European compliance calendar 2026-2030: CRA, AI Act, Data Act and everything still to come

By Kike Gandia · Research · 16 min read

Between 2022 and 2026 the European Union passed more digital legislation than in the two previous decades combined. Each law runs on its own clock: some apply all at once, others in stages over five years, and some have already changed dates before arriving. The result is that hardly any company knows for sure what binds it today and what will bind it next year.

This article puts every date in a single calendar: the Cyber Resilience Act (CRA), the AI Act with the AI Omnibus changes, the Data Act, NIS2, DORA, eIDAS 2, the new product liability directive, the GDPR, product rules and what is still in the pipeline in Brussels and Madrid. You can filter it by what you are, see what to do at each milestone and download it to your calendar with reminders.

Cut-off date: October 13, 2026. Every date has been checked as of this day, including Regulation (EU) 2026/1744 (AI Omnibus), published on July 24 and in force since July 27, 2026. Anything that is still a proposal is marked “in the pipeline”: it may change or never arrive.

45

milestones in the calendar (from 2023 to 2030)

24 h

for the CRA early warning (mandatory since Sep 11, 2026)

Dec 2, 2027

AI Act high-risk (Annex III) (previously Aug 2, 2026)

Dec 9, 2026

software becomes a product (strict liability)

The full calendar

Each lane is a regulation; each dot, a milestone. Filled dots already apply, hollow ones are coming and dashed ones are proposals. Pick your profile at the top to keep only what concerns you and tap any dot to see what needs doing. “Add to my calendar” gives you the filtered milestones as an .ics file with a reminder 30 days before each one.

Interactive calendar of EU digital regulation, with 45 milestones. Cyber Resilience Act (Regulation (EU) 2024/2847): entry into force December 10, 2024; notified bodies from June 11, 2026; reporting of exploited vulnerabilities and severe incidents (24 h, 72 h, 14 days or one month) from September 11, 2026; full application December 11, 2027. AI Act (Regulation (EU) 2024/1689, amended by 2026/1744): entry into force August 1, 2024; prohibited practices and AI literacy from February 2, 2025; general-purpose models from August 2, 2025; Article 50 transparency and AI Office enforcement powers from August 2, 2026; new prohibitions (nudification and child abuse material) and end of the Article 50(2) marking grace period on December 2, 2026; pre-2025 models and national sandboxes on August 2, 2027; Annex III high-risk on December 2, 2027; Annex I on August 2, 2028; public authorities on August 2, 2030. Data Act (Regulation (EU) 2023/2854): applies September 12, 2025; data access by design for new products September 12, 2026; end of cloud switching charges January 12, 2027; unfair terms in older contracts September 12, 2027. NIS2 and CER: transposition October 17, 2024 and Implementing Regulation 2024/2690 for digital providers; entity lists April 17, 2025; identification of critical entities July 17, 2026; review October 17, 2027. DORA: applies January 17, 2025; first register of information in April 2025; 19 critical ICT providers designated November 18, 2025; AMLR July 10, 2027. Product liability (Directive (EU) 2024/2853): applies to products placed on the market from December 9, 2026. eIDAS 2: Member State EUDI Wallets in December 2026 and mandatory acceptance by regulated businesses in December 2027. GDPR: procedural Regulation 2025/2518 in force January 1, 2026 and applicable April 2, 2027. Product: GPSR December 13, 2024, European Accessibility Act June 28, 2025, RED cybersecurity (EN 18031) August 1, 2025, Machinery Regulation January 20, 2027. Spain: end of ENS adaptation May 5, 2024; NIS2 draft law January 14, 2025, still unpublished; AI bill in Parliament since June 2026. In the EU pipeline: Digital Omnibus (proposal of November 19, 2025) and Cybersecurity Act 2 (proposal of January 20, 2026).

What already binds you today

Before looking ahead, the things that can’t wait. If any of these applies to you and you don’t have it, it isn’t a task for next year: you are already late.

CRA · Art. 14 Report exploited vulnerabilities within 24 hours

Since September 11, 2026, any manufacturer of a product with digital elements sold in the EU, including products sold before that date. You need a process that works at midnight on a Saturday.

Data Act · Art. 3 Data accessible by design

Connected products placed on the market from September 12, 2026 must make their data accessible by default. Since 2025 you already had to handle requests.

AI Act · Arts. 4 and 50 AI training and transparency

AI literacy for staff using AI since February 2025, and since August 2026, telling people they are talking to an AI and labeling deepfakes.

DORA Digital operational resilience

Since January 2025 for financial entities: ICT risk management, major incidents, a testing program and a register of ICT providers.

NIS2 · Reg. 2024/2690 Technical measures for digital providers

Cloud, data centers, managed services and managed security services: the implementing regulation has applied directly since October 2024, Spanish law or not.

RED · EN 18031 Cybersecurity for radio equipment

Since August 2025, no connected Wi-Fi, Bluetooth or IoT device can carry the CE mark without meeting the cybersecurity requirements of the Radio Equipment Directive.

What already applies as of October 2026. The rest of the article goes regulation by regulation.

From now to December 2027, month by month

1. Dec 2, 2026 — AI Act: new prohibitions and content marking
   Nudification and child abuse material systems are banned. Generative systems already on the market must mark their output in a machine-readable way.
2. Dec 9, 2026 — Product liability: software is a product
   Strict liability for software, AI and updates for anything placed on the market from that day.
3. Dec 2026 — eIDAS 2: each Member State offers its EUDI Wallet
   Public administrations must accept it to identify citizens.
4. Jan 12, 2027 — Data Act: no more cloud switching charges
   Neither switching providers nor exporting data can be charged for.
5. Jan 20, 2027 — Machinery Regulation
   Machines must be protected against corruption of the software and control systems that affect safety.
6. Apr 2, 2027 — GDPR: new procedural rules
   15-month deadlines for cross-border investigations, right to be heard and preliminary findings.
7. Jul 10, 2027 — Anti-money laundering Regulation (AMLR)
   A single due diligence rulebook across the EU for obliged entities.
8. Aug 2, 2027 — AI Act: pre-2025 models and sandboxes
   General-purpose models placed on the market before August 2025 must comply. Each Member State must have its AI sandbox up and running.
9. Sep 12, 2027 — Data Act: older contracts
   The unfair-terms test reaches open-ended or long-term data contracts signed before September 2025.
10. Dec 2, 2027 — AI Act: Annex III high-risk
    Employment, education, credit, insurance, biometrics, critical infrastructure and essential services.
11. Dec 11, 2027 — CRA: full application
    Essential requirements, conformity assessment, technical documentation and CE marking for every product with digital elements.
12. Dec 2027 — eIDAS 2: businesses must accept the wallet
    Banking, payments, telcos, health, energy, transport and very large platforms.

December 2027 bundles three big deadlines: AI Act high-risk, the full CRA and the EUDI Wallet in the private sector.

Cyber Resilience Act: from reporting to certifying

The CRA is the regulation that demands the most technical work from anyone who makes or imports hardware and software. It has two very different stages: since September 11, 2026 it requires reporting actively exploited vulnerabilities and severe incidents, and from December 11, 2027 it requires designing, testing and documenting the product against Annex I before affixing the CE mark. Reporting covers the whole catalog, including what you sold before 2026.

Article 14 reporting deadlines

Everything goes through the single reporting platform run by ENISA. You have the CRA dates in more detail in Cyber Resilience Act timeline, how disclosure is coordinated in CRA and vulnerability disclosure and which category your product falls into in the interactive CRA classifier.

AI Act: what the AI Omnibus changed

Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, was approved by Parliament on June 16 and by the Council on June 29, and entered into force on July 27, 2026, six days before high-risk obligations were due to start. It repeals nothing: it moves dates and adjusts obligations.

Original text Regulation 2024/1689

• Annex III high-risk: August 2, 2026.
• High-risk in regulated products (Annex I): August 2, 2027.
• AI literacy: ensure a sufficient level for each person.
• National sandbox up and running: August 2, 2026.
• Relief for SMEs only.

After the Omnibus Regulation 2026/1744

• Annex III high-risk: December 2, 2027.
• High-risk in regulated products (Annex I): August 2, 2028.
• AI literacy: take measures, supported by the Commission and Member States.
• National sandbox up and running: August 2, 2027.
• Relief extended to “small mid-caps” (fewer than 750 employees).

Also, two new prohibitions (nudification and child abuse material) from December 2, 2026 and stronger supervisory powers for the AI Office.

Not everything was postponed. The Article 5 prohibitions, AI literacy, the obligations for general-purpose models and Article 50 transparency all keep their dates. Only machine-readable marking for generative systems already on the market gets a grace period until December 2, 2026.

Postponing high-risk doesn’t reduce what you have to prove: Article 15 requires those systems to be robust against input manipulation, data poisoning and model evasion. That is tested by attacking them, which is what we explain in how an AI application is attacked. If you are an SMB or freelancer, start with the AI Act for freelancers and SMBs.

Data Act: product data belongs to the user

The Data Act has applied since September 12, 2025 and gives users of connected products — a car, a boiler, an industrial machine, a wearable — the right to access the data they generate and share it with third parties. From September 12, 2026, new products must be designed for it: access by default, simple, secure, free of charge and machine-readable.

Cloud changes too: from January 12, 2027 providers can no longer charge for switching or for exporting data, and from September 12, 2027 the unfair-terms rules reach older long-term data contracts.

The security angle. Opening up access to product data means opening a new door: an API, a portal or an export that didn’t exist before. The typical flaw isn’t technical but about authorization: a user who requests their data and gets someone else’s by changing an identifier. It needs testing before someone else tests it.

NIS2 and critical entities: Spain still has no law

NIS2 was due to be transposed by October 17, 2024. Spain approved the draft Law on Cybersecurity Coordination and Governance on January 14, 2025 and, as of October 2026, the law still hasn’t been published in the Official Gazette. That doesn’t leave anyone out: Implementing Regulation (EU) 2024/2690 applies directly to digital providers (cloud, data centers, managed services and managed security services), and the Article 21 measures are what the law will end up requiring.

In parallel, the CER Directive set July 17, 2026 for Member States to identify their critical entities, which are also subject to NIS2 measures. And the Cybersecurity Act 2 proposal of January 2026 includes a NIS2 reform that may reshuffle obligations ahead of the review scheduled for October 2027.

Waiting for the law is a bad strategy. When it is published, the adaptation period will be short, and the planned fines reach €10 million or 2% of worldwide turnover for essential entities. It is laid out step by step in how to comply with NIS2.

DORA: from paperwork to oversight

DORA has applied since January 17, 2025 to banks, insurers, asset managers, payment institutions and crypto-asset providers. 2025 was the year of registers: the first submission of the register of ICT provider contracts and, on November 18, 2025, the designation of the first 19 critical ICT providers, mostly major clouds and platforms, which come under direct European oversight. 2026 is the year that shows up in contracts: audit clauses, exit plans and pooled testing. Entities designated by their supervisor must also undergo TLPT, threat-intelligence-led red teaming, every three years. If you are not sure whether it applies to you, see who DORA applies to.

Product liability: software is now on the hook

It is the least discussed regulation and probably the one with the biggest financial impact. Directive (EU) 2024/2853 replaces the 1985 directive and applies to products placed on the market from December 9, 2026. In Spain it requires reforming the liability regime in the consolidated consumer protection act.

1985 Directive products placed on the market until Dec 8, 2026

• Software in a gray area.
• A €500 threshold for property damage.
• Defectiveness fixed at the time of sale.
• The injured party has to prove almost everything.

Directive 2024/2853 from Dec 9, 2026

• Software, AI, firmware and updates are products.
• No threshold; data loss is compensable (non-professional use).
• Failing to ship a security fix can make a product defective.
• Presumption of defect when rules such as the CRA are breached, plus a duty to disclose evidence.

Liability is strict — no fault needed — and cannot be excluded by contract.

The link with the CRA is direct: failing its security requirements counts as evidence of a defect. From December, an update policy, a patch log and documented security testing are your defense in court.

eIDAS 2: the European identity wallet

Regulation (EU) 2024/1183 requires each Member State to offer at least one European Digital Identity Wallet by the end of 2026 and, a year later, in December 2027, requires businesses that demand strong authentication to accept it: banks, payment institutions, telcos, health, energy, transport, very large platforms. For them it is a new onboarding and authentication flow, with its own attack surface, that should be tested before it goes live.

GDPR: what was adopted and what is proposed

Adopted Regulation (EU) 2025/2518

• In force since January 1, 2026; applies to complaints from April 2, 2027.
• Common admissibility criteria for cross-border complaints.
• Investigations within 15 months (12 in simple cases).
• Substantive rights and obligations are unchanged.

Proposed Digital Omnibus, COM(2025) 837

• Breach notification only for high-risk breaches, with a 96-hour deadline.
• A single incident reporting point at ENISA (GDPR, NIS2, DORA, eIDAS, CER).
• Changes to cookie rules and to the definition of personal data.
• Under negotiation: none of this applies until it is published.

The 72 hours of GDPR Article 33 still apply today.

Product safety: what arrives through the CE mark

Dec 13, 2024 General Product Safety Regulation (GPSR)

Regulation (EU) 2023/988 covers cybersecurity risks that affect consumer safety.

Jun 28, 2025 European Accessibility Act

Accessible e-commerce, banking, terminals and e-books. In Spain, Law 11/2023.

Aug 1, 2025 RED and EN 18031

Mandatory cybersecurity for connected radio equipment. We explain it in the EN 18031 standard. The CRA replaces it in December 2027.

Jan 20, 2027 Machinery Regulation

Protection against corruption of software and control systems. With the Omnibus, AI in machinery moves to Section B of AI Act Annex I.

In the pipeline: what could move the calendar

EU · proposal Digital Omnibus

GDPR, cookies, Data Act and a single incident reporting point. The Council Presidency aims to close a deal before the end of 2026.

EU · proposal Cybersecurity Act 2

ICT supply chain security: designation of high-risk suppliers, exclusion from public contracts and removal of their equipment from 5G networks. It includes a NIS2 reform.

Spain · Parliament AI good use and governance law

Bill approved on May 26, 2026. It gives AESIA sanctioning powers and a single complaints desk.

Spain · pending Law on Cybersecurity Coordination and Governance

The NIS2 transposition, with the EU deadline missed since October 2024. It would create the National Cybersecurity Center.

Proposals may change during negotiations. We include them so they don’t catch you off guard, not so you plan around them.

What applies to you, depending on what you are

One test, several regulations

Almost all of these regulations end up asking for the same thing under different names: know what you have, prove it withstands an attack and show you react in time. One piece of evidence done properly serves several at once.

That is why it pays to plan technical testing once and map it to every regulation that applies to you, rather than commissioning a separate audit for each acronym. The differences between the most similar ones are in CRA vs NIS2 and DORA vs NIS2.

A 90-day plan with this calendar

1. Week 1 — Filter and download
   Pick your profile in the calendar, remove what doesn’t apply and download the .ics into the calendar of whoever owns each regulation.
2. Weeks 2-3 — Inventory
   Products with digital elements, AI systems, critical ICT services and providers. No inventory, no classification.
3. Weeks 4-6 — Classification and gap analysis
   For each regulation, which category you fall into and what you are missing. Prioritize what already applies.
4. Weeks 6-8 — Vulnerability and incident process
   Intake, triage, owners, templates and a 24-hour reporting drill. CRA, NIS2 and DORA all require it.
5. Weeks 8-12 — Technical testing
   Pentest of products, data APIs and exposed AI systems, with a report mapped to each regulation.
6. Day 90 — Roadmap to December 2027
   With all of the above, the plan up to the big deadline: full CRA, AI Act high-risk and the EUDI Wallet.

If you make products, start with the CRA scoping form and the Cyber Resilience Act guide for manufacturers. If AI is your front, see our AI Act compliance and artificial intelligence pentesting. And for any combination of the above, our Cyber Resilience Act compliance service helps you sort out the dates and prepare the testing they all require.

Related service

Cyber Resilience Act compliance

Topics

#Cyber-Resilience-Act #AI-Act #Data-Act #NIS2 #DORA #eIDAS-2 #Product-liability #GDPR #Digital-Omnibus #Compliance #Calendar

Keep reading

• Can I upload this to AI? Classify the data before you paste it
• NIS2 in Spain, two years without a law: where transposition stands and what to do this quarter
• Cyber Resilience Act reporting is now mandatory: what has changed and what to do this quarter
• Cloudflare vs. LaLiga: The clash of titans threatening the internet in Spain
• The Evolution of Offshore Finance: Legal Loopholes, Leaks and the Rise of the US "Onshore Haven"

Sources

• Regulation (EU) 2024/2847 — Cyber Resilience Act
• Regulation (EU) 2024/1689 — Artificial Intelligence Act
• Regulation (EU) 2026/1744 — Digital Omnibus on AI
• Regulation (EU) 2023/2854 — Data Act
• Directive (EU) 2022/2555 — NIS2
• Regulation (EU) 2022/2554 — DORA
• Directive (EU) 2024/2853 — Liability for defective products
• Regulation (EU) 2024/1183 — eIDAS 2
• Regulation (EU) 2025/2518 — GDPR procedural rules
• COM(2025) 837 — Digital Omnibus Regulation proposal

Review with us which dates apply to you