The 2026-2028 EU Digital-Law Deadline Calendar: One Board View of Every Trigger Date

Every EU digital regulation arrives at the board as its own memo, its own risk owner, its own line in the budget. None of them arrives with a note saying it competes for the same engineers, the same compliance analysts and the same legal review as five others firing in the same eighteen months.

That is the structural problem with how most boards see the next two years. The AI Act, the Cyber Resilience Act, the Data Act, the recast Product Liability Directive and the EU Digital Identity Wallet each land on the agenda separately, usually presented by whichever function feels most exposed to it. Each is treated as a discrete programme with its own deadline. What no single memo shows is the thing the board actually needs: all the trigger dates on one column, so it can see where the clashes are before the engineering calendar collides with them.

Why treating each regulation in isolation guarantees a clash

These instruments draw on a shared and finite pool of capacity. The people who scope your AI system inventory are the people who would otherwise be building the vulnerability-disclosure process for the Cyber Resilience Act. The lawyer reviewing your connected-product data-access design under the Data Act is the lawyer you also need reading the new product-liability exposure. When each obligation is planned against its own deadline in its own silo, the plans look achievable individually and turn out to be impossible collectively, because they all assume first call on the same specialists in the same quarter.

The failure mode is predictable. Two or three deadlines cluster in a single month, the work was scoped as if each had the team to itself, and the board discovers the conflict late enough that the only options left are emergency contractor spend or accepting slippage on whichever obligation shouts least loudly. Both are expensive. Both are avoidable with a consolidated calendar seen early. This is the same logic that makes it worth reading the overlapping obligations as one programme rather than a stack of unrelated projects.

The trigger dates, on one column

Here is the window as it stands in mid-2026. Dates flagged provisional are not yet settled in final law and should be verified before you plan against them.

• Already live, still incomplete. The European Accessibility Act has applied since 28 June 2025. NIS2 was due to be transposed by 17 October 2024, yet several member states were still finishing that work well into 2026, so the obligation is live but its precise national shape varies by jurisdiction.
• 11 June 2026 — CRA institutional build-out. Member states must have designated conformity-assessment bodies and notifying authorities, the machinery manufacturers will later rely on.
• 2 August 2026 — AI Act, original high-risk date. This was the date most high-risk obligations attached. Under the Digital Omnibus package that the European Parliament approved in June 2026, with Council adoption still pending, the core high-risk duties move later (see below). Treat the deferral as provisional until it is formally adopted.
• 11 September 2026 — CRA reporting begins. Manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents to their CSIRT and ENISA, on a 24-hour early-warning and 72-hour notification cadence.
• 12 September 2026 — Data Act, data-by-design. The Article 3(1) obligation to design connected products so users can access the data they generate applies to products placed on the market after this date.
• 9 December 2026 — new Product Liability Directive. Transposition deadline for Directive (EU) 2024/2853, which brings software, firmware and AI systems squarely within the definition of a defective product.
• End of 2026 (target, verify) — EUDI Wallet. Member states are expected to make a certified EU Digital Identity Wallet available roughly 24 months after the core implementing acts, pointing to late 2026. The exact national go-live dates are still moving.
• January 2027 — Data Act switching charges. The phased withdrawal of cloud data-processing switching charges completes, ending the ability to charge customers to leave.
• 2 December 2027 (provisional) — AI Act standalone high-risk. The deferred obligations for Annex III standalone high-risk systems, such as those used in employment and access to services.
• 11 December 2027 — CRA full application. The essential cybersecurity requirements, conformity assessment and CE marking for products with digital elements all bite.
• 2 August 2028 (provisional) — AI Act embedded high-risk. High-risk AI built into products already regulated under Annex I harmonised legislation, such as medical devices.

The AI Act moved, and that changes your sequencing

The single most important planning fact in this window is that the AI Act’s high-risk timeline shifted in 2026. A board that budgeted a large high-risk compliance push for August 2026 now has room to rebreathe, provided the deferral is confirmed. That does not mean the AI Act goes quiet: transparency duties, the prohibited-practice regime already in force since February 2025, and general-purpose model obligations from August 2025 all continue to apply. The detail of what moved and what did not is worth reading in full in our note on the Digital Omnibus deferrals, because the wrong assumption here misallocates the scarcest capacity you have.

The practical consequence: the room the AI Act deferral opens in late 2026 is exactly the room the CRA reporting obligation and the Data Act design duty need. Sequenced deliberately, that is a gift. Left unsequenced, the teams freed from one deadline are simply idle while the next one is already overdue.

The overlaps that will actually hurt

Look at September to December 2026. CRA vulnerability reporting starts on 11 September, the Data Act design obligation attaches on 12 September, and the Product Liability Directive transposition lands on 9 December, with the EUDI Wallet arriving somewhere in the same quarter. If you build software that ships in hardware, hold customer data on connected products, and rely on identity verification, all four touch the same product teams within fourteen weeks.

The CRA reporting cadence in particular is not a documentation exercise you can defer; it demands a working detection-and-notification pipeline on day one, and it overlaps with incident-reporting duties you may already carry under NIS2 and sector rules. Mapping those reporting obligations together, rather than building three parallel pipelines, is the subject of our board cyber-incident reporting map. The same discipline applies across the whole calendar: find where two obligations want the same artefact and build it once.

What the board should do with this

Give one person the calendar and the mandate to sequence against it. Not one person per regulation, one person across all of them, with authority to say which obligation gets the specialists in which quarter and which gets external help. That role sits naturally alongside the board technology risk register, where these dates should already appear as tracked exposures rather than surprises.

Then make the investment decision the calendar demands: fund the clashes early, at the price you choose, rather than the price the market sets when three deadlines arrive in the same fortnight and everyone in your sector is bidding for the same contractors at once.

The regulations are not going to arrive one at a time to suit your capacity. The only question is whether the board sees them stacked up in advance, or reads about the collision in a project post-mortem.