Compliance calendar
Plan for source-linked regulatory obligations and Cybersecurity and Infrastructure Security Agency (CISA) directive deadlines, with optional product-lifecycle dates.
Regulatory entries last reviewed against their sources: . Regulatory dates are added by hand after checking the primary source; directive and product-lifecycle dates are derived from cisa.gov and endoflife.date at each export. Product End of Support and End of Life dates are off by default; use the toggle below to show them. Every row names its source.
Upcoming
November 2026
CMMC Phase 2 begins, Level 2 third-party certification required
Defense contractors handling Controlled Unclassified Information (CUI) face the Level 2 certification assessment requirement in applicable solicitations as a condition of contract award. The assessment must be performed by an authorized CMMC Third-Party Assessment Organization (C3PAO), and the Department of Defense may delay the requirement to an option period at its discretion. Contractors without Conditional or Final Level 2 status will be ineligible for affected awards.
Source: eCFR, 32 CFR 170.3(e)(2), one calendar year after the verified 2025-11-10 Phase 1 start
Windows 11 23h2 e: End of Support
Active support ends, though security patches usually continue.
Source: endoflife.date
.NET 9: End of Life
Security patches stop.
Source: endoflife.date
.NET 8: End of Life
Security patches stop.
Source: endoflife.date
PostgreSQL 14: End of Life
Security patches stop.
Source: endoflife.date
December 2026
Fedora 43: End of Life
Security patches stop.
Source: endoflife.date
EU AI Act watermarking obligations for AI-generated content
Providers must have machine-readable marking and transparency solutions for synthetic content in place. The 2026 omnibus set this deadline after cutting the proposed grace period from six months to three.
Source: European Parliament press release, 2026 AI simplification deal
BOD 26-04: Meet the full BOD 26-04 remediation timelines in Table 1 (within 180 days of issuance)
Prioritizing Security Updates Based on Risk.
Date computed from the directive's issued date; not a date CISA published.
Source: CISA BOD 26-04
Kubernetes 1.35: End of Support
Active support ends, though security patches usually continue.
Source: endoflife.date
PCI DSS v4.0.1 full assessment year close
All 51 future-dated PCI DSS v4.x requirements have been effective since 2025-03-31; organizations completing annual QSA assessments in 2026 must demonstrate compliance with the full v4.0.1 requirement set.
FreeBSD 14.4: End of Life
Security patches stop.
Source: endoflife.date
January 2027
Oklahoma consumer data privacy law takes effect
Applies to businesses processing personal data of 100,000 or more Oklahoma consumers, or 25,000 or more where a majority of revenue comes from selling data. Grants access, correction, deletion, and opt-out rights, and requires consent before processing sensitive personal data.
Source: Oklahoma House of Representatives, SB 546 news, signed 2026-03-20
California automated decisionmaking rules, compliance begins
Businesses using automated decisionmaking technology (ADMT) for significant decisions about consumers, such as employment, lending, or housing, must provide pre-use notices, opt-outs, and access rights under the California Consumer Privacy Act (CCPA) regulations adopted in 2025.
Source: California Privacy Protection Agency, CCPA updates page
Windows 10 21h2 iot lts: End of Support
Active support ends, though security patches usually continue.
Source: endoflife.date
Windows 10 21h2 e lts: End of Support
Active support ends, though security patches usually continue.
Source: endoflife.date
Microsoft .NET Framework 4.6.2: End of Life
Security patches stop.
Source: endoflife.date
DORA second anniversary and oversight ramp
Two years into DORA application (effective 2025-01-17), oversight of critical ICT third-party providers by the European Supervisory Authorities continues to mature; financial entities should have completed threat-led penetration testing cycles.
EU Machinery Regulation applies
Regulation (EU) 2023/1230 on machinery products begins to apply, including its cybersecurity and safety requirements for connected and digitally controlled machinery.
Source: EU cybersecurity regulatory update for 2026 and beyond, Reed Smith
February 2027
BOD 26-02: Decommission listed EOS edge devices with an EOS date on or before this milestone, report the decommissions, and inventory devices reaching EOS within the next twelve months (within 12 months of issuance)
Mitigating Risk From End-of-Support Edge Devices.
Date computed from the directive's issued date; not a date CISA published.
Source: CISA BOD 26-02
Kubernetes 1.35: End of Life
Security patches stop.
Source: endoflife.date
March 2027
OpenJDK (Oracle builds) 27: End of Life
Security patches stop.
Source: endoflife.date
Citrix Virtual Apps and Desktops 2203: End of Support
Active support ends, though security patches usually continue.
Source: endoflife.date
Cisco IOS XE 17.15: End of Support
Active support ends, though security patches usually continue.
Source: endoflife.date
DORA registers of information, annual transmission deadline
Financial entities' registers of information on ICT third-party arrangements, reference date 2026-12-31, are transmitted by national competent authorities to the European Supervisory Authorities by 31 March. Entity-level filing deadlines fall earlier in the first quarter and are set nationally.
Source: EBA, DORA register of information reporting FAQ (2025-03-28)
FreeBSD 15.1: End of Life
Security patches stop.
Source: endoflife.date
F5 BIG-IP 17.1: End of Life
Security patches stop.
Source: endoflife.date
F5 BIG-IP 17.1: End of Support
Active support ends, though security patches usually continue.
Source: endoflife.date
April 2027
Belgium NIS2, essential entities must hold CyFun certification
Essential entities on the CyberFundamentals (CyFun) route whose risk assessment lands at assurance level Essential must have obtained CyFun Essential certification from an accredited conformity assessment body, or full ISO/IEC 27001 certification on that pathway, and must report compliance progress to the Centre for Cybersecurity Belgium.
Source: Centre for Cybersecurity Belgium
Kubernetes 1.36: End of Support
Active support ends, though security patches usually continue.
Source: endoflife.date
Node.js 22: End of Life
Security patches stop.
Source: endoflife.date
May 2027
August 2027
EU AI Act compliance deadline for legacy GPAI models
Providers of general-purpose artificial intelligence (GPAI) models placed on the market before 2025-08-02 must have completed the steps needed to comply with the regulation's GPAI obligations.
BOD 26-02: Decommission all identified EOS edge devices and report the decommissions to CISA (within 18 months of issuance)
Mitigating Risk From End-of-Support Edge Devices.
Date computed from the directive's issued date; not a date CISA published.
Source: CISA BOD 26-02
November 2027
CMMC Phase 3 begins, Level 3 government assessments required
Applicable solicitations add the Level 3 requirement, assessed by the Defense Contract Management Agency's Defense Industrial Base Cybersecurity Assessment Center (DIBCAC), as a condition of award. Level 2 third-party certification requirements also extend to option-period exercises on previously awarded contracts.
Source: eCFR, 32 CFR 170.3(e)(3), one calendar year after Phase 2
December 2027
EU AI Act high-risk obligations apply to stand-alone systems
The full high-risk regime (risk management, data governance, technical documentation, human oversight, and conformity assessment) applies to stand-alone high-risk systems under Annex III. Deferred from 2026-08-02 by the 2026 omnibus.
EU Cyber Resilience Act main obligations apply
Secure-by-design requirements, conformity assessment, technical documentation, CE marking, software bill of materials (SBOM), and vulnerability handling obligations take full effect for products with digital elements placed on the EU market.
Source: European Commission, Cyber Resilience Act policy page
February 2028
BOD 26-02: Establish continuous discovery of EOS edge devices and decommission each on or before its EOS date (within 24 months of issuance)
Mitigating Risk From End-of-Support Edge Devices.
Date computed from the directive's issued date; not a date CISA published.
Source: CISA BOD 26-02
August 2028
EU AI Act high-risk obligations for AI embedded in products
High-risk obligations apply to systems that are safety components of, or are themselves, products covered by Annex I harmonisation legislation. Deferred from 2027-08-02 by the 2026 omnibus.
November 2028
CMMC Phase 4, full implementation across DoD contracting
CMMC program requirements appear in all applicable Department of Defense solicitations and contracts, including option periods on contracts awarded before Phase 4. This completes the three-year phase-in that began 2025-11-10.
Source: eCFR, 32 CFR 170.3(e)(4), one calendar year after Phase 3
Recent and passed
NIS2 Directive two-year application milestone
Two years after the 2024-10-17 transposition deadline, national supervisory and enforcement regimes for essential and important entities are expected to be fully operational across member states.
Source: ECSO NIS2 Transposition Tracker
EU Cyber Resilience Act reporting obligations apply
Manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents through the CRA Single Reporting Platform (early warning within 24 hours, full notification within 72 hours). Main obligations follow on 2027-12-11.
Source: European Commission, Cyber Resilience Act reporting page
EU AI Act general application date
The baseline application date of Regulation (EU) 2024/1689. After the 2026 simplification omnibus, obligations for high-risk systems do not start on this date; they were deferred to 2027-12-02 and 2028-08-02. The remaining framework, including transparency and governance provisions, becomes applicable.
Source: EUR-Lex, Regulation (EU) 2024/1689, Article 113, and the Consilium AI Act timeline
Arkansas Children and Teens' Online Privacy Protection Act
State law modeled on the federal Children's Online Privacy Protection Act (COPPA) takes effect, adding consent, data minimization, and operator duties for children's and teens' online data.
Source: Arkansas General Assembly, Act 952 of 2025 (HB 1717)
Connecticut Data Privacy Act amendments effective
Public Act 25-113 lowers applicability thresholds so all sensitive data processing and all personal data sales are covered regardless of volume, expands consumer access rights, and strengthens protections for minors.
NIS2 first compliance audit reference date (passed, tracking)
Reference date cited by practitioners for the first NIS2 compliance audit cycle in early-transposing member states, retained for historical context.
CMMC Phase 1 began, self-assessments required in DoD contracts
The Cybersecurity Maturity Model Certification (CMMC) acquisition rule took effect and contracting officers began inserting DFARS clause 252.204-7021 in applicable solicitations. Phase 1 requires Level 1 or Level 2 self-assessments with affirmations in the Supplier Performance Risk System (SPRS) as a condition of award. Kept as the anchor for the phased schedule below.
Source: Federal Register, DFARS Case 2019-D041 final rule, effective 2025-11-10, and DoD CIO CMMC