Compliance Deadlines Calendar 2026/27/28

Already in force (historical markers)

02.02.2025 — EU AI Act Article 4: AI literacy obligation for providers and deployers of AI systems.
02.08.2025 — EU AI Act obligations for general-purpose AI (GPAI models placed on the market after this date).
06.12.2025 — German NIS2 Implementation Act (NIS2UmsuCG) entered into force — risk management, notification obligations, internal liability of managing directors under Section 38 BSIG.

17.01.2026 — DORA (Digital Operational Resilience Act) full application for financial entities and ICT third-party providers.
06.03.2026 — BSI registration deadline for essential and important entities under NIS2 (Germany).
07.06.2026 — EU Pay Transparency Directive (2023/970) transposition deadline: obligations from 100 employees, joint pay assessment from 5 % gap.
02.08.2026 — EU AI Act high-risk provisions (Annex III) applicable — AI in HR, education, law enforcement.
~Q4 2026 — Austrian NISG 2026 expected to enter into force (NIS2 transposition in Austria).

02.08.2027 — EU AI Act: GPAI legacy models (placed on the market before 02.08.2025) must comply with Annex XI obligations.
02.12.2027 — Proposed under the Digital Omnibus initiative (19.11.2025): full applicability of EU AI Act Annex III [VOLATILE — trilogue in progress, NOT yet adopted; until then 02.08.2026 remains binding].
11.12.2027 — Cyber Resilience Act (CRA) main requirements applicable — security by design for connected products.
~12/2027 — Fundamental Rights Impact Assessment (FRIA) mandatory for deployers of high-risk AI (public authorities and private bodies acting on a public mandate).

07.06.2028 — EU Pay Transparency: extended reporting obligations also for companies with 100–149 employees (every three years).
~10/2028 — First NIS2 audit wave by the competent authorities in Germany and Austria expected (24-month cycles from entry into force).