According to media reports, the European Union’s 21st package of sanctions against Russia and Belarus, published on 23 July 2026, was preceded by weeks of protracted and difficult negotiations. Several Member States succeeded in securing mitigations or concessions in favour of domestic businesses. Nevertheless, the latest package contains the most extensive listings of natural and legal persons, entities and bodies in four years, as well as a range of further tightening measures in relation to sectoral sanctions. Key measures include new restrictions targeting the Russian financial sector, the introduction of a new instrument which enables a complete prohibition on crypto-asset services from specific third countries, and the suspension of the automatic adjustment mechanism for the crude oil price cap until 15 July 2027. In addition, the package once again seeks to strengthen the legal position of European companies against abusive Russian jurisdiction.

On 22 July 2026, a coalition of European companies and organizations published an open letter calling on the Commission to enforce the Digital Markets Act (DMA) in full and without delay. The letter responds to hesitant enforcement posture, as the signatories see it: under pressure, particularly from the U.S., they accuse the Commission of holding back or delaying action under the DMA. As if reacting on the spot, the Commission announced two non-compliance decisions against Google under the DMA, just the following day imposing total fines of EUR 890 million. However, as sizeable as the fine may seem, it accounts for less than 1% of Alphabet's annual turnover and sits at the lower end of the DMA's sanctioning scale. Thus, instead of proving the signatories right by showing that public enforcement is ongoing, the decisions actually are best proof that political pressure from abroad continues to weigh on the Commission’s decision-making.

We take the opportunity to revisit the DMA's second pillar: private enforcement. Building on our March 2024 briefing, we summarize some rulings that German courts have handed down and shows how private action complements and, in some respects, outpaces the Commission's work in Brussels.

While digital ex ante regulation, such as the DMA, is all the rage lately, traditional cartel and abuse of dominance enforcement in the video games industry is more alive than ever with eye-watering fines for offenders, or remedies aiming to improve market conditions for studios and publishers. For developers, publishers, hardware manufacturers, platform operators, and any other business active in the video games industry, cartel and abuse of dominance prohibitions are not abstract legal theory. They directly shape how games are developed, published, distributed and monetised across the EU. Getting it wrong can mean serious trouble with competition authorities. This briefing zooms in on antitrust basics and their significance for gaming companies active in Europe.

BLOMSTEIN is delighted to welcome two highly experienced senior lawyers: Juliana Wimmer and Uğur Can Hekim will further enhance our international trade and regulatory practice and our advisory strength in complex international regulatory matters.

Across Europe competition authorities are increasingly targeting M&A transactions that fall below traditional turnover thresholds. The European Commission (EC) and several National Competition Authorities (NCAs) are expanding their toolkits through call-in powers, post-closing antitrust enforcement and expansive interpretations of existing frameworks to close the gap around below-threshold deals in fear of missing out on so-called killer or roll-up acquisitions. While killer acquisitions mean large established market players buying nascent competitors to eliminate future competition, roll-up acquisitions refer to a company systematically taking over small competitors to achieve consolidation of a fragmented market.

BLOMSTEIN starts the New Year with three celebrations: Elisa Theresa Hauch is promoted to the Antitrust Partnership; Konstantin Kuhle, former Member of the German Bundestag, joins as Special Counsel, and Bruno Galvão is appointed Counsel.

On 23 October 2025, the European Commission adopted another set of sanctions against Russia and Belarus. The new package targets key sectors such as energy and finance, the military industrial base, special economic zones, as well as enablers and profiteers of Russia’s aggression against Ukraine. It is noticeable that the new measures increasingly target third country companies outside of Russia. The EU legislator is trying to further reduce the risk of circumvention of the restrictions by extending the scope of important restrictions.

BLOMSTEIN is becoming (even) more international: On 1 October 2025, we are expanding our European presence and will open an office in Brussels. With BLOMSTEIN already being strongly connected across Europe and globally, the new Brussels office marks the natural next step in our international footprint and strengthens our proximity to European institutions. 

The NIS 2 Directive (EU) 2022/2555 is intended to raise the level of IT security in Europe significantly. The directive applies not only to federal government authorities, but also to entities deemed essential or important in sectors considered particularly critical. In order to determine whether a company is subject to the regulation, it must first be established whether it operates within one of the affected sectors. Secondly, the company must meet certain thresholds in order to be classified as an essential or important entity. For the entities concerned, stricter requirements will apply to network and information systems, and reporting obligations will be expanded. Management responsibilities will also increase. The directive will affect significantly more companies and sectors than before. As well as broadening the scope within sectors already regulated under the NIS 1 Directive such as energy, transport and healthcare, the NIS 2 Directive now covers additional areas, including digital services, postal and courier services, wastewater and waste management, and 'manufacturers of critical products'.

 On August 1, 2025, additional cybersecurity requirements will come into force for a large number of electronic devices under the Radio Equipment Directive (Directive 2014/53/EU; RED). Despite this approaching deadline, many issues are still unclear, in particular the scope of application of the new regulations and the interpretation of the term "internet-connected radio equipment ".