Compliance Future 2027/2028: What Comes After EU AI Act and NIS2

Main article: Compliance Deadlines Roadmap — it sets out all EU and DACH deadlines under the GDPR, the AI Act, NIS2, the HinSchG, the AGG and pay transparency in chronological order.

1. What is settled for 2027/28 — and what is merely a proposal

Short answer: considerably less is settled for 2027/28 than the debate suggests — the binding dates are essentially the end of the GPAI transition period for existing models (2 August 2027), the first pay gap reporting round (7 June 2027), the AI Act high-risk obligations for Annex III systems (2 December 2027) and full applicability of the Cyber Resilience Act (11 December 2027). Everything else is either an unadopted proposal or a project the Commission is withdrawing. This distinction is the actual basis for planning: a settled date can carry a budget, whereas a proposal in trilogue carries a review caveat at best.

The legal status of the dates given is stated in the sources block (17 August 2026 for the updated provisions, otherwise 2 May 2026). Every line of the following overview names the date, the legal consequence and the source; the status column refers to the article status of 16 August 2026.

Strictly separate from these are the projects that have not been adopted. The following table lists proposals and expectations, not applicable deadlines — with the exception of the first line, whose dates have been applicable law since 27 July 2026:

2. EU AI Act 2027: Annex I, existing GPAI models and the Digital Omnibus

Short answer: on 2 August 2027 the transition period ends for GPAI models placed on the market before 2 August 2025 (Art. 111(3) AI Act). The obligations for AI in regulated products under Art. 6(1) AI Act no longer fall on that date: Regulation (EU) 2026/1744 has postponed them to 2 August 2028, and the obligations for Annex III systems to 2 December 2027 (Art. 113(3)(c) AI Act as amended). All three dates are applicable law.

Annex I — who is affected. Under Art. 6(1) AI Act, an AI system is classified as high-risk if it is intended to be used as a safety component of a product covered by the harmonisation legislation listed in Annex I, or is itself such a product — and if that product is subject to a third-party conformity assessment. Both conditions must be met together. The Deadlines Roadmap names machinery, toys, medical devices, lifts and pressure equipment as the affected product groups. Two questions determine whether you are affected: does the product contain an AI system within the meaning of Art. 3 no. 1 AI Act — that is, a machine-based system that infers from inputs how to generate outputs? And is the product subject to a third-party conformity assessment? If either answer is negative, Art. 6(1) AI Act does not apply.

Existing GPAI models. Providers of general-purpose AI models placed on the market before 2 August 2025 must meet the full catalogue of obligations in Art. 53 to 55 AI Act by 2 August 2027. Four sets of documents are to be requested from the provider: technical model documentation (at least Annex XI), information for downstream providers integrating the model (at least Annex XII), a copyright policy and a summary of the training data following the template of the EU AI Office (Art. 53(1) AI Act). Where there is systemic risk, model evaluation including adversarial testing, risk mitigation at Union level, reporting of serious incidents and cybersecurity are added (Art. 55(1) AI Act); such a risk is presumed, among other things, where the cumulative amount of computation used for training exceeds 10^25 floating point operations (Art. 51(1) and (2) AI Act).

The Digital Omnibus — precisely delimited. The AI part of the Digital Omnibus has been in force since 27 July 2026 as Regulation (EU) 2026/1744 of 8 July 2026 (OJ L 2026/1744 of 24 July 2026). It postpones the Annex III and Annex I deadlines: the obligations of Chapter III, Sections 1 to 3 apply to Annex III systems from 2 December 2027 and to Annex I systems from 2 August 2028 (Art. 113(3)(c) AI Act as amended). Not postponed are Art. 5 AI Act (prohibited practices, applicable since 2 February 2025; the newly inserted prohibition no. 9 applies from 2 December 2026), Art. 4 AI Act (AI literacy, applicable since 2 February 2025 and in its new version since 27 July 2026) and the GPAI obligations of Chapter V (since 2 August 2025). The general date of application of 2 August 2026 remains; the consolidated version of Art. 113 AI Act is decisive.

The AI Act is an EU regulation; it applies equally in Germany and Austria. Only supervision differs: each Member State establishes at least one notifying authority and at least one market surveillance authority and designates one market surveillance authority as single point of contact (Art. 70(1) and (2) AI Act). In Germany, the market surveillance authority has been the Federal Network Agency (Bundesnetzagentur) since 29 July 2026 (§ 2(1) of the German AI Market Surveillance and Innovation Promotion Act (KI-MIG)), unless sectoral authorities — such as BaFin — are competent. As at the date of this article (17 August 2026), Austria has not designated a market surveillance authority under Art. 70 AI Act; the AI service point at RTR is an information and advisory body without supervisory powers.

3. Cyber Resilience Act (CRA)

Short answer: Regulation 2024/2847, applicable 11 December 2027. Cybersecurity requirements for all products with digital elements. Combined with NIS2 and DORA. The CRA operates through product conformity — unlike the NIS2 evidence obligations, which attach to the entity.

According to the first version of this article, it addresses all manufacturers of 'products with digital elements' — software, hardware with software, IoT devices. The obligations: cybersecurity by design, regular vulnerability updates throughout the product lifecycle, incident reporting within 24 hours, conformity assessment and CE marking. Important for planning: the CRA ties vulnerability handling not to 24 months but to the support period — the expected product lifetime or five years from placing on the market, whichever is shorter (Art. 13(8) subpara. 1 CRA). Anyone building products with a long service life therefore plans vulnerability handling in product generations, not in release cycles.

Preparation according to the first version of this article: implement an SBOM (software bill of materials) and set up a vulnerability management process; the sanction range is up to EUR 15 million or 2.5% of worldwide turnover. On further details — product categories, conformity assessment procedures, transitional arrangements — the factual basis of this article contains no information; please check these points against the text of the regulation before use.

4. AI Liability Directive (AILD)

The proposal for an AI Liability Directive (AILD, COM(2022) 496) is no longer an ongoing legislative project: the European Commission earmarked it for withdrawal in its 2025 work programme (COM(2025) 45 final, Annex IV, 11 February 2025). Entry into force in 2027/28 is therefore not foreseeable. For damage caused by AI, the new Product Liability Directive (EU) 2024/2853 applies instead — it expressly covers software including AI systems and is to be transposed into national law by 9 December 2026 (Germany and Austria alike).

For planning in 2027/28 this has two consequences. First, the target date shifts: not a hypothetical AILD date, but 9 December 2026 as the transposition deadline of the Product Liability Directive and thereafter the respective national implementing law. Second, the liability risk remains — it simply follows from product liability and general damages law instead of from a dedicated AI liability directive. The documentation that supports this risk arises under the AI Act in any case: record-keeping under Art. 12 AI Act for high-risk systems and, where Art. 27 AI Act applies, the deployer's fundamental rights impact assessment. On the addressees of Art. 27 AI Act, the factual basis of this article contains no information — please check this point against the text of the regulation before use.

5. EU Data Act

Regulation 2023/2854, applicable since 12 September 2025. The Data Act does not contain DACH-specific reporting obligations (DACH also includes non-EU Switzerland). The date of 12 September 2026 stems from the rule on application in Art. 50: the obligation under Art. 3(1) — to design connected products so that the product data are accessible to the user by default — applies to connected products and the related services placed on the market after that date. Data sharing between devices and providers. Effects on IoT and cloud.

In practice, 12 September 2026 is therefore not a retrofit deadline for the installed base, but a dividing line within the product portfolio: for devices placed on the market before that date, Art. 3(1) does not apply — for everything after it, it does. Anyone planning a new product generation in 2027 therefore decides data accessibility in the product architecture, not in the compliance department. According to the first version of this article, those mainly affected are IoT manufacturers, cloud providers and data intermediaries; as preparation it names reviewing data processing agreement templates, updating cloud contracts for switching clauses and extending data governance to machine data. The first version lists the Data Governance Act as already applicable; on its obligations the factual basis of this article contains no information.

6. NIS2 evidence 2027/28: Germany and Austria treated separately

Short answer: evidence of NIS2 implementation follows entirely different mechanisms in the two countries — in Germany through a three-year audit set by the BSI that applies only to operators of critical installations, and in Austria — from the date the NISG 2026 becomes applicable on 1 October 2026 — through a self-declaration by all essential and important entities. There is no common DACH date.

Germany. Operators of critical installations demonstrate implementation of the measures under § 30(1) in conjunction with § 31 BSIG at a point in time set by the BSI — at the earliest three years after they first qualify as the operator of a critical installation — and thereafter every three years by means of security audits, reviews or certifications; the results, including any security deficiencies identified, must be submitted (§ 39(1) BSIG). For the remaining particularly important and important entities, this recurring evidence obligation under § 39(1) BSIG does not exist; for them, the documentation obligation under § 30(1) BSIG remains. Anyone wishing to check whether they are affected at all starts with § 28(1) and (2) BSIG: for other entities, the link to an installation is part of the threshold — without a type under Annex 1, or under Annex 1 or 2, employee and turnover figures do not support the classification. Irrespective of the size thresholds, operators of critical installations, qualified trust service providers, top-level domain name registries, DNS service providers and certain telecommunications providers additionally qualify as particularly important entities (§ 28(1) BSIG).

Austria. Essential and important entities submit structured information on the risk management measures implemented — a self-declaration — to the Cybersecurity Authority within twelve months of the registration obligation arising. Upon request, implementation must be demonstrated within two years by an independent body; essential entities must demonstrate operational and organisational implementation within two months of being requested to do so (§ 33(1) and (2) NISG 2026). Registration itself must take place within three months of entry into force or of the conditions being met (§ 29(2) to (4) NISG 2026). The NISG 2026 becomes applicable on 1 October 2026. If the registration obligation arises on that date, the self-declaration falls, arithmetically, in the year 2027 — the exact point in time at which the registration obligation arises is not covered by the factual basis of this article. The competent authority is the Cybersecurity Authority (§ 3a NISG 2026), not the BSI.

Governance. In Germany, management bodies must implement the risk management measures and monitor their implementation, and they are liable to their entity for breaches under the company law applicable to the legal form (§ 38(1) and (2) BSIG). In Austria, from the date the NISG 2026 becomes applicable on 1 October 2026, the management bodies must ensure and supervise compliance (§ 31(1) NISG 2026); the NISG 2026 does not contain an internal liability provision comparable to § 38(2) BSIG, but the Cybersecurity Authority may then temporarily prohibit the management bodies of an essential entity from exercising management functions by official decision (§ 39(4) no. 2 NISG 2026, with entry in the commercial register). A training obligation for management bodies already exists in Germany (§ 38(3) BSIG) and applies in Austria from 1 October 2026 (§ 31(2) NISG 2026).

7. Pay transparency 2027: the first pay gap reports

Short answer: 7 June 2027 is the first date on which the Pay Transparency Directive (Directive (EU) 2023/970) triggers a reporting obligation — staggered by size and taking effect through the respective national implementing law, not directly from the directive.

The staggering: employers with 250 or more employees report by 7 June 2027 and annually thereafter (Art. 9(2) Directive (EU) 2023/970); employers with 150 to 249 employees likewise by 7 June 2027, and every three years thereafter (Art. 9(3)); employers with 100 to 149 employees only by 7 June 2031, and every three years thereafter (Art. 9(4)). The reports cover, among other things, the gender pay gap including variable components, median values, the proportion of workers in each pay quartile and the pay gap by category of worker (Art. 9(1)).

7 June 2026, by contrast, was the transposition deadline addressed to the Member States (Art. 34(1) Directive (EU) 2023/970) — not a date from which private employers are directly bound by the directive. The employer obligations take effect with national transposition: in Germany through the reform of the German Pay Transparency Act (EntgTranspG), in Austria through the EntgleichV. The Deadlines Roadmap gives forecast dates for this, as at 2 May 2026 — DE expected 1 January 2027 for the right to information, AT expected 1 July 2026 for the EntgleichV. As at 17 August 2026, no transposing act was in place in either Germany or Austria; the Austrian forecast date has therefore passed.

Under applicable German law, the individual right to information exists in establishments that, as a rule, have more than 200 employees; the comparator pay need not be stated where the comparable activity is performed by fewer than six employees of the other sex (§§ 10 to 12 EntgTranspG), flanked by the equal pay requirement of § 7 EntgTranspG. In Austria, § 11 of the Austrian Equal Treatment Act (GlBG) requires that company classification schemes observe the principle of equal pay for equal work or work of equal value; gender-neutral job advertisements are governed by § 9 GlBG, and breaches are subject to a fine of up to EUR 360 (§ 10 GlBG). Practical recommendation: form categories of workers performing equal work or work of equal value and check the classification criteria for freedom from discrimination — this grouping supports both the right to information under Art. 7 and the report under Art. 9(1).

8. EU Pay Transparency re-evaluation

Directive (EU) 2023/970 does not provide for an evaluation date in 2029: under Art. 35, the Member States inform the Commission of the application of the directive by 7 June 2031 (paragraph 1); by 7 June 2033 the Commission submits a report on the implementation of the directive to the European Parliament and the Council, examining, among other things, the employer thresholds under Art. 9 and 10 and the 5% threshold for the joint pay assessment under Art. 10(1) (paragraph 2). Possible tightening would be a consequence of that report.

For planning in 2027/28 this means: nothing is to be expected from the re-evaluation in that period. Anyone setting up the reporting process described in Section 7 works against the thresholds applicable today — a lowering would at the earliest be a consequence of the Commission report under Art. 35(2); whether any project to that effect is under way is not covered by the factual basis of this article.

9. Digital Services Act 2.0

A reform is expected from 2027: stricter platform obligations, transparency for AI recommender systems.

This expectation is a statement made in the first version of this article. On a Commission proposal, a procedural status or a date for a DSA reform, the factual basis of this article contains no information; no deadline or obligation for 2027/28 can be derived from it. Where AI-supported systems already trigger transparency obligations today, these follow from Art. 50 AI Act — applicable since the general date of application on 2 August 2026: notification of interaction for systems that communicate directly with people (paragraph 1), machine-readable marking of synthetic audio, image, video and text content (paragraph 2), information to the persons concerned in the case of emotion recognition and biometric categorisation (paragraph 3) and disclosure of deep fakes (paragraph 4).

10. ePrivacy Regulation: withdrawal of the proposal earmarked

The proposal for an ePrivacy Regulation (COM(2017) 10), under discussion since 2017, is no longer an ongoing project: the European Commission earmarked it for withdrawal in the same Annex IV of the 2025 work programme (COM(2025) 45 final, 11 February 2025) on which Section 4 on the AILD already relies. Adoption in 2027/28 is therefore not foreseeable, and § 25 of the German Telecommunications-Digital-Services Data Protection Act (TDDDG) will not be replaced for the time being. For the storage of information on terminal equipment and access to it (cookies and comparable techniques), ePrivacy Directive 2002/58/EC in its national transposition therefore remains decisive — in Germany § 25 TDDDG (protection of privacy in terminal equipment), in Austria the corresponding transposition in the Austrian Telecommunications Act 2021 (TKG 2021).

For cookie practice in 2027/28 this means: the standard does not change. In Germany, storage and access are permissible only if the end user has consented on the basis of clear and comprehensive information; no consent is required where the sole purpose is to carry out the transmission of a communication or where access is strictly necessary for a digital service expressly requested by the user (§ 25(1) and (2) TDDDG). In both countries, the GDPR requirements for consent apply alongside: the controller must be able to demonstrate consent, withdrawal is possible at any time and must be as easy as giving consent (Art. 7(1) and (3) GDPR).

11. Sanction ranges of the 2027/28 obligations

Short answer: the ranges under the AI Act and the BSIG already apply today and will merely become applicable to more situations with the AI Act high-risk dates (2 December 2027 for Annex III, 2 August 2028 for Annex I); the NISG 2026 range takes effect when that act becomes applicable on 1 October 2026, and the CRA range with full applicability on 11 December 2027. The table names statutory maximum ranges, not amounts to be expected.

Two points of context. First: for SMEs, including start-ups, the lower of the two amounts applies to the fines under the AI Act (Art. 99(6) AI Act) — so the EUR 35 million figure is not the benchmark for small enterprises. Second: the addressee of the AI Act fines is the undertaking as provider or deployer; personal recourse against management does not follow from Art. 99 AI Act, but only through national company law and administrative offences law.

12. Preparation 2026/27 — what makes sense now

Short answer: what makes sense is precisely what holds regardless of legislative procedures still under way — an up-to-date AI inventory, the provider documentation for the GPAI models in use, and clarification of your own NIS2 classification. Everything else depends on dates that will only be settled by an adoption or a national implementing act.

These three steps are practical recommendations made in this article, not statutory requirements. First: keep the AI inventory in such a way that, for each system, you can answer whether it falls under Annex III, whether it is embedded as a safety component in an Annex I product and whether a GPAI model sits behind it — these three questions determine which date from Section 2 is relevant at all. Second: request and file the provider documentation under Art. 53(1) AI Act once and in full, instead of searching for it when the first supervisory enquiry arrives. Third: record the NIS2 classification in writing — type of entity under the annex, size threshold, result (§ 28(1) and (2) BSIG; in Austria § 24 in conjunction with § 25 NISG 2026); without this result, neither the evidence question from Section 6 nor the registration obligation can be answered.

A practical rhythm, not a deadline: because individual dates still depend on ongoing legislative procedures, a quarterly check is advisable — once per quarter, check whether the EntgTranspG reform or the EntgleichV have entered into force; the AI part of the Digital Omnibus has been in force since 27 July 2026 as Regulation (EU) 2026/1744, whereas the data omnibus remains only a proposal. This is a working instruction from this article; statutory deadlines run independently of it.

On the developments mentioned in the TL;DR — compliance as code, AI-supported audit automation and mandatory ESG reporting — the factual basis of this article contains no official source; they are an editorial assessment, not a legal source, and do not establish any deadlines.