China OEMs Entering Europe: The Compliance Risk Panorama (2024–2027)
A field report on the 20+ EU regulations Chinese automakers face — data security, right to repair, fleet CO₂, tariffs, WVTA — with case studies, a 5-stage checklist, and differentiated strategy by OEM type.
(incl. 10% base duty)
The most expensive compliance failure in auto history
(810k units, +99% YoY)
Cost $1.8–3.5m
(global revenue; TikTok case €530m)
Compliance Risk Panorama Matrix: Four Risk Tiers
Based on regulatory urgency, fine exposure, technical access barriers, and commercial impact, we classify the compliance risks facing Chinese automakers into four tiers. This is the starting point for any compliance strategy.
Key Compliance Timeline (2024–2028): The Compliance "Combo"
EU automotive regulation forms a dense "compliance combo" across 2025–2027 — the Data Act, Right to Repair, Euro 7, the battery passport, and the CRA arriving in quick succession. Chinese companies must build a "regulatory radar" and plan 24–36 months ahead.
Action recommendation: build a "24-month early-warning" mechanism. Mainstream European automakers (Volkswagen, Mercedes-Benz) typically launch compliance projects 24–36 months before a regulation takes effect. Chinese automakers entering Europe should complete the parallel planning of WVTA + R155 + R156 + GDPR + Data Act before the first vehicle is delivered, rather than "sell first, fix later."
Data Security & Privacy: The "Double Pincer" of Six Overlapping Regulations
This is the most complex and highest-risk compliance area facing Chinese automakers. The EU restricts data "going out," China regulates data "being managed," forming a two-way pincer. The Cariad 800,000-vehicle data breach and the TikTok €530m fine case are both cautionary tales.
1 GDPR (General Data Protection Regulation)
Regulation (EU) 2016/679 Max fine €20m or 4% of global revenue
Core requirements
- Connected-vehicle location data, driving behaviour, biometrics, in-car cameras, voice assistants, and eCall calls all count as "personal data"
- Requires explicit consent or another lawful basis; appointment of a Data Protection Officer (DPO)
- Data subjects enjoy rights of access, rectification, erasure, and portability
- Cross-border transfers require SCC + Transfer Impact Assessment (TIA)
2025 developments
In May 2025 TikTok was fined €530m by the Irish DPC for unlawfully transferring EU user data to China — a major warning for Chinese automakers. In 2024 Uber was fined €290m by the Dutch AP for transferring EU driver data to the US.
2 EU Data Act
Regulation (EU) 2023/2854 Fully applicable 12 Sep 2025 Up to 4% of global revenue
Core requirements (disruptive provisions)
- OEMs must provide users (owners) with access to product-related data by design, by default, and free of charge
- Users may share data with third parties (insurance, repair, mobility service providers); OEMs may not block this
- Must provide a simple means (API / button) to trigger data sharing
- Trade secrets are protected but may not be used as an excuse to refuse sharing
Fundamental impact on Chinese automakers
Must open in-vehicle data interfaces to European users and third-party service providers; cannot continue the "closed data + repatriate to HQ" model; must rebuild the vehicle-cloud architecture to support European local data residency + third-party APIs.
3 NIS2 Network and Information Systems Security Directive
Directive (EU) 2022/2555 Essential entities 2% / important entities 1.4%
Core requirements
- Automakers are usually classed as "important entities" (manufacturing); those in critical transport sub-sectors may be "essential entities"
- Risk management, supply-chain security, MFA, 24h early warning + 72h notification + 1-month report
- Personal liability for management — temporary suspension / revocation of management certification
Impact
Vehicle manufacturers with plants in Europe are directly bound; OEMs will cascade NIS2 requirements contractually to Chinese Tier 1/2 suppliers; together with UN-R155 this forms a "product + operations" dual line of defence.
4 CRA Cyber Resilience Act
Regulation (EU) 2024/2847 Fully applicable Dec 2027 Up to €15m or 2.5% of global revenue
Core requirements
- Sets horizontal cybersecurity requirements for all "products with digital elements": security by design, no known exploitable vulnerabilities on the market
- Vulnerability handling and patching obligations (free for the product life cycle)
- CE marking, technical documentation, conformity assessment
- Joint and several liability for importers/distributors
Jurisdictional-overlap dispute
In-car infotainment, stand-alone software, and charging stations may fall under the CRA rather than vehicle regulations; there is disputed overlap and gaps with UN-R155/R156.
5 eCall emergency-call data compliance
Regulation (EU) 2015/758 Mandatory since Mar 2018
- All new M1/N1 vehicles in the EU must have built-in 112-eCall (automatic on crash + manual trigger)
- Transmitted data is limited to what the incident requires (location, time, direction, VIN, fuel type)
- Forbidden to transmit non-essential personal data; must not be stored beyond what the dashcam requires
For Chinese automakers: all models exported to Europe must have a built-in EU-standard eCall; the China/global-spec SOS module cannot simply be reused.
6 The two-way cross-border data transfer "pincer"
EU side (restricting "going out")
Transferring personal data to China (which has no "adequacy decision") must rely on SCC + TIA or Binding Corporate Rules (BCR). GDPR 4% fines (the TikTok €530m case is the cautionary tale).
China side (regulating "management")
On 3 Feb 2026, MIIT, CAC and eight ministries issued the "Guidelines on Security of Automotive Data Export (2026 Edition)"; from 1 Jan 2026 the "Measures for Certification of Cross-Border Personal Information Export." PIPL fines up to RMB 50m or 5% of revenue.
Countermeasures
① Must build European data centres / EU cloud (Azure EU / AWS EU / local cloud)
② Must conduct a dual PIPL and GDPR compliance audit
③ If algorithm training data is repatriated to China, it must be de-identified or go through the certification pathway
Cautionary case: Volkswagen Cariad 800,000-vehicle data breach (Dec 2024). Volkswagen's software subsidiary Cariad suffered a major data breach — the precise GPS location history, vehicle status, and owner contact information of approximately 800,000 electric vehicles was left unencrypted and exposed on Amazon Web Services for months. Root cause: a misconfigured cloud storage. This is a textbook counter-example for European data compliance by Chinese automakers — GDPR requires anonymisation/aggregation, and a single connected vehicle generates 280 PB of data per year.
Fleet CO₂ & Electrification: Structural Opportunity Laced with Traps
CO₂ regulation is a structural tailwind for Chinese BEVs going overseas (it pulls down the fleet average), but antitrust, CBAM, and the battery passport are hidden traps. The Stellantis–Leapmotor credit-pooling case shows that a "joint venture + credits" model is viable.
EU 2025/2035 CO₂ emission standards
Regulation (EU) 2019/631
| Period | Target | vs 2021 |
|---|---|---|
| 2025–2029 | 93.6 g/km | −15% |
| 2030 | 49.5 g/km | −55% |
| 2035 | 0 g/km | −100% (effectively bans ICE vehicle sales) |
Fines: €95 per g/km over the target × per vehicle. Example: 5 g/km over × 100,000 vehicles = €47.5m.
Flexibility mechanism (2025–2027): compliance judged on a three-year average rather than a single year, which saved Volkswagen roughly €1.7bn in fines.
Structural tailwind for Chinese automakers: Chinese BEV models directly pull down the European fleet average, acting as a "compliance hedge" for traditional OEMs. This is the underlying logic behind SAIC, BYD, and Leapmotor accelerating cooperation with European OEMs.
CO₂ credit-pooling strategy (Stellantis–Leapmotor case)
The pooling mechanism
Multiple manufacturers may form a "pool" and combine their zero-emission vehicle sales to calculate a fleet average. Tesla is the largest "seller."
Stellantis' strategic evolution (textbook case)
| Year | Strategy | Details |
|---|---|---|
| 2025 | Join the Tesla pool | Includes Tesla/Stellantis/Toyota/Ford/Mazda/Subaru/Honda/Suzuki/Polestar; UBS estimates Tesla could earn over €1bn in 2025 |
| 2026 | Exit the Tesla pool, switch to Leapmotor | Stellantis + Toyota both exit; Leapmotor delivered over 17,000 units in Europe in Q4 2025; Stellantis uses Leapmotor's zero-emission sales to offset its own fleet |
| In parallel | Warnings of European plant closures | Cutting ICE production to avoid fines |
Lesson for Chinese automakers: the "joint venture + credit pool" is a viable model. Leveraging the Stellantis network + credit pool, Leapmotor's EU registrations in the first four months of 2026 grew 6× year-on-year (28,000 units).
CBAM Carbon Border Adjustment Mechanism
Regulation (EU) 2023/956 Definitive mechanism in force 1 Jan 2026
Current scope
Steel, aluminium, cement, fertilisers, hydrogen, electricity — vehicles and batteries are not currently included.
Key risk (Dec 2025 proposal)
The European Commission has tabled a legislative proposal to extend CBAM to downstream steel and aluminium products, including certain vehicle categories and white goods. If adopted, the cost of exporting Chinese vehicles will rise significantly.
Impact
- Embodied-carbon costs of body steel, aluminium alloys, and wheel imports are passed through
- China's steel and aluminium industry (high carbon intensity) is hit especially hard
- Must build a full supply-chain carbon accounting system
Battery passport — EU 2023/1542 (the biggest challenge)
Regulation (EU) 2023/1542 Mandatory 18 Feb 2027
Battery passport requirements
Each battery must have a QR-code-linked digital record: composition, supply chain, carbon footprint, recycling information.
Minimum recycled-content thresholds
| Material | 18 Aug 2031 | 18 Aug 2036 |
|---|---|---|
| Cobalt | 16% | 26% |
| Lithium | 6% | 12% |
| Nickel | 6% | 15% |
| Lead | 85% | — |
Fundamental impact on Chinese battery makers
① CATL, BYD and others must disclose their full supply chain and carbon data, touching trade secrets
② Must build traceable due diligence from the mine upstream
③ Conversely, compliance-leading Chinese battery makers can use this to consolidate their supply advantage to Europe
Hidden antitrust risk. In April 2025 the EU fined Volkswagen, Stellantis and others €458m — for a vehicle recycling cartel (antitrust), unrelated to emissions. In 2021 it also fined them €875m for collusion on emissions technology. Coordinated pricing between Chinese automakers and their European dealers/joint-venture partners is a high-risk zone for antitrust compliance.
Right to Repair & After-Sales: The Biggest Operational Gap for Chinese Start-Ups
With the Right to Repair directive's transposition deadline of 31 Jul 2026, three requirements — parts-supply commitments, service networks, and data openness — converge. This is the structural weakness of Chinese start-ups in Europe — one of the core reasons NIO registered only 8 vehicles in Germany in Q1 2026.
Right to Repair directive
Directive (EU) 2024/1799 Member-state transposition deadline 31 Jul 2026
Core requirements
- Manufacturers must provide repair services both during and after the statutory warranty period (at a reasonable price and within a reasonable time)
- Must provide original spare parts for a reasonable number of years (often 7–10 years)
- Consumers may choose "repair" rather than "replacement" within the warranty period
- Must publish repair information; build an EU-level repair-information platform
- Choosing repair can extend the statutory warranty by 12 months
For Chinese automakers
Must build a parts supply chain and service network in Europe — the weakness of Chinese start-ups in Europe; parts-supply commitment periods may far exceed traditional warranties.
Euro 7 emissions standard (29 Nov 2026)
Regulation (EU) 2024/1257
Battery-electric vehicles affected for the first time
- Brake particulates (applies to M1/N1) — requires dedicated development of brake pads
- Tyre wear limits — requires re-selection of tyres
- Battery durability requirements (EV/hybrid) — State-of-Health management
- Tighter evaporative emissions and Real Driving Emissions (RDE)
- Technology-neutral: applies to ICE/hybrid/BEV alike
For Chinese automakers: EVs are not "immune" to Euro 7. Chinese testing standards differ from Euro 7, so re-certification is required.
UN-R156 Software Updates & OTA (mandatory precondition)
UN Regulation No.156 Non-compliance means no registration
Core requirements
- OEMs must establish a Software Update Management System (SUMS) and pass type approval
- Each OTA must be recorded: purpose, scope of impact, whether it affects type approval, verification confirmation
- Ensure updates do not impair already-certified functions; user notification and consent
- Record the RxSWIN software identification number; paired with R155 cybersecurity management
Pain points for Chinese start-ups
Frequent OTA updates are common; a complete SUMS process and documentation must be built; each push must be verified by the certification body. R155 + R156 are technical access thresholds — non-compliance means no registration.
Parts availability + MVBER after-sales
Regulation (EU) No 461/2010 Extended to 31 May 2027
Combined requirements
- Right to Repair + the ESPR Digital Product Passport + MVBER form an "after-sales trio"
- Manufacturers must guarantee original spare-parts supply for a reasonable number of years (7–10 years)
- Encourages access for third-party / remanufactured parts
- Selective distribution: the after-sales stage must open technical information and parts to independent repairers
Distribution models
The agency model (OEM holds inventory and pricing) and the dealer model coexist; Volkswagen, Mercedes-Benz, Volvo and Polestar are accelerating the shift to agency. Chinese start-ups mostly use direct sales / agency, which naturally fits MVBER, but care is needed over territorial restrictions in selective distribution.
Tariffs & Trade Barriers: The Largest Explicit Cost of Entering Europe
Anti-subsidy duties are the most significant trade barrier since 2024. But Chinese automakers have already found multiple circumvention routes: local production, a pivot to PHEVs, minimum-price commitments, and joint-venture identity.
EU anti-subsidy duties on Chinese EVs (definitive, 5 years from 30 Oct 2024)
| Manufacturer | Additional anti-subsidy duty | Total incl. 10% base duty | Impact assessment |
|---|---|---|---|
| BYD | 17.0% | ≈ 27% | Manageable; price advantage maintained |
| Geely (incl. Zeekr, Volvo China-built) | 18.8% | ≈ 28.8% | Moderate pressure |
| SAIC (SAIC / MG) | 35.3% | ≈ 45.3% | Severely erodes price advantage |
| Tesla (China exports) | 9.0% | ≈ 19% | Lowest, due to cooperation with the investigation |
| Other cooperating companies (BMW Mini etc.) | 20.7–21.3% | ≈ 31% | — |
| Non-cooperating companies (default maximum) | 35.3% | ≈ 45.3% | Punitive |
2025–2026 developments
- BYD, Geely, and SAIC have sued the European Commission at the General Court of the EU, challenging the ruling
- The EU is considering a minimum import price mechanism to replace the tariffs (under discussion in 2025)
- PHEV circumvention route: BYD and MG/SAIC use plug-in hybrids to bypass the BEV-specific tariffs; in Jun 2026 the EU plans to impose duties on PHEVs too, to close the loophole
- Chinese automakers are accelerating European local production (BYD Hungary/Turkey, Chery Spain, Leapmotor JV with Stellantis, MG Galicia, Spain)
Comparison of five circumvention strategies.
① Local production (BYD Hungary €4bn / Chery Spain €400m / MG Spain €200m) — the long-term cure but timelines often slip
② Pivot to PHEV/hybrid (MG's most successful case) — most effective short-term, but the EU is closing the loophole
③ Minimum-price commitment (under EU–China negotiation) — high political uncertainty
④ Joint venture + European identity (Volvo/Polestar/Smart) — triple advantage of compliance/trust/tariffs
⑤ Transhipment via third countries (Changan exports from Thailand, MG considering Mexico) — constrained by rules of origin
Product & Safety Compliance: The GSR2, Euro 7, ADAS Trinity
The mandatory WVEK package under the GSR2 General Safety Regulation (ISA/AEB/driver monitoring, etc.) differs markedly from China-spec configurations and is the main cause of certification delays. L3 automated driving requires three layers of approval: UN-R157 + national legislation.
GSR2 General Safety Regulation — mandatory WVEK package
Regulation (EU) 2019/2144
| Mandatory item | New type approval | All new vehicles |
|---|---|---|
| ISA Intelligent Speed Assistance | Jul 2022 | Jul 2024 |
| AEB (incl. vulnerable road users) | Jul 2022 | Extended Jul 2026 |
| Lane Keeping LKA / Emergency Lane Keeping ELK | — | Jul 2024 |
| Driver fatigue/distraction monitoring DDAW | — | Jul 2024 |
| Tyre pressure, reversing detection, EDR | — | Jul 2024 |
| Alcohol-interlock installation readiness | Jul 2026 | — |
China-spec pain point: ISA (speed-limit warning / automatic deceleration) is a hard requirement in Europe but usually absent in China-spec vehicles; AEB pedestrian-detection standards are stricter than in China and require recalibration.
UN-R157 L3 automated driving (three layers of approval)
UN Regulation No.157 L3 cannot be activated without certification
Three-layer approval system
- ① Vehicle type approval (KBA, based on UN-R157/EU 2022/1426) — proves the vehicle is compliant
- ② Operating licence (road traffic authority approves driving zones)
- ③ National legislation (national road regulations allow L3 operation)
Preconditions
UN-R155 (CSMS) and UN-R156 (SUMS) certification must be obtained first. R155 + R156 + R157 form the "cybersecurity + software update + automated driving" triple threshold.
Mercedes-Benz Drive Pilot milestones
In Dec 2021 the German KBA issued the world's first L3 certification; in Dec 2024 it approved the 95 km/h version, making it the fastest production L3 system in the world.
ESPR Digital Product Passport
Regulation (EU) 2024/1781
- Replaces the 2009 Ecodesign Directive, extending scope to almost all physical goods
- Core: the Digital Product Passport (DPP) — NFC/QR/RFID-linked full life-cycle data
- Includes materials, carbon footprint, repairability, and recycling information
- The first delegated acts cover steel, aluminium, textiles, batteries, and electronics; vehicles in later batches
For Chinese automakers: together with the battery passport, CBAM, and Right to Repair, it forms a data-compliance "quartet" that forces the building of a full life-cycle carbon and material data platform.
UN-R155 Automotive Cybersecurity (CSMS)
UN Regulation No.155 Precondition
- OEMs must establish a Cybersecurity Management System (CSMS) and pass certification
- Threat Analysis and Risk Assessment (TARA) — ISO/SAE 21434
- Cybersecurity monitoring and incident response across the entire vehicle life cycle
- It is a precondition for R157 (L3 automated driving)
China's GB 44495 (2024) is modelled on UN R155, but the EU considers its verification rules still weak — what MERICS calls the "European automotive data divide."
How European OEMs Handle Compliance: Organisation, Process, Culture
The compliance system Volkswagen rebuilt after "Dieselgate" is the global automotive benchmark. Mercedes-Benz, Stellantis, Renault and BMW each have their own approach. Common features: compliance embedded in the R&D V-model, an independent CCO with dual-line reporting, a whistleblower system, and a localised compliance-partner network.
Volkswagen Group — textbook-level rebuild
Organisational structure (current)
- A dedicated Board of Management seat for "Integrity and Legal Affairs" (ILA) — created specifically after Dieselgate
- Current ILA Board member: Dr. Manfred Döss
- Group Chief Integrity and Compliance Officer: Nicolas Heyer
- Dual reporting: reports directly to the ILA Board member + the Supervisory Board Audit Committee (for independence)
- Compliance officers in each brand (VW/Audi/Porsche/Škoda) + regional compliance offices (including a China region)
- Group Human Rights Officer: Dr. Kerstin Waltenberg (supply-chain human-rights compliance)
Key tools
Developed the "ILA Platform" (a digital compliance approval platform) with KPMG; built a global whistleblower system; former US prosecutor Larry Thompson served as independent compliance monitor.
Investment
Dieselgate total cost over $30bn (approx. €30bn) — the most expensive compliance failure in automotive history. The 2017 DOJ plea agreement: $4.3bn criminal fine + three years' probation + three years of independent compliance monitoring.
Mercedes-Benz — the dual pillars of technical compliance + integrity
Organisational structure
- Board member Olaf Schick responsible for "Integrity, Governance and Sustainability"
- An independent Technical Compliance Management System (tCMS) — a Mercedes hallmark distinguishing it from most automakers
- Dedicated Integrity Code and Digital Trust programmes
Composition of the Drive Pilot L3 compliance team (worth learning from)
Mercedes discloses that its Drive Pilot development team included engineers, lawyers, compliance managers, data protection officers, and ethicists — a real embodiment of compliance embedded in R&D.
Stellantis — centralised Ethics & Compliance (E&C)
Organisational structure
- Overall oversight by the Board's Audit Committee
- Chief Audit and Compliance Officer: reports regularly to the Audit Committee chair, and informs the CEO
- Ethics and Compliance Committee (ECC): chaired by the CHRSO, including the General Counsel; meets quarterly
- Day-to-day compliance team: export controls, whistleblower case management, investigations, anti-corruption, training
- Integrity Helpline + compliance roadmap
Trend
"Compliance + privacy" integration — former Chief Ethics, Compliance and Privacy Officer Clara Ingen-Housz.
Renault + BMW
Renault (first in France with ISO 37001 certification)
In 2024 became the first company in the French automotive industry to be certified to ISO 37001 (anti-bribery management system); compliance led by the Legal Department; published the "Renault Group Code of Ethics – 2025 edition."
BMW (prevent–detect–respond model)
Adopts a group-wide "prevent-detect-respond" compliance management system; Legal Services, IP and Compliance as a single unified function.
Compliance embedded in the R&D V-model process (common to European OEMs)
The essence of type approval is the auditability of the evidence chain — the part Chinese automakers most easily underestimate. ISO 26262 explicitly uses the V-model to organise safety activities, requiring bidirectional traceability between requirements and test artefacts.
| V-model phase | Compliance embedding point | Key standards/regulations |
|---|---|---|
| Left · Requirements analysis | Import a Regulatory Requirements Database, decomposed by target market | WVTA, various UNECE regulations |
| Left · System design | Functional safety (ISO 26262), cybersecurity (ISO/SAE 21434) TARA analysis | ISO 26262, UN R155/R156 |
| Bottom · Implementation | Software update management (SUMS), GDPR data-protection impact assessment | UN R156, GDPR DPIA |
| Right · Unit/integration testing | Each layer verifies the corresponding requirement — bidirectional traceability | ISO 26262 mandatory requirement |
| Right · System verification | Testing witnessed by a Technical Service | Various UN ECE regulations |
| Top · Type approval | Submit the full compliance evidence package to the TAA (KBA/RDW) and obtain the WVTA | EU 2018/858 |
The Dieselgate lesson. Volkswagen's Dieselgate proves that the absence of technical compliance can instantly destroy decades of brand value. VW paid not only the $30bn direct cost but the permanent brand stigma of the word "Dieselgate." Chinese automakers entering Europe must embed compliance into their organisational DNA from the very beginning, not treat it as a cost centre.
Whole Vehicle Type Approval (WVTA): The 12–24 Month Entry Ticket
The WVTA is the "entry ticket" for Chinese automakers entering Europe. Understanding the dual structure of TS (Technical Service) vs TAA (Type Approval Authority), the differences between national "E-numbers," and small-batch vs large-batch approval is the prerequisite for building a certification strategy.
Legal framework: EU 2018/858
Replaces 2007/46/EC; the framework regulation for the approval and market surveillance of motor vehicles and their trailers. In November 2025 the European Commission published a draft amendment incorporating Euro 7 and the UN R100 03 series of amendments.
Two-layer structure
- Technical Service (TS): authorised by the TAA to conduct or witness testing under UN ECE regulations / EU directives and issue technical reports. Typical: TÜV SÜD, DEKRA, SGS, BV, Applus IDIADA, CSI
- Type Approval Authority (TAA): a government body that issues the whole-vehicle type-approval certificate + a CoC for each vehicle, based on the TS report
Once a WVTA is issued, it is recognised across the entire EU/EEA — no retesting required.
The "E-number" system and national differences
| Body | Country / E-number | Characteristics |
|---|---|---|
| KBA | Germany E1 | Most authoritative and strictest; Mercedes L3 approval; issues TTG from Jun 2024 |
| RDW | Netherlands E4 | Efficient and friendly to new Chinese entrants — the preferred "fast track" |
| UTAC | France E2 | Large proving ground, strong on emissions/energy consumption |
| VCA | UK E9/E11 | Transparent fees; BYD and NIO use this route |
| NSAI | Ireland E24 | In-Service Conformity (ISC) checks |
| SNCA | Luxembourg E13 | Small but flexible — FAW Hongqi uses this route |
Typical RDW delivery times: lamps/glass 5 days, tyres 8–12 days, EMC 10 days, emissions 15 days, noise 20 days, whole-vehicle M1/N1 WVTA 15 days (provided all component certifications are ready).
Chinese automakers' actual certification routes (real-world data)
| Chinese automaker | Model | Type-approval number | Route | Strategic significance |
|---|---|---|---|---|
| Seres/Sokon | Seres 5 | e4*18/858*00142 | RDW (E4) | Preferred fast track |
| DFSK (Dongfeng Sokon) | Fengon 500 | e4*18/858*00016 | RDW (E4) | Preferred fast track |
| BYD | SC2E / HC | e9*18/858*11147 | UK VCA (E9) | Credibility at scale |
| NIO | ESW / ETX | e9*18/858*11323 | UK VCA (E9) | Credibility at scale |
| Smart (Geely–Mercedes) | HX11 (Smart #1) | e1*18/858*00227 | German KBA (E1) | JV advantage |
| FAW Hongqi | E115 | e13*18/858*00350 | Luxembourg SNCA (E13) | Small flexible route |
Lesson: use RDW (E4) for efficiency during early trials; switch to VCA (E9) or KBA (E1) for credibility once at scale; post-Brexit, the EU's recognition of the VCA requires attention to transitional arrangements.
Full compliance timeline from R&D to market (typical new BEV model)
| Phase | Timing | Compliance work |
|---|---|---|
| Concept / feasibility | 36–48 months before launch | Target-market regulatory matrix, selection of certification body/TS, Euro 7/CBAM assessment |
| System design | 24–36 months before launch | ISO 26262 functional safety, ISO/SAE 21434 TARA, GDPR DPIA, UN R155/R156 compliant design |
| Component / system certification | 12–24 months before launch | Type approval of each component system (lighting, braking, emissions, EMC, battery R100, etc.), TS-witnessed testing |
| Whole-vehicle testing | 9–15 months before launch | Vehicle-level WVTA testing (crash, noise, WLTP energy consumption, ADAS, etc.) |
| WVTA issued | 3–6 months before launch | TAA issues the whole-vehicle type-approval certificate |
| Mass production & CoP | Ongoing after launch | CoC for each vehicle, Conformity of Production control |
| After-sales / In-Service Conformity | Ongoing after launch | ISC checks, OTA-update compliance (R156), market surveillance |
Small Batch (SBA) vs Large Batch (WVTA) approval
Under EU 2018/858 Chapter VIII + Annex V:
| Dimension | EU Small Batch | NSSTA | Full WVTA |
|---|---|---|---|
| M1 passenger car annual cap | 1,000 vehicles/year | 250 per member state | Unlimited |
| N1 light commercial vehicle | 2,500 vehicles/year | 250 per member state | Unlimited |
| Automated-driving special cap | 1,500 vehicles per type | — | Unlimited |
| Technical requirements | Some exemptions | More exemptions | All must be met |
| Market recognition | Across the EU | Granting state only | Across the EU |
| Use case | Supercars, niche EVs, first trials | Very-small-batch imports | Mainstream mass production |
Cost benchmarks. For a single new BEV model, parallel multi-market certification takes 12–24 months and costs $1.8m – $3.5m per model. UK VCA WVTA compliance fee £350/item; system/component certification £28–£200/item; RDW component certification 5–20 days. The global automotive certification-services market was about $7.4bn in 2025 and is projected to reach $13.8bn by 2034 (CAGR 7.2%); in 2025 alone, 280+ new passenger-car models entered or sought to enter the European market.
Compliance Partner Ecosystem: The "Four-Layer Network" Chinese Automakers Need to Build
Mainstream European OEMs' compliance ecosystem rests on four pillars: top-tier international law firms, the Big Four consultancies, specialist type-approval bodies (TIC), and data-compliance/ESG advisors. Chinese automakers need to build their local compliance-partner network 1–2 years in advance.
Layer 1: Top-tier international law firms ("Magic Circle" + major European firms)
| Firm | Automotive compliance role | Representative cases |
|---|---|---|
| Freshfields Bruckhaus Deringer | Advises over half of the global top-100 automakers; M&A, antitrust, trade, regulatory | Volkswagen's investment in JAC (the largest China-EV M&A deal); Dieselgate class actions |
| Clifford Chance | Data protection/GDPR, automotive cross-border data compliance | Published a study on the economic impact of GDPR; provides GDPR compliance advice to Asia-Pacific automakers |
| Linklaters | Automotive M&A, regulatory, digitalisation, intellectual property | Appointed a global automotive co-head (Paris-based Pierre Tourres) |
| Allen & Overy | Automotive M&A, regulatory, ESG, litigation | UK M&A deal value +111% in H1 2026 |
| CMS / Noerr | Automotive regulatory, ESG | Deep specialism in the German auto industry |
| Jones Day | Crisis-compliance independent investigations | Commissioned by VW's Supervisory Board to investigate Dieselgate |
Layer 2: Big Four + strategy consultancies
All of the Big Four have built dedicated automotive compliance/cybersecurity practices:
- UNECE R155 compliance services (automotive cybersecurity): Deloitte, KPMG, PwC and EY are all active
- KPMG: developed the ILA Platform (a digital compliance-process platform) with Volkswagen
- Bespoke services: CSRD/ESG reporting, supply-chain due diligence (LkSG/CSDDD), UN R155/R156 cybersecurity, GDPR data protection, type-approval project management
- MBB (McKinsey/BCG/Bain) + the Big Four are both in the top tier of automotive consulting
- Carbon/ESG: Sphera, Quantis (carbon-footprint accounting ISO 14067, CBAM reporting)
Layer 3: Specialist type-approval bodies (TIC) — the core partner for Chinese automakers
| Body | HQ | Role & data |
|---|---|---|
| TÜV SÜD | Munich, Germany | Accredited for 400+ national and international testing procedures; ISO 17025 lab + ISO 17020 inspection; newly built EV battery lab in Michigan |
| TÜV Rheinland | Cologne, Germany | Automotive type approval & compliance testing; battery-regulation expertise |
| DEKRA | Stuttgart, Germany | Automotive TIC industry leader; EV certification business +40% YoY in 2025 |
| SGS | Geneva, Switzerland | Global leader in automotive testing and certification |
| Bureau Veritas (BV) | Paris, France | Official type-approval inspection |
| Applus IDIADA | Spain | Technical Service + a well-known automotive proving ground |
| ATIC | China / international | Helped XPeng G9 obtain its WVTA; friendly to Chinese automakers |
| CSI SpA | Italy | Designated as a Technical Service by KBA (E1)/RDW (E4)/NSAI (E24)/STA (E5) |
Layer 4: Data-compliance & ESG & contract-manufacturing partners
Data-compliance advisors
- External DPO day rate €400–900 (France 2026 market rate)
- DPO annual salary: in-house legal DPO €50k–120k; privacy engineering by the Big Four + specialist firms (DPO Network, OneTrust)
Contract manufacturing (key pathway)
- Magna Steyr (Graz, Austria) — used by GAC and XPeng
- Valmet (Finland), VDL (Netherlands), and others
Distribution partners
- Hedin Group (XPeng in Switzerland/Austria)
- Large local dealer groups
Industry bodies (compliance coordination and lobbying)
17 major OEMs (BMW/DAF/Daimler Truck/Mercedes/Renault/Stellantis/VW); the primary lobbying and standards body; publishes the "REACH Automotive Industry Guidance"
120+ global parts suppliers; focused on in-vehicle data access
Publishes the VDA 6.x quality-management standards (adopted globally); organises the IAA motor show
UN World Forum for Harmonization of Vehicle Regulations; develops UN ECE regulations (R157/R155/R156/R100); China is a party to the 1998 Agreement
Lobbies for independent repairers' rights (Right to Repair, data access)
ACEA and CLEPA both register and disclose lobbying activity
Ten Key Case Studies: From Dieselgate to the Cariad Data Breach
Every case is a compliance lesson bought with real money. From VW Dieselgate's $30bn loss, to BYD's repeatedly delayed Hungarian plant, to the failure of NIO's German direct-sales model — these are the textbooks Chinese automakers must read.
Trigger: In September 2015, the US EPA disclosed that Volkswagen had installed defeat-device software in its diesel vehicles.
Organisational change: In 2017 a dedicated "Integrity and Legal Affairs" Board seat was created (Hiltrud Werner as the first incumbent); a global whistleblower system was built; decision-making authority was devolved to break the hierarchical culture. Werner proposed a "three-dimensional change," shifting from "hierarchical obedience" to "employees speaking up."
End of monitoring: In 2020 Larry Thompson's final report found that VW had met the reform conditions; VW announced it had successfully completed its US independent compliance monitoring period.
Lesson: the absence of technical compliance can instantly destroy decades of brand value. Chinese automakers must embed compliance into their organisational DNA from the very beginning, not treat it as a cost centre. The CCO must report on dual lines (CEO + Board Audit Committee).
Incident: The precise GPS location history, vehicle status, and owner contact information of approximately 800,000 electric vehicles at Volkswagen's software subsidiary Cariad was left unencrypted and exposed on Amazon Web Services for months. Root cause: misconfigured cloud storage.
Architectural change: the CARIAD cloud platform connects to the in-car computer via a dedicated data interface, enabling "secure data transfer to a protected zone"; working with NVIDIA to accelerate the connected-vehicle data pipeline (including GDPR anonymisation, such as aggregating location data with fewer than 2,500 records).
Lesson: GDPR fines reach €20m or 4% of global revenue. Chinese automakers must build a "Security by Design" data architecture from the outset, rather than "launch first, patch later."
2025 strategy: joined the Tesla-led CO₂ pool (including Tesla, Stellantis, Toyota, Ford, Mazda, Subaru, Honda, Suzuki, Polestar). UBS estimated this pool could contribute over €1bn in European revenue to Tesla in 2025.
2026 pivot: Stellantis and Toyota both exited the Tesla pool and instead formed a dedicated pool with their Leapmotor brand. Leapmotor delivered over 17,000 vehicles in Europe in Q4 2025 and had built out 800+ dealers. Stellantis uses Leapmotor's zero-emission sales to offset its own fleet.
Parallel strategy: warned of possible European plant closures and cut ICE production to avoid fines.
Lesson: the "joint venture + credit pool" is a viable model for Chinese automakers entering Europe. Leveraging the Stellantis network + credit pool, Leapmotor's EU registrations in the first four months of 2026 grew 6× year-on-year (28,000 units). Chinese BEV start-ups can actively seek credit-pool partnerships with traditional OEMs.
Three-layer approval: ① Vehicle type approval (KBA, based on UN-R157/EU 2022/1426) ② Operating licence (the AFGBV procedure approves driving zones) ③ National legislation (national road regulations allow L3 operation).
Key insight: UN-R157/EU 2022/1426 only governs "vehicle approval," not "on-road operation." Even with type approval, differences in national operating regulations may limit actual use.
Lesson: the Drive Pilot team included engineers, lawyers, compliance managers, data protection officers, and ethicists — a model of compliance embedded in R&D. Chinese L3 automakers (such as XPeng and the Huawei camp) must develop to dual China-Europe standards in parallel, and R155 + R156 + R157 are the precondition thresholds.
Strategic shift: BYD suspended its Manisa plant in Turkey (originally a $1bn investment, 150,000-unit capacity, 5,000 jobs) to concentrate on the Hungary project. VP Stella Li: "Hungary is currently the number-one priority."
Lesson: even the best-funded Chinese automaker cannot avoid delays to local-production timelines. Delays across 2025–2026 forced BYD to rely on imported vehicles (subject to anti-subsidy duties) for longer.
Lesson: local-production timelines are often overly optimistic — every announced project (BYD Hungary, Chery Spain, Leapmotor Poland) has experienced delays. Chinese automakers must build in an 18–24 month buffer for localisation and prepare a "parallel import + localisation" dual-track strategy.
Incident: NIO's high-cost direct-sales/showroom model proved unsustainable in Germany. Only 8 new vehicles were registered in Germany in Q1 2026; it is seeking sub-tenants for four flagship showrooms in major German cities.
Pivot: NIO is now shifting to a dealer-partner model. This is in stark contrast to the 1,263 registrations in 2023 (its first full sales year).
Lesson: a Chinese-style direct-sales/subscription model that does not fit the European market will fail. MG's successful dealer model is the scalable one. Even Volkswagen is abandoning its agency/direct-sales model in Europe. Chinese automakers should prioritise dealer or agency models over asset-heavy direct sales.
Incident: Zeekr's entry into Germany was delayed by about a year due to certification/compliance hurdles (meeting the EU GSR2 General Safety Regulation and UN-R155 cybersecurity requirements). Deliveries were pushed to January 2026.
Compliance strategy (worth learning from): Zeekr explicitly positioned GSR2 and UN-R155 compliance as "central to its market-entry strategy"; its European R&D centre is in Gothenburg, Sweden (one of three global R&D centres); market-entry sequence: Sweden/Netherlands (Q4 2023) → Norway (summer 2025) → Germany (Jan 2026); 40 certification centres in Germany → 100 in the second phase.
Lesson: the WVTA + R155 + R156 compliance cycle is 12–24 months and costs €1–5m per model. Chinese automakers must embed compliance during R&D (the V-model) rather than "develop first, certify later." Technical Service bodies (TÜV/DEKRA/ATIC) should be involved from the concept stage.
Incident: Stellantis began semi-knocked-down (SKD) assembly of the Leapmotor T03 in Tychy, Poland in June 2024; assembly was stopped on 30 March 2025. It is considering producing the B10 model in Spain.
Key lesson: the Tychy plant in Poland was only a semi-knocked-down (SKD) operation, not full manufacturing — limited value added, and most likely unable to meet the local-content threshold required for EU tariff relief. Stellantis halting production in under a year proves that low-value-added assembly cannot stand up under EU rules.
Lesson: despite the setback, Leapmotor's EV registrations in the EU in the first four months of 2026 grew 6× year-on-year to 28,000 units — showing that importing vehicles + price competition is more effective than low-value local assembly. Chinese automakers' localisation must be genuine localisation (high-value manufacturing); otherwise pure import is preferable.
Polestar's "about Europe" strategy: HQ in Gothenburg, Sweden (under Swedish company law); owned by Volvo Cars + Geely Holding; ~46,479 European sales in 2025 (+55%), about 75–80% of the global total; largest market the UK (16,959 units in 2025, doubled). R&D is being closed in the UK and concentrated in Sweden; the new Polestar 7 will be built in Europe. It also received authorisation to import connected vehicles despite Geely being its owner.
Volvo Cars (the gold standard): Geely has owned Volvo since 2010, but Volvo operates autonomously as a Swedish company. This allows it to obtain authorisation to import connected vehicles and favourable treatment under EU regulation, consumer perception, and tariff structures.
Smart's dual-identity model: a 50/50 Geely + Mercedes-Benz joint venture (2020); Mercedes-Benz leads design, Geely leads R&/manufacturing/supply chain; Smart Europe GmbH is a wholly-owned sales subsidiary; Mercedes-Benz' mature European dealer/service network.
Lesson: the "Chinese-owned + European identity" model carries significant compliance, trust, and tariff advantages over direct entry — but requires a genuine European entity (HQ, R&D, management autonomy), not just brand packaging. This is a strategic option Chinese start-ups can consider.
Success factors: ① A century-old British brand heritage (re-activated); ② Aggressive pricing; ③ A focus on ICE/PHEV/HEV alongside EVs (avoiding tariffs); ④ A dealer (not direct-sales) model; ⑤ Deep market cultivation since 2019 (~7 years of experience). MG is seen as "not a 'domestic brand going overseas,' but more like a 're-builder' of a local brand."
Sales trajectory: 50,000 in 2021 → 100,000 in 2022 → 300,000 in 2025.
Next step: a plant in Galicia, Spain (€200m investment, 120,000-unit capacity, in production by end-2028) — MG's first plant in continental EU.
Lesson: MG's success proves: ① the dealer model is superior to direct sales; ② a hybrid powertrain portfolio is essential; ③ owning a European brand asset (even an acquired one) is a huge advantage; ④ 7 years of deep cultivation is the baseline time investment; ⑤ constrained BEVs and rising PHEVs/HEVs may reshape product-portfolio strategy.
Chinese Automakers in Europe: A Strategic Map of Eight Carmakers
In 2025 Chinese brands reached a 6.1% European market share (812,000 units, +99% YoY); the share of Europeans considering buying a Chinese car rose from 31% to 47% within 12 months (already exceeding American cars). But each automaker's path is very different.
Chinese automakers' European localisation footprint (as of mid-2026)
| Automaker | Country | Model | Capacity / investment | Status (mid-2026) |
|---|---|---|---|---|
| BYD | Hungary (Szeged) | Wholly-owned | 200,000/year, €4bn | Trial production; mass production Q4 2026 |
| BYD | Turkey (Manisa) | Wholly-owned | 150,000, $1bn | Suspended |
| Chery | Spain (Barcelona) | JV (Ebro 60/40) | 150,000 by 2029, €400m | Ebro in production; Chery brand delayed to 2026/27 Q1 |
| Leapmotor | Poland (Tychy) | JV (Stellantis 51%) | Small-scale SKD | Halted Mar 2025 |
| MG / SAIC | Spain (Galicia) | Wholly-owned | 120,000, €200m | Launch 2028 |
| Changan | Exports from Thailand | Export | — | No EU plant; first 1,000 DEEPAL S05 units |
| GAC | Austria (Magna) | Contract manufacturing | Small batch | Underway |
| XPeng | Austria (Magna) | Contract manufacturing | G6/G9 | Underway; considering acquiring a plant |
BYD Europe: the most developed Chinese compliance organisation
- European HQ: Schiedam, Netherlands (registered office); operational hub Hoofddorp (near Amsterdam)
- European headcount: third-party estimate ~5,049 (2024/25, Revelio Labs)
- Head of legal & compliance: Gergő Szalai-Bordás, Chief Legal Counsel (promoted in 2024)
- Active positions in 2025: 441 (including Pan-European Compliance Lead, Senior Legal Counsel for Global Auto EU Compliance, and European Passenger Vehicle Regulatory & Certification Manager)
- Localised executives: Maria Grazia Davino (ex-Stellantis UK), Alfredo Altavilla (ex-FCA)
2025 strategic overhaul: dealer-network expansion too slow, no hybrid models offered, lack of local talent — after poaching Stellantis/FCA executives, European registrations nearly quadrupled in early 2025.
Zeekr: a compliance-led market entry
- European R&D centre: Gothenburg, Sweden (one of three global R&D centres)
- Compliance strategy: GSR2 and UN-R155 compliance "has been central to Zeekr's market-entry strategy"
- Market-entry sequence: Sweden and the Netherlands (Q4 2023) → Norway (summer 2025, 7X) → Germany (Jan 2026, delayed by certification)
- Service network: 40 certification centres in Germany → 100 in the second phase
Pain point: entry into Germany delayed by about a year due to GSR2 and UN-R155 compliance hurdles.
NIO: strong R&D investment but a failed sales model
- Munich design centre (10 years old) — "pure, human, progressive, sophisticated"
- Schönefeld smart-driving tech centre (near Berlin) — advanced AD director Mirko Reuter
- Schönefeld innovation centre (opened 2023)
Failure: the high-cost direct-sales/showroom model proved unsustainable in Germany — only 8 registrations in Q1 2026; seeking sub-tenants for 4 flagship showrooms; now pivoting to a dealer model.
MG / SAIC: the most experienced Chinese automaker
- Entered in 2019 — about 7 years of market experience
- Distribution model: dealers (not direct sales) — a successful choice
- European footprint: Luxembourg (HQ), Netherlands (sales centre), UK (R&D and design), Germany (design centre)
- Sales: over 300,000 units in 2025, the best-selling Chinese brand for the 11th consecutive year; 1 million cumulative
Strategy: a full BEV + ICE + PHEV + HEV powertrain portfolio, with PHEVs/HEVs avoiding anti-subsidy duties.
Data-security political scrutiny: the EU's "restrained" approach. The European Commission carried out a security-risk assessment of connected vehicles, but a February 2026 EU report was noticeably toned down in its references to China (POLITICO Pro) — a deliberate, more moderate approach than the US ban. The US (Sep 2024) banned EVs connected to China; the EU chose a risk-based, restrained approach. But think tanks such as DGAP, OSW, MERICS and ECFR are all pushing for stricter rules. MERICS warns of the "European automotive data divide" — China's GB 44495 standard is modelled on UN R155, but the EU lacks strong verification rules of its own.
Compliance Checklist: A Five-Phase Roadmap from 0 to 1 in Europe
Based on best practice from mainstream European OEMs and lessons from Chinese automakers in practice, this is organised into five phases and 80+ actionable items. Each phase corresponds to a different time window in entering Europe.
Recommended Approaches: Differentiated Strategies by Automaker Type
Different types of Chinese automakers face very different compliance challenges. Based on the panoramic analysis in this report, we offer differentiated recommendations for four typical automaker profiles.
Approach A: Established majors (e.g. BYD, Chery, SAIC)
Objective: scaled European manufacturing + a multi-powertrain portfolio
Core strategy
- Local production (high value-add): advance wholly-owned / JV European plants and avoid the low-value SKD trap (reference: Leapmotor Poland failure); budget €2–4bn
- Multi-powertrain portfolio: full BEV + PHEV + HEV + ICE coverage, with PHEVs/HEVs avoiding anti-subsidy duties (the MG model)
- Dealer model: 1,000+ dealer network (BYD's target); abandon direct sales (the NIO lesson)
- European compliance HQ: registered in the Netherlands/Luxembourg, with a localised executive team (poach from Stellantis/FCA)
- Credit-pool strategy: form a dedicated credit pool with a European OEM (reference: Stellantis–Leapmotor)
Compliance priorities
Anti-subsidy-duty response, CBAM scope-expansion readiness, battery passport, Euro 7, localised data residency
Approach B: Start-ups (e.g. NIO, XPeng, Zeekr, Leapmotor)
Objective: differentiated technical compliance + JV leverage
Core strategy
- JV leverage: form joint ventures with European OEMs (reference: Stellantis–Leapmotor, Smart–Geely–Mercedes), leveraging their dealer/service networks
- Contract manufacturing: partner with Magna Steyr and others for small-batch production, avoiding asset-heavy investment (the GAC/XPeng model)
- Technical compliance as differentiation: position R155/R156/R157 compliance as a core selling point; advanced ADAS features (NOA, urban navigation) require R157 certification
- Nordics-first markets: enter via Norway, Sweden and the Netherlands (EV-friendly, relatively simple certification), then expand to Germany/France
- Front-loaded R&D centre: European R&D centre (reference: Zeekr Gothenburg, NIO Munich + Berlin)
Compliance priorities
GSR2 WVEK, UN-R155/156/157, GDPR/Data Act, Right to Repair
Approach C: Neutral European identity (e.g. Volvo, Polestar, Smart)
Objective: the triple advantage of compliance + trust + tariffs
Core strategy
- European-entity operations: a genuine European HQ, R&D, and management autonomy (the Volvo/Polestar model)
- European company-law identity: registered in Sweden/Germany/the Netherlands; independent board governance
- Local data governance: fully EU cloud, an independent DPO, an independent data-governance committee
- Brand narrative: emphasise "European design, European R&D, European data governance," playing down Chinese ownership
- European production: the Polestar 7 will be built in Europe — a localisation commitment
Compliance priorities
Consumer trust, political-risk management, data-sovereignty narrative, connected-vehicle import authorisation (reference: Volvo obtaining authorisation)
Approach D: Trial entry (e.g. Changan, Neta, GAC)
Objective: low-cost validation + gradual expansion
Core strategy
- Small Batch Approval (SBA): trial the water with EU small-batch approval (1,000 vehicles/year) or NSSTA (250 per member state)
- Third-country transhipment: export from Thailand, Mexico and other third countries (reference: Changan exporting from Thailand), but watch rules of origin
- Contract manufacturing: Magna Steyr and other contract manufacturers (the GAC model), avoiding asset-heavy investment
- RDW (E4) fast track: use RDW for the WVTA, with a 15-day delivery cycle
- Single-point breakthrough: validate product-market fit in a single market (e.g. Norway, Switzerland)
Compliance priorities
WVTA, rules of origin, the lowest-cost certification pathway, partner selection
Overall recommendation: three non-negotiable baselines.
Baseline 1: Embed compliance in R&D — import the regulatory matrix from the concept stage (the V-model), rather than "develop first, certify later." This is the $30bn lesson bought by VW Dieselgate.
Baseline 2: Localise data — European data centres / EU cloud + third-party APIs + a DPO system; never "repatriate data to China." This is the dual warning of the TikTok €530m fine + the Cariad 800,000-vehicle breach.
Baseline 3: Organisational independence — CCO dual reporting (CEO + Board Audit Committee) + a whistleblower system + a digital compliance platform. This is the global automotive benchmark VW rebuilt after Dieselgate.
Indicative compliance-investment budget (reference)
| Item | Budget order of magnitude | Notes |
|---|---|---|
| WVTA certification per model | $1.8m – $3.5m | Cycle 12–24 months |
| Initial GDPR compliance (multinational) | $1.7m – $70m | Fortune 500 combined $7.8bn |
| Annual GDPR maintenance (global) | >$1m (88% of companies) | 40% of companies >$10m |
| DPO annual salary (in-house legal) | €50k – €120k | External DPO €400–900/day |
| European local plant (reference: BYD) | €2–4bn | 200,000-unit capacity |
| European local plant (reference: Chery JV) | €400m | 150,000-unit capacity |
| Dealer network (1,000 outlets) | €100–300m | Reference: BYD target |
| Top-tier law-firm annual retainer | €500k – €5m | Depends on business complexity |
| Big Four consultancy project fee | €300k – €3m/project | R155/ESG/GDPR specialism |
| Compliance team (reference: VW) | Hundreds to over a thousand people | Incl. legal, compliance, privacy, export controls |