Eighteen dates bind a regulated European organisation between January 2027 and July 2028.
DORA and the Digital Services Act contribute nothing. Three deadlines in wide circulation are not in the instruments credited with them, and the accessibility one is three years out.
A calendar is the one format where a single wrong date ruins the whole page, so here is the rule this one follows: every date below was read off the article that sets it, in the instrument's own text, at the Publications Office. Three of the dates this desk had in circulation did not survive that, and they are at the foot with the reason.
What this page is for, and the four things it leaves out
It is one page you can put in front of a board. Each line says what changes, who it binds, and which provision to check it against, for the period from 1 January 2027 to 30 June 2028, with the run-up from this month included because three things land before the window opens and change what the window means.
Eighteen dates in that period carry an obligation on an organisation. The counting rule, so you can check it: one entry per calendar date, however many duties arrive on it — 31 December 2027 carries two and is counted once — and nothing counted where the deadline belongs to the Commission or to a Member State.
Four exclusions, stated here rather than discovered on line nine.
National transpositions, except one. Every directive on this page will reach you as a national act with its own date, and this desk has surveyed none of them. The single exception is Belgium's April 2027 checkpoint, which is here because this publication has read the supervisory letter behind it and because readers keep asking.
Sectoral rules. Nothing here is specific to medical devices, motor insurance, aviation, pharmaceuticals or energy networks, and several of those have their own 2027 dates.
Anything that depends on a Member State option. Where an instrument says a Member State may defer, exempt or shorten, the date is not yours until your Member State has decided, and this page does not print it. One of the corrections at the foot is exactly that case.
Commission and Member State duties, except where named as such. A great many 2027 dates are deadlines for the Commission to write a report or adopt a delegated act. They matter — a guideline you have not seen is a guideline you cannot plan against — but they are not obligations on you, and a calendar that mixes the two is how a planning meeting loses an afternoon.
The run-up, which is already running
Three things close before January.
20 November 2026. Consumer credit directive 2, Directive (EU) 2023/2225, applies in national law. Article 47 repeals Directive 2008/48/EC with effect from the same day, keeps the old Directive alive for credit agreements already in existence, and then reaches back into those agreements anyway: six provisions of the new Directive apply to every open-end agreement existing on 20 November. Marine Lefebvre has the substance on Monday.
2 December 2026. Two new prohibitions in the AI Act and the marking duty for generative systems already on the market. Marine covered both on 2 November; the provisions are the third paragraph of Article 113 as replaced by Article 1(40)(a) of Regulation (EU) 2026/1744, and the new Article 111(4).
9 December 2026. The revised product liability directive, Directive (EU) 2024/2853, applies to products placed on the market after that date, and Directive 85/374/EEC is repealed with effect from it. Software is a product from that day. Tomasz Wierzbicki read it on 22 September. Note the shape, because it recurs four times below: the old rule survives for things already sold, and the new one takes everything after.
2027, in the order it arrives
Instant credit transfersReg 260/2012, Art 5a(8)
Data ActArt 29(1), switching charges
Machinery RegulationArt 54, second paragraph
Batteries RegulationArt 96(2)(a), Art 13(6), Art 77(1)
Health Data SpaceArt 105, mostly held back
AI Act, legacy modelsArt 111(3)
AI Act, Annex IIIArt 113(c)(i) as replaced
Cyber Resilience ActArt 71(2)
Forced Labour RegulationArt 39, second paragraph
Crypto-asset white papersArt 143(2)(b), a deadline
9 January 2027 — instant euro transfers, outside the euro area. Article 5a(8), second subparagraph, of Regulation (EU) No 260/2012 as inserted by Regulation (EU) 2024/886: a payment service provider in a Member State whose currency is not the euro must offer the service of receiving instant credit transfers in euro. Article 5b(3) puts charge equality on the same day. Sending waits until July, which is the trap: you are reachable six months before you are capable. Tomasz asked in September who carries the fraud loss, and the text still does not say.
12 January 2027 — cloud switching charges. Data Act Article 29(1): "providers of data processing services shall not impose any switching charges on the customer for the switching process." Elin Sandberg read five providers' published terms against it on 22 September and found two still publishing a charge as a credit you apply for. If you are the customer, this is the date your contract's switching line becomes unenforceable; it is not the date your data moves.
14 January 2027 — the Machinery Regulation. Article 54, second paragraph, of Regulation (EU) 2023/1230. Directive 2006/42/EC stops being the route to market. Article 52(1) keeps conforming products already placed on the market available, so this bites on what you buy next and not on the press on the floor.The commissioning note for this piece gave 20 January. The article says 14 January. The gap matters by exactly one working week, which is the kind of error a calendar exists to catch.
18 February 2027 — three battery duties on one day. Article 96(2)(a) of Regulation (EU) 2023/1542 switches on Article 11, removability and replaceability of portable batteries. Article 13(6) puts a QR code on every battery. Article 77(1) requires a battery passport for light-means-of-transport batteries, industrial batteries over 2 kWh and electric vehicle batteries. Joris Feenstra covered the first on 27 August and the third on 21 October, including what the passport does not show you. If your organisation buys equipment rather than making it, this is a procurement specification, not a compliance task.
26 March 2027 — the European Health Data Space applies, and almost nothing in it does. Article 105, second paragraph, of Regulation (EU) 2025/327 says the Regulation applies from that date. The next three paragraphs take most of it away again: Articles 3 to 15 reach the first categories of health data on 26 March 2029 and the rest on 26 March 2031, Chapter III reaches systems already in service in 2031, and Chapter IV arrives in 2029 with six named provisions pulled forward to 2027. What lands in March 2027 is the architecture. What a hospital or an insurer has to do lands two years later. Put the date on the slide and the 2029 note beside it, or somebody will budget twice.
9 April 2027 — instant transfers, electronic money and payment institutions. The fourth and fifth subparagraphs of Article 5a(8). Inside the euro area these firms must send and receive by this date; outside it, receive by this date and send by 9 July.
18 April 2027 — Belgium, essential entities. The Centre for Cybersecurity Belgium's conformity assessment deadline, reported by Marine on 9 October against the CCB's own published communication, which also introduces a remediation plan running to April 2028 and says in terms that it alters no deadline in the Law or the Royal Decree. This desk has not opened either, so treat the line as a supervisor's published date rather than a provision read here.
9 July 2027 — sending, and the name check. Article 5a(8), second subparagraph: providers outside the euro area must offer sending. Article 5c(9), second subparagraph: the same providers must comply with verification of the payee. Six months of being reachable without being able to send ends here.
2 August 2027 — general-purpose AI models already on the market. Article 111(3) of the AI Act: providers of general-purpose models placed on the market before 2 August 2025 "shall take the necessary steps in order to comply with the obligations laid down in this Regulation" by this date. The Omnibus rewrote Article 111(2) and added Article 111(4), and left (3) alone. If you deploy rather than provide, this is a date to put in your vendor's calendar, not your own.
12 September 2027 — the Data Act reaches old contracts. The sixth paragraph of Article 50 applies Chapter IV from this date to contracts concluded on or before 12 September 2025, and only where they are of indefinite duration or due to expire at least ten years from 11 January 2024. Chapter IV is one article, Article 13, the unfair-terms test for data access and use between enterprises. So: the test that has applied to new contracts for two years reaches the evergreen ones here, and only those.
2 December 2027 — high-risk AI, Annex III. The third paragraph of Article 113, point (c)(i), as replaced by Article 1(40)(b) of Regulation (EU) 2026/1744: Chapter III, Sections 1, 2 and 3, "with the exception of Article 6(5)", applies to systems classified as high-risk under Article 6(2) and Annex III. Recruitment scoring, creditworthiness, biometric categorisation, education, essential services. For most organisations reading this, this is the single biggest line on the page, and it is thirteen months out.
11 December 2027 — the Cyber Resilience Act in full. Article 71(2) of Regulation (EU) 2024/2847. Two provisions are already live, which this desk covered on 26 October: Article 14's reporting duty since 11 September 2026 and Chapter IV since 11 June 2026. On 11 December the rest arrives, and Article 69(2) grandfathers products placed on the market before then unless they undergo a substantial modification. Read Article 69(3) before you relax about that, because it applies Article 14 to those products anyway. Your supplier's five-year-old firmware is outside the requirements and inside the reporting duty.
14 December 2027 — the Forced Labour Regulation. Article 39, second paragraph, of Regulation (EU) 2024/3015. Nine articles have applied since December 2024 and all nine are about the Commission and the Member States. This is the date the prohibition reaches an undertaking, three days after the Cyber Resilience Act, in the same fortnight as the AI Act's high-risk chapter. December 2027 is the month to protect in a planning calendar.
24 December 2027 — the identity wallet, and this one is derived. Article 5f(2) of Regulation (EU) No 910/2014, as amended, requires private relying parties that use strong user authentication — excluding micro and small enterprises, and only on the user's voluntary request — to accept wallet credentials "no later than 36 months from the date of entry into force of the implementing acts referred to in Article 5a(23) and Article 5c(6)". There is no date in the article. Those implementing acts were published on 4 December 2024 and enter into force on the twentieth day following, which is 24 December 2024, so the arithmetic gives 24 December 2027. Joris reached 24 December 2026 for the 24-month wallet duty off the same anchor. Print the derivation next to the date, because a date computed rather than quoted is a date somebody should be able to check.
31 December 2027 — crypto-asset white papers. Article 143(2)(b) of Regulation (EU) 2023/1114: an operator of a trading platform must ensure by this date that a white paper has been drawn up, notified and published for crypto-assets admitted to trading before 30 December 2024. Unlike nearly everything else here, this is a deadline rather than a switch — the work has to be finished, not merely begun.
31 December 2027 — portable battery collection. Article 59(3)(b) of the Batteries Regulation: producers, or their producer responsibility organisations, must attain and durably maintain a 63 per cent collection rate for waste portable batteries. The target after that is 73 per cent in 2030.
Financial years starting on or after 1 January 2027 — sustainability reporting, in a scope that has halved twice. This is the one on the page most likely to be wrong in your files. Directive (EU) 2025/794 moved the second wave to financial years starting on or after 1 January 2027. Directive (EU) 2026/470 then rewrote who is in it — Article 5(2), first subparagraph, point (b), now reaches only undertakings over EUR 450 000 000 net turnover and 1 000 employees — deleted point (c) altogether, so the listed-SME wave does not exist, and closed the first wave at financial years beginning up to 31 December 2026. If your reporting plan was built in 2024, the scope test in it is two amendments out of date.
The three instruments a board paper leads on, and what they ask
DORARegulation (EU) 2022/2554
Nothing new. Everything applied on 17 January 2025. Article 58(1) puts a Commission review on 17 January 2028.
NIS2Directive (EU) 2022/2555
Nothing new in the Directive. Article 40 puts a Commission review on 17 October 2027. National measures are a separate question this page does not survey.
Critical entitiesDirective (EU) 2022/2557
A risk assessment nine months after your Member State writes to you, and Chapter III ten months after it. Article 12(1) and Article 6(3).
Digital Services ActRegulation (EU) 2022/2065
Nothing new. Article 91 puts two Commission evaluations in 2027 and an assessment of the Board on 18 February 2027.
Between January 2027 and July 2028 these four instruments produce one dated obligation on an entity, and its date is written in a letter from a national authority rather than in the Directive.
This is worth saying flatly because it cuts both ways. A planning document that leads on DORA and NIS2 for 2027 is leading on the two files with nothing in them, and a planning document that treats the critical entities Directive as unclocked has missed the only clock in the group. The Critical Entities Resilience Directive required Member States to identify critical entities by 17 July 2026 and to notify them within a month. From that letter, Article 12(1) gives nine months for a risk assessment and the second subparagraph of Article 6(3) applies Chapter III after ten. The date is real and personal to you, and nobody can print it. Find out whether your organisation received the letter, and when; if it did, your 2027 deadline is on that envelope.
The first half of 2028, which is thin
9 June 2028. The third subparagraph of Article 5a(8) ends the derogation for providers outside the euro area that neither send nor receive non-instant euro transfers from national-currency accounts. Until this date they need not offer sending from those accounts.
11 June 2028. Article 69(1) of the Cyber Resilience Act: EU type-examination certificates and approval decisions issued under other Union harmonisation legislation in respect of cybersecurity requirements remain valid until this date unless they expire or are withdrawn earlier. If a conformity route you rely on was certified elsewhere, this is when it stops counting.
And then, seven weeks past the edge of this page, 2 August 2028: Article 113, third paragraph, point (c)(ii), as replaced, applies Chapter III Sections 1 to 3 to AI systems classified as high-risk under Article 6(1) and Annex I — safety components of regulated products. It is outside the window and it belongs on the same slide, because the design work for it happens inside the window.
Three dates that are not where they are said to be
The accessibility one is three years out. The date in circulation is 28 June 2027, for service contracts concluded before 28 June 2025. The second subparagraph of Article 32(1) of Directive (EU) 2019/882 gives those contracts until they expire and no longer than five years from 28 June 2025, which is 28 June 2030. There is a 28 June 2027 in the Directive, and it is a different thing: Article 31(3) lets Member States decide to defer the measures implementing Article 4(8) — the accessibility of 112 call answering by public-safety answering points — until then. A Member State option, on a public authority, and so off this page twice over.
The due diligence transposition date no longer exists. 26 July 2027 was the transposition deadline for the corporate sustainability due diligence directive after the April 2025 postponement. Article 4 of Directive (EU) 2026/470 moved it again, to 26 July 2028, with application from 26 July 2029. Nothing in Directive (EU) 2024/1760 lands in this window. What survives at 26 July 2027 is a Commission duty to publish guidelines and model contractual clauses, which you will want and cannot be penalised for lacking.
The standardisation request could not be sourced. The expiry of 28 February 2027 for M/613 to CEN and CENELEC is not established here. A standardisation request is a Commission implementing decision and is not published in the Official Journal; no work bearing that reference could be found at the Publications Office. It may well be right. It is not on the calendar, because this desk has not opened the document that would set it.
And a Digital Networks Act does not exist yet. A search of adopted Union legislation returns nothing by that name. There is preparatory material, which this desk has not opened and does not summarise. No date.
How to check any line on this page, in about four minutes
The point of a reference page is that you can falsify it without asking its author.
EUR-Lex's web front end sits behind a challenge that returns half a document and makes it look like a whole one, which is how dates go wrong. The Publications Office serves the same instruments without it. Ask its SPARQL endpoint at publications.europa.eu/webapi/rdf/sparql for the cellar work identifier belonging to a CELEX number, then fetch the English XHTML at publications.europa.eu/resource/cellar/<id>.0006.03/DOC_1. The .0006 is the English language index and .03 is the XHTML manifestation; .01 gives you a PDF, which is also the text but is harder to search. Go to the last article — "Entry into force and application", almost always — and read it before you read anything else. Transitional provisions are the other place dates hide, and they are never in the article that creates the duty.
If a date you find there disagrees with a date here, the instrument is right and this page is wrong, and we would like to know.
What would move all of this
One proposal. A Digital Omnibus on data — the companion to the artificial intelligence one that became Regulation (EU) 2026/1744 in July — was tabled in November 2025 and touches, among other things, the Data Act provisions on this page. A search of adopted legislation under that name returns only the AI instrument, so as of this morning the data proposal has not been adopted and the Data Act dates above stand as published. The next time these dates need re-reading is the day it is.
Written from
Primary The document itself. Claims in this piece rest only on these.
- Regulation (EU) 2024/1689 (AI Act), CELEX 32024R1689Opened as the English XHTML from the Publications Office. Read for this piece: Article 111 in full, and Article 113 in full. Source for Article 111(3), quoted in substance here — providers of general-purpose AI models placed on the market before 2 August 2025 must take the necessary steps to comply by 2 August 2027 — and for Article 113's third paragraph as originally published, including point (c), which put Article 6(1) at 2 August 2027 before the Omnibus replaced it. Article 111(1) was read and is not on the calendar: 2 August 2027 appears there as a cut-off for large-scale IT systems whose compliance date is 31 December 2030.
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), CELEX 32026R1744The EUR-Lex front end was not used. The CELEX number was resolved to a cellar work URI through the Publications Office SPARQL endpoint and the English XHTML manifestation fetched directly, which returns the whole instrument rather than the half page the web front end's WAF challenge serves. Source and quoted verbatim for Article 1(39)(b), adding Article 111(4) to the AI Act. Also read: Article 1(20), replacing Article 50(7); Article 1(38), amending Article 99, including the new paragraph 6a; recital 38 on the four-month transitional period; and recital 41, quoted here for codes of practice having limited legal effect and in particular not granting a presumption of conformity. Article 1(39)(a) was read to confirm that the only other change to Article 111 concerns high-risk systems and does not bear on this duty.
- Regulation (EU) 2024/2847 (Cyber Resilience Act), CELEX 32024R2847Opened as the English XHTML from the Publications Office. Read: Articles 69, 70 and 71 in full. Source for Article 71(2) and its sentence 'This Regulation shall apply from 11 December 2027', for the two earlier dates in the same paragraph, for Article 69(1) on certificates remaining valid until 11 June 2028, and for Article 69(2) and (3) — the grandfathering of products already on the market and the derogation that applies Article 14 to them anyway. Article 68, on notified bodies by 11 December 2026, was read and is a Member State duty, so it is not on the calendar.
- Regulation (EU) 2023/2854 (Data Act), CELEX 32023R2854Opened as the English XHTML from the Publications Office. Read: Article 29 in full, Article 50 in full, and the heading of Chapter IV with Article 13 under it. Source for Article 29(1), quoted here, and for the sixth paragraph of Article 50, including both limbs of its condition — indefinite duration, or due to expire at least ten years from 11 January 2024. The published text of Article 29(2) runs its reduced-charge window from 11 January 2024, which is earlier than the Regulation's own date of application; that reading is Elin Sandberg's from 22 September and is not re-argued here.
- Regulation (EU) 2023/1230 (Machinery Regulation), CELEX 32023R1230Opened as the English XHTML from the Publications Office. Read: Articles 52, 53 and 54. Source for the second paragraph of Article 54, 'It shall apply from 14 January 2027', and for Article 52(1), which lets products placed on the market in conformity with Directive 2006/42/EC before that date continue to be made available. The commissioning note gave this date as 20 January 2027; the article says 14 January, and the article was followed.
- Regulation (EU) 2023/1542 (Batteries Regulation), CELEX 32023R1542Opened as the English XHTML from the Publications Office. Read: Article 11 and its title, Article 13(6), Article 59(3), Article 77(1) and Article 96 in full. Source for Article 96(2)(a), which applies Article 11 from 18 February 2027; for the QR code duty in Article 13(6) from the same date; for the battery passport in Article 77(1) from the same date; and for the 63 per cent portable-battery collection target at Article 59(3)(b), due 31 December 2027. The content of the removability rule and of the passport is Joris Feenstra's, from 27 August and 21 October, and is not re-reported.
- Regulation (EU) 2025/327 (European Health Data Space), CELEX 32025R0327Opened as the English XHTML from the Publications Office. Read: Article 105 in full. Source for the second paragraph, 'This Regulation shall apply from 26 March 2027', and for the third, fourth and fifth paragraphs, which hold Articles 3 to 15 and the rest of Chapter II back to 26 March 2029 and 26 March 2031 by data category, apply Chapter IV from 26 March 2029, and name the six Chapter IV provisions — Article 55(6), Article 70, Article 73(5), Article 75(1) and (12), Article 77(4) and Article 78(6) — that do apply from 26 March 2027. Nothing else in the Regulation was read, and no claim is made here about what the substantive chapters require.
- Regulation (EU) 2024/3015 (Forced Labour Regulation), CELEX 32024R3015Opened as the English XHTML from the Publications Office. Read: Article 39 in full. Source for 'It shall apply from 14 December 2027' and for the list of articles that have applied since 13 December 2024 — Articles 5(3), 7, 8, 9(2), 11, 33, 35 and 37(3), all of which concern the Commission and the Member States rather than an undertaking. No other article was read, and the body makes no claim about what the prohibition requires of a buyer.
- Regulation (EU) 2023/1114 (markets in crypto-assets), CELEX 32023R1114Opened as the English XHTML from the Publications Office. Read: Article 140(1) and Article 143 in full. Source for Article 143(2)(b), quoted in substance — operators of trading platforms must ensure by 31 December 2027 that a white paper is drawn up, notified and published for crypto-assets admitted to trading before 30 December 2024 — and for Article 143(3), whose transitional regime for crypto-asset service providers closed on 1 July 2026. The 30 June 2027 date in Article 140(1) is a Commission report and is named as one.
- Regulation (EU) No 260/2012 as amended by Regulation (EU) 2024/886, CELEX 32024R0886Opened as the English XHTML from the Publications Office, in the amending text rather than a consolidated version. Read: the inserted Articles 5a to 5d and the amendments to Articles 15 and 16. Source for Article 5a(8) in all five of its subparagraphs — receiving by 9 January 2027 and sending by 9 July 2027 for payment service providers outside the euro area, both by 9 April 2027 for electronic money institutions and payment institutions inside it, receiving by 9 April 2027 and sending by 9 July 2027 for those outside it, and the derogation for national-currency accounts running to 9 June 2028. Also source for Article 5b(3) on charge equality and Article 5c(9) on verification of the payee, each giving 9 January 2027 and 9 July 2027 respectively for providers outside the euro area. The fraud-liability question these dates raise is Tomasz Wierzbicki's from 9 September and is not reopened.
- Regulation (EU) No 910/2014 as amended by Regulation (EU) 2024/1183, CELEX 32024R1183Opened as the English XHTML from the Publications Office. Read: Article 5f in full. Source for Article 5f(2), including the exclusion of microenterprises and small enterprises, the words 'only upon the voluntary request of the user', and the period of '36 months from the date of entry into force of the implementing acts referred to in Article 5a(23) and Article 5c(6)'. The article carries no calendar date. The date on the page is arithmetic off that period and the implementing acts below, and is marked as derived in the body.
- Commission Implementing Regulations (EU) 2024/2979 and (EU) 2024/2981, CELEX 32024R2979 and 32024R2981Both opened as English XHTML from the Publications Office, for their headers and their entry-into-force articles only. 2024/2979 is made under Article 5a(23) and 2024/2981 under Article 5c(6); both were adopted on 28 November 2024, both were published on 4 December 2024, and both enter into force on the twentieth day following publication, which this desk counts as 24 December 2024. That anchor plus the 36-month period in Article 5f(2) gives 24 December 2027. Joris Feenstra read the same acts on 23 September and reached 24 December 2026 for the 24-month duty; the 36-month arithmetic here rests on the same anchor and was recomputed independently.
- Directive (EU) 2022/2464 (CSRD) as amended by Directive (EU) 2025/794 and Directive (EU) 2026/470, CELEX 32025L0794 and 32026L0470Both amending instruments opened as English XHTML from the Publications Office. Read in 2025/794: Article 1, amending Article 5(2) of the CSRD, and Article 2, amending Article 37(1) of Directive (EU) 2024/1760. Read in 2026/470: Article 3(1), amending Article 5(2) of the CSRD; Article 4, amending Directive (EU) 2024/1760; and Article 5, on transposition. Source for the first-subparagraph point (b) threshold of EUR 450 000 000 net turnover and 1 000 employees; for the deletion of point (c), which removes the listed-SME wave entirely; for the first subparagraph point (a) being closed at financial years starting up to 31 December 2026; for the Member State option to exempt undertakings below the new threshold; and for the transposition date of 19 March 2027 for Articles 1 to 3. The date of 1 January 2027 in point (b) was set by 2025/794 and left untouched by 2026/470, which is read from the two amending texts side by side rather than from a consolidated version.
- Directive (EU) 2024/1760 (corporate sustainability due diligence), CELEX 32024L1760Opened as the English XHTML from the Publications Office, and read only at Article 37 as it stood on publication, in order to see what the two later directives moved. Source for the statement that transposition now falls on 26 July 2028 and application on 26 July 2029, both of which sit outside this page's window. The commissioning note did not raise this instrument; it is here because the transposition date in circulation, 26 July 2027, no longer exists.
- Directive (EU) 2023/2225 (consumer credit), CELEX 32023L2225Opened as the English XHTML from the Publications Office. Read: Articles 47, 48 and 49. Source for Article 47, which repeals Directive 2008/48/EC with effect from 20 November 2026, keeps it alive for credit agreements existing on that date until termination, and nonetheless applies Articles 23, 24, Article 25(1) second sentence, Article 25(2), 28 and 39 of the new Directive to all open-end agreements existing on that date; and for Article 48(1), by which national measures apply from the same day. Marine Lefebvre's piece of 16 November carries the substance.
- Directive (EU) 2024/2853 (liability for defective products), CELEX 32024L2853Opened as the English XHTML from the Publications Office. Read: Articles 2, 21 and 22. Source for Article 2(1), which applies the Directive to products placed on the market or put into service after 9 December 2026; for Article 21, repealing Directive 85/374/EEC with effect from the same date while keeping it for earlier products; and for Article 22(1), the transposition deadline. The Directive carries no date in 2027 or 2028. Tomasz Wierzbicki read it in full on 22 September.
- Directive (EU) 2019/882 (accessibility requirements for products and services), CELEX 32019L0882Opened as the English XHTML from the Publications Office. Read: Article 4(8), Article 31 and Article 32. Source for the correction in the body. The commissioning note gave 28 June 2027 for service contracts concluded before 28 June 2025; the second subparagraph of Article 32(1) gives those contracts until they expire and no longer than five years from 28 June 2025, which is 28 June 2030. The only 28 June 2027 in the Directive is Article 31(3), under which Member States 'may decide' to defer the measures on the Article 4(8) obligations — the answering of 112 calls by the most appropriate public-safety answering point — to that date. Also read: Article 32(1) first subparagraph and Article 32(2), neither of which produces a 2027 date.
- Regulation (EU) 2022/2554 (DORA), CELEX 32022R2554Opened as the English XHTML from the Publications Office and searched in full for every date falling in 2027 or the first half of 2028. There is one: Article 58(1), a Commission review by 17 January 2028. No provision of DORA imposes a dated obligation on a financial entity inside this page's window, which is the basis for the statement in the body. Articles 25 and 26, on testing cycles, were read and set periods rather than dates.
- Directive (EU) 2022/2555 (NIS2), CELEX 32022L2555Opened as the English XHTML from the Publications Office and searched in full for dates in 2027 and the first half of 2028. There is one: Article 40, a Commission review by 17 October 2027. The Directive itself puts nothing new on an entity in the window. National measures are a different question and this page does not survey them.
- Directive (EU) 2022/2557 (resilience of critical entities), CELEX 32022L2557Opened as the English XHTML from the Publications Office. Read: Article 6 in full, Article 12(1), Article 19(7) and Article 25. Source for the identification deadline of 17 July 2026 in Article 6(1); for the one-month notification in Article 6(3); for the second subparagraph of Article 6(3), applying Chapter III ten months after notification; and for Article 12(1), requiring a risk assessment within nine months of it. The 17 January 2027 and 17 July 2027 dates in Articles 19(7) and 25 are Commission reports. No Member State's identification or notification was checked, so this page gives no date for any entity.
- Regulation (EU) 2022/2065 (Digital Services Act), CELEX 32022R2065Opened as the English XHTML from the Publications Office and searched in full for dates in 2027 and the first half of 2028. There are three, all in Article 91: Commission evaluations due 18 February 2027 and 17 November 2027, and an assessment of the Board and of Article 43 due 18 February 2027. Nothing in the Regulation falls on a provider in the window.
- Regulation (EU) 2023/1115 (deforestation) as amended by Regulation (EU) 2025/2650, CELEX 32025R2650The amending regulation opened as English XHTML from the Publications Office; Article 1(25), replacing Article 38, read in full. Source for the application date of 30 December 2026 for operators and traders generally, and for the separate treatment in paragraph 3 of natural persons and micro and small undertakings established as such by 31 December 2024. Regulation (EU) 2024/3234 was also opened, and is the reason the date in the 2023 text no longer reads as published. Both dates sit before the window and the earlier one is named in the body only as a run-up item.
- A Digital Networks ActNot established, and on the evidence available there is nothing to establish. A search of the Publications Office for adopted Union legislation whose English title carries that name returns nothing; the only matches are preparatory documents. This desk has not opened any proposal and prints no date, no scope and no expected timetable.
- Standardisation request M/613 to CEN and CENELECNot established. The commissioning note gave an expiry of 28 February 2027. A standardisation request is a Commission implementing decision and is not published in the Official Journal, and no work carrying the reference M/613 could be found at the Publications Office. This desk has therefore opened no document that sets that date, and the date does not appear on the calendar.
- The Belgian NIS2 Law of 26 April 2024 and the Royal Decree of 9 June 2024Not opened. The 18 April 2027 conformity assessment date on this page rests on the Centre for Cybersecurity Belgium's own published communication, read in full by Marine Lefebvre on 9 October, and on her reading of it — including the CCB's statement that the communication does not alter the obligations or deadlines in the Law and the Royal Decree. Neither the Law nor the Decree was opened for this piece, so the date is presented as a supervisory authority's published deadline rather than as a provision this desk has read.
- Proposal for a Regulation amending Regulations (EU) 2016/679, (EU) 2018/1724, (EU) 2018/1725, (EU) 2023/2854 and other acts (Digital Omnibus), COM(2025) 837 finalNot opened for this piece. A search of the Publications Office for adopted Union legislation bearing the Digital Omnibus name returns only Regulation (EU) 2026/1744, which covers artificial intelligence. On that basis the body says the data proposal has not been adopted; it does not describe what the proposal would do, and anyone planning against the Data Act dates here should establish its state themselves. Elin Sandberg read its Data Act provisions on 22 September.