EU Legislation Roundup: February 2026

Our EU Roundup highlights key developments that matter most, cutting through the noise to give you a clear, practical view of what is coming and what it means for your business. 

Staying informed on EU-level law helps you manage risk, maintain compliance and remain competitive in a fast-moving regulatory environment.

This edition, brought to you from our EU Knowledge Hub, highlights:

1. 2040 climate target Regulation
2. Corporate Sustainability Reporting and Corporate Sustainability Due Diligence Directives
3. Surface water and groundwater Directive
4. Counter-drone action plan
5. Action plan against cyberbullying
6. 20th Package of sanctions against Russia

EU: Council adopts 2040 climate target

On February 25, the Council adopted a regulation setting a binding EU climate target for 2040 under the European Climate Law. It aims to cut net greenhouse gas emissions by 90% and links the 2030 objectives with the 2050 climate neutrality goal. All sectors are expected to contribute through emissions reductions and carbon removals. International credits may be used within defined limits, while industrial transition is supported through the Clean Industrial Deal and relevant financial instruments.

Why this matters: The 2040 target locks in the EU’s direction and removes scope for delay or reversal. Long term capital allocation, sourcing strategies, and pricing assumptions may no longer hold. Assets or business lines that cannot decarbonise may become stranded or uneconomic. International credits offer limited flexibility, not a solution. You should test EU operations against a 2040 pathway now. Management should map exposure by sector and location. The board should decide which activities can transition, which need redesign, and which may require exit before value erodes.

EU: Council signs off Corporate Sustainability Reporting and Corporate Sustainability Due Diligence Directives

On February 24, the Council approved a package of measures simplifying sustainability reporting and due diligence rules with the stated aim of supporting EU competitiveness.

The Omnibus I package aims to reduce reporting requirements and simplify administrative processes for businesses. It defines the Corporate Sustainability Reporting Directive (CSRD) scope to firms with more than 1,000 employees and over €450 million turnover.  in addition, the Corporate Sustainability Due Diligence Directive is limited to largest businesses (over 5 000 employees and over €1.5 bn turnover).  The requirement for mandatory corporate climate transition plans is also removed.

Member states must adopt the rules by July 2028. Businesses must comply with the new rules by July 2029. Penalties are set at national level, capped at 3 % of global turnover.

Why this matters: The scope change removes many groups from direct obligation, but those still in scope will face deeper challenge. Supervisors will look at how risks are managed in practice, not how policies read. Weak supplier oversight or poor remediation will be harder to defend. Groups near the thresholds should expect shifting coverage as headcount and revenue change. You should reassess whether current reporting and due diligence programmes are oversized or misaligned. The board should reset accountability, budgets, and risk focus ahead of national enforcement regimes and turnover-based penalties.

EU: Stricter surface water and groundwater protection rules adopted

On February 17, the Council of the European Union adopted a directive updating pollutant lists for surface and groundwater. It also strengthens EU water quality rules through expanded monitoring and revised environmental standards.

The latest update expands monitoring to include pesticides, pharmaceuticals, bisphenols and PFAS, while tightening standards for several existing substances. The revised rules introduce methods to assess cumulative risks from combined chemicals and enhance monitoring and reporting across Member States..

Why this matters: Water regulation is tightening and costs will rise across manufacturing, chemicals, food, and pharmaceuticals. Old permits may no longer protect your operations. Products using PFAS or similar substances may need reformulation or withdrawal. Poor monitoring can trigger enforcement even without environmental damage. You should audit water use, discharges, and supplier practices now. Expect capital spend for treatment, monitoring, and site upgrades. The board should assess long-term site viability, supply continuity, and investment priorities.

EU: Commission unveils new counter-drone security plan

On February 11, the European Commission presented an action plan to address growing security threats from drones. The plan aims to strengthen preparedness, improve detection, and support coordinated responses across Member States. It introduces a Counter Drone Centre of Excellence, an EU Trusted Drone label, and guidance to protect critical infrastructure.

The initiative also backs 5G based detection tools, a Drone Incident Platform, and joint procurement efforts. It further promotes cross border emergency exercises to improve operational readiness. A broader Drone Security Package is expected by Q3 2026.

Why this matters: Drone risk is becoming a live business issue, not only a public security concern. Your sites, logistics hubs, and senior personnel may face higher protection expectations from regulators and insurers. If you operate critical infrastructure, scrutiny will increase and security failures may drive liability and service disruption. Use of drones in EU operations may soon depend on trusted certification. Security budgets may need to shift toward approved detection tools and shared procurement models. You should map exposure across EU locations, review security and telecoms contracts, and brief the board on resilience, cost, and accountability.

EU: Action plan against cyberbullying adopted

On February 9, the European Commission adopted an action plan against cyberbullying. It aims to strengthen the online mental health protection of children and young people. The plan seeks to reduce harmful online behaviour and improve EU wide responses. It enhances reporting tools to address incidents more effectively. It promotes coordinated national strategies to strengthen prevention efforts. It also supports safer digital practices for minors across the EU.

It may lead to reinforced guidance under existing legislation such as the Digital Services Act. And could influence future updates in related media and artificial intelligence policies. The Commission also intends to boost digital literacy and provide training resources for educators and parents, supporting early prevention of cyberbullying.

Why this matters: Digital services that reach minors will face closer supervision, even without new legislation. Existing safeguards may be judged against tougher expectations set through guidance and enforcement practice. Weak reporting tools or slow moderation can trigger regulatory action and serious reputational damage. Product design choices affecting children will attract scrutiny, not only content policies. You should review reporting flows, moderation capacity, and age appropriate design now. Treat child safety as an operational risk, not a communications issue. The board should own oversight, resources, and escalation pathways across the business.

EU: 20th Package of sanctions against Russia announced

On February 6, the European Commission proposed its 20th sanctions package against Russia, targeting energy, finance and trade. It aims to introduce a full maritime services ban for Russian crude oil and adds 43 more shadow fleet vessels, totalling 640.

The package tightens restrictions on LNG tankers and icebreakers and limits Russia’s ability to acquire new tankers. It sanctions 20 additional regional banks and targets crypto related circumvention channels. It also imposes export bans worth €360 million and import bans worth €570 million, while activating the anti circumvention tool.

Why this matters: Sanctions exposure is expanding and becoming harder to ring fence. Maritime, energy, finance, and crypto links now carry higher risk, including through indirect routes. Dealings that were lawful at signing may become illegal during performance. Vessel use, payment flows, and trade finance face closer scrutiny. You should re screen counterparties, ships, insurers, and banks across the transaction lifecycle. Contracts should be reviewed for suspension and exit rights. Management must tighten escalation and controls. The board should confirm that rapid exit strategies and loss containment plans are ready to deploy.

Further reading

Managing M&A uncertainty in the EU’s evolving regulatory landscape

EU: Future digital company law rules set to transform corporate administration

Proposal for an EU Regulation introducing measures to strengthen the biotechnology sector (“European Biotech Act”)

Co-authored by Uendi Barreti, Paola Paccani and Clare Johnston (Knowledge)