The European regulatory landscape continues to evolve in response to new challenges related to artificial intelligence, cybersecurity, sustainability, and the circular economy. For companies, anticipating these regulatory changes is not only a matter of compliance—it also helps manage risks, adapt processes, and navigate new regulatory scenarios with greater confidence.

Throughout 2026, four areas are particularly relevant: AI literacy under the EU AI Act, Sustainable Mobility Plans for commuting, the Cyber Resilience Act (CRA), and Deposit Return Systems (DRS).

Below, we explore what these regulations involve, how they may affect organizations and professionals, and why they should be part of a comprehensive Compliance strategy.

EU AI Act and Artificial Intelligence Literacy

Artificial Intelligence is already part of everyday operations across many organizations. Generative AI tools, virtual assistants, and automated systems can improve productivity and transform business processes, but they also introduce new risks related to privacy, security, bias, and the handling of confidential information.

The European Union’s Artificial Intelligence Regulation, commonly known as the EU AI Act, establishes AI literacy as an essential element for promoting the responsible use of this technology.

Article 4 requires providers and deployers of AI systems to take measures to ensure, to the best of their ability, a sufficient level of AI literacy among their staff and other people operating these systems on their behalf.

For organizations, this means paying particular attention to areas such as:

• Training and awareness for employees and professionals.
• Identification of AI systems and tools in use.
• Understanding the risks and limitations of these technologies.
• Development of internal policies for safe and responsible AI use.
• Integration of AI into governance and Compliance frameworks.

AI literacy therefore goes far beyond learning how to use a specific tool. It means understanding how AI works, recognizing its limitations, and being aware of the responsibilities associated with its use.

Sustainable Mobility Plans: Towards New Commuting Models

Sustainability is also transforming work-related mobility. Spanish regulations are promoting measures aimed at reducing the environmental impact of commuting and encouraging more efficient transportation models.

Sustainable Mobility Plans for commuting are designed to analyze how employees travel to and from work and establish alternatives that reduce emissions and encourage more sustainable mobility habits.

Depending on the characteristics of each organization and workplace, these measures may include:

• Encouraging public transportation.
• Shared mobility solutions.
• Bicycles and other sustainable transportation options.
• Electric mobility.
• Work organization measures that reduce commuting, where applicable.

For companies, these plans represent the convergence of regulatory compliance, sustainability, and ESG policies. For employees, their effects may directly influence their everyday commuting habits.

Cyber Resilience Act: Cybersecurity by Design

The growing reliance on connected devices and digital products has made cybersecurity a critical issue for both companies and consumers.

The Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, establishes horizontal cybersecurity requirements for products with digital elements placed on the European Union market.

The underlying principle is clear: security should be integrated into products by design and maintained throughout their entire lifecycle.

Key areas covered by the CRA include:

• Security by design and by default.
• Vulnerability management.
• Security updates.
• Compliance assessment and documentation.
• Reporting and information requirements.

For manufacturers and other affected economic operators, the CRA means incorporating cybersecurity as a regulatory requirement from the earliest stages of product development.

From the user’s perspective, this framework is intended to deliver more secure digital products and greater protection against vulnerabilities and cyber threats.

The CRA is being implemented progressively, making 2026 a particularly important year for preparing processes, products, and vulnerability management models ahead of its full application.

Deposit Return Systems (DRS): A New Approach to Packaging

The transition toward a circular economy is also driving significant regulatory changes.

Deposit Return Systems (DRS) introduce a new approach to managing certain types of packaging. Consumers pay a small deposit when purchasing a product and can recover that amount by returning the packaging through designated collection channels.

This model aims to increase separate collection rates, improve material recovery, and reduce waste generation.

Its implementation may require changes across the value chain, affecting producers, distributors, retailers, and consumers.

Its main objectives include:

• Increasing separate packaging collection rates.
• Improving material circularity.
• Reducing litter and packaging waste.
• Engaging consumers through a financial incentive.

DRS is a clear example of how environmental regulation can transform both business processes and everyday consumer habits.

Compliance in 2026: Staying Ahead of Regulatory Change

The EU AI Act, Sustainable Mobility Plans, the Cyber Resilience Act, and Deposit Return Systems may address very different areas, but they share a common trend: Compliance is becoming increasingly cross-functional within organizations.

Technology, people, sustainability, cybersecurity, and business processes are becoming increasingly interconnected from a regulatory perspective.

Organizations therefore need to move from a reactive compliance model toward a strategy that enables them to identify regulatory developments, assess their potential impact, and prepare the necessary measures well in advance.

METRICA: Technology, Regulation, and Compliance

At METRICA, we help organizations navigate a constantly evolving technological and regulatory environment by integrating Compliance into their business processes and transformation strategies.

We work to align technology, governance, risk management, and Compliance, helping companies develop robust, secure models that meet evolving regulatory requirements.

Because staying ahead of regulation is not simply about meeting an obligation—it is about being prepared to navigate change with greater security and confidence.