{"id":3222,"date":"2026-09-28T13:15:24","date_gmt":"2026-09-28T11:15:24","guid":{"rendered":"https:\/\/bauer.legal\/deadlines-for-businesses\/"},"modified":"2026-09-28T13:15:24","modified_gmt":"2026-09-28T11:15:24","slug":"deadlines-for-businesses","status":"publish","type":"page","link":"https:\/\/bauer.legal\/en\/deadlines-for-businesses\/","title":{"rendered":"Deadlines for businesses"},"content":{"rendered":"\n<p class=\"has-text-align-center wp-block-paragraph\"><strong>Act in time.<\/strong><\/p>\n\n\n\n<p class=\"has-text-align-justify wp-block-paragraph\">Many new obligations for businesses have fixed dates. This overview collects those that, in my view, matter most for managing directors and management, each with a short explanation and a link to the source. It focuses on EU law and German law. I update it regularly.<\/p>\n\n\n\n<p class=\"has-text-align-justify has-extra-small-font-size wp-block-paragraph\">This overview is for orientation only. It is a selection, may change at any time due to new legislation, postponements or case law, and does not replace advice on the individual case. Only the provisions in their current version are authoritative. Last updated: 28 September 2026.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" style=\"font-size:1.5rem\">Coming up<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>2 December 2026<\/strong> \u2013 AI Act: labelling of AI-generated content. For systems already on the market before 2 August 2026, the transition period for machine-readable labelling (such as watermarks) ends. (<a href=\"https:\/\/eur-lex.europa.eu\/eli\/reg\/2024\/1689\/oj\" target=\"_blank\" rel=\"noreferrer noopener\">Regulation (EU) 2024\/1689<\/a>)<\/li>\n\n\n<li><strong>9 December 2026<\/strong> \u2013 New product liability law. Software and AI are expressly treated as products; liability for defects therefore also applies to software providers. (<a href=\"https:\/\/eur-lex.europa.eu\/eli\/dir\/2024\/2853\/oj\" target=\"_blank\" rel=\"noreferrer noopener\">Directive (EU) 2024\/2853<\/a>)<\/li>\n\n\n<li><strong>30 December 2026<\/strong> \u2013 Deforestation Regulation (EUDR). Due diligence obligations for commodities such as wood, cocoa, coffee, soy, palm oil, cattle and rubber and products made from them apply to large and medium-sized companies; for micro and small companies from 30 June 2027. (<a href=\"https:\/\/eur-lex.europa.eu\/eli\/reg\/2023\/1115\/oj\" target=\"_blank\" rel=\"noreferrer noopener\">Regulation (EU) 2023\/1115<\/a>)<\/li>\n\n\n<li><strong>1 January 2027<\/strong> \u2013 Issuing e-invoices (Germany). Companies with a prior-year turnover of more than EUR 800,000 must issue e-invoices in domestic B2B business; from 1 January 2028 this applies to all. (<a href=\"https:\/\/www.bundesfinanzministerium.de\/Content\/DE\/FAQ\/e-rechnung.html\" target=\"_blank\" rel=\"noreferrer noopener\">Federal Ministry of Finance, FAQ on e-invoicing<\/a>)<\/li>\n\n\n<li><strong>2027 (expected)<\/strong> \u2013 Pay transparency. The EU directive should have been transposed by 7 June 2026; the German act is expected in 2027. Pay structures can still be reviewed calmly now. (<a href=\"https:\/\/eur-lex.europa.eu\/eli\/dir\/2023\/970\/oj\" target=\"_blank\" rel=\"noreferrer noopener\">Directive (EU) 2023\/970<\/a>)<\/li>\n\n\n<li><strong>11 December 2027<\/strong> \u2013 Cyber Resilience Act in full. Products with digital elements must then meet all cybersecurity requirements to be sold in the EU. (<a href=\"https:\/\/eur-lex.europa.eu\/eli\/reg\/2024\/2847\/oj\" target=\"_blank\" rel=\"noreferrer noopener\">Regulation (EU) 2024\/2847<\/a>)<\/li>\n\n\n<li><strong>2 December 2027<\/strong> \u2013 AI Act: high-risk systems. Following the postponement by the Digital Omnibus, the obligations for stand-alone high-risk AI (for example in HR) apply only from this date; for AI in regulated products from 2 August 2028. (<a href=\"https:\/\/eur-lex.europa.eu\/eli\/reg\/2024\/1689\/oj\" target=\"_blank\" rel=\"noreferrer noopener\">Regulation (EU) 2024\/1689<\/a>)<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" style=\"font-size:1.5rem\">Already in force<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>27 September 2026<\/strong> \u2013 Environmental claims. Generic claims such as \u201cenvironmentally friendly\u201d or \u201cclimate neutral\u201d through offsetting, and private sustainability labels without certification, are largely prohibited towards consumers; new information duties on durability and reparability. (<a href=\"https:\/\/eur-lex.europa.eu\/eli\/dir\/2024\/825\/oj\" target=\"_blank\" rel=\"noreferrer noopener\">Directive (EU) 2024\/825<\/a>)<\/li>\n\n\n<li><strong>12 September 2026<\/strong> \u2013 Data Act: data access by design. Newly placed connected products must be designed so that users can easily access their data. The other obligations have applied since 12 September 2025. (<a href=\"https:\/\/eur-lex.europa.eu\/eli\/reg\/2023\/2854\/oj\" target=\"_blank\" rel=\"noreferrer noopener\">Regulation (EU) 2023\/2854<\/a>)<\/li>\n\n\n<li><strong>11 September 2026<\/strong> \u2013 Cyber Resilience Act: reporting obligations. Manufacturers must report actively exploited vulnerabilities and severe security incidents in their products within short deadlines. (<a href=\"https:\/\/eur-lex.europa.eu\/eli\/reg\/2024\/2847\/oj\" target=\"_blank\" rel=\"noreferrer noopener\">Regulation (EU) 2024\/2847<\/a>)<\/li>\n\n\n<li><strong>2 August 2026<\/strong> \u2013 AI Act: transparency obligations. Those who use AI systems must, among other things, disclose when people are interacting with an AI and label deepfakes. (<a href=\"https:\/\/eur-lex.europa.eu\/eli\/reg\/2024\/1689\/oj\" target=\"_blank\" rel=\"noreferrer noopener\">Regulation (EU) 2024\/1689<\/a>)<\/li>\n\n\n<li><strong>31 July 2026<\/strong> \u2013 Right to repair. Manufacturers of certain products must repair on request; spare parts and repair information must be available. (<a href=\"https:\/\/eur-lex.europa.eu\/eli\/dir\/2024\/1799\/oj\" target=\"_blank\" rel=\"noreferrer noopener\">Directive (EU) 2024\/1799<\/a>)<\/li>\n\n\n<li><strong>19 June 2026<\/strong> \u2013 Withdrawal button (Germany). Anyone concluding contracts with consumers online must provide a withdrawal function that makes withdrawing as easy as concluding the contract. (<a href=\"https:\/\/www.gesetze-im-internet.de\/bgb\/__356a.html\" target=\"_blank\" rel=\"noreferrer noopener\">Section 356a German Civil Code<\/a>)<\/li>\n\n\n<li><strong>6 December 2025<\/strong> \u2013 NIS2 and the German BSI Act (BSIG). The new BSIG obliges around 29,000 companies to implement risk management, report incidents and register with the BSI (the deadline was 6 March 2026). Management must approve and monitor the measures and undergo training; it is personally liable. (<a href=\"https:\/\/www.bsi.bund.de\/EN\/\" target=\"_blank\" rel=\"noreferrer noopener\">Federal Office for Information Security<\/a>)<\/li>\n\n\n<li><strong>28 June 2025<\/strong> \u2013 Accessibility. Many digital products and services for consumers, including online shops, must be accessible. (<a href=\"https:\/\/www.gesetze-im-internet.de\/bfsg\/\" target=\"_blank\" rel=\"noreferrer noopener\">German Accessibility Strengthening Act<\/a>)<\/li>\n\n\n<li><strong>2 February 2025<\/strong> \u2013 AI literacy and prohibitions. Companies using AI must promote the AI literacy of their staff; certain AI practices are prohibited. (<a href=\"https:\/\/eur-lex.europa.eu\/eli\/reg\/2024\/1689\/oj\" target=\"_blank\" rel=\"noreferrer noopener\">Regulation (EU) 2024\/1689<\/a>)<\/li>\n\n\n<li><strong>1 January 2025<\/strong> \u2013 Receiving e-invoices (Germany). All companies must be able to receive and process e-invoices in domestic B2B business. (<a href=\"https:\/\/www.bundesfinanzministerium.de\/Content\/DE\/FAQ\/e-rechnung.html\" target=\"_blank\" rel=\"noreferrer noopener\">Federal Ministry of Finance, FAQ on e-invoicing<\/a>)<\/li>\n\n\n<li><strong>1 July 2022<\/strong> \u2013 Cancellation button (Germany). Anyone concluding continuing obligations with consumers online must provide a cancellation button. (<a href=\"https:\/\/www.gesetze-im-internet.de\/bgb\/__312k.html\" target=\"_blank\" rel=\"noreferrer noopener\">Section 312k German Civil Code<\/a>)<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" style=\"font-size:1.5rem\">Next steps<\/h2>\n\n\n\n<p class=\"has-text-align-justify wp-block-paragraph\">I offer <a href=\"https:\/\/bauer.legal\/en\/it-compliance-training-online\/\">training<\/a> on many of these topics for management and staff. If you would like to know which dates concern your company specifically, please get in touch; how we work together is explained under <a href=\"https:\/\/bauer.legal\/en\/how-we-work-together\/\">How we work together<\/a>. You can write to me in English or German.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Act in time. Many new obligations for businesses have fixed dates. This overview collects those that, in my view, matter most for managing directors and management, each with a short explanation and a link to the source. It focuses on EU law and German law. I update it regularly. This overview is for orientation only.&hellip; <a class=\"more-link\" href=\"https:\/\/bauer.legal\/en\/deadlines-for-businesses\/\">Continue reading <span class=\"screen-reader-text\">Deadlines for businesses<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_editorskit_title_hidden":false,"_editorskit_reading_time":0,"_editorskit_is_block_options_detached":false,"_editorskit_block_options_position":"{}","footnotes":"","_genesis_title":"Deadlines for businesses: key dates 2025 to 2028","_genesis_description":"Key dates for management under EU and German law: AI Act, NIS2\/BSIG, Data Act, Cyber Resilience Act, e-invoicing, environmental claims, withdrawal button and more \u2013 updated regularly.","_tsf_title_no_blogname":0,"_genesis_noindex":0},"class_list":["post-3222","page","type-page","status-publish","hentry","entry"],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/bauer.legal\/en\/wp-json\/wp\/v2\/pages\/3222","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bauer.legal\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/bauer.legal\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/bauer.legal\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/bauer.legal\/en\/wp-json\/wp\/v2\/comments?post=3222"}],"version-history":[{"count":0,"href":"https:\/\/bauer.legal\/en\/wp-json\/wp\/v2\/pages\/3222\/revisions"}],"wp:attachment":[{"href":"https:\/\/bauer.legal\/en\/wp-json\/wp\/v2\/media?parent=3222"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}