If you sell into the European Union in 2026 and haven’t audited your compliance stack since 2024, you’re operating with a ticking clock. Three regulatory shifts converged this year: the full enforcement phase of the EU Digital Markets Act (DMA), updated VAT One Stop Shop (OSS) thresholds under the ViDA package, and the Product Liability Directive rewrite that now sweeps in digital goods and marketplace operators. Together, they’ve created a compliance surface area that most mid-market DTC brands and Shopify operators haven’t mapped.
“We had four clients hit with German customs audits in Q1 alone,” says Margaux Leblanc, head of cross-border strategy at Berlin-based agency Globalic Commerce. “Every single one had been using the same VAT OSS registration they set up in 2022 and assumed it still covered them. It didn’t.” The following guide walks you through rebuilding a compliant EU cross-border stack in seven operational steps — with specific tools, vendor names, and cost benchmarks from operators running €500K to €20M in annual EU GMV.
What changed in EU cross-border regulations in 2026 that operators must know?
Three changes demand immediate attention:
- ViDA (VAT in the Digital Age): Effective January 1, 2026, the EU’s ViDA package introduced real-time digital reporting requirements in Germany, France, and the Netherlands. Sellers above €10,000 annual EU net revenue must now transmit structured e-invoices (EN16931 format) to national tax authorities within 48 hours of transaction. The old quarterly OSS filing model no longer satisfies these three markets alone.
- Digital Markets Act gatekeeper rules: If you sell via Amazon EU, Zalando, or any designated gatekeeper marketplace, those platforms are now required to share first-party buyer data with sellers under interoperability mandates — but only if you formally request it through the platform’s DMA data portal. Most sellers haven’t done this yet and are leaving attribution and retargeting data on the table.
- Product Liability Directive (PLD) rewrite: Effective July 2025 but with enforcement ramping now, this directive extends liability to economic operators — including marketplace sellers and Shopify merchants importing from China — for defective products, including software and digital components embedded in physical goods. Your product descriptions are now legal documents.
Step 1: Audit your current VAT OSS registration and ViDA exposure
Start with your OSS registration country. Most U.S. and UK DTC brands registered in Ireland or the Netherlands in 2021-2022 because of low bureaucratic friction. That registration is still valid for 24 of the 27 EU member states, but Germany, France, and the Netherlands now require supplemental real-time reporting alongside OSS filings.
Tool: Use Taxdoo (Hamburg-based, integrates natively with Shopify and Shopware) or Avalara’s EU ViDA module, which launched in March 2026. Taxdoo charges roughly €299/month for merchants under €2M EU GMV and generates EN16931-compliant e-invoices automatically. Avalara’s module runs about $450/month but offers broader ERP integrations if you’re on NetSuite or SAP.
“The ViDA 48-hour rule caught every single one of our clients off guard. We spent February migrating six stores from manual OSS filing to Taxdoo’s automated pipeline. The cost of the tool is nothing compared to the penalty exposure.” — Margaux Leblanc, Globalic Commerce
Pro tip: If you’re below €10,000 EU net revenue annually, you may still be exempt from ViDA real-time reporting — but that threshold is per-country in Germany’s interpretation. Confirm your position with a local VAT advisor before assuming exemption applies.
Step 2: Register for DMA data access on gatekeeper platforms
This step is consistently skipped and consistently valuable. Amazon EU, Google Shopping, Meta (for EU users), and Zalando are all designated DMA gatekeepers. Under Article 6 of the DMA, sellers using these platforms can now formally request access to aggregated and anonymized buyer data that gatekeepers were previously permitted to withhold.
For Amazon EU sellers: log into Seller Central EU, navigate to Brand Analytics → DMA Data Access Portal (rolled out in Amazon EU Seller Central in February 2026). Submit a structured data request. Amazon is legally required to respond within 30 days. The data includes purchase frequency by category, cross-shopping behavior, and — critically — whether your buyers also purchased from a gatekeeper’s own private label within 90 days.
“We filed DMA data requests for three brand clients in March,” says James Whitfield, founder of London-based Amazon agency Meridian Marketplace. “What came back was eye-opening. One client’s buyers had a 34% co-purchase rate with Amazon Basics in the same category. That’s a targeting and positioning signal you can’t get anywhere else.”
“DMA data access is the most underutilized competitive intelligence tool in EU ecommerce right now. Sellers have a legal right to this data and almost nobody is using it.” — James Whitfield, Meridian Marketplace
Step 3: Rewrite product listings to meet PLD liability standards
Under the rewritten Product Liability Directive, your product titles, bullet points, and safety descriptions carry legal weight. Specifically: if your listing omits a known safety limitation or misrepresents a product’s digital functionality, you can be held liable for damages without the buyer having to prove negligence — a shift from the old fault-based standard.
Practical actions:
- Add CE/UKCA marking status explicitly to all product descriptions, not just the backend compliance fields.
- For any product with embedded software (smart home devices, wearables, connected accessories), add a firmware update policy and end-of-support date to the listing.
- Review all “claim” language with a focus on German, French, and Austrian consumer protection law, which has the strictest UWG (Unfair Competition Act) application in the EU.
- Document your supplier chain. PLD now allows national courts to name importers as defendants even when the manufacturer is outside the EU. Your Chinese supplier’s product test reports need to be accessible within 72 hours of a complaint.
Tool recommendation: Prodly Compliance (SaaS, ~$199/month) integrates with Shopify and Amazon Seller Central to flag listing language that triggers PLD risk patterns. It’s not a law firm substitute, but it catches the obvious gaps at scale.
Step 4: Set up a EU-resident fiscal representative if you don’t have EU legal presence
If your business is incorporated outside the EU and you’re above €150,000 annual EU GMV, France, Spain, and Poland now require a fiscal representative — a local entity that co-signs your VAT obligations. Ireland and the Netherlands do not require this, which is part of why so many brands anchor their EU OSS registration there.
Vendors: Fiscal Solutions (UK/EU hybrid, ~€1,200/year for fiscal rep services in France and Spain), Global-e for end-to-end landed cost and fiscal representation bundled into their checkout product (they take a percentage of GMV, typically 2.5-3.5%, which rolls up compliance, currency, and duty calculation).
Pro tip: If you’re below €150K EU GMV, skip the fiscal rep and use Global-e or Zonos to handle HS code classification and duty calculation at checkout instead. Zonos integrates with Shopify in about four hours and reduces customs clearance failure rates by flagging misclassified SKUs before they ship.
Step 5: Implement EN16931 e-invoicing in your order management system
This is the most technically demanding step for brands running custom stacks. EN16931 is the EU’s structured e-invoice XML standard. For ViDA-affected markets (Germany, France, Netherlands), every B2C and B2B transaction above €250 requires a compliant invoice transmitted to both the buyer and, in Germany’s case, the Bundeszentralamt für Steuern (federal tax authority) via the PEPPOL network.
If you’re on Shopify, the path of least resistance is Taxdoo (mentioned above) or Sufio, which added ViDA-compliant PEPPOL transmission in its April 2026 update. Sufio’s EU Compliance plan runs €149/month and handles invoice generation, transmission, and archiving (EU law requires 10-year invoice retention).
If you’re on a headless or custom stack, you’ll need a direct PEPPOL access point provider. Pagero (now owned by Thomson Reuters) and Basware both offer API-based PEPPOL onboarding at roughly €500-€800/month for mid-market transaction volumes.
Step 6: Build a regulatory monitoring workflow
EU regulations iterate faster than most merchants update their tech stacks. The GPSR (General Product Safety Regulation) that took effect in December 2024 still has merchants scrambling. The Ecodesign for Sustainable Products Regulation starts imposing category-specific requirements from Q3 2026 onward, beginning with textiles and electronics.
Build a lightweight monitoring workflow:
- Subscribe to the EUR-Lex RSS feed filtered for your product categories. Free, authoritative, and faster than any newsletter.
- Assign one team member quarterly to review updates from the European Commission’s Single Market Compliance Space portal.
- If you’re above €5M EU GMV, retain a EU trade law firm on a monthly retainer. Fieldfisher and Bird & Bird both have dedicated ecommerce regulatory practices.
- Set a calendar reminder every January 1 and July 1 to re-audit your VAT OSS registration, PLD disclosures, and platform DMA data requests.
What does a fully compliant EU cross-border stack actually cost to run?
For a brand doing €2-5M annual EU GMV, the all-in compliance stack — VAT automation, e-invoicing, fiscal rep, HS code classification, and monitoring — runs approximately €1,800-€3,200/month in SaaS and vendor fees. That’s roughly 0.4-0.7% of GMV at the midpoint. Compared to the fine structure under ViDA (penalties of 2-5% of EU annual turnover per infraction in Germany), it’s asymmetrically cheap insurance.
“The merchants who get hurt are the ones who treat EU compliance as a one-time setup task,” says Leblanc. “The regulatory environment here iterates on a 12-18 month cycle. You need a stack that updates with it, not a spreadsheet you last touched in 2023.”
The EU is still the largest addressable cross-border market for U.S. and UK DTC brands — roughly €900B in total ecommerce volume in 2025 per Eurocommerce data. The compliance overhead is real, but the brands building the right infrastructure now are locking in market access that less-prepared competitors will lose when the next enforcement wave hits. Start with your VAT OSS audit this week. Everything else follows from that.
