Laws vary by member state - Some countries (Netherlands, France, Belgium) have explicit protections for ethical hackers - The EU Cybersecurity Act encourages coordinated vulnerability disclosure - GDPR implications if you access personal data during testing