:2015 should obtain the revised standard, complete a clause-by-clause gap analysis and agree transition arrangements with their certification body.

ISO 20252:2026, Market, opinion and social research, including insights and data analytics

Published: September 2026
Status: Fourth edition, replacing ISO 20252:2019

The standard establishes vocabulary and service requirements for:

• Commissioning and designing research.
• Data collection and processing.
• Analysis and reporting.
• Retention of research information.
• Methodological quality and transparency.
• Participant protection.
• Control of data and subcontracted activities.

Research and analytics providers should review client agreements, methodologies, sampling, privacy arrangements, information security, quality controls, supplier oversight and reporting practices.

Commission Delegated Regulation (EU) 2026/1560 on voluntary sustainability reporting

Published: 21 September 2026
Status: In force

The Regulation establishes a simplified and proportionate voluntary sustainability reporting standard for organisations outside mandatory Corporate Sustainability Reporting Directive requirements.

It covers:

• Environmental information.
• Social information.
• Governance information.
• Basic and comprehensive reporting modules.
• A value-chain information cap for requests made to organisations with no more than 1,000 employees.

The standard is intended to reduce inconsistent questionnaires, duplicated evidence requests and disproportionate reporting burdens while supporting credible sustainability information for customers, lenders, investors and supply-chain partners.

ISO 20001:2026, Food loss and waste management system

Published: September 2026
Status: First edition

The standard specifies requirements for preventing and minimising food loss and waste across the food supply chain, including:

• Policy and objectives.
• Operational controls.
• Quantification and measurement.
• Monitoring and documentation.
• Reporting of excess food and food waste.
• Collaboration with relevant interested parties.
• Performance evaluation and continual improvement.

It applies to organisations involved in production, processing, transport, storage, distribution, retail, catering, charitable redistribution and food-waste management.

ISO 14068:2026, Climate change management, Carbon neutrality

Published: September 2026
Status: First edition, replacing ISO 14068-1:2023

The standard establishes principles and requirements for achieving and demonstrating carbon neutrality, including:

• Defining the subject and reporting boundary.
• Quantifying the carbon footprint.
• Preparing carbon-neutrality management plans.
• Reducing direct and indirect emissions.
• Enhancing greenhouse-gas removals.
• Using offsets for residual emissions.
• Continual improvement.
• Transparent reporting and substantiated claims.

The standard prioritises value-chain reductions and removals before offsetting.

ISO/UNDP 53001:2026, Management systems for United Nations Sustainable Development Goals

Status: First edition

The standard provides a management-system framework for integrating the UN Sustainable Development Goals into organisational purpose, strategy, operations and decision-making.

It requires organisations to:

• Identify beneficial and adverse impacts.
• Engage interested parties.
• Prioritise relevant Sustainable Development Goals.
• Consider interdependencies and trade-offs.
• Set meaningful objectives.
• Allocate actions and resources.
• Collect and evaluate performance data.
• Continually improve sustainable-development outcomes.

Luxembourg heat-pump legislation

Published: 18 September 2026
Status: In force in accordance with the relevant commencement provisions

The Law of 17 August 2026 and its supporting Grand-Ducal Regulation establish requirements for:

• Safe and energy-efficient heat-pump operation.
• Maintenance and inspections.
• Competence of relevant professionals.
• Documentation and operating records.
• Regulatory supervision.
• Monitoring and correction of defects or performance issues.

Owners and managers of Luxembourg buildings should identify covered heat pumps, review maintenance contracts and inspection schedules, confirm contractor competence and retain service and corrective-action records.

Swedish environmental supervision and fee amendments

Published: 8 September 2026

Sweden amended:

• The Environmental Supervision Regulation.
• The Regulation on fees for examination and supervision under the Environmental Code.

The changes update:

• Allocation and coordination of supervisory responsibilities.
• References to competent national, regional and municipal authorities.
• Environmental permit, notification and inspection arrangements.
• Fees for specified applications, examinations and supervisory activities.

Organisations should confirm the responsible authority for each site or regulated activity, update regulator contact details and review applicable environmental fees.

Cyber Resilience Act

Status: In force with phased application

Regulation (EU) 2024/2847 introduces cybersecurity requirements for hardware and software products with digital elements placed on the EU market.

The requirements include:

• Secure product design and development.
• Cybersecurity risk assessment.
• Vulnerability management throughout the support period.
• Security updates and user information.
• Technical documentation.
• Conformity assessment and CE marking.
• Reporting of actively exploited vulnerabilities and severe incidents.
• Verification duties for importers and distributors.

Manufacturers and other economic operators should integrate cybersecurity into product development, technical documentation, supplier controls and post-market support.

EU Data Act

Status: In force and applicable

Regulation (EU) 2023/2854 establishes rules governing access to and use of data generated by connected products and related services.

It covers:

• User rights to access and share data.
• Duties of data holders and recipients.
• Business-to-business data sharing.
• Business-to-government data requests.
• Unfair contractual terms imposed on smaller enterprises.
• Switching between data-processing services.
• Cloud portability and interoperability.
• Protection of trade secrets and personal data.

Organisations should map relevant products, services and datasets and review product design, customer interfaces, contracts, licensing and cloud exit arrangements.

Commission Implementing Regulation (EU) 2026/2083 on MyHealth@EU

Published: 21 September 2026

The Regulation establishes operational and technical arrangements for cross-border exchange of personal electronic health data, including:

• Roles of national contact points.
• Connection and onboarding requirements.
• Common services and interoperability.
• Testing and monitoring.
• Service continuity.
• Information security.
• Incident management.

Participating bodies and their suppliers should review access controls, encryption, logging, business continuity, incident response and conformance-testing arrangements.

Commission Implementing Regulation (EU) 2026/2099 on cross-border health-data identification and authentication

Published: 22 September 2026

The Regulation establishes a common mechanism for identifying and authenticating:

• Natural persons.
• Health professionals.
• Healthcare providers.

The requirements support consistent identity matching, verification, authorisation and assurance when personal electronic health data is exchanged across borders.

Affected organisations should review identity attributes, credential management, access controls, audit logging and procedures for resolving incomplete, duplicate or conflicting identity records.

Swedish electronic-evidence access arrangements

Published: 5 September 2026

The Swedish Regulation establishes technical and administrative arrangements for accessing the decentralised EU system used for European Production Orders and European Preservation Orders.

It covers:

• Provision of the technical access solution.
• Service-provider notifications.
• Authorisation arrangements.
• Secure and auditable access.
• Information sharing concerning non-compliance.
• Receipt, validation, escalation and response to electronic-evidence orders.

Relevant service providers and legal representatives should review registration, authentication, role-based access, secure communications, evidence preservation, incident response and business continuity controls.

Italian AI legislation for policing and liability

Commencement: 30 September 2026

Legislative Decree No. 160 of 9 September 2026 adapts Italian legislation to the EU AI Act in relation to policing and civil and criminal liability.

It addresses:

• Research, development, training and testing of policing AI.
• Biometric-data categorisation.
• Real-time remote biometric identification.
• Retrospective facial recognition.
• Governance and safeguards for law-enforcement AI.
• Criminal provisions concerning unlawful AI development or use.
• Civil procedures for claims involving damage caused by AI systems.

Authorities, technology providers and contractors should maintain evidence of lawful purpose, authorisation, human oversight, data governance, testing, accuracy, logging, cybersecurity and liability allocation.

ISO 45010:2026, Menstruation and menopause in the workplace

Published: September 2026
Status: First-edition guidance standard

The standard provides guidance on workplace policies and practices supporting menstrual and menopausal health and experiences, including:

• Workplace design and facilities.
• Work organisation and flexibility.
• Uniforms and temperature.
• Welfare and rest arrangements.
• Recruitment and management practices.
• Confidential workplace discussions.
• Suitable adjustments.
• Communication and manager competence.

Organisations should review workplace barriers, facilities, risk assessments, occupational-health routes, confidentiality arrangements and manager guidance.

Norwegian Regulation on the performance of work and use of work equipment

Commencement: 29 September 2026

The amendment clarifies the territorial and sectoral scope of Norway’s work-performance requirements, including their application to:

• Offshore petroleum activities.
• Specified onshore petroleum facilities.
• Activities in Svalbard.
• Svalbard coal mines under their separate framework.

Organisations operating across these areas should map the correct occupational health and safety regime for each activity and update legal-applicability assessments, procedures and audit criteria.

Swiss Accident Insurance Ordinance

Status: In force

The Ordinance provides detailed arrangements for compulsory occupational and non-occupational accident insurance, including:

• Persons and activities insured.
• Employer and employee insurance arrangements.
• Occupational and non-occupational accident classification.
• Insured earnings and benefits.
• Premiums and payroll arrangements.
• Insurer responsibilities.
• Claims administration.
• Coordination with other social-insurance provisions.

Employers should verify coverage for permanent, part-time, temporary and mobile workers and review payroll, accident-reporting and claims-handling procedures.

EU anti-dumping duties on Chinese iron and steel fasteners

Commencement: 22 September 2026
Validity: Until 18 February 2027

Commission Implementing Regulation (EU) 2026/2089 amends the anti-dumping measures applying to specified iron or steel fasteners originating in China.

The change affects:

• Exporting-producer information.
• Applicable duty treatment.
• Customs classification.
• Origin evidence.
• Import documentation.

Importers should verify product codes, technical descriptions, country of origin, exporting producers and the applicable duty rate before customs entry.

Updated EU restrictive measures concerning Ukraine

Commencement: 22 September 2026
Extended until: 22 September 2029

Council Implementing Regulation (EU) 2026/2160 and Council Decision (CFSP) 2026/2161 update and extend restrictive measures relating to actions undermining or threatening Ukraine’s territorial integrity, sovereignty and independence.

The changes include:

• Revised identifying information for listed persons and entities.
• Removal of specified entries.
• Continued application of asset freezes.
• Prohibitions on making funds or economic resources available.
• Extension of the relevant sanctions framework.

Organisations should update screening data and re-screen relevant customers, suppliers, beneficial owners, banks, intermediaries and pending transactions.

German public procurement amendments

Commencement: 8 September 2026

The Regulation updates Germany’s general and defence and security public procurement rules following legislation intended to accelerate public procurement.

The changes include:

• Updated statutory cross-references.
• References to current EU procurement thresholds.
• Alignment with the amended procurement framework.
• Consequential changes affecting contracting authorities and bidders.

Procurement procedures, threshold tables, templates and workflow systems should be reviewed and updated.

German Pharmacy Operating Regulations

Published: 21 September 2026
Commencement: Phased

The amendments cover:

• Responsible-person and representation arrangements.
• Pharmacy quality management systems.
• Planning for short-term energy shortages.
• Protection of critical equipment and medicine stocks.
• Continuity of essential pharmacy services.
• Branch and subsidiary pharmacy coordination.
• Pharmaceutical technical assistant arrangements.
• Operational documentation and facilities.

Pharmacy operators should identify the commencement date for each applicable provision and update their quality management, staffing, continuity and competence arrangements.

Gambling premises regulations, Republic of Ireland

Made: 17 September 2026

The Regulations require affected in-person betting premises to:

• Remain closed on Christmas Day.
• Remain closed on Good Friday.
• Open no earlier than 7.00 am on other days.
• Close no later than 10.00 pm.
• Prohibit the sale of alcohol products at affected premises.

Operators should update published hours, staff rotas, access controls, alarms, point-of-sale systems and closure procedures.

Swiss measures concerning Belarus

Status: In force and amended during September 2026

The Swiss framework includes:

• Asset freezes.
• Restrictions on making funds or economic resources available.
• Controls on specified goods and technologies.
• Restrictions affecting services, financing, trade and transport.
• Licensing and reporting arrangements.

Organisations should screen against current Swiss lists rather than relying solely on EU or UK sanctions data and should review Belarus-related ownership, end-use, routing, payments, technology and services.

Countries with no applicable updates identified

No applicable legislation updates were identified for:

• Austria.
• Bosnia and Herzegovina.
• Denmark.
• France.
• Malta.
• Poland.
• Portugal.
• Spain.

Significant amendments

The following matters represent substantive changes or emerging compliance issues arising from the September 2026 update:

• Publication of ISO 9001:2026 and the need for certified organisations to plan their transition from ISO 9001:2015.
• Introduction of revised international standards covering research services, food loss and waste, carbon neutrality, Sustainable Development Goals and workplace support for menstruation and menopause.
• Simplification of mandatory EU sustainability reporting requirements from financial years beginning on or after 1 January 2027.
• Introduction of a voluntary sustainability reporting standard and associated value-chain information cap for smaller organisations.
• Increasing treatment of cybersecurity as a product compliance requirement under the Cyber Resilience Act.
• Application of harmonised data-access, data-sharing, cloud-switching and interoperability requirements under the EU Data Act.
• Introduction of detailed operational, security and identity requirements for cross-border electronic health-data exchange.
• Implementation of secure technical arrangements for cross-border electronic-evidence orders in Sweden.
• New Italian controls governing policing AI, biometric identification, facial recognition and civil and criminal liability.
• Transition to the EU Machinery Regulation and the associated Dutch enforcement framework.
• Clarification of occupational health and safety requirements for Norwegian petroleum activities and Svalbard.
• New heat-pump operating, inspection, competence and documentation requirements in Luxembourg.
• Updated environmental supervision and fee arrangements in Sweden.
• Development of Swiss climate-roadmap, emissions-calculation and climate-finance requirements.
• Modernisation of Belgian contract law, with significant implications for sales, leases, services and other special contracts from September 2027.
• Increased Dutch minimum youth wage percentages from January 2027.
• Development of a future Italian regulatory framework for sustainable nuclear energy.
• Updated requirements affecting German procurement and pharmacy operations.
• Continuing changes to EU, Swiss and international sanctions controls.
• Increased need for reliable technical documentation, supplier information, traceability, conformity evidence, screening records and documented applicability assessments.
• Continued need to distinguish binding legal obligations from voluntary standards, enabling legislation, future commencement provisions and general monitoring items.