Secondary Legislation

The EU Cyber Resilience Act introduces mandatory vulnerability and incident reporting obligations for products with digital elements starting September 2026. Economic operators developing, importing, or distributing such products in the EU face strict compliance deadlines, substantial penalties for non-compliance, and must implement security-by-design principles throughout product lifecycles.

Ireland's National Cyber Security Centre has issued comprehensive guidance on NIS2 compliance, placing cybersecurity firmly in the boardroom. With potential fines reaching €10 million or 2% of global turnover for essential entities, management boards must now actively oversee cyber risk strategies, incident response capabilities, and supply chain vulnerabilities. The guidance provides a structured framework for organisations to assess their readiness before the National Cyber Security Bill takes effec

Ireland's Gambling Regulatory Authority is now actively licensing operators and enforcing the comprehensive regulatory framework established by the Gambling Regulation Act 2024. With remote operators already transitioned and in-person operators facing a December 2026 deadline, the GRAI has implemented wide-ranging enforcement powers including administrative sanctions up to €20 million and criminal provisions for unlicensed activities. Recent CJEU case law highlights critical compliance considerations

Michael Egan and Michael Scorer explore how organisations are transitioning from AI experimentation to practical implementation in legal workflows. They examine why generative AI adoption has doubled while confidence remains low, and discuss the critical role of defensibility, governance, and human oversight in successful AI deployment.

Ireland's EU Council Presidency faces critical telecommunications negotiations that will reshape Europe's digital infrastructure landscape. The Digital Networks Act promises to modernize the EU's telecoms framework by replacing multiple directives with a unified regulation, while parallel negotiations on child safety online raise fundamental questions about encryption and privacy. These interconnected policy files will determine how Europe balances investment incentives, cross-border service provision, netw

Legal compliance has moved to the forefront of technology deployment in Europe, with regulations like the EU AI Act, GDPR, DORA, and NIS 2 fundamentally changing how organizations approach technology adoption.

The European Commission has released draft guidelines clarifying how AI systems should be classified as high-risk under the EU AI Act, while simultaneously extending key compliance deadlines by up to two years. These guidelines provide detailed interpretative guidance on classification thresholds, the role of human oversight, and how complex or interconnected AI systems should be assessed for regulatory purposes.

The European Commission's Cloud and AI Development Act (CADA) proposes a radical restructuring of Europe's digital infrastructure landscape, introducing a four-tier sovereignty framework that could fundamentally...

Coimisiún na Meán has published guidance on the Article 40(4) Digital Services Act process, which enables Ireland's media regulator to request Very Large Online Platforms and Search Engines to provide data to vetted researchers. This novel regulatory mechanism involves complex evaluations of confidentiality concerns...

On 17 March 2026, the European Commission opened two new Connecting Europe Facility calls worth €200 million for projects in high-capacity networks, including submarine cables. These investments are in line with the goals of the EU Action Plan on Cable Security and are intended to help ensure secure and resilient connectivity across the EU and beyond.