Legal Order
The EU instruments that frame the function, their legal nature and the authorities that supervise them.
The compliance function operates within a layered legal order. Understanding the nature of each instrument tells the organisation where its obligations come from and which text to read:
regulations: directly applicable in every Member State, without transposition, although national laws may complement them where the regulation allows;
directives: binding as to the result, but transposed by each Member State into national law, which is the text that creates obligations for organisations;
delegated and implementing acts: adopted by the Commission to specify technical details, such as reporting templates or security requirements;
guidelines and supervisory practice: issued by EU bodies such as the EDPB or the European Supervisory Authorities, they are not legislation but shape how the rules are interpreted and enforced.
Above them, the Charter of Fundamental Rights of the European Union, including the right to the protection of personal data, frames how all of these rules are applied.
Data protection: GDPR, Regulation (EU) 2016/679, a regulation; consistency ensured by the EDPB and enforcement by national authorities;
Cybersecurity: NIS2, Directive (EU) 2022/2555, a directive; ENISA supports, national authorities enforce;
Digital operational resilience: DORA, Regulation (EU) 2022/2554, a regulation; national competent authorities and the ESAs;
Artificial intelligence: AI Act, Regulation (EU) 2024/1689, amended by Regulation (EU) 2026/1744; the AI Office and national market surveillance authorities;
Whistleblower protection: Directive (EU) 2019/1937, a directive; national authorities;
Anti-money laundering: Regulation (EU) 2024/1624 and Directive (EU) 2024/1640; AMLA and national supervisors;
Anti-corruption: Directive (EU) 2026/1021, a directive to be transposed by June 2028; national authorities;
Sustainability: CSRD, Directive (EU) 2022/2464, and CSDDD, Directive (EU) 2024/1760, both amended by Directive (EU) 2026/470; national authorities;
Pay transparency: Directive (EU) 2023/970, a directive; national equality bodies and labour authorities;
Digital services and markets: DSA, Regulation (EU) 2022/2065, and DMA, Regulation (EU) 2022/1925; the European Commission and national Digital Services Coordinators.
The status of each instrument is detailed in Regulation and national transposition, and the supervisors in Authorities.
The authentic texts of EU law are published in the Official Journal and available on EUR-Lex. National transposing laws are published in each Member State's official gazette.
The information is indicative and reflects the situation in October 2026. EU instruments and their national transposition evolve and should be confirmed with the competent authorities.