{ "id": "compliance-deadlines", "title": "EU compliance deadlines 2026-2028 (AI Act, CRA, DORA, NIS2, Data Act)", "description": "Dated EU compliance milestones with who they apply to, the article, and recurring dates; also as an iCal feed.", "verified": "2026-11-10", "license": { "name": "CC BY 4.0", "url": "https://creativecommons.org/licenses/by/4.0/" }, "attribution": "ClevSec (https://clevsec.one)", "disclaimer": "For informational purposes only; not legal advice. Check the cited sources and your national law.", "human_readable": "https://clevsec.one/deadlines/?ref=agent", "sources": [ "https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng", "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32026R1744", "https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng", "https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng", "https://eur-lex.europa.eu/eli/reg_impl/2024/2956/oj/eng", "https://eur-lex.europa.eu/eli/dir/2022/2555/oj/eng", "https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng" ], "ical": "https://clevsec.one/deadlines/eu-compliance-deadlines.ics", "items": [ { "id": "cra-notified-bodies", "short": "CRA: conformity assessment body rules apply", "date": "2026-06-11", "regime": "CRA", "repeat": null, "title": "CRA rules on conformity assessment bodies apply", "who": "Notifying authorities and conformity assessment bodies", "reference": "CRA Art. 71(2) (Chapter IV)", "source": "https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng", "guide": "https://clevsec.one/blog/cyber-resilience-act-requirements/" }, { "id": "ai-act-general", "short": "AI Act applies, incl. Art. 50 transparency duties", "date": "2026-08-02", "regime": "AI Act", "repeat": null, "title": "AI Act general date of application, including the Article 50 transparency obligations", "who": "Providers and deployers of AI systems that interact with people or generate content", "reference": "AI Act Art. 113, Art. 50", "source": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng", "guide": "https://clevsec.one/blog/eu-ai-act-timeline/" }, { "id": "cra-reporting", "short": "CRA: vulnerability and incident reporting starts", "date": "2026-09-11", "regime": "CRA", "repeat": null, "title": "CRA reporting of actively exploited vulnerabilities and severe incidents starts (24h / 72h / final report)", "who": "Manufacturers of products with digital elements, also for products already on the market", "reference": "CRA Art. 14, Art. 69(3), Art. 71(2)", "source": "https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng", "guide": "https://clevsec.one/blog/cyber-resilience-act-reporting/" }, { "id": "ai-act-omnibus-dec-2026", "short": "AI Act: new prohibitions and AI content marking", "date": "2026-12-02", "regime": "AI Act", "repeat": null, "title": "AI Act: new prohibitions on AI-generated non-consensual intimate imagery and child sexual abuse material; machine-readable marking for generative AI placed on the market before 2 August 2026", "who": "Providers of generative AI systems; everyone (prohibitions)", "reference": "AI Act Art. 113(a) and Art. 111(4) as amended by Regulation (EU) 2026/1744", "source": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32026R1744", "guide": "https://clevsec.one/blog/eu-ai-act-timeline/" }, { "id": "data-act-switching-charges", "short": "Data Act: no more cloud switching charges", "date": "2027-01-12", "regime": "Data Act", "repeat": null, "title": "Data Act: cloud and other data processing services may no longer charge switching fees (including data egress for switching)", "who": "Providers of data processing services (cloud, SaaS, PaaS, IaaS) and their customers", "reference": "Data Act Art. 29(1)", "source": "https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng", "guide": null }, { "id": "dora-register-submission", "short": "DORA: registers of information due at the ESAs", "date": "2027-03-31", "regime": "DORA", "repeat": "yearly", "title": "DORA: competent authorities report the registers of information to the ESAs (reference date 31 December of the previous year); your national deadline is earlier", "who": "Financial entities in scope of DORA, through their competent authority", "reference": "DORA Art. 28(3); Implementing Regulation (EU) 2024/2956", "source": "https://eur-lex.europa.eu/eli/reg_impl/2024/2956/oj/eng", "guide": "https://clevsec.one/blog/dora-register-of-information/" }, { "id": "nis2-entity-lists-review", "short": "NIS2: member states review entity lists", "date": "2027-04-17", "regime": "NIS2", "repeat": "every-2-years", "title": "NIS2: member states review their lists of essential and important entities and report numbers to the Commission", "who": "Member states; entities should check their registration details are current", "reference": "NIS2 Art. 3(3) and 3(5)", "source": "https://eur-lex.europa.eu/eli/dir/2022/2555/oj/eng", "guide": "https://clevsec.one/blog/nis2-registration-by-country/" }, { "id": "data-act-legacy-contracts", "short": "Data Act: unfair-terms rules reach older contracts", "date": "2027-09-12", "regime": "Data Act", "repeat": null, "title": "Data Act: the unfair-terms rules for B2B data contracts (Chapter IV) also cover older long-term contracts", "who": "Businesses with data-sharing contracts concluded on or before 12 September 2025 that are of indefinite duration or expire at least ten years from 11 January 2024", "reference": "Data Act Art. 50, Art. 13", "source": "https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng", "guide": null }, { "id": "nis2-review", "short": "NIS2: Commission review of the directive", "date": "2027-10-17", "regime": "NIS2", "repeat": null, "title": "NIS2: first Commission review of the directive (scope, sectors and size rules), then every 36 months", "who": "European Commission; may lead to a proposal changing scope", "reference": "NIS2 Art. 40", "source": "https://eur-lex.europa.eu/eli/dir/2022/2555/oj/eng", "guide": "https://clevsec.one/blog/nis2-directive-explained/" }, { "id": "ai-act-high-risk-annex-iii", "short": "AI Act: high-risk rules for Annex III systems", "date": "2027-12-02", "regime": "AI Act", "repeat": null, "title": "AI Act high-risk obligations for Annex III systems (for example recruitment, credit scoring, education, essential services)", "who": "Providers and deployers of high-risk AI systems listed in Annex III", "reference": "AI Act Art. 113(c)(i) as amended by Regulation (EU) 2026/1744", "source": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32026R1744", "guide": "https://clevsec.one/blog/eu-ai-act-timeline/" }, { "id": "cra-full-application", "short": "Cyber Resilience Act applies in full", "date": "2027-12-11", "regime": "CRA", "repeat": null, "title": "Cyber Resilience Act applies in full: essential requirements (Annex I), conformity assessment, CE marking, importer and distributor duties", "who": "Manufacturers, importers and distributors of products with digital elements", "reference": "CRA Art. 71(2)", "source": "https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng", "guide": "https://clevsec.one/blog/cyber-resilience-act-requirements/" }, { "id": "ai-act-high-risk-annex-i", "short": "AI Act: high-risk rules for Annex I products", "date": "2028-08-02", "regime": "AI Act", "repeat": null, "title": "AI Act high-risk obligations for AI in products covered by Annex I, Section A (for example toys, lifts, radio equipment, medical devices)", "who": "Providers and deployers of AI in regulated products", "reference": "AI Act Art. 113(c)(ii) as amended by Regulation (EU) 2026/1744", "source": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32026R1744", "guide": "https://clevsec.one/blog/eu-ai-act-timeline/" } ] }