EU Deadlines at the End of 2026: Eight Dates from 11 September to 20 January

Between 11 September 2026 and 20 January 2027 sit eight EU deadlines that matter to the mid-market; behind the two in September, the obligations have kept running since. That stretch is the densest run of European regulatory dates any business year has contained this decade. The risk sits less in the date than in the reading: most of these deadlines attach to a product, a turnover figure or a function rather than to the size of your company.

This piece puts the eight dates on one page, in the order they arrive: what actually changes, who it hits and which task follows from it. Each passage links to the full analysis we published on that subject. The framing here is the one for a managing director who has to decide what they carry personally and what they hand off.

The two deadlines in September 2026

On 11 September the reporting duty of the Cyber Resilience Act went live. Manufacturers of products with digital elements now report actively exploited vulnerabilities and severe security incidents through the Single Reporting Platform operated by ENISA, which went into operation the same day: early warning within 24 hours, notification within 72 hours, final report no later than 14 days after a corrective measure is available, and within one month for severe incidents. Two sharpeners are missing from most summaries. The duty covers products sold years ago — the cut-off sits in the regulation, not in your shipping date. And the manufacturer in law is whoever places the product on the market under their own name: a company that has an app or a portal developed externally and ships it under its own brand reports itself, not the contractor. What can be settled by contract is who detects, analyses and writes — not who is legally obliged. The full analysis is in our piece on the CRA reporting duty.

One day later, on 12 September, the most reported obligation of the Data Act began — and the most frequently misread. Article 3(1) requires connected products to be built so that their data is accessible by default, easily, securely and free of charge. The deadline only covers products placed on the market after it; the installed base stays outside. What has applied to the installed base since 12 September 2025, though, is Article 4: where a user cannot take data directly from a connected product, they have been able to demand it on simple request since September 2025, free of charge, machine-readable and without undue delay, unless an exemption under Article 7(1) applies. That duty has been running largely unnoticed since then, and it is the one through which the first request arrives. The details are in the Data Act analysis.

The shared point of the two September dates: a passed deadline does not lower the risk, it changes the question. Before the date it was whether you are prepared. After it, whether the process works. Anyone who has never practised registering on the ENISA platform or answering a data request is practising now, under time pressure.

The calendar up to 20 January

The eight dates in calendar order:

20 October 2026: a deadline for the member states, not for you

20 October is the only date in this list that demands nothing from your company. Article 50 of the Machinery Regulation applies from that day, and its second paragraph obliges the member states to notify the Commission of their penalty rules. Germany has already set its penalties, in the Act implementing the Machinery Regulation (MaschinenDG), promulgated on 5 December 2025: section 9 provides for fines of up to 10,000 euros, and up to 100,000 euros among other things for failure to take corrective action under Article 10(9), and applies from 20 January 2027.

In practice: anyone with a machine or an assembly in the pipeline for 2027 should know section 9 MaschinenDG before the first contractual partner asks about it. The details are in our analysis of the Machinery Regulation.

2 December 2026: the deadline that ends at your provider, not at you

On 2 December the transition period for the machine-readable marking of AI-generated content ends. Article 50(2) of the AI Act requires the outputs of generative systems to be technically marked as AI-generated; for systems that were on the market before 2 August 2026, the Digital Omnibus allowed time until that date. The duty sits with the provider of the system, not with you as the user.

The day matters to you through a side condition: it decides whether the tools in your stack deliver in time. The question — does your generator mark its outputs as machine-readable, and from when — belongs in an email to your providers now, not in a meeting shortly before the deadline. Do not confuse it with what already applies: the disclosure duty of Article 50(1), that a chatbot identifies itself as AI, for instance, has been running since 2 August. It binds the provider of the system; if you develop a chatbot or have it developed and put it into service under your own name, you are the provider yourself (Article 3(3)). The separation is in our piece on the marking obligations.

9 December 2026: from when an undelivered update creates liability

On 9 December software becomes a product. Article 4 of Directive (EU) 2024/2853 counts it expressly among the items for which liability is strict — and Article 11(2) switches off, for one case, the defence on which nearly every software-liability discussion used to end: that the product was sound when placed on the market. Where the defectiveness results from a missing update necessary to maintain safety, and that lies within the manufacturer's control, the shipping state no longer exculpates. Article 4(5)(b) defines control as the ability to supply updates — not their exercise.

The limits are just as concrete: only a natural person is entitled to compensation; a company can bring such a claim only where it has succeeded to it, or been subrogated to it, by virtue of Union or national law or contract. Recoverable damage covers personal injury, property damage outside exclusively professional use, and the destruction of non-professional data. Pure B2B damage stays outside. On our reading, however, every licence you newly grant after the deadline counts as newly placed on the market; the directive does not say so expressly. And every substantial modification restarts the ten-year period. From December, whether you still ship a security update for an old version is no longer a support decision but a liability decision. The full reading is in the piece on product liability.

1 January 2027: e-invoicing hangs on your 2026 turnover

The issuing obligation for e-invoices starts on 1 January 2027 for every German-established business whose 2026 total turnover exceeds 800,000 euros. The decisive part is the figure, and it is not the one in your accounts: section 19(2) UStG measures total turnover by consideration actually received — the inflow, not the invoicing — and expressly leaves out supplies of fixed assets. Anyone who sold a machine or a company car in 2026 carries the proceeds in the profit calculation, not in this figure. Within a corridor of about ten percent around the threshold, that decides whether your deadline is January 2027 or January 2028.

Two reliefs are regularly overlooked. Below the threshold you may keep invoicing on paper until the end of 2027, and in another electronic format provided the recipient consents. And anyone transmitting invoices by EDI has until the end of 2027 regardless of turnover — the most practically important transitional rule for suppliers with grown EDI links, set out in section 27(38) UStG. From 1 January 2028 the obligation applies to everyone; invoices from businesses under the small-business scheme, small-amount invoices up to 250 euros and travel tickets remain exempt. The question for your tax adviser — what is our total turnover under section 19(2) — is answered in minutes and belongs before the turn of the year. The details are in the e-invoicing piece.

12 January 2027: leaving a cloud provider no longer costs a switching charge

From 12 January, providers of cloud and SaaS services may no longer impose any switching charges when a customer moves to another provider or back to its own infrastructure. That is Article 29(1) of the Data Act, and under Article 2(36) the ban expressly includes data egress charges. Until then, charges may not exceed the costs directly linked to the switch. What remains allowed: standard service fees until the contract ends, proportionate penalties for ending a fixed-term contract early, and egress charges capped at cost where several services are used in parallel (Article 34(2)).

Two points are easy to miss. Chapter VI has no exemption by company size, so the ban binds a mid-sized company whose customer portal counts as a data processing service just as it binds a hyperscaler. And because Article 50 sets no transitional rule for this chapter, it also covers contracts concluded before 12 September 2025. As a customer, check your cloud and SaaS contracts for exit and export prices; as a provider, take them out of your price lists by that day. What still costs money, and why Germany’s list of fines does not name Article 29 itself, is in the piece on switching charges.

20 January 2027: the regulation replaces the directive without a general transition period

On 20 January Machinery Directive 2006/42/EC is repealed, and Regulation (EU) 2023/1230 applies in full. There is no general transition period; the cut-off attaches to the individual machine. Whatever was lawfully placed on the market before stays under the directive and need not be re-assessed as long as it is not substantially modified. What is new is that software expressly counts as a safety component, with two qualifiers missing from most summaries: the component must be placed on the market separately, and it must either not be required for the product itself to function or be replaceable by normal components for its operation. Control software inseparable from the machine is therefore not a standalone safety component; a separately sold safety module is.

The second change sits in Article 18: anyone who makes a substantial modification counts as the manufacturer — with all obligations, on sole responsibility. Article 3(16) defines substantial through three cumulative elements, and the third filters out most updates: a change that requires no new guards and no new stability measures is not substantial. The regulation does not turn your maintenance department into a manufacturer; it captures rebuilding a machine into something its maker never intended — and that rebuilding can consist of software alone. What to do concretely is in the Machinery Regulation analysis.

The obligations without a calendar date that run anyway

Beside the eight dates, three regimes run without a deadline. The most visible is NIS2: by 30 September 2026, 20,141 entities had registered with the BSI, while the legislator budgeted for around 30,000. The gap sits mainly among the important entities, the size band from 50 employees, to which Annex 2 of the BSIG expressly assigns mechanical engineering. For management, two provisions decide: section 38 places the implementation and supervision of the measures on the management level and requires its own regular training; and the supply-chain clause pushes the questionnaires of regulated customers down to suppliers sitting far below every threshold. The details are in the NIS2 analysis.

The second running duty is the AI-literacy obligation of Article 4 of the AI Act. It has applied since February 2025, since 27 July 2026 in the weaker version of Regulation (EU) 2026/1744 (measures that support the development of AI literacy are required, not a specific level), and it reaches you whether or not you have sanctioned any AI, because deploying in the sense of the regulation is using it within your area of responsibility. In a company where two-thirds of AI users work around the policy, that is not a clause for the stack but one for training; the figures are in the piece on shadow AI. And since 2 August, on our reading, the right to an explanation under Article 86 has formally applied: affected persons can demand a clear explanation where a decision based on a high-risk AI system listed in Annex III (other than critical infrastructure) has legal or similarly significant effects on them. In practice it only bites from 2 December 2027, because under Article 111(2) as amended by the Omnibus, the regulation applies to high-risk systems placed on the market or put into service before that date only if their design is significantly changed afterwards. High-risk systems intended to be used by public authorities must comply in any case by 2 August 2030 under the same paragraph.

Across the eight deadlines and three running duties a similar pattern repeats: most of them do not attach to the size of your company but to a product, a turnover figure, a function or the question of who decides. The exceptions are the Data Act design obligation and the duty to hand over data, which under Article 7(1) do not apply to connected products and related services of micro and small enterprises without larger partner or linked enterprises unless those enterprises are subcontracted to manufacture or design a connected product or to provide a related service (so the size of the manufacturer or service provider is what counts; medium-sized enterprises get one-year grace periods), and NIS2, which in most sectors only applies from medium size upwards. That is also why these duties are so regularly misclassified in the mid-market: filed as a topic for a corporate legal department instead of for your own week.

What belongs on your desk now

Most of the implementation behind these deadlines is delegable — the classification is not. Concretely, three tasks remain that need no specialist department:

The rest of the list is calendar work: list the products going to market from 20 January; check whether an Annex 2 activity and fifty employees coincide in your house; settle who answers a Data Act request. This article is the map — each linked analysis contains the individual steps. If you take one thing: none of the dates up to 20 January 2027 is a voluntary commitment or a recommendation. These are deadlines, and they apply.

Frequently asked questions about the EU deadlines