Deadlines
Dates we track from official sources. Every entry links to the document it came from.
November 2026
- IEC 62443 IEC 61508-1:2026 FDIS: Third edition of general requirements for functional safety of E/E/PE safety-related systems, with new provisions on AI, human factors, and security 4 days left
- IEC 62443 IEC 61508-7:2026 FDIS (third edition): revised Annex D on proven-in-use and relocation of Annexes E and H to IEC 61508-2-1 4 days left
- IEC 62443 IEC 61508-6:2026 (FDIS): Guidelines on the application of IEC 61508-2 and IEC 61508-3 — third edition replaces 2010 version with new annexes on diagnostics, failure rate estimation, and robust safety 4 days left
- IEC 62443 IEC 61508-5:2026 FDIS: Examples of methods for determination of safety integrity levels in E/E/PE safety-related systems 4 days left
- IEC 62443 IEC 61508-4 third edition (FDIS 2026): revised and new definitions cover AI software classes, tool impact, diagnostic functions, and security alignment 4 days left
- IEC 62443 IEC 61508-3:2026 FDIS: Third edition of software requirements for functional safety of electrical/electronic/programmable electronic safety-related systems 4 days left
- IEC 62443 IEC 61508-2:2026 FDIS — Requirements for E/E/PE safety-related systems: clarified SIL/SC differentiation, semiconductor content relocated, updated interfaces to other parts 4 days left
- CISA CISA Logging Reference Architecture: outcome-driven guidance for FCEB agencies to build Agency Logging Plans under OMB M-26-14 9 days left
- Germany BDSG Amended § 30 on credit databases and the new § 37a on scoring enter into force (Act of 12 May 2026, Article 16(1)) 11 days left
- CER Directive Indicative European Parliament plenary date for the small mid-caps omnibus, COM(2025) 502, which amends the CER Directive - a forecast, not a fixed date 14 days left
- GDPR Indicative European Parliament plenary date (first reading) for the small mid-caps omnibus, COM(2025) 501, which would raise the Article 30 records exemption to organisations under 750 employees - a forecast, not a fixed date 14 days left
- IEC 62443 IEC 63116:2026 – General requirements for lighting systems: first full International Standard replacing IEC TS 63116:2021, with expanded information security and cybersecurity provisions 18 days left
- BSI IT-Grundschutz Planned publication of training concepts for Grundschutz++ practitioners and consultants 21 days left
- NIST SP 800-82 Comment deadline for the initial public draft of SP 800-82 Rev. 4 21 days left
December 2026
- Chile Act 19.628 Ley 21.719 amendments to Ley 19.628 take effect, with the new Agencia de Protección de Datos Personales, breach reporting and fines of up to 20,000 UTM 22 days left
- EU AI Act New prohibitions on non-consensual intimate imagery and child sexual abuse material apply; earlier generative AI systems must meet the Article 50(2) marking duty 23 days left
- Australian Privacy Act APP entities must disclose in their privacy policy when computer programs make or inform decisions that significantly affect individuals (APP 1.7-1.9) 31 days left
- IEC 62443 IEC 63452:2026 FDIS — Cybersecurity management, zoning, risk, supply chain, and assurance requirements for railway applications across the full system lifecycle 32 days left
- PSD2 SCA Indicative European Parliament plenary date for PSD3 and the Payment Services Regulation - a forecast, not a fixed date 35 days left
- Germany BAIT BAIT cease to apply in full at the end of the day, after the DORA transition period 52 days left
- Electricity cyber network code ENTSO for Electricity, with the EU DSO entity, makes available an exercise scenario template for entity and Member State exercises (Article 43) 52 days left
January 2027
- BSI IT-Grundschutz Planned start of applications for ISO 27001 certification on the basis of Grundschutz++ 53 days left
- Germany BAIT Further institutions fall within DORA's scope under section 1a(2) of the Banking Act, as revised by the Financial Market Digitalisation Act (FinmadiG) 53 days left
- FedRAMP CR26 becomes mandatory: new Rev5 applications and all active 20x certifications must follow it 53 days left
- FedRAMP Rev5 providers must follow the Significant Change Notification rules 53 days left
- TISAX ISA2027 applies to all TISAX assessments ordered from this date; the final month to open an initial assessment under ISA 6 is March 2027 53 days left
- EU Data Act Cloud and other data processing providers may no longer charge switching fees 64 days left
- Hungary Act CXII of 2011 NAIH President and Vice-President file asset declarations in the new form, as of 31 December 2026 (§ 75/C(3)) 83 days left
February 2027
- Cyber Solidarity Act Commission's first evaluation of the Regulation is due, then at least every four years (Article 25(1)) 88 days left
- FedRAMP CR26 grace period ends for Rev5 Lost Sponsor and Ready Conversion program certifications 102 days left
- TX DIR Control Standards Controls added in Version 2.2 (such as CP-07 Alternate Processing Site and SI-08 Spam Protection) must be implemented 111 days left
March 2027
- Korea PIPA AI development special rules (Act No. 21910) take effect 120 days left
- UA Cloud Services Law Amendments by Law No. 4888-IX on public procurement to Articles 11 and 12 (how public users buy cloud services) take effect 135 days left
- CRA EHDS amendments to CRA Articles 13, 31 and 32 apply 137 days left
- EHDS The Regulation applies in general; Member States must have notified their penalty rules (Article 99) 137 days left
- CISA SSDAF Expiration date of the form's current OMB approval (OMB control number 1670-0052) 142 days left
- UK Telecoms Security Code of Practice "Management plane 3" measures should be completed 142 days left
April 2027
May 2027
- TSA SD 1580/82 SD 1580/82-2022-01E expires unless TSA renews or replaces it 174 days left
- eIDAS 2 Signature creation devices certified under Directive 1999/93/EC stop counting as qualified devices (Article 51(1), as amended) 193 days left
June 2027
- Germany C5 C5:2026 applies to type 1 reports dated, and type 2 periods beginning, on or after this date; earlier use is allowed (C5:2026 section 3.5) 204 days left
- FedRAMP Grace period ends for Rev5 Significant Change Notification rules 204 days left
- FedRAMP FedRAMP stops accepting applications for new Rev5 certifications 214 days left
July 2027
- FedRAMP Rev5 certified services must supply a Certification Package Overview in human-readable and JSON formats (grace until their next assessment) 234 days left
- Korea PIPA Mandatory personal information protection certification applies to controllers meeting the Presidential Decree criteria 234 days left
- GDPR EDPB and AMLA to develop Joint Guidelines clarifying how organizations can share information to fight financial crime while protecting personal data under Article 75 of the AML Regulation 243 days left
- MTSA Cybersecurity Deadline for the first Cybersecurity Assessment and for submitting Cybersecurity Plans to the Coast Guard for review and approval 249 days left
August 2027
- BC PIPA PIPA amendments by the Business Practices and Consumer Protection Amendment Act (No. 2), 2025 (SBC 2025, c. 31) come into force, including a new section 24.1 on individuals' requests to credit reporting agencies to correct personal information 265 days left
- EU AI Act Providers of general-purpose AI models placed on the market before 2 August 2025 must comply (Article 111(3)) 266 days left
September 2027
- EU Data Act Unfair-terms rules (Chapter IV) extend to long-running data-sharing contracts concluded on or before 12 September 2025 307 days left
- CJIS Security Policy Zero-cycle ends for Priority 2, 3 and 4 modernized requirements (began 1 October 2024) 325 days left
October 2027
- FedRAMP Grace period ends for Rev5 Collaborative Continuous Monitoring rules 326 days left
- NIS2 Commission's first review of how the Directive works is due, then every 36 months (Article 40) 342 days left
December 2027
- EU AI Act High-risk obligations apply to stand-alone AI systems classified high-risk under Article 6(2) and Annex III 388 days left
- CRA The CRA applies in full, including the essential requirements; open-source software stewards' reporting duties start 397 days left
- RED cyber delegated act Delegated Regulation (EU) 2022/30 is repealed; the Cyber Resilience Act applies to these products instead 397 days left
- FedRAMP FedRAMP Authorization Act sunset as enacted: 44 U.S.C. 3607-3616 are struck 5 years after enactment (Pub. L. 117-263, sec. 5921(d)) 409 days left
- BSI IT-Grundschutz Planned end of the early-adopter phase for the first applicable Grundschutz++ version 417 days left
- Electricity cyber network code ENTSO for Electricity makes available a template for regional and cross-regional exercises (Article 44(6)) 417 days left
- EUCC Last day certificates may be issued against the older Common Criteria 3.1 / ISO/IEC 15408:2008 standards (Article 3(2), as amended) 417 days left
- ISO 15408 Last day EUCC certificates may be issued under CC 3.1 R5 or ISO/IEC 15408-1:2009, -2:2008 and -3:2008; CCRA accepts CC:2022 security targets based on CC 3.1 protection profiles until this date 417 days left
January 2028
February 2028
- FedRAMP All CR26 grace periods expire; non-compliant services lose FedRAMP Certification 449 days left
March 2028
- UK Telecoms Security Management plane 4 measures and the first new measures of the revised Code should be completed 508 days left
July 2028
August 2028
September 2028
- EU Data Act Commission evaluation of the Data Act due (Article 49) 673 days left
December 2028
- FedRAMP All FedRAMP Practices in the Consolidated Rules for 2026 expire no later than this date 783 days left
- FedRAMP Existing Rev5 certifications remain active until at least this date, unless FedRAMP is otherwise directed 783 days left
- UK Telecoms Security Further new measures in the revised Code of Practice should be completed, including SIM provider checks 783 days left
March 2029
July 2029
December 2029
- Electricity cyber network code First regional cybersecurity exercise in each system operation region (Article 44) 1148 days left
- UK Telecoms Security Final group of new measures in the revised Code of Practice should be completed 1148 days left
August 2030
December 2030
- CRA Commission review of the CRA due (Article 70(1)) 1493 days left
- EU AI Act AI systems in the EU large-scale IT systems of Annex X, placed on the market before 2 August 2027, must comply (Article 111(1)) 1513 days left
March 2031
- EHDS Primary-use rules apply to medical images, laboratory results and discharge reports and the EHR systems for them; Chapter III applies to EHR systems put into service 1598 days left
- EASA Part-IS Part-IS extends to certain organisations providing ground handling services (Regulation (EU) 2025/22) 1599 days left
June 2031
- Electricity cyber network code Latest date for TSOs to develop the first regional cybersecurity risk mitigation plans (Article 22) 1677 days left
November 2031
- BSI IT-Grundschutz Planned end of certifiability for IT-Grundschutz, five years after Grundschutz++ is published 1847 days left
March 2035
- EHDS Article 75(5) on secondary use starts to apply 3059 days left