Legal Update for Businesses in Europe: September 2026

The status of legislation and legislative proposals is current as of 16 September 2026. This issue covers changes since 14 August 2026 and deadlines running until mid-December.

No unnecessary legal theory. For each change, you will learn who it affects, what your deadline is, and what specifically to do.

From 11 September, you must report exploited vulnerabilities within 24 hours, even for old products

This is the toughest new development in this entire issue, and it has been in effect for five days. The Cyber Resilience Act (CRA) has its first truly enforceable deadline, which companies had not expected until the end of 2027.

Who it affects. Manufacturers of products with digital elements placed on the EU market. This is a broad category: enterprise software, standalone applications, operating systems, network devices, IoT hardware, and industrial control units. You are also considered a manufacturer if you put your name or brand on another's product.

What you must report and within what deadlines. Two things: an actively exploited vulnerability in your product and a severe incident affecting its security. The cascade has three stages – an early warning without undue delay, no later than 24 hours from the moment you become aware of the matter. A more detailed notification within 72 hours. A final report within 14 days from when a corrective measure is available, or for severe incidents, within one month of the 72-hour notification. You submit a single report via a unified platform that ENISA launched on the same day; it directs them to the relevant national CSIRT team and to ENISA, so you do not send two separate submissions. In addition, you must inform the affected users and, where appropriate, all users.

Two things that are most often confused. The obligation also applies to products placed on the market long before 2026 – the decisive factor is when you learned of the active exploitation. However, according to the final interpretation by the European Commission, you do not have to retroactively report exploitation you were aware of before 11 September. And the trigger is not every bug: it must be an active exploitation or a severe impact. This is the first operational decision you must have clarified in advance, not on the day of the incident.

The rest of the regulation – essential security requirements and CE marking – will not apply until 11 December 2027. Stewards of open source software are also required to report only from this date. Penalties under Art. 64 can reach EUR 15 million or 2.5% of total worldwide turnover. The Commission has published details on reporting on the page on reporting obligations under the CRA.

What to do this week. Determine who in the company will decide that it is an active exploitation and who will submit the report – including backup for weekends, as the 24-hour deadline does not run on business days. Register on the ENISA platform in advance; registering on the day of the incident will eat up your deadline. Review contracts with component suppliers and add an obligation to notify you of any exploitation immediately, otherwise you will learn about it too late. And set up an early warning template so you are not dealing with formatting on day one.

From 9 December, a new product liability regime applies to newly placed software

The second fundamental change is aimed at everyone who sells tangible goods, software, or both in the EU. Directive (EU) 2024/2853 on liability for defective products must be implemented in all Member States by 9 December 2026, replacing the 1985 regulation.

What is changing the most. Software is now explicitly a product – both standalone and embedded, including artificial intelligence systems and digital manufacturing files. Liability is strict, i.e., regardless of fault. The circle of liable persons is expanding to include software providers, online platform operators, fulfilment services, and companies that refurbish products. Compensation now also covers the destruction or corruption of data and medically recognised psychological harm. The previous lower threshold for damages and the upper liability limit are being abolished. And a court can order the disclosure of evidence, which changes the procedural position of the defendant.

The key date is often cited incorrectly in overviews. The original text of the directive stated that it would apply to products placed on the market after 9 December 2026. A corrigendum published on 7 May 2026 corrected this: the decisive factor is placing on the market or putting into service after 8 December 2026, so the new regime applies to products placed on the market from 9 December onwards. Many publications still repeat the uncorrected version, shifting the deadline by a day. The 1985 regulation will continue to apply to older products, even though it will be formally repealed – the two regimes will run side by side, for as long as ten years for long-life products. Free and open-source software developed or supplied outside of a commercial activity is exempt.

And one legal nuance that matters. This is a directive, not a regulation. The effects depend on national transposition, and a state that fails to meet the deadline does not in itself create liability for one private company towards another. Moreover, transposition varies significantly across states. As of the closing date, Hungary, which passed its law in December 2025, Croatia since July 2026, and Lithuania, whose law enters into force on 9 December 2026, have completed it. Roughly a third of the states have published drafts, and despite the requirement for full harmonisation, they are interpreted differently. Germany submitted a draft in September 2025, France anticipates a significant delay, and until then, its courts are expected to interpret existing regulations in light of the new directive. In the Czech Republic, liability for a defective product is in the Civil Code – the separate Act No. 59/1998 Coll. was repealed as of 31 December 2013.

What to do by the end of November. Identify which products you will place on the market from 9 December and separate them in your documentation from older versions – this will determine which regime applies. Review the limitations of liability in your terms and conditions and licenses; you cannot contractually waive strict liability for a defective product, and any clause that attempts to do so is ineffective in this part. Check with your insurer whether your liability insurance covers data damage and the new scope of liable persons. And negotiate recourse with your software component suppliers.

By 27 September, you must remove unsubstantiated environmental claims from labels

Eleven days remain. From 27 September 2026, Member States must begin applying the rules adopted to transpose Directive (EU) 2024/825 on empowering consumers for the green transition. Do not confuse it with the separately debated proposal for a directive on green claims, which has not yet been adopted. There is no transition period, and the regulations being amended are already in national law – on unfair commercial practices and consumer rights.

Generic environmental claims such as "eco-friendly," "nature-friendly," or "green" are prohibited unless you can demonstrate recognised excellent environmental performance relevant to the claim. Claims of a product's climate neutrality based on offsetting emissions outside the value chain – typically "carbon neutral" based on offsets – are also banned. An important clarification applies to sustainability labels: a label is not banned because it is private, but because it is not based on a certification scheme with independent third-party verification or was not established by a public authority. A self-certified label without such a system is a problem. You, as the trader, are responsible for it, even if someone else issued it.

By 27 September, review your packaging, labels, e-shop, and catalogues, and for each claim, document what it relates to and what supports it. Remove anything you cannot substantiate. Start with formulations like "carbon neutral" – those are the first to go. And don't forget the language versions of your e-shop; you need substantiation for every market where you use the claim.

Your Dutch subsidiary will become more expensive twice over starting in January

On 15 September, the government presented the tax package for 2027, and it contains two unpleasant items for employers. We will preface this with what matters most: these are still proposals. They will only become final after approval by both chambers and publication in the Staatsblad, usually in December. Until then, the amounts and dates may change.

The first item is already in the law and will not change. The tax benefit for foreign workers, the so-called 30% ruling, will decrease for new cases from 2027 to 27%, and the salary thresholds for eligibility will increase. If you are seconding people to the Netherlands or hiring foreigners there, calculate the net salary according to the new rate before you sign an offer effective from January.

The other items are proposals and will decide the budget for next year. The energy investment deduction is set to increase from 40% to 45% from 1 January 2027. The innovation box for small and medium-sized enterprises is to be expanded from EUR 25,000 to EUR 100,000, so the tax benefit will apply to a larger portion of innovation profits. The real estate transfer tax rate for buyers who will not live in the property themselves is being reduced from 8% to 7% – the official material does not mention a restriction to natural persons, so for investment purchases, verify this against the final text. And for incomes from EUR 137,800, the tax advantage for pension building is to be limited for six years, which affects management packages.

And don't forget the deadline that is approaching faster. The Dutch rebuttable presumption of an employment relationship for low hourly rates comes into effect on 31 December 2026. The decisive threshold is below EUR 38 per hour; the basic amount in the law is EUR 36 with indexation, and the applicable amount for the first application will be set by ministerial regulation. However, also check contractors just above the threshold – it is not a ceiling, and a disguised employment relationship can exist above it too. You have fifteen weeks to restructure your cooperation model.

In France, invoicing outside an approved platform will no longer be accepted

From 1 September 2026, businesses established in France that fall within the scope of the reform must be able to receive an electronic invoice. This applies regardless of size, including micro-enterprises. On the same day, large enterprises and businesses with 250 to 4,999 employees began issuing invoices and transmitting transaction and payment data to the tax authority. The regime is therefore no longer in preparation, but fully live.

If you missed the deadline, address two things at once. Enter into a contract with an approved platform and simultaneously agree with your French customers on a transitional arrangement until the connection is complete. The French tax authority points out the opposite of what is commonly claimed: a customer should not refuse to process or pay an invoice just because it is not electronic, if the supplier does not yet have the obligation to issue one.

Establishment is the deciding factor, not just a VAT registration number. Do you have a permanent establishment or a subsidiary in France? The full scope applies to you. Do you only have a French VAT number without a permanent establishment? Electronic invoicing does not apply to you at all, but data transmission to the tax authority does – and this applies where you carry out transactions considered to be located in France, for which you are obliged to pay French VAT.

This is a common point of error, as there is not just one deadline. According to the French tax authority, the obligation to transmit data for non-established businesses comes in three waves. From 1 September 2026 for large enterprises and businesses with 250 to 4,999 employees, if they are the seller or service provider. From 1 September 2027 for micro-enterprises and small and medium-sized enterprises in the same role. And from 1 September 2027 for businesses in the position of the acquirer or recipient obliged to pay VAT, i.e., for reverse charge and intra-Community acquisitions of goods, regardless of size. You must conclude a contract with an approved platform before the date on which your obligation arises.

A pitfall that almost everyone overlooks. The size of the enterprise is assessed as of 1 January 2025 based on the last accounting period closed before this date – and the decisive factor is the total turnover achieved in France and abroad, not just the French part. A Czech company with a turnover of over EUR 50 million can thus easily find itself outside the category of small and medium-sized enterprises and fall into the wave that has been running since this September. On the other hand, transactions exempt from VAT, typically exports and intra-Community supplies, are excluded.

In Slovakia, the new commercial register has been running for a month and the first entries are already being made under it

Act No. 29/2026 Coll. on the Commercial Register has been effective since 17 August 2026 and has replaced the 2003 regulation. Anyone who did not complete their registration by 16 August is now following the new rules.

We remind you of what has changed, as it now affects every transaction. For specified documents, a notarial deed or a contract authorised by a lawyer is required – for the founding document when establishing any legal form of company, for a contract on the transfer of a business share, for a decision to increase or decrease the share capital if the ratio of shares changes, for amendments to the articles of association and statutes, and for an approved project of a cross-border transformation or change of legal form. The qualified form does not automatically apply to other registered changes; for these, you should verify the requirements based on the type of entry.

The deadline for registering a cross-border transformation has been shortened from 21 days to 5 working days. You can only be represented for registration by a lawyer, a notary, or your own employee. The ban on the chaining of single-member companies and the limit of three single-member LLCs per one natural person have been abolished. And the fine for a statutory director for failing to register required data or file documents in the collection of deeds has increased from EUR 3,310 to EUR 4,000, and it can be imposed repeatedly.

If you are planning to transfer a share in a Slovak subsidiary by the end of the year, factor in an appointment with a notary or lawyer and higher transaction costs in your schedule. For cross-border transformations, recalculate your closing checklist for the five-day deadline.

Hungarian receipt reporting has been running since 1 September with a three-day deadline

As of 1 September 2026, anyone in Hungary who issues receipts manually from a pad or from their own software not connected to the tax authority is obliged to transmit receipt data within 3 calendar days of issuance. Those using a cash register connected to the tax authority or an e-cash register do nothing.

Two things are still being confused in communications. This is not an electronic invoicing obligation, but a requirement to report receipt data. And it is not each receipt that is reported separately, but aggregated daily data. The new feature is a uniform three-day deadline regardless of the VAT amount; previously, it was 4 days for receipts with VAT up to HUF 500,000 and 1 day above this threshold.

However, another date is more important for transaction preparation. The special Hungarian regime for screening foreign investments is only valid until 31 December 2026, while the new European regulation will not be applicable until 17 January 2028. If you are planning an acquisition of a Hungarian target with a signing in 2027, include a question in your due diligence about which approval regime the transaction will fall under – there is a gap between the two dates.

In Romania, notifications for pre-filled returns will resume on 30 September

For taxpayers under the cash accounting scheme, the sending of notifications for the Romanian pre-filled VAT return was suspended until 30 September 2026. After this date, expect them to resume, and thus the need to respond to notifications within the prescribed deadlines.

A shorter deadline continues to apply for invoicing: in the Romanian e-invoicing system, you send the invoice within 5 working days, previously it was 5 calendar days. The obligation also applies to invoices issued to foreign companies registered for Romanian VAT without a local permanent establishment.

And a hidden deal-breaker remains in effect for transactions. The transfer of shares in a company with tax arrears is effective against the tax authority only if you report it within 15 days and provide a guarantee for the arrears. Therefore, for an acquisition of a Romanian target, request a certificate of no tax arrears before signing.

Germany still lacks a pay transparency act, and waiting is not advisable

The transposition deadline for the European Pay Transparency Directive expired on 7 June 2026. Germany missed it and, as of the closing date, has not even published a reference draft of the law. The responsible ministry is finalising internal discussions after the submission of the expert commission's final report from November 2025, but the adoption date is not certain as of the closing date. The existing Entgelttransparenzgesetz from 2017 remains in effect unchanged.

However, the absence of a law does not mean the absence of risk. The Bundesarbeitsgericht (Federal Labour Court) confirmed pair comparison back in October 2025 – a single better-paid colleague in a comparable position establishes a presumption of wage discrimination. Moreover, for the public sector, the direct effect of those provisions of the directive that are sufficiently precise and unconditional may be relevant after the deadline has passed in vain.

Therefore, review the pay structures and job advertisements at your German subsidiary regardless of the missing law. How urgent this is depends on size. Employers with 150 or more employees will report for the first time by 7 June 2027, based on data for 2026 – the data you are collecting right now. Employers with 100 to 149 employees have their first report due by 7 June 2031. However, adding a salary range to job ads and removing questions about previous salary from the recruitment process applies regardless of size.

The second German issue to watch is the transposition of the new product liability regulation. The German draft has been on the table since September 2025 and expands liability to software providers, platform operators, and companies that refurbish products. If you supply software or a connected device to Germany, this is more relevant to you than the pay agenda.

Poland will launch sanctions in the KSeF system right in January

Electronic invoicing via the Polish KSeF system is mandatory for issuance from 1 February 2026 for taxpayers with a turnover exceeding PLN 200 million, and from 1 April 2026 for others. Everyone must be able to receive invoices from 1 February 2026. The smallest taxpayers have an exemption until the end of 2026: if the total value of their sales documented by invoices does not exceed PLN 10,000 in a month, they can continue to issue them electronically or on paper outside the system. From 1 January 2027, this exemption is also lifted.

Three things will change at once from January. Sanctions for failing to issue an invoice in the system will be introduced, up to 100% of the VAT amount shown on an invoice issued outside KSeF; for an invoice with no tax shown, up to 18.7% of the total amount. They are not imposed automatically – the amount will be determined by a decision of the head of the tax office based on the circumstances of the specific violation. The obligation to include the KSeF identifier in the title of a bank transfer between active VAT payers begins; for payment of multiple invoices with a single transfer, a collective identifier generated by the system will be used. And the smallest taxpayers will also enter the system.

However, one widespread concern needs to be dispelled. An invoice issued outside KSeF in violation of the supplier's obligation does not deprive the recipient of the right to deduct VAT. The Polish tax administration states this explicitly: the right is assessed according to general substantive conditions, and the recipient is not obliged to verify whether the supplier issued the invoice correctly – such a requirement would be disproportionate and practically unenforceable. The violation is the issuer's responsibility, and financial sanctions apply exclusively to them. Nothing changes in this regard from January 2027; the only change is that sanctions against the supplier will begin to be imposed.

Therefore, by the end of the year, complete your KSeF integration, including a scenario for system unavailability, and confirm the identifier format directly with your Polish bank before setting up payment templates. For Polish suppliers who are using the ten-thousand zloty exemption this year, verify that they are ready for January – otherwise, their problem will end up in your accounting department.

In Spain, you have time for VeriFactu, but only until January

A reminder due to a common misconception: VeriFactu is not mandatory in Spain today. The deadlines were postponed by a year in December 2025. Corporate income taxpayers must have their invoicing systems adapted before 1 January 2027, and other affected persons before 1 July 2027.

However, the postponement does not apply to the technical standard. The Spanish regulation that introduces it is in effect and sets requirements for invoicing systems – immutability and traceability of records, cryptographic chaining, secure event logging, exclusion of double use, and a QR code. Software suppliers therefore already have obligations today; the deadline for you as a user has been moved.

Meanwhile, the second Spanish regime has moved forward. Mandatory B2B electronic invoicing under the Crea y Crece law now has an implementing regulation – Real Decreto 238/2026 of 25 March 2026, published in the BOE on 31 March 2026 and effective on the twentieth day after publication. However, the start of the deadlines is linked to a ministerial order on the public invoicing solution, which had not been issued as of the closing date. From its effective date, a 12-month period will run for businesses with a turnover of over EUR 8 million and 24 months for others. The draft order anticipates an effective date of 1 October 2026, which would mean deadlines of 1 October 2027 and 1 October 2028 – but the final dates will only be valid after the final version is published.

If you have a Spanish subsidiary with the legal form of a commercial company, you have less than four months until the January deadline for VeriFactu. Request written confirmation of compliance and the implementation date from your invoicing software supplier. Keep both regimes as separate projects with different deadlines – anyone who combines them into one will either implement something that is not yet mandatory or miss what comes sooner.

Deadlines for companies to track until 15 December 2026

• 27 Sep 2026 – entire EU: start of application of rules for the transposition of the Directive on empowering consumers for the green transition. Affects anyone using sustainability claims in the EU.

• 30 Sep 2026 – Romania: end of the suspension of notifications for the pre-filled VAT return for taxpayers under the cash accounting scheme.

• 1 Nov 2026 – entire EU: product identifiers become mandatory for imports under the distance selling regime.

• 1 Oct 2026 – Spain: expected effective date of the ministerial order from which the deadlines for mandatory B2B electronic invoicing will start to be calculated. The final version had not been published as of the closing date.

• 9 Dec 2026 – entire EU: deadline for the transposition of the new product liability regulation; the new rules will apply to products placed on the market from this day.

Just over the horizon, but requiring preparation this year: 31 December 2026, the Dutch presumption of an employment relationship and the end of the Hungarian special investment screening regime; 1 January 2027, Spanish VeriFactu for corporations, Polish sanctions in KSeF and the identifier in transfers, the Dutch reduction of the tax benefit to 27% and most measures from the Dutch tax package after parliamentary approval; 12 February 2027, national sanctions for the packaging regulation and the digital identifier for packaging; 7 June 2027, the first Italian pay report; 11 December 2027, full applicability of the Cyber Resilience Act.

Three things from September that cannot be postponed

First, set up your reporting process before you need it. The 24-hour deadline under the Cyber Resilience Act runs from the moment you learn of the exploitation – not from Monday morning. Without a designated responsible person, a pre-established registration with ENISA, and a prepared template, you will not meet it. And it also applies to products you sold years ago.

Second, the December deadline for product liability is not just a matter for lawyers. The decisive factor is when you place a specific product on the market. What you manage by 8 December falls under the old regulation; what you do from 9 December falls under the new, strict, and uncapped one. This cut-off was only corrected by the corrigendum of 7 May 2026, and many publications still state it a day differently. For year-end product plans, this is an argument for sales and development, not a footnote.

Third, distinguish between a proposal and an effective rule. The Dutch tax package from 15 September is still a set of proposals and will only be final after approval by both chambers, usually in December; the reduction of the tax benefit to 27%, on the other hand, is already in the law. In Spain, VeriFactu has been postponed to January 2027, and the deadlines for the second regime have not even started running yet. And in Poland, an invoice outside KSeF does not deprive the recipient of a VAT deduction – the sanctions are aimed at the issuer. Anyone who doesn't read this carefully will either invest before they have to or create a risk that doesn't exist.

That is why we regularly prepare legal news for companies in Europe for you. No unnecessary legal theory. With an emphasis on what the change means for your business and what needs to be done.

The lawyers at ARROWS law firm monitor developments in the Member States on an ongoing basis and, thanks to the ARROWS International network, verify local regulations directly with partners in the given jurisdiction – from reporting obligations for connected products and the form of Slovak transaction documents to Dutch contractors. For the maximum security of our clients, we are insured for professional liability with a limit of CZK 400,000,000. Do you need a map of obligations and deadlines for the specific countries where you have a subsidiary, employees, or suppliers? Write to consultation@arws.cz.