Last updated: 11 July 2026
Your 2026 EU compliance calendar is wrong. Omnibus I entered into force on 18 March 2026 and removed roughly 80% of companies from mandatory CSRD scope in a single directive. Listed SMEs are out entirely. The CS3D phased rollout is abolished. And on 29 June 2026 the Council gave final adoption to the Digital Omnibus on AI, moving the high-risk deadline from 2 August 2026 to 2 December 2027. Only publication in the Official Journal remains. Until it appears, 2 August 2026 is still the binding date on paper.
For the AI Act on its own, our AI Act compliance deadlines breakdown tracks every date by risk category, including the obligations that still land on 2 August 2026 regardless of the delay.
Below is every major EU compliance deadline from 2025 to 2028 across 14 regulations. Each date traces to a specific Article and EUR-Lex reference. Dates affected by Omnibus legislation are flagged with ✱.
Omnibus I is in force. The AI Act delay is adopted but waits on the Official Journal
Two packages reshaped this calendar in 2026. They no longer sit in different legal positions, but they are not yet in the same one either.
Omnibus I (Directive (EU) 2026/470) is done. Published, in force, enforceable since 18 March 2026. CSRD thresholds now require both more than 1,000 employees and more than €450 million turnover. Fall below either number and mandatory reporting no longer applies. The simplified ESRS consultation closed 3 June 2026. Commission adoption deadline is 18 September 2026. Member states must transpose by 19 March 2027.
The Digital Omnibus on AI closed its legislative procedure on 29 June 2026, when the Council gave final adoption following the Parliament’s vote on 16 June. Only publication in the Official Journal remains, and the regulation enters into force on the third day after it appears. The race is now against the EU’s own printing press: the text must be published before 2 August 2026, the very deadline it exists to move. Once it is, Annex III high-risk systems get until 2 December 2027 and Annex I product-embedded systems until 2 August 2028. Two things the Omnibus does not touch. Article 50 transparency obligations still apply from 2 August 2026. And generative systems already on the market before that date must watermark their output by 2 December 2026.
14 regulations from the AI Act to Pay Transparency
The tracker covers the AI Act, NIS2, DORA, CSRD (post-Omnibus I), Cyber Resilience Act, CS3D/CSDDD, Data Act, CBAM, EU Deforestation Regulation, AML Package, Product Liability Directive, European Health Data Space, Pay Transparency Directive, and the European Accessibility Act.
Each date cites the EUR-Lex publication reference and the Article that establishes it. Items flagged with ✱ reflect Omnibus legislation, with the current legal status of each AI Act date carried in its label. All entries were verified against primary sources on 11 July 2026.
Missing a regulation? Email info@regdossier.eu.
Deadlines are one half of the risk. What regulators have actually done with them so far is the other, and every confirmed fine and formal enforcement action under all eight frameworks sits on one page, verified against primary sources.
Not sure which deadlines apply to your organisation? Take the free AI Act Readiness Assessment.
What compliance officers keep asking about these deadlines
Has the EU AI Act high-risk deadline been delayed?
Formally adopted, one step from binding. The Council gave final adoption to the Digital Omnibus on AI on 29 June 2026, following the Parliament’s vote on 16 June. The Annex III deadline moves from 2 August 2026 to 2 December 2027 once the regulation is published in the Official Journal, expected in July 2026. Until publication, 2 August 2026 formally stands. Article 50 transparency obligations are not delayed at all and apply from 2 August 2026. The deadline everyone talks about moved. The one that covers your customer-facing AI did not.
What did Omnibus I change for CSRD?
Mandatory reporting now applies only to companies exceeding both more than 1,000 employees and more than €450 million net turnover. Below either threshold and you are out. Listed SMEs were removed entirely. Wave 2 companies meeting the new thresholds file first reports in 2028 for financial year 2027 under the simplified ESRS.
Which EU countries have transposed NIS2?
Germany, Italy, Belgium, Croatia, Hungary and Sweden have transposing laws in force. The Netherlands adopted the Cyberbeveiligingswet on 7 July 2026; it applies from 15 August 2026, with NCSC registration obligatory from day one. Austria adopted NISG 2026, in force from 1 October 2026 with registration due by 31 December. France missed the July 2026 extraordinary session entirely and now expects a parliamentary debate in autumn. Poland and Spain remain pending. The tracker includes an expandable NIS2 country panel with supervisory authority details per state. Check whether NIS2 applies to your organisation.
When does the Cyber Resilience Act start applying?
11 September 2026. From that date, manufacturers must report actively exploited vulnerabilities to ENISA within 24 hours. That is the first CRA obligation to take effect. Full application including cybersecurity requirements, CE marking, and conformity assessment follows on 11 December 2027.
What are the maximum fines under the AI Act?
The AI Act has three penalty tiers. Prohibited practices under Article 5 carry penalties up to €35 million or 7% of global annual turnover. Breaches of the other obligations, including the high-risk requirements, carry up to €15 million or 3% under Article 99(4). Supplying incorrect information to authorities carries up to €7.5 million or 1%. The €30 million or 6% figure still circulating in older guides comes from the 2021 Commission proposal, not the adopted regulation. Calculate the fine exposure for your organisation.
When is the first CBAM payment due?
30 September 2027. The CBAM Simplification Regulation (EU) 2025/2083 moved both the annual declaration and the certificate surrender for 2026 imports from 31 May to 30 September 2027. Certificate sales open on 1 February 2027, priced on 2026 EU ETS averages. Importers whose annual imports of covered goods stay below 50 tonnes are exempt from CBAM obligations entirely.
Does CSRD still apply after Omnibus I?
Only if you exceed both thresholds simultaneously. More than 1,000 employees AND more than €450 million net turnover. Fall below either one and mandatory reporting does not apply. Listed SMEs are out entirely. Voluntary reporting under ESRS remains possible from financial year 2026.
When must employers comply with the Pay Transparency Directive?
Member states must transpose by 7 June 2026. After transposition, reporting obligations phase in by company size. Employers with 250+ employees file their first report by 7 June 2027 using 2026 pay data. Employers with 150 to 249 employees also report by June 2027, then every three years. The 100 to 149 bracket follows from 7 June 2031.
This page is for informational purposes only and does not constitute legal advice. EU regulations are subject to member state transposition and interpretation. Consult qualified professionals for your specific situation.