The Softer Brussels Effect: Cybersecurity, Rights, And The Reach Of EU Law

Introduction

When lawyers and policymakers speak of the Brussels Effect, they usually point to privacy law. The story is familiar: the European Union adopts the General Data Protection Regulation (GDPR), firms worldwide adjust their practices, and before long the European model becomes the global template. Yet the arrival of the EU Cyber Resilience Act (CRA) invites us to revisit the concept. Here we see a gentler, product-based Brussels Effect, less tied to rights and establishments, more grounded in supply chains, CE markings, and the technical grammar of product law.

This 'softer' effect deserves attention, because it shows that the reach of EU law abroad does not follow a single script. In some domains, the effect is direct, sharp, and grounded in fundamental rights. In others it is indirect, technical, and mediated through global commerce. The contrast between the CRA, GDPR and the Artificial Intelligence Act reveals the plurality of the Brussels Effect.