Compliance deadlines 2026-2027: the calendar of dates to put in your diary

Compliance deadlines no longer arrive one at a time: they overlap. Within twelve months, an Italian SME can find itself closing out the NIS2 baseline measures, meeting the new AI Act transparency obligations, preparing its first gender pay gap report and moving to the new ISO 9001. Each of these deadlines is manageable on its own. All together, without a single calendar, they become the fastest way to pile up non-conformities and avoidable penalties.

This guide brings together the 2026 and 2027 compliance deadlines that genuinely affect Italian small and medium-sized businesses, checked against legal texts and public authority communications as of 31 October 2026. We have split them into four groups: obligations already in force, deadlines by the end of 2026, 2027 deadlines and dates from 2028 onwards. You will find a summary table to copy into your compliance calendar and, for each regulation, what to do in practice. Where a date depends on your specific situation, as with NIS2, we say so clearly instead of giving one date for everyone.

Not sure which risk class your AI systems fall into? Take our free AI Act risk class check: five questions, two minutes, with your obligations and deadlines.

How to read this compliance deadline calendar

A compliance calendar is only useful if it distinguishes between obligations that already apply and future ones. Many companies treat as a "deadline" a requirement that has actually been in force for months, and risk finding out during an inspection.

What is a compliance calendar?

A compliance calendar is the ordered list of dates by which a company must adopt a measure, submit a notification or pass an audit. It is not the same as a legal diary: it also includes recurring annual windows (such as those on the ACN platform for NIS2), ISO standard transitions and related internal deadlines, for example reviewing the risk assessment before a surveillance audit. For an SME managing several regulations, it is the tool that prevents a last-minute rush.

In this guide we use four labels. Already in force marks obligations you must meet today, even if the start date has passed. By the end of 2026 covers deadlines in November and December 2026. 2027 collects next year's dates, including annual windows that reopen. 2028 and beyond covers long transitions, which need planning now precisely because they seem far away.

Why some dates are "per entity" rather than the same for everyone

Not every deadline has a fixed date valid for every business. The clearest case is NIS2: the time limits for notifications and security measures run from the individual communication in which Italy's National Cybersecurity Agency (ACN) informs the entity that it has been included in the list. Two companies added in the same year can have deadlines a few days apart.

The same applies to certifications: the annual surveillance of an ISO 9001 or of the gender equality certification falls according to the issue date of your certificate, not a national date. That is why, alongside the general dates, we always tell you which event starts the clock. A practical rule: when a source gives "31 October" or "30 June" for everyone, always check the document that concerns you directly.

The 2026-2027 compliance deadline calendar in one table

The table below summarises the dates confirmed by legal texts and official communications. "Per entity" dates are marked as such. Recurring 2027 windows are shown according to the rules in force today: if the authority changes them, we will update this guide.

Alongside these dates there are the "moving" deadlines tied to your certificates: annual surveillance audits and three-yearly renewals for ISO 9001, ISO 14001, ISO 27001 and the UNI/PdR 125 gender equality certification.

NIS2: what is left to do after the baseline measures deadline

For most NIS entities added to the list in 2025, October 2026 marks the shift from the adjustment phase to the supervision phase. But the NIS2 calendar does not end there: Legislative Decree 138/2024 (the Italian NIS2 decree) sets out requirements that recur every year on the ACN platform, and entities added in 2026 have their own deadlines. If you do not yet know whether your company falls within scope, our page on the NIS2 directive and Legislative Decree 138/2024 explains the criteria for application.

October 2026: baseline measures and the start of supervision

According to ACN, NIS entities must adopt the baseline security measures by October 2026. The time limit is 18 months from the communication of inclusion in the list: if you received it in April 2025, your deadline falls in October 2026, on the corresponding day. Many commentators give 31 October as a single date, but the correct reference remains your individual communication.

The baseline measures are defined by ACN determination no. 379907/2025, applicable from 15 January 2026, which replaced the earlier determination no. 164179 of April 2025. They cover governance, risk management, incident management, business continuity, the supply chain, access control and training, with requirements that differ between essential and important entities.

If the work is not complete at the end of October, the priority is not to hide the delay but to document it: an adjustment plan with responsibilities, timescales and evidence of progress is what demonstrates a serious approach in the event of an inspection. The penalties under Article 38 of the decree reach up to €10 million or 2% of annual worldwide turnover for essential entities, and up to €7 million or 1.4% for important entities.

Recurring requirements on the ACN platform

Every NIS entity has three annual windows to keep an eye on, set by ACN determination no. 314287/2026, which replaced no. 127437/2026 from 25 October 2026. From 1 January to 28 February, registration or its update must be completed on the ACN platform: entities already on the list with no changes to report do not need to repeat it. From 15 April to 31 May, the set of information required by Article 7 of the decree must be updated, which includes contact points and the list of relevant NIS suppliers. Finally, from 1 May to 30 June, the categorised list of activities and services must be submitted using the template in determination 155238/2026; financial entities subject to DORA are exempt.

The obligation to notify significant incidents, on the other hand, is continuous. For entities added in 2025 it has applied since January 2026 and follows the sequence set by the decree: pre-notification within 24 hours of becoming aware of the incident, notification within 72 hours and a final report within one month of the notification. A written procedure, with names and on-call numbers, is worth more than any generic policy.

Entities added to the list in 2026: December 2026 and July 2027

Entities that received the inclusion communication in 2026 follow a different calendar, set by ACN determination no. 127434/2026. By 31 December 2026 they must appoint the CSIRT contact person, meaning the person who liaises with CSIRT Italia and handles notifications. From 1 January 2027 the obligation to notify significant incidents applies. By 31 July 2027 the baseline security measures must be adopted.

For these entities, the most common mistake is reading guides written for those added in 2025 and concluding that they are already late, or, conversely, underestimating the fact that July 2027 is less than nine months away. A gap analysis completed by the end of the year leaves the first half of 2027 for implementation.

AI Act after the Digital Omnibus: which dates really apply

The Digital Omnibus postponed the obligations for high-risk systems, but it did not postpone the AI Act. That is the most important distinction to make today. Amending regulation (EU) 2026/1744 was approved by the European Parliament on 16 June 2026 and by the Council on 29 June 2026, published in the Official Journal of the European Union on 24 July 2026 and has been in force since 27 July 2026. The dates for the chapters not affected by the postponement remain those originally set in regulation (EU) 2024/1689.

Already in force: prohibitions, literacy, general-purpose models and Article 50

Since 2 February 2025, AI practices considered unacceptable, such as subliminal manipulation or social scoring, have been prohibited, and the AI literacy obligation in Article 4 has applied. The Digital Omnibus reworded it: providers and deployers must take measures to support AI literacy among their staff, without having to guarantee a specific level for each individual. The obligation remains, but becomes more proportionate.

Since 2 August 2025, the rules on general-purpose AI models, governance and the penalties regime have applied. Since 2 August 2026, the transparency obligations in Article 50 have been in force: anyone offering a chatbot must tell users they are interacting with an AI, anyone generating synthetic content must mark it in a machine-readable way, and anyone distributing deepfakes must disclose them. We have written a dedicated guide to the AI Act Article 50 transparency obligations, with practical examples for SMEs.

In Italy, Law 132/2025, in force since 10 October 2025, designated AgID and ACN as the national authorities for artificial intelligence. AI Act penalties reach up to €35 million or 7% of worldwide turnover for prohibited practices and up to €15 million or 3% for breaches of other obligations, including Article 50, with the lower amount applying to SMEs and start-ups.

2 December 2026: the forgotten marking deadline

2 December 2026 is the only AI Act date in the next two months, and it is easy to miss. For generative AI systems placed on the market before 2 August 2026, the technical marking obligation in Article 50(2) applies from 2 December 2026. It mainly concerns those who develop or integrate tools that generate text, images, audio or video, for example a software house that has released a generative assistant to its clients. The new prohibitions introduced by the Digital Omnibus also apply from the same date: placing on the market or using AI systems that generate intimate or sexually explicit images, video or audio of identifiable people without their consent, or child sexual abuse material, is banned.

If you only use third-party tools, this deadline falls on the tool provider. Even so, it is worth asking in writing how they intend to comply, because the labelling obligations for deepfakes and for texts published on matters of public interest remain with whoever distributes them.

2 December 2027 and 2 August 2028: high-risk systems

The Digital Omnibus moved the obligations for the high-risk systems listed in Annex III, such as those used for recruitment, creditworthiness assessment or access to education, from 2 August 2026 to 2 December 2027. The obligations for high-risk systems embedded in already regulated products (Annex I, such as machinery or medical devices) move to 2 August 2028.

The postponement gives you time, not an exemption. A company using AI software to screen CVs will be a deployer of a high-risk system from December 2027 and will have to ensure human oversight, log retention and information for workers. Mapping the systems in use today, with an inventory that records for each one the company's role, purpose and risk level, is the first concrete step.

Cyber Resilience Act and DORA: deadlines for technology manufacturers and the financial supply chain

Two European regulations directly affect some SMEs and indirectly many others. The Cyber Resilience Act applies to manufacturers of products with digital elements; DORA applies to financial entities, but its requirements cascade down to ICT providers through contracts.

Cyber Resilience Act: reporting from 11 September 2026, full application in December 2027

Regulation (EU) 2024/2847, known as the Cyber Resilience Act, has three dates. Since 11 June 2026, the rules on notifying conformity assessment bodies have applied. Since 11 September 2026, manufacturers have had to report actively exploited vulnerabilities and severe incidents affecting their products. From 11 December 2027 the whole regulation applies, including the essential cybersecurity requirements and CE marking.

According to the European Commission, reports go through the single platform managed by ENISA and follow a precise sequence: early warning within 24 hours, notification within 72 hours, and a final report within 14 days of a corrective measure becoming available for vulnerabilities and within one month of the notification for severe incidents. The obligation also covers products already on the market. An SME that manufactures connected devices, firmware or software sold as a product must therefore already have a working vulnerability management process today. Penalties for breaching the essential requirements and reporting obligations reach up to €15 million or 2.5% of annual worldwide turnover.

DORA: in force since January 2025, with a fixed date every March

Regulation (EU) 2022/2554 has applied since 17 January 2025 to banks, intermediaries, insurers, asset managers and other financial entities. It has no new application dates in 2027, but it does have an annual requirement: the register of information on arrangements with ICT service providers. According to the Bank of Italy's communication, from 2026 the submission is annual, by 15 March, with data as at 31 December of the previous year, via the INFOSTAT platform. Entities supervised by other authorities follow their own instructions.

For SMEs providing ICT services to financial clients, the practical consequence is contractual: expect requests on business continuity, incident management, subcontracting and audit rights. Arriving prepared is a commercial advantage. We cover these aspects in more depth on our page dedicated to the Digital Operational Resilience Act (DORA).

Pay transparency and gender equality: deadlines for HR

2026 brought a concrete change for the HR department. Directive (EU) 2023/970 on pay transparency was transposed in Italy by Legislative Decree no. 96 of 7 May 2026, published in Official Gazette no. 125 of 1 June 2026 and in force since 7 June 2026, that is, within the transposition deadline set by the directive.

What is already in force and what is due on 7 June 2027

Since 7 June 2026, the transparency obligations have applied to all employers, regardless of size. Among the most significant: the ban on asking candidates about their pay in current or previous jobs, the obligation to state the starting pay or its range in job adverts, and workers' right to receive information on average pay levels for categories doing the same work or work of equal value.

Periodic reporting of gender pay gap data, by contrast, only concerns employers with at least 100 employees and follows the size-based timetable in Article 9 of the decree. For employers with at least 250 employees, the data must be collected by 7 June 2027 and every year thereafter. Those with between 150 and 249 employees have the same first deadline, then a three-yearly cycle. For those with between 100 and 149 employees, the first deadline is 7 June 2031, then every three years. The collection arrangements are left to a decree of the Minister of Labour. Under the EU directive, the data refer to the previous calendar year: if your payroll systems do not already separate fixed and variable components by gender, the work needs to start now.

Gender equality certification: surveillance, INPS contribution relief and the biennial report

The UNI/PdR 125:2022 certification is valid for three years with an annual surveillance audit, which falls according to the certificate's issue date. The timetable, requirements and assessment areas are explained in our complete guide to gender equality certification: here we focus on the dates.

The contribution relief provided by Law 162/2021 is worth up to 1% of the employer's contributions, capped at €50,000 a year. In the latest round, according to INPS (the Italian social security institute) message no. 3804 of 16 December 2025, employers certified by 31 December 2025 could apply until 30 April 2026. Those who already obtained the relief in a previous round do not need to reapply: according to INPS, the relief applies for the full 36 months of the certificate's validity. For certifications obtained in 2026, the new window will be set by an INPS message that, at the date of this guide, has not yet been published: it is worth being ready with your certificate and documentation as early as January.

There is also the obligation to produce the biennial report on the situation of male and female staff for companies with more than 50 employees. The report on the 2024-2025 period had to be submitted by 15 May 2026, after the extension granted by the Ministry of Labour. The next one, on the 2026-2027 period, must be submitted by 30 April 2028.

ISO 9001:2026 and ISO 14001:2026: how long you have for the transition

2026 is the year two of the most widespread ISO standards in Italy are revised. Both have a three-year transition, but with timetables five months apart. It is also worth remembering that on 1 January 2026 the International Accreditation Forum (IAF) merged, together with the international laboratory organisation, into Global Accreditation Cooperation (Global ACI), which now issues the transition requirements.

ISO 14001:2026: 2015 certificates valid until 30 April 2029

ISO 14001:2026 was published on 15 April 2026. Under the transition arrangements adopted in Italy by the national accreditation body on the basis of Global ACI rules, the transition period ends on 30 April 2029: from that day, ISO 14001:2015 certificates lose validity. After 31 October 2027, no new certificates can be issued against the 2015 version.

The transition takes place through a dedicated audit or one combined with a surveillance or renewal audit. The revision is evolutionary, not a rewrite: the main changes concern change management and more explicit consideration of environmental conditions, such as climate change and biodiversity, in the analysis of context. A company with its renewal in 2027 has every reason to make it coincide with the transition. To set out the path, you can start from our page on ISO 14001 certification.

ISO 9001:2026: published on 16 September 2026

ISO 9001:2026 was published on 16 September 2026 and replaces the 2015 version. Here too the transition lasts three years: under the national arrangements issued on 20 October 2026 on the basis of Global ACI rules, ISO 9001:2015 certificates lose validity on 30 September 2029, and after 31 March 2028 no new certificates can be issued against the 2015 version.

If you are ISO 9001 certified, the practical advice is not to wait until 2029: planning the transition together with your next three-yearly renewal avoids an extra audit and spreads the workload.

ISO 27001: the transition to the 2022 version has closed

The three-year transition to ISO/IEC 27001:2022 set by the IAF closed on 31 October 2025. Certificates against the 2013 version are no longer valid. If your company did not complete the transition in time, it now faces a new initial certification. We mention this because the 2013 version is still cited in tender specifications, supplier questionnaires and internal documentation: updating the references avoids disputes.

GDPR and accessibility: ongoing obligations with one date to note in 2027

The GDPR and the European Accessibility Act do not have "deadlines" in the classic sense: they are obligations already in force that require ongoing maintenance. They do, however, have some dates that are useful for planning.

GDPR: the procedural regulation from 2 April 2027

The GDPR has applied since 2018 and its obligations do not expire: records of processing, impact assessments, appointments, notification of breaches to the Garante (the Italian data protection authority) within 72 hours. The new item in the calendar is regulation (EU) 2025/2518, which harmonises procedures between supervisory authorities for cross-border cases. It has been in force since 1 January 2026 and applies from 2 April 2027 to investigations opened and complaints lodged after that date. It introduces no new obligations for businesses, but makes timescales and procedural rights more predictable for those processing data in several EU countries.

At national level, the Garante plans its inspections by half-year. The plan for August-December 2026 also includes checks on those acting as data protection officers for public bodies. It is a clear signal: the DPO is assessed on what they do, not on the appointment. If your company needs to appoint one, or wants ongoing oversight, you can consider an outsourced DPO.

European Accessibility Act: in force, with a transitional period until 2030

Legislative Decree 82/2022, which transposes the European Accessibility Act, has applied since 28 June 2025 to covered products and services, including e-commerce, consumer banking services, e-books and passenger transport services. The transitional period until 28 June 2030 is limited: service providers may keep using products they lawfully used before 28 June 2025, and service contracts agreed before that date may continue unchanged until they expire, but no later than 2030. The directive exempts microenterprises providing services from the obligations.

AgID is the supervisory authority for services and has published guidelines on the accessibility of services. For an SME with an e-commerce site, then, 2030 is not a general postponement: a service offered to consumers today must already be compliant, except in the cases covered by the transitional period.

How to build your 2027 compliance calendar

Having the list of dates is not enough: you need to turn it into responsibilities and activities. Companies that arrive prepared for compliance deadlines work from a single calendar, with an owner for every line and the evidence already gathered before the audit.

A five-step method

The method we use with the companies we support can be summarised as follows:

1. Scope. Check which regulations genuinely apply to you: are you a NIS entity? Do you manufacture products with digital elements? Do you use AI systems in recruitment? Do you have at least 150 employees?

2. Per-entity dates. Gather the documents that set your own deadlines: the ACN communication, the dates of your ISO and UNI/PdR 125 certificates, contractual deadlines with financial clients.

3. Recurring windows. Add the annual windows to your calendar (NIS2 January-February, April-May, May-June; DORA by March) with a reminder at least four weeks ahead.

4. Evidence. For each deadline, define which document or record proves compliance and where it is stored.

5. Audit integration. Align ISO transitions, surveillance audits and internal reviews to reduce the number of audits and the burden on your people.

The mistakes we see most often

The first mistake is treating each regulation as a separate project, with different consultants, folders and calendars. The result is duplicated and contradictory documents: the risk assessment carried out for NIS2 does not talk to the ISO 27001 one, and the supplier mapping for DORA ignores the one done for NIS2. An integrated management system reduces the work and improves consistency.

The second mistake is considering a deadline closed when the measure has been adopted but not documented. In an ACN inspection, a certification audit or a Garante check, what counts is the evidence: minutes, records, logs, an approved and dated policy. The third mistake is relying on generic dates read online without checking the one that applies to your case, as the NIS2 measures example shows.

How Complaion helps you never miss a deadline

There are many compliance deadlines in 2026 and 2027, but they are manageable if they sit in a single calendar with clear responsibilities and evidence. That is exactly how we work with our more than 1,000 clients.

Every company has a dedicated Lead Auditor who knows the regulations involved and helps you understand which dates genuinely apply to you. Our platform gathers evidence in one place, manages documents, keeps your compliance calendar and prepares the audit, so surveillance audits, transitions and requirements do not overlap. We support you on NIS2, the AI Act, DORA, GDPR with an outsourced DPO, gender equality certification and ISO standards, including the transitions to ISO 9001:2026 and ISO 14001:2026.

Want to find out which deadlines apply to your company? Book a free 30-minute call with one of our Lead Auditors.

Frequently asked questions about 2026-2027 compliance deadlines

What is the next NIS2 deadline after October 2026?

For entities added to the list in 2025, the next deadline is the window for registration or registration update on the ACN platform, to be used if there are changes to report, from 1 January to 28 February 2027. This is followed by the annual information update from 15 April to 31 May and the categorisation of activities and services from 1 May to 30 June. For entities added in 2026, the key dates are 31 December 2026 for the CSIRT contact person, 1 January 2027 for the start of notifications and 31 July 2027 for the baseline measures.

Has the Digital Omnibus postponed the whole AI Act?

No. Regulation (EU) 2026/1744 only postponed the obligations for high-risk systems: to 2 December 2027 for Annex III systems and to 2 August 2028 for Annex I systems. The prohibitions and AI literacy have applied since 2 February 2025, the rules on general-purpose models since 2 August 2025 and the Article 50 transparency obligations since 2 August 2026. The only extension on Article 50 concerns technical marking for generative systems already on the market, until 2 December 2026. The new prohibitions on AI-generated non-consensual intimate content and child sexual abuse material also apply from that date.

My company has 80 employees: does it need to produce the gender pay gap report?

No, the periodic report on the gender pay gap concerns employers with at least 100 employees, with the first deadline in 2027 for those with at least 150 and in 2031 for those with between 100 and 149. However, since 7 June 2026, a company with 80 employees must also comply with the transparency obligations of Legislative Decree 96/2026. These include pay information for candidates, the ban on asking about pay history and workers' right to information.

By when do I need to move to ISO 14001:2026?

ISO 14001:2015 certificates lose validity on 30 April 2029, under the transition arrangements adopted in Italy. After 31 October 2027 no new certificates can be issued against the 2015 version, so anyone facing initial certification or renewal after that date will have to do so directly against the 2026 version. The transition can be carried out during a surveillance or renewal audit. Planning it together with the three-yearly renewal is generally the most efficient solution.

Does the Cyber Resilience Act also apply to developers of business management software?

It depends on how the software is made available. The Cyber Resilience Act applies to products with digital elements placed on the European market, including software sold as a product, whereas services provided exclusively as SaaS generally fall under other regulations, such as NIS2. If your software is within scope, since 11 September 2026 you have had to report actively exploited vulnerabilities and severe incidents, and from 11 December 2027 you must meet all the essential requirements. Scope needs to be checked product by product.

I missed the INPS window for the gender equality contribution relief: what can I do?

The window for certifications obtained by 31 December 2025 closed on 30 April 2026. If you obtained certification in 2026, you will need to apply in the next round, whose dates will be set by an INPS message not yet published at the date of this guide. In the meantime, it is worth checking that the certificate is valid and that the annual surveillance is scheduled, because the relief is tied to the certificate's period of validity.

Is ISO 27001:2013 still valid?

No. The transition to ISO/IEC 27001:2022 closed on 31 October 2025 and certificates against the 2013 version are no longer valid. An organisation that did not complete the transition must undergo a new initial certification against the 2022 version. It is good practice to also update references to the old version in contracts, supplier questionnaires and management system documentation.

How can I manage all these deadlines with a small team?

The most effective approach is to unify: a single calendar, a single evidence archive, an integrated management system covering several standards with the same processes. Many requirements overlap, for example risk, supplier and incident management across NIS2, ISO 27001 and DORA. Working with an experienced auditor who knows all the regulations involved avoids duplicating work and arriving at the audit with inconsistent documents.