Industrial Policy & Trade Monitor· 2663 actions· ✨ 89 recent

On 16 December 2022 the Council of the European Union adopted Council Regulation (EU) 2022/2474, the 9th package of restrictive measures against Russia, amending Regulation (EU) 833/2014. It entered into force on publication the following day (17 December 2022). The package extends the prohibition on new EU investment from the Russian energy sector to the Russian mining and quarrying sector, bans exports of aircraft and drone engines and their parts to Russia (and to any third country that could re-supply drones to Russia), adds 168 entities to the sectoral export- control annex covering chemicals, nerve agents, night-vision and radio- navigation equipment, electronics and IT components, and prohibits EU advertising, market-research, product-testing and technical-inspection services to Russia. A parallel Council Decision/Implementing Regulation designated a further 141 individuals and 49 entities to the EU asset-freeze and travel-ban list.

Directive (EU) 2022/2557 of the European Parliament and of the Council of 14 December 2022 on the resilience of critical entities, published OJ L 333, 27 December 2022, entered into force 16 January 2023, with Member State transposition deadline 17 October 2024 (rules applicable from 18 October 2024). The CER Directive repeals Council Directive 2008/114/EC on European Critical Infrastructures, extending the scope from two sectors (energy, transport) to eleven essential-service sectors: energy, transport, banking, financial market infrastructures, health, drinking water, wastewater, digital infrastructure, public administration, space, and food. Member States must adopt national resilience strategies, conduct risk assessments at least every four years, identify "critical entities" providing essential services whose disruption would have significant cross-border impacts, and ensure those entities implement technical, security, and organisational resilience measures, business-continuity plans, incident-reporting obligations, and personnel-security background checks. The CER Directive is the physical and hybrid resilience twin to the NIS2 Directive (2022/2555) — the two instruments form the binding EU critical-infrastructure-protection architecture replacing the 2008/114/EC regime.

Regulation (EU) 2022/2554 (Digital Operational Resilience Act, DORA) is the EU's first horizontal cyber- and ICT-resilience instrument for the financial sector. Adopted 14 December 2022 and published in the Official Journal on 27 December 2022, it entered into force on 16 January 2023 and applies from 17 January 2025. DORA covers approximately 22,000 EU regulated financial entities across ~20 entity types (credit institutions, insurers, investment firms, CCPs, trading venues, crypto-asset service providers, etc.) under five pillars: ICT risk management, ICT-incident reporting, digital operational resilience testing (including threat-led penetration testing for significant entities), ICT third-party risk management, and information sharing. Structurally novel, DORA establishes the Critical ICT Third-Party Provider (CTPP) oversight regime under which the European Supervisory Authorities (EBA, ESMA, EIOPA) acquire direct supervisory powers over hyperscale cloud providers (AWS, Azure, GCP, Oracle) servicing EU financial entities — the first EU mechanism for ESA direct oversight of non-financial cloud providers.

Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive), published OJ L 333, 27 December 2022, entered into force 16 January 2023. NIS2 repeals and substantially expands the 2016 NIS1 Directive (2016/1148), extending the scope from ~7 sectors to 18 enumerated essential and important sectors, imposing binding cybersecurity risk- management and incident-reporting obligations on covered entities, introducing board-level management accountability, and mandating Member State transposition by 17 October 2024. NIS2 is the structural EU statutory anchor for national cybersecurity frameworks across the bloc, operating alongside DORA (Reg 2022/2554) for financial-sector digital resilience and CRA (Reg 2024/2847) for product cybersecurity.

Council Directive (EU) 2022/2523, adopted 14 December 2022 and published in OJ L 328 on 22 December 2022, transposes the OECD/G20 Inclusive Framework Pillar Two model rules into binding EU law. It requires all 27 Member States to impose a minimum 15% effective tax rate (ETR) on the jurisdictional income of MNE groups with consolidated annual revenue ≥ EUR 750 million via three interlocking charges: an Income Inclusion Rule (IIR) for fiscal years beginning on or after 31 December 2023, an Undertaxed Profits Rule (UTPR) backstop from 31 December 2024, and an optional Qualified Domestic Minimum Top-up Tax (QDMTT). The directive is the largest international-tax instrument in EU history and the operative legal anchor for the cross-border Pillar Two architecture inside the single market, structurally rebalancing FDI location decisions for an estimated 12,000+ in-scope MNE groups globally.

Council Regulation (EU) 2022/2372, adopted 24 October 2022, establishes a binding framework empowering HERA (Health Emergency Preparedness and Response Authority) to activate emergency supply measures for crisis-relevant medical countermeasures — vaccines, therapeutics, PPE, medical devices, and in-vitro diagnostics — when a public health emergency at Union level is declared under Regulation (EU) 2022/2371. Emergency-mode powers include joint procurement on behalf of Member States, mandatory information requests to manufacturers on stockpiles and production capacity, accelerated R&D funding under the Emergency Research and Innovation Plan, and Union-level stockpile authority. This is the foundational binding instrument for the EU's post-COVID medical supply-chain resilience architecture; it is referenced by every subsequent EU pharma-resilience initiative including the Critical Medicines Act proposal (2025) and the 2025 MCM Strategy.

Regulation (EU) 2022/2065 on a Single Market For Digital Services (Digital Services Act, DSA) was adopted by the European Parliament and Council on 19 October 2022, published in OJ L 277 on 27 October 2022, entered into force on 16 November 2022, and applied in full from 17 February 2024 (with VLOP/VLOSE obligations applying from 25 August 2023 following the Commission's initial designation letters of February 2023). The DSA establishes a graduated intermediary-liability and platform-safety framework covering all online intermediaries serving EU users, with the heaviest obligations falling on designated Very Large Online Platforms (VLOPs, ≥45m monthly active EU users) and Very Large Online Search Engines (VLOSEs): systemic-risk assessments, annual independent audits, vetted-researcher data access, recommender-system transparency, online-advertising transparency, and crisis-response cooperation mechanisms under Commission coordination. The European Commission holds exclusive enforcement authority over VLOPs and VLOSEs, with fines up to 6% of global turnover. The DSA is the structural twin-pillar to the Digital Markets Act (Reg (EU) 2022/1925): the DMA governs ex-ante competition obligations on designated gatekeepers; the DSA governs ex-post intermediary-liability, content-moderation, and platform-safety obligations across all online intermediaries.

On 6 October 2022 the Council of the European Union adopted Council Regulation (EU) 2022/1904, amending Regulation (EU) No 833/2014, as the EU's eighth package of restrictive measures against Russia. It entered into force 7 October 2022. The regulation's headline measure creates the legal basis for an oil price-cap mechanism: a ban on maritime transport to third countries of Russian-origin crude oil and petroleum products, becoming operational once the Council sets an actual cap level by a separate decision (the G7/EU $60/bbl cap followed on 3 December 2022). The package also expands import bans on steel products (phased through 2024), firearms and ammunition, wood pulp and paper, and certain chemicals, cosmetics and jewellery materials; extends export bans on aviation-sector goods; bans the provision of architectural, engineering, IT-consultancy and legal advisory services to the Russian government and Russian companies; and imposes restrictions on Russian-flagged vessels at the Russian Maritime Register.

Council Regulation (EU) 2022/1903 amends Regulation (EU) 2022/263 so that its import ban and export restrictions, previously limited to the non-government-controlled areas of Donetsk and Luhansk, also cover the non-government-controlled areas of Ukraine's Kherson and Zaporizhzhia oblasts. It was adopted on 6 October 2022 alongside the eighth Russia sanctions package and entered into force the day after publication in the Official Journal.

Regulation (EU) 2022/1925 of the European Parliament and of the Council of 14 September 2022 on contestable and fair markets in the digital sector (Digital Markets Act, DMA) was published in OJ L 265 on 12 October 2022, entered into force on 1 November 2022, and applied for the most part from 2 May 2023. The DMA establishes an ex-ante competition framework imposing binding obligations and prohibitions on designated "gatekeepers" operating Core Platform Services (CPS) in the EU — covering search engines, social-networking services, video-sharing platforms, number-independent interpersonal communications, operating systems, web browsers, virtual assistants, cloud computing, online intermediation services, and online advertising. The European Commission designated six gatekeepers on 6 September 2023 (Alphabet, Amazon, Apple, ByteDance, Meta, Microsoft); full compliance with all obligations was required by 7 March 2024. Subsequent designations added Booking.com (May 2024) and Apple iPadOS (April 2024). The DMA functions as the EU's structural anchor for ex-ante digital competition regulation, closing the enforcement gap left by ex-post competition law (Articles 101–102 TFEU) where market-tipping dynamics make remedies ineffective after the fact.

The Council of the EU adopted Council Implementing Regulation (EU) 2022/878 of 3 June 2022, implementing Regulation (EU) No 269/2014 concerning restrictive measures in respect of actions undermining or threatening the territorial integrity, sovereignty and independence of Ukraine. The regulation adds 65 individuals and 18 legal entities to Annex I, subjecting them to an EU-wide asset freeze and a prohibition on EU persons or entities making funds or economic resources available to them. The listed entities span Russia's defense-industrial base, military-linked vehicle and tyre manufacturing, and financial-market infrastructure.

On 3 June 2022 the Council of the European Union adopted Regulation (EU) 2022/879, the sixth package of sanctions against Russia over the invasion of Ukraine, further amending Regulation (EU) No 833/2014. It bans the seaborne import of Russian crude oil and refined petroleum products, covering roughly two-thirds of EU oil imports from Russia at adoption (pipeline deliveries via Druzhba were temporarily exempted). It removes Sberbank, Credit Bank of Moscow and Russian Agricultural Bank from SWIFT (Annex XIV), bans EU operators from providing accounting, auditing, bookkeeping, tax consulting, business/management consulting and public-relations services to persons in Russia (new Article 5n), and adds three more Russian broadcasters to the EU broadcasting-suspension list (Annex XV). It entered into force on 4 June 2022, the day after publication in the Official Journal.

Regulation (EU) 2022/868 of the European Parliament and of the Council of 30 May 2022 on European data governance — the Data Governance Act (DGA) — was published in the Official Journal on 3 June 2022, entered into force on 23 June 2022, and became fully applicable on 24 September 2023. The DGA is the second pillar of the EU data-economy framework (alongside GDPR for personal data and the Data Act 2023/2854 for industrial/IoT data) and establishes four structural mechanisms: (i) a harmonised public-sector data re-use regime for protected data held by public-sector bodies; (ii) a mandatory notification and structural-separation regime for data-intermediation service providers; (iii) a voluntary recognition framework for data-altruism organisations (RDAOs); and (iv) the European Data Innovation Board (EDIB) to co-ordinate national competent authorities and advise on common European data spaces and interoperability standards. The regulation is the foundational parent statute of the existing French SREN law filing (2024-05-21) and functions as enabling legislation for the EU's sectoral common-data-space programme (Health, Agriculture, Finance, Mobility, Green Deal, Energy, etc.).

On 8 April 2022 the Council of the European Union adopted Regulation (EU) 2022/576, further amending Regulation (EU) No 833/2014 (the fifth package of measures against Russia). It bans imports of Russian coal and other solid fossil fuels, wood, cement, rubber, fertilisers, high-end seafood and spirits; bans exports to Russia of jet fuel, quantum computers, advanced semiconductors, high-end electronics and sensitive machinery; bars Russian and Belarusian road-freight operators from EU territory; and closes EU ports to Russian-flagged vessels. It entered into force on 9 April 2022, the day after publication in the Official Journal (OJ L 111).

On 15 March 2022 the Council of the European Union adopted Regulation (EU) 2022/428, amending Regulation (EU) No 833/2014 (the fourth package of measures against Russia). It bans imports, purchase and transport of the iron and steel products listed in a new Annex XVII that originate in or are exported from Russia, bans the sale or export of Annex XVIII luxury goods to Russia (above EUR 300 per item unless otherwise specified), and prohibits transactions with the Russian state-controlled entities listed in Annex XIX. The Regulation entered into force on the day after its publication in the Official Journal (OJ L 87 I, 15.3.2022), i.e. 16 March 2022.

On 2 March 2022 the Council of the European Union adopted Regulation (EU) 2022/355, amending Regulation (EC) No 765/2006 concerning restrictive measures in view of the situation in Belarus. It bans importing, purchasing or transporting products originating in or exported from Belarus in wood (Annex X), cement (Annex XI), iron and steel (Annex XII) and rubber (Annex XIII), and extends restrictions to potassium chloride ("potash"), tobacco and mineral products, plus a ban on exporting dual-use goods, machinery (Annex XIV) and goods usable for Belarus's military or security development. The measure responds to Belarus's active facilitation of Russia's invasion of Ukraine. It entered into force the day after publication in the Official Journal (OJ L 67, 2 March 2022), i.e. 3 March 2022, with a wind-down period to 4 June 2022 for pre-existing contracts.

On 25 February 2022, the day after Russia's full-scale invasion of Ukraine, the Council of the European Union adopted Regulation (EU) 2022/328, amending Regulation (EU) No 833/2014. It prohibits the sale, supply, transfer or export of dual-use goods and technology to any person, entity or body in Russia, or for military use or military end-users there, and extends to goods and technology suited for use in the oil refining industry and for the aviation and space industry, alongside a ban on related technical assistance, brokering, financing and insurance/maintenance services. The Regulation entered into force on the day after its Official Journal publication (OJ L 49, 25.2.2022), i.e. 26 February 2022.

Council Regulation (EU) 2022/263 prohibits importing into the EU any goods originating in the non-government-controlled areas of Ukraine's Donetsk and Luhansk oblasts, and bans the sale, supply, transfer or export of Annex II goods and technology (transport, telecommunications, energy, resource extraction) to those areas. It also bars new investment and financing there. It entered into force the day after adoption, 24 February 2022.