Deadlines worth a place in your plan.

• DORAFinancial servicesIn force · In force since Jan 2025Binding ICT risk and operational-resilience requirements for EU financial entities and their critical ICT third parties.
• EU AI Act: GPAI & first obligationsAIIn force · In force since Aug 2025Prohibited-practice bans and AI-literacy duties have applied since February 2025; general-purpose AI rules, governance bodies and penalties since August 2025.
• EU AI Act: high-risk systemsAIUpcoming · August 2026High-risk AI system requirements apply. UK organisations serving EU users can be in scope. Preparation now beats retrofitting under deadline.
• EU Cyber Resilience Act (CRA)Product securityPhased · Reporting Sept 2026, full Dec 2027Security-by-design and vulnerability-handling duties for makers of products with digital elements. Incident and vulnerability reporting starts September 2026; full obligations from December 2027.
• NIS2Cross-sectorPhased · Transposing across the EUExpands baseline cybersecurity and incident-reporting duties to far more sectors, via member-state law. UK companies with EU operations may inherit obligations.
• UK Cyber Security and Resilience BillUK · Cross-sectorUpcoming · Before ParliamentThe UK’s NIS2-equivalent: extends incident-reporting and baseline security duties to more sectors, including managed-service providers and data centres.
• PCI DSS 4.0.1Card dataIn force · In force since March 2025The card-data security standard’s future-dated v4 requirements are now mandatory for any organisation that stores, processes or transmits payment-card data.
• ISO 42001AIIn force · Available nowThe AI Management System standard, increasingly expected by procurement as evidence of responsible AI governance.

This tracker is a general guide, not legal advice. Dates and scope can change as laws are finalised and transposed; check the official source for the detail that applies to you.