What sources does Taxxa search?

Taxxa searches a continuously updated collection of more than one million pages from tax authorities, government publications, legislation and case law across the European jurisdictions it covers. Every response cites the underlying material, so a professional can inspect the rule, its jurisdiction and whether it is current before relying on the result.

Can Taxxa work with a team’s own documents?

Yes. Research can combine the public knowledge base with a team’s own PDF, DOCX, CSV and TXT files in one workspace. That makes it possible to compare a client document with the relevant guidance, trace a conclusion to its source and prepare a draft without losing the evidence that supports it.

Who is Taxxa built for?

Accountants, auditors, tax advisors, payroll specialists, bookkeepers and advisory teams working across European jurisdictions. Shared workspaces keep research available to colleagues, and citations make review easier.

Where is customer data stored, and is it used to train models?

Customer data stays in the European Union and is never used to train language models.

Does Taxxa replace professional judgement?

No. Taxxa is a research and drafting workspace. It helps professionals reach an informed starting point faster; the professional still reviews the evidence and makes the final decision. It does not file returns, post bookkeeping entries or give legal advice.

IT, Cybersecurity & Data news

Saturday, 31 October 2026

Regulatory changes detected daily from official sources across Europe. Create a free account to follow your jurisdictions and ask Taxxa what a change means in practice.

Data Protection & Privacy Regulations (GDPR)FranceLégifrance2 days ago

CNIL fines FNAC group €7M over app recommendations without consent

FNAC DARTY companies fined €6M and €1M after the FNAC app tracked users who clicked “continue without accepting” to feed product recommendations.

Industry: Across industries

AI Regulation & Algorithmic AccountabilityGermanyBundessteuerberaterkammer4 days ago

BStBK adds AI-labelling Q&A for public-facing AI texts

The updated 27 October AI FAQ adds a labelling Q&A under Art. 50(4) and reverses the 'no duties' line for firms.

Industry: Accounting, bookkeeping and auditing activities; tax consultancy

AI Regulation & Algorithmic AccountabilitySwedenFAR4 days ago

High AI Act fines do not automatically mean a material breach

FAR's rewritten AI explainer says high AI Act fines do not automatically make a breach material — assess facts and effects under ISA 250 — and sets staged AI Act dates through 2028.

Industry: Accounting, bookkeeping and auditing activities; tax consultancy

Data Protection & Privacy Regulations (GDPR)FinlandTelp1 week ago

Public-interest data basis reaches private handlers of public tasks

Public-interest processing needs a statutory basis; since 1 September 2026 it also reaches private handlers of public tasks, and research or statistics must check whether the basis is duty or public interest.

Industry: Across industries

Data Protection & Privacy Regulations (GDPR)FranceLégifrance1 week ago

CNIL clears synthetic oncology dataset for open data

Octopize may turn pseudonymised Roche and Medipath cancer records into synthetic ONCOVAL profiles for open release, under binding no-re-identification terms and three-yearly reviews. Authorised 8 October 2026.

Digital Operational Resilience (DORA)EstoniaFinantsinspektsioon2 weeks ago5 documents

Estonia moves DORA incident reports to joint portal from 1 November

Encrypted e-mail runs only to 31 October 2026; from 1 November DORA incident and cyber-threat reports must use the joint data-collection portal, with money fields in thousands.

Industry: Financial and insurance activities

Cybersecurity Laws & NIS2 FrameworkEstoniaRiigi Teataja2 weeks ago

Estonia adds near-miss incidents, 3-year audits to cyber law

Estonia adds a near-miss cyber incident category across notification, register and cooperation duties and gives RIA need-based plus three-yearly audits of critical entities.

Industry: Across industries

AI Regulation & Algorithmic AccountabilityEuropean UnionEUR-Lex2 weeks ago

EU publishes AI quality-management standard EN 18286:2026

EN 18286:2026 gives providers of high-risk AI systems a presumption of conformity for quality-management and post-market monitoring duties from 14 October 2026.

Data Protection & Privacy Regulations (GDPR)FinlandFinlex2 weeks ago

Helsinki clinic fined EUR 20,200 for ignoring patient-data order

Plastic Surgery Center Helsinki Oy defied a binding order to hand over a patient's records by 29 August 2026; the sanctions board fined it EUR 20,200 for deliberate non-compliance.

Industry: Human health activities

AI Regulation & Algorithmic AccountabilityDenmarkRetsinformation3 weeks ago

Denmark retables AI Act with fines, market powers, registration duty

Bill L 3 replaces the 2025 AI Act: Digitaliseringsstyrelsen becomes the contact point, safety-component AI must register, and breaches carry fines.

Industry: Across industries

Data Protection & Privacy Regulations (GDPR)NorwayRevisorforeningen4 weeks ago

Finanstilsynet seeks power for fully automated decisions on auditors

New § 6-5 in the finanstilsynsloven would let the supervisor decide cases by automation alone and new § 6-6 would let it test IT systems on real personal data; hearing responses are due 6 October 2026.

Industry: Accounting, bookkeeping and auditing activities; tax consultancy

Data Protection & Privacy Regulations (GDPR)DenmarkDatatilsynet4 weeks ago

Datatilsynet: TIA required before SCC/BCR transfers, not for adequacy ones

Datatilsynet: adequacy-country transfers need no further exporter measures, while Article 46 SCC/BCR transfers require a prior TIA, aided by the CNIL guide and EDPS checklist.

Industry: Across industries

Digital Operational Resilience (DORA)EstoniaFinantsinspektsioon1 month ago4 documents

Estonia sets 2026 year-end DORA register round, adds TIBER-EE testing guide

The DORA information-register round is collected in early 2027 as of 31 December 2026, and a new section sets threat-led testing under the TIBER-EE national guide.

Industry: Financial and insurance activities

Cloud Computing & Data Sovereignty RulesFranceLégifrance1 month ago

Health-data hosting locked to EU/EEA with transfer map duty

Hosted health-data storage must sit exclusively in the EU/EEA, contracts gain compelled-transfer disclosure clauses, and hosts must publish a live map of third-country transfers and remote access.

Industry: Data processing, hosting and related activities

Electronic Records & Digital Evidence StandardsFranceLégifrance1 month ago

Polynesian communes shift accounting chain to paperless PES v2 exchanges

Polynesian communes go paperless on PES v2+: three signature options, probative electronic data, and a tripartite convention with suspension fallbacks.

Industry: Across industries

Digital Operational Resilience (DORA)EstoniaFinantsinspektsioon1 month ago

Estonia adopts TIBER-EE framework for threat-led penetration tests

Finantsinspektsioon's recommended TIBER-EE guide in force since 15 September 2026 sets the national playbook for DORA threat-led penetration testing, with voluntary use subject to prior coordination.

Industry: Financial and insurance activities

Data Protection & Privacy Regulations (GDPR)European UnionEUR-Lex1 month ago

AG: unnamed 'partners' consent cannot support direct marketing

Advocate General Spielmann opines in Case C-317/25 that ISP 'partners' consent cannot support Groupe Canal +'s marketing without fresh consent, proposing the Court answer the first question accordingly.

Industry: Across industries

Digital Operational Resilience (DORA)GermanyRechtsprechung des Bundes2 months ago3 documents

Auditors must now test DORA ICT resilience at securities firms

BaFin ordinance of 26 August 2026 (BGBl I Nr. 256) extends the audit report to DORA ICT duties for Wertpapierinstitute and crowdfunding providers, first for years starting after 31 Dec 2024.

Industry: Legal and accounting activities · Other financial service activities, except insurance and pension funding n.e.c. · Other activities auxiliary to financial services, except insurance and pension funding

Digital Operational Resilience (DORA)NorwayFinanstilsynet2 months ago

DORA replaces Norway’s ICT rules for additional financial firms

From 1 September 2026, financing, debt-collection and estate-agency firms face adapted DORA requirements. The supervisor specifies temporary incident-reporting channels.

Industry: Activities of collection agencies and credit bureaus · Real estate agencies · Other credit granting · Non-life insurance

Cybersecurity Laws & NIS2 FrameworkEstoniaRiigi Teataja2 months ago

Estonia replaces its information-security standard from 1 September

The new regulation preserves compatible existing security measures and allows pre-existing compliance documentation to remain valid for up to three years.