Regulatory map

The European instruments a system built this way is likely to meet. Every row was read at its primary source on the date the row states, and every row links to that source. This is a map and not advice: nothing here says which of these applies to any particular system.

What this version corrects

The July 2026 edition of this map carried four rows that its own sources do not support. They are corrected here rather than quietly edited, and each correction is a link to the text that settles it.

The registry row put one date on three different events. Article 13(1) of Regulation (EU) 2024/1781 set 19 July 2026 as the deadline by which the Commission was to set the registry up. The Commission announced on 20 July 2026 that the registry was live, which is an announcement of operational availability and not a date in either instrument. Implementing Regulation (EU) 2026/1778 of 16 July 2026 lays down the implementation arrangements; it was published on 17 July 2026 and enters into force on the twentieth day after that. Three dates, three different things, and the July edition described one as the other.
Source: Regulation (EU) 2024/1781, Article 13(1), read with Article 24 of Implementing Regulation (EU) 2026/1778 (primary source) · checked on 7 September 2026
The due diligence row was written against the original directive alone. Directive (EU) 2026/470 of 24 February 2026 moved the application of those measures to 26 July 2029, set 26 July 2028 as the transposition deadline for its due diligence article, raised the scope thresholds on the principal route for EU companies to more than 5 000 employees on average and a net worldwide turnover above EUR 1 500 000 000, other categories keeping their own criteria, and left the measures for Article 16 to apply for financial years starting on or after 1 January 2030. A separate point, because it is the one most often got wrong: the amending directive removes harmonised Union conditions of civil liability, which is not the same as removing civil liability. National law continues to apply.
Source: Directive (EU) 2026/470, Article 4(2) and Article 5 (primary source) · checked on 7 September 2026
The critical raw materials row stated a flat start date. Article 29(1) of Regulation (EU) 2024/1252 sets the later of 24 May 2027 and two years after the entry into force of the calculation and verification act under Article 29(2). That act was due by 24 May 2026 and is not published, so the start date is not yet fixed.
Source: Regulation (EU) 2024/1252, Article 29(1) and (2) (primary source) · checked on 7 September 2026
The row on a scheme for passport service providers described a Commission preparation and a year. Recital 40 of Regulation (EU) 2024/1781 says the Commission could carry out an impact assessment to investigate whether such a scheme is appropriate. That is the whole of what the text supports.
Source: Regulation (EU) 2024/1781, Recital 40 (primary source) · checked on 7 September 2026
Edition r4 corrects two statements of this map following renewed verification against the primary sources. The AI Act row gave Article 6(1) and its obligations as applying from 2 August 2027, the date in the original Article 113. Regulation (EU) 2026/1744, in force since 27 July 2026, replaced that schedule: Chapter III, Sections 1 to 3, on high-risk AI systems, apply from 2 December 2027 under Article 6(2) and Annex III, and from 2 August 2028 under Article 6(1) and Annex I. The eight architecture principles and their alignment statements are unchanged.
Source: Regulation (EU) 2026/1744, Article 1, point (40) (primary source) · checked on 11 September 2026
The CBAM row gave the definitive regime as applying from 1 January 2026. Regulation (EU) 2025/2083 set later dates for two of its parts: Article 22(2), on holding CBAM certificates each quarter, applies from 1 January 2027, and Article 20(1), (3), (4) and (5), on their sale, from 1 February 2027.
Source: Regulation (EU) 2025/2083, Article 1, point (27) (primary source) · checked on 11 September 2026

In force and phasing in

EU AI Act

Regulation (EU) 2024/1689

Applies from 2 August 2026. Chapters I and II applied from 2 February 2025; Chapter III Section 4, Chapters V, VII and XII and Article 78 from 2 August 2025. As amended by Regulation (EU) 2026/1744, Chapter III, Sections 1 to 3, on high-risk AI systems, apply from 2 December 2027 for systems classified as high-risk under Article 6(2) and Annex III, and from 2 August 2028 for those under Article 6(1) and Annex I. The two prohibited practices that Regulation added to Article 5 apply from 2 December 2026.

Source: Regulation (EU) 2024/1689, Article 113, as amended by Regulation (EU) 2026/1744 (primary source) · checked on 11 September 2026

Cyber Resilience Act

Regulation (EU) 2024/2847

Applies from 11 December 2027. Article 14, the reporting duty, applies from 11 September 2026, and Chapter IV from 11 June 2026.

Source: Regulation (EU) 2024/2847, Article 71 (primary source) · checked on 7 September 2026

Ecodesign for Sustainable Products Regulation

Regulation (EU) 2024/1781

Framework in force. Article 13(1) required the Commission to set up the digital product passport registry by 19 July 2026; Implementing Regulation (EU) 2026/1778 of 16 July 2026 lays down its implementation arrangements. Delegated acts per product category follow.

Source: Regulation (EU) 2024/1781, Article 13(1), read with Implementing Regulation (EU) 2026/1778 (primary source) · checked on 7 September 2026

Deforestation Regulation

Regulation (EU) 2023/1115

Obligations bind medium and large operators from 30 December 2026 and micro and small operators from 30 June 2027, after the amendment by Regulation (EU) 2025/2650.

Source: Regulation (EU) 2023/1115, Article 38(2) and (3), as replaced by Regulation (EU) 2025/2650 (primary source) · checked on 7 September 2026

Battery Regulation

Regulation (EU) 2023/1542

Applies from 18 February 2024. Article 11 applies from 18 February 2027; Article 17 and Chapter VI from 18 August 2024; Chapter VIII from 18 August 2025.

Source: Regulation (EU) 2023/1542, Article 96 (primary source) · checked on 7 September 2026

General Data Protection Regulation

Regulation (EU) 2016/679

Applies since 25 May 2018.

Source: Regulation (EU) 2016/679, Article 99(2) (primary source) · checked on 7 September 2026

NIS2 Directive

Directive (EU) 2022/2555

Member States were to adopt the measures by 17 October 2024 and to apply them from 18 October 2024. National transposition is a Member State matter and varies.

Source: Directive (EU) 2022/2555, Article 41(1) (primary source) · checked on 7 September 2026

Data Act

Regulation (EU) 2023/2854

Applies from 12 September 2025. The Article 3(1) duty applies to connected products placed on the market after 12 September 2026.

Source: Regulation (EU) 2023/2854, Article 50 (primary source) · checked on 7 September 2026

DORA

Regulation (EU) 2022/2554

Applies from 17 January 2025.

Source: Regulation (EU) 2022/2554, Article 64 (primary source) · checked on 7 September 2026

Packaging and Packaging Waste Regulation

Regulation (EU) 2025/40

Applies from 12 August 2026. Article 67(5) applies from 12 February 2029.

Source: Regulation (EU) 2025/40, Article 79 (primary source) · checked on 7 September 2026

Critical Raw Materials Act

Regulation (EU) 2024/1252

In force. The public recycled-content statement for permanent magnets under Article 29(1) starts on the later of 24 May 2027 and two years after the calculation and verification act under Article 29(2) enters into force. That act was due by 24 May 2026 and is not published, so the start date is open.

Source: Regulation (EU) 2024/1252, Article 29(1) and (2) (primary source) · checked on 7 September 2026

Product Liability Directive, recast

Directive (EU) 2024/2853

Software is within scope. Member States are to transpose it by 9 December 2026.

Source: Directive (EU) 2024/2853, Article 22(1) (primary source) · checked on 7 September 2026

Carbon Border Adjustment Mechanism

Regulation (EU) 2023/956

Applies from 1 October 2023. Articles 5, 10, 14, 16 and 17 apply from 31 December 2024, and most provisions of the definitive regime from 1 January 2026. As amended by Regulation (EU) 2025/2083, Article 22(2), on holding CBAM certificates each quarter, applies from 1 January 2027, and Article 20(1), (3), (4) and (5), on the sale of CBAM certificates, from 1 February 2027.

Source: Regulation (EU) 2023/956, Article 36(2), as amended by Regulation (EU) 2025/2083 (primary source) · checked on 11 September 2026

Taxonomy Regulation

Regulation (EU) 2020/852

Articles 4 to 7 and Article 8(1) to (3) apply from 1 January 2022 for the first two environmental objectives and from 1 January 2023 for the other four.

Source: Regulation (EU) 2020/852, Article 27(2) (primary source) · checked on 7 September 2026

Corporate Sustainability Reporting Directive

Directive (EU) 2022/2464

Article 4 applies from 1 January 2024 for financial years starting on or after that date. Amended by Directive (EU) 2026/470, whose Articles 1, 2 and 3 are to be transposed by 19 March 2027.

Source: Directive (EU) 2022/2464, Article 7, read with Article 5 of Directive (EU) 2026/470 (primary source) · checked on 7 September 2026

Standards and frameworks

Not legislation. Referenced by legislation, or used by audits. The rows below name each item and what it is for. Where this pass did not read a standards body's own text at source, the row states no date, and that absence is deliberate.

EN 18216, EN 18219, EN 18220, EN 18221, EN 18222, EN 18223

CEN, CENELEC and ETSI

References cited in the Official Journal by Implementing Decision (EU) 2026/1736 of 14 July 2026, giving presumption of conformity for the requirements of Articles 10 and 11 of Regulation (EU) 2024/1781 that they cover.

Source: Commission Implementing Decision (EU) 2026/1736, Recitals 3 and 4, read with Article 41(2) of Regulation (EU) 2024/1781 (primary source) · checked on 7 September 2026

EN 18239 and EN 18246

CEN, CENELEC and ETSI

Access rights, and data authentication and integrity. Not among the references cited by Implementing Decision (EU) 2026/1736, so no presumption of conformity attaches to them today.

Source: Commission Implementing Decision (EU) 2026/1736, Recital 3 (primary source) · checked on 7 September 2026

Audit and assurance assessment architecture for AI

BSI, Germany

A draft criteria catalogue for assessing AI systems, machine-readable, built on an assurance engagement methodology. Not read at source in this pass, so no date is stated here.

ISO/IEC 42001

ISO and IEC

A management system standard for artificial intelligence, certifiable by a third party. COADF is an implementation-level companion to it and does not stand against it.

AI Risk Management Framework

NIST, United States

A voluntary framework with four functions, plus a profile for generative systems. Referenced here for its vocabulary, not as an obligation.

EPCIS and Digital Link

GS1

The identifier and event layer a passport is reached through. Open specifications; naming one is not a claim of any status with the body.

ECLASS and the IEC Common Data Dictionary

ECLASS and IEC

Licensed vocabularies. Treated as isolated adapters under P-7, so that a licence change never reaches the core.

Code of practice for general-purpose AI

European Commission

Voluntary. Its safety chapter addresses providers of models with systemic risk.

Monitor, do not build against

Ecodesign delegated acts by product category

Each act is adopted under Article 4 of Regulation (EU) 2024/1781 and creates its own rule set. Follow the acts, not the working plan.

Source: Regulation (EU) 2024/1781, Article 4 (primary source) · checked on 7 September 2026

A scheme for digital product passport service providers

Recital 40 of Regulation (EU) 2024/1781 says the Commission could carry out an impact assessment to investigate whether such a scheme is appropriate. Nothing further is in the text.

Source: Regulation (EU) 2024/1781, Recital 40 (primary source) · checked on 7 September 2026

Forced Labour Regulation

Regulation (EU) 2024/3015 applies from 14 December 2027, with Articles 5(3), 7, 8, 9(2), 11, 33, 35 and 37(3) applicable since 13 December 2024.

Source: Regulation (EU) 2024/3015, Article 40 (primary source) · checked on 7 September 2026

Corporate Sustainability Due Diligence Directive

Directive (EU) 2024/1760, as amended by Directive (EU) 2026/470 of 24 February 2026: transposition of the amending article by 26 July 2028, application of those measures from 26 July 2029, and the measures for Article 16 for financial years starting on or after 1 January 2030. Scope thresholds, on the principal route for EU companies: more than 5 000 employees on average and a net worldwide turnover above EUR 1 500 000 000. Other categories, including non-EU companies and the franchising and licensing route, carry their own criteria, and the figures above are not those. The amending directive removes harmonised Union conditions of civil liability, which is not the same as removing civil liability; national law continues to apply.

Source: Directive (EU) 2026/470, Article 4(2) and Article 5 (primary source) · checked on 7 September 2026

Public feedback

Disagree with an assumption, found a source issue, or applied this in practice? Contributions are reviewed before publication and stay linked to this version.

Give feedback Public feedback on this page