How this feed is edited. Official sources only — every item links to the official document or page it reports, with its document reference where one exists. Each item carries two dates: when it happened (event date) and when Trusq verified it against the source. Each update is source-backed and translated into what changed, who is affected and what to check next — see
how a change becomes an action. This is a selective record of what matters for compliance work, not a news wire — anything that cannot be verified against a primary source is not published. Not legal advice.
Upcoming key dates
Deadlineupcoming · 11 Sep 2026
From 11 September 2026, manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents — the CRA's first obligation to bite, ahead of the main requirements in December 2027.
August 2026
Deadline2 Aug 2026
The AI Act's remaining provisions largely apply from 2 August 2026, while Regulation (EU) 2026/1744 sets the high-risk dates at 2 December 2027 for Annex III systems and 2 August 2028 for Annex I embedded systems.
July 2026
Regulatory change27 Jul 2026
Trusq publishes a side-by-side record of every dated effect of Regulation (EU) 2026/1744 on the AI Act — old value, new value and the provision that sets each date — plus a machine-readable version. Timelines compiled before 27 July 2026 still show the original dates.
June 2026
Regulatory change29 Jun 2026
Regulation (EU) 2026/1744 entered into force on 27 July 2026. The AI Act's high-risk deadlines are now 2 December 2027 for Annex III systems and 2 August 2028 for high-risk AI embedded in Annex I products.
May 2026
Guidance19 May 2026
The Commission published draft guidelines on 19 May 2026 on when an AI system is high-risk under Article 6 AI Act, with practical classification examples, for targeted consultation.
November 2025
Regulatory change19 Nov 2025
On 19 November 2025 the Commission proposed the digital omnibus on AI (COM(2025) 836) — targeted amendments to the AI Act's implementation, including the timing of the high-risk requirements.
Enforcement18 Nov 2025
On 18 November 2025 the ESAs published the first list of critical ICT third-party providers under DORA, bringing them under direct EU oversight.
September 2025
Deadline12 Sep 2025
The Data Act has applied since 12 September 2025: users can demand access to connected-product data, B2B sharing terms face fairness rules, and cloud customers hold switching rights.
July 2025
Guidance24 Jul 2025
Since 24 July 2025 there is one mandatory format for the public training-content summary every GPAI provider must publish — a standard artefact to request in AI vendor due diligence.
Guidance18 Jul 2025
Commission guidelines of 18 July 2025 set out who counts as a GPAI provider — including when fine-tuning makes you one — with obligations applying from 2 August 2025 and Commission enforcement from 2 August 2026.
Guidance10 Jul 2025
The voluntary GPAI Code of Practice, published 10 July 2025, gives general-purpose model providers a signable route to demonstrating AI Act compliance — more than 20 providers have signed.
February 2025
Case law27 Feb 2025
The CJEU held on 27 February 2025 (C-203/22) that people are entitled to an intelligible explanation of automated decisions about them — handing over an algorithm is not enough, and trade secrets do not override the right.
Regulatory change20 Feb 2025
Binding DORA incident-report deadlines are in the Official Journal since 20 February 2025: initial notification within 4 hours of classification (max 24 hours from awareness), intermediate report within 72 hours, final report within one month.
Guidance6 Feb 2025
Commission guidelines of 6 February 2025 explain how to determine whether software is an 'AI system' under the AI Act — the gating question for every AI Act obligation.
Guidance4 Feb 2025
Commission guidelines of 4 February 2025 interpret the AI Act's prohibitions — harmful manipulation, social scoring and real-time remote biometric identification, among others — in force since 2 February 2025.
January 2025
Deadline17 Jan 2025
DORA has applied to EU financial entities and their critical ICT providers since 17 January 2025 — a standing evidence obligation across ICT risk, incidents, testing and third-party oversight.
November 2024
Enforcement28 Nov 2024
On 28 November 2024 the Commission opened infringement procedures against 23 Member States for missing the NIS2 transposition deadline — pressure that makes national laws land on short notice.
October 2024
Regulatory change17 Oct 2024
Implementing Regulation (EU) 2024/2690 turns NIS2's open norms into concrete, testable technical requirements — and numeric 'significant incident' thresholds — for DNS, cloud, data-centre, CDN, managed-service and online-platform providers.
Deadline17 Oct 2024
NIS2's national transposition deadline passed on 17 October 2024 — but transposition remains uneven, so what applies to you is set per Member State.
← Back to Trusq