Dispatch from Brussels: Updates on EU Tech Policy

23 Mar 2026 02:31 PM

Digital Sovereignty 

Cloud and AI Development Act (CADA) delayed: The CADA is now expected to be proposed on 27 May 2026. The proposal is set to be a flagship legislative initiative aimed at tripling EU data centre capacity, establishing EU-wide eligibility requirements for cloud service providers, and creating a single EU-wide cloud policy for public administrations and procurement. The Act, which will be proposed around the same time as a revision of EU public procurement rules, is being dubbed the "tech sovereignty package". techUK will be paying close attention to the proposal to ensure any impact on non-EU companies is fully understood. 

Artificial Intelligence 

EU Commission opens consultation on evaluations and proceedings: On 12 March the EU Commission published a draft implementing act on "detailed arrangements for the conduct of certain proceedings" by the EU AI Office. The draft act covers arrangements and conditions for evaluations of general-purpose AI models, including the involvement of independent experts. Interested stakeholders can take part in the consultation until 9 April. 

Simplification  

EU Proposes 28th Regime (EU Inc.): On 18 March, the European Commission published its legislative proposal for EU Inc, an optional, harmonised EU-level company law framework. It aims to address the fragmentation that currently forces companies expanding across EU borders to navigate 27 national legal systems and more than 60 different company forms. Key features include: company registration within 48 hours, fully online, for less than €100 and with no minimum share capital; a "once only" principle whereby companies submit information to a single EU-level interface connected to national business registers, with tax identification and VAT numbers issued without resubmitting paperwork; and digital-by-default corporate processes throughout a company's lifecycle. The Commission will also establish a new central EU register. An overview of the 28th regime will soon be published on our website. 

Council and Parliament to begin AI omnibus negotiations: On Friday 14 March, EU Member States adopted the necessary mandate to begin interinstitutional negotiations with the European Parliament.  The AI Omnibus, which forms a part of the EU’s Digital Simplification Package, will aim to simplify the EU's AI Act rules before the high-risk requirements August 2026 deadline kicks in. The Omnibus will therefore have the ambitious task of conducting quick negotiations. Should things continue at this quick pace, we can expect an AI Omnibus text to be agreed upon by May 2026. 

Online Platforms  

Digital Fairness Act (DFA) discussions gaining traction: The DFA, a new legislative initiative aimed at strengthening consumer protection in digital environments by tackling certain online practices (such as dark patterns, addictive design, unfair personalisation, or subscription traps), is increasingly being discussed. The legislative proposal is expected for Q4 2026 but discussions are currently picking up. On 13 March, over 200 civil society groups urged the EU Commission, in an open letter to deliver an ambitious proposal that ensures "meaningful protection in the digital environment for people of all ages". This was followed by an industry letter by 34 trade associations and organisations addressed to the EU Commission on 16 March calling for the DFA to focus on consistent enforcement and further clarity regarding existing rules rather than the creation of new rules. In response to this, Consumer Protection Commissioner Michael McGrath said the upcoming legislation would only introduce "targeted and proportionate" measures and would not seek to "duplicate efforts or reopen matters already settled". 

Cyber Resilience  

EU Publishes draft guidance for Cyber Resilience Act (CRA): The CRA is part of the broader EU product law framework and establishes mandatory cybersecurity requirements that will affect most hardware and software products made available on the EU market. On 3 March, the EU published its first draft guidance intended to assist economic operators and market surveillance authorities applying the CRA. Interested stakeholders have until 31 March to provide feedback on the guidance. As a reminder, the CRA’s main obligations will apply from 11 December 2027 with reporting obligations to apply as of 11 September 2026.  

Click here for the full press release