Compliance Deadlines Calendar 2026 / 2027 / 2028

Already in force (historical markers)

• 17.01.2025 — DORA (Regulation (EU) 2022/2554) applies to financial entities and their ICT third-party providers (Art. 64).
• 02.02.2025 — EU AI Act: prohibited practices (Art. 5) and Art. 4 AI literacy apply. Art. 4 in the version in force since 27.07.2026 (Regulation (EU) 2026/1744): providers and deployers take measures to support the development of the AI literacy of their staff — a particular level of AI literacy does not have to be guaranteed.
• 02.08.2025 — EU AI Act obligations for general-purpose AI (Chapter V), governance and penalties (Art. 99/100).
• 06.12.2025 — German NIS2 Implementation Act (NIS2UmsuCG, BGBl. 2025 I No. 301) entered into force — risk management (Section 30 BSIG), notification obligations (Section 32 BSIG), implementation, supervision and training duties of management with internal liability under Section 38 BSIG.
• 06.01.2026 — BSI registration portal open (second stage) for essential and important entities.
• 27.07.2026 — Regulation (EU) 2026/1744 (“Digital Omnibus on AI”, OJ L 2026/1744 of 24.07.2026) entered into force and amended the EU AI Act — it is applicable law, no longer a proposal.
• 29.07.2026 — Germany: the KI-MIG (BGBl. 2026 I No. 223) entered into force. The Bundesnetzagentur is the market surveillance authority for the EU AI Act unless the act provides otherwise (Section 2(1) KI-MIG); at the same time a new no. 10 covering breaches of Regulation (EU) 2024/1689 was inserted into Section 2(1) HinSchG (the previous no. 10 became no. 11). Austria had not designated an authority under Art. 70 EU AI Act as at 17.08.2026.

Key deadlines 2026

• Rolling deadline — NIS2 registration in Germany: under Section 33(1) BSIG at the latest three months after an entity first or again qualifies as an essential or important entity. The BSI states that the statutory registration deadline has already expired — there is no official calendar date.
• 07.06.2026 — transposition deadline of the EU Pay Transparency Directive (EU) 2023/970 (Art. 34) — expired. As of 17.08.2026 Germany had no transposition act and not even a ministerial draft (BT-Drs. 21/7026); Austria likewise had no government bill. The directive’s obligations take effect with the respective national law.
• 02.08.2026 — general date of application of the EU AI Act, including the Art. 50 transparency obligations. This date remains unchanged under Regulation (EU) 2026/1744.
• 01.10.2026 — NISG 2026 (Austria) enters into force (Section 51(2) NISG 2026, BGBl. I No. 94/2025); at the same time Sections 2–31 NISG 2018, NISV and QuaSteV cease to apply.
• 02.12.2026 — EU AI Act: the new prohibition added by Regulation (EU) 2026/1744 (Art. 5(1)(ba)/(bb)) applies; generative AI systems placed on the market before 02.08.2026 must meet Art. 50(2) by this date (Art. 111(4)).

Key deadlines 2027

• 07.06.2027 — EU Pay Transparency Directive: employers with 250 or more employees report annually, employers with 150–249 employees for the first time and thereafter every three years (Art. 9(2), (3)) — applicable in Germany and Austria only once the directive is transposed into national law.
• 02.08.2027 — EU AI Act: providers of general-purpose AI models placed on the market before 02.08.2025 must have taken the measures needed to comply with the Regulation (Art. 111(3)); national AI regulatory sandboxes must be operational (Art. 57).
• 02.12.2027 — EU AI Act: Chapter III Sections 1–3 apply to high-risk systems under Annex III (Art. 113(3)(c)(i) as amended by Regulation (EU) 2026/1744, in force since 27.07.2026). From this date the deployer obligations of that chapter apply to Annex III systems; the fundamental rights impact assessment under Art. 27 is required of deployers that are bodies governed by public law or private entities providing public services, and of deployers of the systems listed in Annex III points 5(b) and (c).

Key deadlines 2028

• 02.08.2028 — EU AI Act: high-risk requirements for products under Annex I (Art. 6(1)) apply (Art. 113(3)(c)(ii) as amended by Regulation (EU) 2026/1744).
• Evidence cycles under NIS2 (Germany) — operators of critical installations must demonstrate implementation to the BSI at a date set by the BSI, at the earliest three years after they first qualify, and every three years thereafter (Section 39(1) BSIG). There is no official date for the start of supervisory audits or fines.
• 07.06.2031 — EU Pay Transparency: employers with 100–149 employees report for the first time, thereafter every three years (Art. 9(4)) — again subject to national transposition.