--- title: "EU compliance deadlines 2026-2027: days left, and the document each one wants — CSIDIA" description: "A live counter for EU and Italian obligations: Cyber Resilience Act, NIS2, the Machinery Regulation, pay transparency and the ACN cloud rules. For each deadline, the days remaining and the document it asks you to produce, computed in your browser." url: https://csidia.com/en/tools/compliance-deadlines/ lang: en publisher: CSIDIA S.r.l. (https://csidia.com/) --- [Tools](https://csidia.com/en/tools/) · Updated July 2026 # How long is left on each deadline. The deadlines we track, in date order. The days are counted in your browser against today’s date: the page does not age, and dates already passed stay on the list. These are the same deadlines as the guide on documentation duties: each one asks for a dated document, not a statement of intent. What is added here is the count of days, recalculated on every visit. An information tool, not legal advice and not a conformity assessment. The references are the ones cited entry by entry; the text that counts is the official one. How it works - The days left are computed in the browser against today’s date, not against the publication date. - A deadline is imminent when ninety days or fewer remain; already in force once the date has passed. - The filter removes nothing from the list: it hides the entries that do not concern the audience you pick. Concerns 1. 30 June 2026 **ACN cloud rules: the transitional tolerance is over** Concerns Public administration **Rule** Regulation on digital infrastructure and cloud services for public administration, ACN directorial decree no. 21007/24 of 27 June 2024 (notice in Official Gazette no. 163 of 13 July 2024), art. 11(4) and (10) **Who it concerns** Public administrations and bodies handling critical or strategic data. [The note behind it ACN cloud rules: the 30 June 2026 deadline has passed, and handling critical data is now non-compliant](https://csidia.com/en/notes/cloud-acn-30-giugno-2026-dati-critici-pa/) [The related service Your model, on our infrastructure or yours](https://csidia.com/en/infrastructure/) 2. 12 August 2026 **Packaging Regulation (PPWR): the general obligations are applicable** Concerns Companies **Rule** Regulation (EU) 2025/40, arts. 15-20, 38-39, 44-45, 71 **Who it concerns** Manufacturers, importers, distributors and fulfilment service providers placing or making packaging available on the EU market; producers subject to extended producer responsibility in each Member State where they first sell. [The note behind it EU Packaging Regulation 2025/40: applicable from 12 August, the data sits in five different systems](https://csidia.com/en/notes/imballaggi-ppwr-dato-in-cinque-sistemi/) [The related service Checking technical documents against standards](https://csidia.com/en/capabilities/#standards) 3. 11 September 2026 **Cyber Resilience Act: the reporting duty** Concerns Companies **Rule** Regulation (EU) 2024/2847, art. 14 **Who it concerns** Manufacturers of products with digital elements — connected or connectable hardware and software — including products already on the market. [The note behind it Cyber Resilience Act: the reporting clock starts on 11 September](https://csidia.com/en/notes/cyber-resilience-act-segnalazione-settembre-2026/) [The related service Checking technical documents against standards](https://csidia.com/en/capabilities/#standards) 4. 12 September 2026 **Data Act: product data accessible by design** Not a compliance deadline for the installed base: the duty in art. 3(1) applies to connected products and related services placed on the market after 12 September 2026, product by product. Concerns Companies **Rule** Regulation (EU) 2023/2854 (Data Act), art. 3(1), applicable under art. 50, third paragraph **Who it concerns** Manufacturers of connected products and providers of related services placing them on the Union market after that date; by extension, whoever buys those products and puts them into service. [The note behind it Data Act: your machines’ data is (also) yours](https://csidia.com/en/notes/data-act-dati-macchine-cloud/) [The related service Checking technical documents against standards](https://csidia.com/en/capabilities/#standards) 5. 15 September 2026 **RENTRI: penalties start on missing waste manifests** Concerns Companies **Rule** Legislative Decree no. 152 of 3 April 2006, art. 258, paragraphs 10 and 10-bis **Who it concerns** Entities and businesses already registered with RENTRI and required to transmit waste manifests (FIR) digitally: the three registration windows under art. 13 of Ministerial Decree no. 59 of 4 April 2023 have all now closed, the last one by mid-February 2026. [The note behind it RENTRI: the register is not enough, you need proof the waste arrived](https://csidia.com/en/notes/rentri-prova-rifiuto-arrivato/) [The related service Checking technical documents against standards](https://csidia.com/en/capabilities/#standards) 6. 18 September 2026 **NEWS-D: Italy’s drug early-warning regulation enters into force** Concerns Companies and public bodies **Rule** Italy: DPCM 7 July 2026, no. 156 (Official Gazette, General Series no. 204 of 3 September 2026), implementing Article 14-bis of Presidential Decree 309/1990 **Who it concerns** First- and second-level NEWS-D collaborating centres: public, private and university clinical and forensic toxicology laboratories, forensic medicine institutes, emergency units, poison control centres, police laboratories, and private bodies seeking recognition by an act of the head of the Department. [The note behind it NEWS-D: Italy’s drug early-warning regulation arrives 462 days late](https://csidia.com/en/notes/news-d-regolamento-462-giorni-ritardo/) [The related service Checking technical documents against standards](https://csidia.com/en/capabilities/#standards) 7. 27 September 2026 **Environmental claims: twelve practices join the blacklist, with no case-by-case assessment** Concerns Companies **Rule** Directive (EU) 2024/825, amending Directive 2005/29/EC and Directive 2011/83/EU; in Italy Legislative Decree 20 February 2026, no. 30, whose Article 2 provides that its provisions «si applicano a decorrere dal 27 settembre 2026» (apply from 27 September 2026) **Who it concerns** Anyone making a commercial communication to consumers with environmental content — packaging, product sheets, catalogues, website, advertising — and anyone selling goods with digital elements or a durability guarantee [The note behind it Who has to prove the environmental claim you already printed?](https://csidia.com/en/notes/asserzione-ambientale-chi-la-deve-dimostrare/) [The related service Checking technical documents against standards](https://csidia.com/en/capabilities/#standards) 8. 30 September 2026 **ICT census: public bodies declare what is in the machine room** Concerns Public administration **Rule** Article 33-septies(1-ter) of Decree-Law 179/2012; AgID survey opened on 22 July 2026 **Who it concerns** Central and local public administrations required to answer the questionnaire on their ICT estate. For schools and universities AgID has said the deadline will be announced later: 30 September is not a universal cut-off. [The note behind it ICT census of Italy’s public bodies by 30 September 2026: AgID set the date, not the law](https://csidia.com/en/notes/censimento-ict-pa-30-settembre-2026/) [The related service Your model, on our infrastructure or yours](https://csidia.com/en/infrastructure/) 9. October 2026 **NIS2: the baseline security measures, evidenced** A per-subject deadline: eighteen months from the notice of inclusion in the list, received by the first wave from 12 April 2025 onwards. The count here starts from 12 October 2026, the earliest possible day. Concerns Companies and public bodies **Rule** Italian Legislative Decree 138 of 4 September 2024, arts. 23, 24 and 29, with the deadline set by art. 42(1)(c) and by ACN determination 379907/2025 **Who it concerns** Essential and important entities in the first wave: registered between December 2024 and February 2025, they received their listing notification from 12 April 2025 onwards. [The note behind it NIS2, October 2026: what has to be in the binder when the national cyber agency comes knocking](https://csidia.com/en/notes/nis2-ottobre-2026-prova-documentale/) [The related service Your model, on our infrastructure or yours](https://csidia.com/en/infrastructure/) 10. October 2026 **Annual landfill guarantees: the decree is converted, or it falls retroactively** Concerns Companies **Rule** Italian Decree-Law 154 of 28 August 2026, art. 1, replacing art. 208(11)(g) of Legislative Decree 152 of 3 April 2006; conversion deadline under Article 77, third paragraph, of the Constitution **Who it concerns** Companies admitted to extraordinary administration under Decree-Law 347 of 23 December 2003 — which requires at least five hundred employees for a year and debts of no less than three hundred million euros — running at least one plant declared of national strategic interest under art. 1 of Decree-Law 207 of 3 December 2012, a status conferred by decree of the Prime Minister and presupposing at least two hundred employees for at least a year. A narrow field, drawn by two cross-references rather than by a list. [The note behind it Annual guarantees, a thirty-year obligation: compliance becomes a matter of days](https://csidia.com/en/notes/discariche-garanzia-annuale-conformita-giorno-per-giorno/) [The related service Checking technical documents against standards](https://csidia.com/en/capabilities/#standards) 11. 29 October 2026 **Tracking pixels in email: consent and notice, in writing** Concerns Companies and public bodies **Rule** Italian Data Protection Authority, measure no. 284 of 17 April 2026 — guidelines on the use of tracking pixels in email communications, published in Official Gazette no. 98 of 29 April 2026 **Who it concerns** Anyone placing tracking pixels in email: controllers sending marketing and newsletters, email service providers, operators of bulk email platforms. [The note behind it Tracking pixels in email: what you need in place by 29 October 2026](https://csidia.com/en/notes/tracking-pixel-email-29-ottobre-2026/) [The related service Checking technical documents against standards](https://csidia.com/en/capabilities/#standards) 12. 30 October 2026 **Compliance through data: the national co-financing application** Concerns Companies **Rule** Decreto direttoriale MIMIT 22 settembre 2026, prot. R.0002694, art. 2, attuativo del DM 16 dicembre 2022 come modificato dal DM 13 giugno 2023 (investimento PNRR M4C2 «Partenariati per la ricerca e l’innovazione – Orizzonte Europa») **Who it concerns** Imprese e organismi di ricerca italiani che abbiano presentato una proposta alla call DIGITAL-2026-AI-DATA-10-COMPLIANCE della DG CONNECT sul programma Europa digitale. [The note behind it Compliance through data: two deadlines and a million](https://csidia.com/en/notes/conformita-attraverso-i-dati-due-scadenze-un-milione/) [The related service Checking technical documents against standards](https://csidia.com/en/capabilities/#standards) 13. 9 November 2026 **Masts and fibre trenches: local authorities move to the eleven new forms** Concerns Companies **Rule** Unified Conference Agreement of 10 September 2026 (record of acts no. 108/CU), art. 1, on the forms in Annex 12-bis to legislative decree 259 of 1 August 2003, published in Gazzetta Ufficiale no. 223 of 25 September 2026, Ordinary Supplement no. 38 **Who it concerns** Network operators, civil-works contractors and the practices that file applications, notices and declarations for radio installations, civil works and ultra-broadband — and the authorities that receive them. [The related service Checking technical documents against standards](https://csidia.com/en/capabilities/#standards) 14. 27 November 2026 **Euro 5 diesel: either the decree is converted, or the 2026 date revives** Concerns Companies **Rule** Decreto-legge 28 settembre 2026, n. 167, Article 1, which moves to 1 October 2027 the deadline in the fourth sentence of Article 1(2) of d.l. 121/2023 as converted by l. 155/2023; conversion within sixty days of publication under Article 77, third paragraph, of the Constitution **Who it concerns** Anyone running fleets of Euro 5 diesel cars or N1, N2 and N3 commercial vehicles in Piedmont, Lombardy, Veneto and Emilia-Romagna, and anyone who planned replacements or contract renewals around that date. [The note behind it Euro 5 diesel: the date moved, but it is not the one that stops you](https://csidia.com/en/notes/euro-5-diesel-data-spostata-cosa-resta/) [The related service Checking technical documents against standards](https://csidia.com/en/capabilities/#standards) 15. 9 December 2026 **Product liability: documentation as a defence** Concerns Companies **Rule** Directive (EU) 2024/2853 **Who it concerns** Anyone placing on the market, or integrating, software and AI systems in a product or service under their own brand. [The note behind it The AI Liability Directive Is Dead. The Rule That Actually Matters Still Lands on 9 December 2026](https://csidia.com/en/notes/responsabilita-prodotto-ai-9-dicembre-2026/) [The related service A model trained for your purpose](https://csidia.com/en/what-we-do/) 16. 12 January 2027 **Data Act: switching charges for cloud providers fall away** Concerns Companies and public bodies **Rule** Regulation (EU) 2023/2854 (Data Act), art. 29(1) and (2), with the definition in art. 2(36) **Who it concerns** Providers of data processing services — cloud and edge — and their customers, businesses and public bodies alike. [The note behind it Data Act: your machines’ data is (also) yours](https://csidia.com/en/notes/data-act-dati-macchine-cloud/) [The related service Your model, on our infrastructure or yours](https://csidia.com/en/infrastructure/) 17. 20 January 2027 **Machinery Regulation: the manual decides the CE marking** Concerns Companies **Rule** Regulation (EU) 2023/1230, which repeals Machinery Directive 2006/42/EC on the same date **Who it concerns** Manufacturers of machinery and partly completed machinery, importers and distributors placing products on the Union market. [The note behind it EU Machinery Regulation: no CE marking without compliant manuals from 20 January 2027](https://csidia.com/en/notes/regolamento-macchine-manuali-istruzioni-2027/) [The related service Checking technical documents against standards](https://csidia.com/en/capabilities/#standards) 18. 31 January 2027 **Beneficial ownership: chambers of commerce report their access refusals** Concerns Public administration **Rule** Legislative Decree 21 November 2007, no. 231, Article 21-sexies(9), inserted by Legislative Decree 10 June 2026, no. 122, in force since 23 July 2026 **Who it concerns** The territorially competent chambers of commerce, which decide on requests to exclude access to beneficial ownership data, and indirectly the companies and professionals on the receiving end of those decisions. [The note behind it Beneficial ownership: who can see your data, and how to ask for exclusion](https://csidia.com/en/notes/titolare-effettivo-chi-vede-i-dati-esclusione-accesso/) [The related service Checking technical documents against standards](https://csidia.com/en/capabilities/#standards) 19. 9 February 2027 **DataMatrix on medicines: the old seal can no longer substitute** Concerns Companies **Rule** Legislative Decree No. 10 of 6 February 2025, Art. 13(4), (6) and (9) (transposing Delegated Regulation (EU) 2016/161) **Who it concerns** Manufacturers, wholesalers, pharmacies and healthcare facilities handling medicinal products subject to the unique-identifier regime. [The note behind it Medicines: the old seal ends on 9 February 2027, the batch stays scattered across six systems](https://csidia.com/en/notes/datamatrix-farmaci-sei-sistemi/) [The related service Checking technical documents against standards](https://csidia.com/en/capabilities/#standards) 20. 18 February 2027 **Battery passport: the electronic file becomes mandatory** Concerns Companies **Rule** Regulation (EU) 2023/1542, Art. 77 **Who it concerns** Anyone placing on the market, or putting into service, LMT batteries, industrial batteries with a capacity greater than 2 kWh, and electric vehicle batteries. [The note behind it Battery passport: mandatory from 18 February 2027, and the key data point sits outside the company](https://csidia.com/en/notes/passaporto-batteria-dato-fuori-azienda/) [The related service Checking technical documents against standards](https://csidia.com/en/capabilities/#standards) 21. 15 March 2027 **DORA register of information: annual submission to the Bank of Italy by 15 March** Concerns Companies **Rule** Regulation (EU) 2022/2554, Article 28(3) and (9); Implementing Regulation (EU) 2024/2956; Bank of Italy communication of 13 February 2026 **Who it concerns** Financial entities under Article 2 of Regulation (EU) 2022/2554 supervised by the Bank of Italy [The note behind it The DORA ICT-supplier register: the deadline is fixed, the subcontracting chain is not](https://csidia.com/en/notes/dora-registro-informazioni-catena-subappalto/) [The related service Checking technical documents against standards](https://csidia.com/en/capabilities/#standards) 22. 15 May 2027 **Data centres: the annual sustainability report** Concerns Companies and public bodies **Rule** Directive (EU) 2023/1791, art. 12, and Delegated Regulation (EU) 2024/1364, art. 3(1) **Who it concerns** Owners and operators of data centres in the Union with an installed information technology power demand of at least 500 kW: enterprise, colocation and co-hosting. [The related service Checking technical documents against standards](https://csidia.com/en/capabilities/#standards) 23. 7 June 2027 **Pay transparency: the first report on the gap** Concerns Companies **Rule** Italian Legislative Decree 96 of 7 May 2026, art. 9(9) (deadlines and frequency) and art. 9(8) (the 100-employee threshold); arts. 10 and 11 **Who it concerns** Companies with at least 250 employees, reporting annually, and companies between 150 and 249, with the same first deadline and then every three years. Between 100 and 149 the start is 7 June 2031. [The note behind it Pay Transparency: From 7 June 2027 the Gap Must Be Declared — and Whoever Calculates It Sees Your Payslips](https://csidia.com/en/notes/parita-retributiva-7-giugno-2027-buste-paga/) [The related service Your model, on our infrastructure or yours](https://csidia.com/en/infrastructure/) 24. 30 June 2027 **NIS: the categorised list of activities and services** Concerns Companies **Rule** Italian Legislative Decree 138 of 4 September 2024, art. 30(1), with art. 42(2) and ACN determination no. 155238/2026 **Who it concerns** Essential and important entities on the Italian NIS register, public and private. [The note behind it NIS categorisation: the one duty you judge, not fill in](https://csidia.com/en/notes/nis-categorizzazione-attivita-servizi-30-giugno/) [The related service Your model, on our infrastructure or yours](https://csidia.com/en/infrastructure/) 25. 12 September 2027 **Data Act: unfair terms catch up with old contracts** It covers only contracts concluded on or before 12 September 2025 that are of indefinite duration or expire at least ten years after 11 January 2024. Chapter IV already applies to contracts concluded after 12 September 2025. Concerns Companies **Rule** Regulation (EU) 2023/2854 (Data Act), Chapter IV — art. 13 —, applicable under art. 50, sixth paragraph **Who it concerns** Enterprises that unilaterally imposed terms on data access and use on another enterprise, and the enterprises that had those terms imposed on them. [The note behind it Data Act: your machines’ data is (also) yours](https://csidia.com/en/notes/data-act-dati-macchine-cloud/) [The related service Checking technical documents against standards](https://csidia.com/en/capabilities/#standards) 26. 30 September 2027 **CBAM: the first annual declaration covers the whole of 2026, if the threshold was crossed** Concerns Companies **Rule** Regulation (EU) 2023/956, Article 6(1) and Article 2a, as replaced by Regulation (EU) 2025/2083; Annex VII, point 1; application dates in Article 36(2) **Who it concerns** Importers of cement, iron and steel, aluminium, fertilisers, electricity and hydrogen from third countries, and the indirect customs representatives acting for importers not established in the Union [The note behind it CBAM: the 50-tonne threshold is cumulative](https://csidia.com/en/notes/cbam-soglia-cumulativa-anno-intero/) [The related service Checking technical documents against standards](https://csidia.com/en/capabilities/#standards) 27. 15 October 2027 **Sustainable nuclear: twelve months for the decrees, and an authority still to be created** Concerns Companies **Rule** Legge 29 settembre 2026, n. 169 (enabling act on sustainable nuclear energy), Articles 1, 2, 3 and 5, published in Gazzetta Ufficiale no. 227 of 30 September 2026 and in force since 15 October 2026 **Who it concerns** Companies in the nuclear and component supply chain, holders and operators of installations being decommissioned, operators storing or disposing of radioactive waste and spent fuel, engineering firms and research bodies, and anyone planning long-term electricity supply or investment in the areas concerned. [The note behind it Nuclear enabling act: twelve months to write the rules that will bind you](https://csidia.com/en/notes/delega-nucleare-dodici-mesi-regole-da-scrivere/) [The related service Checking technical documents against standards](https://csidia.com/en/capabilities/#standards) 28. 11 December 2027 **Cyber Resilience Act: technical file and software bill of materials** Concerns Companies **Rule** Regulation (EU) 2024/2847, arts. 13, 28, 30, 31 and 32, Annexes I and VII **Who it concerns** Manufacturers of products with digital elements placed on the Union market. [The note behind it Cyber Resilience Act: no SBOM, no CE marking from 11 December 2027](https://csidia.com/en/notes/cyber-resilience-act-sbom-fascicolo-tecnico-2027/) [The related service Checking technical documents against standards](https://csidia.com/en/capabilities/#standards) ## The full calendar, in a machine-readable form. The JSON file holds the fourteen deadlines on this page plus the ones that sit in the other guide — the AI Act dates and Italy’s law 132/2025 — with dates, audiences, links to the notes and the primary source each entry was checked against. Useful to anyone tracking them in their own calendar or handing them to an assistant. [Download deadlines.json](https://csidia.com/deadlines.json) ## The two AI Act dates rest on the same documents. On 2 December 2027 the obligations on Annex III high-risk systems apply; on 2 August 2028 those on systems embedded in already regulated products, the Machinery Regulation included. The full calendar sits in the dedicated guide. [AI Act: every deadline, in order](https://csidia.com/en/guides/ai-act-deadlines/) Reminders ## The reminder that arrives before the deadline. A monthly summary of the deadlines that concern you, and an alert when one of them enters the thirty-day window. A free information service for institutions and companies: subscription is subject to approval. Free information service, with no obligation on either side. Not legal advice: always check the primary source before acting. The first step ## Book a meeting. Tell us the purpose. We tell you whether an agent or a trained model would do it better than you do today, what it would take (data, compute, time) and which route fits: our infrastructure or yours. If it is not a job for us, we say so. - video call or in person - 30 minutes - free [Book a meeting](https://csidia.com/en/book/?servizio=misura) [or write to engagement@csidia.com](mailto:engagement@csidia.com?subject=First%20meeting%3A%20A%20model%20trained%20for%20your%20purpose) The service A model trained for your purpose An open-weight model trained on your data, on our infrastructure or yours. What it learns stays yours. [What we do](https://csidia.com/en/what-we-do/) [Capabilities](https://csidia.com/en/capabilities/) Page: https://csidia.com/en/tools/compliance-deadlines/ · CSIDIA S.r.l., Vignola (MO), Italy · engagement@csidia.com · index for agents: https://csidia.com/llms.txt