The deadlines, read in the text
Every line carries its source (article, annex, point) and says what is not yet settled. No countdown: a deadline is stated, not dramatised.
10 deadlines shown
The calendar
From the oldest to the most distant. Deadlines already applicable are marked as such. Next: Machinery Regulation 2023/1230, applicable from 20 January 2027.
Cybersecurity requirements for internet-connected radio equipment, equipment that processes personal data and equipment that transfers money. Repealed with effect from 11.12.2027, when the CRA takes over.
Delegated Regulation (EU) 2022/30, Art. 3, as amended by Delegated Regulation (EU) 2023/2444, Art. 1; repeal: Delegated Regulation (EU) 2026/339, Art. 1
The regime for notified bodies. It concerns the bodies themselves, not manufacturers directly.
Regulation (EU) 2024/2847, Art. 71(2)
Transparency obligations for AI systems. This date was not postponed, unlike the high-risk part. Only the marking of synthetic content (Art. 50(2)) gives systems already on the market before this date until 2 December 2026.
Regulation (EU) 2024/1689, Art. 50 and 113; Art. 111(4) added by Regulation (EU) 2026/1744
Notify the CSIRT designated as coordinator and ENISA of any actively exploited vulnerability and any severe incident. Early warning within 24 hours, notification within 72 hours.
Regulation (EU) 2024/2847, Art. 14 and 71(2)
- today
Cybersecurity becomes an essential health and safety requirement. The harmonised standard prEN 50742 is still a draft.
Regulation (EU) 2023/1230, Art. 54, corrected in OJ L 169 of 4.7.2023; requirements: Annex III, 1.1.9 and 1.2.1
A digital passport for batteries. A legal regime separate from the ESPR: it is the Batteries Regulation.
Regulation (EU) 2023/1542
Postponed from 2 August 2026 by the Digital Omnibus on AI, which entered into force on 27 July 2026. The original date is still going around.
Regulation (EU) 2024/1689, Annex III, as amended by Regulation (EU) 2026/1744, Art. 113
The deadline that concerns the most manufacturers: technical documentation, SBOM, security by design, vulnerability handling.
Regulation (EU) 2024/2847, Art. 71(2); SBOM: Annex I, Part II, point 1
AI systems built into products already subject to harmonisation legislation. Postponed by the same regulation.
Regulation (EU) 2024/1689, Annex I, as amended by Regulation (EU) 2026/1744, Art. 113
The sectoral delegated acts are not all adopted: no firm date can be announced today.
Regulation (EU) 2024/1781
Three common mix-ups
We fell for all three. They get copied from article to article, and they change what a manufacturer actually has to do.
Mix-up no. 1
“The SBOM is mandatory from 11 September 2026”
False.
11.09.2026 is the date for reporting actively exploited vulnerabilities: Article 14. The essential requirements, including the SBOM (Annex I, Part II, point 1), are applicable from 11 December 2027 (Art. 71(2)). These are two separate obligations, fifteen months apart, and mixing them up means preparing the wrong deliverable.
Mix-up no. 2
“The final report under Art. 14 is due 14 days after discovery”
False.
The period does not run from awareness, but from the moment a corrective or mitigating measure is available (Art. 14(2)(c)). And the word “mitigating” matters: a simple workaround starts the fourteen days. For an incident, it is one month after the submission of the incident notification, Art. 14(4)(c).
Mix-up no. 3
“The battery passport comes from the ESPR”
False.
It comes from the Batteries Regulation (EU) 2023/1542, a legal regime separate from ecodesign. Treating them together sends you looking for the obligations in the wrong act.
A fourth, on the AI Act
How these dates are checked
Because a table of deadlines with no method is no better than the articles it claims to correct.
Read in the Official Journal, not in a blog post. The CRA's application dates are in its Article 71(2); the essential requirements in Annex I, the SBOM in its Part II, point 1. Each line of the calendar above carries the article or annex where it is found, so that you can check without taking our word for it.
Corrected when we get it wrong. This table exists because we made three date errors in one sitting, then two more on Article 14, found by going back to the text on 8 August 2026. The mix-ups listed above were ours before they were anyone else's.
Reread on 6 September 2026. All ten lines were reviewed one by one. No date moved, but two of them were not in the text cited: the AI Act high-risk dates come from Regulation (EU) 2026/1744, which amends it, not from the AI Act itself. The source now names both. Checked along the way: this regulation, which also touches the Machinery Regulation, moves neither its application from 20 January 2027 nor points 1.1.9 and 1.2.1 of its Annex III.
Reread on 30 September 2026, the RED line. The same case: 1 August 2025 is correct, but Article 3 of Delegated Regulation 2022/30 said “1 August 2024”. Delegated Regulation (EU) 2023/2444 postponed it. The source now names it.
Reread on 14 October 2026, the sources. Three lines cited the article that founds the obligation, not the one that dates it. They now name the application article: 71(2) for the CRA, 113 for the AI Act, 54 for the Machinery Regulation, whose January 2027 date comes from a corrigendum of 4 July 2023. The repeal of Delegated Regulation 2022/30 cites the act that carries it, Delegated Regulation (EU) 2026/339. No date moved.
What is not settled is said to be so. The ESPR's sectoral delegated acts are not all published, and the prEN 50742 standard for the Machinery Regulation is still a draft. Announcing a firm date for something not finalised would be exactly the fault this page corrects.
What this page is not
The one that already applies to the most manufacturers
Article 14, applicable from 11 September 2026: 24 hours and 72 hours from the moment you learn that a vulnerability in your product is actively exploited, for the early warning and then the notification. euvex matches your components against the CISA KEV catalogue, opens the case and works out the deadlines.