Dazr Compliance newsShort, sourced updates on EU and national rules for cybersecurity, privacy, AI and operational resilience: what changed, what comes next and when.https://compliance.dazr.eu/news2026-10-29T00:00:00ZDazrhttps://dazr.eu/Digital Omnibus: the Council's position on GDPR and cookieshttps://compliance.dazr.eu/news/digital-omnibus-council-position-gdpr-cookies2026-10-29T00:00:00Z2026-10-29T00:00:00ZDazrOn 21 October 2026 EU ambassadors agreed the Council's mandate on the Digital Omnibus: breach reporting, personal data, cookies, incident reporting.Italy NIS2: basic security measures due in October 2026https://compliance.dazr.eu/news/italy-nis-basic-measures-october-20262026-10-22T00:00:00Z2026-10-22T00:00:00ZDazrEntities on Italy's 2025 NIS list have 18 months to adopt ACN's basic security measures, ending in October 2026. Those listed in 2026 have until July 2027.GDPR enforcement in 2026: large fines and new procedureshttps://compliance.dazr.eu/news/gdpr-enforcement-autumn-20262026-10-19T00:00:00Z2026-10-29T00:00:00ZDazrGoogle fined EUR 403 million over location data, faster cross-border procedures from April 2027, and GDPR changes that are still only proposals.NIS2 in October 2026: where transposition standshttps://compliance.dazr.eu/news/nis2-transposition-october-20262026-10-19T00:00:00Z2026-10-29T00:00:00ZDazrTwo years after the deadline, four Member States are before the EU Court of Justice, while Germany, the Netherlands and Austria now apply NIS2 laws.AI Act after the Digital Omnibus: the new dateshttps://compliance.dazr.eu/news/ai-act-digital-omnibus-new-dates2026-10-19T00:00:00Z2026-10-19T00:00:00ZDazrRegulation (EU) 2026/1744 moved the AI Act's high-risk rules to December 2027 and August 2028. Transparency duties have applied since 2 August 2026.Austria: the NISG 2026 applies from 1 October 2026https://compliance.dazr.eu/news/austria-nisg-2026-in-force2026-10-19T00:00:00Z2026-10-19T00:00:00ZDazrAustria's NIS2 law has applied since 1 October 2026 to about 4,000 organisations. Registration, self-declaration and reporting deadlines at a glance.Cyber Resilience Act: reporting is live, the rest follows in 2027https://compliance.dazr.eu/news/cyber-resilience-act-reporting-live2026-10-19T00:00:00Z2026-10-19T00:00:00ZDazrSince 11 September 2026 manufacturers report exploited vulnerabilities and severe incidents to ENISA's platform. Full CRA rules apply on 11 December 2027.Data Act: new duties for connected products, free cloud switching nexthttps://compliance.dazr.eu/news/data-act-connected-products-switching2026-10-19T00:00:00Z2026-10-19T00:00:00ZDazrThe Data Act has applied since 12 September 2025. Design duties for connected products followed in 2026; cloud switching charges end on 12 January 2027.DORA: the first critical ICT providers are designatedhttps://compliance.dazr.eu/news/dora-critical-ict-providers-designated2026-10-19T00:00:00Z2026-10-19T00:00:00ZDazrThe ESAs designated 19 critical ICT third-party providers under DORA, now under direct EU oversight. What it means for financial entities and suppliers.