AI Act and digital rules calendar: deadlines 2026 to 2028

Between autumn 2026 and summer 2028, a business that uses AI, buys cloud services or publishes software faces around ten European deadlines, plus a few US state laws if it sells across the Atlantic. Each text has its own timetable, and several were revised in 2026. This page brings them together in one place, date by date.

It is a page kept up to date in our Business AI section: version of 19 October 2026, with each date checked that day against its official source. It is not legal advice: to know whether a text applies to you, your DPO, your accountant or a lawyer has the final say.

The deadlines, from 2026 to 2028

1. 1 September 2026

   Every business in France must be able to receive e-invoices; large companies and mid-caps issue them.

2. 11 September 2026

   Cyber Resilience Act, duty to report actively exploited vulnerabilities and severe incidents.

3. 12 September 2026

   Data Act, connected products placed on the market from this date must make their data accessible by design.

4. 2 December 2026

   AI Act, end of the marking deadline for generative tools already on the market, and two new prohibitions.

5. 9 December 2026

   Transposition deadline for the new Product Liability Directive, which covers software.

6. 1 January 2027

   In Colorado, the automated decision-making law and the chatbot safety law take effect.

7. 12 January 2027

   Data Act, end of cloud switching charges.

8. 20 January 2027

   The EU Machinery Regulation applies, including to machinery whose safety functions rely on AI.

9. 1 July 2027

   In California, no more discipline or dismissal based solely on an automated system.

10. 2 August 2027

    AI Act, compliance for general-purpose models released before 2 August 2025; at least one regulatory sandbox per Member State.

11. 1 September 2027

    At the latest, French SMEs and micro-businesses issue e-invoices.

12. 2 December 2027

    AI Act, high-risk rules for Annex III uses.

13. 11 December 2027

    Cyber Resilience Act, essential cybersecurity requirements.

14. 2 August 2028

    AI Act, high-risk rules for AI built into Annex I products.

AI Act: four dates after the July revision

The EU regulation on AI was revised by Regulation (EU) 2026/1744, in force since 27 July 2026. The official timetable of the Commission’s service desk reflects it: prohibited practices and AI literacy have applied since February 2025, the general-purpose model rules since August 2025, and most of the text, including the Article 50 transparency rules, since 2 August 2026. Four deadlines remain:

• 2 December 2026: tools that generate images, video, audio or text and were on the market before 2 August 2026 must mark their content; two prohibitions are added, on intimate images generated without consent and on child sexual abuse material. The details are in our guide to marking generated content.
• 2 August 2027: general-purpose models released before 2 August 2025 must comply, and each Member State must have opened at least one regulatory sandbox.
• 2 December 2027: the high-risk rules apply to recruitment, staff management, credit scoring and the other Annex III uses.
• 2 August 2028: they apply to AI built into already regulated products (medical devices, toys, lifts).

What the revision moved, article by article, is explained in what the Digital Omnibus changed in the AI Act, and what these rules ask of a business that uses AI in our guide to the AI Act and the GDPR for SMEs.

Cybersecurity: the CRA has started, NIS2 is waiting

The Cyber Resilience Act covers manufacturers of “products with digital elements”: software, apps, connected devices. Since 11 September 2026, they must report actively exploited vulnerabilities and severe incidents on the single platform that the EU cybersecurity agency launched the same day.

www.enisa.europa.eu/index.php/news/the-cra-single-reporting-platform-is-launched

The deadlines are short, according to the Commission’s page on CRA reporting: an early warning within 24 hours of becoming aware, a full notification within 72 hours, then a final report no later than 14 days after a corrective measure is available for an exploited vulnerability, or within a month for a severe incident. The essential cybersecurity requirements apply from 11 December 2027, ENISA notes.

NIS2, the directive that extends cybersecurity obligations to thousands of entities in 18 sectors, has still not been transposed in France: the National Assembly removed the Resilience bill from its agenda on 6 October 2026. Where the text stands, and what you can do without waiting for it, is in our update on NIS2 in France.

Products: software and machinery

Two product texts change things for anyone who manufactures or publishes:

• 9 December 2026: Directive (EU) 2024/2853 on liability for defective products must be transposed, and covers products placed on the market after that date; its definition of a product expressly includes software, according to Gibson Dunn.
• 20 January 2027: Regulation (EU) 2023/1230 on machinery applies on a mandatory basis, with provisions for machinery whose safety functions rely on AI, according to the European Commission.

Data and cloud: the Data Act in three steps

The Data Act has applied since 12 September 2025. Two steps follow, according to McCann FitzGerald’s analysis:

• 12 September 2026: a connected product placed on the market from this date must be designed so that its user can access its data; the obligation is not retroactive.
• 12 January 2027: cloud switching charges disappear. Since 11 January 2024, they could already not exceed the costs directly linked to the switch, under Article 29 of the regulation.

For a business considering leaving a host, this date removes a cost argument, not the migration work. The method is in cloud migration without breaking everything, and the dependency question in can Europe do without the American cloud giants.

French e-invoicing: September 2026, then September 2027

Since 1 September 2026, every VAT-registered business in France must be able to receive electronic invoices, but only large companies, mid-caps and public bodies issue them. According to the French tax administration’s FAQ, the issuing obligation “will be extended to medium, small and very small businesses” by 1 September 2027 at the latest, together with the transmission of invoicing and payment data to the administration.

Outside Europe: two US states to watch

A European business with customers or employees in the United States may fall under the law of the state concerned, since there is no federal AI law. Two dates are close:

• Colorado, 1 January 2027: SB 26-189 requires users of automated decision-making technology to inform consumers and, after an adverse decision, to explain the tool’s role; HB 26-1263 regulates conversational chatbots. Both take effect the same day, according to the Colorado Attorney General’s page, whose office is finalising the implementing rules.
• California, 1 July 2027: SB 947 prohibits disciplining or dismissing an employee based solely on an automated system. Its content is detailed in the human role in the face of AI judgment.

What changes precisely around New Year, from Colorado to the Machinery Regulation, has its own article: what changes on 1 January 2027 for digital.

What concerns you, depending on what you do

Not every date applies to every business. Five situations, in the order they come up most often:

1. You use generative AI tools: 2 December 2026 (check that your tools mark their content, disclose your deepfakes), then 2 December 2027 if a use touches recruitment, staff or credit.
2. You buy cloud services: 12 January 2027, end of switching charges.
3. You publish software, an app or a connected device: CRA reporting since 11 September 2026, security requirements on 11 December 2027, new product liability for what you place on the market after 9 December 2026.
4. You are in one of the 18 NIS2 sectors, from 50 people: no date in France, but a reference framework from the French cybersecurity agency ANSSI is already published.
5. You are a French SME: issuing e-invoices by 1 September 2027 at the latest.

For AI uses, the overall approach, from the tool inventory to the usage policy, is in our guide to integrating AI in your business.

To find out which of your AI uses come close to high risk and which can stay with a provider, our AI at the right cost offer starts from your actual tools. The rest of the month’s news, from Meta’s terms on crawling websites to new models, is in our October AI news for business leaders.

Frequently asked questions

Sources

1. The Commission’s service desk (new tab)ai-act-service-desk.ec.europa.eu
2. The Commission’s page on CRA reporting (new tab)digital-strategy.ec.europa.eu
3. ENISA notes (new tab)enisa.europa.eu
4. Gibson Dunn (new tab)gibsondunn.com
5. The European Commission (new tab)single-market-economy.ec.europa.eu
6. McCann FitzGerald’s analysis (new tab)mccannfitzgerald.com
7. The French tax administration’s FAQ (new tab)impots.gouv.fr
8. The Colorado Attorney General’s page (new tab)coag.gov