The legislation that affects your business, on a single radar.

The mechanism pricing embedded emissions in cement, steel, aluminium, fertilisers, electricity and hydrogen imported into the EU; the definitive regime began on 01.01.2026 and the duty sits with the EU importer, reaching Turkish producers contractually.

The Regulation admitting cattle, cocoa, coffee, oil palm, rubber, soya, wood and their derived products to the EU market only if deforestation-free; in force, applying from 30.12.2026, with Türkiye classified low risk.

The new regime treats software, updates and AI systems as products, eases the claimant’s burden of proof and makes the EU importer strictly liable; it applies to products placed on the market after 09.12.2026.

The Regulation imposing EU-wide cybersecurity requirements and CE marking on products with digital elements; a Turkish company placing such a product on the EU market is itself the manufacturer and cannot delegate these duties.

A framework statute covering every real and legal person operating in cyberspace in Türkiye; its incident reporting, procurement and audit duties, and the approval requirement for share transfers, are binding today.

The package the Commission published on 19.11.2025 is two separate proposals: the AI half was adopted and signed on 08.07.2026, while the data and GDPR half remains a proposal; nothing on the data side has changed.

The directive and German implementing act that place web stores selling to consumers in the EU under an accessibility obligation as of 28 June 2025; in Germany, violations carry the risk of fines up to €100,000 and warning notices.

Transparency, content-moderation and seller-traceability rules for online platforms and marketplaces: it directly shapes the platform relationships of Turkish sellers selling online into the EU.

A German law imposing human rights and environmental due diligence on large companies across their supply chains; the obligations flow through German buyers to Turkish suppliers by contract.

A directive imposing comprehensive sustainability reporting on large companies operating in the EU and selling into the EU market; the data requests reach Turkish suppliers too through the value chain.

The EU-scale counterpart of the LkSG: it imposes a human rights and environmental due diligence obligation on the largest companies across the value chain; it is expected to reach Turkish suppliers through a contractual cascade.

The world’s first comprehensive artificial intelligence regulation: risk-based classification, provider/deployer obligations, and a phased implementation timeline. It may also cover Turkish companies whose output is used in the EU.

Türkiye's framework law for e-commerce: the 2022 amendments introduced obligations on platforms that intensify with size, a licensing regime and prohibitions on unfair commercial practices.

The framework law that provides foreign investors in Türkiye with national treatment, freedom of transfer and protection against expropriation; the legal basis for company formation and investment structuring.

A regulation introducing safety, traceability and — critical for non-EU sellers — an EU-established “responsible person” requirement for consumer products sold in the EU; in force since 13 December 2024.

The LUCID packaging registration mandatory for every seller shipping to Germany, together with the EU Packaging Regulation (PPWR) taking effect on 12 August 2026; an authorised representative requirement is coming for non-EU sellers.

The framework of the EU data protection regime: it also directly covers Turkish companies that offer goods and services to persons in the EU or monitor their behaviour.

Türkiye’s data protection framework: the 2024 amendments re-established the regime for special-category data and cross-border transfers; the standard contract and notification to the Board are at the centre of practice.

Rules on access to, sharing of, and cloud switching for connected-product and related-service data: the regulation that re-establishes the contractual order of the data economy has been in application since September 2025.

A directive that ties cybersecurity in critical and important sectors to board-level responsibility; it reaches Turkish suppliers as well, through customers and group companies in the EU.