Insights

The wait is over. As of today, manufacturers of connected products (both hardware and software) must comply with the Cyber Resilience Act’s (“CRA”) vulnerability and incident reporting obligations. The CRA’s Single Reporting Platform (“SRP”), operated by the European Union Agency for Cybersecurity (“ENISA”), is now the EU-wide gateway through which those notifications must flow.

The EU Cyber Resilience Act (CRA) is an EU product cybersecurity law for connected products (formally, “products with digital elements” under the CRA) commercialized in the EU; it entered into force on 10 December 2024, with direct application across the EU. Full application begins 11 December 2027, but one of its most operationally demanding provisions takes effect in just under 100 days, on 11 September 2026: the mandatory vulnerability and incident reporting under Article 14 CRA.

The Court of Justice of the European Union (CJEU) recently issued a landmark judgment in the LEGO Group case (C-211/24) concerning the scope of EU design protection for modular systems. This recent judgment addresses fundamental questions regarding the protection and enforcement of Community designs for modular products, specifically the LEGO Group’s iconic toy building blocks and parts:

The EU Institutions are currently adding the finishing touches to the new Packaging & Packaging Waste Regulation (“PPWR”) which is expected to be adopted in Q4 2024 or Q1 2025. While many companies are fully preoccupied with preparing for other EU legislation (e.g. the Deforestation Regulation) – companies will ignore the PPWR at their peril. The PPWR contains a host of ambitious legal targets and requirements – which industry will find it difficult to achieve in practice. And the deadlines to comply – are perhaps even more challenging. Companies will need to start preparing for the EU PPWR now, to avoid serious problems – including supply-chain disruption, penalties and litigation – in the future.

At the beginning of the year, we brought to your attention that a number of important Belgian and EU legislative changes are likely to have an impact in 2024: there are new laws that have been adopted and proposals that are expected to firm up into law.

In an era where regulatory landscapes are rapidly evolving, companies with a footprint in the European Union must stay vigilant and adaptable. The EU has recently unveiled a comprehensive set of guidelines that impose fresh obligations on both EU and non-EU based companies operating within its borders. This client alert is the first in a series designed to decode the complexities of the new EU regulations and provide actionable insights for businesses to ensure full compliance[1]. Stay tuned as we unravel the details of these pivotal changes and guide you through the steps your business needs to take to align with the EU's heightened regulatory standards.

On February 17, 2024, The Digital Services Act (DSA) will become applicable, introducing a new regulatory framework for providers of intermediary services. The DSA will apply to those offering their services to users located in the EU, regardless of the providers' place of establishment. We have discussed the new obligations in our previous client alert, when the DSA was adopted. In this alert, we will focus on the notice and action mechanisms, the positions of the users, intermediaries and the general public.

A number of important Belgian and EU legislative changes are likely to have an impact in 2024. On the one hand, there are new laws that have been adopted and will start to bite, and, on the other, there are proposals that are expected to firm up into law.

The historic Brexit vote on June 23, 2016, calls into question the future of product regulation in the U.K. but should not have an immediate effect on compliance obligations.

The EU Court of Justice recently found that the communication of erroneous information to a consumer must be classified as a 'misleading commercial practice' within the meaning of the Unfair Commercial Practices Directive, even though that information concerned only one single consumer (Case C 388/13 of 16 April 2015).

Since September 1, 2014, Belgian law contains a collective redress mechanism. The procedure is available to Belgian and foreign consumers seeking redress from companies that have breached a contract or have violated certain consumer protection laws (European and domestic), including the product safety and product liability laws.