January 2, 2023

What are the new EU policies startups should watch out for in 2023?

EU lawmakers aren’t slowing down with their efforts to regulate tech companies 

Zosia Wanat

6 min read

European startups, brace yourselves — there will be plenty of new regulations you’ll have to look out for in 2023. 

In recent years, European regulators have become somewhat more serious about policing tech companies. Even though they usually have Big Tech in mind when creating new rules, increasingly often these policies also affect European tech startups. 

“Regulation will be more and more important in tech life,” says Hugo Weber, public affairs director at Mirakl, a French ecommerce company. “It started with GDPR [the EU’s landmark data protection rules], the very famous one, and is now inflating as we have never seen before.”


New laws usually impact startups in two ways. They unify and clarify existing rules across the 27 European markets, which makes it easier for businesses to scale up and enter new geographies. They also often create a level playing field for smaller players on the market, as Brussels’ regulations tend to target Big Tech.

It started with GDPR, the very famous one, and is now inflating as we have never seen before

But new laws also mean more compliance obligations, which usually requires a lot of people power and money. 

“Overarching regulations mean there's less ability for [EU] member states to go play or change or interpret them differently,” says Daniel Dalton, a senior advisor at Allied for Startups, a startups trade association. “But the reality is, there are still more obligations on startups than there were before. That means it's costly to set up, it's costly to get going, it's costly to scale up [in new markets].”

Sifted has prepared a list of laws that European startups should watch out for in the coming year.

DMA and DSA — the follow up

In 2022, Brussels lawmakers managed to publish two giant pieces of tech regulation: the Digital Markets Act (DMA) and the Digital Services Act (DSA). But for tech companies, the struggle isn’t over — it’s actually only beginning. 

For EU startups, the DSA is more relevant — this new law forces online platforms, like social media, marketplaces, search engines, online travel platforms and cloud services, to be more transparent about how their algorithmic systems work. It also enforces content moderation rules to fight illegal content on such platforms. 

In practice, it will require more compliance and reporting work from the companies. First, they will have to report the number of active end users they have to the European Commission. If they get classified as big players, they’ll have to comply with the regulation by mid-2023; if they’re smaller businesses, then they have up until the beginning of 2024. The new requirements include, for example, conducting and publishing risk assessments and implementing rules on content moderation. UK-based startups watch out — the British parliament is currently processing similar legislation called the Online Safety Bill. 

DMA targets Big Tech companies — the so-called “gatekeepers” — so it shouldn’t affect startups in their everyday operations. The law aims to level the playing field between the biggest players, such as Google, Facebook or Apple, and their users. This could be beneficial for EU startups, which often fight unequal fights with the big platforms they rely on. But some fear this legislation could also have a negative effect on the ecosystem: some companies might be wary of getting too big (to avoid the additional compliance that comes with “gatekeeper” status) and become more cautious about future mergers and acquisitions. 

AI Act 

The EU’s landmark legislation on artificial intelligence is important for all startups that use AI —  think of services like online ad targeting and credit checks, or facial recognition.

The new law aims to harmonise the rules on AI across the continent, to ensure that only safe and trustworthy AI systems enter the market. The new law might ban certain uses of the technology (for example manipulation, exploitation and social scoring), police the use of facial recognition in public places and set strict rules for “high-risk” AI applications. The lawmakers are also looking at creating a definition of AI, and setting up guidelines for AI regulatory sandboxes — a regulatory “safe space” where innovators can try out their solutions without legal consequences. 

The negotiations on the final text are expected to finish in 2023. Once completed, this will be the most far-reaching set of rules for AI in the world. The UK has also proposed its own AI strategy which, in certain areas, differs from the one proposed in the EU.


Data Act

Brussels is also looking to regulate the handling of industrial data. A new law, the Data Act, establishes certain mandatory data sharing requirements for industrial data processors: think of connected cars, factory robots and smart home appliances. The new law aims to force such companies to share some of their data with other businesses, governments and their end users. 

While the law hasn’t been drafted with startups in mind, startup associations think it could be helpful.

“This is good news for startups, as it will allow them to better harness the potential of data to produce economic value and respond to consumer demands. An entrepreneur often is just an idea and the right dataset away from a startup,” Allied for Startups said in a statement. 

The work on the document is ongoing, but it’s unlikely that the legislators will wrap it up in 2023. 

An entrepreneur often is just an idea and the right dataset away from a startup

Platform work directive 

This one is important for all startups (and their workers) that operate in the so-called gig economy: food delivery apps like Deliveroo or ride hailing startups like Bolt. Brussels has proposed a set of measures to improve the working conditions of those who provide these companies' services. The new law will establish who is an “employee” of the platforms — which would give them labour and social rights, such as a minimum wage, paid holiday and sick leave and pension contributions.  

Brussels estimates that currently there are 28m platform workers active in Europe; out of this group, 5.5m are at risk of being wrongly classified as self-employed. Between 1.7m and 4.2m are expected to be reclassified as workers as a result of this new law.  

There are a lot of sticking points in the negotiations on this law, but there’s some hope that EU institutions will reach an agreement in 2023. 

European Innovation Agenda 

In 2022, the EU published its first ever policy roadmap for startups — and in 2023  the vision might become reality. Brussels has been slowly unveiling the details of various proposals (for example, an initiative to employ 1m people in deeptech or one to launch a new investment programme for venture capital) but much of the actual work is going to happen in 2023.

Over the course of the next 12 months, Brussels is planning to issue a guidance document on regulatory sandboxes (also relevant for AI projects), establish and connect its “deeptech innovation valleys” — local innovation ecosystems that will provide financial and business support to founders — launch an intern scheme for students who want to work in deeptech and create an innovation gender and diversity index.

The Commission is also planning to forge concrete definitions explaining what exactly startups, scaleups, deeptech companies and unicorns are.

Zosia Wanat

Zosia Wanat is a senior reporter at Sifted. She covers the CEE region and policy. Follow her on X and LinkedIn