EU Regulation & National Transposition
Map of the key EU instruments framing the compliance function and how they are transposed across Member States.
| EU Regulatory Domains | EU instrument | National transposition |
|---|---|---|
| Data Protection | Regulation (EU) 2016/679 (GDPR) | Directly applicable; national laws (e.g. PT Law 58/2019, ES LOPDGDD 3/2018) and DPAs. |
| Cybersecurity (NIS2) | Directive (EU) 2022/2555 (NIS2) | Transposed by Member States (e.g. PT via the RJSC framework); national CSIRTs. |
| Digital Operational Resilience | Regulation (EU) 2022/2554 (DORA) | Directly applicable to the financial sector; supervised by national authorities and ESAs. |
| Artificial Intelligence | Regulation (EU) 2024/1689 (AI Act) | Directly applicable; national supervisory authorities to be designated. |
| Whistleblower Protection | Directive (EU) 2019/1937 | Transposed nationally (e.g. PT Law 93/2021, ES Law 2/2023); 50+ employees. |
| Anti-Money Laundering | AML package & Regulation (EU) 2024/1624; AMLA | New EU single rulebook; AMLA operational since 1 July 2025; national supervisors. |
| Anti-Corruption | Proposed EU Anti-Corruption Directive | National regimes (e.g. PT RGPC, DL 109-E/2021); EU directive under negotiation. |
| Sustainability (CSRD/CSDDD) | Directive (EU) 2022/2464 (CSRD); CSDDD | Transposed nationally; scope revised by the Omnibus package (2026). |
| Pay Transparency | Directive (EU) 2023/970 | To be transposed by Member States by June 2026. |
| Corporate Governance | EU company law & governance instruments | National company law; internal control and accountability. |
| Third-Party & Supply Chain | CSDDD & sectoral due diligence | Supply-chain due diligence; national transposition in progress. |
| Digital Services & Markets | Regulations (EU) 2022/2065 (DSA) & 2022/1925 (DMA) | Directly applicable; European Commission and national coordinators. |