Home › Law library › Compliance deadlines 2024–2028: EU AI Act, CRA, NIS2, DORA, Data Act and UK rules

Compliance deadlines 2024–2028: EU AI Act, CRA, NIS2, DORA, Data Act and UK rules

When each obligation starts, in date order, so you can plan the next two years. Every date comes from the law's own page, where it is confirmed by two independent sources, at least one official.

Next deadline: 2 December 2026 — EU AI Act: two new prohibited practices apply, and the marking grace period for systems already on the market ends.

23 dates from 12 laws. Library last updated 11 October 2026. = confirmed by two independent sources, at least one official.

Coming up

Date	Law	What applies
2 December 2026	EU AI Act European Union	EU AI Act: two new prohibited practices apply, and the marking grace period for systems already on the market ends✓Sources: eur-lex.europa.eu, eur-lex.europa.eu, ai-act-service-desk.ec.europa.eu, hunton.com
12 January 2027	EU Data Act European Union	EU Data Act: cloud switching fees must end✓Sources: digital-strategy.ec.europa.eu, eur-lex.europa.eu, springlex.eu, mccannfitzgerald.com
13 May 2027	DPDP Act / DPDP Rules India	India DPDP: breach reporting to the Data Protection Board starts, with most business duties✓DPDP Act s.8(6); DPDP Rules r.7 (commencement r.1); CERT-In Directions 28 Apr 2022 para (ii) (IT Act s.70B(6)) ↗ · Sources: cert-in.org.in, static.pib.gov.in
2 December 2027	EU AI Act European Union	EU AI Act: stand-alone (Annex III) high-risk rules apply✓Sources: ai-act-service-desk.ec.europa.eu, eur-lex.europa.eu, hunton.com, cdp.cooley.com
11 December 2027	Cyber Resilience Act (CRA) European Union	Cyber Resilience Act: main obligations apply✓CRA Art 71(2) · Sources: eur-lex.europa.eu, digital-strategy.ec.europa.eu, twobirds.com
2 August 2028	EU AI Act European Union	EU AI Act: product-embedded (Annex I) high-risk rules apply✓Sources: ai-act-service-desk.ec.europa.eu, eur-lex.europa.eu, hunton.com, cdp.cooley.com

Already applies

Date	Law	What applies
12 September 2026	EU Data Act European Union	EU Data Act: design duty (data access by design) applies to new products✓Sources: digital-strategy.ec.europa.eu, eur-lex.europa.eu, springlex.eu, mccannfitzgerald.com
11 September 2026	Cyber Resilience Act (CRA) European Union	Cyber Resilience Act: reporting of actively exploited vulnerabilities and severe incidents (Art 14) applies✓CRA Art 71(2) · Sources: eur-lex.europa.eu, digital-strategy.ec.europa.eu, twobirds.com
2 August 2026	EU AI Act European Union	EU AI Act transparency duties apply✓Sources: eur-lex.europa.eu, eur-lex.europa.eu, ai-act-service-desk.ec.europa.eu, hunton.com
19 June 2026	UK GDPR / DPA 2018 United Kingdom	UK Data (Use and Access) Act 2025 data protection changes fully in force✓Sources: ico.org.uk, legislation.gov.uk, dlapiperdataprotection.com
11 June 2026	Cyber Resilience Act (CRA) European Union	Cyber Resilience Act: rules on notified bodies apply✓CRA Art 71(2) · Sources: eur-lex.europa.eu, digital-strategy.ec.europa.eu, twobirds.com
7 April 2026	UK Online Safety Act United Kingdom	Online Safety Act: user-to-user services must report CSEA content to the National Crime Agency✓OSA 2023 introduction (Royal Assent); s.81; ss.9-10; ss.35-37; s.66; SI 2026/262 · Sources: ofcom.org.uk, legislation.gov.uk, bratby.law
1 January 2026	CCPA/CPRA California, United States	California CPPA rules on automated decision-making, risk assessments and cybersecurity audits take effect (phased deadlines)✓Sources: cppa.ca.gov, cppa.ca.gov, hunton.com
12 September 2025	EU Data Act European Union	EU Data Act applies✓Sources: digital-strategy.ec.europa.eu, eur-lex.europa.eu, springlex.eu, mccannfitzgerald.com
25 July 2025	UK Online Safety Act United Kingdom	Online Safety Act: child-safety duties apply✓OSA 2023 introduction (Royal Assent); s.81; ss.9-10; ss.35-37; s.66; SI 2026/262 · Sources: ofcom.org.uk, legislation.gov.uk, bratby.law
28 June 2025	European Accessibility Act (EAA) European Union	European Accessibility Act applies✓Sources: eur-lex.europa.eu, commission.europa.eu, fieldfisher.com
17 March 2025	UK Online Safety Act United Kingdom	Online Safety Act: illegal content duties become enforceable✓OSA 2023 introduction (Royal Assent); s.81; ss.9-10; ss.35-37; s.66; SI 2026/262 · Sources: ofcom.org.uk, legislation.gov.uk, bratby.law
17 January 2025	UK Online Safety Act United Kingdom	Online Safety Act: Part 5 age checks apply✓OSA 2023 introduction (Royal Assent); s.81; ss.9-10; ss.35-37; s.66; SI 2026/262 · Sources: ofcom.org.uk, legislation.gov.uk, bratby.law
17 January 2025	DORA European Union	DORA applies to EU financial entities✓Sources: eiopa.europa.eu, oeil.europarl.europa.eu
10 December 2024	Cyber Resilience Act (CRA) European Union	Cyber Resilience Act enters into force✓CRA Art 71(2) · Sources: eur-lex.europa.eu, digital-strategy.ec.europa.eu, twobirds.com
17 October 2024	NIS2 European Union	NIS2 transposition deadline; it applies through each country's national law✓Sources: digital-strategy.ec.europa.eu, oeil.europarl.europa.eu, cm.twobirds.com
29 April 2024	UK PSTI (connected products) United Kingdom	UK product security (PSTI) requirements apply to connectable products✓SI 2023/1007 reg 1(2) (in force 29 Apr 2024); SI 2025/211 reg 1; SI 2025/1267 reg 1 · Sources: legislation.gov.uk, cooley.com
17 February 2024	Digital Services Act (DSA) European Union	DSA applies to all intermediary services (very large platforms earlier)✓Sources: digital-strategy.ec.europa.eu, cooley.com, garrigues.com

See which of these laws apply to you with the Global Law Finder

Information only, not legal advice. Dates can move when laws are amended; open the law page and its official source before relying on a row. Spotted an error? Email contact@glancedeskjurisdiction.com.