Deadlines under NIS2, the CRA, DORA and the AI Act, at EU and Italian level, taken from the official texts: the upcoming ones and those of the last six months.
These dates are a guide, not legal advice: the official source given for each deadline prevails. We check them against the official texts and show the date of the last check for each one.
The .ics file opens in Outlook, Google Calendar and Apple Calendar. Indicative dates are not added to the calendar.
December 2026
DORAEU
31 December 2026In 59 days
Critical ICT third-party providers: certified turnover to the Lead Overseer
Each ICT third-party provider designated as critical sends the Lead Overseer its audited turnover generated in the EU with financial entities, which is used to calculate the oversight fee. The 31 December 2026 deadline covers 2025 turnover.
Who it applies to: ICT third-party service providers designated as critical by the European Supervisory Authorities.
Article 106 TUB intermediaries: parts of DORA apply under a simplified regime
Financial intermediaries entered in the register under Article 106 of the Italian Consolidated Law on Banking (TUB) become subject, under a simplified regime, to the DORA provisions listed in Article 6 of Legislative Decree 23/2025: ICT risk management, major incident reporting, testing, and the register of and contracts with ICT providers.
Who it applies to: Financial intermediaries under Article 106 TUB (competent authority: Bank of Italy).
Bank of Italy: annual submission of the register of information on ICT providers
By 15 March the register of all arrangements with ICT providers, with data as at 31 December 2026, is sent to the Bank of Italy via INFOSTAT. The Bank of Italy checks data quality and may request a resubmission.
Who it applies to: Financial entities that send the register to the Bank of Italy. The communication does not list the addressees.
Critical ICT third-party providers already under oversight on 1 January 2027 pay the annual fee to the Lead Overseer in a single instalment by 30 April.
Who it applies to: Critical ICT third-party service providers under oversight on 1 January 2027.
Bank of Italy: annual estimate of costs and losses from major ICT incidents
By 31 May the estimate of the previous year’s aggregated costs and losses caused by major ICT-related incidents is sent to the Bank of Italy via INFOSTAT.
Who it applies to: Intermediaries directly supervised by the Bank of Italy.
Bank of Italy: first annual estimate of costs and losses from major ICT incidents
Intermediaries supervised by the Bank of Italy submit via INFOSTAT their estimate of the aggregated annual costs and losses caused by major ICT-related incidents. For the first submission only, the deadline was 30 June instead of 31 May.
Who it applies to: Intermediaries directly supervised by the Bank of Italy.