EU Compliance Calendar for Software 2026–2028: AI Act, CRA, NIS2, Data Act, E-Invoicing and More

Short answer (updated November 2026). The next deadlines for companies that build or run software in Germany and the EU: 2 December 2026 – AI-generated content from systems already on the market must be marked (AI Act); 9 December 2026 – software counts as a product under the new EU Product Liability Directive; 1 January 2027 – businesses with more than €800,000 turnover must issue e-invoices in Germany; 12 January 2027 – cloud switching charges end (Data Act); 2 December 2027 – high-risk AI under Annex III; 11 December 2027 – the Cyber Resilience Act applies in full; 1 January 2028 – e-invoices for all German businesses; 2 August 2028 – high-risk AI in regulated products. Reporting under the CRA (since 11 September 2026), NIS2 in Germany (since 6 December 2025), accessibility (since 28 June 2025) and DORA (since 17 January 2025) already apply.

We update this calendar every quarter. Each date links to the regulation or an official source, and to our detailed guide where there is one. It is an overview, not legal advice.

Deadlines from November 2026

What already applies

Which rules apply to your software?

Most companies are affected by three to five of these laws at once. The quickest way to find yours is to start from what you sell, not from the regulation.

The regulations in brief

AI Act

Prohibitions (since February 2025) and general-purpose AI rules (since August 2025) already apply, and since 2 August 2026 so do the transparency duties: disclose that users talk to an AI, label deepfakes and mark generated content. The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026) moved the high-risk obligations to 2 December 2027 (Annex III) and 2 August 2028 (Annex I) and eased the rules for SMEs and small mid-caps. In Germany, the Bundesnetzagentur is the supervisor. What to do: list your AI systems, label AI output now, and classify any high-risk use before December 2027. Our guide: the EU AI Act and AI agents in 2026.

Cyber Resilience Act

Manufacturers of software and connected products sold in the EU must report actively exploited vulnerabilities and severe incidents through ENISA's platform since 11 September 2026, including for products already on the market. From 11 December 2027, SBOMs, a vulnerability disclosure policy and at least five years of security updates follow. Custom software is in scope, and the manufacturer is whoever markets it under its own name. Our guide: Cyber Resilience Act reporting obligations.

NIS2 in Germany

The NIS2 Implementation Act has been in force since 6 December 2025. It covers about 29,500 companies in 18 sectors, including cloud providers, data centres, managed (security) service providers and digital platforms: "important" entities from 50 employees or more than €10 million turnover and balance sheet. They must register with the BSI (the deadline was three months after entry into force; anyone who missed it should register now), manage cybersecurity risks with management personally accountable, and report incidents within 24 hours, 72 hours and one month. What to do: check your size and sector, register, document risk management.

Data Act

The Data Act has applied since 12 September 2025. Connected products and related services placed on the market since 12 September 2026 must let users access their data by design. From 12 January 2027, cloud and SaaS providers may no longer charge for switching, and from 12 September 2027 the unfair-terms rules also cover older long-term contracts. What to do: build data export and APIs, plan switching and egress, review B2B terms.

E-invoicing in Germany and ViDA

All businesses must receive e-invoices since 2025; issuing becomes mandatory in 2027 above €800,000 turnover and for everyone in 2028. From July 2030, ViDA brings e-invoicing and digital reporting to cross-border B2B supplies. Our guide: E-invoicing 2027: an ERP checklist.

Product liability

The new Product Liability Directive treats software and AI as products, whether installed, embedded or delivered as a service. A product can be defective because it lacks a security update, and courts can order manufacturers to disclose evidence. It applies to products placed on the market after 9 December 2026; Germany's implementing bill passed the Bundestag legal committee in October 2026. What to do: document updates and the support period, review liability caps and insurance.

Accessibility

Since 28 June 2025, the Accessibility Strengthening Act (BFSG) requires accessible online shops, banking services, e-books, apps and other consumer services; micro-enterprises providing services are exempt. What to do: meet WCAG 2.1 AA (EN 301 549) and publish an accessibility statement.

eIDAS 2

Member states must offer an EU Digital Identity Wallet by the end of 2026; Germany plans its wallet from January 2027. About a year later, regulated private services that require strong authentication must accept it. What to do: plan wallet-based login and identity checks if you run such a service.

DORA

DORA applies to banks, insurers, investment firms and other financial entities since 17 January 2025. Software and cloud suppliers are not supervised directly unless designated as critical, but their contracts must include audit rights, incident cooperation and exit plans, and clients must list them in their register of information. What to do: have a DORA contract annex ready.

Health software

The European Health Data Space applies from 26 March 2027; EHR systems must support patient summaries and ePrescriptions from 2029 and images, lab results and discharge reports from 2031. In Germany, the electronic patient record (ePA) has been mandatory for providers since October 2025, and the EHDS implementation act was in parliament in autumn 2026. Medical device software under the MDR must leave the legacy rules by the end of 2027 or 2028, depending on its class. What to do: use FHIR-based exchange formats and plan EHR conformity for 2029.

Still being negotiated

These proposals could change the dates or duties above. As of November 2026 none of them is law:

• Digital Omnibus on data and privacy (Commission proposal of November 2025): changes to the GDPR and cookie rules, such as exemptions from consent for audience measurement; Council and Parliament had not agreed.
• Targeted NIS2 amendments and a single EU reporting point (proposed January 2026).
• Data Act changes in the Digital Omnibus, including relief for switching.
• German product liability reform (implementation of the directive): final Bundestag vote pending.
• PSD3 and the Payment Services Regulation: political agreement in 2026, application expected about 21 months after publication.
• MDR and IVDR revision proposed in December 2025.

How to use this calendar

1. Find your rows: start with what you sell (Figure 2), then mark the regulations that apply.
2. Assign an owner for each regulation, with a date in your roadmap well before the legal deadline.
3. Put the technical work into the product backlog: SBOM and reporting (CRA), data export (Data Act), labelling (AI Act), e-invoice formats, accessibility.
4. Check contracts with suppliers and clients: DORA annexes, CRA responsibilities, Data Act terms, liability caps.
5. Come back each quarter: we update this page when dates or proposals change.

How we help

SDH builds and runs software for companies in Germany and the EU, from ERP and accounting integrations to healthcare, finance and logistics systems. We put compliance into the architecture and the delivery pipeline: security and compliance by design, managed DevOps with SBOM and vulnerability monitoring, digital sovereignty for EU hosting, and CTO as a Service to turn this calendar into a roadmap. Talk to us if you need help working out which rules apply to your product.

FAQ

Which EU regulations apply to software companies in 2027?

The most important are the AI Act (high-risk obligations from 2 December 2027), the Cyber Resilience Act (full application from 11 December 2027), the Data Act (end of cloud switching charges on 12 January 2027), the new Product Liability Directive (for products placed on the market after 9 December 2026) and, in Germany, mandatory e-invoicing for businesses above €800,000 turnover from 1 January 2027.

When do the AI Act high-risk obligations apply?

After the Digital Omnibus on AI, high-risk obligations apply from 2 December 2027 for systems listed in Annex III and from 2 August 2028 for AI in products covered by Annex I. Transparency obligations have applied since 2 August 2026.

Is NIS2 already in force in Germany?

Yes. The NIS2 Implementation Act has been in force since 6 December 2025. Affected companies had to register with the BSI within three months and must report incidents within 24 hours, 72 hours and one month.

Does the Product Liability Directive cover software?

Yes. Under Directive (EU) 2024/2853, software and AI systems are products, including software delivered as a service. It applies to products placed on the market after 9 December 2026.

How often is this calendar updated?

Every quarter, and whenever a regulation or proposal on this page changes. The date at the top shows the last update.

Sources

• European Commission, AI Omnibus enters into force, July 2026
• Regulation (EU) 2024/2847 (Cyber Resilience Act)
• BSI, NIS2 Implementation Act in force, December 2025
• European Commission, Data Act
• Directive (EU) 2024/2853 (Product Liability)
• German Federal Ministry of Finance, FAQ on e-invoicing
• European Commission, VAT in the Digital Age
• § 38 BFSG (Accessibility Strengthening Act)
• Regulation (EU) 2024/1183 (eIDAS 2)
• Regulation (EU) 2022/2554 (DORA)
• European Commission, European Health Data Space
• German Federal Ministry for Digital Affairs, New AI law enters into force, July 2026

Categories

About the author

Vasyl Kuchma

CEO, Europe Offices & Co-Founder

View full profile

CEO & Co-Founder at Software Development Hub. Innovation-driven expert with 20+ years of experience. A business practitioner with experience in creating and launching startups, an innovator and progressive-minded specialist, who helps turn raw ideas into profitable results.

View full profile