Glossary

Third-Party Logistics. Outsourced logistics provider handling warehousing, fulfilment, and transport on behalf of another company.

Tin, Tantalum, Tungsten, and Gold — the four conflict minerals covered by EU Regulation 2017/821. EU importers above specified volume thresholds must conduct supply chain due diligence aligned with OECD guidance.

Document issued under Reg (EC) 883/2004 confirming the social security legislation applicable to a worker temporarily working in another Member State. Required for posted workers, multi-state workers, and cross-border self-employed.

European agreement on the carriage of Dangerous goods by Road.

Authorised Economic Operator. A trusted trader status granted by EU customs authorities recognising supply chain security and customs compliance. Provides simplified customs procedures, fewer inspections, and priority treatment at borders.

Animal Health Law (Reg (EU) 2016/429).

EU Artificial Intelligence Act (2024/1689). Risk-based framework for AI systems. High-risk AI (including health, financial, and recruitment AI) requires conformity assessment, risk management, and human oversight. Phased implementation from August 2025.

Annex III of Regulation (EU) 2024/1689 lists eight categories of high-risk AI systems including biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, and justice administration. Triggers conformity assessment, technical documentation, and post-market monitoring obligations.

Regulation (EU) 2023/1804 on the deployment of alternative fuels infrastructure.

Directive 2011/61/EU as amended, the EU framework for managers of alternative investment funds (hedge funds, private equity, real estate funds). Authorisation, marketing rules, and depositary requirements.

EU Anti-Money Laundering Authority (Reg (EU) 2024/1620) — the new central supervisor.

Anti-Money Laundering Directive (current: 5th AMLD) and the forthcoming Anti-Money Laundering Regulation (from July 2027). Imposes customer due diligence, beneficial ownership registration, and suspicious transaction reporting on obliged entities including financial institutions, real estate agents, and professional service providers.

The value of recurring revenue normalized to a one-year period, commonly used by subscription-based businesses to measure growth.

Anti-money laundering: framework for preventing money laundering and terrorist financing.

Regulation (EU) 2024/1624 on anti-money laundering.

Directive 2011/36/EU as amended by Dir 2024/1712, the EU framework for prevention, victim protection, and prosecution of trafficking in human beings. Expanded supply-chain due diligence obligations transpose by 15 July 2026.

A certificate authenticating the origin of a public document (birth certificates, company registrations, court judgments) for use in another country under the Hague Convention. Required for non-EU corporate documents used in EU legal proceedings.

Appointed Representative. Entity operating under the regulatory authorisation of a principal firm.

Water and sewerage utilities: drinking-water supply and wastewater or sewerage operators.

Waste management: collection, treatment, recovery, and disposal (NACE 38 activities).

Remediation and clean-up: site remediation including contaminated land (NACE 39).

Carriers: road, air, sea, or rail transport of goods or people.

Logistics: warehousing, freight forwarding, customs, and supply-chain services.

Postal and courier services.

Platforms and intermediation: digital platforms matching freight or passengers with carriers.

Regulated professional services: law, accounting, audit, tax, and veterinary practice.

Management consultancy and head-office activities.

Architecture, engineering, and technical testing services.

Scientific research and development.

Creative, marketing, and specialised professional services.

Rental and leasing of equipment, vehicles, or other assets.

Employment activities: recruitment, placement, and temporary staffing.

Travel and tourism services.

Security and investigation services.

Building and landscape services: cleaning, facilities management, and landscaping.

Office and business support: administration, call centres, and business process outsourcing.

Licensed clinical care: doctor-led, dentist-led, or hospital-integrated services.

Health technology: medical devices, in vitro diagnostics, software as a medical device, and health AI.

Care services: residential and social care.

Other regulated health activities.

Membership organisations: associations, unions, and professional bodies.

Repair services for goods and equipment.

Personal services: hairdressing, beauty, and wellbeing.

The simulation of human intelligence processes by computer systems, including learning, reasoning, and self-correction. In the EU context, regulated under the EU AI Act (Regulation 2024/1689) which establishes a risk-based framework for AI systems.

Regulation (EU) 2024/1689, the first comprehensive horizontal EU framework for AI. Risk-based classification (unacceptable, high-risk Annex III, limited-risk transparency, minimal-risk) with general-purpose AI rules. Most obligations apply from 2 August 2026.

A readiness band indicating the capability does not yet meet baseline expectations for EU market entry. Material gaps exist that need focused attention. The capability is not a full blocker but presents meaningful risk if left unaddressed.

Anti-Tax Avoidance Directive. EU rules restricting interest deductibility, controlled foreign company rules, and hybrid mismatches. Relevant to cross-border tax structuring.

EU rules for equipment and worker protection in explosive atmospheres (2014/34/EU + 1999/92/EC).

Directive 2010/13/EU on audiovisual media services, as amended.

Authorised Economic Operator: trusted-trader customs status.

A natural or legal person established in the EU mandated by a non-EU manufacturer to act on their behalf for specific regulatory tasks such as product compliance declarations, technical documentation, and market surveillance cooperation.

Banking-as-a-Service. Model where a licensed bank provides regulated banking infrastructure to non-bank partners via API. Common entry route for non-EU fintechs.

A model where licensed banks provide regulated banking services to non-bank fintech partners via API, enabling those partners to embed banking products without direct authorisation. Subject to outsourcing rules and DORA flow-down.

Best Available Techniques — the IED reference standard for emission limits.

A defined quantity of product manufactured or processed together under uniform conditions. EU traceability regulations require batch identification for food, pharmaceuticals, cosmetics, and other regulated products.

Business Continuity / Disaster Recovery plan — keep operations running and restore systems after disruption.

The natural person(s) who ultimately own or control a legal entity, typically those holding >25% ownership or voting rights. EU AMLR requires registration in national beneficial ownership registers, with retroactive obligations from January 2024.

Building Information Modelling. Digital modelling standard increasingly required in EU construction procurement.

Internal rules adopted by multinational companies for transferring personal data within the corporate group to countries outside the EEA, approved by EU data protection authorities.

A readiness band indicating fundamental gaps that would prevent or significantly delay EU market entry. Capabilities at this level require immediate action before proceeding. Corresponds to an internal severity classification of 'gate' (score below 25).

Intergovernmental higher education reform process across 49 European countries, harmonising degree structures (Bachelor/Master/Doctorate), credit systems (ECTS), and quality assurance. Originated 1999 Bologna Declaration.

A local office or operational presence of a foreign company in an EU member state. Unlike a subsidiary, a branch is not a separate legal entity: the parent company retains full liability. Subject to local registration, tax, and reporting requirements.

The rate at which a company spends money beyond its income, typically measured monthly. A €15K burn rate means the company loses €15K per month. Critical for calculating runway and planning fundraising.

A documented plan describing how an organisation will continue operating during and after a significant disruption, including backup procedures and recovery steps.

The practice of contracting specific business operations or processes to a third-party provider, subject to EU data protection and cross-border service regulations when involving EU entities.

Commercial transactions or business conducted between two businesses, rather than between a business and individual consumers.

Commercial transactions between a business and individual consumers, subject to consumer protection regulations in the EU.

One of the seven independent dimensions of EU market readiness assessed by the AFT Framework. Each capability is scored on its own diagnostic axis and is not substitutable for another. Strength in one capability does not cancel out a critical gap in another.

EU directive (CRD VI, alongside CRR III) setting prudential capital, liquidity, and governance requirements for banks and certain investment firms operating in the EU. Establishes minimum capital floors that authorised credit institutions must hold and maintain on an ongoing basis.

Regulation (EU) 2023/956 establishing a carbon border adjustment mechanism.

Closed-circuit television (video surveillance, a GDPR consideration).

Customer Due Diligence — verifying and monitoring a customer.

A mandatory marking on products sold in the EEA indicating compliance with EU health, safety, and environmental requirements. Required for approximately 25 product categories including machinery, electronics, medical devices, toys, and construction products.

Court of Justice of the European Union. EU's highest court. Its rulings bind member states and set enforceable precedent, including for non-EU companies operating in the EU.

Classification, Labelling and Packaging Regulation (EC 1272/2008). Implements the UN Globally Harmonised System for chemical hazard classification. Applies to all chemical substances and mixtures placed on the EU market.

Regulation (EC) 1272/2008 on the Classification, Labelling, and Packaging of substances and mixtures.

Collective Management Organisation — collects and distributes royalties for creators.

Carcinogenic, Mutagenic or Reprotoxic substances — a hazard class under REACH/CLP.

Certificate of Analysis. Document confirming that a product batch meets agreed specifications, standard in chemicals, food, and pharmaceutical supply chains.

The reading of the AFT Framework across a group of firms, producing programme-level insights for institutions, chambers and programme operators.

Directive 2014/26/EU, harmonising the operation of collective management organisations (CMOs) across the EU. Enables multi-territory online music licensing and sets governance, transparency, and member-rights standards.

Your initial educated assumption about which EU regulations apply to your business and what actions are needed. A starting point to be validated with legal experts before finalizing your compliance pathway.

A structured plan identifying which regulations apply to your business and the steps needed to meet each requirement. Includes gap assessment, timeline, responsible parties, and evidence documentation.

A measure of evidence strength behind each capability assessment, ranging from limited (no consolidated proof) to operationalised (documented and repeatable process). Higher confidence means the assessment carries greater reliability.

EU Regulation 305/2011 laying down harmonised conditions for the marketing of construction products, requiring CE marking and declarations of performance for products covered by harmonised European standards.

Directive 2011/83/EU establishing common consumer protection rules for the EU. Key provisions: 14-day withdrawal right for distance contracts, pre-contractual information requirements, and delivery obligations.

The percentage of prospects who complete a desired action, such as moving from enquiry to purchase. Low conversion in a new market may indicate misalignment with local buyer expectations, pricing, or purchasing processes.

Directive (EU) 2024/1760 on corporate sustainability due diligence.

Directive (EU) 2022/2464 on corporate sustainability reporting.

Court of Justice of the European Union.

Cyber Resilience Act. EU regulation introducing cybersecurity requirements for products with digital elements. Full compliance required from late 2027.

Directive (EU) 2022/2557 on the resilience of critical entities.

Regulation (EU) 2024/1252 on critical raw materials.

Critical Raw Materials Act (2024/1252). Identifies 34 critical and 17 strategic materials. Requires supply chain resilience, recycling targets, and strategic stockpiling. Affects mining, manufacturing, and battery sectors.

Involving transactions, operations, or regulatory obligations across national borders within or into the EU. Cross-border activity triggers specific rules on VAT, data transfers, consumer protection, employment, and product compliance that do not apply to domestic operations.

Regulation (EU) 2019/880, prohibiting introduction of cultural goods unlawfully exported from third countries and creating import-licensing requirements for high-risk categories. Applies from 28 June 2025.

The total cost of acquiring a new customer, including marketing, sales, and onboarding expenses. A key metric for evaluating go-to-market efficiency.

Software systems and strategies for managing a company's interactions with current and potential customers, tracking sales pipelines and customer data.

The administrative process of getting goods through customs authorities when entering or leaving a country. Involves submitting declarations, paying applicable duties and VAT, and presenting required documentation such as certificates of origin or conformity.

A tax levied on goods imported into the EU, calculated based on the product's HS code, declared value, and country of origin. Rates vary by product category, and preferential rates may apply under free trade agreements.

Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for products with digital elements.

Under GDPR, any operation performed on personal data: collecting, recording, storing, retrieving, using, sharing, combining, restricting, erasing, or destroying. Even viewing a spreadsheet of customer names counts as processing.

A legally binding contract between a data controller and data processor required by GDPR Article 28. Must specify processing purposes, data types, security measures, sub-processor rules, and data subject rights procedures.

Data protection impact assessment required under the GDPR for high-risk processing.

Data protection officer designated under the GDPR.

The entity-level output of an AFT EU Market Readiness assessment, combining a verdict, capability profile, priority blockers and evidence roadmap.

A formal document issued by a manufacturer or authorised representative stating that a product meets all applicable EU requirements. Required before affixing CE marking to most regulated products.

An Incoterm where the seller delivers goods to a named destination, with the buyer responsible for import clearance and duties.

An Incoterm where the seller bears all costs and risks of delivering goods to the buyer's location, including customs clearance and import duties.

Regulation (EU) 2022/1925 on contestable and fair markets in the digital sector.

Regulation (EU) 2022/2554, the EU framework for ICT risk management across financial entities and their critical ICT providers, in force from 17 January 2025. Covers ICT risk frameworks, incident reporting, third-party risk, and threat-led penetration testing for significant entities.

Digital Operational Resilience Act (EU 2022/2554). Applies to financial entities from January 2025. Requires ICT risk management frameworks, incident reporting, resilience testing, and third-party provider oversight.

EU regulation establishing rules for online platforms and digital services, including content moderation, transparency requirements, and user protections.

Directive (EU) 2019/790, harmonising EU copyright in the digital environment. Article 15 creates ancillary rights for press publishers; Article 17 imposes filtering and licensing duties on content-sharing platforms; Article 5 provides educational-establishment exception.

Directive (EU) 2021/514 on administrative cooperation in taxation for digital platforms.

Directive 2005/36/EC as amended, the EU framework for cross-border recognition of regulated professional qualifications. Covers seven sectoral regulated professions plus the general system for other regulated professions. The European Professional Card (separate procedural surface, also abbreviated EPC) operates under this directive.

The process and network used to deliver products to end customers in a market. In the EU, distributors have specific legal obligations under product safety and market surveillance rules, distinct from those of importers or manufacturers.

Data Protection Impact Assessment. Required by GDPR Article 35 when processing is likely to result in high risk to individuals. Mandatory for health data processing, large-scale profiling, systematic monitoring, and AI-driven decisions.

Data Protection Impact Assessments: GDPR risk assessments required for higher-risk processing. (Plural of DPIA.)

Data Protection Officer. Role required under GDPR for certain controllers and processors, responsible for privacy compliance oversight.

Digital Single Market. EU policy framework harmonising digital rules, including the Copyright DSM Directive (2019/790) on online content and licensing.

Distribution System Operator. Entity responsible for operating local electricity or gas distribution networks.

A structured process of identifying, preventing, and mitigating adverse impacts in a company's operations and supply chain. In the EU context, this is increasingly a legal obligation under directives such as CSDDD and sector-specific regulations.

EU Aviation Safety Agency.

European Banking Authority. EU regulator issuing binding technical standards and guidelines for banks and credit institutions.

European Chemicals Agency — administers REACH and CLP.

Regulation (EU) 2024/1781 on the ecodesign of sustainable products.

European Electronic Communications Code. EU framework for telecoms regulation, authorisation, and end-user rights.

European Health Data Space Regulation (2025/327). Creates a framework for primary use (care delivery) and secondary use (research, policy) of electronic health data across the EU. Phased implementation 2027-2029.

Environmental Impact Assessment Directive (2011/92/EU). Requires assessment of environmental effects before approving certain public and private projects. Mandatory for extractive industries, large infrastructure, and energy installations.

European Insurance and Occupational Pensions Authority. EU regulator for insurance and pensions, issues binding guidelines on distribution, outsourcing and prudential matters.

End-of-Life Vehicles Directive — vehicle recycling and recovery.

Eco-Management and Audit Scheme. EU voluntary environmental management certification, stricter than ISO 14001, often referenced in public procurement.

Electromagnetic Compatibility Directive (2014/30/EU).

Electronic Money Institution. Licensed entity authorised to issue electronic money in the EU under the E-Money Directive.

Directive (EU) 2024/825, banning generic environmental claims and requiring substantiation for sustainability marketing. Member State transposition by 27 March 2026; obligations apply from 27 September 2026.

Mandatory energy rating document for buildings under EPBD, required at sale, lease, or major renovation. Format harmonised under EPBD recast 2024/1275 with minimum-content and renovation-passport linkage.

Directive (EU) 2024/1275 (recast), the EU framework for building energy performance with minimum energy performance standards (MEPS), zero-emission-building (ZEB) targets from 2028 (public) and 2030 (all new), and renovation obligations for worst-performing stock.

Environmental impact assessment under Directive 2011/92/EU.

Energy Performance of Buildings Directive (2024/1275). Requires Energy Performance Certificates for all buildings sold or rented, with Minimum Energy Performance Standards. Transposition deadline May 2026.

Energy Performance Certificate. A document rating a building's energy efficiency on a scale from A to G. Mandatory under EPBD for all buildings sold or rented. Required in property advertisements.

European Qualifications Framework. Eight-level reference framework linking EU countries' qualifications systems. Voluntary transparency tool that enables comparison across member states.

Environmental, Social and Governance — the sustainability dimensions of corporate reporting.

European Single Procurement Document. A self-declaration form used in EU public procurement to confirm a bidder meets exclusion and selection criteria. Replaces full documentary evidence at tender stage.

Mandatory designated representative within the EU for non-EU manufacturers under product-compliance regimes including MDR, IVDR, and CE-marking directives. Holds technical documentation, interfaces with authorities, and bears certain liabilities under MDR Art 11.

Regulation (EU) 2023/1542, the EU framework for batteries placed on the market. Sets carbon-footprint declaration, recycled-content thresholds, due diligence on raw materials, and EPR scheme registration. Replaces Dir 2006/66/EC from 18 August 2025.

Regulation (EU) 2023/1115 on deforestation-free products.

Single entry point for EU funding programmes and procurement opportunities at ec.europa.eu/info/funding-tenders. Supplier registration, application, and contract management for EU institution-funded projects.

Regulation (EU) 2018/1725 on personal data processing by EU institutions, bodies, offices, and agencies. The EU-institutional equivalent of GDPR; applies to EUI processing operations rather than to private-sector or Member State controllers.

The capacity of a firm to enter, operate and prove itself in the European Union single market. Assessed across seven independent capabilities, not as a single composite score.

Regulation (EU) 2020/852, establishing a classification system for environmentally sustainable economic activities. Used by financial market participants under SFDR and by large undertakings for non-financial reporting alignment.

European Database on Medical Devices.

EU Deforestation Regulation (2023/1115). Requires due diligence for 7 commodities (cattle, cocoa, coffee, oil palm, rubber, soya, wood) to prove products are deforestation-free. Applies from December 2026 for large operators.

European Employment Services — the EU job-mobility network.

Directive (EU) 2019/882 on accessibility requirements for products and services.

Standard EU credit unit for higher education enabling transfer and recognition across institutions. 60 ECTS represents one full-time academic year. Anchored in the Bologna Process.

Independent EU authority supervising compliance with Reg 2018/1725 by EU institutions, bodies, offices, and agencies. Counterpart to national data protection authorities under GDPR.

The European Union single market extended to Norway, Iceland, and Liechtenstein. For data protection purposes, the EEA is treated as equivalent to the EU.

Regulation (EU) 2025/327, establishing the EU framework for primary use (patient access to records cross-border) and secondary use (research, policymaking) of electronic health data. In force from 12 March 2025; secondary-use applications from 2027.

The executive body of the European Patent Organisation responsible for granting European patents across 39 contracting states.

Eight-level meta-framework referencing national qualification frameworks across Europe to enable cross-border recognition of learning outcomes. Adopted via Council Recommendation 2017/C 189/03.

Register of recognised quality assurance agencies for higher education across the European Higher Education Area. EQAR-listed agencies operate per the European Standards and Guidelines (ESG).

A standardised self-declaration form used across the EU to simplify participation in public procurement procedures, replacing the need for multiple national certificates.

The 2015 reference framework for quality assurance in European higher education, distinct from environmental/social/governance ESG. Covers internal QA, external QA, and QA agencies under the Bologna Process.

A political and economic union of 27 European member states with a single market, common regulations, and shared institutions. The primary target market for this assessment.

The EU agency responsible for managing the EU trademark and registered Community design systems, providing IP protection across all EU member states.

European Waste Catalogue of standardised waste codes.

The statistical office of the European Union, responsible for publishing high-quality Europe-wide statistics and indicators. Eurostat maintains official classifications like NACE, coordinates national statistical offices, and provides the data infrastructure for EU policy-making and regulatory alignment.

Concrete, reviewable artefacts: documents, records, contracts, accounts, certifications, or operational outputs that a third party could examine and assess. A statement of intent or a self-declaration is not evidence on its own, even when it accurately describes the firm's position.

A composite indicator reflecting both readiness status and evidence quality for a given capability. It combines the assessment outcome with the strength of supporting documentation.

A methodological discipline that distinguishes what a firm claims from what it can demonstrably produce within an operationally meaningful window.

A regulatory framework requiring producers to finance the collection, recycling, and disposal of their products at end of life. Applies in the EU to packaging, electronics (WEEE), batteries, and other product categories. Obligations vary by member state.

Food Business Operator. Any entity carrying out food-related activities. FBO registration is required before operating in EU food supply chains.

Food Information to Consumers Regulation (1169/2011): food labelling.

Financial Intelligence Unit — receives suspicious-transaction reports.

Regulation (EU) 2024/573 on fluorinated greenhouse gases.

Regulation (EU) 2022/2560, requiring notification to the Commission of foreign financial contributions in EU procurement (above €4M lot value) and concentrations. Aimed at addressing distortive non-EU subsidies in the internal market.

Foreign Subsidies Regulation. EU rules requiring notification of non-EU subsidies in large public tenders and M&A, effective since 2023.

The complete process of receiving, processing, and delivering orders to customers. Includes inventory management, picking, packing, shipping, tracking, and handling returns.

A critical weakness threshold applied to each capability. If a capability falls below its gate floor, the assessment cannot return a Go verdict, even if other capabilities are strong. The gate floor prevents the combined readiness reading from masking a single structural gap.

Standard contractual terms applied by international organisations and EU institutions to procurement contracts. Each organisation has its own GCC version (UN GCC, EC GCC, World Bank GCC, EBRD GCC, EIB GCC) with limited negotiability.

General Data Protection Regulation (EU 2016/679). The EU's comprehensive data protection law governing how personal data of EU residents is collected, stored, and processed. Applies to any organisation handling EU personal data, regardless of where it is based. Requires lawful basis for processing, data subject rights, and breach notification.

Regulation (EU) 2023/988 on general product safety.

Geographical Indication. EU protected status for products with a specific geographical origin and reputation, including PDO and PGI subcategories.

Good Laboratory Practice — quality standards for non-clinical safety studies.

Good Manufacturing Practice — quality standards for making medicines and some products.

A strategic plan for launching a product or service to market, including target customers, distribution channels, and positioning.

Good Distribution Practice for storage and distribution of medicines.

Plurilateral WTO agreement granting reciprocal market access to public procurement above thresholds. EU is a party; non-GPA countries face restricted access via the International Procurement Instrument (IPI).

Government Procurement Agreement. WTO agreement granting signatory countries access to public procurement in other signatory markets, including the EU.

General-Purpose AI, the AI Act category for large general models.

General Product Safety Regulation (2023/988). Extends EU safety obligations to non-harmonised consumer products, requires economic operators in the EU, and covers online sales. Applies from December 2024.

Hazard Analysis and Critical Control Points. A systematic food safety management approach required by EU Hygiene Regulations (852/2004). Mandatory for all food business operators from primary production to retail.

A baseline element of EU market readiness whose absence is treated as non-negotiable. When a hard blocker is triggered, the verdict is Hold regardless of strength elsewhere. The principle is disclosed in the public methodology; the specific elements designated as hard blockers remain protected.

The main offices or central administrative center of an organisation where key decisions are made.

Bilateral treaty between an international organisation and its host Member State defining privileges, immunities, tax exemptions, and operational arrangements. Reference framework for entities classified as NACE V99 extraterritorial organisations.

A reference benchmark derived from sector characteristics (regulatory intensity, operational complexity, data exposure), used for comparison. Not a statistical average or peer benchmark.

Harmonised System code. A standardised numerical classification used worldwide to identify products at customs. Required for calculating duties, applying trade preferences, and clearing goods into the EU.

Health Technology Assessment. Process used by EU member states to evaluate clinical and economic value of medical technologies before reimbursement. Joint clinical assessments apply from 2025 under Regulation 2021/2282.

Heating, Ventilation and Air Conditioning.

Information and Communication Technology — computing, software, networks, telecoms.

Insurance Distribution Directive. EU rules governing how insurance is sold, including conduct, disclosure and training requirements.

A detailed description of the type of company or customer that would benefit most from your product or service, including industry, size, and characteristics.

International Electrotechnical Commission — electrical/electronic standards body.

Industrial Emissions Directive (2010/75/EU, amended 2024). Regulates emissions from large industrial installations including waste treatment, energy generation, and manufacturing above specified thresholds.

International Labour Organization.

Internal Market Information system — cross-border cooperation between authorities.

The legal entity responsible for ensuring goods imported into the EU comply with all customs regulations, pay applicable duties, and meet product safety requirements.

In vitro diagnostic medical device.

Regulation (EU) 2017/746, the EU framework for in vitro diagnostic medical devices. Risk-based class (A, B, C, D) conformity assessment with broader Notified Body involvement than the prior Directive.

Directive 2010/75/EU on industrial emissions, as amended by Directive (EU) 2024/1785.

Directive (EU) 2024/1785, the recast Industrial Emissions Directive expanding scope to large livestock farms and updating BAT-AEL emission limits. Member State transposition deadline 1 July 2026.

Typical regulatory and operational intensity levels (Low, Medium, High) for your industry sector, indicating common requirements and compliance expectations in the EU market.

Directive (EU) 2016/97, the EU framework for insurance and reinsurance distribution. Covers authorisation of intermediaries, conduct rules, demands-and-needs analysis, and cross-border passporting.

Legal rights protecting creations of the mind, including patents, trademarks, copyrights, and trade secrets.

Standardized trade terms published by the International Chamber of Commerce defining responsibilities of buyers and sellers for delivery of goods, including risk transfer and cost allocation.

International Organization for Standardization, publisher of voluntary international standards.

Import One Stop Shop. Simplified VAT registration for non-EU sellers shipping goods under EUR 150 to EU consumers.

Internet of Things: physical devices (sensors, appliances, machines) connected to the internet that collect and exchange data.

Joint Venture. Partnership structure where two or more parties form a shared entity, common route for market entry in regulated or licence-dependent sectors.

Know Your Customer. Process of verifying the identity of customers before and during a business relationship, required for regulated financial and professional services to prevent fraud and money laundering.

A non-binding document expressing a party's intention to enter into a transaction. In EU market entry context, LOIs from potential customers or distributors serve as evidence of market demand and commercial interest.

The predicted total net profit attributed to the entire future relationship with a customer, used to determine sustainable acquisition spending.

The process of adapting a product, service, or commercial approach to meet the specific regulatory, linguistic, cultural, and operational requirements of a target market. In the EU, localisation goes beyond translation to include legal compliance, packaging, labelling, and payment methods.

Low Voltage Directive (2014/35/EU): electrical equipment safety.

Machine-to-Machine: automated data exchange between devices without human involvement.

Council of Europe Convention CETS 215 of 2014, providing the framework for combating match-fixing and integrity issues in sports. EU is a signatory; relevant for sports-betting operators in S sector.

An authorised intermediary delegated by an insurer to underwrite and bind cover within agreed parameters. Common cross-border insurance entry route avoiding own authorisation but subject to IDD and contractual oversight.

The difference between revenue and cost, expressed as a percentage. EU market entry typically introduces additional costs (VAT, compliance, logistics, localisation) that can significantly reduce margins compared to domestic operations.

The conditions under which a product or service may legally be sold in a given market. In the EU, market access depends on meeting regulatory requirements, obtaining necessary certifications, and complying with sector-specific rules. Distinct from market entry, which refers to the commercial strategy.

Evidence that real customers want your product or service, beyond assumptions. Valid signals include signed LOIs, pre-orders, paying pilots, or documented prospect conversations with clear buying intent.

Regulation (EU) 2023/1114, the EU framework for crypto-asset service providers (CASPs), asset-referenced tokens (ARTs), and electronic-money tokens (EMTs). Stablecoins under MiCA from 30 June 2024; CASP authorisation from 30 December 2024.

Directive 2014/65/EU and Regulation 600/2014/EU, the EU framework for investment services and trading venues. Covers authorisation, conduct of business, transparency, transaction reporting, and product governance for investment firms.

Regulation (EU) 2017/745, the EU framework for medical devices placed on the market. Class-based conformity assessment via Notified Bodies, EU Authorised Representative for non-EU manufacturers, EUDAMED registration, and post-market surveillance.

Medical Device Regulation (EU 2017/745). Replaced previous directives with stricter pre-market requirements, clinical evidence obligations, and post-market surveillance for medical devices including software as a medical device.

A country that is a member of the European Union, bound by EU treaties and regulations.

Managing General Agent. Insurance intermediary with delegated underwriting authority from an insurer, common route for non-EU insurance market entry.

Markets in Crypto-Assets Regulation (2023/1114). EU-wide framework for crypto-asset issuers and service providers. Fully applicable since December 2024. Requires authorisation for crypto-asset service providers.

Markets in Financial Instruments Directive (2014/65/EU). Governs investment services, trading venues, and investor protection in the EU. Requires authorisation from national competent authority for investment firms.

Building energy ratings below which renovation becomes mandatory under EPBD recast 2024/1275. Member States set sector-specific phasing, with worst-performing residential stock typically targeted by 2030 and 2033.

A version of a product with just enough features to satisfy early customers and provide feedback for future development.

Machine learning: building systems that learn patterns from data rather than being explicitly programmed. 'ML features' are product features powered by machine learning.

Money Laundering Reporting Officer. Designated senior role required under EU anti-money laundering rules for regulated financial entities.

Monitoring, reporting, and verification regime for shipping emissions.

The predictable revenue a business expects to receive every month from active subscriptions.

Maximum Residue Level. The maximum permitted concentration of a pesticide residue in food or feed (Regulation 396/2005). Default MRL is 0.01 mg/kg. Exceeding MRLs results in border rejection.

A security mechanism requiring users to provide two or more verification factors to gain access to a system, significantly reducing unauthorised access risk.

An EU principle where a product legally marketed in one member state can be sold in another without additional compliance. Applies to non-harmonised product areas. Does not apply to professional qualifications (which require Dir 2005/36 recognition).

Motor Vehicle Vertical Agreement Block Exemption (Reg (EU) 2023/822): car distribution/repair agreements.

Mobile Virtual Network Operator: resells mobile network capacity without owning the network.

Nomenclature statistique des Activites economiques dans la Communaute Europeenne. The EU's standard classification of economic activities used for statistical, regulatory, and administrative purposes. Current version: NACE Rev. 2.1.

A two-digit industry code within a NACE Section, providing more specific classification. For example, Division 62 (Computer Programming) sits within Section J (Information and Communication).

The official European Union statistical classification of economic activities, used as the sector anchor for AFT readiness calibration.

One of 21 high-level industry categories (A–U) in the EU NACE classification system, such as Section C (Manufacturing) or Section K (Financial Services). Sections group related economic activities.

National Anti-Doping Organisation.

National / European centres for recognition of academic qualifications.

Member State-level qualifications framework referenced to the European Qualifications Framework. Each Member State maintains its own NQF aligned to EQF levels for cross-border recognition.

National Competent Authority. Member state regulator responsible for authorising and supervising regulated activities in that jurisdiction.

A readiness band indicating the capability is progressing but has not yet reached the expected baseline. Improvement is recommended but the gap is not blocking market entry.

A customer loyalty metric that measures how likely customers are to recommend a company's products or services to others.

Network and Information Security Directive (EU 2022/2555). Expanded cybersecurity obligations for essential and important entities across 18 sectors. Requires risk management measures, incident reporting within 24 hours, and supply chain security.

Directive (EU) 2022/2555, the second-generation EU cybersecurity directive expanding scope to essential and important entities across 18 sectors. Imposes risk management, incident reporting, and supply-chain security obligations transposed by Member States by 17 October 2024.

Non-Governmental Organisation.

The official EU statistical classification of economic activities, maintained by Eurostat. NACE Rev. 2.1 organizes all businesses into 21 sections (A–U) and 88 two-digit divisions. It is used by EU institutions, national regulators, and statistical offices to categorize companies for reporting, compliance, and policy purposes.

A legal contract establishing a confidential relationship between parties to protect sensitive information from disclosure.

An organisation designated by an EU member state to assess conformity of certain products before they can be placed on the market. Required for higher-risk CE marking categories including medical devices, machinery, and pressure equipment.

National Regulatory Authority: the national telecom regulator that authorises and supervises electronic-communications providers.

Occupational safety and health framework.

Organisation for Economic Co-operation and Development.

Original Equipment Manufacturer. Manufacturer supplying components or finished products to be sold under another company's brand.

A readiness band indicating the capability meets baseline expectations for EU market entry at this stage. Remaining gaps, if any, are manageable within normal execution planning.

An EU-based entity appointed by a non-EU manufacturer to fulfil EU regulatory obligations on their behalf. Required under REACH for chemical importers and under certain product safety regulations. Must have genuine capability.

Copyrighted works whose owner cannot be found; Dir 2012/28/EU permits limited cultural-institution use.

One-Stop Shop. An EU VAT simplification scheme allowing businesses to register for VAT in one member state and report all EU cross-border B2C sales through a single return, instead of registering in each country separately.

Solvency II requirement for insurance and reinsurance undertakings to perform a forward-looking self-assessment of overall solvency needs and capital adequacy under stressed scenarios. Annual board-reviewed exercise.

Regulation (EU) 2025/40 on packaging and packaging waste.

Directive (EU) 2023/970, requiring employers to disclose pay information for transparency on gender pay gaps. Reporting obligations apply from 7 June 2026 for employers with 100+ employees, with phased thresholds.

EU directive regulating payment services and payment service providers, introducing Strong Customer Authentication (SCA) requirements and enabling open banking. PSD3 proposal extends these requirements with stronger fraud prevention and open finance provisions.

Directive (EU) 2015/2366, the current EU framework for payment institutions, electronic money institutions, and account information service providers. Strong customer authentication, open banking access, and complaints regimes apply pending PSD3 transition.

The forthcoming revision of the EU Payment Services Directive, expected to modernise rules on open banking, payment fraud liability, and consumer protection for electronic payments across the single market.

Protected Designation of Origin. Strictest EU geographical indication, requiring full production in the designated area.

Politically Exposed Person — a higher-AML-risk client in or close to public office.

A fixed place of business in a country that creates a tax obligation there. In EU context, having an office, warehouse, employee, or dependent agent can constitute a PE and trigger corporate tax filing obligations in that member state.

Mandatory role under MDR Art 15 / IVDR Art 15 for medical device manufacturers and authorised representatives, with defined qualifications and sole responsibility for conformity, post-market surveillance, and incident reporting.

Under GDPR, any information relating to an identified or identifiable person. Includes obvious identifiers (name, email, phone) but also IP addresses, device IDs, location data, cookies, and any data that could identify someone when combined.

Protected Geographical Indication. EU geographical indication requiring at least one production stage in the designated area.

Private Hire Vehicle — pre-booked passenger transport (distinct from taxis).

An official document issued by the plant protection authority of the exporting country confirming that plants or plant products meet the import requirements of the destination country. Required for most agricultural exports to the EU.

Payment Institution. Licensed entity authorised to provide payment services in the EU under PSD2.

Public Interest Entity — listed companies/banks subject to stricter audit rules.

The set of prospective customers or deals currently being pursued, typically organised by stage of engagement. A healthy pipeline indicates sufficient commercial activity to sustain revenue targets.

Employees sent by their employer to temporarily work in another EU member state. The Posted Workers Directive (2018/957) requires host-country remuneration, A1 social security certificates, and full host-country employment law after 12 months.

Directive 96/71/EC as amended by Dir 2018/957, the EU framework for protection of workers temporarily posted to another Member State. Equal-treatment and minimum-employment-conditions rules apply per host MS.

Power Purchase Agreement. Long-term contract between electricity generator and buyer, common in renewable energy market entry.

A notice published by a contracting authority to inform the market in advance about upcoming procurement procedures.

The process by which organisations purchase goods or services. EU public procurement follows specific rules requiring open tenders, published through Tenders Electronic Daily (TED), and often requires an ESPD submission.

Revised Product Liability Directive (EU) 2024/2853.

Directive (EU) 2024/2853, the recast Product Liability Directive expanding scope to digital products, software, AI systems, and refurbished products. Member State transposition deadline 9 December 2026.

The requirement that products placed on the EU market do not present risks to consumers. Governed by the General Product Safety Regulation (GPSR) and sector-specific directives. Non-compliant products can be recalled, and manufacturers may face penalties.

A financial statement summarizing revenues, costs, and expenses during a specific period, showing whether a business is profitable.

A small-scale project or demonstration used to verify that a product, service, or business model can work in a specific market. In EU market entry context, POCs with local partners serve as evidence of commercial viability.

Person Responsible for Regulatory Compliance. Required role under the Medical Device Regulation for manufacturers, including non-EU manufacturers through their authorised representative.

Quality Management System. Documented processes for managing quality, often certified to ISO 9001 and required for regulated products including medical devices.

A framework that defines clear roles and decision rights by assigning Responsible, Accountable, Consulted, and Informed designations for each task or deliverable.

Rapid Alert System for Food and Feed. EU notification system for food safety risks. Rejections and recalls are published publicly and can damage supplier reputation.

Registration, Evaluation, Authorisation and Restriction of Chemicals (EC 1907/2006). Requires manufacturers and importers to register chemical substances with ECHA. Non-EU companies must appoint an Only Representative.

Regulation (EC) 1907/2006 on the Registration, Evaluation, Authorisation, and Restriction of Chemicals.

Renewable Energy Directive III (2023/2413). Sets binding EU renewable energy targets and streamlines permitting for renewable projects.

Products or services requiring specific government approvals, certifications, or licenses to sell legally. Examples: medical devices (MDR), financial services (MiFID/PSD2), food products, pharmaceuticals, toys, cosmetics, construction materials, and any product requiring CE marking.

Regulation on Energy Market Integrity and Transparency (1227/2011, updated 2024). Prohibits market manipulation and insider trading in wholesale energy markets. Non-EU market participants must designate an EU representative.

A formal document issued by an organisation inviting suppliers to submit a structured bid for goods or services, commonly used in public and private procurement across EU member states.

The order in which readiness gaps should be addressed, reflecting their dependency structure. Foundational gaps, such as ownership, legal structure, budget discipline and compliance pathway, are usually addressed before market-facing or execution gaps. The precise sequence depends on the firm, sector, target market and severity of the blockers identified.

Directive 2011/65/EU on the restriction of hazardous substances in electrical and electronic equipment.

Directive (EU) 2024/1799, requiring manufacturers to enable repair of in-scope products through spare-parts access, repair information, and standardised European Repair Information Form. Member State transposition deadline 31 July 2026.

A potential compliance or operational concern identified during assessment that warrants verification with specialists. Risk flags are advisory, not definitive legal conclusions.

A database security feature that restricts which rows a user can access based on their identity or role.

Recovery Time Objective — target maximum time to restore a system after an outage.

Criteria used to determine the country of origin of a product for customs and trade purposes. Origin determines applicable duty rates, eligibility for preferential treatment under free trade agreements, and compliance with trade policy measures.

The length of time a business can continue operating with its current cash reserves. Calculated by dividing available cash by monthly burn rate. For example, €120K cash with €10K monthly expenses = 12 months runway.

Directive (EU) 2019/771, harmonising EU consumer rights in B2C sales of goods. Two-year statutory warranty, repair-as-first-remedy, and digital-content overlay with Dir 2019/770.

A visual representation of where prospects are in the sales process, from initial contact to closed deal. A healthy pipeline has multiple prospects at different stages (awareness, evaluation, negotiation, closing).

Software as a Medical Device. Software intended to be used for medical purposes without being part of a hardware medical device. Classified under MDR Rule 11 — most health AI falls into Class IIa or higher, requiring Notified Body involvement.

Software Bill of Materials. Inventory of software components and dependencies, increasingly required for EU procurement and under the Cyber Resilience Act.

Safety Data Sheet. Structured document required for hazardous substances under REACH and CLP, providing handling and safety information.

The discipline of calibrating readiness thresholds and content against the operational reality of each sector, rather than applying one uniform reading to every firm.

Special categories of personal data requiring extra protection under GDPR Article 9. Includes: health and medical data, biometric data, racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, and sexual orientation.

A contract between a service provider and customer that defines the level of service expected, including metrics, responsibilities, and remedies.

The segment of the TAM that your product or service can realistically target based on geography, sector, or capability. For example, EU fintech compliance spend.

The portion of SAM you can realistically capture in a defined period (e.g., 2 years). Calculated by target customers × average revenue (e.g., 50 customers × €X).

Directive 2006/123/EC simplifying cross-border service provision in the EU. Establishes Points of Single Contact for administrative procedures and limits unjustified barriers to service providers from other member states.

A payment integration initiative of the EU for simplification of bank transfers denominated in euro across member states and associated countries.

The EU's unified economic area in which goods, services, capital, and people move freely across member state borders without tariffs or border controls. Regulatory harmonisation enables a single set of product rules to grant access to over 440 million consumers, though national differences remain in areas such as taxation, employment, and certain consumer protections.

Directive (EU) 2024/1233 (recast), establishing a single application procedure for non-EU workers to reside and work in a Member State. Member State transposition deadline 21 May 2026.

Directive (EU) 2024/1640, the sixth anti-money laundering directive.

An enterprise with fewer than 250 employees and either annual turnover not exceeding EUR 50 million or total balance sheet not exceeding EUR 43 million, as defined by Commission Recommendation 2003/361/EC.

Regulation (EC) 883/2004, the EU framework coordinating social security systems across Member States. Determines applicable legislation for cross-border workers, allowing accumulation of rights and avoiding double contributions.

Software intended for medical purposes, regulated as a medical device under MDR. Class IIa or higher SaMD also typically falls under AI Act high-risk categorisation if it uses AI components.

Software as a Service. A software delivery model in which applications are hosted centrally and accessed by customers over the internet, typically via subscription. EU regulations on data residency, GDPR, and digital services apply to SaaS providers operating in the market.

A formal inventory of components, libraries, and dependencies in a software product, increasingly required as evidence under the Cyber Resilience Act and NIS2 supply-chain obligations. Supports vulnerability disclosure and patching workflows.

EU prudential framework for insurance and reinsurance companies. Sets capital requirements, risk management standards, and reporting obligations. Authorisation required from national supervisory authority.

Directive 2009/138/EC as amended, the EU prudential framework for insurance and reinsurance undertakings. Three-pillar structure covering capital requirements (SCR, MCR), governance and risk management, and supervisory reporting.

Sanitary and Phytosanitary measures. EU border controls for plant health, animal health, and food safety. Agricultural imports undergo SPS inspections at Border Control Posts before clearing customs.

Special Purpose Vehicle. Legal entity created for a specific purpose, often used for asset holding, project finance, or ring-fencing risk.

EU-approved contract terms that provide legal safeguards for transferring personal data outside the European Economic Area to countries without adequacy decisions.

A documented process that describes how a recurring task or activity should be carried out within an organisation.

Short-Term Rental. EU Regulation 2024/1028 introduces registration and data-sharing obligations for short-term accommodation platforms, applying from May 2026.

The categorical decision output of an AFT EU Market Readiness assessment. The instrument resolves to one of three verdicts: Go, Conditional Go, or Hold. A Hold is a sequencing signal, not a failure judgement.

A requirement under PSD2 for electronic payments to use at least two of three authentication factors: knowledge, possession, and inherence.

A readiness band indicating the capability exceeds baseline expectations and demonstrates strong evidence of EU market readiness.

A legally independent company established in an EU member state, owned or controlled by a parent company outside the EU. Creates a permanent local legal presence with its own tax, employment, and regulatory obligations. Distinct from a branch, which is not a separate legal entity.

The full network of organisations, activities, and resources involved in producing and delivering a product or service. In the EU, companies face increasing legal obligations to ensure transparency and responsible practices throughout their supply chains.

Substance of Very High Concern — a REACH candidate-list substance.

World Bank online procurement platform for managing the full procurement cycle of Bank-financed projects. Suppliers register and submit to active opportunities via the STEP portal.

Temporary work agency under Directive 2008/104/EC.

The online version of the Supplement to the Official Journal of the EU, dedicated to European public procurement. All EU public tenders above threshold values are published here.

A non-binding document outlining the key terms and conditions of a proposed business agreement, investment, or partnership. Typically used as a basis for negotiation before drafting a full contract.

The total market demand for a product or service, representing all potential revenue if 100% market share were achieved. For example, all compliance software spend globally.

Tobacco Products Directive (Dir 2014/40/EU): tobacco/e-cigarette rules.

The ability to track a product through all stages of production, processing, and distribution. Required by EU General Food Law (Reg 178/2002) for food products and by various regulations for medical devices, chemicals, and consumer goods.

Evidence that a product or service is gaining acceptance in a market, typically measured through revenue, user growth, partnerships, or repeat purchases. In the EU context, traction signals that the value proposition resonates with local buyers.

An assessment required under GDPR to evaluate whether personal data transferred to a third country will have an equivalent level of protection as within the EU.

Transmission System Operator. Entity responsible for operating high-voltage electricity or high-pressure gas networks in a member state.

Unfair Commercial Practices Directive (2005/29/EC): bans misleading/aggressive B2C practices.

Unique Device Identification — the traceability code for medical devices.

Directive 2009/65/EC as amended, the EU framework for harmonised retail collective investment schemes. UCITS funds passport across the EU and are the dominant retail fund vehicle.

UN body for education, science and culture.

Unified Patent Court — litigates European patents centrally.

Recast Directive (EU) 2024/3019 on urban waste-water treatment.

Universal Service Obligation — duty to provide a baseline telecom/postal service to all.

A consumption tax placed on products at each stage of production where value is added. Standard across the EU but with varying rates by country (typically 17-27%).

Value Added Tax. A consumption tax applied at each stage of the supply chain in the EU. Registration thresholds vary by member state. Cross-border B2C sales require OSS (One-Stop Shop) registration or local VAT registration.

Regulation (EU) 2022/720, the EU competition-law block exemption for vertical agreements between firms at different supply-chain levels. Used for franchise, distribution, and supply agreements falling within market-share thresholds.

VAT in the Digital Age (Dir (EU) 2025/516): e-invoicing, platform VAT, single VAT registration, 2027-2030.

1963 international treaty establishing consular functions and immunities. Distinct from VCDR (diplomatic) and from headquarters-agreement frameworks for international organisations.

1961 international treaty establishing diplomatic relations between states, including immunities and privileges of diplomatic missions and personnel. Reference framework for diplomatic-mission classification distinct from extraterritorial organisations.

Very Large Online Platform, a DSA category (45 million-plus EU users) with extra duties.

Very Large Online Search Engine, a DSA category (45 million-plus EU users) with extra duties; the search-engine counterpart of VLOP.

Video on Demand.

World Anti-Doping Agency.

Directive 2012/19/EU as amended by 2018/849, the EU framework for collection, treatment, and recycling of electrical and electronic equipment. EPR-scheme registration mandatory for producers placing EEE on the market.

Regulation (EU) 2024/1157, the recast EU framework for waste shipments within the EU and to/from third countries. Tightens electronic notification, destination-country verification, and prohibitions on certain plastic-waste exports. Applies from 21 May 2026.

Directive 2000/60/EC establishing a framework for community action in the field of water policy.

Directive (EU) 2016/2102, requiring public-sector websites and mobile applications to meet WCAG 2.1 AA accessibility standards. Complements the European Accessibility Act for private-sector consumer surfaces.

International standard for web accessibility published by W3C. WCAG 2.1 AA is the EU compliance baseline for the European Accessibility Act, the Web Accessibility Directive, and most public-sector procurement requirements.

Waste Shipment Regulation (2024/1157, replacing 1013/2006). Governs cross-border waste transport with digitalised tracking from June 2026. Tightened controls on exports to non-OECD countries.

Building standard under EPBD recast requiring zero on-site emissions from fossil fuels and very high energy performance. Applies to new public buildings from 2028 and all new buildings from 2030.