EU · DACH · FRANCE · ITALY · BENELUX
Five regulatory regimes.
One execution record that holds up under all of them.
GDPR, PSD2, the AI Act, influencer disclosure directives, cross-border VAT. Every EU agency faces all five simultaneously. Most document after the fact. Cognitiva captures as execution happens.
WHAT YOU ARE DEALING WITH
Five overlapping regulatory regimes. No execution record that holds up under any of them.
Today, without Cognitiva
- GDPR consent reconstructed at audit time. Personal data scattered across creator briefs and payment systems.
- PSD2 payment compliance dependent on whatever rails the agency happened to use for the last invoice.
- AI Act audit-trail requirements met with email screenshots and PDFs of approval workflows.
- Cross-border VAT on creator payments calculated quarterly, retroactively, manually.
- Disclosure directive tracking (#ad, #sponsored) done in spreadsheets per platform.
With Cognitiva
- GDPR-compliant capture by design. Minimum personal data, addressable to the DPO on demand, deletable on request.
- PSD2-licensed Stripe rails for every EUR payout. Compliance is built into the settlement layer.
- Every approval, every revision, every payment captured as an evidentiary execution event.
- Cross-border VAT metadata generated per transaction. Quarterly filing becomes a query.
- Disclosure status tracked as a first-class event per platform per post. Compliance is automatic.
COUNTRY-SPECIFIC REQUIREMENTS
The law that applies to you. By market.
Germany
Federated enforcement across Landesbeauftragten. DPO required at scale. DSAR response legally mandated.
XInvoice / ZUGFeRD format mandatory for receiving from Jan 2025. Issuing mandatory from Jan 2027 (>€800K). PDF no longer valid.
LG München I has issued injunctions for inadequate influencer disclosure. Agency liability established.
Commission statements must be issued in writing within one month. Clear and complete — or the agent has enforcement rights.
Every payment event captures the structured metadata for XInvoice / ZUGFeRD. GDPR consent documented at capture. UWG disclosure status tracked per post.
France
Written contract required for any partnership >€1,000 HT since January 1, 2026 (Décret n° 2025-1137). Per advertiser, per objective, per calendar year.
DGCCRF fined Taboola €650,000 in 2023. Enforcement intensity increasing year-on-year. Agency liability when disclosure inadequate.
Strict consent interpretation. Profiling and automated decisions face additional scrutiny.
Alcohol advertising restricted to factual information only. Documentary obligation to demonstrate compliance on demand.
Written contract execution captured as immutable event. Disclosure status per post. CNIL-compliant data minimisation. Each partnership >€1,000 HT automatically documented.
Italy
Mandatory since 2019. No exemptions from 2024. FatturaPA XML v1.9. 12-day transmission deadline. 10-year archival. Penalty: 90–180% of VAT; €250–€2,000 per document sent late.
TD29: omitted or irregular invoices. RF20: cross-border VAT exemption scheme. Required from April 2025.
Italy's competition authority issues enforcement actions for inadequate influencer disclosure. Documentary burden falls on the agency.
Italy's data protection authority enforces GDPR with increasing intensity in digital marketing.
Payment approval → FatturaPA-ready structured metadata → SDI-compliant documentation. TD29 / RF20 supported. 10-year archival integrity guaranteed.
SIX FRAMEWORKS · ONE LEDGER
Every regulator that reads your record. Already satisfied.
General Data Protection Regulation
Legal basis at capture. DSAR in hours. Deletion on request. DPO-ready by design.
Payment Services Directive 2
SEPA EUR disbursements via fully PSD2-licensed Stripe infrastructure. Every payout linked to the approval that authorised it.
EU AI Act (Reg. 2024/1689)
Full enforcement August 2026. Every AI-assisted decision captured as an evidentiary event.
Unfair Commercial Practices Directive
Disclosure status tracked as a first-class event per platform, per post. Automatic, not manual.
Cross-Border VAT / ViDA
VAT metadata generated per transaction at settlement. Quarterly filing becomes a query.
National Enforcement Authorities
France (DGCCRF, ARPP), Germany (UWG), Italy (AGCM). Documentary burden lands on the agency. We pre-build the dossier.
HOW THE RECORD IS BUILT
Compliance produced as a by-product of execution.
Your team does not change a single workflow. Cognitiva sits beneath the tools you already run and captures every event the moment it fires.
Brief accepted.
The creator reads the brief, accepts the terms. The acceptance is captured as a signed, time-stamped event — with the legal basis for GDPR processing documented at the moment of acceptance.
Work delivered. Approval given.
The deliverable arrives. The brand director approves. Cognitiva captures who approved, when, via which tool, against which brief version. Immutable.
Payment released. VAT metadata generated.
The approval triggers the payment rail. SEPA EUR disbursement via PSD2-licensed Stripe. The payment event carries structured metadata: amount, recipient, transaction type, VAT regime.
Audit request received. Dossier produced.
The DGCCRF investigates. The Garante asks. The DPO receives a DSAR. You run a query. The dossier was pre-built at execution time.
THE PROOF CALL
45 minutes. You leave with the dossier.
One live campaign of yours. We show you what the execution record looks like when it is built correctly — and we send the compliance export to your inbox before the call ends.
Book the walkthrough →NO DECK · NO NDA · JUST YOUR STACK ON SCREEN