Sustainability and ESG—key principles Corporate sustainability, or performance in respect of ‘environmental social governance’ (ESG) criteria, has become increasingly important to investors, customers and employees in recent years. In response to this, there has been a rapid development of ESG criteria (also referred to as ESG metrics or factors) against which the performance of a, usually corporate, entity can be evaluated. Common ESG metrics or factors The overarching goal of the mandatory and voluntary ESG reporting frameworks developing in the EU and globally is to collect measurable data to show whether corporate entities are truly ‘sustainable’ in respect of each ESG metric relevant to their business and to make that data as transparent as possible for investors and other stakeholders. For more information on the development of the principles of ESG, and their practical application, see Practice Notes: • ESG—new starter guide • Sustainable business and environmental, social, governance (ESG)—introduction for companies and advisors For a hub on issues related to sustainable business, including reporting, see: ESG and sustainability collection. EU mandatory corporate sustainability

Law360, London: EU governments approved on 24 July 2025 a €93bn package of retaliatory tariffs against the US, with only Hungary voting against the measure. The tariffs, which consolidate two earlier packages targeting US steel, aluminium and car duties, are set to take effect by 7 August 2025 if talks with Washington collapse. The vote comes as the EU and US move closer to a broader trade agreement that could set a 15% baseline tariff on EU exports.

MLex: EU countries are expected to reach a common position on the European Commission's overhaul of the EU Emissions Trading System (ETS) by December 2026, the country chairing the talks has said. Ireland is also planning to seek agreement among EU countries in September 2026 on a negotiating mandate for plans for ETS fallback benchmarks.

MLex: A planned delay for key EU AI Act duties has come under question from Member States, which warn that the European Commission’s proposed approach lacks clear criteria, predictability and sufficient involvement of national authorities. Even supporters of a pause raised concerns, while others asked what happens if the relevant compliance tools aren’t ready even with the new timeline or if the amendments don’t pass before the August 2026 deadline.

MLex: Enforcement of the EU's keystone AI law is proving a struggle for the bloc's Member States as they try to coordinate across fragmented national regulatory systems: Differing structures, capacity constraints and approaches create risks of inconsistency. Officials see national single points of contact and stronger EU-level co-ordination as key, but acknowledge that there is no quick solution to the complexity.

MLex: EU governments aim to reach a negotiating position by late March or early April 2026 on amendments to the EU’s AI Act following initial legislative discussions. Removing the registration requirement is proving controversial among EU countries, whereas reservations and requests for clarifications remain on the measures related to addressing biases, AI literacy and centralising parts of the enforcement architecture.

MLex: EU governments' official gazettes are data controllers when they publish personal data passed to them for publication by national authorities, the EU's highest court ruled today in a case referred to it from Belgium. Such journals have responsibility for data processing, either sole responsibility or shared with bodies providing the information where national law requires that. The case stems from a Belgian court's questions after a dispute between the country’s privacy watchdog and the state over wrongly published personal data in the Moniteur Belge.

Law360, London: Russia's securities clearinghouse has lost its appeal challenging sanctions imposed by the EU in response to the invasion of Ukraine, after a Luxembourg court ruled, on 11 September 2024, that the decisions were backed up by evidence.

Law360, London: The Court of Justice gave national courts across the EU its blessing to weigh in on cross-border patent infringement cases, in a decision that lawyers say could reshape European intellectual property strategy going forward.

The European Commission has announced that the EU Customs Reform has entered into force following its adoption by the Council of the EU and European Parliament. The reform introduces a modernised Union Customs Code and establishes the EU Customs Authority, which will be based in Lille. It is intended to create a more integrated, digital and data-driven customs system, harmonise procedures, strengthen risk management and provide a single EU entry point for customs operations. It will also clarify importers’ responsibilities and simplify procedures and reporting for trusted traders.

MLex: EU cybersecurity certification for products and services may be proposed when the European Commission reviews the Directive (EU) 2016/1148, the Network and Information Systems Directive (NIS Directive), Commissioner Thierry Breton told the European Parliament’s industry committee on 24 April 2020. The review will take place this year, he said.

STOP PRESS: This Practice Note reflects the current legislative position, however please note that certain elements will be impacted by the Digital Omnibus proposals published on 19 November 2025 pursuant to the Commission’s ‘simplification’ agenda. For more information, see Practice Note: EU Digital Omnibus—tracker. Introduction The importance of implementing cybersecurity measures has been highlighted in recent years by high profile security failures involving the internet, the technology, and the services which support and make use of it. Against this backdrop, cybersecurity is of growing significance both to businesses and individuals. On 16 December 2020, the Commission and the High Representative of the Union for Foreign Affairs and Security Policy presented an EU Cybersecurity Strategy. This strategy covers the security of essential services in the EU (eg hospitals, energy grids and railways) but also the security of connected objects in homes, offices and factories. The strategy focuses on building collective capabilities to respond to major cyber-attacks and working internationally to ensure international security and stability in cyberspace. The EU has recently adopted several cybersecurity