An EU regulation is a binding legislative act of the European Union that applies in its entirety and directly in all member states from the date it specifies, without any need for national implementing laws. Under Article 288 of the Treaty on the Functioning of the European Union (TFEU), it has general application and creates rights and obligations that businesses, public bodies and individuals can rely on immediately.
In tech regulation, the regulation is the preferred instrument for rules that must be identical across the single market. The General Data Protection Regulation, the Digital Services Act, the Digital Markets Act, the AI Act and MiCA are all regulations, which is why their obligations read the same in every member state.
How an EU regulation is made and takes effect
Most EU regulations are adopted through the ordinary legislative procedure. The European Commission proposes a text, and the European Parliament and the Council of the EU amend and adopt it as co-legislators. In practice, informal three-way negotiations called trilogues usually produce the compromise text that both institutions then formally approve.
After adoption, the regulation is published in the Official Journal of the European Union with a number such as Regulation (EU) 2016/679. Two dates then matter. The entry into force, often 20 days after publication, makes the act legally existing. The date of application, frequently one to three years later, is when obligations actually bind those covered.
The table below traces the main stages from proposal to enforcement.
| Stage | Main actors | Result |
|---|---|---|
| Proposal | European Commission | Draft text with an impact assessment |
| Negotiation | Parliament, Council, Commission | Amendments and trilogue compromise |
| Adoption and publication | Parliament and Council | Numbered act in the Official Journal |
| Entry into force | Set by the act | Act legally exists |
| Application | Set by the act, often staggered | Obligations become binding |
| Enforcement | National authorities, sometimes the Commission | Supervision, orders and fines |
Large tech regulations often apply in phases. The AI Act, for example, entered into force in August 2024, with prohibitions applying from February 2025, rules for general-purpose AI models from August 2025 and most remaining obligations later, which gives organizations time to prepare in stages.
EU regulation compared with other EU legal acts
The EU has several types of legal act, and the differences decide how rules reach companies and citizens. The key contrast is with the EU directive, which sets goals that each member state must achieve through its own national legislation, a process called transposition.
| Act | Binding | Applies to | Needs national law |
|---|---|---|---|
| Regulation | Yes, in its entirety | Everyone covered, in all member states | No |
| Directive | Yes, as to the result | Member states, which then legislate | Yes, transposition |
| Decision | Yes, in its entirety | Specific addressees if named | No |
| Recommendation | No | Addressees, as guidance | No |
| Opinion | No | Addressees, as a view | No |
Because a regulation does not need transposition, it reduces fragmentation between national rules. A directive allows more national flexibility but can produce 27 different implementations, as happened with older data protection law before the GDPR replaced the 1995 Data Protection Directive.
Secondary rules under an EU regulation
A regulation rarely contains every technical detail. It usually empowers the Commission to adopt delegated acts and implementing acts, and it often relies on harmonized standards to describe how compliance can be demonstrated in practice.
| Instrument | Legal basis or source | Typical purpose |
|---|---|---|
| Delegated act | Article 290 TFEU | Amends or supplements non-essential elements |
| Implementing act | Article 291 TFEU | Sets uniform conditions for applying the rules |
| Harmonized standard | European standardization bodies on request | Technical route to presumed conformity |
| Guidelines | Commission or EU boards | Non-binding interpretation of obligations |
| Codes of practice | Industry with Commission involvement | Voluntary commitments that support compliance |
For compliance teams, this means that reading the regulation alone is not enough. Obligations become concrete only together with the relevant delegated and implementing acts, standards and official guidance, some of which are published years after the regulation itself.
Enforcement and penalties in tech regulations
Enforcement depends on the regulation. Many tech regulations are enforced by national supervisory authorities, such as data protection authorities under the GDPR, while some give the European Commission direct enforcement powers over the largest companies, as the Digital Services Act and the Digital Markets Act do.
| Regulation | Maximum fine | Main enforcer |
|---|---|---|
| GDPR | EUR 20 million or 4 percent of worldwide annual turnover | National data protection authorities |
| Digital Services Act | 6 percent of worldwide annual turnover | Commission for very large platforms |
| Digital Markets Act | 10 percent, up to 20 percent for repeat breaches | European Commission |
| AI Act | EUR 35 million or 7 percent for prohibited practices | National market surveillance authorities |
Where a percentage and a fixed amount are given, the higher of the two generally applies to undertakings. Actual fines depend on the gravity, duration and intent of the infringement, so the maximums indicate exposure rather than typical outcomes.
Practical implications and common misunderstandings
EU regulations often reach companies outside the EU. The GDPR, the AI Act and the Digital Services Act apply to non-EU providers that offer services in the EU or target EU users. This extraterritorial reach contributes to the so-called Brussels effect, where global firms adopt EU rules worldwide.
- Direct applicability does not mean no national law: member states still designate authorities, set procedures and use permitted opening clauses.
- Entry into force is not the deadline: the date of application, often staggered, decides when duties start.
- Recitals are not obligations but guide how the articles are interpreted.
- Sector rules can overlap, so one product may fall under several regulations at once.
In simple terms
An EU regulation is one rulebook that applies in every EU country on the same day. Lawmakers in Brussels and Strasbourg agree on the text, and it becomes law everywhere without each country rewriting it.
That is the main difference from a directive, which tells countries what result to reach and lets each write its own law. With a regulation, a company follows the same rules whether it sells in Spain, Poland or Finland.
A practical example
A software company based outside the EU sells a recruitment tool that uses AI to rank job applicants for customers in Germany, France and Italy. Under the AI Act, AI systems used for recruitment and candidate selection are classified as high-risk.
Because the AI Act is a regulation, the company faces one set of requirements across all three markets instead of three national laws. It must establish risk management, data governance, technical documentation, human oversight and a conformity assessment before the applicable deadline, and it must appoint an authorized representative in the EU.
The compliance team builds a single program around the regulation, then tracks the implementing acts, guidelines and harmonized standards as they appear. The outcome is one compliance effort for the whole single market, with national authorities in each country supervising the same obligations.