The calendar

The table below collects the dates verified in our recent coverage, with a status for each. Where a date comes from secondary sources and could shift, it is marked as reported.

Items already live are included because they apply to products on the market today.

DateItemStatusOur article
Live since Jun 2025European Accessibility ActApplies; enforcement is national and unevenAccessibility, year one
2 Aug 2026AI Act transparency duties and AI Office powers over GPAILiveGPAI enforcement for builders
Sep 2026Cyber Resilience Act reporting dutiesLive, reportedCRA vulnerability handling
9 Dec 2026Product Liability Directive transposition deadlinePending national lawsSoftware as a product
End of 2026Member states offer EU Digital Identity WalletsReported 24 Dec 2026EUDI wallet
12 Jan 2027Data Act: no cloud switching chargesScheduledCloud switching
H2 2026 to 2027PSD3 and PSR formal adoptionAgreed texts, adoption pendingImpersonation fraud rule
2 Aug 2027Older GPAI models must complyReportedGPAI enforcement for builders
2 Dec 2027AI Act Annex III high-risk obligationsDelayed by omnibus, in forceHigh-risk deadlines moved
11 Dec 2027Cyber Resilience Act full applicationScheduledCRA vulnerability handling
2 Aug 2028AI Act Annex I high-risk obligationsDelayed by omnibus, in forceHigh-risk deadlines moved

Still being negotiated

Some items are proposals and could change materially. The GDPR and ePrivacy half of the Digital Omnibus is contested and unresolved. The Cloud and AI Development Act, proposed in June 2026, would add sovereignty assurance levels for cloud and AI and is early in the legislative process. Revisions to the Cybersecurity Act and targeted NIS2 amendments proposed in January 2026 are also still moving.

NIS2 itself is transposed unevenly across member states, but customers in scope are already asking suppliers for evidence.

Watch items, do not build for them. Assign an owner and a check date, and keep architecture flexible.

Where the crunch points are

December 2026 is crowded: product liability transposition and identity wallets arrive within weeks, with the Data Act switching rules just after the new year. Then December 2027 brings two big milestones together, high-risk AI obligations and full Cyber Resilience Act application. Teams that share work across them, such as logging, documentation, component inventories, and vulnerability handling, will do much less than teams that treat each as a project.

Pick the shared foundations first: a system inventory, a component inventory, an incident and vulnerability process, and a documentation habit.

Want this calendar translated into a delivery plan for your products? Talk to us.

Key takeaways

  • Live now: the EAA, AI Act transparency duties and GPAI enforcement, and CRA reporting.
  • December 2026 to January 2027 brings product liability, identity wallets, and Data Act switching.
  • December 2027 combines AI Act high-risk obligations and full CRA application; August 2028 follows for embedded AI.
  • Build shared foundations first: system inventory, component inventory, vulnerability process, and documentation.
This is general information, not legal advice. Dates come from EU texts and law-firm summaries as of October 2026, and some are reported rather than confirmed; verify against official sources.