securityportal
Sign in

Regulatory deadlines

Deadlines under NIS2, the CRA, DORA and the AI Act, at EU and Italian level, taken from the official texts: the upcoming ones and those of the last six months.

These dates are a guide, not legal advice: the official source given for each deadline prevails. We check them against the official texts and show the date of the last check for each one.

AllNIS2CRADORAAI Act

With an account, you get a reminder in the notification bell 30 and 7 days before the deadlines of the topics you follow.

Upcoming deadlines

Add all to calendar

The .ics file opens in Outlook, Google Calendar and Apple Calendar. Indicative dates are not added to the calendar.

December 2026

AI ActEU
2 December 2026In 30 days

AI Act: marking of synthetic content for systems already on the market

Providers of systems generating text, images, audio or video placed on the market before 2 August 2026 have until 2 December 2026 to mark outputs as artificially generated (Article 50(2)). Systems placed on the market from 2 August 2026 must mark them straight away.

Who it applies to: Providers of generative AI systems, including general-purpose ones.

Checked on 1 November 2026Add to calendar
AI ActEU
2 December 2026In 30 days

AI Act: new prohibitions on intimate imagery and child sexual abuse material

It becomes prohibited to place on the market, put into service or use AI systems that generate or manipulate realistic intimate images, video or audio of identifiable people without their consent, or child sexual abuse material (Article 5(1), points (ba) and (bb)). For providers the prohibition applies where this is the intended purpose, or where the output is reasonably foreseeable and adequate technical safeguards are lacking; for deployers, where they use the system to generate such material (Article 5(1a)).

Who it applies to: Providers and deployers of AI systems that generate images, video or audio.

Checked on 1 November 2026Add to calendar

April 2027

AI ActItalyIndicative date
23 April 2027 (calculated)

National councils of professional bodies: CPD rules to include AI courses

The national councils of Italian professional bodies update their continuing professional development rules to include AI courses. The obligation for members follows the new rules.

The decree allows six months from its entry into force (23 October 2026): the date is calculated.

Who it applies to: National councils of professional bodies; then their registered members.

Checked on 1 November 2026

August 2027

AI ActEU
2 August 2027

AI Act: general-purpose AI models placed on the market before 2 August 2025

General-purpose AI models placed on the market before 2 August 2025 must comply with the obligations in Chapter V (technical documentation, information for downstream providers, copyright policy, summary of training content) by 2 August 2027.

Who it applies to: Providers of general-purpose AI models.

Checked on 1 November 2026Add to calendar

December 2027

AI ActEUPostponed
2 December 2027

AI Act: high-risk systems in Annex III

For high-risk systems in Annex III, the classification rules, the requirements (risk management, data, technical documentation, record-keeping, transparency, human oversight, accuracy, robustness and cybersecurity) and the obligations of providers, importers, distributors and deployers apply. Systems already on the market or in service remain outside until their design undergoes significant changes. What counts is the type and model, not the individual unit: if a first unit was already on the market, later identical units follow the same rule (Article 111(2)). For those intended for use by public authorities the final deadline is 2 August 2030.

Postponed by Regulation (EU) 2026/1744: it was previously 2 August 2026.

Who it applies to: Providers, authorised representatives, importers, distributors and deployers of Annex III systems, including public bodies.

Checked on 1 November 2026Add to calendar

August 2028

AI ActEUAmendment proposed
2 August 2028

AI Act: high-risk systems in Annex I (regulated products)

For AI systems that are products, or safety components of products, covered by the legislation in Annex I (for example toys, lifts, radio equipment, medical devices), the high-risk requirements and obligations apply. The date was postponed by Regulation 2026/1744: it was previously 2 August 2027. Systems already on the market or in service remain outside until their design undergoes significant changes. What counts is the type and model, not the individual unit: if a first unit was already on the market, later identical units follow the same rule (Article 111(2)).

Proposal COM(2025) 1023 is pending: it would move medical devices and in vitro diagnostic medical devices to Section B of Annex I, taking them out of this deadline. Until it is adopted, the current date and scope apply. The procedure

Who it applies to: Manufacturers and providers of products in Annex I, Section A; deployers.

Checked on 1 November 2026Add to calendar
AI ActEUIndicative date
By 2 August 2028

Machinery with AI: requirements in the Machinery Regulation

With machinery leaving Section A of Annex I to the AI Act, the requirements for high-risk AI in machinery will become new essential requirements of Machinery Regulation (EU) 2023/1230, through delegated acts to apply by 2 August 2028 at the latest.

It depends on Commission delegated acts not yet adopted: the actual date will be the one they set.

Who it applies to: Manufacturers of machinery with high-risk AI systems as safety components.

Checked on 1 November 2026

August 2030

AI ActEU
2 August 2030

AI Act: high-risk systems already on the market intended for use by public authorities

High-risk systems already on the market or in service and intended for use by public authorities must be brought into compliance by this date, even without changes. New systems follow 2 December 2027 or 2 August 2028.

Who it applies to: Providers and deployers of high-risk systems intended for use by public authorities.

Checked on 1 November 2026Add to calendar

Already in force

Deadlines of the last six months.

AI ActItaly
23 October 2026

Italian Legislative Decree 179/2026 enters into force (authorities, penalties, AI at work)

Italy now has national penalties for breaches of the AI Act, with the ACN among the market surveillance authorities (alongside the Bank of Italy, CONSOB, IVASS and the Italian Data Protection Authority, each within its remit) and AgID as notifying authority. Employers using AI must leave final decisions on the employment relationship to a person: a dismissal decided solely by automated processing is void.

Who it applies to: Providers, deployers, importers, distributors and notified bodies in Italy; employers using AI systems.

Checked on 1 November 2026
AI ActEU
14 October 2026

AI Act: first harmonised standard, EN 18286:2026 on quality management systems

Implementing Decision (EU) 2026/2274 publishes the reference of standard EN 18286:2026 in the Official Journal: following it gives a presumption of conformity with the AI Act requirements on quality management systems, from the date of publication.

Who it applies to: Providers of high-risk AI systems.

Checked on 1 November 2026
AI ActItaly
30 September 2026

Italian Legislative Decree 160/2026 enters into force (offence, corporate liability and AI damages)

A new offence is created under Article 437-bis of the Italian Criminal Code (failure to adopt security measures in AI systems and unlawful alteration of systems: among other things, failure to adopt security or human oversight measures for high-risk AI systems, where this endangers life or safety), with corporate liability under Legislative Decree 231/2001. In damages claims, where the AI Act has been breached, the causal link with the damage is presumed unless proven otherwise.

Who it applies to: Providers and professional users of high-risk AI systems; organisations (Decree 231 models); anyone sued for damage caused by an AI system.

Checked on 1 November 2026
AI ActEU
2 August 2026

AI Act: general application, transparency (Art. 50) and fines for GPAI model providers

Everything without a different date applies. For businesses the main point is Article 50: telling people they are interacting with AI, marking synthetic content in a machine-readable format, and disclosing deepfakes (for generative systems already on the market before 2 August 2026, marking is due by 2 December 2026). From the same date the Commission can fine providers of general-purpose AI models (Article 101): up to 3% of total worldwide annual turnover or EUR 15 million, whichever is higher.

Who it applies to: Providers and deployers of the systems covered by Article 50; providers of general-purpose AI models (Article 101).

Checked on 1 November 2026
AI ActEU
27 July 2026

The AI Omnibus (Regulation 2026/1744) enters into force

The Omnibus amendments without a date of their own apply: a new Article 4 on AI literacy; machinery moves from Section A to Section B of Annex I; the “whichever is lower” penalty ceilings also apply to small mid-cap enterprises (Article 99(6a), for paragraphs 4 and 5 only; this already applied to SMEs). Articles 102 to 110 also apply, including consumers’ representative actions (Article 110).

Who it applies to: Providers and deployers of AI systems; small mid-cap enterprises; machinery manufacturers.

Checked on 1 November 2026