Which EU regulations actually apply to you?

We Built a Tool to Answer the Question Every Business Entering the EU is Asking

There is a question we hear in almost every market entry conversation we have, phrased in different ways but always meaning the same thing: which EU regulations actually apply to us, and what do we need to do about them?

It sounds simple. It isn't. The EU's regulatory landscape has expanded dramatically over the past three years — across AI, data, cybersecurity, financial services, digital markets, health, defense, and more. Many of these regulations are already in force. Several more are weeks or months away from application. And unlike most regulatory frameworks, EU law frequently applies to companies regardless of where they are headquartered — if you operate in, sell into, or process data from the EU, you are likely in scope.

The problem is not a lack of information. The problem is that the information is fragmented, technical, and not organized around the question a business actually needs to answer: does this apply to me, and if so, what does it mean operationally?

Click here to find out - it takes 3 minutes

What the tool does

The EU Regulatory Exposure Scanner asks you a short set of questions — tailored to your sector — and produces a personalised map of the regulations that apply to your business. It covers the current regulatory environment as of March 2026, across sectors including technology, financial services, real estate, healthcare, manufacturing, media, defense and space, and more.

The output has two layers. The first is a legal exposure map: which regulations apply, when they come into force, what the key obligations are, and what the penalty exposure looks like. The second is an operational gap analysis: the obligations that go beyond what legal advice alone can resolve — local representation requirements, management accountability, physical presence triggers, employment classification risk, and government relations needs. This is the layer that most compliance checklists miss, and the layer where we work.

The tool is free to use and takes approximately three minutes to complete.

Why the two-layer structure matters

Legal compliance and operational readiness are not the same thing. A company can have excellent legal counsel advising on GDPR, the AI Act, or NIS2, and still be materially non-compliant because the regulation requires something their lawyers cannot provide — a designated EU representative with joint liability, a locally accountable senior manager, an incident reporting infrastructure that has to exist on the ground.

Several of the EU's most significant recent regulations carry this kind of operational sting. The AI Act requires non-EU providers of high-risk AI systems to designate an EU-established authorized representative. The Cyber Resilience Act places joint and several liability on EU-based representatives of non-EU manufacturers. NIS2 creates personal liability for senior management and cannot be administered remotely. MiCA requires crypto-asset service providers to have their place of effective management inside the EU. The FDI screening framework — particularly relevant for defense and space — requires local legal and government relations capacity that no amount of remote advisory can replace.

These are not edge cases. For any business headquartered outside the EU that operates here, they are live questions.

Who it is for

The tool is designed for decision-makers, not compliance specialists. If you are a CEO, CFO, General Counsel, or Head of Strategy at a business operating in or entering the EU, it will give you a clear picture of your regulatory exposure in the time it takes to have a cup of coffee. If you are an advisor — legal, financial, or operational — it is a useful starting point for client conversations.

We built it primarily for our own market entry advisory work, but the questions we received from clients and partners made clear it had broader value. We are making it publicly available because we think more businesses should have access to a clear, honest picture of what operating in the EU actually requires.

A note on what it is not

The tool does not constitute legal advice. It is a diagnostic, not an opinion. Regulatory exposure depends on the specific facts of your business, and the right next step after using the tool is a conversation with qualified legal counsel — and, where the operational gaps are significant, with someone who can help you build the infrastructure those regulations require.

If the tool surfaces obligations you are not currently meeting, we are happy to have that conversation.

Try the EU Regulatory Exposure Scanner →

Ediyal is a boutique operational partnership firm specializing in the US–EU business corridor. We help businesses establish, operate, and scale in Europe — combining market entry advisory, bridge leadership, and hands-on operational support.