Deadlines and dates
When each obligation takes effect, with its legal source alongside. Because not every date passed around as a deadline is actually written into law.
Last updated: 03.11.2026
Upcoming dates
2026
- 10 November 2026 Tuesday
Windows 11 23H2 Enterprise and Education: last updates
With the Patch Tuesday on 10 November, support ends for Windows 11 version 23H2 in the Enterprise and Education editions. After that, there are no more security updates for it. Devices still on 23H2 need the feature update to a newer version.
- 11 November 2026 to 13 November 2026 Wednesday
DAFTA and RDV Forum, Cologne and online
The data protection conference of the GDD, for the 50th time, with the RDV Forum the day before. One of the major dates for data protection officers in the German-speaking region.
- 2 December 2026 Wednesday
AI Act: marking by providers of existing systems
Providers of AI systems that generate synthetic audio, image, video or text content and placed their system on the market before 2 August 2026 must implement machine-readable marking by this date. The deadline applies to providers and their procedures, not to retroactively labelling older content.
- 9 December 2026 Wednesday
Product Liability Directive: transposition deadline, software is a product
By this date member states must transpose the new Product Liability Directive; on the same day Directive 85/374/EEC is repealed. The new directive applies to products placed on the market or put into service after 9 December 2026 and explicitly counts software as a product. Older products remain under the previous law. Germany has transposed it with the new Product Liability Act (BGBl. 2026 I No. 321), which enters into force on the same day.
- 19 December 2026 Saturday
Hazardous Substances Ordinance: permit for demolition work with asbestos
Anyone carrying out demolition work with asbestos in the low and medium risk range must prove a permit under Section 11a(4a) by the end of this day. This also concerns building owners who commission such work.
- 24 December 2026 Thursday
eIDAS 2: Member States provide the EU Digital Identity Wallet
Each Member State provides at least one European Digital Identity Wallet within 24 months of the implementing acts entering into force. The relevant implementing regulations were published on 4.12.2024 and entered into force on 24.12.2024; the date is calculated from that.
- 31 December 2026 Thursday
PHP 8.2: end of security support
After this date, the PHP project no longer provides security fixes for PHP 8.2; PHP 8.1 and older already receive no updates. This affects not only websites but every application with a PHP runtime, including business applications and device web interfaces. Anyone not moving to 8.3 or later needs backports from their distribution or a documented risk decision.
2027
- 1 January 2027 Friday
Grundschutz++ becomes certifiable
From this day, certification applications for ISO 27001 on the basis of Grundschutz++ can be submitted, as well as for certification as GS++ consultant and GS++ audit team leader. Not a legal date but the BSI plan.
- 12 January 2027 Tuesday
Windows Server 2016: end of extended support
After this date, Microsoft no longer provides security updates for Windows Server 2016 unless a paid extension programme has been purchased. Anyone still running systems on it needs a migration plan or a documented risk decision by now at the latest.
- 12 January 2027 Tuesday
Data Act: switching charges end
Providers of data processing services may no longer charge for carrying out a provider switch. Until then, reduced charges are permitted, capped at the costs actually incurred.
- 20 January 2027 Wednesday
Machinery Regulation: application begins, with cybersecurity requirements
The Machinery Regulation replaces the Machinery Directive and for the first time explicitly requires protection against corruption as well as safety and reliability of control systems. For operators this is mainly a procurement question: machinery placed on the market from this day must meet the requirements and evidence them in the EU declaration of conformity. This also applies to lifts with a speed of no more than 0.15 m/s. Note: the originally published text said 14 January; a corrigendum changed the date to 20 January.
- 28 January 2027 Thursday
European Data Protection Day
Established by the Council of Europe, every year on 28 January, the anniversary of data protection Convention 108. A good occasion to read the record of processing and the privacy notices against reality once.
- 9 February 2027 Tuesday
Safer Internet Day
Every year on the second Tuesday in February. An occasion for an awareness campaign that does not feel like mandatory training.
- 11 February 2027 Thursday
European 112 Day
Every year on 11 February. A good occasion to check whether emergency numbers, alarm plans and notices in the building are still correct.
- 2 March 2027 to 3 March 2027 Tuesday
44th Heilbronn Lift Days
Conference on trends and standards in lift technology, for operators, experts and manufacturers.
- 15 March 2027 Monday
TLS certificates: maximum validity of 100 days
Publicly trusted TLS certificates issued from this date may be valid for at most 100 days. Anyone still renewing certificates by hand will then do so about four times a year per certificate; automation pays off by now at the latest.
- 26 March 2027 Friday
European Health Data Space: start of application
From this date, the regulation on the European Health Data Space applies. Most obligations follow in stages: the rules on access to electronic health data and secondary use from 26 March 2029, parts for further data categories and EHR systems from 26 March 2031. By March 2027, the Commission first adopts the technical specifications.
- 31 March 2027 Wednesday
World Backup Day
Every year on 31 March. The day is a reminder about backups; in an emergency, what counts is the restore. Testing one on that day is worth more.
- 31 March 2027 Wednesday
Energy Efficiency Act: report data centre figures for 2026
Data centre operators publish the information under Annex 3 for the previous calendar year by the end of 31 March and submit it to the federal government. The obligation recurs every year, so the measuring is happening now.
- 31 March 2027 Wednesday
Grundschutz++: performance indicators for every requirement
By this date, every requirement of the user catalogue is to carry performance indicators. They replace the previous levels basic, standard and increased protection. Not a legal date but the BSI plan.
- 28 April 2027 Wednesday
World Day for Safety and Health at Work
Every year on 28 April, established by the International Labour Organization. An occasion to review instructions, risk assessments and accident reports.
- 1 June 2027 Tuesday
BSI C5:2026 applies to all attestations
From this date, the criteria of the C5:2026 apply to all attestations, both Type 1 reports for a specific date and Type 2 reports covering a period; earlier application is allowed. For customers, the list of corresponding criteria they must implement themselves may change with the next audit report; in the German healthcare sector this is explicitly required under Section 393(3) no. 3 SGB V.
- 9 June 2027 to 10 June 2027 Wednesday
Potsdam Conference for National Cybersecurity
The Hasso Plattner Institute conference brings politics, authorities, research and industry together on the state of cybersecurity in Germany.
- 15 June 2027 to 16 June 2027 Tuesday
Zukunftskongress Staat & Verwaltung, Berlin
The congress on the digitalisation of government and public administration, with federal, state and local government. For information security in the public sector, one of the key meeting points of the year.
- 16 June 2027 to 17 June 2027 Wednesday
FeuerTRUTZ, Nuremberg
Trade fair with congress for preventive fire protection: structural, technical and organisational fire protection.
- 1 July 2027 Thursday
Energy Efficiency Act: PUE of at most 1.5 for existing data centres
Data centres that started operation before 1 July 2026 must permanently achieve an annual average power usage effectiveness of at most 1.5 from this date. Current law: an amendment of the act is in the parliamentary process and may still change the values.
- 26 July 2027 Monday
CSDDD: member state transposition deadline
By this date member states must have transposed the EU due diligence directive into national law. The date still widely quoted is 26 July 2026: that is what the original directive said, until the "stop-the-clock" Directive (EU) 2025/794 postponed it by a year. First application for the largest group of companies moved from July 2027 to July 2028.
- 28 July 2027 Wednesday
Hazardous Substances Ordinance: prove expertise for biocidal products
Anyone using biocidal products that could be used without expertise until 30 September 2021 must prove expertise by this date. Note: on 12.06.2026 the Bundesrat called for a postponement to 2030 (printed paper 194/26); it has not been promulgated so far.
- 30 July 2027 Friday
System Administrator Appreciation Day
Every year on the last Friday in July, in 2027 for the 28th time. A day for the people whose work is only noticed when it is missing: patches, backups, certificates renewed at night.
- 12 September 2027 Sunday
Data Act: legacy contracts for data processing services
From this day, Chapter IV also covers contracts concluded on or before 12 September 2025, provided they are open-ended or end no earlier than 11 January 2034. A good reason to search the contract register for exactly those two characteristics.
- 1 October 2027 Friday
European Cybersecurity Month
Every October, supported by ENISA and the European Commission. A month for awareness in which phishing exercises and training get more attention than usual.
- 5 October 2027 to 7 October 2027 Tuesday
it-sa Expo&Congress, Nuremberg
Three days until 7 October at the Nuremberg exhibition centre, the large IT security trade fair in the DACH region.
- 5 October 2027 to 7 October 2027 Tuesday
Smart Country Convention, Berlin
Trade fair and congress for digital public administration and the connected municipality, organised by Bitkom and Messe Berlin.
- 12 October 2027 to 15 October 2027 Tuesday
interlift, Nuremberg
International trade fair for lifts, components and modernisation, every two years, in Nuremberg since 2025.
- 19 October 2027 to 22 October 2027 Tuesday
A+A, Düsseldorf
International trade fair with congress for safety, health and occupational protection, every two years in Düsseldorf.
- 2 December 2027 Thursday
AI Act: high-risk obligations under Annex III
Originally set for 2 August 2026, deferred in July 2026. Eight areas are affected, among them biometrics, critical infrastructure, employment and access to essential services. The deferral is preparation time, not a pause.
- 5 December 2027 Sunday
Hazardous Substances Ordinance: expertise for work with asbestos
For work with asbestos, expertise and specialist knowledge under Section 11a must be proven by this date, and where no authorised expert with powers of instruction was required so far, the obligation applies from this date.
- 11 December 2027 Saturday
Cyber Resilience Act applies in full
From this day, products with digital elements may only be placed on the market if they meet the essential cybersecurity requirements, including conformity assessment, CE marking and a support period for security updates.
- 24 December 2027 Friday
eIDAS 2: regulated companies must accept the EU Digital Identity Wallet
Private relying parties required to use strong user authentication, for example in transport, energy, banking, financial services, health, telecommunications or digital infrastructure, accept the European Digital Identity Wallet at the user's request no later than 36 months after the implementing acts entered into force. Date calculated from 24.12.2024.
2028
- 30 June 2028 Friday
Telekom switches off its 2G network (expected)
According to Telekom, the 2G network is expected to be switched off on 30 June 2028; Vodafone states the end of September or October 2028, Telefónica the second half of 2028. Devices with 2G modules may be affected: lift emergency calls, alarm and fire alarm transmission, telecontrol and metering.
- 2 August 2028 Wednesday
AI Act: high-risk AI in regulated products
For AI systems embedded as a safety component in products under Annex I, the later date applies. This one was also deferred in July 2026, from 2027 to 2028.
- 19 September 2028 to 22 September 2028 Tuesday
security essen
Trade fair for civil security: access control, video technology, fire alarm and security technology, every two years in Essen.
- 5 December 2028 Tuesday
Hazardous Substances Ordinance: old asbestos approvals expire
Approvals under Annex I no. 2.4.2 in the version applicable on 1 January 2022 only remain valid until this date.
- 31 December 2028 Sunday
Carcinogens Directive: transitional values for lead and diisocyanates end
Until this date, an occupational exposure limit of 10 μg NCO/m³ for diisocyanates and a biological limit value of 30 μg/100 ml for lead in blood apply as transitional values; after that, the stricter values. The directive takes effect through national law.
2029
- 15 March 2029 Thursday
TLS certificates: maximum validity of 47 days
Final step of the reduction: publicly trusted TLS certificates issued from this date may be valid for at most 47 days. Without automated renewal, this can no longer be operated.
2030
- 27 June 2030 Thursday
German Accessibility Act: end of the transition period for existing products
Until this day service providers may continue to use products they were already lawfully using before 28 June 2025. Not afterwards. Contracts for services concluded earlier also end on this day at the latest, even if they were agreed for longer. Self-service terminals have a separate limit: the end of their economic life, at most fifteen years.
- 1 July 2030 Monday
Energy Efficiency Act: PUE of at most 1.3 for existing data centres
For data centres that started operation before 1 July 2026, the limit for the annual average power usage effectiveness drops to 1.3. Current law; an amendment is in progress.
Legend
- Statutory deadline
- Written into the legal text.
- Transitional rule
- Applies only to legacy cases; check the scope carefully.
- Administrative grace period
- A statement about enforcement practice, not about the law.
- Industry or vendor date
- Not a legal norm, but binding in practice: certificate rules, end of support.
- Event
- Professional event, date confirmed by the organiser. Not an obligation.
- We will be there
- You will find isidaten there in person.
- Awareness day
- Fixed annual day, an occasion and not an obligation.
How to read this list
Product-related context, not legal advice. The linked legal text always prevails. Whether an obligation applies to you depends on your sector, size and role, and no calendar can make that assessment for you.
Already passed
Kept in place, because your own chronology often matters more than the next date.
2026
- 27 October 2026 to 29 October 2026
it-sa Expo&Congress, Nuremberg
Three days until 29 October at the Nuremberg exhibition centre. This is also where the Grundschutz++ methodology is published, see the entry below.
- 26 October 2026
Grundschutz++: methodology published as BSI Standard 300-1
The BSI has published the Grundschutz++ methodology as BSI Standard 300-1, one day before it-sa. It is process-oriented, lets organisations choose their risk method subject to minimum criteria, and all requirements are machine-readable. An early adopter phase follows; an ISMS under Grundschutz++ becomes certifiable from 2027.
- 20 October 2026 to 22 October 2026
Arbeitsschutz Aktuell, Stuttgart
Trade fair and congress for safety and health at work, with a programme for occupational safety specialists and company doctors.
- 27 September 2026
EmpCo: environmental claims on the blacklist
From this day the measures of Directive (EU) 2024/825 apply: general environmental claims without proven excellent environmental performance, claims about the whole product for a partial aspect, climate neutrality via offsetting and labels without a certification scheme are added to Annex I of the UCPD. The Member States’ transposition deadline was 27 March 2026.
- 12 September 2026
Data Act: access to connected product data
Connected products placed on the market AFTER this day must be designed so that users can access the data generated by default, free of charge, machine-readable and, where possible, directly. The wording says “after 12 September 2026”, so the cut-off is the following day. Products placed on the market earlier are not covered. The pre-contractual information duty (Art. 3(2)) has applied since 12 September 2025.
- 11 September 2026
Cyber Resilience Act: manufacturers’ reporting obligations
Manufacturers must report actively exploited vulnerabilities and severe security incidents, simultaneously to the competent CSIRT and to ENISA. The duty applies long before the regulation takes full effect, and it covers products placed on the market before 11 December 2027.
- 8 September 2026
DIGITAL X Cologne, isidaten on site
All three founders are on Deutsche Telekom’s partner floor: the information security, the data protection and the IT management perspective at one table.
- 2 August 2026
AI Act: general date of application
The transparency duties under Article 50 have applied since this day and affect almost anyone using AI in external contact: chatbot disclosure, machine-readable marking of generated content. The high-risk obligations, by contrast, were deferred shortly before.
- 31 July 2026
NIS2: end of the BSI grace period for registration
This much-quoted date was in no statute. It was a BSI grace period for outstanding registrations, that is, a statement about enforcement practice. The statutory deadline was 6 March 2026, and the actual obligations never depended on registration anyway.
- 11 June 2026
Cyber Resilience Act: chapter on notified bodies
The rules on notifying conformity assessment bodies have applied since this day. For manufacturers this is mainly a signal: the assessment infrastructure is being built now, before the product requirements bite.
- 16 March 2026
German critical infrastructure umbrella act enters into force
The first cross-sector minimum requirements for the physical protection of critical installations, transposing CER Directive (EU) 2022/2557. This entry deliberately names no follow-up deadline: the obligations do not hang on a national cut-off date but on your own registration. Registration is due at the latest three months after an installation qualifies as critical (Section 8(1)); the risk analysis under Section 12 then applies nine months, and the resilience plan and reporting duties under Sections 13, 18 and 20 ten months after registration (Section 8(7)). Incidents must be reported within 24 hours, the detailed report within one month (Section 18(1)).
- 15 March 2026
TLS certificates: maximum validity of 200 days
First step of the reduction: since this date, newly issued publicly trusted TLS certificates may be valid for at most 200 days instead of 398.
- 6 March 2026
NIS2: statutory registration deadline
Registration no later than three months after first falling within scope. For everyone already covered when the implementing act entered into force, the deadline expired on this day. Registering later is not on time, it is late.
2025
- 6 December 2025
German NIS2 implementing act enters into force
Without a transition period. From this day the duties on risk management, incident reporting and evidence apply, regardless of whether a registration has taken place.
- 12 September 2025
Data Act: date of application
The regulation has applied since this day. Chapter IV on unfair contract terms covers contracts concluded after it; legacy contracts follow in September 2027.
Who tracks this at your organisation?
We maintain this list by hand. In the legal register, a source watcher does the job: it observes the official sources and reports when a new version appears.