EU cyber regulation · verified 9 October 2026
EU Cyber Compliance Deadline Tracker
Every binding date from NIS2, the Cyber Resilience Act, DORA, CER, the AI Act and eIDAS 2 in one table, with the article that sets it and a primary source you can check. Updated monthly; last verified 9 October 2026.
General information only, not legal advice. NIS2 obligations depend on your member state’s transposition law and sector rules — verify each date against the national law and your competent authority before acting on it.
Next upAI Act
54
days
AI Act: new prohibitions and legacy-system marking duties apply
2 December 2026
CRA
63
days
CRA: member states to have enough notified bodies in place
11 December 2026
eIDAS 2
76
days
eIDAS 2: every member state to offer an EU Digital Identity Wallet
24 December 2026
All upcoming deadlines
Filter by framework. Rolling deadlines depend on when an authority notifies the entity; the trigger is shown instead of a calendar date.
| Date | Framework | What applies | Who is affected | Legal basis | Source |
|---|---|---|---|---|---|
| 2 December 2026 54 days |
AI Act | AI Act: new prohibitions and legacy-system marking duties apply The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force 27 July 2026) kept the 2 August 2026 transparency duties but gave pre-existing generative systems until 2 December 2026 to implement machine-readable marking under Article 50(2). The same date brings the added prohibition on AI used to create non-consensual intimate imagery and child sexual abuse material. |
Providers of AI systems (including general-purpose AI systems) that generate synthetic audio, image, video or text and were placed on the market before 2 August 2026; providers and deployers regarding the new Article 5 prohibitions | Reg. (EU) 2024/1689 Art. 5(1)(ba)-(bb), Art. 111(4) and Art. 113, third paragraph, point (a), as amended by Reg. (EU) 2026/1744 | EUR-Lex – Regulation (EU) 2026/1744 (Digital Omnibus on AI) + Add to Google Calendar |
| 11 December 2026 63 days |
CRA | CRA: member states to have enough notified bodies in place Member states shall strive to ensure, by 11 December 2026, that there are enough notified bodies in the EU to carry out CRA conformity assessments and avoid bottlenecks before the CRA applies in full on 11 December 2027. A best-efforts target, not a hard obligation on companies. |
Member states and notifying authorities; manufacturers whose products need third-party conformity assessment (e.g. important products of Class II) | Reg. (EU) 2024/2847, Art. 35(2) | EUR-Lex + Add to Google Calendar |
| 24 December 2026 76 days |
eIDAS 2 | eIDAS 2: every member state to offer an EU Digital Identity Wallet Article 5a(1) requires each member state to provide at least one wallet within 24 months of the entry into force of the implementing acts under Articles 5a(23) and 5c(6). Those acts were adopted on 28 November 2024, published on 4 December 2024 and entered into force on 24 December 2024, which puts the deadline at 24 December 2026. Acceptance obligations for private relying parties in regulated sectors follow twelve months later. |
Member states (wallet issuance); relying parties preparing wallet acceptance | Reg. (EU) 2024/1183, Art. 5a(1); Implementing Regulations (EU) 2024/2977, 2024/2979, 2024/2980, 2024/2981 and 2024/2982 | EUR-Lex – Regulation (EU) 2024/1183 (eIDAS 2) + Add to Google Calendar |
| 1 January 2027 84 days |
Member state | Austria: registration deadline under NISG 2026 Section 29(3) NISG 2026 requires registration within three months of entry into force (1 October 2026). The Federal Office for Cybersecurity (Bundesamt für Cybersicherheit) gives the deadline as 1 January 2027, which shifts to 4 January 2027 at the latest because the period ends on a public holiday (section 33(2) AVG). Entities that come into scope later register within three months of meeting the criteria. |
Essential and important entities in Austria | NISG 2026, § 29(2)-(3) | Bundesamt für Cybersicherheit – Registrierung + Add to Google Calendar |
| 17 April 2027 190 days |
NIS2 | NIS2: member states review their lists of essential and important entities The lists were due by 17 April 2025 and are to be reviewed and, where appropriate, updated at least every two years. Entities that crossed a size threshold or changed sector since 2025 are the typical candidates for re-classification. |
National competent authorities; entities whose classification may change | Directive (EU) 2022/2555, Art. 3(3) | EUR-Lex – Directive (EU) 2022/2555 (NIS2) + Add to Google Calendar |
| 2 August 2027 297 days |
AI Act | AI Act: general-purpose AI models placed on the market before August 2025 must comply GPAI obligations have applied to new models since 2 August 2025; models already on the market before that date get a transition period until 2 August 2027. This date was not changed by the Digital Omnibus on AI. |
Providers of general-purpose AI models placed on the market before 2 August 2025 | Reg. (EU) 2024/1689, Art. 111(3) | EUR-Lex + Add to Google Calendar |
| 17 October 2027 373 days |
NIS2 | NIS2: first Commission review of the Directive The Commission reviews the functioning of NIS2 by 17 October 2027 and every 36 months thereafter, assessing in particular whether entity size and the sectors in Annexes I and II remain relevant. The report may be accompanied by a legislative proposal; separately, the Commission already proposed targeted NIS2 amendments on 20 January 2026. |
European Commission (report to Parliament and Council); all in-scope sectors indirectly | Directive (EU) 2022/2555, Art. 40 | EUR-Lex – Directive (EU) 2022/2555 (NIS2) + Add to Google Calendar |
| 2 December 2027 419 days |
AI Act | AI Act: high-risk obligations for stand-alone Annex III systems apply Originally 2 August 2026; postponed by the Digital Omnibus on AI to 2 December 2027 as a fixed calendar date, not a standards-dependent trigger. |
Providers and deployers of Annex III high-risk AI (e.g. HR screening, credit scoring, critical-infrastructure safety components) | Reg. (EU) 2024/1689 Art. 113, third paragraph, point (c)(i), as amended by Reg. (EU) 2026/1744 | European Commission – AI Act + Add to Google Calendar |
| 11 December 2027 428 days |
CRA | CRA applies in full: essential requirements, conformity assessment, CE marking Products placed on the market from this date need to meet the Annex I essential cybersecurity requirements, carry technical documentation and a conformity assessment, and provide security updates for the support period. |
Manufacturers, importers and distributors of products with digital elements | Reg. (EU) 2024/2847, Art. 71(2) | European Commission – Cyber Resilience Act + Add to Google Calendar |
| 24 December 2027 441 days |
eIDAS 2 | eIDAS 2: wallet acceptance duty reaches private relying parties No later than 36 months after the implementing acts entered into force (24 December 2024), i.e. twelve months after the wallet-availability deadline, these private services must accept the EU Digital Identity Wallet for identification where strong authentication is required, upon the user's voluntary request. |
Private relying parties (except micro and small enterprises) required by EU or national law, or by contract, to use strong user authentication for online identification, e.g. in transport, energy, banking and financial services, social security, health, drinking water, postal services, digital infrastructure, education or telecommunications | Reg. (EU) 2024/1183, Art. 5f(2) | EUR-Lex – Regulation (EU) 2024/1183 (eIDAS 2) + Add to Google Calendar |
| 17 January 2028 465 days |
DORA | DORA: Commission review, including the critical ICT third-party provider regime By 17 January 2028 the Commission reviews DORA and reports to Parliament and Council, where appropriate with a legislative proposal. The review covers at least the criteria for designating critical ICT third-party providers, the voluntary notification of significant cyber threats, and oversight of critical providers established in third countries. |
European Commission (after consulting the ESAs and ESRB); financial entities and critical ICT third-party service providers indirectly | Reg. (EU) 2022/2554, Art. 58(1) | EUR-Lex + Add to Google Calendar |
| 2 August 2028 663 days |
AI Act | AI Act: high-risk obligations for AI embedded in Annex I regulated products apply Originally 2 August 2027; postponed by Regulation (EU) 2026/1744 to 2 August 2028. The same regulation moved machinery (Regulation (EU) 2023/1230) to Annex I Section B, so AI in machinery will be regulated through Machinery Regulation delegated acts that apply by 2 August 2028. Vehicles and other Section B products were never subject to these Chapter III obligations directly. |
Providers of AI systems that are safety components of, or are themselves, products under the Annex I Section A legislation (e.g. medical and in vitro diagnostic devices, toys, lifts, radio equipment, pressure equipment, personal protective equipment) | Reg. (EU) 2024/1689 Art. 113, as amended by Reg. (EU) 2026/1744 | European Commission – AI Act + Add to Google Calendar |
| 10 months after notification | CER | CER: resilience obligations start 10 months after an entity is notified Chapter III duties (resilience measures, incident notification, background checks) apply from 10 months after the date of the notification; the critical-entity risk assessment itself is due within nine months of receiving the notification (Art. 12(1)). An entity notified in August 2026 therefore faces its risk-assessment deadline around May 2027 and the remaining obligations around June 2027. Critical entities in banking, financial market infrastructure and digital infrastructure have no Chapter III obligations unless national law provides otherwise. |
Entities identified as critical entities by their member state (identification was due by 17 July 2026, notification within one month) | Directive (EU) 2022/2557, Art. 6(1), 6(3) and 12(1) | EUR-Lex – Directive (EU) 2022/2557 (CER) |
| 3 months after a facility qualifies | Germany | Germany: KRITIS-Dachgesetz registration, then risk analysis and resilience plan Adopted by the Bundestag on 29 January 2026, approved by the Bundesrat on 6 March 2026, in force since 17 March 2026 (BGBl. 2026 I No. 66). Operators register on the joint BBK/BSI platform no later than three months after a facility counts as a critical installation under the thresholds and cut-off dates set by the Federal Interior Ministry's ordinance (section 5(1)). The original fixed date of 17 July 2026 was removed by an amendment of 21 July 2026 (BGBl. 2026 I No. 221). The risk analysis applies nine months after registration; resilience measures and plan, incident reporting and management duties apply ten months after registration. |
Operators of critical installations (physical resilience, CER transposition) | KRITIS-Dachgesetz (KRITISDachG) § 8(1) and (7), §§ 12, 13, 18, 20 | gesetze-im-internet.de – KRITIS-Dachgesetz |
| every 3 years | Germany | Germany: evidence of security measures by operators of critical installations Operators of critical installations demonstrate compliance with their security obligations to the BSI through audits, tests or certification every three years. The BSI sets the date of the first submission, which is no earlier than three years after the operator first qualifies; for former KRITIS operators, no earlier than three years after their last evidence under the old § 8a(3) BSIG. |
Operators of critical installations under the BSIG (KRITIS operators) | § 39 BSIG | gesetze-im-internet.de – § 39 BSIG |
NIS2 transposition status by member state
Status as verified on 9 October 2026. Three member states still have no adopted NIS2 law and were referred to the Court of Justice on 8 July 2026; the Netherlands was referred too but its law entered into force on 15 August 2026.
| Member state | Status | National law | Key date | Notes |
|---|---|---|---|---|
| Austria | In force | NISG 2026 (BGBl. I Nr. 94/2025) | 1 October 2026 | Adopted by the Nationalrat on 12 Dec 2025; in force since 1 Oct 2026. Initial registration with the Bundesamt für Cybersicherheit is due by 1 Jan 2027 (the authority accepts filings until 4 Jan 2027). |
| Belgium | In force | Loi du 26 avril 2024 | 18 October 2024 | One of the first full transpositions; supervised by the CCB. |
| Bulgaria | In force | Cybersecurity Act, amended (State Gazette 17/2026) | 17 February 2026 | Amendments adopted 5 Feb 2026, in force 17 Feb 2026 with no general transition period; fines are halved for breaches committed before 1 Jun 2026. Since SG 55/2026 the competent ministry is the Ministry of Innovation and Digital Transformation. |
| Croatia | In force | Zakon o kibernetičkoj sigurnosti (NN 14/2024) | 15 February 2024 | Transposed ahead of the EU deadline. |
| Cyprus | In force | Law 60(I)/2025 amending Law 89(I)/2020 | 25 April 2025 | Competent authority: Digital Security Authority (DSA). |
| Czechia | In force | Zákon č. 264/2025 Sb. (ZoKB) | 1 November 2025 | Goes beyond NIS2 on supply-chain rules for strategically significant services. |
| Denmark | In force | NIS 2-loven (Lov nr. 434 af 6. maj 2025) | 1 July 2025 | General act in force since 1 Jul 2025; energy, telecom and certain financial entities are covered by sector-specific laws. |
| Estonia | In force | Küberturvalisuse seadus, amended by RT I, 30.12.2025, 4 | 1 January 2026 | Amending act adopted 10 Dec 2025 and in force since 1 Jan 2026; supervised by the Information System Authority (RIA). Newly covered entities have three years to meet the requirements. |
| Finland | In force | Kyberturvallisuuslaki 124/2025 | 8 April 2025 | In force since 8 Apr 2025. Supervision is split between Traficom and sector authorities; Traficom's National Cyber Security Centre is the single point of contact. |
| France | Not adopted CJEU referral | Projet de loi relatif à la résilience des infrastructures critiques et au renforcement de la cybersécurité | — | Senate adopted 12 Mar 2025; Assembly committee text 10 Sep 2025. The plenary debate set for 7 Oct 2026 was withdrawn on 6 Oct with no new date. Referred to the CJEU on 8 Jul 2026. |
| Germany | In force | NIS2UmsuCG (BGBl. 2025 I Nr. 301) / BSIG | 6 December 2025 | Registration with the BSI was due by 6 Mar 2026 (§ 33 BSIG); entities not yet registered must register without delay. |
| Greece | In force | Law 5160/2024 (ΦΕΚ Α' 195/27.11.2024) | — | Published on 27 Nov 2024; essential and important entities register with the National Cybersecurity Authority via gov.gr. |
| Hungary | In force | Act LXIX of 2024 on the cybersecurity of Hungary (Magyar Közlöny 2024/130) | 1 January 2025 | In force since 1 Jan 2025. The SZTFH supervises companies; public bodies are supervised by the national cybersecurity authority (Special Service for National Security). |
| Ireland | Not adopted CJEU referral | National Cyber Security Bill | — | Bill not yet introduced in the Oireachtas; listed for priority publication in the Autumn 2026 legislation programme. Referred to the CJEU on 8 Jul 2026. |
| Italy | In force | D.Lgs. 4 settembre 2024, n. 138 (GU n. 230 of 1 Oct 2024) | 16 October 2024 | Supervised by the ACN. Entities listed in 2025 must have the baseline security measures in place by October 2026. |
| Latvia | In force | Nacionālās kiberdrošības likums (Latvijas Vēstnesis 128A, 4 Jul 2024) | 1 September 2024 | In force since 1 Sep 2024; the National Cybersecurity Centre at the Ministry of Defence is the competent authority. Amended with effect from 18 Jun 2026. |
| Lithuania | In force | Kibernetinio saugumo įstatymas Nr. XII-1428, as amended by Law No XIV-2902 (TAR 2024-13535) | 18 October 2024 | Among the four states never sent a formal notice. |
| Luxembourg | In force | Loi du 5 mai 2026 (Mémorial A n° 225) | 10 May 2026 | Self-registration with the ILR was due by 10 Jul 2026. |
| Malta | In force | S.L. 460.41 (LN 71/2025, amended by LN 89/2026) | 23 January 2026 | Order made by LN 71/2025 in April 2025 but only brought into force on 23 Jan 2026 (LN 22/2026); amended by LN 89/2026. The CIP Department is the national supervisory authority. |
| Netherlands | In force CJEU referral | Cyberbeveiligingswet (Stb. 2026, 187) | 15 August 2026 | In force 15 Aug 2026, five weeks after the CJEU referral of 8 Jul 2026; Wbni repealed. Registration with the NCSC (via MijnNCSC) has been mandatory since that date. |
| Poland | In force | Ustawa o KSC, amended (Dz.U. 2026 poz. 252) | 3 April 2026 | Amending act of 23 Jan 2026, in force 3 Apr 2026. The self-registration deadline for the KSC register was 3 Oct 2026; obligations must be implemented by 3 Apr 2027, and fines can be imposed only from 3 Apr 2028. |
| Portugal | In force | Decreto-Lei n.º 125/2025 | 3 April 2026 | In force 3 Apr 2026. Entities must self-identify on the CNCS MyCiber platform; most security measures apply 24 months after the CNCS implementing regulation of 22 Jun 2026. |
| Romania | In force | OUG 155/2024, approved by Law 124/2025 | 31 December 2024 | Emergency ordinance in force since 31 Dec 2024, with DNSC as the competent authority; approved with amendments by Law 124/2025 (in force 10 Jul 2025). |
| Slovakia | In force | Act 366/2024 amending Act 69/2018 | 1 January 2025 | Amendment of the 2018 Cybersecurity Act, in force 1 Jan 2025 and supervised by the National Security Authority (NBÚ). Transitional rules for existing operators of essential services expire on 31 Dec 2026. |
| Slovenia | In force | ZInfV-1 (Uradni list RS 40/2025) | 19 June 2025 | New Information Security Act in force 19 Jun 2025, supervised by the Government Information Security Office (URSIV); existing entities had to self-register within six months (by Dec 2025). |
| Spain | Not adopted CJEU referral | Anteproyecto de Ley de Coordinación y Gobernanza de la Ciberseguridad | — | Draft approved by the Council of Ministers on 14 Jan 2025 but never sent to parliament; referred to the CJEU on 8 Jul 2026. The Cortes were dissolved in Oct 2026 for elections on 29 Nov 2026. |
| Sweden | In force | Cybersäkerhetslag (SFS 2025:1506) | 15 January 2026 | Cybersecurity Act in force 15 Jan 2026, replacing the 2018 NIS Act. Since 1 Jul 2026 the National Defence Radio Establishment (FRA) has been the single point of contact and CSIRT, so registrations and incident reports go to it. |
Milestones already passed
Kept for context: these dates explain why an obligation already applies today.
Show 26 past milestones
- 1 October 2026Member stateAustria: NISG 2026 (BGBl. I No. 94/2025) enters into force, replacing the NISG 2018
- 11 September 2026CRACRA Article 14 applies: manufacturers report actively exploited vulnerabilities and severe incidents to their coordinating CSIRT and ENISA via the single reporting platform (Art. 71(2))
- 15 August 2026Member stateNetherlands: Cyberbeveiligingswet (Stb. 2026, 187) enters into force
- 2 August 2026AI ActAI Act: Article 50 transparency obligations apply (systems generating synthetic content placed on the market before this date have until 2 December 2026 to comply with Art. 50(2) – Regulation (EU) 2026/1744)
- 31 July 2026GermanyGermany: date by which the BSI expected all overdue NIS2 registrations to be completed (BSI letter to industry associations of 12 June 2026; not a statutory deadline)
- 27 July 2026AI ActDigital Omnibus on AI (Regulation (EU) 2026/1744) enters into force
- 17 July 2026CERCER: member states identify critical entities (Art. 6(1))
- 8 July 2026NIS2Commission refers Ireland, Spain, France and the Netherlands to the Court of Justice, requesting lump-sum and daily penalties
- 11 June 2026CRACRA Chapter IV applies: notifying authorities and notified bodies (Art. 35–51)
- 16 March 2026GermanyGermany: KRITIS-Dachgesetz promulgated in the Federal Law Gazette
- 6 March 2026GermanyGermany: statutory registration deadline under § 33 BSIG (three months after entry into force)
- 17 January 2026CERCER: member states adopt a critical-entities resilience strategy and complete the national risk assessment (Art. 4, Art. 5)
- 6 January 2026GermanyGermany: BSI registration portal for NIS2 entities opens
- 6 December 2025GermanyGermany: NIS2UmsuCG enters into force, BSIG recast (published in the Federal Law Gazette on 5 December 2025)
- 2 August 2025AI ActAI Act: obligations for general-purpose AI models apply
- 7 May 2025NIS2Commission sends reasoned opinions to 19 member states on NIS2 transposition
- 17 April 2025NIS2NIS2 Art. 3(3): member states establish lists of essential and important entities
- 2 February 2025AI ActAI Act: prohibited practices (Art. 5) and AI-literacy duty (Art. 4) apply
- 17 January 2025DORADORA applies to financial entities (Art. 64); oversight of critical ICT third-party providers starts once the ESAs designate them
- 17 January 2025NIS2NIS2 Art. 27(2): DNS providers, TLD registries, domain registrars, cloud, data-centre, CDN, managed (security) service providers, online marketplaces, search engines and social networks submit registry information to national authorities
- 10 December 2024CRACyber Resilience Act enters into force
- 28 November 2024NIS2Commission sends letters of formal notice to 23 member states for incomplete NIS2 transposition
- 18 October 2024NIS2National NIS2 and CER measures apply; NIS1 repealed
- 17 October 2024NIS2NIS2 and CER transposition deadline for member states (Art. 41 NIS2, Art. 26 CER)
- 1 August 2024AI ActAI Act enters into force
- 20 May 2024eIDAS 2eIDAS 2 (Regulation (EU) 2024/1183) enters into force
Frequently asked questions
Which deadline matters most right now?
For manufacturers of connected hardware or software, CRA Article 14: from 11 September 2026 actively exploited vulnerabilities and severe incidents have to be reported within 24 hours, including for products already on the market. For everyone else NIS2 already applies through national law in 23 member states, so the operative dates are national registration and evidence deadlines rather than EU ones.
Does NIS2 apply in a member state that has not transposed it yet?
Not directly to private entities: a directive binds companies only through national law. Regulators, customers and insurers in Ireland, Spain and France nevertheless reference NIS2 in contracts and guidance, and the Commission has asked the Court of Justice for daily penalties until transposition is notified. Preparing to the Directive’s Article 21 baseline is the common approach.
Why did the AI Act dates move?
Regulation (EU) 2026/1744 (the Digital Omnibus on AI) postponed the high-risk obligations to fixed dates: 2 December 2027 for stand-alone Annex III systems and 2 August 2028 for AI embedded in Annex I products. The Article 50 transparency duties stayed on 2 August 2026.
How are these dates verified?
Each EU-level date is read from the legal text itself (the application and transposition articles of the regulation or directive) and cross-checked against the Commission’s policy pages. Member-state status is taken from the national law or the Commission’s infringement notices, and cross-checked against two independent transposition trackers. Anything we could not confirm in a primary source is left out.
How often is this page updated?
Monthly, and within days of a major event such as a new transposition law or a Commission enforcement step. The verification date in the header is the date of the last full check.
Turn the next deadline into finished documentation
The CRA Reporting Readiness Pack gives manufacturers the Article 14 procedure, templates and 24-hour checklist. The Complete Toolkit covers all ten NIS2 Article 21 measures with 76 audit-ready files.
Related guides
Sources
Primary sources used for this tracker. All links checked on 9 October 2026.
- European Commission – NIS2 Directive policy page
- European Commission – NIS2 transposition hub
- European Commission – letters of formal notice to 23 member states (28 Nov 2024)
- European Commission – referral of Ireland, Spain, France and the Netherlands to the Court of Justice (8 Jul 2026)
- European Commission – Cyber Resilience Act
- European Commission – AI Act
- European Commission – European Digital Identity (EUDI) Regulation
- European Commission – Critical infrastructure resilience (CER)
- EIOPA – Digital Operational Resilience Act (DORA)
- BSI – NIS-2-regulierte Unternehmen
- gesetze-im-internet.de – § 33 BSIG (Registrierungspflicht)
- gesetze-im-internet.de – § 39 BSIG (Nachweispflichten)
- Deutscher Bundestag – KRITIS-Dachgesetz beschlossen
- Rijksoverheid – Cyberbeveiligingswet van kracht per 15 augustus 2026
- Parlament Österreich – NISG 2026