Not really, it's not sovereign. The EU can pass laws that each European country chooses to implement. If they don't implement enough EU laws, they can get kicked out, which means more pieces of paper are written and some European countries might choose to afford them less privileges.
No. EU laws are of two kinds: directives and regulations. Directives work roughly as you describe, while regulations have direct effect like regular laws.
Those countries may also ratify EU laws if they wish. I think the UK has something similar to GDPR and Switzerland also picks and chooses which laws it thinks make sense.