A seller established outside the EU who sells to European consumers today already has to navigate six distinct regulatory regimes. By 2028, a seventh will be in force.
Taken individually, none of these texts is new news — VAT reform dates back to 2021, the DSA to 2023, GPSR to 2024. What deserves attention is not any single pillar, but the pattern that emerges when you line them up on a single timeline: in every one of them, compliance duties shift toward whichever party is established in the EU — a marketplace or an authorised representative — the moment the original seller isn’t.
CB Consulting & Management — status as of 22/07/2026
The six pillars, and the one taking shape
Tax was first. Since 2021, the deemed supplier rule (Article 14a) has made marketplaces liable for VAT collection through OSS and IOSS, regardless of where the underlying seller sits.
Customs followed on a longer fuse. The €150 duty-free threshold ended on 1 July 2026, replaced by a flat €3-per-item duty under Regulation 2026/382. The same reform creates an EU Customs Authority, fully operational from 1 January 2028, followed on 1 March 2028 by “deemed importer” status for platforms — the customs equivalent of the VAT deemed supplier rule. A longer rollout of the EU Customs Data Hub then extends out to 2037.
Product safety moved next. GPSR has required an EU responsible person since December 2024, with Article 22 placing parallel duties directly on marketplaces; implementation guidelines followed in November 2025.
The environmental pillar is the most fragmented, and the one moving fastest right now: WEEE, battery and textile EPR already require an EU representative; French AGEC packaging EPR took effect on 1 July 2026; PPWR brings per-country EPR and marketplace checks from 12 August 2026; a bill on marketplace EPR co-liability is expected in late 2026.
Digital obligations under the DSA have been in force since 2023 for the largest platforms (Article 34-35, VLOP duties) and since February 2024 for baseline duties under Articles 16-32. This summer’s €550 million fine against AliExpress is the most visible sign yet that enforcement has moved from text to practice.
Consumer protection — the right of withdrawal and the anti-geo-blocking regulation — is the one pillar already fully settled and stable.
Why the convergence matters more than any single text
None of these six regimes was designed with the others in mind; they come from different Directorates-General, on different legislative timetables, addressing different risks. Yet they converge on the same structural answer: when the seller sits outside the Union, the compliance burden does not disappear — it is reassigned to whoever is inside it.
For a marketplace, that means expanding legal exposure well beyond its original role as an intermediary. For a non-EU seller, it means that the choice of EU representative — customs, EPR, or otherwise — is no longer a formality; it is a determination of who actually carries the regulatory risk.
Where a given business sits on this timeline is worth mapping precisely, pillar by pillar, rather than assuming any one filing covers the rest.