2025 is characterized by accompanying regulations: Sustainability, digital security, AI governance and data protection are the focus. Those who create risk-oriented structures in good time and digitally anchored compliance minimize sanctions and increase reputation.
Supply chain compliance & sustainability reporting
- The EU deforestation regulation will apply from 30 December 2025 – strict rules against illegal grubbing-up, and SMEs must also be careful.
- The battery regulation (obligation to take care from 18 August 2025) and the planned EU regulation against forced labour from 14 December 2027 extend the obligations.
- The CSRD (Corporate Sustainability Reporting Directive) is only gradually implemented – large capital market-oriented companies will follow later on from 2024, medium and small-scale companies.
EU digital law: AI‐Act, NIS‐2, DSA, product safety
- AI Act, NIS 2 (IT Security) and Data Act specifications require robust governance for AI systems and reliable data security.
- Since 13 December 2024, the General Product Safety Regulation (GPSR) applies – manufacturers and online retailers must provide comprehensive risk analysis and technical documentation.
- Since February 2024, the Digital Services Act (DSA) has imposed stricter content controls and transparency obligations for large platforms.
Data protection and IT security
- The data protection supervisory authority carries out a coordinated EU audit action ("CEF Action") on the right to erasure (Art. 17 GDPR) in 2025. Companies must adapt extinguishing concepts, observe deadlines and train employees.
- The Accessibility Strengthening Act requires accessible websites, apps and digital devices from 28 June 2025 – with exceptions for very small companies.
Export controls & sanctions
- The coalition agreement provides for simplification in foreign trade law, but at the same time brings more self-control and high fines if permits are used incorrectly.
Compliance Culture & Audit Practice
- Audits from 2024 show deficits in ESG implementation, digitisation of compliance processes, data analysis, training and cyber security guidelines.
- New rules on whistleblower protection and ethics strengthen the overall compliance culture.
Recommendations for action by companies
| Priority | Actions |
|---|---|
| Supply Chains & Reporting | Comprehensive Risk Analysis & Monitoring for Batteries, Deforestation, Forced Labour; CSRD preparation |
| Digital/KI/IT security | implement AI governance framework; Data management & IT protection according to NIS‐2; technical documentation (GPSR) |
| Data protection | Optimise extinguishing processes; Time-limit handling; Website/App accessibility |
| Training & Culture | Regular training (ESG, AI, data protection), robust whistleblower system |
| Continuous revision | Digital compliance tools & audits for early detection of deficits |
Overview of developments in compliance law 2025