Regulatory and compliance calendar

Cisco IOS XE 17.9 reaches End of Life on 2026-07-29 (security patches stop). Lifecycle data from endoflife.date.

The baseline application date of Regulation (EU) 2024/1689. After the 2026 simplification omnibus, obligations for high-risk systems do not start on this date; they were deferred to 2027-12-02 and 2028-08-02. The remaining framework, including transparency and governance provisions, becomes applicable.

F5 BIG-IP 21.0 reaches End of Life on 2026-08-06 (security patches stop). Lifecycle data from endoflife.date.

F5 BIG-IP 21.0 reaches End of Support on 2026-08-06 (active support ends, though security patches usually continue). Lifecycle data from endoflife.date.

Prioritizing Security Updates Based on Risk. Compliance deadline from CISA BOD 26-04.

Kubernetes 1.34 reaches End of Support on 2026-08-27 (active support ends, though security patches usually continue). Lifecycle data from endoflife.date.

OpenSSL 3.0 reaches End of Life on 2026-09-07 (security patches stop). Lifecycle data from endoflife.date.

Manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents through the CRA Single Reporting Platform (early warning within 24 hours, full notification within 72 hours). Main obligations follow on 2027-12-11.

OpenJDK (Oracle builds) 26 reaches End of Life on 2026-09-18 (security patches stop). Lifecycle data from endoflife.date.

FreeBSD 15.0 reaches End of Life on 2026-09-30 (security patches stop). Lifecycle data from endoflife.date.

Fortinet FortiOS 7.2 reaches End of Life on 2026-09-30 (security patches stop). Lifecycle data from endoflife.date.

Python 3.13 reaches End of Support on 2026-10-01 (active support ends, though security patches usually continue). Lifecycle data from endoflife.date.

Windows 11-24h2-w reaches End of Life on 2026-10-13 (security patches stop). Lifecycle data from endoflife.date.

Windows 11-24h2-w reaches End of Support on 2026-10-13 (active support ends, though security patches usually continue). Lifecycle data from endoflife.date.

Windows 10-1607-e-lts reaches End of Life on 2026-10-13 (security patches stop). Lifecycle data from endoflife.date.

Windows Server 2022 reaches End of Support on 2026-10-13 (active support ends, though security patches usually continue). Lifecycle data from endoflife.date.

Two years after the 2024-10-17 transposition deadline, national supervisory and enforcement regimes for essential and important entities are expected to be fully operational across member states.

Node.js 24 reaches End of Support on 2026-10-20 (active support ends, though security patches usually continue). Lifecycle data from endoflife.date.

OpenSSL 3.4 reaches End of Life on 2026-10-22 (security patches stop). Lifecycle data from endoflife.date.

Kubernetes 1.34 reaches End of Life on 2026-10-27 (security patches stop). Lifecycle data from endoflife.date.

Citrix Virtual Apps and Desktops 2503 reaches End of Life on 2026-10-29 (security patches stop). Lifecycle data from endoflife.date.

Citrix Virtual Apps and Desktops 2603 reaches End of Support on 2026-10-30 (active support ends, though security patches usually continue). Lifecycle data from endoflife.date.

Python 3.10 reaches End of Life on 2026-10-31 (security patches stop). Lifecycle data from endoflife.date.

Alpine Linux 3.21 reaches End of Life on 2026-11-01 (security patches stop). Lifecycle data from endoflife.date.

OpenSSL 3.6 reaches End of Life on 2026-11-01 (security patches stop). Lifecycle data from endoflife.date.

Defense contractors handling Controlled Unclassified Information (CUI) face the Level 2 certification assessment requirement in applicable solicitations as a condition of contract award. The assessment must be performed by an authorized CMMC Third-Party Assessment Organization (C3PAO), and the Department of Defense may delay the requirement to an option period at its discretion. Contractors without Conditional or Final Level 2 status will be ineligible for affected awards.

Windows 11-23h2-e reaches End of Life on 2026-11-10 (security patches stop). Lifecycle data from endoflife.date.

Windows 11-23h2-e reaches End of Support on 2026-11-10 (active support ends, though security patches usually continue). Lifecycle data from endoflife.date.

.NET 9 reaches End of Life on 2026-11-10 (security patches stop). Lifecycle data from endoflife.date.

.NET 8 reaches End of Life on 2026-11-10 (security patches stop). Lifecycle data from endoflife.date.

PostgreSQL 14 reaches End of Life on 2026-11-12 (security patches stop). Lifecycle data from endoflife.date.

Providers must have machine-readable marking and transparency solutions for synthetic content in place. The 2026 omnibus set this deadline after cutting the proposed grace period from six months to three.

Prioritizing Security Updates Based on Risk. Compliance deadline from CISA BOD 26-04.

Fedora 43 reaches End of Life on 2026-12-09 (security patches stop). Lifecycle data from endoflife.date.

Kubernetes 1.35 reaches End of Support on 2026-12-28 (active support ends, though security patches usually continue). Lifecycle data from endoflife.date.

All 51 future-dated PCI DSS v4.x requirements have been effective since 2025-03-31; organizations completing annual QSA assessments in 2026 must demonstrate compliance with the full v4.0.1 requirement set.

FreeBSD 14.4 reaches End of Life on 2026-12-31 (security patches stop). Lifecycle data from endoflife.date.

Applies to businesses processing personal data of 100,000 or more Oklahoma consumers, or 25,000 or more where a majority of revenue comes from selling data. Grants access, correction, deletion, and opt-out rights, and requires consent before processing sensitive personal data.

Businesses using automated decisionmaking technology (ADMT) for significant decisions about consumers, such as employment, lending, or housing, must provide pre-use notices, opt-outs, and access rights under the California Consumer Privacy Act (CCPA) regulations adopted in 2025.

Windows 10-21h2-iot-lts reaches End of Support on 2027-01-12 (active support ends, though security patches usually continue). Lifecycle data from endoflife.date.

Windows 10-21h2-e-lts reaches End of Life on 2027-01-12 (security patches stop). Lifecycle data from endoflife.date.

Windows 10-21h2-e-lts reaches End of Support on 2027-01-12 (active support ends, though security patches usually continue). Lifecycle data from endoflife.date.

Windows Server 2016 reaches End of Life on 2027-01-12 (security patches stop). Lifecycle data from endoflife.date.

Microsoft .NET Framework 4.6.2 reaches End of Life on 2027-01-12 (security patches stop). Lifecycle data from endoflife.date.

Two years into DORA application (effective 2025-01-17), oversight of critical ICT third-party providers by the European Supervisory Authorities continues to mature; financial entities should have completed threat-led penetration testing cycles.

Regulation (EU) 2023/1230 on machinery products begins to apply, including its cybersecurity and safety requirements for connected and digitally controlled machinery.

Financial entities' registers of information on ICT third-party arrangements, reference date 2026-12-31, are transmitted by national competent authorities to the European Supervisory Authorities by 31 March. Entity-level filing deadlines fall earlier in the first quarter and are set nationally.

Essential entities on the CyberFundamentals (CyFun) route whose risk assessment lands at assurance level Essential must have obtained CyFun Essential certification from an accredited conformity assessment body, or full ISO/IEC 27001 certification on that pathway, and must report compliance progress to the Centre for Cybersecurity Belgium.

Providers of general-purpose artificial intelligence (GPAI) models placed on the market before 2025-08-02 must have completed the steps needed to comply with the regulation's GPAI obligations.

Applicable solicitations add the Level 3 requirement, assessed by the Defense Contract Management Agency's Defense Industrial Base Cybersecurity Assessment Center (DIBCAC), as a condition of award. Level 2 third-party certification requirements also extend to option-period exercises on previously awarded contracts.

The full high-risk regime (risk management, data governance, technical documentation, human oversight, and conformity assessment) applies to stand-alone high-risk systems under Annex III. Deferred from 2026-08-02 by the 2026 omnibus.

Secure-by-design requirements, conformity assessment, technical documentation, CE marking, software bill of materials (SBOM), and vulnerability handling obligations take full effect for products with digital elements placed on the EU market.

High-risk obligations apply to systems that are safety components of, or are themselves, products covered by Annex I harmonisation legislation. Deferred from 2027-08-02 by the 2026 omnibus.

CMMC program requirements appear in all applicable Department of Defense solicitations and contracts, including option periods on contracts awarded before Phase 4. This completes the three-year phase-in that began 2025-11-10.