- Home
- Suite features
- Deadlines and horizon
EU digital regulation deadlines, 2026 to 2028, on one timeline
EU digital regulation deadlines 2026 run from August to December: AI Act transparency since 2 August, Cyber Resilience Act reporting since 11 September, the Data Act design duty for connected products placed on the EU market after 12 September, and product-liability transposition — EU countries turning the directive into national law — by 9 December. The Horizon Scanner counts down twelve milestones, not the August one; it sends no alerts.
- 12 dated milestones
- Alerts · none
- Calendar export · none
- GDPR · NIS2 · not listed
EU digital regulation deadlines 2026 and 2027: which dates matter?
For non-EU sellers of software, connected devices or cloud services, 2026 is the dense year; December 2027 completes the Cyber Resilience Act (CRA). The EU regulatory timeline for 2026 and 2027, as of 27 September 2026:
| Date | What applies | Legal basis | In the scanner |
|---|---|---|---|
| 12 September 2025 | Data Act applies: data access, cloud switching | Art. 50 Regulation (EU) 2023/2854 | Listed |
| 2 August 2026 | AI Act general application: transparency for chatbots and synthetic content. All dates: AI Act timeline | Art. 50, Art. 113 Regulation (EU) 2024/1689 | Not listed |
| 11 September 2026 | CRA reporting of actively exploited vulnerabilities and severe incidents, earlier products included | Art. 14, Art. 69(3), Art. 71(2) Regulation (EU) 2024/2847 | Listed · never marked |
| 12 September 2026 | The Data Act September 2026 deadline: access by design for connected products and related services placed on the market after it | Art. 3(1), Art. 50 Data Act | Data Act module only |
| 9 December 2026 | Product liability transposition; new rules for products, software included, placed on the market after it | Directive (EU) 2024/2853, Art. 2(1), Art. 4(1) | Listed |
| 12 January 2027 | Data Act: switching charges end | Art. 29(1) Data Act | Data Act module only |
| 12 September 2027 | Data Act unfair-terms rules reach B2B contracts concluded on or before 12 September 2025: open-ended, or expiring ten or more years after 11 January 2024 | Art. 50, Chapter IV Data Act | Not listed |
| 2 December 2027 | AI Act high-risk systems, Annex III; Annex I products on 2 August 2028 | Art. 113 AI Act · Regulation (EU) 2026/1744 | Listed |
| 11 December 2027 | CRA in full, including the Annex I essential requirements | Art. 71(2) CRA | Inside the September 2026 entry |
Outside the table: DORA, for financial entities, since 17 January 2025 (Art. 64); NIS2, the EU cybersecurity directive, whose national laws were to apply from 18 October 2024 (Art. 41(1)), several late; and the GDPR. Their deadlines are incident clocks — see NIS2 incident reporting.
From the first click to the timeline
Open /suite/#home; the scanner has no address of its own.
- Accept the legal notice on your first visit.
- Complete a quick check. The welcome screen's Digital Services Act (DSA), AI Act and GDPR cards open one; further checks start from the sidebar. A check you close marks nothing.
- Press 'Stream'. Top right on a desktop, a satellite-dish icon above the footer on a phone; or key 5.
- Filter and read. Pills: All, DSA, AI Act, Guidance, Further EU acts. Amber under 180 days, red under 60. 'RA Funk' in the overlay's notes is the law firm Theo Funk, acting only under a separate mandate.
- Open a regime module for cut-offs inside one act, such as the Data Act's (/suite/#data-act); on a first visit its welcome-screen card does not respond.
Answers stay in this browser (local storage, no account) unless you send an email draft yourself; the marking runs there. Details: Trust Center.
What the Horizon Scanner shows, and on which legal basis
Regulatory horizon scanning, here, is one dated list — not a news feed or an EU compliance calendar to subscribe to.
| Capability | Source | Output |
|---|---|---|
| Milestone list | Three DSA entries (one under Guidance), three AI Act · Data Act · CRA · DORA · eIDAS 2.0 · EHDS · product liability | Twelve entries by date, each with days left or 'in force'; on screen only |
| Profile marks | Your quick-check answers | 'Relevant to your profile' per entry, and a banner counting them |
Marks you can trace
Fixed rules, run in your browser: cloud storage (DSA check) marks the Data Act; any AI system, product liability; Annex III or Annex I, December 2027; special-category data (Art. 9 GDPR), the European Health Data Space (EHDS).
Gaps left open
CRA and DORA are never marked: no quick check asks about products with digital elements or financial services.
Which dates does the scanner mark for a US file-sharing vendor?
A hypothetical US company with no EU establishment sells B2B file sharing, a desktop sync client and AI summaries. Quick checks: DSA 'Hosting service', 'Cloud storage'; AI Act 'Provider', 'Established outside the EU', 'Generative output'. On 27 September 2026 the banner reads '3 act(s) highlighted for your profile':
- Marked · 232 daysDSA Art. 15 report, for a hosting service — a prompt, not the statutory day; micro and small enterprises are exempt (Art. 15(2) DSA).
- Marked · in forceData Act, for cloud storage; the module adds the end of switching charges on 12 January 2027 (Art. 29(1)).
- Marked · 73 daysProduct liability, for an AI system: software placed on the market after 9 December 2026 is a product (Art. 2(1), Art. 4(1) Directive (EU) 2024/2853).
- Not marked · in forceCyber Resilience Act. If the sync client is a product with digital elements (Art. 3(1) CRA), Art. 14 reporting has applied since 11 September 2026, earlier versions included (Art. 69(3)).
- Not listed · 2026AI Act transparency: the summaries may need machine-readable marking (Art. 50(2) AI Act) since 2 August 2026, later for systems already on the market — see the AI Act timeline.
Unmarked and unlisted rows make the list a starting point, not an inventory; whether the CRA or Art. 50 applies here is a question for a lawyer.
What the scanner leaves out
- No notifications, no live source: 'Fetch live updates' looks for an engine on your own machine and, finding none, reports 'not connected'.
- No entry for 2 August 2026, the AI Act's general application date (Art. 113), nor for the GDPR, NIS2, DMA or the Data Act's later cut-offs.
- DSA entries are reminders, not statutory dates. Under Implementing Regulation (EU) 2024/2835, reports cover the calendar year, or half-years for very large platforms and search engines (Art. 15(1), Art. 42(1) DSA), and are due two months later; 17 May 2027 is no such date. The mark ignores the small-enterprise exemption (Art. 15(2)). The Art. 33 threshold evaluation was due by 17 November 2025 (Art. 91), not 17 February 2027.
- The EHDS entry counts down to 26 March 2029, when the first health-data use rules apply; the Regulation applies from 26 March 2027, later parts from 2031 (Art. 105 Regulation (EU) 2025/327).
- A directive binds Member States (Art. 288 of the Treaty on the Functioning of the EU): liability follows the national transposing law, not the countdown.
Frequently asked questions
Which EU digital compliance deadlines fall in 2026 and 2027?
Six stand out: AI Act transparency since 2 August 2026 (Art. 113 AI Act), Cyber Resilience Act reporting from 11 September 2026 (Art. 71(2) CRA), the Data Act design duty from 12 September 2026 (Art. 50 Data Act), product-liability transposition by 9 December 2026, the end of switching charges on 12 January 2027 (Art. 29(1) Data Act) and the AI Act Annex III high-risk rules from 2 December 2027 (Regulation (EU) 2026/1744).
Which EU obligations start in September 2026?
Among the digital acts on this page, two, one day apart: Cyber Resilience Act reporting of actively exploited vulnerabilities and severe incidents from 11 September 2026 (Art. 14, Art. 71(2) CRA), and data access by design for connected products and related services placed on the market after 12 September 2026 (Art. 3(1), Art. 50 Data Act).
When do the Cyber Resilience Act reporting duties apply?
From 11 September 2026 (Art. 71(2) CRA), also for products already on the market (Art. 69(3)). An actively exploited vulnerability needs an early warning within 24 hours, a notification within 72 hours and a final report within 14 days of a corrective measure; a severe incident, 24 hours, 72 hours and one month (Art. 14(2), (4)). Reports go via the single reporting platform to the coordinating CSIRT and ENISA, the EU cybersecurity agency (Art. 14(1), Art. 16).
Does the suite alert me when a deadline changes?
No. The Horizon Scanner sends no email, push message or calendar file; it shows the list shipped with your suite version, and only a newer version revises it. Alerts belong to the Monitoring plan under software plans, which is on a waitlist.
How often is the timeline updated?
By release, not continuously. The twelve milestones ship with the suite and change only with a newer version; the overlay shows no date of last review, so check each entry against its cited article. Countdowns update when the overlay opens and daily while it stays open.
Where do I find regulatory changes as they happen?
Not in real time, here or in the suite. The public Regingada Radar is an editorially curated, hand-updated selection of changes in EU digital law (DSA, AI Act, GDPR, DMA, NIS2), with sources, RSS and JSON. The suite's 'Compliance Radar' shows built-in sample entries, not a feed.
When, not whether
The scanner answers when. Whether an act reaches your product, whether a release was placed on the market before a cut-off (Art. 50 Data Act, Art. 69 CRA) and whose national law applies turn on your facts; the law firm Theo Funk can answer them under a separate mandate.
Several of these acts require a non-EU company to appoint an EU representative: Art. 13 DSA for intermediary services such as the hosting service above, Art. 37(11) Data Act, and Art. 26(3) NIS2 for the digital providers in Art. 26(1)(b). Regingada UG (haftungsbeschränkt) can hold these roles; it gives no legal advice: EU representative for US companies · DSA Art. 13 · NIS2 Art. 26(3).