The European regulatory framework for digital has significantly intensified in the second half of 2026. With the concrete implementation of the AI Act, the designation of new services under the Digital Services Act, and the first obligations of the Data Act, the digital landscape is evolving under the influence of texts that affect both large platforms and manufacturers of connected devices. Which regulations are truly changing the practices of web companies, and which are still in a transitional phase?
European Digital Regulations: Comparative Calendar and Scope
Several European texts now coexist with very different application dates and scopes. The table below compares the structuring regulations for the digital actors in the fall of 2026.
| Regulation | Main Object | Phase in September 2026 | Concerned Actors |
|---|---|---|---|
| AI Act | Transparency on synthetic content, obligations by risk level | Partial application (transitional period until December 2, 2026, for certain existing systems) | Providers and users of AI systems |
| Digital Services Act (DSA) | Assessment of systemic risks, protection of minors, moderation | Designation of new services (ChatGPT, Reddit, Roblox, September 2026) | Very large online platforms |
| Data Act | Data portability, product architecture of connected devices | Technical obligations being deployed | Manufacturers of connected devices, cloud service providers |
| EU Kids Act (proposal) | Age verification, limitation of addictive features | Proposal presented in September 2026 | Digital services accessible to minors |
What stands out in this table is the stacking of obligations over the same period. A company developing a connected product that integrates AI and is accessible to a young audience may potentially be subject to three distinct texts, each with its own deadlines. The news published on BestWeb regularly follows the evolution of these frameworks for web professionals.
AI Act and DSA: Two Overlapping Regulatory Logics
The AI Act imposes transparency obligations on content generated by artificial intelligence. Providers must clearly indicate when content is synthetic, and high-risk systems are subject to enhanced requirements. The transitional period runs until December 2, 2026 for existing systems that have not yet been brought into compliance.
Meanwhile, the DSA has expanded its scope. The European Commission designated ChatGPT, Reddit, and Roblox as very large platforms in September 2026. These services must now assess and mitigate their systemic risks, including effects on minors, mental health, electoral processes, and public safety.
The case of ChatGPT illustrates a concrete regulatory tension. The service finds itself simultaneously under the DSA regime (as a search platform) and under the AI Act (as an AI system). Two sets of rules, two timelines, two potential supervisory authorities.
Consequences for Product and Marketing Teams
For digital companies, this overlap has direct operational repercussions. Teams managing AI-generated content on their sites must integrate the labeling obligations of the AI Act. Those leveraging user data on large platforms must comply with the new risk assessment requirements of the DSA.
The compliance burden is no longer limited to legal aspects. It affects interface design, data architecture, and content strategy.
Data Act and Connected Devices: A Redesign of Product Architecture
The Data Act requires manufacturers of connected devices to make the data generated by their products accessible and portable. This obligation goes beyond mere privacy concerns. It directly relates to how a product is designed, from firmware to sharing APIs.
For brands selling connected products online, the implications are numerous:
- The technical architecture of the product must provide for user access to data from the design stage, and in some cases, for authorized third parties
- The terms and conditions of sale and use must reflect these access rights, altering the user journey on e-commerce sites
- Companies that use data from connected devices for personalized marketing must verify the legal basis of each processing in light of the Data Act and the GDPR combined
Data portability becomes a product design criterion, not just a post-facto legal obligation.
Online Protection of Minors: What the EU Kids Act Proposes
The proposed EU Kids Act, presented in September 2026, specifically targets the design features of digital services. The text does not merely require age verification. It provides for age-appropriate accounts and a limitation of features deemed addictive such as infinite scrolling or recurring push notifications.
For web designers and developers, this proposal changes the game. If adopted, it will require rethinking the user experience based on age profile, with constraints on mechanisms that are currently at the heart of engagement strategies.
Cybersecurity and Vulnerability Reporting
The cybersecurity aspect complements this regulatory landscape. Manufacturers of connected products face an operational obligation to report vulnerabilities that adds to existing requirements. Reporting now encompasses not only breaches of personal data but also technical flaws that could affect user security.
This obligation pushes companies to structure monitoring and incident response processes that did not exist in most SMEs in the digital sector.
The regulatory landscape of the web in 2026 is characterized by the simultaneity of deadlines. Four major texts produce their effects in the same quarter, each with requirements that affect different teams within the same organization. The ability to accurately map which texts apply to which products and services will determine, in the coming months, the gap between prepared companies and those that will discover their obligations through inspections.
