This calendar lists the dated cyber security rules and official milestones that matter for 2026 and 2027, as official pages state them: the EU Cyber Resilience Act, the EU AI Act, NIS2, post-quantum cryptography milestones, and the US and UK reporting rules that have no fixed date yet. It was checked against the official pages on 9 October 2026.
What are the key cyber compliance dates from 2026 to 2028?
Each row below comes from one of our detailed posts and the official page behind it. Where a page gives no date, we say so instead of guessing.
- 11 Jun 2026Cyber Resilience Act Chapter IVNotification of conformity assessment bodies applies.
- 8 Jul 2026NIS2Commission refers Ireland, Spain, France and the Netherlands to the Court of Justice.
- 27 Jul 2026AI OmnibusIt entered into force.
- 2 Aug 2026EU AI ActBecame applicable with some exceptions.
- 11 Sep 2026Cyber Resilience Act reportingManufacturers must report actively exploited vulnerabilities and severe incidents.
- Dec 2026AI Act prohibition 9It comes into effect, introduced as part of the AI Omnibus.
- End of 2026Post-quantum cryptographyAll Member States should start transitioning, says the Commission.
- 17 Oct 2027NIS2 reviewThe Commission reports for the first time by this date.
- 2 Dec 2027AI Act high-risk, Annex III areasRules for certain high-risk areas apply.
- 11 Dec 2027Cyber Resilience Act main obligationsMain obligations apply, including open-source steward reporting.
Which dates fall in the rest of 2026?
The Commission’s Cyber Resilience Act pages say reporting obligations apply as of 11 September 2026, with an early warning within 24 hours of becoming aware. Our post on Cyber Resilience Act dates covers every step. The Commission’s AI Act page says the Act became applicable on 2 August 2026 with some exceptions, and that prohibition 9 comes into effect in December 2026; see EU AI Act dates after the 2026 AI Omnibus.
On NIS2, the Commission’s transposition page lists the 8 July 2026 referral of four Member States to the Court of Justice. NIS2 transposition status in 2026 sets out what the pages say and what they leave open. On post-quantum cryptography, the Commission press release says all Member States should start transitioning by the end of 2026; see post-quantum migration milestones from the NCSC and the EU.
Which dates fall in 2027 and 2028?
The Commission’s AI Act page says rules for systems in certain high-risk areas apply from 2 December 2027, and rules for systems integrated into products from 2 August 2028. The Cyber Resilience Act summary page says the main obligations apply from 11 December 2027, and that EU type-examination certificates remain valid until 11 June 2028 unless they expire before. The NIS2 questions and answers page says the Commission reports on the Directive for the first time by 17 October 2027.
| Rule | 2027 | 2028 |
|---|---|---|
| EU AI Act | 2 December 2027, certain high-risk areas | 2 August 2028, systems integrated into products |
| Cyber Resilience Act | 11 December 2027, main obligations | 11 June 2028, type-examination certificates valid until, unless they expire before |
What has no fixed date yet?
Three items matter for planning but have no date on the pages we read. CISA’s CIRCIA page says reports are not required until the final rule goes into effect and gives no date; see CIRCIA final rule status in 2026. The GOV.UK pages give no royal assent date for the UK Cyber Security and Resilience Bill; see the UK bill post. The SEC rules have applied since the compliance dates in the SEC fact sheet (18 December 2023 for most registrants); see SEC Form 8-K Item 1.05 explained. For how the reporting clocks differ, read incident reporting deadlines.
What do the longer migration dates say?
The NCSC guidance sets 2028, 2031 and 2035 as migration milestones, and the Commission press release says critical infrastructure should be transitioned no later than the end of 2030. NIST says it will deprecate and ultimately remove quantum-vulnerable algorithms from its standards by 2035. These are the bodies’ stated plans, not dated legal duties for most organizations. See post-quantum guidance from NIST and CISA.
How can a team use this calendar?
- List the rules above that could applyAsk counsel which of them cover your products, sectors and countries.
- Put each date on one shared calendarUse the dates as stated on the official pages.
- Mark items with no dateCIRCIA and the UK bill are tracked, not scheduled.
- Recheck the official pages each quarterPages are updated after publication.
For a planning method, see planning a 2027 program with NIST CSF 2.0, and for the wider rule overview cyber security regulations to know in 2026. This calendar is a summary of official pages, not legal advice.
Last checked against the official pages on 9 October 2026. Dates and status can change, so confirm on the pages listed under Sources before acting.
For background on how threats are cataloged, see the Brandefense knowledge hub pages on threat groups, malware families, ATT&CK techniques and significant incidents, and the glossary. The cyber threat intelligence page describes the related service.
Two linked pieces cover this from other angles: DORA in 2026.