The European Commission has published guidelines to assist Member States in implementing Directive (EU) 2022/2557, the EU Critical Entities Resilience Directive, (CER Directive) and to strengthen the resilience of critical infrastructure across the EU. The guidelines detail the process for identifying critical entities in 11 sectors and for developing national resilience strategies. Implementation will be supported by the €1.93bn Internal Security Fund (2021–27), with an additional €2.7m in emergency funding available for incident investigations. The Commission has proposed tripling internal security funding for the period 2028–34 to enhance the protection of infrastructure against threats such as cyber-attacks and natural hazards.

The European Commission has published guidelines on the protection of minors, as well as a prototype of an age-verification app under the EU Digital Services Act (EU DSA). These aim to ensure that children and young people can continue to enjoy the opportunities of an online world while minimising risk of exposure to harmful content or behaviour. The guidelines set out a non-exhaustive list of measures to protect children from online risks and provides recommendations to address: curbing addictive design features, managing cyberbullying exposure, reducing exposure to harmful content and limiting unwanted contact from strangers. The prototype of the age verification app is aimed at providing a method to enable users to prove they are over 18 years old when accessing restricted adult content, such as online pornography, without revealing any other personal information. It is user-friendly and protects privacy, setting a ‘gold standard' in age assurance online. The verification app will be tested and further customised in collaboration with Member States, online platforms and end-users.

The European Commission has issued new guidance outlining the obligations under the General Product Safety Regulation (GPSR) for all economic operators in the EU product supply chain. The guidance confirms that manufacturers, importers, distributors and online marketplace providers must ensure products are safe by design, supported by thorough risk assessments and detailed technical documentation. It highlights the use of European standards as a key means of demonstrating product safety. It also sets out procedures for reporting dangerous products, including the use of the Safety Business Gateway for recalls and consumer protection.

The European Commission has published an indicative timetable for the legislative proposals it expects to issue in 2025. The list includes the following items:

The European Commission has published joint guidance developed within the G7 Sub-Working Group on Export Control Enforcement to raise awareness on sanctions evasion risks and indicators, and help relevant business operators address and mitigate such risks. It aims to identify Russian evasion practices, to protect G7 technology from misappropriation, prevent reputational harm, and mitigate liability risk while supporting continued success of export controls and sanctions.

The European Commission has published a mid-term review of the EU’s Zero Pollution Action Plan, alongside a study examining the societal costs of pollution caused by per- and polyfluoroalkyl substances (PFAS). The review evaluates progress since the action plan was launched in 2021 and concludes that most of the planned legislation is now in place. However, it finds that further action by Member States will be required for the EU to meet its pollution reduction targets by 2030. The accompanying study provides a minimum estimate of the costs associated with existing PFAS contamination and finds that, if current pollution levels persist until 2050 without further regulatory action, the societal cost could reach approximately €440bn. It concludes that reducing PFAS releases at the source is by far the most cost-effective approach, with measures implemented by 2040 expected to save around €110bn, compared with treating polluted water without addressing emissions at their source, which would cost more than €1trn.

The European Commission has published MDCG 2025–10, which provides guidance on post-market surveillance (PMS) of medical devices and in vitro diagnostic medical devices. The guidance sets out a common approach to how manufacturers and other economic operators should meet PMS obligations under Regulation (EU) 2017/745 on medical devices (MDR) and Regulation (EU) 2017/746 on in vitro diagnostic medical devices (IVDR), with the aim of ensuring consistent and effective implementation across the EU.

The European Commission has published new Variations Guidelines, which define the detailed rules for pharmaceutical companies for modifying and updating their marketing authorisations, and for streamlining the lifecycle management of medicines to adapt to scientific and technical advancements. These guidelines will support the implementation of the new Regulation (EC) No 1234/2008 as amended (the Variations Regulation) that came into force in January 2025 as part of the EU pharmaceutical legislation reform package. The Variations Regulations and these amended Variation Guidelines represent the largest reform of the Variations Regulation in over 30 years. The Guidelines will apply to variation applications submitted by marketing authorisation holders to EMA from 15 January 2026 and will replace the current guidelines.

The European Commission has published new guidance to support Member States in adapting the Natura 2000 network of protected sites to increasing climate change pressures. The guidance clarifies how the provisions of the Birds and Habitats Directives should be applied when designating and managing Natura 2000 sites in the context of climate impacts. It also outlines a range of adaptation measures and introduces a climate adaptation framework for Natura 2000 site managers, national authorities,and other stakeholders responsible for safeguarding Europe’s habitats and species. While the guidance is not legally binding, it is intended to provide Member States with the flexibility to tailor adaptation actions to their specific national and regional contexts.

The European Commission has released an updated Manufacturer Incident Report (MIR) form version 7.3.1 to align with the requirements under the Medical Devices Regulation (EU) 2017/745 (MDR) and In Vitro Diagnostic Regulation (EU) 2017/746(IVDR). The updated version of MIR is effective May 5, with mandatory compliance by November 2025. Key regulatory changes include enhanced reporting requirements, with new fields capturing the date of manufacturer awareness regarding reportability and adjustments to device identification, ensuring proper classification, especially for legacy devices. A detailed help guide is available to assist manufacturers in understanding the new fields and ensuring compliance with the updated requirements.

The European Commission has published a delegated regulation effective from 24 July 2025, establishing new methodologies for calculating recycling efficiency and material recovery from waste batteries. This regulation, which underpins the EU’s green transition and the goal of achieving climate neutrality by 2050, provides clear guidelines for recyclers handling lead-acid, nickel-cadmium, lithium, and other batteries. It sets specific recycling efficiency targets—75% for lead-acid, 65% for lithium-based, 80% for nickel-cadmium, and 50% for other batteries by December 2025, increasing to 80% for lead-acid and 70% for lithium-based batteries by 2030. In addition, the regulation mandates ambitious material recovery targets for critical raw materials, requiring a 90% recovery for cobalt, copper, lead, and nickel, and 50% for lithium by December 2027, with further increases to 95% and 80% respectively by December 2031. It also establishes harmonised documentation requirements for recyclers reporting to member states, thereby aiming to prevent unfair competition within the EU's secondary raw materials market.

The European Commission published guidance to assist manufacturers, developer and businesses in meeting their obligations under Regulation (EU) 2024/2847, the EU Cyber Resilience Act (CRA), which has been in force since December 2024. This non-binding guidance addresses several important aspects, including the scope of the Act—such as the treatment of remote data processing solutions and free and open source software—and clarifies what constitutes a 'substantial modification'. It also explains how support periods apply and provides instructions on meeting reporting and risk assessment requirements. Reporting obligations under the CRA take effect on 11 September 2026, while the main obligations are set to apply from 11 December 2027.