# Product safety, platform economy, data, security — and the ODR shutdown

Status as at 2026-08-05.

Scope tests and the handful of duties that reach an ordinary product. Each entry says whether the instrument is a Regulation or a Directive, because that decides whether the national skill has to add anything.

## Dispute resolution — the ODR platform is gone

**Regulation (EU) 2024/3228 of 19.12.2024** repealing Regulation (EU) No 524/2013 and amending Regulations (EU) 2017/2394 and (EU) 2018/1724 with regard to the discontinuation of the European Online Dispute Resolution Platform. OJ L, 2024/3228, 30.12.2024; in force 19.01.2025.

- **Art 1, verbatim: "Regulation (EU) No 524/2013 is repealed with effect from 20 July 2025."**
- **Art 2(2)**: submission of complaints to the ODR platform was discontinued on **20.03.2025**.
- **Art 2(4)**: all information, including personal data, was deleted at the latest by **20.07.2025**.
- **Art 14 of Regulation (EU) No 524/2013 — the duty on traders and marketplaces to provide an easily accessible link to the ODR platform — fell away with the repeal on 20.07.2025.** There is no successor obligation and no transitional provision preserving it.

An ODR link on a website today is a dead link. It is also a statement to consumers about a redress route that does not exist. Remove it wherever it appears — footer, terms, order confirmation emails, shop-system default templates, invoice templates. Never add it back, whatever a template says.

**Directive 2013/11/EU on consumer ADR remains in force** and was **not** amended by Regulation (EU) 2024/3228. Its Art 13 trader information duty about the competent ADR entity survives, transposed nationally.

**Directive (EU) 2025/2647 of 16.12.2025** amends Directive 2013/11/EU (and Directives (EU) 2015/2302, (EU) 2019/2161 and (EU) 2020/1828) following the ODR shutdown. OJ L, 2025/2647, 30.12.2025; in force 19.01.2026. **Transposition by 20.03.2028; member states apply the measures from 20.09.2028.** It is therefore a future obligation, not current law. Changes to note now for planning:

- Art 2(1) of 2013/11/EU replaced — scope extended to disputes with **third-country traders**, expressly to **digital content and digital services**, and to cases where the consumer provides **personal data** instead of a price.
- Art 13(2) replaced — the trader's ADR information must appear **(a) on the trader's website, where one exists, in a clear, prominent, comprehensible and easily accessible way** and **(b) in the general terms and conditions**. Art 13(3) replaced — where a dispute could not be resolved after a complaint made directly to the trader, the trader **must** provide that information to the consumer.
- Art 14 replaced — cross-border assistance is routed through designated **ADR contact points**, primarily the European Consumer Centres Network.
- Art 3 of 2025/2647 replaces Art 5(b) of Directive (EU) 2019/2161 with a referral to the competent centre of the **European Consumer Centres Network**, removing the ODR reference.

## GPSR — Regulation (EU) 2023/988

A Regulation. In force 12.06.2023, **applicable from 13.12.2024**; Directives 2001/95/EC and 87/357/EEC repealed with effect from the same date. Amended by **Regulation (EU) 2024/2748** (OJ 08.11.2024, applicable 29.05.2026), which added the Chapter IIa emergency procedures; Arts 2(2), 16, 19, 22 and 50–52 are unchanged.

- **Art 16 — responsible person in the Union.** A product **shall not be placed on the market unless there is an economic operator established in the Union** responsible for the tasks in Art 4(3) of Regulation (EU) 2019/1020. Eligible under Art 4(2) of that Regulation: an EU manufacturer, an importer, a mandated authorised representative, or an EU fulfilment service provider where none of the others exists. Art 16(2): regular checks against the technical documentation, with documented evidence on request. **Art 16(3): the name or trade mark and the postal *and electronic* address must appear on the product, its packaging, the parcel or an accompanying document** — stricter than Art 4(4) of Regulation (EU) 2019/1020, which requires only a postal address.
- **Art 19 — distance sales.** The online offer must show clearly and visibly, at least: (a) the **manufacturer's** name or trade mark and **postal and electronic address**; (b) where the manufacturer is not established in the Union, the name and postal and electronic address of the **responsible person**; (c) information identifying the product **including a picture of it**, its type and any other product identifier; (d) any warning or safety information to be affixed, in a language easily understood by consumers as determined by the member state where the product is made available.
- **Art 22 — online marketplaces.** Twelve paragraphs. Single point of contact for market surveillance authorities plus **registration on the Safety Gate Portal**; a separate point of contact for consumers; internal product-safety processes; act on authority removal or disabling orders **within two working days**; process DSA Art 16 notices concerning product safety **within three working days**; display the same four Art 19 items; trader self-certification plus DSA Art 30(1) data; DSA Art 23 suspension of repeat offenders; recall and consumer-notification duties. Keep the **two** and **three** working-day clocks apart.
- **Scope.** Art 3(1) defines a product as an **item**. Recital 17: "Services should not be covered by this Regulation", though products supplied in the context of a service are in scope. Software appears only as a safety **aspect** — Art 6(1)(b), (c) interconnection and non-embedded items, 6(1)(g) cybersecurity, 6(1)(h) evolving, learning or predictive functionalities, and Art 12(4)–(5) traceability of embedded software with six-year records.

  **There is no express clause excluding standalone software or digital-only products.** The exclusion rests on Recital 17 and on "item" in Art 3(1). State it that way; do not assert a clean digital carve-out. [[UNVERIFIED: whether Commission GPSR guidance settles standalone-software scope — check the Commission's GPSR guidance and FAQ]]

## Cyber Resilience Act — Regulation (EU) 2024/2847

A Regulation. In force **10.12.2024**. **Reporting obligations apply from 11.09.2026** — five weeks out. **Main obligations from 11.12.2027.** Covers connectable hardware and software, i.e. products with digital elements placed on the Union market. Any vendor shipping software or connected hardware needs a vulnerability-reporting and coordinated-disclosure process live before 11.09.2026. [[UNVERIFIED: the precise treatment of pure SaaS and cloud services under the CRA — the Commission's overview page does not resolve it; check Art 2 and the recitals of Regulation (EU) 2024/2847]]

## P2B — Regulation (EU) 2019/1150

A Regulation, applicable since **12.07.2020**. **Proposed for outright repeal by the Digital Omnibus, COM(2025) 837, procedure 2025/0360(COD). Still fully in force as at 05.08.2026** — the file is at European Parliament committee stage. Flag it as at risk in any long-lived text; do not treat it as repealed.

- **Scope, Art 1(2)**: online intermediation services and online search engines provided or offered to business users or corporate website users established or resident in the Union that offer goods or services to consumers located in the Union, **irrespective of the provider's place of establishment and of the law otherwise applicable**. Art 1(3) excludes online payment services and online advertising tools not aimed at facilitating direct transactions.
- **Art 2(2), three cumulative conditions** for an online intermediation service: an information society service; allowing business users to offer goods or services to consumers with a view to facilitating the initiating of direct transactions, wherever ultimately concluded; provided on the basis of a **contractual relationship** with the business user.
- **Art 3(1)** terms: plain and intelligible language; easily available **at all stages including the pre-contractual stage**; the grounds for suspension, termination or other restriction; information on additional distribution channels and potential affiliate programmes; general information on effects on intellectual property ownership and control. **Art 3(2)**: changes on a durable medium with a notice period of **at least 15 days**, longer where technical or commercial adaptation is needed. **Art 3(3): terms not meeting paragraph 1, and changes made contrary to paragraph 2, are null and void.**
- **Art 4**: a statement of reasons on a durable medium **prior to or at the time** a restriction or suspension takes effect; **at least 30 days' prior** notice with reasons for termination of the whole service, subject to the Art 4(4) exceptions.
- **Art 5**: main ranking parameters and the reasons for their relative importance, in the terms for intermediation services and in a publicly available description for search engines; the effect of **direct or indirect remuneration** on ranking; **Art 5(6): no duty to disclose algorithms, and without prejudice to Directive (EU) 2016/943** on trade secrets.
- **Small-enterprise reliefs, different scopes**: **Art 11(5)** disapplies the **whole of Art 11** (internal complaint-handling system); **Art 12(7)** disapplies only the **Art 12(1)** duty to name two or more mediators. Threshold: fewer than 50 persons and turnover and/or balance sheet total not exceeding EUR 10 million (Annex to Recommendation 2003/361/EC, Art 2(2)); the consolidation rules apply, so a small subsidiary of a large group does not qualify.
- Size-neutral duties: Art 7 differentiated treatment and self-preferencing disclosure, Art 8 specific contractual terms, Art 9 data access, Art 10 restrictions on offering different conditions by other means, Art 14 representative actions.

[[UNVERIFIED: the Commission Communication "Guidelines on ranking transparency pursuant to Regulation (EU) 2019/1150" is understood to be OJ C 424, 08.12.2020 (2020/C 424/01) — the OJ C reference was not re-verified; check before citing]]

## Data Act — Regulation (EU) 2023/2854

A Regulation. **Applicable from 12.09.2025**, but staged:

- the **Art 3(1)** access-by-design obligation applies to connected products and related services placed on the market **after 12.09.2026**
- Chapter III applies to data-availability obligations under law entering into force after 12.09.2025
- Chapter IV applies to contracts concluded after 12.09.2025, and **from 12.09.2027** to earlier contracts that are of indefinite duration or due to expire at least ten years from 11.01.2024

**Chapter II — user access.** Art 3(1): connected products and related services must be designed so that product and related-service data, including relevant metadata, are by default easily, securely, free of charge, in a comprehensive, structured, commonly used and machine-readable format and, where relevant and technically feasible, **directly accessible to the user**. Art 3(2)–(3): pre-contractual information on data type, format, volume, continuous or real-time generation, on-device versus remote storage and retention, and how to access, retrieve and erase. Arts 4–6: user access and third-party sharing rights. Arts 8–9: FRAND terms and compensation.

**Art 7 SME exemption — Chapter II only.** Chapter II does not apply to data generated by connected products manufactured or designed, or related services provided, by a **microenterprise or small enterprise**, provided it has no partner or linked enterprise that is not itself micro or small, and is not a subcontractor for the product or service. The relief extends to an enterprise that has been medium-sized for less than one year, and to its products for one year after a medium-sized enterprise placed them on the market. **There is no SME exemption in Chapters IV or VI.**

**Chapter IV — unfair data contract terms, between all enterprises.** Art 13(1): a term concerning access to and use of data, or liability and remedies for breach or termination of data-related obligations, that has been **unilaterally imposed by one enterprise on another**, is **not binding** on the latter if unfair. Art 13(3) test: the use grossly deviates from good commercial practice in data access and use, contrary to good faith and fair dealing. **Art 13(4) blacklist**: excluding or limiting liability for intentional acts or gross negligence; excluding remedies for non-performance; giving the imposing party the exclusive right to determine data conformity or to interpret any term. Art 13(5) greylist of presumptively unfair terms.

**Chapter VI — cloud switching.** "Data processing service" under Art 2(8) covers IaaS, PaaS and SaaS generally, not only hyperscalers. Art 23 remove obstacles; **Art 25** mandatory written contract with a **maximum transitional period of 30 calendar days** after the notice period, during which the contract stays applicable and the provider must give reasonable assistance, maintain business continuity and security, and flag continuity risks. **Art 29: from 12.01.2027, no switching charges at all**; reduced charges only in the interim, capped at costs directly linked to switching, with pre-contractual and published information duties. Art 31 carve-outs for custom-built services and for non-production test and evaluation versions.

The Digital Omnibus proposes to amend the Data Act. Pending.

## NIS2 — Directive (EU) 2022/2555

A **Directive**. Art 41(1): national measures adopted and published by **17.10.2024** and **applied from 18.10.2024**; Directive (EU) 2016/1148 repealed from the same date. Duties reach an entity only through national law — Art 46 addresses the directive to the member states, and every obligation is framed "Member States shall ensure that … entities …". Several member states transposed late; check the national skill for the actual commencement date.

**Size cap, Art 2(1)**: Annex I or II entity types that qualify as **medium-sized** under Art 2 of the Annex to Recommendation 2003/361/EC, **or exceed** those ceilings. In practice: an entity that fails the small-enterprise test — **staff of 50 or more, or turnover and balance sheet total above EUR 10 million**. Art 3(4) of the Annex is disapplied, so the 25 % public-body exclusion does not operate.

There is a genuine ambiguity here: Art 2(2) of the Annex reads "and/or" for the financial limbs, and the Commission's SME User Guide treats headcount as mandatory with only one financial ceiling needing to be met. The directive does not resolve it, and member states resolved it differently in transposition. Note it; do not paper over it. Note also that the EUR 43 million balance-sheet figure belongs to the 250-staff tier and has no place in the NIS2 size test.

**Art 2(2) — caught regardless of size**: providers of public electronic communications networks or publicly available electronic communications services; trust service providers; TLD name registries and DNS service providers; sole providers in a member state of a service essential for critical societal or economic activities; entities whose disruption could significantly impact public safety, security or health or induce significant systemic risk; entities critical because of their specific importance at national or regional level; and central-government public administration entities. Art 2(4) catches entities providing **domain name registration services**.

**Essential versus important — Annex I is not a synonym for essential.** Art 3(1): essential = Annex I types **exceeding** the medium-sized ceilings; qualified trust service providers, TLD name registries and DNS service providers regardless of size; medium-sized providers of public electronic communications networks or services; central-government public administration; and any Annex I **or II** entity designated by a member state. Art 3(2): all other Annex I or II entities are **important**. So a **medium-sized Annex I entity is important, not essential**, and all Annex II entities are important by default.

Digital sectors in scope:

- **Annex I point 8, digital infrastructure**: Internet Exchange Point providers; DNS service providers excluding root name server operators; TLD name registries; **cloud computing service providers**; **data centre service providers**; **content delivery network providers**; trust service providers; providers of public electronic communications networks; providers of publicly available electronic communications services.
- **Annex I point 9, ICT service management (B2B)**: **managed service providers; managed security service providers.**
- **Annex II point 6, digital providers**: **providers of online marketplaces; providers of online search engines; providers of social networking services platforms** — important entities by default.

**Art 21(2)** risk-management measures — a floor, "shall include at least": risk analysis and information system security policies; incident handling; business continuity including backup, disaster recovery and crisis management; **supply chain security including relationships with direct suppliers**; security in acquisition, development and maintenance including vulnerability handling and disclosure; policies to assess effectiveness; basic cyber hygiene and training; cryptography and where appropriate encryption; human resources security, access control and asset management; multi-factor or continuous authentication, secured voice, video and text communications and secured emergency communications where appropriate.

**Art 23(3) significant incident**, disjunctive: it has caused or is capable of causing severe operational disruption of the services or financial loss for the entity; **or** it has affected or is capable of affecting other natural or legal persons by causing considerable material or non-material damage.

**Art 23(4) clocks, running from becoming aware**: **early warning within 24 hours**, flagging any suspected unlawful or malicious cause and cross-border impact; **incident notification within 72 hours**, with an initial severity and impact assessment and indicators of compromise; an intermediate report on request; a **final report not later than one month** after the notification. Trust service providers must give the incident notification within **24 hours**.

**Commission Implementing Regulation (EU) 2024/2690 of 17.10.2024** is in force since **07.11.2024** and is **directly applicable**. It lays down technical and methodological requirements for Art 21(2)(a)–(j) and specifies when an incident is significant, for eleven relevant entity types: DNS service providers, TLD name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, providers of online marketplaces, of online search engines, of social networking services platforms, and trust service providers. It deliberately cuts across the annexes and does not cover IXP providers or non-digital sectors. **Art 3(1)(a): an incident is significant where it causes direct financial loss exceeding EUR 500 000 or 5 % of total annual turnover in the preceding financial year, whichever is lower.** Art 4 aggregates recurring incidents occurring at least twice within six months. It repeals Implementing Regulation (EU) 2018/151.

## Adjacent, flagged not covered

- **Regulation (EU) 2018/302 (geo-blocking)** — restricts discrimination in access to online interfaces, in general conditions of access to goods and services, and in payment, for traders selling cross-border within the Union. [[UNVERIFIED: regulation number, date of application and the exact three prohibited discriminations were not verified in this pass — check before relying on it]]
- **Directive (EU) 2020/1828** on representative actions for the protection of the collective interests of consumers — qualified entities can bring collective redress for breaches of most of the instruments in this skill, including the GDPR. Amended by Directive (EU) 2024/1799 and Directive (EU) 2025/2647.
- **Regulation (EU) 2022/1925 (DMA)** — gatekeepers only, by Commission designation. Not a general obligation.
- **Regulation (EU) 2022/868 (Data Governance Act)** — proposed for repeal by the Digital Omnibus.

## Checkpoints

- [ ] Project-wide full-text search for `odr`, `ec.europa.eu/consumers/odr`, "online dispute resolution", "ODR platform" across code, CMS content, shop-system defaults, email templates and invoices — **zero hits**
- [ ] National ADR entity named where a participation duty exists (Directive 2013/11/EU Art 13, national transposition)
- [ ] Directive (EU) 2025/2647 changes to ADR information duties diarised for 20.09.2028
- [ ] Physical products: responsible person established in the Union identified, named, with postal **and electronic** address on the product or packaging (GPSR Arts 16(1), 16(3))
- [ ] Product listings show manufacturer details, responsible person, product identifier **including a picture**, and warnings in the right language (GPSR Art 19)
- [ ] Marketplace: Safety Gate registration, two- and three-working-day clocks implemented (GPSR Art 22)
- [ ] Software or connected hardware vendor: vulnerability reporting and coordinated disclosure process live before **11.09.2026** (CRA)
- [ ] Business users under contract: P2B terms, 15-day change notice, statement of reasons, ranking parameter disclosure — and small-enterprise relief correctly scoped (Art 11(5) vs Art 12(7))
- [ ] Connected products or related services: Data Act Chapter II design and information duties, or documented Art 7 SME exemption
- [ ] Cloud or data processing services offered: switching contract terms, 30-day transitional period, **zero switching charges from 12.01.2027**
- [ ] Data-sharing contracts screened against the Art 13(4) blacklist
- [ ] NIS2 scope test run against Annex I and II and the size cap, with essential versus important classified correctly, and the **national** commencement date checked
- [ ] Where in scope and a listed digital provider: Implementing Regulation (EU) 2024/2690 requirements and the EUR 500 000 / 5 % significance threshold implemented
- [ ] All `[[…]]` placeholders resolved or reported as open