From Regulation to Strategy: Europe’s New Tech Agenda

Written by Efi Thoma, Senior Global Legal Counsel 

Europe’s approach to technology regulation is entering a more practical phase. After several years of ambitious rule-making, Brussels is increasingly focused on implementation, enforcement and simplification. For technology companies, the key question is no longer simply “What does the law require?” but “How do we make these requirements work in practice without unnecessarily slowing innovation?”

The EU AI Act (Regulation (EU) 2024/1689) establishes a risk-based framework covering areas such as transparency, governance, human oversight and high-risk AI systems. As implementation progresses, the emphasis is increasingly on making the framework workable in practice, including through regulatory sandboxes and measures supporting implementation.

For businesses, the practical approach is to embed AI governance into existing processes rather than create an entirely separate compliance structure. AI inventories, risk classification, procurement controls, human oversight and clear internal accountability can increasingly become part of normal product and business governance.

The EU Data Act (Regulation (EU) 2023/2854), applicable since September 2025, introduces important rules around access to data generated by connected products and related services, cloud switching and contractual terms concerning data sharing.

The practical question for companies is therefore not only “Who owns or can access the data?” but also “How can we use data responsibly to improve products, partnerships and customer value?” Reviewing data architecture and contractual arrangements early can help avoid compliance becoming a barrier when new products or services are launched.

The Digital Markets Act (Regulation (EU) 2022/1925) and Digital Services Act (Regulation (EU) 2022/2065) demonstrate that Brussels is increasingly looking beyond policies and contractual terms to how digital products and platforms actually operate.

Transparency, online choice, platform behavior and user experience are therefore becoming part of the regulatory conversation. The practical lesson is straightforward: legal and compliance teams should be involved earlier in product development, particularly where design choices may affect consumers, competition or transparency.

The NIS2 Directive (Directive (EU) 2022/2555) and Cyber Resilience Act (Regulation (EU) 2024/2847) reinforce the direction toward stronger cybersecurity governance and greater accountability throughout the lifecycle of digital products.

Cybersecurity should therefore increasingly be viewed as a business resilience issue rather than simply an IT responsibility. Clear ownership, supplier oversight, incident-response processes and security-by-design can help companies manage both regulatory and operational risk.

Looking toward 2027 and beyond, the direction from Brussels appears increasingly pragmatic: maintaining strong safeguards while also supporting innovation, investment and European competitiveness.

For technology companies, the opportunity is to move beyond a checklist approach to compliance. The more sustainable strategy is to build regulatory thinking into product, data and business decisions early-making compliance easier to manage while turning trust, security and responsible innovation into a competitive advantage.

Efi Thoma is Senior Global Legal Counsel


Comments

Post a Comment

Popular posts from this blog

Ombudsman inquiry on Commission President’s text messages is a wake-up call for EU

Image
The European Ombudsman inquiry into the Commission’s handling of a request for text messages between its President and the CEO of a pharmaceutical company is a wake-up call for all EU institutions about ensuring accountability in an era of instant messaging. One year after the initial request by a journalist, the Commission has still not clarified whether messages reported to concern major vaccine procurement deals exist and whether the public is entitled to see them. The Ombudsman had asked the Commission, in a finding of maladministration in January, to conduct a more thorough search for the text messages. The Commission’s recent response failed to say whether it had looked directly and correctly for the text messages and if not, why not. While the response recognised that work-related text messages can be EU documents, it reiterated that the Commission’s internal policy is, in effect, not to register text messages. The Ombudsman has closed  the inquiry  and upheld...
Read more

European Commission refers Poland to the Court of Justice to protect judges from political control

Image
European Commission decided to refer Poland to the Court of Justice of the EU regarding the new disciplinary regime for Polish judges, requesting an expedited procedure. On 3 April 2019, the Commission launched this infringement procedure on the grounds that the new disciplinary regime undermines the judicial independence of Polish judges and does not ensure the necessary guarantees to protect judges from political control, as required by the Court of Justice of the EU. Specifically, the Polish law allows ordinary court judges to be subjected to disciplinary investigations, procedures and sanctions on the basis of the content of their judicial decisions, including the exercise of their right under Article 267 of the Treaty on the Functioning of the European Union (TFEU) to request preliminary rulings from the Court of Justice of the EU. Moreover, the new disciplinary regime does not guarantee the independence and impartiality of the Disciplinary Chamber of the Supreme Co...
Read more

The Title Deed Issue in Cyprus and the "Trapped Buyers" Phenomenon

Image
Article By Giorgos Kazoleas, Lawyer LL.M.  The issue of title deeds in Cyprus and the phenomenon of "trapped buyers" constitutes one of the greatest legal, financial, and social peculiarities of Cypriot real estate law. The Cypriot Peculiarity: Sale Without a Title Deed Under Cypriot law (pursuant to the Immovable Property (Tenure, Registration and Valuation) Law, Cap. 224), legal ownership of a property is transferred and acquired solely upon its registration with the Department of Lands and Surveys and the issuance of the relevant Certificate of Registration (Title Deed). However, a major peculiarity exists: it is entirely legal to sell a property that does not (yet) possess a separate title deed. This typically occurs in new developments (apartment buildings or residential complexes), where the title deed for the plot of land belongs to the developer, but the separate title deeds for each apartment or house can take years to be issued due to bureaucracy, pending ap...
Read more

Amendment of Articles of Association in Cyprus: Between Corporate Freedom and Abuse of Right – A Comparison with the Corresponding Regulation in Germany

Image
Giorgos Kazoleas, Lawyer in Cyprus The Articles of Association constitute the regulatory framework of a company, governing the internal relations between its members and management. Under Cyprus law, flexibility in adapting this document is vital, but it is not unchecked. The Amendment Process (Section 12 of the Companies Law, Cap. 113) Pursuant to Section 12 of the Companies Law (Cap. 113), a company may amend its articles of association by passing a Special Resolution, subject to compliance with the provisions of this Law and the conditions contained in the Company’s Memorandum of Association. The Company may amend specific articles or its articles of association in their entirety. For the amendment to be valid, a majority of at least 75% of the members present and voting at the General Meeting is required, and the prescribed notice must have been given (typically 21 days, unless otherwise provided for private companies). Subsequently, the company must submit the special reso...
Read more

Greek Administrative Court rules state liable for Covid-19 vaccine side effects due to "excessive sacrifice"

Image
Greece: The Administrative Court of First Instance of Athens, in its decision no. 4202/2025, has ruled that the Greek State is liable for damages sustained by an individual due to side effects following a preventive "COVID-19" vaccination. This landmark decision was issued in a compensation lawsuit filed against the Hellenic Republic. The Case: Seeking Compensation for Vaccine-Related Harm The lawsuit was brought by a plaintiff seeking compensation for material damage and moral harm (non-pecuniary damage), alleging that they suffered severe side effects after their preventive COVID-19 vaccination with a specific vaccine. The initial claim was for €461,835.26, but this amount was subsequently restricted during the proceedings. The plaintiff based their claim on two legal grounds: Article 105 of the Introductory Law of the Civil Code (EισNAK): This article concerns the State's liability for compensation arising from illegal acts or omissions of its organs in the exe...
Read more

Access to documents: the Commission decision refusing a journalist of The New York Times access to the text messages exchanged between President von der Leyen and the CEO of Pfizer is annulled (CJEU)

Image
In its Judgment dated 14/5/2025 in Case T-36/23 (Stevi and The New York Times v Commission), the General Court ruled that the Commission decision refusing a journalist of The New York Times access to the text messages exchanged between President von der Leyen and the CEO of Pfizer is annulled. By an application based on the Access to Documents Regulation, [1], Matina Stevi, a journalist working for the daily newspaper The New York Times, requested the European Commission to provide access to all text messages exchanged between President Ursula von der Leyen and Albert Bourla, the chief executive officer of Pfizer, between 1 January 2021 and 11 May 2022.  The Commission rejected that application on the ground that it did not hold the documents covered by it. Ms Stevi and The New York Times requested the General Court of the European Union to annul the Commission’s decision.  In its judgment, the General Court upholds the action and annuls the Commission’s decision. The Court re...
Read more

International Criminal Court removes Prosecutor Karim Khan over serious misconduct

Image
International Criminal Court member states voted to dismiss prosecutor Karim Khan following disputed allegations that he sexually assaulted a female member of his staff. The Assembly of States Parties to the Rome Statute of the International Criminal Court held a special session on disciplinary proceedings involving an elected official on 24 July 2026 at United Nations Headquarters in New York. The Assembly adopted a decision, by secret ballot, by an absolute majority of 82 States Parties, finding that Mr. Karim Khan committed serious misconduct and serious breach of duty and removed him from office under article 46 of the Rome Statute. Following the decision, Deputy Prosecutors Nazhat Shameen Khan and Mame Mandiaye Niang, will continue to head the Office of the Prosecutor (the Office). Since Mr Karim A. A. Khan took a leave of absence in May 2025,  the Deputy Prosecutors have assumed responsibility for the leadership, management and administration of...
Read more