EU-wide

Do I have to, since when, and what is the fine.

Who must, what, since when, who checks, what the fine is and how to sort it out. No legal jargon, a source and a verification date on every card. The free solution always first.

Check your obligations in a few clicks What is new today

days until: CRA: full application, CE marking and technical documentation11 Dec 2027

4obligations already apply

Today

2 items · checked by the editors

already applies EU and worldwide · software and devices on the EU market 24 Oct 2026

CRA: from 11 September 2026 you report an actively exploited vulnerability within 24 hours

Early warning within 24 hours, notification within 72 hours, final report 14 days after the fix, all through the ENISA platform. Applies to anyone who commercially places software or devices on the EU market, wherever they are based. Full application and CE marking from 11 December 2027.

Open the card Source: Regulation (EU) 2024/2847, art. 14 and 71, read on 23 October 2026

new deadline EU · businesses using AI towards customers 24 Oct 2026

AI Act: by 2 December 2026, label AI content for systems on the market before 2 August 2026

The Digital Omnibus on AI moved high-risk systems to 2 December 2027 and 2 August 2028 but left the transparency obligations at 2 August 2026. For older systems the deadline for labelling generated content is 2 December 2026. If you have a chatbot or generate content for customers, check your labels.

Open the card Source: Digital Omnibus on AI, secondary sources 24 October 2026; OJ text being checked