Legal compliance deadlines calendar

What the calendar contains

The next legal deadline with the countdown, then all the deadlines that follow, in order, with a sentence on what comes into force and for whom. At the end, the obligations that came into force in the past year, which many organisations only discover during an inspection.

What it is based on

• AI Act, Regulation (EU) 2024/1689, with the postponements in Regulation (EU) 2026/1744 (the "digital omnibus", in force since 27 July 2026): transparency from 2 August 2026, marking of generated content and the new prohibition from 2 December 2026, the high-risk systems in Annex III from 2 December 2027, those embedded in regulated products (Annex I) from 2 August 2028.
• Cyber Resilience Act, Regulation (EU) 2024/2847: reporting of exploited vulnerabilities and severe incidents from 11 September 2026, the remaining obligations from 11 December 2027.
• PPWR, Regulation (EU) 2025/40: applicable from 12 August 2026, harmonised labelling from 12 August 2028, recyclability requirements from 1 January 2030.
• NIS2, Government Emergency Ordinance (GEO) no. 155/2024 and Law no. 124/2025: the deadline for registering with DNSC (Order no. 1/2025) expired in September 2025; entities that have not registered must do so now.

The deadlines were checked on 19 October 2026. When they change, we update the calendar and the date of the check.

How to use it

Put the calendar on your compliance team's agenda: each deadline is a project with at least three months of preparation ahead of it. If you do not know which of them concern you, start with the compliance obligations map; for incidents, use the 72-hour clock.

Frequently asked questions

Where do the deadlines come from?

From the legislation published in the Official Journal of the EU and in Romania's Official Gazette: Regulation (EU) 2024/1689 (the AI Act) with the postponements in Regulation (EU) 2026/1744, Regulation (EU) 2024/2847 (the Cyber Resilience Act), Regulation (EU) 2025/40 (PPWR), Government Emergency Ordinance (GEO) no. 155/2024 and the DNSC orders for NIS2. We check the calendar at every change and note the date of the check.

What does "already in force" mean?

Deadlines from the past year that have passed: obligations that already apply and that organisations usually discover late, such as vulnerability reporting under the Cyber Resilience Act or transparency under the AI Act.

How do I find out which deadlines concern me?

The compliance obligations map, also here under Tools, tells you in five minutes which frameworks apply to you; the calendar then shows when each obligation comes into force.