EU Readiness
Selling into the EU? The rules got there first.
GDPR reaches you the moment you process an EU customer’s data. The EU AI Act’s training duty has applied since February 2025: Delaware address or not. And long before any regulator calls, your EU customer’s procurement team sends the questionnaire.
- GDPR, Art. 3(2)
- EU AI Act, Art. 4
- Customer questionnaires
- Data hosted in the EU
In 80 seconds
Prefer to watch?
The same arc as this page, only faster: the five regimes, the moment the questionnaire arrives, and the evidence your EU customer will ask for.
The map
Five regimes, five triggers.
None of them asks where you are incorporated. They ask where your customers, users and parcels are.
Applies when you offer goods or services to people in the EU or monitor their behaviour (Art. 3(2)): incorporation is irrelevant. Your EU customers will ask for a DPA, a transfer mechanism and proof of staff training.
Art. 4 requires a sufficient level of AI literacy in your staff, in force since 2 February 2025, no size threshold. The newest duty, and the one most US companies have never heard of.
NIS2 makes your EU customers accountable for their supply chain. You will meet it as a security questionnaire, including questions about awareness training.
Products with digital elements placed on the EU market carry security and reporting duties for the manufacturer. That is you, not your EU distributor.
Product safety requires an EU responsible person; packaging rules add registration and labelling duties per member state. Dedicated GPSR/PPWR training is on our roadmap. The curriculum below covers the four regimes above.
The moment it bites
Your EU customer’s procurement team asks first.
Data processing agreement, transfer mechanism, technical and organisational measures, and evidence of staff training. Somewhere on page four sits the question that stalls the deal for three weeks. In a competitive evaluation, that delay is an argument against you that nobody puts in writing.
EU readiness is a sales asset, not a legal cost. The evidence you collect now is the answer sheet for every EU deal that follows.
Three of the five regimes ask about your people.
GDPR makes staff awareness part of “appropriate measures” (Art. 24, 32, and Art. 39 where a DPO exists). The AI Act demands AI literacy since February 2025 (Art. 4). NIS2 sends management to cybersecurity training and mirrors the duty into supplier requirements (Art. 20(2)).
What all three have in common: the deliverable is not attendance. It is documented, auditable evidence. Certificates with dates, content and pass marks, exportable the day the questionnaire arrives.
EU data residency, by construction.
ConformBase is built and hosted in the European Union, and every course claim carries a citation to the official legal text. “Where does our staff’s training data live?” is a standard question in every DPA negotiation with your EU customers: “in the EU” is the answer that ends the thread.
The curriculum
Eight courses. Four regimes. All in English.
The English editions of the courses our EU customers train with: curated for the four regimes that reach US companies. Every claim carries a citation to the official legal text, and every course opens with a free preview of its first module.
Data-Subject Rights & Data Breaches
the operational side your EU customers ask about
Processing on Behalf & Third-Country Transfers
SCCs and the Data Privacy Framework: the transfer question, from the US side
EU AI Act — AI Literacy & Obligations
Art. 4 applies since 02/2025, no size threshold
NIS2 — Obligations for Companies
reaches US suppliers through their EU customers’ questionnaires
Cyber Resilience Act — Reporting & Product Security
US software vendors with an EU market
ISO/IEC 27001 — ISMS Fundamentals
the bridge to the security questionnaire: also part of Security Baseline
Pricing
Per learner, per year. In dollars.
The full EU-readiness curriculum: GDPR, AI literacy under Art. 4, NIS2, CRA and ISO 27001, in English, with certificates and the audit export. Annual billing; three-year prepay takes 20% off. Self-serve up to 250 learners. For scale: fifty learners cost about four attorney hours. Per year.
| Learners | Annual | 3-year prepay |
|---|---|---|
| 1–25 | $59 /user/yr | $47.20 /user/yr |
| 26–100 | $49 /user/yr | $39.20 /user/yr |
| 101–250 | $42 /user/yr | $33.60 /user/yr |
| 251–1000 | $35 /user/yr | $28 /user/yr |
| 1000+ | Volume quote: get in touch | |
The white paper
Eight pages. The five triggers, the questionnaire, the 30-day plan.
Selling into the EU: what actually applies to you
Five regimes, the triggers that switch them on, the supplier questionnaire that stalls deals, and the 30-day plan. Free, 8 pages.
- 8 pages
- free
- No sales call
That address didn't work. Please check it and try again.
Plus 3 short follow-up emails about this topic, then it stops. Unsubscribe in every one.
We use your address to send you this paper. Privacy.
You can also open it right now:
Common questions
What US teams ask first
GDPR: yes, if you serve people in the EU (Art. 3(2)). The AI Act: yes, if your AI system reaches the EU market. NIS2 and the CRA reach you through your customers and products, not through your registration. This page is orientation, not legal advice, but the questionnaire from your customer will not wait for either.
GDPR fundamentals for everyone who touches customer data, AI literacy under Art. 4 for everyone using AI tools, and security awareness as the baseline your customers’ NIS2 programmes ask about. All available in English, with certificates and an audit export.
In the European Union. For a US company selling into the EU that is the point, not a footnote: “where does the data live?” is a standard question in every DPA negotiation with your EU customers, and “in the EU” is the answer that ends the thread.
Per user per year, in dollars: $59 at the entry band down to $35 at 251–1000 learners, minus 20% on a three-year prepay. The full table is on this page. For scale: fifty learners cost about four attorney hours. Per year.