Overview

EU rules that end up on your desk

Most EU rules do not mention companies in South America by name. Your customers in the EU still have to comply with them, and they pass the requirements on to you through contracts, questionnaires and audits.

Rules9

Next deadlineEUDR, Dec 30, 2026

Applies toExporters and service providers

EU rule · Cybersecurity

NIS2

What NIS2 means for IT service providers, software firms and industrial suppliers in South America: duties, reporting deadlines, proof for EU clients.

EU rule · Financial sector

DORA

DORA requires EU banks and insurers to vet their IT providers closely. The clauses and evidence that South American providers need to have ready.

EU rule · Data protection

GDPR

When the GDPR applies to South American firms, what adequacy means for Argentina, Brazil and Uruguay, and which contracts EU customers ask for.

EU rule · Artificial intelligence

AI Act

When the AI Act applies to South American software firms, which deadlines apply after the Digital Omnibus, and what evidence EU customers ask for.

EU rule · Product security

Cyber Resilience Act

The CRA covers connected products and software in the EU: reporting since Sep 11, 2026, all duties from Dec 11, 2027. What manufacturers need to do.

EU rule · Supply chain

EUDR

EUDR from Dec 30, 2026: what exporters of soy, cattle, coffee, cocoa, wood, rubber and palm oil in South America must supply, with country ratings.

EU rule · Climate and customs

CBAM

CBAM has been in its definitive period since Jan 1, 2026. The emissions data South American makers of steel, aluminum, fertilizer and hydrogen must supply.

EU rule · Sustainability

CSDDD and CSRD

CSDDD and CSRD after Omnibus I: new thresholds, deadlines up to 2029 and what data EU customers may request from suppliers based in South America.

EU rule · Human rights

Forced Labour Regulation

From Dec 14, 2027, the EU bans products made with forced labor, with no thresholds. The evidence South American exporters should start preparing now.

In brief

This page covers nine EU rules that buyers in Europe are asking about today. Each subpage explains who the rule affects in South America, when it applies, what evidence EU customers ask for and how to get started. The information is based on the Official Journal of the EU and the European Commission's own pages. For your own country, the country pages compare local law with EU law, for example for Brazil, Argentina or Chile.

Directly or through your customers

Some rules apply to you directly as soon as you do business on the EU market. The GDPR kicks in when you offer goods or services to people in the EU. The AI Act and the Cyber Resilience Act apply to providers and manufacturers wherever they are based. For the other rules, the legal obligation sits with your EU customer. But your customer can only meet it if you deliver: geolocation data for the EUDR, emissions data for CBAM, security evidence for NIS2 and DORA.

Key deadlines

Date	What applies
since Jan 1, 2026	CBAM, definitive period
since Sep 11, 2026	Cyber Resilience Act, reporting obligations
Dec 30, 2026	EUDR for large and medium-sized companies
Dec 2, 2027	AI Act, high-risk systems under Annex III
Dec 11, 2027	Cyber Resilience Act, all obligations
Dec 14, 2027	Forced Labour Regulation
Jul 26, 2029	CSDDD

What about the trade agreement?

Since May 1, 2026, the EU-Mercosur Agreement has been lowering tariffs for Argentina, Brazil, Paraguay and Uruguay. It does not exempt anyone from these rules. The same goes for the agreements with Chile, Colombia, Peru and Ecuador.

How to proceed

Start with the rules that affect your industry. For agriculture and food, that means the EUDR and the forced labor ban; for manufacturing, CBAM and the CRA; for IT and software, NIS2, DORA, the GDPR and the AI Act. A lot of the evidence overlaps. A certificate under ISO/IEC 27001 or ISO 14001 answers questions on several rules at once. A GRC platform such as Sightadel lets you record that evidence once and reuse it for the next framework. The free EU Readiness Check shows which rules matter in your case.

FAQ

Do I have to comply with all nine rules?

No. Which ones apply depends on your industry, product and customers. A software company has nothing to do with the EUDR, and a soy exporter will rarely deal with DORA.

Does the EU-Mercosur Agreement exempt me from these rules?

No. The agreement covers tariffs and rules of origin. The EU rules apply to goods from every country.

Where do I start?

With the EU Readiness Check. In ten minutes it shows which rules matter for you and where the gaps are.

Which tools help with the security rules?

For NIS2, DORA, the GDPR and the AI Act, Sightadel provides templates, tasks and evidence per framework and is hosted in Germany. veyrisk checks your externally visible attack surface, which many security questionnaires ask about.

Sources · Last updated: October 11, 2026

General information, not legal advice. The official texts are authoritative.

Trade · Agreements