EU Legislation Roundup: September 2026

Over the last month

Several converging pressures are now facing global businesses. The Cyber Resilience Act (CRA) reporting obligations are already live, the reformed customs framework entered into force and a major pharmaceutical overhaul will soon follow. Meanwhile, the Commission is extending its regulatory reach into new territory, from youth online safety to wider carbon import obligations.

At the same time, a cluster of proposals around procurement, innovation and labour mobility signals a broader shift. The EU is using regulation not just to manage risk, but to steer investment.

For in-house teams, this means staying proactive. Several items already require action, with CRA reporting mandatory and the Empowering Consumers for the Green Transition (ECGT) Directive now applying. Potential expansion of the Carbon Border Adjustment Mechanism (CBAM) calls for early supply chain mapping. Aligning sourcing and investment strategies with this evolving landscape remains equally important.

***

Digital & Technology

KIDS Act: under-15s face social media age limits – new proposal

On September 17, 2026, the Commission proposed the KIDS Act. The proposal would ban social media for children under 13 and set 15 as the EU-wide minimum age for personal accounts. Children aged 13 to 14 could use parent-managed mini accounts with limited features. Beyond social media, the proposal covers video-sharing platforms, online games, app stores, AI companions and chatbots. Platforms would need to demonstrate online child safety through age verification and age assurance. The proposal would also ban addictive design features, including infinite scroll and reward tricks. Push notifications during sleeping hours would be prohibited, and AI companions would be off by default.

Why this matters: Once adopted, the proposal would impose binding age limits and safety-by-design duties across the EU. Providers based outside the EU offering services to EU users would also be caught. App developers would be affected through mandatory app store age ratings. Negotiations will likely focus on the age thresholds, the privacy-preserving verification, scope beyond social media and addictive design timelines features. They are expected through 2027, with adoption unlikely before 2028.

Cyber Resilience Act: manufacturers face 24-hour vulnerability reporting – in effect since 11 Sept. 2026

As of September 11, 2026, the CRA reached a key implementation milestone. Manufacturers must report actively exploited vulnerabilities and severe incidents affecting product security. Early warnings are due within 24 hours, full notifications within 72 hours, and final reports within one month or once fixes are available. All reports must go through the Single Reporting Platform (SRP), the centralised reporting channel. These obligations apply to all products with digital elements made available in the EU.

Why this matters: The reporting obligations are now live, creating immediate compliance pressure for manufacturers of connected products. They affect any business placing products with digital elements on the EU market, including component and software suppliers. Security, product, legal and supplier teams need to assign ownership for 24-hour early warnings, 72-hour notifications and final reports. The following step is registering for the SRP. Escalation routes with the relevant Computer Security Incident Response Team (CSIRT) and the European Union Agency for Cybersecurity (ENISA) also need testing. Incident playbooks and contracts should distinguish CRA reporting from NIS2 Directive duties, which apply in parallel.

Health & Life Sciences

Pharmaceutical package: new exclusivity and supply rules – adopted – applies from 2029

On September 28, 2026, the Council adopted the EU pharmaceutical package. It restructures data protection and market exclusivity periods, with a combined cap of eleven or twelve years for new medicines. A transferrable exclusivity voucher also incentivises development of priority antibiotics to combat antimicrobial resistance. Separately, orphan medicines for rare conditions will receive up to eleven years of market exclusivity. The package strengthens supply-chain obligations and gives EU countries power to require sufficient supply of protected medicines. 

Why this matters: The package will reshape how pharmaceutical businesses bring medicines to market across the EU. Originator pharmaceutical companies, generics and biosimilars manufacturers, and suppliers supporting medicines are all affected. The changes carry direct implications for commercial and IP strategy, particularly around pipeline timelines and launch planning. Originators should model exclusivity and voucher effects against pipeline and launch plans, while generic and biosimilar manufacturers need to revisit entry assumptions.

Competition, Trade & Customs

Customs reform: new EU authority and data hub for traders – adopted – applies from 2028

On September 20, 2026, the reform of the Union Customs Code took effect. It introduces a new EU Customs Code, a new EU Customs Authority and an EU Customs Data Hub. Together, these measures aim to modernise customs procedures and reduce administrative burdens. They also give authorities better visibility over supply chains. The reform strengthens customs risk management through more data-driven supervision. It introduces Trust & Check trader arrangements for compliant operators. 

Why this matters: Importers, exporters, e-commerce platforms, logistics providers and customs intermediaries will be affected as the new framework is rolled out. Platforms selling non-EU goods may face a more direct customs role. Preparations should include addressing gaps in product and supply-chain records and reviewing potential impacts on fulfilment or pricing models. Importers and logistics providers will need to plan for new data requirements as the Data Hub phases in. Voluntary use will begin in 2032, becoming mandatory from 2037. The EU Customs Authority is expected to become operational in 2028.

Defence & Security

Defence Omnibus: faster permits and procurement – in negotiation 

On September 16, 2026, the Parliament adopted its position on the Defence Readiness Omnibus package. Linked to the ReArm Europe Plan, the package aims to accelerate defence investment, permit granting, procurement, and intra-EU product transfers. The package targets up to EUR 800 billion in defence spending over four years. It includes increased support for SMEs and strengthened European Defence Fund implementation.

Why this matters: Defence manufacturers, SMEs, investors and suppliers involved in EU procurement or intra-EU transfers would be affected. Mapping affected projects and assessing potential changes to timing or support eligibility is essential to prepare. Key negotiation issues include approval speed, transfer safeguards and smaller suppliers’ access to funding. An agreement on the package is expected by late 2026 or early 2027, with adoption to follow.

Consumer & Products

Green claims: tighter rules for consumer-facing businesses – in effect since 27 Sept. 2026

• Previously covered: EU Legislation Roundup: March 2026

As of September 27, 2026, the Empowering Consumers for the Green Transition (ECGT) Directive, also known as EmpCo Directive, fully applies. It amends EU consumer law to address misleading environmental claims and marketing practices. Generic claims such as “green”, “eco-friendly” or “carbon neutral” based on offsets are now banned unless properly substantiated. Sustainability labels are only permitted where based on independent third-party certification schemes. The ECGT introduces new requirements on how durability, repairability and software updates are communicated to consumers.

Why this matters: The new rules reach any business making environmental or sustainability claims to EU consumers, including non-EU online sellers in the EU market. While most Member States missed the transposition deadline, the compliance requirements are now fully applicable. Marketing, product and compliance teams may need to review consumer-facing environmental claims, packaging, websites and sustainability labels against the new bans. Claims about future environmental performance require an underlying implementation plan verified by an independent third party. 

Corporate & Commercial

Public procurement: single EU rulebook and European preference in tenders – new proposal 

On September 9, 2026, the Commission proposed a Public Procurement Act consolidating three existing directives into a single, directly applicable regulation. The proposal simplifies procurement procedures while strengthening strategic criteria, including security, resilience, environmental, social, and innovation considerations. It also introduces European preference criteria in line with EU international commitments.

Why this matters: The proposal could reshape how public contracts and concessions are awarded across the EU. It is relevant to businesses bidding for public contracts, subcontractors and suppliers to public-sector customers. Discussions will likely focus on the criteria conditions, especially on the European preference. Negotiations are expected to start over 2027 and adoption no earlier than 2029. 

Energy & Climate

EU Emissions Trading System: allowance rules to change – in negotiation 

• Previously covered: EU Legislation Roundup: June 2026

On September 23, 2026, the Council agreed on a targeted amendment to the market stability reserve (MSR). The MSR adjusts allowance supply under the EU Emissions Trading System (ETS) to correct carbon market imbalances. This proposal aims to make the EU carbon market more liquid and predictable over the long term. Under the Council’s position, allowances above the current 400 million invalidation threshold would not be cancelled until the end of 2030. From January 1, 2031, that threshold would double to 800 million allowances. 

Why this matters: Energy-intensive manufacturers, fuel suppliers, utilities and other operators exposed to EU carbon prices will be affected if the changes are adopted. The amendment could shift allowance availability and carbon price expectations under the EU ETS. Revisiting carbon-cost forecasts, allowance strategies and hedging assumptions will help businesses prepare timely. Cross-team alignment on these assumptions should support 2027 budget planning. Negotiations focus on market liquidity, the size and timing of the reserve and how quickly any revised thresholds should change. They are expected to be concluded by end of 2026, with adoption likely by Q1 2027. 

CBAM: scope expansion to downstream goods – in negotiation 

• Previously covered: EU Legislation Roundup: June 2026

On September 15, 2026, the Parliament adopted its position on proposed CBAM changes. The text supports extending CBAM to downstream goods containing steel and aluminium, alongside tougher anti-circumvention rules and a temporary decarbonisation fund. The fund would support EU producers exposed to carbon costs in export markets. Importers would need to account for embedded emissions and CBAM certificates.

Why this matters: The expanded scope would bring finished goods with CBAM-covered inputs under the mechanism for the first time. That change is relevant to importers of finished goods containing steel or aluminium, industrial exporters and carbon-intensive supply chains. Preparations include mapping affected finished goods, gathering supplier emissions data and modelling certificate and pricing exposure. Exporters should also explore potential support from the proposed decarbonisation fund. Negotiations are under way; an agreement is targeted by end of 2026, though scope and anti-circumvention details may push it into early 2027.

Employment & Social

Fair labour mobility package – new proposal 

On September 15, 2026, the Commission proposed the Fair Labour Mobility Package, comprising a Communication and five legislative proposals. The package aims to simplify cross-border employment by digitalising social security and improving skills recognition. Central to the proposal is a European Social Security Pass (ESSPASS) for digital cross-border document verification. ESSPASS would cover social security documents, including the European Health Insurance Card. The package would also integrate the EU Digital Identity Wallet into cross-border services. It rounds out with a Skills Portability Act and stronger powers for the European Labour Authority.

Why this matters: The package is relevant to any business posting workers, recruiting across borders, or operating in regulated professions. It could change how employers verify credentials and manage social security documentation, once approved. Discussions might focus on data governance, employer responsibilities, enforcement powers and the pace of mutual recognition for qualifications. Negotiations are expected to start in 2027, with adoption no earlier than 2028.

Co-authored by Uendi Barreti and Paola Paccani (Knowledge)

Further reading

EU WEEE Directive Reform: Tighter Rules, Rising Costs

EU Cyber Resilience Act: Single Reporting Platform Goes Live

EU CRA Reporting Obligations - Mini Guide

EU Cyber Resilience Act Reporting Starts September 11 | Eversheds Sutherland posted on the topic | LinkedIn

Executive Compliance Guide: Cyber Resilience Act | Navigating EU Law

EU: Empowering Consumers for the Green Transition Directive

EU KIDS Act to restrict social media platforms’ access to children in the EU | Shaping Europe’s digital future

EU Sustainability Omnibus Package: key changes and implications for businesses

Germany: regulator publishes draft determination for electricity grid charges from 2029 (AgNes)

Revision of the EU emissions trading system and the market stability reserve | Think Tank | European Parliament

Origin Labelling, “Made in the EU” Claims and Fragmented Global Supply Chains | Think Tank | European Parliament

Omnibus V – Defence readiness | Think Tank | European Parliament

EU: Proposed KIDS Act Targets Online Child Safety

Flash update: EU KIDS Act proposals | Eversheds Sutherland