Your Backlog Does Not Move the Deadline.

A compliance deadline changes only when the law changes it. Regulators do not move published dates because a team is overloaded.

The EU AI Act entered into force on 1 August 2024 and applies in stages. Chapters I and II, including prohibited AI practices and AI literacy obligations, applied from 2 February 2025. The general-purpose AI model rules, governance chapters, penalty rules, and Article 78 applied from 2 August 2025. The Regulation's general application date is 2 August 2026. In June 2026, the Council gave final green light to simplification changes that delay high-risk rules to 2 December 2027 for stand-alone high-risk AI systems and 2 August 2028 for high-risk AI systems embedded in products. Track that legal change without assuming it moved AI inventory, transparency, literacy, governance, or GPAI duties.

NIS2 carried a transposition deadline of 17 October 2024 and repealed NIS1 from 18 October 2024. DORA became applicable on 17 January 2025. The work had to follow those dates.

"Applies progressively" means a sequence of separate deadlines. Under the AI Act, prohibitions applied first, followed by general-purpose AI obligations, the general application date, and delayed high-risk dates. Clearing one phase does not satisfy the next.

Treat every amendment or deferral as a regulatory change. Identify which obligation moved, which systems it covers, which internal dates change, and which duties stayed in place.

These deadlines carry enforcement consequences. The AI Act sets penalties of up to EUR 35 million or 7% of total worldwide annual turnover, whichever is higher, for the most serious violations. NIS2 requires Member States to provide maximum administrative fines of at least EUR 10 million or 2% of worldwide annual turnover for essential entities, and makes management bodies responsible for approving and overseeing cybersecurity risk-management measures. DORA became applicable to financial entities on 17 January 2025 and gives supervisors a detailed rulebook for ICT risk, incidents, testing, and third-party risk.

Some obligations assign responsibility to named management bodies. Workload is not a defense for missing them.

Start with the fixed legal date and work backward. Set the internal readiness date, evidence freeze, owner review, dependency deadline, and escalation date. Attach the expected evidence to each checkpoint.

If a formal amendment moves the date for your obligation, update the plan deliberately and preserve the old record.

Every deadline needs a named owner and evidence. NIS2 places responsibility on management bodies, not shared inboxes.

Regulators need records: the approved policy, completed assessment, tested control, and dated log. Collect and organize that evidence before the deadline. Sorena Law Tracker maintains the obligation, due date, and owner in a live regulatory register. The same discipline applies to ESG and CSRD reporting.

The AI Act, NIS2, DORA, and CSRD have overlapping dates. A single organization can face several obligations at once.

A financial entity can owe DORA duties from 17 January 2025 and still fall under NIS2 where DORA does not cover the issue. A manufacturer using AI may face AI Act inventory, literacy, transparency, GPAI, and high-risk planning milestones while its sustainability team follows CSRD's phased calendar.

Keep one view of applicable obligations and critical dates so the team can plan across them.

Plan backward from the legal date. Name the owner, list the evidence, and set checkpoints early enough to complete the work before the deadline.