The European legal framework is not limited to the General Data Protection Regulation. Companies operating in the internal market face a regulatory stack where sector-specific directives, directly applicable regulations, and national transpositions coexist, sometimes with timelines staggered by several years between member states.
CSDDD Due Diligence: A Three-Wave Timeline Most Guides Omit
The Directive (EU) 2024/1760 on sustainability due diligence (CSDDD, also referred to as CS3D) adopted on June 13, 2024, structures its obligations according to three successive tiers. We recommend that legal departments map their position in this timeline now.
- In 2027, EU companies with more than 5,000 employees and €1.5 billion in global net revenue fall under its scope.
- In 2028, the threshold drops to 3,000 employees and €900 million in revenue.
- In 2029, any company with more than 1,000 employees and €450 million is affected, including certain companies from third countries generating this amount in the EU.
The scope has been narrowed by amendments made after the initial adoption. The obligations cover the entire value chain, which implies an audit of second-tier suppliers and beyond. Member states must transpose the directive between 2026 and 2027 according to the consolidated versions.
In practice, a company below the 2027 threshold may fall within the scope in 2028 after an acquisition. Monitoring the thresholds must be continuous, not sporadic. The resources available on the Europe Enterprises legal site allow for tracking the evolution of ongoing national transpositions.
European Company Law: Freedom of Establishment and Cross-Border Legal Forms
Article 49 and Article 54 of the Treaty on the Functioning of the European Union (TFEU) establish the freedom of establishment for companies within the internal market. This foundation remains underutilized by SMEs, which continue to create traditional national subsidiaries without examining unified legal forms.
The Societas Europaea (SE) allows for the establishment of a European law company operating in multiple member states under a single status. The directive on cross-border mergers, revised in recent years, facilitates restructuring between entities located in different EU countries.
The European Commission is pursuing the digitization of company formation procedures. Interconnected commercial registers through the BRIS (Business Registers Interconnection System) provide centralized access to information on companies registered in member states. This interconnection reduces verification times during cross-border operations.
Directive on Shareholder Rights and Governance
The Shareholder Rights Directive (SRD II) imposes transparency obligations on listed companies regarding executive remuneration policies and transactions with related parties. Institutional investors must publish their shareholder engagement policy.
We observe that unlisted companies often neglect these governance standards, while a buyer or fund will conduct a compliance audit based on these same requirements during due diligence.
Regulatory Cybersecurity: NIS 2 and Cyber Resilience Act
The cybersecurity aspect of European business law has significantly strengthened. The NIS 2 Directive expands the scope of entities subject to incident notification and risk management obligations. The Cyber Resilience Act imposes security requirements by design for products containing digital elements placed on the European market.
For a company marketing connected devices or software, ignoring the Cyber Resilience Act means risking market withdrawal. The penalties under NIS 2 can reach a significant percentage of global revenue, depending on the entity’s category (large or very large).
Interaction Between Sectoral Regulations and Common Law
The overlap between GDPR, NIS 2, and the Cyber Resilience Act creates areas of intersection. A personal data breach simultaneously triggers a GDPR notification (72 hours) and, if the entity is covered by NIS 2, an additional notification to the competent cybersecurity authority.
Centralizing incident management in a single unit avoids duplications and inconsistent notification timelines between the two regimes. The GDPR processing register and the mapping of NIS 2 information systems should be built on a common reference framework.
Multijurisdictional Compliance: Structuring Legal Monitoring in the Company
European law sets the baseline. National transpositions add specific layers, sometimes contradictory between member states during transitional periods. France, Germany, and the Netherlands rarely transpose at the same pace or with the same regulatory options.
We recommend maintaining a tracking table by directive, crossing the state of transposition in each jurisdiction where the group operates. This table should be updated at least quarterly and include ongoing bills, not just adopted texts.
- Identify the directives requiring mandatory transposition that affect the business (CSDDD, NIS 2, SRD II, directive on cross-border mergers).
- Map the national options chosen by each relevant member state.
- Anticipate timing discrepancies between countries, which can create asymmetric obligations within the same group.
The regulatory complexity in Europe will not diminish. Companies that structure their legal monitoring in advance absorb new obligations without operational disruption, whereas those that react after the publication of texts incur significantly higher compliance costs.
