Deadlines for businesses

Act in time.

Many new obligations for businesses have fixed dates. This overview collects those that, in my view, matter most for managing directors and management, each with a short explanation and a link to the source. It focuses on EU law and German law. I update it regularly.

This overview is for orientation only. It is a selection, may change at any time due to new legislation, postponements or case law, and does not replace advice on the individual case. Only the provisions in their current version are authoritative. Last updated: 28 September 2026.

Coming up

  • 2 December 2026 – AI Act: labelling of AI-generated content. For systems already on the market before 2 August 2026, the transition period for machine-readable labelling (such as watermarks) ends. (Regulation (EU) 2024/1689)
  • 9 December 2026 – New product liability law. Software and AI are expressly treated as products; liability for defects therefore also applies to software providers. (Directive (EU) 2024/2853)
  • 30 December 2026 – Deforestation Regulation (EUDR). Due diligence obligations for commodities such as wood, cocoa, coffee, soy, palm oil, cattle and rubber and products made from them apply to large and medium-sized companies; for micro and small companies from 30 June 2027. (Regulation (EU) 2023/1115)
  • 1 January 2027 – Issuing e-invoices (Germany). Companies with a prior-year turnover of more than EUR 800,000 must issue e-invoices in domestic B2B business; from 1 January 2028 this applies to all. (Federal Ministry of Finance, FAQ on e-invoicing)
  • 2027 (expected) – Pay transparency. The EU directive should have been transposed by 7 June 2026; the German act is expected in 2027. Pay structures can still be reviewed calmly now. (Directive (EU) 2023/970)
  • 11 December 2027 – Cyber Resilience Act in full. Products with digital elements must then meet all cybersecurity requirements to be sold in the EU. (Regulation (EU) 2024/2847)
  • 2 December 2027 – AI Act: high-risk systems. Following the postponement by the Digital Omnibus, the obligations for stand-alone high-risk AI (for example in HR) apply only from this date; for AI in regulated products from 2 August 2028. (Regulation (EU) 2024/1689)

Already in force

  • 27 September 2026 – Environmental claims. Generic claims such as “environmentally friendly” or “climate neutral” through offsetting, and private sustainability labels without certification, are largely prohibited towards consumers; new information duties on durability and reparability. (Directive (EU) 2024/825)
  • 12 September 2026 – Data Act: data access by design. Newly placed connected products must be designed so that users can easily access their data. The other obligations have applied since 12 September 2025. (Regulation (EU) 2023/2854)
  • 11 September 2026 – Cyber Resilience Act: reporting obligations. Manufacturers must report actively exploited vulnerabilities and severe security incidents in their products within short deadlines. (Regulation (EU) 2024/2847)
  • 2 August 2026 – AI Act: transparency obligations. Those who use AI systems must, among other things, disclose when people are interacting with an AI and label deepfakes. (Regulation (EU) 2024/1689)
  • 31 July 2026 – Right to repair. Manufacturers of certain products must repair on request; spare parts and repair information must be available. (Directive (EU) 2024/1799)
  • 19 June 2026 – Withdrawal button (Germany). Anyone concluding contracts with consumers online must provide a withdrawal function that makes withdrawing as easy as concluding the contract. (Section 356a German Civil Code)
  • 6 December 2025 – NIS2 and the German BSI Act (BSIG). The new BSIG obliges around 29,000 companies to implement risk management, report incidents and register with the BSI (the deadline was 6 March 2026). Management must approve and monitor the measures and undergo training; it is personally liable. (Federal Office for Information Security)
  • 28 June 2025 – Accessibility. Many digital products and services for consumers, including online shops, must be accessible. (German Accessibility Strengthening Act)
  • 2 February 2025 – AI literacy and prohibitions. Companies using AI must promote the AI literacy of their staff; certain AI practices are prohibited. (Regulation (EU) 2024/1689)
  • 1 January 2025 – Receiving e-invoices (Germany). All companies must be able to receive and process e-invoices in domestic B2B business. (Federal Ministry of Finance, FAQ on e-invoicing)
  • 1 July 2022 – Cancellation button (Germany). Anyone concluding continuing obligations with consumers online must provide a cancellation button. (Section 312k German Civil Code)

Next steps

I offer training on many of these topics for management and staff. If you would like to know which dates concern your company specifically, please get in touch; how we work together is explained under How we work together. You can write to me in English or German.

Call Now Button