NIS-2 · Section 32 BSIG
Report a security incident
Early warning to the BSI within 24 hours, notification within 72 hours, final report after one month.
Home / Deadline calendar
Regulation · dates and deadlines · as of 10 November 2026
Deadline calendar: NIS-2, DORA, CRA, AI Act and GDPR
Which obligation has applied since when, and what comes next? Here you will find the most important dates for companies and financial institutions in Germany. Each entry states what to do and how we can support you.
Coming up next
Upcoming dates
-
Labelling of AI-generated content for existing systems too
AI systems that generate synthetic audio, image, video or text content and were already on the market before 2 August 2026 must mark their outputs in a machine-readable format (Art. 50(2) AI Act; transitional period under amending Regulation (EU) 2026/1744).
-
BAIT repealed in full
The BAIT now only apply to institutions that do not have to apply the ICT risk management requirements of DORA. They will be repealed in full at the end of 31 December 2026. Anyone still working to BAIT should align their ICT risk management with DORA now. 31 December is also expected to be the reference date for the next register of information again; BaFin announces the submission period.
DORA audit · Vercora with register of information · DORA courses
-
High-risk AI systems under Annex III
The obligations for stand-alone high-risk AI systems, for example in HR, credit scoring or critical infrastructure, apply from this date. Originally 2 August 2026 was planned; amending Regulation (EU) 2026/1744 postponed the date.
-
Cyber Resilience Act fully applicable
Products with digital elements may then only be placed on the market if they meet the cybersecurity requirements of Annex I, have undergone conformity assessment and bear the CE marking. This includes a software bill of materials (SBOM) and structured vulnerability handling.
CRA course: SBOM and manufacturer obligations · Vercora with SBOM management
-
High-risk AI in regulated products under Annex I
AI used as a safety component in products already subject to product legislation, such as machinery or medical devices, must meet the high-risk requirements from this date.
Already in force
These obligations already apply
If any of these dates is still open for you, action is required. The Readiness Check shows where you stand in a short time.
-
Reporting obligations for manufacturers
Manufacturers report actively exploited vulnerabilities and severe security incidents via ENISA’s single reporting platform (Art. 14 CRA): early warning within 24 hours, notification within 72 hours, final report 14 days after a corrective measure is available or one month after notifying an incident. The obligation also covers products already on the market before that date.
-
AI Act generally applicable, transparency obligations
Most provisions of the AI Act apply, including the transparency obligations under Art. 50: people must be able to recognise that they are interacting with an AI system, and deepfakes must be disclosed.
-
Rules for conformity assessment bodies
The provisions on notification of conformity assessment bodies (Chapter IV CRA) apply. Manufacturers of important and critical products should plan their conformity assessment early.
-
Register of information 2026 submitted to BaFin
Financial entities submitted their register of information on contractual arrangements with ICT third-party service providers from 9 to 30 March 2026, reference date 31 December 2025 (Art. 28(3) DORA). The register must be kept up to date and submitted annually.
Vercora with register of information · Outsourcing officer course
-
Registration with the BSI
Essential and important entities had to register with the BSI within three months of entry into force (Section 33 BSIG). According to the BSI, late registrations were accepted until 31 July 2026 without immediate measures. The obligation remains: anyone not yet registered should do so without delay.
-
NIS-2 Implementation Act in force
The new BSIG applies. Entities in scope must implement risk management measures (Section 30), report significant security incidents (Section 32), and management must approve the measures, monitor their implementation and attend training regularly (Section 38).
NIS2 as a Service · NIS2 management board training · Vercora
-
Obligations for general-purpose AI models
Providers of general-purpose AI models must, among other things, provide technical documentation and respect copyright.
-
Prohibited AI practices and AI literacy
Certain AI practices are prohibited (Art. 5). Providers and deployers of AI systems ensure that their staff have a sufficient level of AI literacy (Art. 4).
-
DORA applies
Regulation (EU) 2022/2554 applies directly to financial entities: ICT risk management, reporting of major ICT-related incidents, resilience testing, management of ICT third-party risk. The management body bears responsibility and keeps its knowledge up to date through regular training (Art. 5(4)). VAIT, ZAIT and KAIT ceased to apply at the end of 16 January 2025.
Ongoing obligations
Deadlines that start again with every incident
These obligations have no fixed date. They apply as soon as something happens, or recur regularly.
DORA · Art. 19
Report an ICT incident
Report major ICT-related incidents to the supervisor: initial, intermediate and final report within the deadlines of the technical standards.
GDPR · Art. 33
Report a data breach
Report personal data breaches to the supervisory authority within 72 hours, unless the risk to the individuals concerned is low.
BSIG · DORA · GDPR
Train regularly
Management (Section 38(3) BSIG, Art. 5(4) DORA), all employees (Art. 13(6) DORA) and data protection awareness (Art. 39 GDPR), each with evidence.
As of 10 November 2026. The calendar is for guidance only and is not legal advice; whether and from when an obligation applies to you depends on your classification. Sources: Regulation (EU) 2022/2554 (DORA), Regulation (EU) 2024/2847 (CRA), Regulation (EU) 2024/1689 (AI Act) with amending Regulation (EU) 2026/1744, BSIG as amended by the NIS2UmsuCG, communications from BSI, BaFin and Deutsche Bundesbank.
Which deadlines affect you?
In an initial consultation we assess your classification and show which dates matter to you and what needs to be done by then.