2026 Regulatory Overview: What Has Come into Force This Year and Everything Coming in 2027

2026 has been a year in which a significant amount of digital legislation has come into force, requiring websites to adapt in order to comply with all the new legal requirements.

A withdrawal button on websites, a warranty notice, labelling of AI-generated or AI-modified content, warranty notices...

In this article, we review the legislation that has come into force during 2026, what it means in practice for your website or e-commerce business, and what lies ahead in 2027, a year that will bring even more regulatory changes.

2026 at a Glance

1. The Withdrawal Button (19 June)

The right of withdrawal was not new: consumers already had the right to withdraw from a distance purchase within 14 calendar days. What changed on 19 June was how this right could be exercised. Consumers must now be able to withdraw just as easily as they can make a purchase, through a specific, visible and easily identifiable function.

For e-commerce businesses, this meant making changes to their website design to ensure compliance with the following requirements:

• Symmetry: If consumers can enter into a contract with one click, they must be able to withdraw with one click.
• Visibility: It cannot be hidden in the FAQs; it must be located somewhere easy to find, such as the customer account area, order history or footer.
• Unambiguous labelling: It must be a button with wording such as "Exercise right of withdrawal" or "Withdraw from purchase", without using wording that could cause confusion.
• No dark patterns: The process must not be more complicated or hidden.
• Accessibility: It must be compatible with screen readers, feature good contrast and use a legible font size.
• Confirmation on a durable medium: Immediate and durable confirmation must be provided, for example by email.
• Management of exceptions: For personalised goods, perishable products or products sealed for hygiene reasons, consumers must be clearly informed that no right of withdrawal applies.
• Updated legal texts: The terms and conditions of purchase and pre-contractual information must explain that the button exists, where it can be found and how to use it.

Remember that if you fail to provide consumers with the correct information about their right of withdrawal before the purchase, the withdrawal period is extended to 12 months.

If you have not reviewed this yet, you can find all the information in our Guide to the Withdrawal Button and in the article Withdrawal Button: New Requirement for E-commerce Businesses from June 2026. And if you are unsure about the differences between these concepts, we have also explained the differences between withdrawal, returns and the legal guarantee.

2. The AI Act Comes to Your Website (2 August and 2 December)

On 2 August 2026, the transparency obligations set out in Article 50 of the Artificial Intelligence Act came into force, introducing the following requirements:

• Chatbots and virtual assistants: Users must be informed from their first interaction that they are communicating with a machine.
• AI-generated or manipulated content: Images, videos, audio and text must be identifiable as having been generated or manipulated using AI.
• Intelligent search engines and recommendation systems: Users must be informed that results are mediated by AI and personalised according to their behaviour.
• Virtual try-on tools and biometric data: If you use the customer's camera, you must provide information beforehand and comply with the GDPR's data minimisation principle.
• Artificial Intelligence Policy: You must have an AI usage policy describing the AI systems active on your website.

Penalties for failing to comply with transparency obligations can reach up to €15 million or 3% of global annual turnover, with the lower of the two amounts applying to SMEs.

The AI Act implementation schedule has been phased in through the AI Digital Omnibus. 2 December 2026 will be the date by which providers of generative AI systems placed on the market before 2 August 2026 will have to comply with machine-readable marking of artificial content. On the same date, the new prohibited practices under Article 5 relating to non-consensual intimate material ("nudification") and child sexual abuse material will begin to apply.

If you want to discover all the obligations under the AI Act, do not miss What Is the AI Act and How Does It Affect Your Website?. And if you want to automate the detection and labelling of AI content on your e-commerce website, AI Sentinel is designed for that purpose.

3. Harmonised Notice and the «GARAN» Label (27 September)

Since 27 September 2026, all shops, both physical and online, have been subject to new information requirements regarding guarantees:

• The harmonised notice reminds consumers of their minimum rights: a minimum duration of two years across the EU, available remedies (repair, replacement, price reduction or refund), the fact that national legislation may extend these rights, and a QR code linking to the "Your Europe" portal. In Spain, the duration for new goods is 3 years.
• The «GARAN» label is only mandatory when four conditions are met simultaneously: the producer offers a commercial durability guarantee at no additional cost, covering the entire product, for more than two years, and provides this information to the trader.

You can find a comprehensive guide in our article Harmonised Notice and GARAN Label: A Guide for E-commerce Businesses.

4. Consumer Credit: CCD2 (20 November)

Directive (EU) 2023/2225 extends its scope to microloans of less than €200, Buy Now, Pay Later (BNPL) services and leasing. If you offer financing in your store or integrate deferred payment providers, these are the key changes:

• Advertising must include the warning "Warning: borrowing money costs money" and must not suggest that credit improves a person's financial situation, replaces savings or that being listed in a credit default register has no bearing on the assessment.
• Creditworthiness assessments and the right to human intervention when a decision is automated.
• If prices or offers are personalised through automated processing, consumers must be informed.
• Unsolicited credit, pre-ticked boxes and tied selling are prohibited.
• Restructuring must be considered before enforcement proceedings are initiated, and financial difficulties must be detected at an early stage.

5. Defective Products (9 December)

Directive (EU) 2024/2853 adapts strict liability to the digital age. The concept of "product" now includes software, applications and AI systems. Factors such as cybersecurity and the ability of AI to learn after a product has been placed on the market are also taken into account.

6. Customer Service: Law 10/2025 (28 December)

This legislation applies to large companies (more than 250 employees, more than €50 million in turnover or more than €43 million in total assets), all providers of essential services and the General State Administration. The main measures are as follows:

• The option to speak to a real person from the outset; the exclusive use of bots is prohibited.
• 95% of calls must be answered within an average time of less than 3 minutes.
• Complaints must be resolved within a maximum of 15 working days, with a tracking reference and confirmation on a durable medium.
• Accessible customer service, with priority assistance for people over 65.

7. EUDR: Regulation Against Deforestation (30 December)

Regulation (EU) 2023/1115 applies to cattle, cocoa, coffee, palm oil, rubber, soya and wood, as well as the derived products listed in Annex I.

• Operators must implement a three-stage due diligence system (collect information including the geolocation of plots of land, assess the risk and mitigate it), submit a declaration through the EU information system, retain records for five years and pass reference numbers along the supply chain.
• Non-SME traders have the same obligations as operators.
  • SME traders only have traceability obligations: they must retain supplier and customer data and reference numbers for five years, cooperate with the authorities and report risks or non-compliance. If their supplier has already submitted the due diligence statement, they do not need to submit it again: they only need to request, retain and provide the reference number when asked.

8. Unsold Products and Ecodesign

Since 19 July 2026, large companies have been prohibited from destroying unsold clothing, clothing accessories and footwear. Medium-sized companies will be subject to this prohibition from 19 July 2030, while micro and small enterprises are exempt.

What's Coming in 2027

If 2026 has been intense, 2027 will be no different. Here is the schedule you should keep in your diary:

1. Cognitive Accessibility: Royal Decree 707/2026 (2 January)

On 2 January 2027, an obligation will come into force that affects almost all websites because it goes beyond technical accessibility (text typography, contrast, lighting, etc.) and requires clear language and easy-to-read content to ensure full comprehension.

In parallel, confirmation in the Official Journal of the European Union (OJEU) of the harmonised standard EN 301 549 V4.1.1, based on WCAG 2.2 Level A and AA guidelines, is still pending. At Lawwwing, we offer a solution to help you prepare your website through our accessibility widget.

2. Packaging and Packaging Waste Regulation: PPWR (12 February)

The PPWR introduces two changes that affect e-commerce and, above all, the hospitality and catering sectors.

• Digital identification of EPR compliance: Packaging marketed by online shops or platforms can be identified through a QR code indicating that the producer complies with the Extended Producer Responsibility (EPR) scheme.
• Customers' own containers in the hospitality sector: Final distributors in the hospitality and catering sectors that sell takeaway food and drinks must allow customers to bring their own containers.

3. Digital Battery Passport: Regulation (EU) 2023/1542 (18 February)

The Batteries Regulation governs the entire life cycle of batteries, and on 18 February 2027 the digital battery passport will become mandatory for batteries used in light means of transport (LMT), rechargeable industrial batteries exceeding 2 kWh and electric vehicle batteries.

It must be accessible through a QR code printed or engraved on the battery itself (or on its packaging or documentation if the battery is too small) and must include performance, traceability, sustainability and composition data.

4. Unsold Consumer Products and Ecodesign (2 March)

Companies must disclose information about unsold consumer products that they discard, in accordance with the Ecodesign Regulation (EU) 2024/1781. From 2 March 2027, large companies will have to publish information about consumer products discarded during the previous financial year. Medium-sized companies will have to comply with this reporting obligation from 19 July 2030.

5. Right to Repair: Directive (EU) 2024/1799 (31 July)

The deadline for transposing Directive (EU) 2024/1799 is 31 July 2027. The Directive aims to facilitate the repair of goods instead of their replacement and, in Spain, must be implemented through the Sustainable Consumption Act.

In this regard, European legislation establishes the following:

• European Online Platform for Repairs: A digital meeting point where consumers can find repairers and sellers of refurbished goods.
• Pre-repair information: Repairers must provide standardised information about the service conditions through a European form.
• Promoting repair over replacement: The legislation strengthens the right to repair within the legal guarantee period and requires manufacturers of certain products to carry out repairs under reasonable conditions.

6. Cyber Resilience Act (11 December)

On 11 December 2027, the Cyber Resilience Act will become generally applicable. Companies selling hardware and software products must ensure that these products have been designed to be secure by design, with security-by-default requirements, access control, the use of cryptography and automatic updates.

Manufacturers' Obligations

1. Before placing products on the market: Assess risks to determine how to apply the essential cybersecurity requirements, prepare technical documentation explaining how these requirements are met and carry out the conformity assessment procedure.
2. When placing the product on the market: Affix the visible, legible and indelible CE marking, issue the EU declaration of conformity, indicate the support period (how long the product will be maintained) and provide information and instructions for use.
3. After placing the product on the market: Manage vulnerabilities throughout the entire support period and report vulnerabilities and serious incidents affecting product security.

Importers' Obligations

Before selling a product, importers must verify that the manufacturer has carried out the conformity assessment, prepared the technical documentation, affixed the CE marking and included the instructions for use.

7. EUDR and Wood Produced Before 2023 (31 December)

On 31 December 2027, the regulatory calendar concludes with a specific date under Regulation (EU) 2023/1115: all wood and wood products produced before 29 June 2023 that are placed on the EU market must comply with the general requirements of Article 3.

In practice, that wood must:

• Be free from deforestation and forest degradation: It must have been harvested without causing deforestation or forest degradation after 31 December 2020.
• Comply with the legislation of the country of production: This includes land-use rights, forest management, environmental protection, labour rights and human rights.
• Be covered by a due diligence statement registered in the EU information system.

Conclusion

2026 has taught us one important lesson: regulatory compliance requires constant adaptation. The entry into force of new obligations, the updating of criteria by the authorities and increasingly stringent requirements concerning privacy, cookies, e-commerce and artificial intelligence have demonstrated that businesses that simply draft their legal texts once and leave them unchanged run the risk of falling behind and exposing themselves to penalties, loss of trust and problems with their users.

Keeping a website compliant with the law is not just about avoiding fines: it is also a way to build trust, improve transparency with your customers and provide added value. In an ever-evolving regulatory environment, the key is to anticipate changes and use automated tools that allow you to maintain ongoing compliance.

At Lawwwing, we closely monitor every regulatory change to keep your legal texts automatically up to date. We also help you implement the new requirements affecting your website, so you can focus on what really matters: your business, with the peace of mind of knowing that your website is always compliant with all applicable requirements.