deadlines.json

{
  "version": "1.0.0",
  "updated": "2026-05-15",
  "deadlines": [
    {
      "id": "cra-entry-into-force-2024-12-10",
      "regulation": "CRA",
      "article": "Art. 71",
      "date": "2024-12-10",
      "summary": "Cyber Resilience Act enters into force (20 days after OJ publication of 20 Nov 2024). Most substantive obligations apply later; this date starts the transition clock.",
      "excerpt": "This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.",
      "excerpt_secondary": "It shall apply from 11 December 2027.",
      "source_url": "https://eur-lex.europa.eu/eli/reg/2024/2847/oj",
      "applies_to": [
        "manufacturers",
        "importers",
        "distributors"
      ],
      "notes": "Published in OJ on 20 November 2024; Article 71(1) sets entry into force as the 20th day after publication; Article 71(2) sets general application date 11 December 2027.",
      "excerpt_type": "verbatim_oj_composite"
    },
    {
      "id": "cra-notified-bodies-2026-06-11",
      "regulation": "CRA",
      "article": "Chapter IV",
      "date": "2026-06-11",
      "summary": "Rules on the notification of conformity assessment bodies (Chapter IV) start to apply. Notified bodies can be designated to assess products with digital elements.",
      "excerpt": "Chapter IV shall apply from 11 June 2026.",
      "source_url": "https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act",
      "applies_to": [
        "conformity-assessment-bodies",
        "manufacturers"
      ],
      "notes": "Source: Commission summary of the CRA legislative text.",
      "excerpt_type": "verbatim_oj"
    },
    {
      "id": "cra-art-14-vuln-reporting-2026-09-11",
      "regulation": "CRA",
      "article": "Art. 14(2)",
      "date": "2026-09-11",
      "summary": "Manufacturers must notify actively exploited vulnerabilities to the CSIRT designated as coordinator of the Member State, simultaneously copying ENISA via the Single Reporting Platform: early warning ≤24h, vulnerability notification ≤72h, final report ≤14 days.",
      "excerpt": "A manufacturer shall notify any actively exploited vulnerability contained in the product with digital elements that it becomes aware of simultaneously to the CSIRT designated as coordinator [...] and to ENISA [...] within 24 hours of the manufacturer becoming aware of it, an early warning notification [...] within 72 hours [...] a vulnerability notification.",
      "source_url": "https://eur-lex.europa.eu/eli/reg/2024/2847/oj",
      "applies_to": [
        "manufacturers"
      ],
      "notes": "First substantive obligation in force. Per Art. 14(2) CRA, the addressee is the CSIRT-coordinator of the manufacturer's MS; ENISA receives a simultaneous copy. The ENISA Single Reporting Platform (Art. 16) is the technical addressing point through which the CSIRT and ENISA both receive the notification.",
      "excerpt_type": "verbatim_oj"
    },
    {
      "id": "cra-full-obligations-2027-12-11",
      "regulation": "CRA",
      "article": "Art. 71(2)",
      "date": "2027-12-11",
      "summary": "Full CRA obligations apply: essential cybersecurity requirements, CE marking, conformity assessment, secure-by-design, SBOM and vulnerability handling for all products with digital elements placed on the EU market.",
      "excerpt": "It shall apply from 11 December 2027.",
      "source_url": "https://eur-lex.europa.eu/eli/reg/2024/2847/oj",
      "applies_to": [
        "manufacturers",
        "importers",
        "distributors"
      ],
      "notes": "The 36-month transitional period ends. Non-compliant products cannot be placed on the EU market after this date.",
      "excerpt_type": "verbatim_oj"
    },
    {
      "id": "ai-act-prohibited-practices-2025-02-02",
      "regulation": "AI Act",
      "article": "Art. 113(a) (application date); Art. 5 (prohibited practices)",
      "date": "2025-02-02",
      "summary": "Prohibited AI practices (social scoring, manipulative AI, untargeted face-image scraping, certain biometric categorisation) ban begins. AI literacy obligation (Art. 4) also starts. Art. 113(a) sets the application date; Art. 5 defines the prohibitions.",
      "excerpt": "It shall apply from 2 August 2026. However: (a) Chapters I and II shall apply from 2 February 2025;",
      "excerpt_secondary": "The following AI practices shall be prohibited: (a) the placing on the market, the putting into service or the use of an AI system that deploys subliminal techniques [...]",
      "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj",
      "applies_to": [
        "providers",
        "deployers"
      ],
      "notes": "First wave of AI Act application. The date itself lives in Art. 113(a); the substantive prohibitions live in Art. 5. Article 4 (AI literacy) also kicks in via Chapter I.",
      "excerpt_type": "verbatim_oj_composite"
    },
    {
      "id": "ai-act-gpai-2025-08-02",
      "regulation": "AI Act",
      "article": "Chapter V",
      "date": "2025-08-02",
      "summary": "Obligations for providers of general-purpose AI models (GPAI) apply: transparency, technical documentation, copyright policy, training data summaries. Stricter rules for GPAI with systemic risk.",
      "excerpt": "Chapter III Section 4, Chapter V, Chapter VII and Chapter XII and Article 78 shall apply from 2 August 2025.",
      "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj",
      "applies_to": [
        "gpai-providers"
      ],
      "notes": "Notifying authorities, penalties (except Art. 101) and governance also become applicable.",
      "excerpt_type": "verbatim_oj"
    },
    {
      "id": "ai-act-art-50-watermarking-2026-12-02",
      "regulation": "AI Act",
      "article": "Art. 50(2)",
      "date": "2026-12-02",
      "summary": "Article 50(2) watermarking and synthetic-content disclosure for providers deferred from 2 Aug 2026 to 2 Dec 2026 under Digital Omnibus political agreement of 7 May 2026 (still to be formally adopted).",
      "excerpt": "Article 50(2) watermarking & synthetic content disclosure deferred to 2 December 2026.",
      "source_url": "https://www.consilium.europa.eu/en/press/press-releases/2026/05/07/artificial-intelligence-council-and-parliament-agree-to-simplify-and-streamline-rules/",
      "applies_to": [
        "providers"
      ],
      "notes": "Provisional agreement only; awaiting Parliament/Council endorsement and OJ publication. Other Art. 50 transparency duties for deployers still apply from 2 Aug 2026.",
      "excerpt_type": "paraphrase"
    },
    {
      "id": "ai-act-deployer-transparency-2026-08-02",
      "regulation": "AI Act",
      "article": "Art. 50 (deployer duties)",
      "date": "2026-08-02",
      "summary": "AI Act general application date. Article 50 transparency obligations for deployers (emotion-recognition, biometric categorisation disclosure, deep-fake labelling) apply. Most remaining Chapters become applicable.",
      "excerpt": "This Regulation [...] shall apply from 2 August 2026.",
      "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj",
      "applies_to": [
        "deployers",
        "providers"
      ],
      "notes": "Article 6(1) and most high-risk obligations are deferred per Digital Omnibus (see other entries).",
      "excerpt_type": "verbatim_oj"
    },
    {
      "id": "ai-act-annex-iii-highrisk-2027-12-02",
      "regulation": "AI Act",
      "article": "Annex III; Art. 6(2)",
      "date": "2027-12-02",
      "summary": "Stand-alone high-risk AI systems listed in Annex III (biometrics, education, employment, essential services, law enforcement, migration, justice) obligations apply. Deferred from 2 Aug 2026 by Digital Omnibus.",
      "excerpt": "High-risk obligations under Annex III now apply from 2 December 2027.",
      "source_url": "https://www.consilium.europa.eu/en/press/press-releases/2026/05/07/artificial-intelligence-council-and-parliament-agree-to-simplify-and-streamline-rules/",
      "applies_to": [
        "providers",
        "deployers"
      ],
      "notes": "Pre-Omnibus original date was 2 Aug 2026. Provisional agreement of 7 May 2026 pending formal adoption.",
      "excerpt_type": "paraphrase"
    },
    {
      "id": "ai-act-annex-i-product-2028-08-02",
      "regulation": "AI Act",
      "article": "Annex I; Art. 6(1)",
      "date": "2028-08-02",
      "summary": "Product-integrated high-risk AI (Annex I sectoral product legislation: medical devices, toys, machinery, etc.) obligations apply. Deferred from original 2 Aug 2027 by the Digital Omnibus.",
      "excerpt": "AI embedded in regulated products under Annex I applies from 2 August 2028.",
      "source_url": "https://www.consilium.europa.eu/en/press/press-releases/2026/05/07/artificial-intelligence-council-and-parliament-agree-to-simplify-and-streamline-rules/",
      "applies_to": [
        "providers",
        "product-manufacturers"
      ],
      "notes": "Aligns the AI Act's product-integrated high-risk clock with sectoral product-safety transitional periods (MDR, MD machinery, etc.).",
      "excerpt_type": "paraphrase"
    },
    {
      "id": "nis2-transposition-2024-10-17",
      "regulation": "NIS2",
      "article": "Art. 41",
      "date": "2024-10-17",
      "summary": "Deadline for Member States to transpose NIS2 into national law. Measures apply from 18 Oct 2024. As of May 2026, several MS including Spain have not completed transposition; Commission has issued reasoned opinions.",
      "excerpt": "Member States shall adopt and publish, by 17 October 2024, the measures necessary to comply with this Directive. They shall apply those measures from 18 October 2024.",
      "source_url": "https://eur-lex.europa.eu/eli/dir/2022/2555/oj",
      "applies_to": [
        "member-states",
        "essential-entities",
        "important-entities"
      ],
      "notes": "Spain: draft law approved by Council of Ministers 14 Jan 2025, not yet enacted. Germany NIS2UmsuCG entered into force early 2025. Commission reasoned opinion sent to 19 MS for failure to fully transpose.",
      "excerpt_type": "verbatim_oj"
    },
    {
      "id": "ehds-entry-into-force-2025-03-26",
      "regulation": "EHDS",
      "article": "Art. 105",
      "date": "2025-03-26",
      "summary": "European Health Data Space Regulation enters into force (20 days after OJ publication of 5 Mar 2025). Most operational obligations apply later in staggered milestones.",
      "excerpt": "This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.",
      "source_url": "https://eur-lex.europa.eu/eli/reg/2025/327/oj",
      "applies_to": [
        "member-states",
        "health-data-holders",
        "ehr-vendors"
      ],
      "notes": "Implementing acts on EHR system requirements and secondary-use technical specs pending.",
      "excerpt_type": "verbatim_oj"
    },
    {
      "id": "ehds-general-application-2027-03-26",
      "regulation": "EHDS",
      "article": "Art. 105(2)",
      "date": "2027-03-26",
      "summary": "EHDS general date of application: most governance, EHR-system harmonisation and Health Data Access Bodies provisions apply. Operational data exchange milestones follow in 2029 and 2031.",
      "excerpt": "This Regulation shall apply from 26 March 2027.",
      "source_url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en",
      "applies_to": [
        "member-states",
        "ehr-vendors",
        "health-data-access-bodies"
      ],
      "notes": "Cross-check with Art. 105 staggered list. Some Chapters (e.g. primary-use priority categories) apply only from March 2029/2031.",
      "excerpt_type": "verbatim_oj"
    },
    {
      "id": "ehds-secondary-use-2029-03-26",
      "regulation": "EHDS",
      "article": "Chapter IV",
      "date": "2029-03-26",
      "summary": "Secondary-use chapters apply: Health Data Access Bodies operational, secondary use of EHR data for research, policy and statistics under data permit/data request regime.",
      "excerpt": "Rules on secondary use will also start to apply for most data categories (e.g. data from electronic health records) in March 2029.",
      "source_url": "https://european-health-data-space.com/",
      "applies_to": [
        "health-data-holders",
        "data-users",
        "health-data-access-bodies"
      ],
      "notes": "First group of priority categories for primary use (Patient Summaries, ePrescriptions) also operational this date.",
      "excerpt_type": "verbatim_oj"
    },
    {
      "id": "ehds-primary-use-images-2031-03-26",
      "regulation": "EHDS",
      "article": "Chapter II",
      "date": "2031-03-26",
      "summary": "Second group of priority categories of health data for primary use must be operational across MyHealth@EU: medical images, laboratory results, hospital discharge reports.",
      "excerpt": "For primary use, the exchange of the second group of priority categories of health data (medical images, lab results, and hospital discharge reports) should be operational in all EU Member States in March 2031.",
      "source_url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en",
      "applies_to": [
        "health-data-holders",
        "ehr-vendors",
        "imaging-providers"
      ],
      "notes": "Direct relevance for DICOM/PACS ecosystem and anonymisation pipelines.",
      "excerpt_type": "paraphrase"
    },
    {
      "id": "dora-application-2025-01-17",
      "regulation": "DORA",
      "article": "Art. 64",
      "date": "2025-01-17",
      "summary": "Digital Operational Resilience Act applies to all financial entities and their critical ICT third-party providers: ICT risk management, incident reporting, resilience testing, third-party risk register.",
      "excerpt": "This Regulation shall apply from 17 January 2025.",
      "source_url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj",
      "applies_to": [
        "financial-entities",
        "ict-third-party-providers"
      ],
      "notes": "20 categories of financial entities covered. RTS/ITS adopted by ESAs in 2024.",
      "excerpt_type": "verbatim_oj"
    },
    {
      "id": "mdr-class-iii-iib-transitional-2027-12-31",
      "regulation": "MDR",
      "article": "Art. 120 (as amended by 2023/607)",
      "date": "2027-12-31",
      "summary": "End of transitional period for higher-risk legacy devices (Class III and certain Class IIb implantables, e.g. pacemakers). After this date, only MDR-certified devices may remain on the EU market.",
      "excerpt": "The transitional period for higher-risk devices (class III and certain class IIb implantables) [...] has been extended to comply with EU MDR requirements until 31 December 2027.",
      "source_url": "https://eur-lex.europa.eu/eli/reg/2023/607/oj",
      "applies_to": [
        "medical-device-manufacturers",
        "notified-bodies"
      ],
      "notes": "Conditional extension: requires written agreement with notified body, QMS in place, application submitted on time.",
      "excerpt_type": "verbatim_oj"
    },
    {
      "id": "mdr-class-iib-iia-transitional-2028-12-31",
      "regulation": "MDR",
      "article": "Art. 120 (as amended by 2023/607)",
      "date": "2028-12-31",
      "summary": "End of transitional period for medium and lower-risk legacy devices (other Class IIb, Class IIa, Class Im/Is/Ir, e.g. syringes). After this date, only MDR-certified devices may remain on the EU market.",
      "excerpt": "The transitional period for medium and lower-risk devices (other class IIb devices, class IIa, class Im, Is and Ir devices) [...] has been extended to comply with EU MDR requirements until 31 December 2028.",
      "source_url": "https://eur-lex.europa.eu/eli/reg/2023/607/oj",
      "applies_to": [
        "medical-device-manufacturers",
        "notified-bodies"
      ],
      "notes": "Same conditional regime as class III/IIb implantables.",
      "excerpt_type": "verbatim_oj"
    },
    {
      "id": "ivdr-class-d-transitional-2027-12-31",
      "regulation": "Other",
      "article": "IVDR Art. 110 (as amended by 2024/1860)",
      "date": "2027-12-31",
      "summary": "End of IVDR transitional period for Class D legacy in vitro diagnostics (highest risk, e.g. HIV/hepatitis blood-screening). Application to notified body must be submitted by 26 May 2025.",
      "excerpt": "Extended transitional periods for placing on the market extend until [...] December 31, 2027 for Class D devices.",
      "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1860/oj",
      "applies_to": [
        "ivd-manufacturers",
        "notified-bodies"
      ],
      "notes": "Regulation (EU) 2024/1860 in force 9 July 2024. Schema enum has no 'IVDR' value; classified as 'Other'.",
      "excerpt_type": "verbatim_oj"
    },
    {
      "id": "ivdr-class-c-transitional-2028-12-31",
      "regulation": "Other",
      "article": "IVDR Art. 110 (as amended by 2024/1860)",
      "date": "2028-12-31",
      "summary": "End of IVDR transitional period for Class C legacy IVDs (high individual risk / moderate public-health risk, e.g. cancer markers). Application deadline 26 May 2026.",
      "excerpt": "Extended transitional periods [...] until [...] December 31, 2028 for Class C devices.",
      "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1860/oj",
      "applies_to": [
        "ivd-manufacturers",
        "notified-bodies"
      ],
      "notes": "IVDR not present in schema enum; classified as 'Other'.",
      "excerpt_type": "verbatim_oj"
    },
    {
      "id": "ivdr-class-b-a-sterile-transitional-2029-12-31",
      "regulation": "Other",
      "article": "IVDR Art. 110 (as amended by 2024/1860)",
      "date": "2029-12-31",
      "summary": "End of IVDR transitional period for Class B and sterile Class A legacy IVDs. Application to notified body deadline 26 May 2027. QMS per Art. 10(8) IVDR must be in place by 26 May 2025.",
      "excerpt": "Extended transitional periods [...] until December 31, 2029 for sterile Class A devices, December 31, 2029 for Class B devices.",
      "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1860/oj",
      "applies_to": [
        "ivd-manufacturers",
        "notified-bodies"
      ],
      "notes": "IVDR classified as 'Other' (not in schema enum).",
      "excerpt_type": "verbatim_oj"
    },
    {
      "id": "gdpr-dpia-in-force-2018-05-25",
      "regulation": "GDPR",
      "article": "Art. 35",
      "date": "2018-05-25",
      "summary": "GDPR Article 35 DPIA obligation: controllers must perform a Data Protection Impact Assessment for processing likely to result in high risk (incl. large-scale special-category data, systematic monitoring, automated decisions).",
      "excerpt": "Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk [...] the controller shall, prior to the processing, carry out an assessment of the impact.",
      "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj",
      "applies_to": [
        "controllers",
        "health-data-holders"
      ],
      "notes": "Standing obligation, not a future deadline. Included as baseline reference for the Digital Omnibus Art. 30 amendments under consultation (no fixed date).",
      "excerpt_type": "verbatim_oj"
    },
    {
      "id": "eidas2-eudi-wallet-2026-12-31",
      "regulation": "Other",
      "article": "Reg. 2024/1183 Art. 5a",
      "date": "2026-12-31",
      "summary": "Each EU Member State must provide at least one EU Digital Identity Wallet to citizens and residents (24 months after adoption of implementing acts of Dec 2024). Mandatory acceptance by private sector follows in 2027.",
      "excerpt": "EU Member States must provide EU Digital Identity Wallets to citizens up to 24 months after the adoption of Implementing Acts [...] this anchors national wallet availability by late December 2026.",
      "source_url": "https://digital-strategy.ec.europa.eu/en/policies/eudi-regulation",
      "applies_to": [
        "member-states",
        "relying-parties"
      ],
      "notes": "Regulation 2024/1183 (eIDAS 2) in force 20 May 2024. Wallet exact rollout date depends on each MS; end-2026 is the Commission target.",
      "excerpt_type": "paraphrase"
    },
    {
      "id": "data-act-application-2025-09-12",
      "regulation": "Other",
      "article": "Reg. 2023/2854 Art. 50",
      "date": "2025-09-12",
      "summary": "EU Data Act core provisions apply: access rights to IoT-generated data for users, B2B data-sharing fairness rules, cloud-switching obligations, public-sector access in exceptional need.",
      "excerpt": "The Data Act [...] entered into force on 11 January 2024 and into application on 12 September 2025.",
      "source_url": "https://eur-lex.europa.eu/eli/reg/2023/2854/oj",
      "applies_to": [
        "data-holders",
        "iot-manufacturers",
        "cloud-providers"
      ],
      "notes": "Enhanced cloud interoperability requirements apply from 12 Sep 2026; full portability standards from 12 Sep 2027.",
      "excerpt_type": "verbatim_oj"
    },
    {
      "id": "csrd-wave2-large-undertakings-2026-01-01",
      "regulation": "CSRD",
      "article": "Dir. 2022/2464 Art. 5(2)(b)",
      "date": "2026-01-01",
      "summary": "CSRD wave 2: all 'large undertakings' (not previously subject to NFRD) must report sustainability information per ESRS in their management report, covering FY 2025 onwards (first reports published 2026).",
      "excerpt": "Member States shall ensure that the laws, regulations and administrative provisions necessary to comply with this Directive [...] apply [...] (b) for financial years starting on or after 1 January 2025 for undertakings referred to in Article 3(4) of Directive 2013/34/EU [...]",
      "source_url": "https://eur-lex.europa.eu/eli/dir/2022/2464/oj",
      "applies_to": [
        "large-undertakings",
        "auditors"
      ],
      "notes": "Note: a Commission 'Stop-the-Clock' proposal in 2025 would defer wave 2 and 3 by two years; status as of artifact date is provisional. Cross-check OJ for adoption before relying on this date.",
      "excerpt_type": "verbatim_oj_composite"
    },
    {
      "id": "dsa-general-application-2024-02-17",
      "regulation": "DSA",
      "article": "Reg. 2022/2065 Art. 93(2)",
      "date": "2024-02-17",
      "summary": "Digital Services Act applies to all intermediary services (hosting providers, online platforms, marketplaces, search engines) regardless of size: notice-and-action, transparency reports, terms of service in plain language, trader traceability for marketplaces.",
      "excerpt": "This Regulation shall apply from 17 February 2024.",
      "source_url": "https://eur-lex.europa.eu/eli/reg/2022/2065/oj",
      "applies_to": [
        "intermediary-services",
        "online-platforms",
        "marketplaces",
        "search-engines"
      ],
      "notes": "Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs) designated under Art. 33 were already subject to the additional Section 5 obligations from 25 August 2023.",
      "excerpt_type": "verbatim_oj"
    },
    {
      "id": "dma-gatekeeper-compliance-2024-03-07",
      "regulation": "DMA",
      "article": "Reg. 2022/1925 Art. 3(10)",
      "date": "2024-03-07",
      "summary": "Designated gatekeepers must comply with all Article 5, 6 and 7 obligations for their designated core platform services (interoperability of messaging, sideloading on mobile OS, no self-preferencing, data-portability, choice screens, etc.).",
      "excerpt": "The designated gatekeeper shall comply with the obligations laid down in Articles 5, 6 and 7 within six months after a core platform service has been listed in the designation decision pursuant to paragraph 9 of this Article.",
      "source_url": "https://eur-lex.europa.eu/eli/reg/2022/1925/oj",
      "applies_to": [
        "gatekeepers"
      ],
      "notes": "First wave of designation decisions of 5 September 2023 → compliance from 7 March 2024. Subsequent designations (e.g. Booking.com 13 May 2024) trigger their own 6-month clocks.",
      "excerpt_type": "verbatim_oj"
    },
    {
      "id": "mica-application-2024-12-30",
      "regulation": "MiCA",
      "article": "Reg. 2023/1114 Art. 149",
      "date": "2024-12-30",
      "summary": "Markets in Crypto-Assets Regulation fully applies to crypto-asset service providers (CASPs), asset-referenced tokens (ARTs) and e-money tokens (EMTs). Title III and IV on ARTs/EMTs already applied from 30 Jun 2024.",
      "excerpt": "It shall apply from 30 December 2024.",
      "excerpt_secondary": "However, Titles III and IV shall apply from 30 June 2024.",
      "source_url": "https://eur-lex.europa.eu/eli/reg/2023/1114/oj",
      "applies_to": [
        "crypto-asset-service-providers",
        "issuers-of-art",
        "issuers-of-emt"
      ],
      "notes": "Member State transitional regimes for incumbent CASPs may extend authorisation deadlines up to 1 July 2026 (Art. 143(3) Member State option, max 18 months).",
      "excerpt_type": "verbatim_oj_composite"
    },
    {
      "id": "eidas2-private-sector-acceptance-2027-11-26",
      "regulation": "eIDAS",
      "article": "Reg. 2024/1183 Art. 5f",
      "date": "2027-11-26",
      "summary": "Mandatory acceptance of EU Digital Identity Wallets by certain very-large online platforms and by relying parties in regulated sectors (banking, telecoms, energy, health, e-commerce). Triggers at 36 months after wallet implementing-act adoption.",
      "excerpt": "Where relying parties intend to rely on European Digital Identity Wallets [...] private relying parties [...] shall accept the use of European Digital Identity Wallets [...] within 36 months after the date of entry into force of the implementing acts referred to in Article 5a(23).",
      "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1183/oj",
      "applies_to": [
        "very-large-online-platforms",
        "regulated-private-sector",
        "relying-parties"
      ],
      "notes": "Exact date depends on adoption of the Art. 5a(23) implementing acts; the Commission target for that adoption is end-November 2024, which anchors mandatory private-sector acceptance at end-November 2027. Re-verify after the implementing acts publish in OJ.",
      "excerpt_type": "paraphrase"
    }
  ]
}