Compliance Roadmap 2026/2027 – EU digital regulation for companies
This roadmap bundles the key deadlines and first steps for the five central EU digital regulations. Tick off what you've checked – and get expert support for the binding assessment. As of June 2026.
- 1. EU AI Act – transparency from 02 Aug 2026
Affected if you use or offer AI. First steps: ensure AI literacy, rule out prohibited practices, label chatbots and AI-generated content. High-risk duties were postponed (Annex III now from Dec 2027).
- 2. NIS2 – in force since 06 Dec 2025
Affected from 50 staff or €10m turnover in one of the 18 sectors. First steps: check exposure, register with the BSI, set up risk management per § 30 BSIG, establish the reporting process (24 h/72 h/1 month).
- 3. EU Data Act – core duties since 12 Sep 2025
Affected for connected products (IoT) or cloud services. First steps: enable user data access, review fair contract terms, check cloud contracts for switching barriers (switching-charge ban from Jan 2027).
- 4. Cyber Resilience Act – reporting from 11 Sep 2026
Affected for products with digital elements (hard/software). First steps: bake in security-by-design, define a support period, build vulnerability management and an update process; full requirements + CE from Dec 2027.
- 5. DORA – in force since 17 Jan 2025
Affected as a financial entity or its ICT provider. First steps: establish ICT risk management and incident reporting, keep a register of information, make third-party contracts DORA-compliant.
- 6. Define responsibilities & monitoring
Name owners per regulation, document records and plan regular reviews. Deadlines shift (see AI Act) – a living roadmap beats a one-off action.
Next steps: Take the quick check first to narrow down your exposure, and start with the regulations already in force (NIS2, Data Act, DORA). Unsure about the technical implementation? Email us at info@rocket-monkeys.com for a no-pressure intro call.
⚠️ Important note: This content is for general information and is not legal advice. Deadlines and obligations may change; whether you are affected depends on your specific case. For a binding assessment, consult qualified advisors. As of June 2026.