Industrial Policy & Trade Monitor· 2662 actions· ✨ 89 recent

Korea's National Assembly passed amendments to Chapter V of the Act on the Adjustment of International Taxes (AITA) on 23 December 2022; promulgated 31 December 2022. The amendment codifies the OECD/G20 Pillar Two GloBE (Global Anti-Base Erosion) rules — specifically the Income Inclusion Rule (IIR) — directly within Korea's existing international-tax statute (Articles 60–83), making Korea the first jurisdiction globally to enact binding primary legislation implementing Pillar Two. The IIR applies to Korean members of MNE groups with consolidated revenue ≥ EUR 750 million for fiscal years beginning on or after 1 January 2024; the Undertaxed Profits Rule (UTPR) was subsequently delayed by the 2024 tax reform bill to fiscal years beginning on or after 1 January 2025. Korea did not initially adopt a Qualified Domestic Minimum Top-up Tax (QDMTT); proposals to add one have been debated in subsequent amendment cycles. The law directly interacts with the K-Chips Act (2023) enhanced investment tax credits: those credits reduce Korean effective tax rates and may trigger Pillar Two top-up exposure unless structured as Qualifying Refundable Tax Credits.

Directive (EU) 2022/2557 of the European Parliament and of the Council of 14 December 2022 on the resilience of critical entities, published OJ L 333, 27 December 2022, entered into force 16 January 2023, with Member State transposition deadline 17 October 2024 (rules applicable from 18 October 2024). The CER Directive repeals Council Directive 2008/114/EC on European Critical Infrastructures, extending the scope from two sectors (energy, transport) to eleven essential-service sectors: energy, transport, banking, financial market infrastructures, health, drinking water, wastewater, digital infrastructure, public administration, space, and food. Member States must adopt national resilience strategies, conduct risk assessments at least every four years, identify "critical entities" providing essential services whose disruption would have significant cross-border impacts, and ensure those entities implement technical, security, and organisational resilience measures, business-continuity plans, incident-reporting obligations, and personnel-security background checks. The CER Directive is the physical and hybrid resilience twin to the NIS2 Directive (2022/2555) — the two instruments form the binding EU critical-infrastructure-protection architecture replacing the 2008/114/EC regime.

Regulation (EU) 2022/2554 (Digital Operational Resilience Act, DORA) is the EU's first horizontal cyber- and ICT-resilience instrument for the financial sector. Adopted 14 December 2022 and published in the Official Journal on 27 December 2022, it entered into force on 16 January 2023 and applies from 17 January 2025. DORA covers approximately 22,000 EU regulated financial entities across ~20 entity types (credit institutions, insurers, investment firms, CCPs, trading venues, crypto-asset service providers, etc.) under five pillars: ICT risk management, ICT-incident reporting, digital operational resilience testing (including threat-led penetration testing for significant entities), ICT third-party risk management, and information sharing. Structurally novel, DORA establishes the Critical ICT Third-Party Provider (CTPP) oversight regime under which the European Supervisory Authorities (EBA, ESMA, EIOPA) acquire direct supervisory powers over hyperscale cloud providers (AWS, Azure, GCP, Oracle) servicing EU financial entities — the first EU mechanism for ESA direct oversight of non-financial cloud providers.

Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive), published OJ L 333, 27 December 2022, entered into force 16 January 2023. NIS2 repeals and substantially expands the 2016 NIS1 Directive (2016/1148), extending the scope from ~7 sectors to 18 enumerated essential and important sectors, imposing binding cybersecurity risk- management and incident-reporting obligations on covered entities, introducing board-level management accountability, and mandating Member State transposition by 17 October 2024. NIS2 is the structural EU statutory anchor for national cybersecurity frameworks across the bloc, operating alongside DORA (Reg 2022/2554) for financial-sector digital resilience and CRA (Reg 2024/2847) for product cybersecurity.

Council Directive (EU) 2022/2523, adopted 14 December 2022 and published in OJ L 328 on 22 December 2022, transposes the OECD/G20 Inclusive Framework Pillar Two model rules into binding EU law. It requires all 27 Member States to impose a minimum 15% effective tax rate (ETR) on the jurisdictional income of MNE groups with consolidated annual revenue ≥ EUR 750 million via three interlocking charges: an Income Inclusion Rule (IIR) for fiscal years beginning on or after 31 December 2023, an Undertaxed Profits Rule (UTPR) backstop from 31 December 2024, and an optional Qualified Domestic Minimum Top-up Tax (QDMTT). The directive is the largest international-tax instrument in EU history and the operative legal anchor for the cross-border Pillar Two architecture inside the single market, structurally rebalancing FDI location decisions for an estimated 12,000+ in-scope MNE groups globally.

Regulation (EU) 2022/2065 on a Single Market For Digital Services (Digital Services Act, DSA) was adopted by the European Parliament and Council on 19 October 2022, published in OJ L 277 on 27 October 2022, entered into force on 16 November 2022, and applied in full from 17 February 2024 (with VLOP/VLOSE obligations applying from 25 August 2023 following the Commission's initial designation letters of February 2023). The DSA establishes a graduated intermediary-liability and platform-safety framework covering all online intermediaries serving EU users, with the heaviest obligations falling on designated Very Large Online Platforms (VLOPs, ≥45m monthly active EU users) and Very Large Online Search Engines (VLOSEs): systemic-risk assessments, annual independent audits, vetted-researcher data access, recommender-system transparency, online-advertising transparency, and crisis-response cooperation mechanisms under Commission coordination. The European Commission holds exclusive enforcement authority over VLOPs and VLOSEs, with fines up to 6% of global turnover. The DSA is the structural twin-pillar to the Digital Markets Act (Reg (EU) 2022/1925): the DMA governs ex-ante competition obligations on designated gatekeepers; the DSA governs ex-post intermediary-liability, content-moderation, and platform-safety obligations across all online intermediaries.

Regulation (EU) 2022/1925 of the European Parliament and of the Council of 14 September 2022 on contestable and fair markets in the digital sector (Digital Markets Act, DMA) was published in OJ L 265 on 12 October 2022, entered into force on 1 November 2022, and applied for the most part from 2 May 2023. The DMA establishes an ex-ante competition framework imposing binding obligations and prohibitions on designated "gatekeepers" operating Core Platform Services (CPS) in the EU — covering search engines, social-networking services, video-sharing platforms, number-independent interpersonal communications, operating systems, web browsers, virtual assistants, cloud computing, online intermediation services, and online advertising. The European Commission designated six gatekeepers on 6 September 2023 (Alphabet, Amazon, Apple, ByteDance, Meta, Microsoft); full compliance with all obligations was required by 7 March 2024. Subsequent designations added Booking.com (May 2024) and Apple iPadOS (April 2024). The DMA functions as the EU's structural anchor for ex-ante digital competition regulation, closing the enforcement gap left by ex-post competition law (Articles 101–102 TFEU) where market-tipping dynamics make remedies ineffective after the fact.

Government Decree 53/2022/ND-CP, signed 15 August 2022 and effective 1 October 2022, implements Article 26 of Vietnam's 2018 Law on Cybersecurity. It mandates in-country storage of three categories of data — personal data of users in Vietnam, user-generated data, and user-relationship data — for both domestic and foreign cyberspace- service providers, with a minimum 24-month retention period. Foreign enterprises providing telecoms, data storage, domain names, e-commerce, online payments, social networks, online video games, or messaging services to users in Vietnam must establish a Vietnamese branch or representative office within 12 months of a Minister of Public Security written request. The decree closes a four-year implementation gap on the 2018 Cybersecurity Law and is the principal Vietnamese digital-trade barrier alongside Decree 13/2023/ND-CP (Personal Data Protection).

Russian Government Resolution No. 506 of 29 March 2022, signed by Prime Minister Mikhail Mishustin and effective 30 March 2022, authorises the Ministry of Industry and Trade (Minpromtorg) to designate categories of goods exempt from articles 1252(4), 1359(6) and 1487 of the Russian Civil Code on national/regional exhaustion of trademark and other intellectual- property rights. Followed by Minpromtorg Order No. 1532 of 19 April 2022 publishing an initial list of 55 goods categories and named brands — including pharmaceuticals, electronics, automotive parts, mineral fuels, industrial chemicals, paper, textiles, base metals, and consumer goods — for which parallel (grey-market) imports without IP-holder consent are legalised. Designed as a sanctions-circumvention and supply-substitution instrument after the Western corporate exodus of March 2022; extended annually and most recently re-authorised through 31 December 2026.

The Government of Serbia adopted, on 20 January 2022, the "Uredba o prestanku važenja Uredbe o utvrđivanju Prostornog plana područja posebne namene za realizaciju projekta eksploatacije i prerade minerala jadarita 'Jadar'" — a decree terminating the 2020 Spatial Plan of the Special Purpose Area (SPSPA, Sl. glasnik RS 26/2020) that had underpinned Rio Tinto's Jadar lithium-borate project in the Mačva District. Published in Sl. glasnik RS br. 8/2022. Five days later, on 25 January 2022, the Ministry of Environmental Protection separately annulled its decision approving the project's environmental impact assessment study. Together the two acts cancelled all administrative permits, decisions and resolutions tied to the Jadar project, following weeks of nationwide protests against the mine.