The digital landscape in 2024 is measured less by its technological promises than by the regulatory constraints that now frame it. Between the Digital Services Act effective since February, the European AI Act that came into force in August, and the NIS2 directive on cybersecurity, web projects are facing a profoundly reshaped legal framework. Which texts are concretely changing the game for web professionals, digital marketing, and development?
Three European regulations redefining web projects in 2024
Competitors talk about AI, UX, and design trends. Few focus on what truly constrains technical and strategic decisions this year: regulation. Three European texts have changed the rules of the game in just a few months.
| Regulation | Effective Date | Main Scope | Concrete Web Impact |
|---|---|---|---|
| Digital Services Act (DSA) | February 17, 2024 | All digital intermediaries | Transparency, combating illegal content, prohibition of dark patterns |
| AI Act (EU 2024/1689) | August 1, 2024 (entry into force) | AI systems (chatbots, recommendations, recruitment) | Progressive compliance obligations until 2026 |
| NIS2 Directive | Transposition by October 17, 2024 | Major and important organizations | Enhanced cybersecurity requirements for an expanded scope |
This table summarizes the three texts, but their practical implications vary greatly depending on the size of the organization and the type of digital project involved.
To find information about Infiniti Geek and keep up with these technical developments over time, regular monitoring remains the best reflex in a rapidly changing framework.
DSA and dark patterns: what the Digital Services Act changes for web content
The DSA does not only concern giants like Meta or Google. Its scope includes forums, marketplaces, messaging applications, and even sites publishing user reviews. In practical terms, any site that hosts third-party content is potentially affected.
One of the most structuring aspects concerns the prohibition of manipulative interfaces, the infamous dark patterns. Cookie consent pop-ups designed to push for acceptance, deliberately complex unsubscribe processes, fake urgency counters on e-commerce pages: these practices are now subject to regulation.
For web development and UX design teams, this implies an audit of existing user journeys. Conversion strategies that relied on cognitive biases exploited by the interface must be revised. The DSA also strengthens transparency obligations regarding content moderation and algorithmic recommendation systems.
Points of vigilance for site publishers
- Ensure that consent forms respect the principle of visual neutrality between acceptance and refusal
- Document user content moderation processes (reviews, comments, forums)
- Make information about how recommendation algorithms work accessible, even for mid-sized players
AI Act and digital marketing: compliance of chatbots and generated content
The AI Act transforms the governance of artificial intelligence into an operational subject. Chatbots deployed on a website must indicate their artificial nature to the user. This obligation also applies to AI-generated content, whether it be text, images, or videos.
The recommendation systems used in e-commerce and content marketing are also targeted. Their operation must be explainable, and potential biases documented. Compliance is progressive: the first prohibitions regarding systems with unacceptable risk began to apply in February 2025, with other obligations following until 2026 and beyond.
For SEO content creators and marketing teams, using generative AI to produce content requires a traceability framework. Knowing which tool generated which text, what training data was used, and being able to document it becomes a compliance requirement, not just a best practice.
What this changes for content strategy
Companies that use AI to feed their social media, write product sheets, or personalize user experience must integrate this layer of compliance from the design stage. The cost is not only technical: it also affects internal governance and team training.
Cybersecurity and NIS2 directive: an expanded scope affecting web development
The NIS2 directive significantly expands the number of organizations subject to strict IT security obligations. The scope is no longer limited to critical infrastructure operators: it now includes sectors such as waste management, manufacturing, postal services, and public administration.
For web agencies and developers, this translates into enhanced requirements from their clients. An e-commerce site operated by a company classified as a “major entity” under NIS2 must meet higher security standards: incident management, regular penetration testing, data encryption in transit and at rest.
- Web development providers may be held liable if they intervene in the security chain of an entity subject to NIS2
- Security audits become a contractual prerequisite for certain projects, not an optional bonus
- Documentation of security measures implemented must be accessible to competent authorities in case of an incident
This directive pushes web security from the status of technical recommendation to that of measurable regulatory constraint.
The European regulatory framework of 2024 has shifted several topics from the realm of trends to that of obligations. DSA, AI Act, NIS2: these three texts directly impact site design, digital content production, and user relationship management. Regulatory compliance has become a permanent work item in web projects, on par with SEO or front-end development.
