Deadlines and dates
When each obligation takes effect, with its legal source alongside. Because not every date passed around as a deadline is actually written into law.
Last updated: 15.10.2026
Upcoming dates
2026
- 20 October 2026 to 22 October 2026 Tuesday
Arbeitsschutz Aktuell, Stuttgart
Trade fair and congress for safety and health at work, with a programme for occupational safety specialists and company doctors.
- 27 October 2026 to 29 October 2026 Tuesday
it-sa Expo&Congress, Nuremberg
Three days until 29 October at the Nuremberg exhibition centre. This is also where the Grundschutz++ methodology is published, see the entry below.
- 27 October 2026 Tuesday
Grundschutz++: methodology published at it-sa
At it-sa 2026 in Nuremberg, the BSI makes the Grundschutz++ methodology available to the community. The user catalogue replaces the IT-Grundschutz-Kompendium and sits machine-readable in the state-of-the-art library. The checklists proven with WiBA become a fixture. Not a legal date but the BSI plan.
- 11 November 2026 to 13 November 2026 Wednesday
DAFTA and RDV Forum, Cologne and online
The data protection conference of the GDD, for the 50th time, with the RDV Forum the day before. One of the major dates for data protection officers in the German-speaking region.
- 2 December 2026 Wednesday
AI Act: marking by providers of existing systems
Providers of AI systems that generate synthetic audio, image, video or text content and placed their system on the market before 2 August 2026 must implement machine-readable marking by this date. The deadline applies to providers and their procedures, not to retroactively labelling older content.
- 19 December 2026 Saturday
Hazardous Substances Ordinance: permit for demolition work with asbestos
Anyone carrying out demolition work with asbestos in the low and medium risk range must prove a permit under Section 11a(4a) by the end of this day. This also concerns building owners who commission such work.
- 24 December 2026 Thursday
eIDAS 2: Member States provide the EU Digital Identity Wallet
Each Member State provides at least one European Digital Identity Wallet within 24 months of the implementing acts entering into force. The relevant implementing regulations were published on 4.12.2024 and entered into force on 24.12.2024; the date is calculated from that.
2027
- 1 January 2027 Friday
Grundschutz++ becomes certifiable
From this day, certification applications for ISO 27001 on the basis of Grundschutz++ can be submitted, as well as for certification as GS++ consultant and GS++ audit team leader. Not a legal date but the BSI plan.
- 12 January 2027 Tuesday
Data Act: switching charges end
Providers of data processing services may no longer charge for carrying out a provider switch. Until then, reduced charges are permitted, capped at the costs actually incurred.
- 14 January 2027 Thursday
Machinery Regulation: application begins, with cybersecurity requirements
The Machinery Regulation replaces the Machinery Directive and for the first time explicitly requires protection against corruption as well as safety and reliability of control systems. For operators this is mainly a procurement question: machinery placed on the market from this day must meet the requirements and evidence them in the EU declaration of conformity.
- 28 January 2027 Thursday
European Data Protection Day
Established by the Council of Europe, every year on 28 January, the anniversary of data protection Convention 108. A good occasion to read the record of processing and the privacy notices against reality once.
- 11 February 2027 Thursday
European 112 Day
Every year on 11 February. A good occasion to check whether emergency numbers, alarm plans and notices in the building are still correct.
- 31 March 2027 Wednesday
World Backup Day
Every year on 31 March. The day is a reminder about backups; in an emergency, what counts is the restore. Testing one on that day is worth more.
- 31 March 2027 Wednesday
Energy Efficiency Act: report data centre figures for 2026
Data centre operators publish the information under Annex 3 for the previous calendar year by the end of 31 March and submit it to the federal government. The obligation recurs every year, so the measuring is happening now.
- 31 March 2027 Wednesday
Grundschutz++: performance indicators for every requirement
By this date, every requirement of the user catalogue is to carry performance indicators. They replace the previous levels basic, standard and increased protection. Not a legal date but the BSI plan.
- 28 April 2027 Wednesday
World Day for Safety and Health at Work
Every year on 28 April, established by the International Labour Organization. An occasion to review instructions, risk assessments and accident reports.
- 9 June 2027 to 10 June 2027 Wednesday
Potsdam Conference for National Cybersecurity
The Hasso Plattner Institute conference brings politics, authorities, research and industry together on the state of cybersecurity in Germany.
- 15 June 2027 to 16 June 2027 Tuesday
Zukunftskongress Staat & Verwaltung, Berlin
The congress on the digitalisation of government and public administration, with federal, state and local government. For information security in the public sector, one of the key meeting points of the year.
- 16 June 2027 to 17 June 2027 Wednesday
FeuerTRUTZ, Nuremberg
Trade fair with congress for preventive fire protection: structural, technical and organisational fire protection.
- 1 July 2027 Thursday
Energy Efficiency Act: PUE of at most 1.5 for existing data centres
Data centres that started operation before 1 July 2026 must permanently achieve an annual average power usage effectiveness of at most 1.5 from this date. Current law: an amendment of the act is in the parliamentary process and may still change the values.
- 26 July 2027 Monday
CSDDD: member state transposition deadline
By this date member states must have transposed the EU due diligence directive into national law. The date still widely quoted is 26 July 2026: that is what the original directive said, until the "stop-the-clock" Directive (EU) 2025/794 postponed it by a year. First application for the largest group of companies moved from July 2027 to July 2028.
- 28 July 2027 Wednesday
Hazardous Substances Ordinance: prove expertise for biocidal products
Anyone using biocidal products that could be used without expertise until 30 September 2021 must prove expertise by this date. Note: on 12.06.2026 the Bundesrat called for a postponement to 2030 (printed paper 194/26); it has not been promulgated so far.
- 30 July 2027 Friday
System Administrator Appreciation Day
Every year on the last Friday in July, in 2027 for the 28th time. A day for the people whose work is only noticed when it is missing: patches, backups, certificates renewed at night.
- 12 September 2027 Sunday
Data Act: legacy contracts for data processing services
From this day, Chapter IV also covers contracts concluded on or before 12 September 2025, provided they are open-ended or end no earlier than 11 January 2034. A good reason to search the contract register for exactly those two characteristics.
- 1 October 2027 Friday
European Cybersecurity Month
Every October, supported by ENISA and the European Commission. A month for awareness in which phishing exercises and training get more attention than usual.
- 5 October 2027 to 7 October 2027 Tuesday
Smart Country Convention, Berlin
Trade fair and congress for digital public administration and the connected municipality, organised by Bitkom and Messe Berlin.
- 19 October 2027 to 22 October 2027 Tuesday
A+A, Düsseldorf
International trade fair with congress for safety, health and occupational protection, every two years in Düsseldorf.
- 2 December 2027 Thursday
AI Act: high-risk obligations under Annex III
Originally set for 2 August 2026, deferred in July 2026. Eight areas are affected, among them biometrics, critical infrastructure, employment and access to essential services. The deferral is preparation time, not a pause.
- 5 December 2027 Sunday
Hazardous Substances Ordinance: expertise for work with asbestos
For work with asbestos, expertise and specialist knowledge under Section 11a must be proven by this date, and where no authorised expert with powers of instruction was required so far, the obligation applies from this date.
- 11 December 2027 Saturday
Cyber Resilience Act applies in full
From this day, products with digital elements may only be placed on the market if they meet the essential cybersecurity requirements, including conformity assessment, CE marking and a support period for security updates.
- 24 December 2027 Friday
eIDAS 2: regulated companies must accept the EU Digital Identity Wallet
Private relying parties required to use strong user authentication, for example in transport, energy, banking, financial services, health, telecommunications or digital infrastructure, accept the European Digital Identity Wallet at the user's request no later than 36 months after the implementing acts entered into force. Date calculated from 24.12.2024.
2028
- 2 August 2028 Wednesday
AI Act: high-risk AI in regulated products
For AI systems embedded as a safety component in products under Annex I, the later date applies. This one was also deferred in July 2026, from 2027 to 2028.
- 19 September 2028 to 22 September 2028 Tuesday
security essen
Trade fair for civil security: access control, video technology, fire alarm and security technology, every two years in Essen.
- 5 December 2028 Tuesday
Hazardous Substances Ordinance: old asbestos approvals expire
Approvals under Annex I no. 2.4.2 in the version applicable on 1 January 2022 only remain valid until this date.
- 31 December 2028 Sunday
Carcinogens Directive: transitional values for lead and diisocyanates end
Until this date, an occupational exposure limit of 10 μg NCO/m³ for diisocyanates and a biological limit value of 30 μg/100 ml for lead in blood apply as transitional values; after that, the stricter values. The directive takes effect through national law.
2030
- 27 June 2030 Thursday
German Accessibility Act: end of the transition period for existing products
Until this day service providers may continue to use products they were already lawfully using before 28 June 2025. Not afterwards. Contracts for services concluded earlier also end on this day at the latest, even if they were agreed for longer. Self-service terminals have a separate limit: the end of their economic life, at most fifteen years.
- 1 July 2030 Monday
Energy Efficiency Act: PUE of at most 1.3 for existing data centres
For data centres that started operation before 1 July 2026, the limit for the annual average power usage effectiveness drops to 1.3. Current law; an amendment is in progress.
Legend
- Statutory deadline
- Written into the legal text.
- Transitional rule
- Applies only to legacy cases; check the scope carefully.
- Administrative grace period
- A statement about enforcement practice, not about the law.
- Event
- Professional event, date confirmed by the organiser. Not an obligation.
- We will be there
- You will find isidaten there in person.
- Awareness day
- Fixed annual day, an occasion and not an obligation.
How to read this list
Product-related context, not legal advice. The linked legal text always prevails. Whether an obligation applies to you depends on your sector, size and role, and no calendar can make that assessment for you.
Already passed
Kept in place, because your own chronology often matters more than the next date.
2026
- 27 September 2026
EmpCo: environmental claims on the blacklist
From this day the measures of Directive (EU) 2024/825 apply: general environmental claims without proven excellent environmental performance, claims about the whole product for a partial aspect, climate neutrality via offsetting and labels without a certification scheme are added to Annex I of the UCPD. The Member States’ transposition deadline was 27 March 2026.
- 12 September 2026
Data Act: access to connected product data
Connected products placed on the market AFTER this day must be designed so that users can access the data generated by default, free of charge, machine-readable and, where possible, directly. The wording says “after 12 September 2026”, so the cut-off is the following day. Products placed on the market earlier are not covered. The pre-contractual information duty (Art. 3(2)) has applied since 12 September 2025.
- 11 September 2026
Cyber Resilience Act: manufacturers’ reporting obligations
Manufacturers must report actively exploited vulnerabilities and severe security incidents, simultaneously to the competent CSIRT and to ENISA. The duty applies long before the regulation takes full effect, and it covers products placed on the market before 11 December 2027.
- 8 September 2026
DIGITAL X Cologne, isidaten on site
All three founders are on Deutsche Telekom’s partner floor: the information security, the data protection and the IT management perspective at one table.
- 2 August 2026
AI Act: general date of application
The transparency duties under Article 50 have applied since this day and affect almost anyone using AI in external contact: chatbot disclosure, machine-readable marking of generated content. The high-risk obligations, by contrast, were deferred shortly before.
- 31 July 2026
NIS2: end of the BSI grace period for registration
This much-quoted date was in no statute. It was a BSI grace period for outstanding registrations, that is, a statement about enforcement practice. The statutory deadline was 6 March 2026, and the actual obligations never depended on registration anyway.
- 11 June 2026
Cyber Resilience Act: chapter on notified bodies
The rules on notifying conformity assessment bodies have applied since this day. For manufacturers this is mainly a signal: the assessment infrastructure is being built now, before the product requirements bite.
- 16 March 2026
German critical infrastructure umbrella act enters into force
The first cross-sector minimum requirements for the physical protection of critical installations, transposing CER Directive (EU) 2022/2557. This entry deliberately names no follow-up deadline: the obligations do not hang on a national cut-off date but on your own registration. Registration is due at the latest three months after an installation qualifies as critical (Section 8(1)); the risk analysis under Section 12 then applies nine months, and the resilience plan and reporting duties under Sections 13, 18 and 20 ten months after registration (Section 8(7)). Incidents must be reported within 24 hours, the detailed report within one month (Section 18(1)).
- 6 March 2026
NIS2: statutory registration deadline
Registration no later than three months after first falling within scope. For everyone already covered when the implementing act entered into force, the deadline expired on this day. Registering later is not on time, it is late.
2025
- 6 December 2025
German NIS2 implementing act enters into force
Without a transition period. From this day the duties on risk management, incident reporting and evidence apply, regardless of whether a registration has taken place.
- 12 September 2025
Data Act: date of application
The regulation has applied since this day. Chapter IV on unfair contract terms covers contracts concluded after it; legacy contracts follow in September 2027.
Who tracks this at your organisation?
We maintain this list by hand. In the legal register, a source watcher does the job: it observes the official sources and reports when a new version appears.