Deadlines under NIS2, the CRA, DORA and the AI Act, at EU and Italian level, taken from the official texts: the upcoming ones and those of the last six months.
These dates are a guide, not legal advice: the official source given for each deadline prevails. We check them against the official texts and show the date of the last check for each one.
The .ics file opens in Outlook, Google Calendar and Apple Calendar. Indicative dates are not added to the calendar.
December 2027
CRAEU
10 December 2027
Last day of the RED cybersecurity requirements
Until 10 December 2027, radio equipment covered by Delegated Regulation 2022/30 must meet the cybersecurity requirements of the Radio Equipment Directive (RED); from 11 December 2027 the CRA replaces them. Units placed on the market between 1 August 2025 and 10 December 2027 can still be checked against the RED afterwards.
Who it applies to: Manufacturers, importers and distributors of radio equipment within the scope of Delegated Regulation 2022/30.
The whole Regulation applies: essential cybersecurity requirements, vulnerability handling, technical documentation, conformity assessment, EU declaration of conformity and CE marking, obligations of importers and distributors, market surveillance and penalties. Units placed on the market before this date are outside its scope unless substantially modified, but Article 14 applies regardless. What counts is the individual unit, not the model: units placed on the market from 11 December 2027 must comply even if the model was already on sale.
Who it applies to: Manufacturers, authorised representatives, importers and distributors of products with digital elements.
CRA: obligations of open-source software stewards (Art. 24)
Legal persons that systematically provide sustained support for the development of open-source software intended for commercial activities must have a documented cybersecurity policy, cooperate with market surveillance authorities on request and report through the ENISA platform actively exploited vulnerabilities in products whose development they are involved in, and severe incidents affecting the systems they provide for that development.
Who it applies to: Open-source software stewards (for example, foundations).
CRA: latest end of validity of certificates and approval decisions issued under other EU legislation
EU type-examination certificates and approval decisions on cybersecurity issued under other EU product legislation (for example the RED, with Delegated Regulation 2022/30) remain valid until this date at the latest.
Who it applies to: Manufacturers holding such certificates or approval decisions.
A manufacturer that becomes aware of an actively exploited vulnerability or a severe incident affecting its product notifies it exclusively through ENISA’s single reporting platform (access via EU Login), operational from the same date: early warning within 24 hours, notification within 72 hours, final report. This also applies to products already on the market.
Who it applies to: Manufacturers of products with digital elements made available in the EU, including those placed on the market before 11 December 2027.
Chapter IV applies: from this date Member States can assess laboratories and certification bodies that wish to become notified bodies under the CRA, and notify them to the Commission.
Who it applies to: Conformity assessment bodies; indirectly, manufacturers that will need a notified body.