Calendar

EU Compliance Deadlines 2026–2028

The dates that matter for EU cybersecurity, AI and data rules, each with who it applies to and the article it comes from. Subscribe once and your calendar updates itself when a date changes, as it did when the Digital Omnibus moved the AI Act high-risk rules.

Add to your calendar

Add to Google Calendar Apple Calendar / Outlook Download .ics

Feed URL: https://clevsec.one/deadlines/eu-compliance-deadlines.ics. Each event has a reminder 30 days before. Also as JSON (CC BY 4.0).

DateLawWhat appliesReference
11 June 2026CRACRA rules on conformity assessment bodies applyWho: Notifying authorities and conformity assessment bodiesCRA Art. 71(2) (Chapter IV)Guide
2 August 2026AI ActAI Act general date of application, including the Article 50 transparency obligationsWho: Providers and deployers of AI systems that interact with people or generate contentAI Act Art. 113, Art. 50Guide
11 September 2026CRACRA reporting of actively exploited vulnerabilities and severe incidents starts (24h / 72h / final report)Who: Manufacturers of products with digital elements, also for products already on the marketCRA Art. 14, Art. 69(3), Art. 71(2)Guide
2 December 2026AI ActAI Act: new prohibitions on AI-generated non-consensual intimate imagery and child sexual abuse material; machine-readable marking for generative AI placed on the market before 2 August 2026Who: Providers of generative AI systems; everyone (prohibitions)AI Act Art. 113(a) and Art. 111(4) as amended by Regulation (EU) 2026/1744Guide
12 January 2027Data ActData Act: cloud and other data processing services may no longer charge switching fees (including data egress for switching)Who: Providers of data processing services (cloud, SaaS, PaaS, IaaS) and their customersData Act Art. 29(1)EUR-Lex
31 March 2027Repeats every yearDORADORA: competent authorities report the registers of information to the ESAs (reference date 31 December of the previous year); your national deadline is earlierWho: Financial entities in scope of DORA, through their competent authorityDORA Art. 28(3); Implementing Regulation (EU) 2024/2956Guide
17 April 2027Repeats every two yearsNIS2NIS2: member states review their lists of essential and important entities and report numbers to the CommissionWho: Member states; entities should check their registration details are currentNIS2 Art. 3(3) and 3(5)Guide
12 September 2027Data ActData Act: the unfair-terms rules for B2B data contracts (Chapter IV) also cover older long-term contractsWho: Businesses with data-sharing contracts concluded on or before 12 September 2025 that are of indefinite duration or expire at least ten years from 11 January 2024Data Act Art. 50, Art. 13EUR-Lex
17 October 2027NIS2NIS2: first Commission review of the directive (scope, sectors and size rules), then every 36 monthsWho: European Commission; may lead to a proposal changing scopeNIS2 Art. 40Guide
2 December 2027AI ActAI Act high-risk obligations for Annex III systems (for example recruitment, credit scoring, education, essential services)Who: Providers and deployers of high-risk AI systems listed in Annex IIIAI Act Art. 113(c)(i) as amended by Regulation (EU) 2026/1744Guide
11 December 2027CRACyber Resilience Act applies in full: essential requirements (Annex I), conformity assessment, CE marking, importer and distributor dutiesWho: Manufacturers, importers and distributors of products with digital elementsCRA Art. 71(2)Guide
2 August 2028AI ActAI Act high-risk obligations for AI in products covered by Annex I, Section A (for example toys, lifts, radio equipment, medical devices)Who: Providers and deployers of AI in regulated productsAI Act Art. 113(c)(ii) as amended by Regulation (EU) 2026/1744Guide

Dates checked against the official texts on 10 November 2026. Earlier dates that still shape obligations: GDPR since 25 May 2018, NIS2 national laws due 17 October 2024, DORA since 17 January 2025, AI Act prohibitions and AI literacy since 2 February 2025. National NIS2 laws set their own dates: see NIS2 transposition status and registration by country.

Check where you stand before each date

NIS2 Readiness Check53 controls against Article 21, free DORA Compliance Check39 controls across the five pillars, free AI Agent Risk CalculatorRisk score mapped to the AI Act and GDPR, free Cyber Resilience Act requirementsWhat applies on 11 December 2027

Questions

What is the next EU compliance deadline?

The table above marks it. From December 2026 the next big dates are 2 December 2026 (new AI Act prohibitions and marking of AI-generated content), 12 January 2027 (no more cloud switching charges under the Data Act), 2 December 2027 (AI Act high-risk obligations for Annex III systems) and 11 December 2027 (the Cyber Resilience Act applies in full).

How do I add these deadlines to my calendar?

Subscribe to the iCal feed. In Google Calendar use "Add to Google Calendar" (or Other calendars, From URL, and paste https://clevsec.one/deadlines/eu-compliance-deadlines.ics); in Outlook use Add calendar, Subscribe from web; on Apple devices tap "Apple Calendar". A subscription updates itself when we add or change a date. You can also download the file once.

Did the Digital Omnibus move the AI Act high-risk deadline?

Yes. Regulation (EU) 2026/1744 moved the high-risk obligations to 2 December 2027 for Annex III systems and 2 August 2028 for AI in products covered by Annex I. The transparency obligations of Article 50 still applied from 2 August 2026.

Is there a fixed date for the DORA register of information?

The ESAs collect the registers from the competent authorities by 31 March each year, with a reference date of 31 December of the previous year. Your competent authority sets an earlier national deadline for you, so check its website and work back from that date.

Sources

Disclaimer: This calendar is for informational purposes only and does not constitute legal advice. Dates come from the EU texts; national laws, supervisors and pending amendments can change what applies to you. Check the cited sources.

Last updated: November 2026 · ClevSec is an independent cybersecurity and compliance tools studio that builds free tools and guides from the official texts. About us