Deadlines for businesses

Act in time.

Many new obligations for businesses have fixed dates. This overview collects those that, in my view, matter most for managing directors and management, each with a short explanation and a link to the source. It focuses on EU law and German law. I update it regularly.

This overview is for orientation only. It is a selection, may change at any time due to new legislation, postponements or case law, and does not replace advice on the individual case. Only the provisions in their current version are authoritative. Last updated: 2 October 2026.

Coming up

  • 20 November 2026 – Consumer credit and “buy now, pay later”. The new consumer credit rules also cover interest-free payment deferrals through third-party providers, with creditworthiness checks and extended information duties; buying on invoice directly from the retailer is exempt only within narrow limits. [Act passed by the Bundestag; promulgation not yet confirmed] (German Bundestag)
  • 2 December 2026 – AI Act: labelling and new prohibitions. AI systems already on the market before 2 August 2026 must now also mark generated content in a machine-readable way. The AI Act also prohibits AI that generates child sexual abuse material or intimate images of people without their consent. [start date of the prohibitions not yet confirmed] (Regulation (EU) 2026/1744)
  • 2 December 2026 – Platform work. The EU Platform Work Directive must be transposed by this date: people who work via a platform and are directed by it are presumed to be employees, and new rules apply to algorithmic management. [German implementing act still pending] (Directive (EU) 2024/2831)
  • 9 December 2026 – New product liability law. Software and AI are products; manufacturers are liable regardless of fault, including for security flaws and defective updates. This applies to products placed on the market from this date. [promulgation of the German act not yet confirmed] (Directive (EU) 2024/2853)
  • 30 December 2026 – Deforestation Regulation (EUDR). Due diligence obligations for commodities such as wood, cocoa, coffee, soy, palm oil, cattle and rubber and products made from them apply to large and medium-sized companies; for micro and small companies from 30 June 2027. (Regulation (EU) 2023/1115)
  • 1 January 2027 – Minimum wage EUR 14.60. The German statutory minimum wage rises from EUR 13.90 to EUR 14.60 per hour; the mini-job threshold rises to EUR 633 per month. (Federal Ministry of Labour and Social Affairs)
  • 1 January 2027 – Issuing e-invoices (Germany). Companies with a prior-year turnover of more than EUR 800,000 must issue e-invoices in domestic B2B business; from 1 January 2028 this applies to all. (Federal Ministry of Finance, FAQ on e-invoicing)
  • 12 January 2027 – Data Act: cloud switching without switching charges. Providers of cloud and other data processing services may no longer charge for switching to another provider. (Regulation (EU) 2023/2854, Art. 29)
  • 18 February 2027 – Batteries Regulation: replaceable batteries. Portable batteries in electrical devices must be easy for end users to remove and replace, with exceptions. [date not yet officially confirmed] (Regulation (EU) 2023/1542)
  • 2027 (expected) – Pay transparency. The EU directive should have been transposed by 7 June 2026. Employers should already review their pay structures for objective, gender-neutral criteria. [no German draft bill yet] (Directive (EU) 2023/970)
  • 12 September 2027 – Data Act: fair terms in older contracts too. The review of unfair data-sharing terms between businesses then also covers open-ended or long-term contracts concluded before 12 September 2025. [not yet officially confirmed] (Regulation (EU) 2023/2854)
  • 2 December 2027 – AI Act: high-risk systems. Following the postponement by the Digital Omnibus, the obligations for stand-alone high-risk AI (for example in HR) apply only from this date; for AI in regulated products from 2 August 2028. (Regulation (EU) 2024/1689)
  • 11 December 2027 – Cyber Resilience Act in full. Products with digital elements must then meet all cybersecurity requirements to be sold in the EU. (Regulation (EU) 2024/2847)

Already in force

  • 27 September 2026 – Environmental claims. Generic claims such as “environmentally friendly” or “climate neutral” through offsetting, and private sustainability labels without certification, are largely prohibited towards consumers; new information duties on durability and reparability. (Directive (EU) 2024/825)
  • 12 September 2026 – Data Act: data access by design. Newly placed connected products must be designed so that users can easily access their data. The other obligations have applied since 12 September 2025. (Regulation (EU) 2023/2854)
  • 11 September 2026 – Cyber Resilience Act: reporting obligations. Manufacturers must report actively exploited vulnerabilities and severe security incidents via ENISA’s reporting platform: early warning within 24 hours, notification within 72 hours, followed by a final report. (European Commission)
  • 12 August 2026 – EU Packaging Regulation. The Packaging Regulation has applied directly since this date; in Germany, a new implementing act replaces the Packaging Act. Further duties, such as uniform labelling, follow in stages. [entry into force of the German act not yet confirmed] (Regulation (EU) 2025/40)
  • 2 August 2026 – AI Act: transparency obligations. Those who use AI systems must, among other things, disclose when people are interacting with an AI and label deepfakes. (Regulation (EU) 2024/1689)
  • 31 July 2026 – Right to repair. Manufacturers of certain products must repair on request; spare parts and repair information must be available. (Directive (EU) 2024/1799)
  • 19 June 2026 – Withdrawal button (Germany). Anyone concluding contracts with consumers online must provide a withdrawal function that makes withdrawing as easy as concluding the contract. (Section 356a German Civil Code)
  • 6 December 2025 – NIS2 and the German BSI Act (BSIG). The new BSIG obliges around 29,000 companies to implement risk management, report incidents and register with the BSI (the deadline was 6 March 2026). Management must approve and monitor the measures and undergo training; it is personally liable. (Federal Office for Information Security)
  • 28 June 2025 – Accessibility. Many digital products and services for consumers, including online shops, must be accessible. (German Accessibility Strengthening Act)
  • 2 February 2025 – AI literacy and prohibitions. Certain AI practices have been prohibited since this date. Anyone using AI must support the AI literacy of their staff; since 27 July 2026 this is a duty to support, without a fixed minimum level. (Regulation (EU) 2026/1744)
  • 1 January 2025 – Receiving e-invoices (Germany). All companies must be able to receive and process e-invoices in domestic B2B business. (Federal Ministry of Finance, FAQ on e-invoicing)
  • 13 December 2024 – Product safety in online retail (GPSR). Online sellers must state, among other things, the manufacturer, the responsible person in the EU, a product identifier and warning and safety information in their listings. (Regulation (EU) 2023/988)
  • 1 July 2022 – Cancellation button (Germany). Subscriptions and other ongoing contracts concluded online must be cancellable online. According to the Federal Court of Justice (16 July 2026, I ZR 200/25), the confirmation page may only ask for the necessary details and must not offer alternatives such as pausing. (Section 312k German Civil Code)

Next steps

I offer training on many of these topics for management and staff. If you would like to know which dates concern your company specifically, please get in touch; how we work together is explained under How we work together. You can write to me in English or German.

Call Now Button