This Practice Note provides an overview of Directive 2011/83/EU, the EU Consumer Rights Directive (EU CRD), including the amendments introduced by Directive (EU) 2019/2161, the EU Omnibus Directive, Directive (EU) 2024/825, the EU Empowering Consumers Directive and Directive (EU) 2023/2673, the Revised EU Distance Marketing of Consumer Financial Services Directive. It explains the scope of the EU CRD, key definitions including the differences between distance, off-premises and other contracts, what information must be provided to the consumer, and the consumer’s cancellation rights (also known as the right of withdrawal). It also considers the rules on additional payments, payment surcharges, help-lines, and delivery and passing of risk. This Practice Note does not cover UK legislation. For more information on UK legislation, see Practice Notes: • Distance, doorstep and on-premises sales • Consumer Rights Act 2015—summary • Consumer Rights Act 2015—goods • Payment surcharges For an overview of key consumer legislation in the EU, see Practice Note: Key EU consumer legislation—summary. Key EU legislation and materials The EU Consumer Rights Directive The EU CRD aims to align and harmonises

The Court of Justice of the European Union has its seat in Luxembourg and consists of two courts: the Court of Justice and the General Court (the Civil Service Tribunal was merged into the General Court in September 2016). The General Court and Court of Justice hear cases involving EU competition law, including: • appeals brought against decisions of the European Commission (the Commission) in relation to Articles 101 and 102 of the Treaty on the Functioning of the European Union (TFEU) (infringement decisions, decisions rejecting complaints, and procedural decisions taken during investigations), • appeals brought against decisions of the Commission in relation to Articles 107 to 109 TFEU (State aid; decisions approving or refusing aid and also procedural decisions during investigations), • appeals brought against decisions of the Commission in relation to the EU Merger Regulation (EUMR), • actions by the Commission before the Court of Justice against Member States for failing to comply with State aid decisions (eg, failure to recoup illegal aid), • references made to the Court of Justice

Purpose of the Credit Institutions (Reorganisation and Winding Up) Directive The Credit Institutions (Reorganisation and Winding Up) Directive 2001/24/EC (CIWUD) was originally created to ensure that a credit institution and its branches in other Member States are reorganised or wound up according to the principles of unity and universality, with the effect that there will be only one set of insolvency proceedings in which the credit institution is treated as one entity. The CIWUD therefore ensured that the assets of the institution, wherever they are located, will be included in a single winding-up process, eliminating the confusion and uncertainty of secondary proceedings. The CIWUD sought to prevent the separation of assets of the credit institution so that creditors outside of the Member

STOP PRESS: This Practice Note reflects the current legislative position, however please note that certain elements will be impacted by the Digital Omnibus proposals published on 19 November 2025 pursuant to the Commission’s ‘simplification’ agenda. For more information, see Practice Note: EU Digital Omnibus—tracker. This Practice Note provides an overview of the key aspects of Directive (EU) 2022/2557 on the resilience of critical entities, the EU Critical Entities Resilience Directive (CER Directive), including its scope, key obligations for critical entities, its sanctions regime and what the new requirements mean for organisations in practice. The CER Directive is part of the EU’s broader effort to strengthen the resilience of critical infrastructure across sectors. It is not primarily a cybersecurity law, but it does intersect with cybersecurity as cyber incidents can threaten the resilience of critical entities, alongside other threats such as natural hazards, terrorism, insider threats, pandemics and sabotage. Background In an evaluation report published in July 2019, the European Commission determined that the technological, economic, social, political and environmental context

This Practice Note covers the manufacturer, authorised representative, importer and distributor obligations under Regulation (EU) 2024/2847, the EU Cyber Resilience Act (CRA). It also covers the enforcement and sanctions under the CRA and what the new requirements mean for organisations in practice. For more information on the background and scope of the CRA, see Practice Notes: • The EU Cyber Resilience Act—overview and regulatory framework • The EU Cyber Resilience Act—scope and classification of products The CRA is a first of its kind EU legislation that imposes mandatory cybersecurity standards on ‘products with digital elements’ throughout the EU. Products that do not meet these standards will not be eligible for sale on the EU market as of December 2027. Compliance with the CRA will therefore become essential to gain access to the EU market for hardware and software products. Manufacturers, importers and distributors of such products will be subject to extensive cybersecurity obligations and face substantial fines if they fail to comply. The CRA has been

This Practice Note provides an overview of the key aspects of Regulation (EU) 2024/2847, the EU Cyber Resilience Act (CRA), its background, timeline, objectives and how it interacts with other EU laws. For more information on the scope of the CRA or key obligations for economic operators, see Practice Notes: • The EU Cyber Resilience Act—scope and classification of products • The EU Cyber Resilience Act—obligations, compliance and enforcement Regulation (EU) 2024/2847, the EU Cyber Resilience Act (CRA) is a first of its kind EU legislation that imposes mandatory cybersecurity standards on ‘products with digital elements’ throughout the EU. Products that do not meet these standards will not be eligible for sale on the EU market as of December 2027. Compliance with the CRA will therefore become essential to gain access to the EU market for hardware and software products. Manufacturers, importers and distributors of such products will be subject to extensive cybersecurity obligations and face substantial fines if they fail to comply. The CRA has

This Practice Note covers the material, personal and territorial scope of Regulation (EU) 2024/2847, the EU Cyber Resilience Act (CRA). It also explains the classification of products under the CRA, such as non-critical, important and critical products. For more information on the background of the CRA or key obligations for economic operators, see Practice Notes: • The EU Cyber Resilience Act—overview and regulatory framework • The EU Cyber Resilience Act—obligations, compliance and enforcement The CRA is a first of its kind EU legislation that imposes mandatory cybersecurity standards on ‘products with digital elements’ throughout the EU. Products that do not meet these standards will not be eligible for sale on the EU market as of December 2027. Compliance with the CRA will therefore become essential to gain access to the EU market for hardware and software products. Manufacturers, importers and distributors of such products will be subject to extensive cybersecurity obligations and face substantial fines if they fail to comply. The CRA has been published

This checklist outlines the key requirements of Regulation (EU) 2023/2854, the EU Data Act, that businesses need to comply with, such as data access and portability, smart contracts, prohibition on unfair contractual terms, right to switch services (operability), open interoperability, as well as the rules on international data transfers. The EU Data Act aims to encourage business-to-business (B2B) and business-to-consumers (B2C) sharing of data generated by Internet of Things (IoT) devices to facilitate a fair use of data and realise the full potential of EU’s data economy. It is the second main legislative initiative resulting from the European strategy for data, after the adoption of Regulation (EU) 2022/868, the EU Data Governance Act. While the EU Data Governance Act creates the processes and structures to facilitate data sharing by companies, individuals and the public sector, the EU Data Act clarifies who can create value from data and under which conditions. The EU Data Act entered into force on 11 January 2024 and started to apply on 12 September 2025. Note that the EU Data Act also aims

STOP PRESS: This Practice Note reflects the current legislative position, however please note that certain elements will be impacted by the Digital Omnibus proposals published on 19 November 2025 pursuant to the Commission’s ‘simplification’ agenda. For more information, see Practice Note: EU Digital Omnibus—tracker. The European Strategy for Data aims to support the creation of a single European market for data by supporting responsible access, broader sharing and re-use of personal and non-personal data, in accordance with the values and existing laws of the EU, in particular on the protection of personal data, consumer protection and competition rules. Regulation (EU) 2022/868, the Data Governance Act (DGA) strengthens the single European market's governance mechanisms and establishes a framework to facilitate general and sector-specific data sharing, and Regulation (EU) 2023/2854, the Data Act (DA) concerns the actual rights on the access to and use of data. It is estimated that the volume of data generated

This Practice Note provides a summary of Directive (EU) 2019/770 (OJ L 136/1) on certain aspects concerning contracts for the supply of digital content and digital services, the EU Digital Content Directive (EU DCD), introduced as part of the European Commission’s Digital Single Market strategy. The EU DCD provides various rights and remedies for consumers in respect of business-to-consumer (B2C) contracts for the supply of digital content or digital services, and is complemented by Directive (EU) 2019/771 (OJ L 136/28) on certain aspects concerning contracts for the sale of goods, the EU Sale of Goods Directive (EU SGD) (introduced alongside the EU DCD). For more information on the EU SGD, see Practice Note: The EU Sale of Goods Directive. The EU DCD entered into force on 11 June 2019. EU Member States were required to adopt and publish the measures necessary to comply with the EU DCD by 1 July 2021 and had to apply those measures from 1 January 2022. The national transposition measures of the Directive can be viewed on the EUR-Lex website.

Ireland—-Banking and Financial Services and Commercial analysis: This article, written by Aoife MacArdle and Colin Rooney of Arthur Cox LLP, explains that the EU Digital Identity Wallet (Identity Wallet) will become a part of everyday life, with certain regulated industries required to accept them by December 2027.

Introduction This Practice Note provides a quick guide to Regulation (EU) 2022/1925, the EU Digital Markets Act (EU DMA). It details key information on the EU DMA including the scope, key legal and compliance obligations, the availability of exemptions and the European Commission’s investigative, enforcement and monitoring powers. The EU DMA was published in the Official Journal on 12 October 2022, entered into force on 1 November 2022 and applied for most purposes from 2 May 2023. It is a targeted regime for large digital platforms that act as gateways between business users and end users. Its purpose is to ensure contestable and fair markets in the digital sector. For further information on adoption and implementation dates, see Practice Notes: The EU Digital Markets Act—the gatekeeper obligations—Timeline and EU Digital Markets Act—progress tracker. If you would like to check if and how the EU DMA may impact your business, you should consider the following questions: • does the service fall within one of the EU DMA’s core platform service categories? • is the provider a gatekeeper