From GDPR to the EU AI Act, European regulation has been moving on a fixed timeline since 2018. Below is every major enforcement date, past and future, with what each one means for your business.
Dates your legal and compliance team should have on the wall. Click through to the relevant tool for each regulation.
The General Data Protection Regulation became enforceable across all EU member states. Any company that processes personal data of EU residents must comply, with fines up to €20M or 4% of global annual turnover.
Check your GDPR compliance →EU member states were required to transpose NIS2 into national law by 17 October 2024. Over 160,000 entities in essential and important sectors across the EU are in scope, including energy, transport, health, finance, and digital infrastructure.
Check your NIS2 readiness →The Digital Operational Resilience Act became applicable on 17 January 2025. Banks, insurers, investment firms, crypto-asset service providers, and their critical ICT third-party providers must now maintain ICT risk frameworks, incident reporting procedures, and resilience testing programmes.
Check your DORA readiness →Large public-interest entities with more than 500 employees began reporting on FY2024 sustainability data under the Corporate Sustainability Reporting Directive. Reports must follow ESRS standards, covering climate, environment, workforce, governance, and supply chain.
Check your CSRD readiness →Article 5 of the EU AI Act became enforceable on 2 February 2025. AI systems that manipulate behaviour, exploit vulnerabilities, use real-time biometric surveillance in public spaces, or apply social scoring are now banned. Companies must verify that none of their AI tools fall under these prohibitions.
Classify your AI systems →On 2 August 2025, governance rules and General Purpose AI (GPAI) model obligations became applicable. Providers of foundation models must meet transparency, copyright, and technical documentation requirements. Most SMEs using these models are not directly affected: the obligations apply primarily to the model providers themselves.
Since 2 August 2026, Article 50 transparency obligations apply to any AI system that interacts with people or generates synthetic content, whether or not it is high-risk. People must be told when they are dealing with an AI system, and AI-generated content must be labelled. Regulation (EU) 2026/1744 did not defer these obligations.
Classify your AI systems →Generative AI systems placed on the EU market before 2 August 2026 must carry machine-readable marking of synthetic content under Article 50(2) from 2 December 2026. Regulation (EU) 2026/1744 granted this four-month grace period to existing systems only. Systems placed on the market from 2 August 2026 onwards have had to comply since that date.
Classify your AI systems →Obligations for standalone high-risk AI systems (Annex III) apply from 2 December 2027. Regulation (EU) 2026/1744 (Digital Omnibus on AI), in force since 27 July 2026, moved this date from the original 2 August 2026. Companies that develop, deploy, or use AI in areas such as employment, education, credit scoring, biometrics, critical infrastructure, and law enforcement must have risk management systems, technical documentation, human oversight, and conformity assessments in place by then.
Build your AI Act compliance roadmap →Post-Omnibus I scope (Directive (EU) 2026/470, in force 18 March 2026): large EU undertakings meeting both cumulative thresholds, more than 1,000 employees AND more than €450M net turnover, begin reporting on FY2027 data. First reports due in 2028. The original pre-Omnibus "2-of-3" test (250 employees / €50M / €25M) has been removed.
Run your ESRS gap analysis →High-risk AI systems that are safety components of products already regulated under other EU legislation (Annex I, for example medical devices, machinery, aviation, automotive) must comply from 2 August 2028. Regulation (EU) 2026/1744 moved this date from the original 2 August 2027, keeping it aligned with the product regulation timelines.
Classify your AI systems →The Corporate Sustainability Due Diligence Directive (Directive (EU) 2024/1760, as amended by Directive (EU) 2026/470, Omnibus I, in force 18 March 2026) now applies from July 2029 to EU companies with more than 5,000 employees AND more than €1.5bn worldwide net turnover, and to non-EU companies with more than €1.5bn of EU turnover. The pre-Omnibus 3-wave phasing (5,000/€1.5bn → 3,000/€900m → 1,000/€450m) has been removed. Member-state transposition deadline: 26 July 2028. Due diligence scope is narrowed to Tier-1 direct business partners (with deeper assessment only where there is plausible evidence of adverse impact); the CS3D climate transition plan obligation has been removed.
Check your supply chain readiness →The original Phase 3 obligation on EU-listed SMEs has been removed by Directive (EU) 2026/470 (Omnibus I, in force 18 March 2026). Listed SMEs are no longer in mandatory CSRD scope and may report voluntarily using the VSME standard. Non-listed SMEs were never directly obligated, but will continue to face reporting requests from larger companies in their supply chains (value-chain flow-down).
Start your CSRD assessment →Not all regulations apply to every company. Take the free diagnostic and get a personalised view of your obligations, in under 2 minutes.