EU compliance reference
Eight EU regulations. One of you.
Free tools that run the thresholds, trackers that carry the dates, and 76 specialist firms across seventeen countries who do this work for a living. Start with whichever one is closest.
8
frameworks tracked
27
member states covered
76
specialist firms listed
Aug 2026
trackers last verified
Start where the pressure is
Who can help with the work?
EU Compliance Provider Directory
Seventy-six consultancies, auditors and gap assessors that work on NIS2 and DORA, in Germany, the Netherlands, Spain, the UK, France, Ireland, Poland, Italy, Austria, Denmark, Sweden and Luxembourg. Filter by regulation, country, service and the size of client they take.
Browse the directory →
What has actually been fined?
EU Regulatory Enforcement Tracker
Confirmed fines and enforcement actions under all eight frameworks, plus NIS2 transposition status by member state and the authority responsible in each one.
Open the tracker →
When is it due?
EU Compliance Deadlines 2026 to 2028
Every date we have covered, from the AI Act transparency obligations to CBAM certificate sales, marked where the date still depends on publication in the Official Journal.
See the deadlines →
Does this even apply to us?
Sector, size and turnover run against the thresholds in the Directive, so you can see whether you are likely essential, important or out of scope before you read the transposition law.
Run the check →
Why the source link sits next to the claim
Eight frameworks across twenty-seven member states produce guidance, delegated acts, transposition laws, enforcement decisions and court referrals faster than a small publication follows by hand. RegDossier does that reading with AI, working from the Official Journal, EUR-Lex, the Commission, the European supervisory authorities and the national regulators.
Language models get dates, article numbers and penalty tiers wrong, and they get them wrong confidently. That is the whole reason the link sits beside the figure rather than in a list at the bottom. Nothing here asks for your trust. It asks for one click, and in return it tells you which forty pages of the Regulation are the ones that belong to you.
- Primary sources only for anything that bites. Dates, thresholds, penalties and liability come from the Official Journal, the national gazette or the competent authority. Not from a law firm briefing.
- Where the source is silent, the page says so. A missing national figure is marked as not published. It is never filled in from the Directive or borrowed from another member state.
- Where sources disagree, both stay on the page. We would rather show you the conflict than pick the tidier answer.
- Corrections are dated and left visible. Send an error to info@regdossier.eu and the fix carries a note saying what changed, including on pages old enough that nobody would go back and check.
- Where our text and the Official Journal disagree, the Official Journal governs. Treat this as an index to the regulation, not a substitute for opening it.
- Directory listings are free and editorial. A firm gets in because it does the work and says so on its own site, not because it paid. Where a listing is promoted, the page says so on the listing itself.
How RegDossier is produced, including what it does not check.
Take the data and use it
If you publish country overviews, they go stale within a quarter, and rewriting one every time a member state moves a deadline is nobody’s idea of a good afternoon. If a figure here saves you that work, take it.
The enforcement tracker and the deadline tracker are published under a Creative Commons Attribution 4.0 licence. Use them in a client alert, a slide, an article or a member briefing. The only condition is that you name where it came from and link back, so your reader can check it the same way you did.
Source: RegDossier, EU Regulatory Enforcement Tracker, https://regdossier.eu/eu-enforcement-tracker/ (CC BY 4.0)
Journalists and researchers who need a figure verified against a specific document, or who want the underlying table as a file, can write to info@regdossier.eu.
The eight frameworks
Each has its own scope test, its own timetable and its own penalty ceiling. The AI Act moved its high-risk deadline to 2 December 2027. Most pages online still say 2 August 2026.
Sustainability
Corporate Sustainability Reporting. Who must report, what to report, ESRS standards, supply chain effects.
Cybersecurity
Network and Information Security Directive. Scope, incident reporting, management liability, member state transposition.
Artificial Intelligence
Risk categories, high-risk obligations, AI literacy requirements, Digital Omnibus amendments.
Financial Resilience
Digital Operational Resilience Act. ICT risk management, incident reporting, third-party oversight for financial entities.
Carbon and Trade
Carbon Border Adjustment Mechanism. Reporting obligations for importers of iron, steel, cement, aluminium and fertilisers.
Product Security
Cyber Resilience Act. Mandatory cybersecurity requirements for products with digital elements.
Data Protection
Enforcement trends, new fines, regulatory guidance updates, Digital Omnibus implications.
Supply Chain
EU Deforestation Regulation. Due diligence obligations, product scope, implementation timeline shifts.
Eight free tools that run the thresholds for you
No sign-up, nothing stored, answer on screen in three minutes.
NIS2 Applicability Checker →
Essential, important or out of scope.
AI Act Fine Calculator →
Exposure by violation type under Article 99.
AI Act Risk Classifier →
Where your system sits against Annex III.
DORA ICT Risk Assessment →
A quick read on your ICT risk position.
Regulation Comparison Matrix →
Eight frameworks side by side.
Implementation Cost Estimator →
A budget range before you brief a vendor.
AI Act Readiness Check →
Three minutes on where you stand.
Compliance Deadline Tracker →
Every date from 2026 to 2028.
Who this is built for
You run compliance at a company of fifty to a thousand people. You are not a regulatory lawyer, you have a day job besides this, and three or four of these frameworks are yours whether or not anyone gave you the headcount for them. Consultants and advisers who serve that person, and journalists who need a figure they can attribute, are welcome to everything here too.
And the firms on the other side of that: the consultancies, auditors and assessors who do this work, who are spread across hundreds of separate sites with no way for a buyer to compare them.
RegDossier is a publication, not a consultancy. No law firm behind it, no legal advice, no compliance software to sell you. Where a sponsorship or an affiliate link appears, the page says so.
The month in bullets
Once a month. What changed across the eight frameworks, with the source on every line, and what falls due in the next ninety days. No commentary.
One email a month. Unsubscribe with one click.
RegDossier provides regulatory intelligence for informational purposes only. Content does not constitute legal advice. EU regulations are subject to member state transposition and interpretation. Consult qualified professionals for your specific situation.