IT EN DE
Start a trial

Tools · Updated July 2026

How long is left on each deadline.

The deadlines we track, in date order. The days are counted in your browser against today’s date: the page does not age, and dates already passed stay on the list.

These are the same deadlines as the guide on documentation duties: each one asks for a dated document, not a statement of intent. What is added here is the count of days, recalculated on every visit.

An information tool, not legal advice and not a conformity assessment. The references are the ones cited entry by entry; the text that counts is the official one.

Concerns

  1. ACN cloud rules: the transitional tolerance is over

    Concerns Public administration

    Rule
    Regulation on digital infrastructure and cloud services for public administration, ACN directorial decree no. 21007/24 of 27 June 2024 (notice in Official Gazette no. 163 of 13 July 2024), art. 11(4) and (10)
    Who it concerns
    Public administrations and bodies handling critical or strategic data.
    The note behind it ACN cloud rules: the 30 June 2026 deadline has passed, and handling critical data is now non-compliant The system that solves this problem Data protection and perimeter

  2. Packaging Regulation (PPWR): the general obligations are applicable

    Concerns Companies

    Rule
    Regulation (EU) 2025/40, arts. 15-20, 38-39, 44-45, 71
    Who it concerns
    Manufacturers, importers, distributors and fulfilment service providers placing or making packaging available on the EU market; producers subject to extended producer responsibility in each Member State where they first sell.
    The note behind it EU Packaging Regulation 2025/40: applicable from 12 August, the data sits in five different systems The system that solves this problem Assisted document review

  3. Cyber Resilience Act: the reporting duty

    Concerns Companies

    Rule
    Regulation (EU) 2024/2847, art. 14
    Who it concerns
    Manufacturers of products with digital elements — connected or connectable hardware and software — including products already on the market.
    The note behind it Cyber Resilience Act: the reporting clock starts on 11 September The system that solves this problem Assisted document review

  4. Data Act: product data accessible by design

    Not a compliance deadline for the installed base: the duty in art. 3(1) applies to connected products and related services placed on the market after 12 September 2026, product by product.

    Concerns Companies

    Rule
    Regulation (EU) 2023/2854 (Data Act), art. 3(1), applicable under art. 50, third paragraph
    Who it concerns
    Manufacturers of connected products and providers of related services placing them on the Union market after that date; by extension, whoever buys those products and puts them into service.
    The note behind it Data Act: your machines’ data is (also) yours The system that solves this problem Assisted document review

  5. RENTRI: penalties start on missing waste manifests

    Concerns Companies

    Rule
    Legislative Decree no. 152 of 3 April 2006, art. 258, paragraphs 10 and 10-bis
    Who it concerns
    Entities and businesses already registered with RENTRI and required to transmit waste manifests (FIR) digitally: the three registration windows under art. 13 of Ministerial Decree no. 59 of 4 April 2023 have all now closed, the last one by mid-February 2026.
    The note behind it RENTRI: the register is not enough, you need proof the waste arrived The system that solves this problem Assisted document review

  6. NEWS-D: Italy’s drug early-warning regulation enters into force

    Concerns Companies and public bodies

    Rule
    Italy: DPCM 7 July 2026, no. 156 (Official Gazette, General Series no. 204 of 3 September 2026), implementing Article 14-bis of Presidential Decree 309/1990
    Who it concerns
    First- and second-level NEWS-D collaborating centres: public, private and university clinical and forensic toxicology laboratories, forensic medicine institutes, emergency units, poison control centres, police laboratories, and private bodies seeking recognition by an act of the head of the Department.
    The note behind it NEWS-D: Italy’s drug early-warning regulation arrives 462 days late The system that solves this problem Assisted document review

  7. ICT census: public bodies declare what is in the machine room

    Concerns Public administration

    Rule
    Article 33-septies(1-ter) of Decree-Law 179/2012; AgID survey opened on 22 July 2026
    Who it concerns
    Central and local public administrations required to answer the questionnaire on their ICT estate. For schools and universities AgID has said the deadline will be announced later: 30 September is not a universal cut-off.
    The note behind it ICT census of Italy’s public bodies by 30 September 2026: AgID set the date, not the law The system that solves this problem Data protection and perimeter

  8. NIS2: the baseline security measures, evidenced

    A per-subject deadline: eighteen months from the notice of inclusion in the list, received by the first wave from 12 April 2025 onwards. The count here starts from 12 October 2026, the earliest possible day.

    Concerns Companies and public bodies

    Rule
    Italian Legislative Decree 138 of 4 September 2024, arts. 23, 24 and 29, with the deadline set by art. 42(1)(c) and by ACN determination 379907/2025
    Who it concerns
    Essential and important entities in the first wave: registered between December 2024 and February 2025, they received their listing notification from 12 April 2025 onwards.
    The note behind it NIS2, October 2026: what has to be in the binder when the national cyber agency comes knocking The system that solves this problem Data protection and perimeter

  9. Annual landfill guarantees: the decree is converted, or it falls retroactively

    Concerns Companies

    Rule
    Italian Decree-Law 154 of 28 August 2026, art. 1, replacing art. 208(11)(g) of Legislative Decree 152 of 3 April 2006; conversion deadline under Article 77, third paragraph, of the Constitution
    Who it concerns
    Companies admitted to extraordinary administration under Decree-Law 347 of 23 December 2003 — which requires at least five hundred employees for a year and debts of no less than three hundred million euros — running at least one plant declared of national strategic interest under art. 1 of Decree-Law 207 of 3 December 2012, a status conferred by decree of the Prime Minister and presupposing at least two hundred employees for at least a year. A narrow field, drawn by two cross-references rather than by a list.
    The note behind it Annual guarantees, a thirty-year obligation: compliance becomes a matter of days The system that solves this problem Assisted document review

  10. Tracking pixels in email: consent and notice, in writing

    Concerns Companies and public bodies

    Rule
    Italian Data Protection Authority, measure no. 284 of 17 April 2026 — guidelines on the use of tracking pixels in email communications, published in Official Gazette no. 98 of 29 April 2026
    Who it concerns
    Anyone placing tracking pixels in email: controllers sending marketing and newsletters, email service providers, operators of bulk email platforms.
    The note behind it Tracking pixels in email: what you need in place by 29 October 2026 The system that solves this problem Assisted document review

  11. Product liability: documentation as a defence

    Concerns Companies

    Rule
    Directive (EU) 2024/2853
    Who it concerns
    Anyone placing on the market, or integrating, software and AI systems in a product or service under their own brand.
    The note behind it The AI Liability Directive Is Dead. The Rule That Actually Matters Still Lands on 9 December 2026 The system that solves this problem Governance of AI systems

  12. Data Act: switching charges for cloud providers fall away

    Concerns Companies and public bodies

    Rule
    Regulation (EU) 2023/2854 (Data Act), art. 29(1) and (2), with the definition in art. 2(36)
    Who it concerns
    Providers of data processing services — cloud and edge — and their customers, businesses and public bodies alike.
    The note behind it Data Act: your machines’ data is (also) yours The system that solves this problem Data protection and perimeter

  13. Machinery Regulation: the manual decides the CE marking

    Concerns Companies

    Rule
    Regulation (EU) 2023/1230, which repeals Machinery Directive 2006/42/EC on the same date
    Who it concerns
    Manufacturers of machinery and partly completed machinery, importers and distributors placing products on the Union market.
    The note behind it EU Machinery Regulation: no CE marking without compliant manuals from 20 January 2027 The system that solves this problem Assisted document review

  14. DataMatrix on medicines: the old seal can no longer substitute

    Concerns Companies

    Rule
    Legislative Decree No. 10 of 6 February 2025, Art. 13(4), (6) and (9) (transposing Delegated Regulation (EU) 2016/161)
    Who it concerns
    Manufacturers, wholesalers, pharmacies and healthcare facilities handling medicinal products subject to the unique-identifier regime.
    The note behind it Medicines: the old seal ends on 9 February 2027, the batch stays scattered across six systems The system that solves this problem Assisted document review

  15. Battery passport: the electronic file becomes mandatory

    Concerns Companies

    Rule
    Regulation (EU) 2023/1542, Art. 77
    Who it concerns
    Anyone placing on the market, or putting into service, LMT batteries, industrial batteries with a capacity greater than 2 kWh, and electric vehicle batteries.
    The note behind it Battery passport: mandatory from 18 February 2027, and the key data point sits outside the company The system that solves this problem Assisted document review

  16. DORA register of information: annual submission to the Bank of Italy by 15 March

    Concerns Companies

    Rule
    Regulation (EU) 2022/2554, Article 28(3) and (9); Implementing Regulation (EU) 2024/2956; Bank of Italy communication of 13 February 2026
    Who it concerns
    Financial entities under Article 2 of Regulation (EU) 2022/2554 supervised by the Bank of Italy
    The note behind it The DORA ICT-supplier register: the deadline is fixed, the subcontracting chain is not The system that solves this problem Assisted document review

  17. Data centres: the annual sustainability report

    Concerns Companies and public bodies

    Rule
    Directive (EU) 2023/1791, art. 12, and Delegated Regulation (EU) 2024/1364, art. 3(1)
    Who it concerns
    Owners and operators of data centres in the Union with an installed information technology power demand of at least 500 kW: enterprise, colocation and co-hosting.
    The system that solves this problem Assisted document review

  18. Pay transparency: the first report on the gap

    Concerns Companies

    Rule
    Italian Legislative Decree 96 of 7 May 2026, art. 9(9) (deadlines and frequency) and art. 9(8) (the 100-employee threshold); arts. 10 and 11
    Who it concerns
    Companies with at least 250 employees, reporting annually, and companies between 150 and 249, with the same first deadline and then every three years. Between 100 and 149 the start is 7 June 2031.
    The note behind it Pay Transparency: From 7 June 2027 the Gap Must Be Declared — and Whoever Calculates It Sees Your Payslips The system that solves this problem Analysis of sensitive data

  19. NIS: the categorised list of activities and services

    Concerns Companies

    Rule
    Italian Legislative Decree 138 of 4 September 2024, art. 30(1), with art. 42(2) and ACN determination no. 155238/2026
    Who it concerns
    Essential and important entities on the Italian NIS register, public and private.
    The note behind it NIS categorisation: the one duty you judge, not fill in The system that solves this problem Data protection and perimeter

  20. Data Act: unfair terms catch up with old contracts

    It covers only contracts concluded on or before 12 September 2025 that are of indefinite duration or expire at least ten years after 11 January 2024. Chapter IV already applies to contracts concluded after 12 September 2025.

    Concerns Companies

    Rule
    Regulation (EU) 2023/2854 (Data Act), Chapter IV — art. 13 —, applicable under art. 50, sixth paragraph
    Who it concerns
    Enterprises that unilaterally imposed terms on data access and use on another enterprise, and the enterprises that had those terms imposed on them.
    The note behind it Data Act: your machines’ data is (also) yours The system that solves this problem Assisted document review

  21. CBAM: the first annual declaration covers the whole of 2026, if the threshold was crossed

    Concerns Companies

    Rule
    Regulation (EU) 2023/956, Article 6(1) and Article 2a, as replaced by Regulation (EU) 2025/2083; Annex VII, point 1; application dates in Article 36(2)
    Who it concerns
    Importers of cement, iron and steel, aluminium, fertilisers, electricity and hydrogen from third countries, and the indirect customs representatives acting for importers not established in the Union
    The note behind it CBAM: the 50-tonne threshold is cumulative The system that solves this problem Assisted document review

  22. Cyber Resilience Act: technical file and software bill of materials

    Concerns Companies

    Rule
    Regulation (EU) 2024/2847, arts. 13, 28, 30, 31 and 32, Annexes I and VII
    Who it concerns
    Manufacturers of products with digital elements placed on the Union market.
    The note behind it Cyber Resilience Act: no SBOM, no CE marking from 11 December 2027 The system that solves this problem Assisted document review

The full calendar, in a machine-readable form.

The JSON file holds the fourteen deadlines on this page plus the ones that sit in the other guide — the AI Act dates and Italy’s law 132/2025 — with dates, audiences, links to the notes and the primary source each entry was checked against. Useful to anyone tracking them in their own calendar or handing them to an assistant.

Download deadlines.json

The two AI Act dates rest on the same documents.

On 2 December 2027 the obligations on Annex III high-risk systems apply; on 2 August 2028 those on systems embedded in already regulated products, the Machinery Regulation included. The full calendar sits in the dedicated guide.

AI Act: every deadline, in order

Reminders

The reminder that arrives before the deadline.

A monthly summary of the deadlines that concern you, and an alert when one of them enters the thirty-day window. A free information service for institutions and companies: subscription is subject to approval.

What you want to be alerted about
How we handle this data

Free information service, with no obligation on either side. Not legal advice: always check the primary source before acting.

The first step

Operational from week one.

A real use case, on your data, in production. Then it grows, week after week.

30 minutes video call free of charge
Start an operational trial

It starts with a session with our engagement expert. Your data stays yours, always.