While it is true that directives require implementation, it is not true that the EU cannot directly create legislation. EU regulations do have a direct effect, meaning that no implementation law is necessary. GDPR is an example of this (General Data Protection Regulation).