Deadlines under NIS2, the CRA, DORA and the AI Act, at EU and Italian level, taken from the official texts: the upcoming ones and those of the last six months.
These dates are a guide, not legal advice: the official source given for each deadline prevails. We check them against the official texts and show the date of the last check for each one.
With an account, you get a reminder in the notification bell 30 and 7 days before the deadlines of the topics you follow.
The .ics file opens in Outlook, Google Calendar and Apple Calendar. Indicative dates are not added to the calendar.
Deadlines of the last six months.
AI ActItaly
23 October 2026
Italian Legislative Decree 179/2026 enters into force (authorities, penalties, AI at work)
Italy now has national penalties for breaches of the AI Act, with the ACN among the market surveillance authorities (alongside the Bank of Italy, CONSOB, IVASS and the Italian Data Protection Authority, each within its remit) and AgID as notifying authority. Employers using AI must leave final decisions on the employment relationship to a person: a dismissal decided solely by automated processing is void.
Who it applies to: Providers, deployers, importers, distributors and notified bodies in Italy; employers using AI systems.
Checked on 1 November 2026
AI ActEU
14 October 2026
AI Act: first harmonised standard, EN 18286:2026 on quality management systems
Implementing Decision (EU) 2026/2274 publishes the reference of standard EN 18286:2026 in the Official Journal: following it gives a presumption of conformity with the AI Act requirements on quality management systems, from the date of publication.
Who it applies to: Providers of high-risk AI systems.
Checked on 1 November 2026
AI ActItaly
30 September 2026
Italian Legislative Decree 160/2026 enters into force (offence, corporate liability and AI damages)
A new offence is created under Article 437-bis of the Italian Criminal Code (failure to adopt security measures in AI systems and unlawful alteration of systems: among other things, failure to adopt security or human oversight measures for high-risk AI systems, where this endangers life or safety), with corporate liability under Legislative Decree 231/2001. In damages claims, where the AI Act has been breached, the causal link with the damage is presumed unless proven otherwise.
Who it applies to: Providers and professional users of high-risk AI systems; organisations (Decree 231 models); anyone sued for damage caused by an AI system.
Checked on 1 November 2026
AI ActEU
2 August 2026
AI Act: general application, transparency (Art. 50) and fines for GPAI model providers
Everything without a different date applies. For businesses the main point is Article 50: telling people they are interacting with AI, marking synthetic content in a machine-readable format, and disclosing deepfakes (for generative systems already on the market before 2 August 2026, marking is due by 2 December 2026). From the same date the Commission can fine providers of general-purpose AI models (Article 101): up to 3% of total worldwide annual turnover or EUR 15 million, whichever is higher.
Who it applies to: Providers and deployers of the systems covered by Article 50; providers of general-purpose AI models (Article 101).
Checked on 1 November 2026
AI ActEU
27 July 2026
The AI Omnibus (Regulation 2026/1744) enters into force
The Omnibus amendments without a date of their own apply: a new Article 4 on AI literacy; machinery moves from Section A to Section B of Annex I; the “whichever is lower” penalty ceilings also apply to small mid-cap enterprises (Article 99(6a), for paragraphs 4 and 5 only; this already applied to SMEs). Articles 102 to 110 also apply, including consumers’ representative actions (Article 110).
Who it applies to: Providers and deployers of AI systems; small mid-cap enterprises; machinery manufacturers.
Checked on 1 November 2026