Industrial Policy & Trade Monitor· 2667 actions· ✨ 89 recent

On 29 January 2026, the Council of the European Union adopted Council Implementing Regulation (EU) 2026/267 and the accompanying Council Decision, implementing the EU's Iran human-rights restrictive-measures regime (Regulation (EU) No 359/2011, in place since 2011 and renewed annually). The package designates 15 individuals and 6 entities over the violent repression of peaceful protests, arbitrary detention, and internet/media censorship in Iran, bringing the regime's cumulative total to 24 individuals and 26 entities. The six newly listed entities are the Iranian Audio-Visual Media Regulatory Authority (SATRA), the IRGC-linked Seraj Cyberspace Organization, the Working Group for Determining Instances of Criminal Content (WGDICC), Yaftar Pazhohan Pishtaz Rayanesh Limited Company, Douran Software Technologies, and Masaf Institute. Designated parties are subject to an EU-wide asset freeze and a prohibition on making funds or economic resources available to them; listed individuals additionally face a travel ban.

The European Investment Bank agreed to lend up to EUR 870 million to Nokia to accelerate research and development of next-generation mobile network technologies (5G-Advanced and 6G radio access network hardware and software). The facility is structured in two tranches of EUR 435 million each: the first was signed in December 2025, with the second expected to be signed in mid-2026. The financing is delivered under the EIB's TechEU initiative and backed by an InvestEU guarantee, explicitly framed around EU strategic autonomy in mobile-network technology and support for EU security and defence objectives given the cybersecurity features of the radio networks involved.

The European Investment Fund (EIF), part of the EIB Group, invested EUR 20 million (~USD 23.1 million) on 6 November 2025 in TIN Capital's European Cyber Tech Fund V, a growth-equity vehicle backing European cybersecurity scale-ups. EIF's participation is supported under the European Commission's InvestEU programme; alongside Invest-NL and private investors, the fund closed at over EUR 80 million. The EIF frames the investment as strengthening Europe's digital security and autonomy amid incoming EU cybersecurity regulation (NIS2, the Cybersecurity Act, DORA). Global Trade Alert separately logs the transaction as a "red"-flagged state-linked financial investment-support intervention.

The European Investment Bank, the Spanish Ministry of Economy, Trade and Business, and Endesa SA agreed a EUR 650 million financing package on 29 September 2025 to modernise, digitalise and reinforce Endesa's electricity distribution network across six Spanish autonomous communities during 2025-2027. The package comprises a EUR 500 million loan channelling NextGenerationEU Recovery Plan funds through Spain's Autonomous Resilience Fund (FRA), plus a EUR 150 million EIB own-funds loan representing the first tranche of a EUR 500 million facility already approved by the Bank. Financing covers smart meters, advanced transformers, grid digitalisation software, new substations and underground cabling, with over half the investment targeted at economically disadvantaged regions.

The European Investment Bank signed a EUR 450 million loan with Thales to finance the group's 2025-2027 research and development investment programme in aeronautics and radar. The aeronautics stream targets safety and efficiency improvements for civil and military flight; the radar stream funds modernisation of existing equipment and development of a new generation of civil and military radar systems and software. The EIB frames the deal as its first-ever corporate loan to Thales and one of the largest it has extended to Europe's security and defence sector, part of a EUR 3.5 billion (3.5% of 2025 financing) EIB Group allocation to security and defence.

On 18 July 2025, the Council of the European Union adopted the 18th package of restrictive measures against Russia, anchored by Council Regulation (EU) 2025/1494 amending Regulation 833/2014 (sectoral measures), Council Implementing Regulation (EU) 2025/1476 implementing Regulation 269/2014 (asset-freeze listings), Council Decision (CFSP) 2025/1495 (vessel listings), and Council Regulation (EU) 2025/1472 (parallel Belarus measures). The package is the largest energy-sector escalation since 2022 and pivots from new-perimeter creation toward enforcement and circumvention closure. Headline measures: (i) the Russian-crude price cap is lowered from USD 60 to USD 47.6 per barrel with a new automatic dynamic mechanism re-indexing the cap to global oil prices every six months at a 15 % discount to the 22-week trailing average (effective 3 Sep 2025, with a transitional exemption to 18 Oct 2025 for pre-20 Jul 2025 contracts compliant with the prior cap); (ii) full transaction ban extended to 22 additional Russian banks, bringing the total cut off from the EU financial system to 45; transaction ban extended to third-country financial institutions and crypto-asset service providers facilitating circumvention; (iii) full transaction ban on Nord Stream 1 and Nord Stream 2 pipelines; (iv) import ban on refined oil products derived from Russian crude processed in third countries; (v) 105 additional vessels added to the shadow-fleet port-access ban (cumulative total 444); (vi) 26 new entities added to Annex IV military end-user list (15 Russian + 11 from China/Hong Kong/Turkey); (vii) Council Implementing Regulation 2025/1476 lists 14 individuals + 41 entities under asset-freeze, including a major Indian refinery (Nayara Energy, part-owned by Rosneft), three Chinese suppliers of battlefield goods, shadow-fleet operators, and entities involved in the deportation of Ukrainian children; (viii) parallel Belarus complementary measures via Regulation 2025/1472. Wind-down periods vary: 90 days for oil-price-cap contracts; banking-software wind-down to 30 Sep 2025; trade-goods wind-downs Oct 2025–Jan 2026 by category. Entry into force on 19 July 2025 (day following publication in the Official Journal), except for measures with explicit deferred application dates.

Regulation (EU) 2024/2847 of the European Parliament and of the Council on horizontal cybersecurity requirements for products with digital elements, signed 23 October 2024 and entering into force 10 December 2024. The CRA is the first EU statutory cybersecurity regime covering all hardware and software products with a direct or indirect data connection placed on the EU market, imposing essential cybersecurity requirements, conformity assessment with CE marking, mandatory vulnerability handling, and 24-hour early-warning notification of actively-exploited vulnerabilities to ENISA. Main manufacturer obligations apply from 11 December 2027; conformity-assessment-body notification provisions apply from 11 June 2026 and reporting obligations from 11 September 2026. Penalties reach EUR 15M or 2.5% of global annual turnover.

The European Union's Artificial Intelligence Act, Regulation (EU) 2024/1689, was published in the Official Journal on 12 July 2024 and entered into force on 1 August 2024. It establishes the world's first horizontal, risk-tiered legal framework for the development, market placement, and use of AI systems — covering prohibited practices, high-risk systems, general-purpose AI models, and minimal-risk applications — with extraterritorial reach over any provider placing an AI system on the EU market or whose output is used in the EU. Penalties reach up to EUR 35 million or 7% of global annual turnover. Application is staged: prohibitions from 2 February 2025, GPAI and governance from 2 August 2025, the bulk of high-risk obligations from 2 August 2026, and product-safety-embedded high-risk systems from 2 August 2027.

Regulation (EU) 2023/2854 of the European Parliament and of the Council of 13 December 2023 on harmonised rules on fair access to and use of data — the "Data Act" — was published in the Official Journal on 22 December 2023, entered into force on 11 January 2024, and applies generally from 12 September 2025 (with longer transitional periods for IoT product-design obligations under Article 3(1), which apply to products placed on the market after 12 September 2026, and for the data-portability standardisation framework, applicable from 12 September 2027). The Data Act is the third pillar of the EU data-economy framework alongside the GDPR (personal data) and the Data Governance Act 2022/868 (data-intermediation services), and is the world's first horizontal statutory regime governing access to and portability of industrial / IoT / non-personal data — covering by-design data-availability obligations on connected-product manufacturers, a mandatory cloud- switching framework with progressive elimination of switching charges, B2G emergency data-sharing in exceptional needs, unfair-contract-terms protection for SMEs, and safeguards against unlawful international government access to non-personal data held in EU cloud.