Legal changes in 2026: What companies should prepare for – New obligations and planned relief at a glance.

• In 2026, companies will probably have to implement a number of new obligations, particularly in the areas of digitalization, ESG and consumer protection.
• As part of the omnibus initiative, the start of some of the requirements has already been postponed; the final decision on further proposals by the EU Commission is still pending.
• As long as the obligations are not postponed, companies should be prepared for them to apply on the originally planned dates.

Rarely has the new year been as difficult for companies to plan as 2026.

All the signs in the EU are currently pointing towards reducing the burden on the economy. The EU wants to reduce bureaucracy and is rowing back with the Omnibus Initiative on the Green Deal and now also on digital legislation. This creates a dilemma for companies: easing the burden is good, but the economy also needs reliability. Even at the end of 2025, it is still uncertain in some areas what will apply in 2026. And as long as obligations have not been bindingly postponed or repealed, companies should prepare for them to apply on the original dates to be on the safe side.

Obligations for high-risk AI systems under the AI Act are expected to apply from August 2026

According to current knowledge, the comprehensive obligations of the AI Act will apply from August 2, 2026. The requirements for high-risk AI systems are particularly relevant. Providers then need robust risk management, high-quality and representative training data and complete technical documentation.

Transparency is key: AI-generated content must be clearly labeled and the functioning of AI systems must remain explainable. Human control is also mandatory in order to avoid autonomous decisions.

On November 19, as part of the so-called Digital Omnibus, the EU Commission proposed significantly postponing the date of application of these rules.

New reporting obligations under the Cyber Resilience Act from September 2026

From September 11, 2026, the first obligations under the Cyber Resilience Act (CRA) will apply: Manufacturers must then report actively exploited vulnerabilities and serious security incidents. The CRA has been in force since December 2024. For the first time, it sets out binding cyber security requirements for almost all products with digital elements that are connected to networks or data processing. In future, anyone placing digital products on the EU market must ensure that these products are secure and that risks are managed in accordance with the law. From June 11, 2026, conformity assessment bodies can officially act as “CRA Notified Bodies” – an important building block for CE marking from 2027.

Binding cyber risk management becomes mandatory – NIS2 Implementation Act in force

According to the NIS 2 directive, far more companies than before must have mandatory cyber risk management and clear security processes and report IT incidents quickly. In addition to operators of essential services, providers of digital services that were previously not subject to the regulations are now also affected. These include providers of cloud services, data centers and online marketplaces.

The German Implementation Act (NIS2UmsuCG) came into force on December 6, 2025.

Germany implements the CSRD

Germany should have implemented the Corporate Sustainability Reporting Directive CSRD by July 2024. In the meantime, the German implementation law is about to be passed. The current draft law is based on the EU requirement and stipulates that large companies with more than 1,000 employees must report for the first time in 2026 – on the 2025 financial year.

Stricter rules for environmental promises and “green” advertising

Germany must implement the Empowering Consumers for the Green Transition Directive (EmpCo) by March 27, 2026. Significantly stricter rules for “green” advertising are expected to apply from September 27, 2026: companies will only be allowed to make environmental claims (“green claims”) if they can objectively prove them. According to the EmpCo, sustainability seals must be based on a recognized certification system or be established by government bodies. The German government has already submitted a draft bill to amend the Unfair Competition Act.

EU deforestation regulation will most likely not apply until the end of 2026

According to the current legal situation, the EUDR deforestation regulation will apply from December 30, 2025. The EU Parliament and the Council have provisionally agreed to postpone the start until December 30, 2026. Small and micro enterprises will not even be affected until June 30, 2027. A final decision is expected to be made in 2025.

The EUDR affects market participants and traders who import, place on the market or export the relevant raw materials cocoa, coffee, soya, palm oil, beef, wood, rubber or certain products thereof. Anyone placing the aforementioned raw materials or relevant products on the market within the EU must be able to guarantee that no areas have been deforested for this purpose since December 31, 2020 and that they have been produced in accordance with the legislation of the country of production.

CBAM: Emissions trading from January 1, 2026

From January 1, 2026, the Carbon Border Adjustment Mechanism (CBAM) will enter its final phase, the emissions trading phase. It is intended to prevent companies from shifting their CO₂ emissions to countries with weaker climate protection rules by requiring them to pay a CO₂ border adjustment for CO₂-intensive imports. Importers must buy emission certificates for the emissions generated during production. As part of the second omnibus package, the EU has partially simplified the CBAM.

Many new obligations for packaging

The new EU packaging regulation will apply from August 12, 2026. It has been in force since February 11, 2025. The new regulation governs the entire life cycle of packaging.

Manufacturers, retailers, online stores, importers and distributors of packaging are obliged to comply. Germany will adapt its rules to the EU regulation in a new Packaging Implementation Act. A draft bill is already available, meaning that the new requirements are expected to come into force in 2026.

Take-back obligation for lithium-ion batteries

From January 1, 2026, public waste disposal authorities must take back lithium-ion batteries from e-bikes or e-scooters. Battery manufacturers are already obliged to set up collective collection systems for all categories of batteries and to deposit security deposits. This is regulated by the new Battery Law EU Adaptation Act, which aligns German law with the EU Battery Regulation. The application of the due diligence obligations under this EU regulation has been postponed to August 2027 in line with the proposal of the fourth omnibus package.

Manufacturers are obliged to offer repairs

Germany must transpose the “Right to Repair” Directive into national law by July 31, 2026. Manufacturers of certain product groups must then offer repairs at a “reasonable price and within a reasonable period of time”, even after the warranty period has expired. Consumers who choose repair instead of replacement within the scope of liability for material defects are to be rewarded with an extension of the warranty. The aim of the directive is to extend the service life of products.

New rules on product liability to be introduced by the end of the year

The new product liability directive must be implemented by December 9. The new Product Liability Directive applies to products that are placed on the market or put into operation after December 9, 2026. It covers both conventional and digital products such as robots and smart home systems. The new directive also stipulates that manufacturers from third countries whose products are sold on the EU market must always designate an economic operator in the EU from whom injured parties can claim compensation.

No reporting obligation under the Supply Chain Act

The German Supply Chain Due Diligence Act will continue to apply until the implementation of the European Supply Chain Directive CSDDD. In the meantime, however, the reporting obligation has been removed– as provided for in the coalition agreement. Sanctions will only be imposed for serious violations. In the long term, the reporting obligation is to be integrated into the CSRD report.

New obligations for lenders and credit intermediaries

The revised Consumer Credit Directive (CCD II) should have been transposed into German law as early as November 2025; a corresponding law is currently still being negotiated and is expected to be passed by early 2026 at the latest.

CCD II standardizes the rules within the EU. It also covers previously unregulated forms of credit such as Buy Now Pay Later, interest-free loans, microcredits and short-term loans. Stricter requirements will also apply to overdraft facilities in future. The directive also applies to market participants who broker loans.

The construction turbo is to provide new living space

The law to accelerate housing construction (“Bau-Turbo“) and to secure living space came into force on October 30, 2025. In order to create more living space, authorities can deviate from the provisions of the Building Code, development plans and the Land Use Ordinance until 2030. Project developers, real estate companies, housing cooperatives, property developers and investors can all benefit.

Investments and investment funds to become more attractive

On November 7, 2025, the federal government presented a draft bill for the Site Promotion Act, which is to be passed in 2026. It is intended to create incentives to found start-ups or invest in them. To make this possible, the roll-over rule is to be extended: If profits are reinvested, the maximum amount for tax-privileged capital gains will be raised from EUR 500,000 to EUR 2,000,000.

The Fund Risk Limitation Act is intended to modernize the regulatory framework for investment funds and facilitate citizen participation and lending by funds.

Rules on pay transparency are expected to apply from 2026

The EU Pay Transparency Directive must be transposed into German law by June 7, 2026.

Among other things, the directive stipulates that employers must provide information on salary levels in the job advertisement. Employees can request information on the average salary, broken down by gender, for comparable jobs.

Companies will also have to report on their gender pay gap and take action if necessary. Non-compliance could result in financial penalties.

Minimum wage increases on January 1, 2026

On January 1, 2026, the statutory minimum wage will rise to 13.90 euros per hour. The income threshold for mini-jobs will increase from 566 euros to 603 euros per month.

Jurisdictional amount in dispute of the local courts is raised to 10,000 euros

From January 1, 2026, the local courts will have jurisdiction for amounts in dispute up to 10,000 euros. Up to this amount, there will also be no obligation to hire a lawyer. For proceedings that are already pending, the old value limit of 5,000 euros for determining jurisdiction will remain in place. In addition, the thresholds for appeals will be raised.