dates and fines
What is next, what moved and how high the ceilings go.
last checked 2 November 2026not legal advice
what has passed, what is next
2025202620272028
NIS2
14
NIS2 in Poland
681012
DORA
2
AI Act
35791113
today, at the last build. Hollow dates have passed.
- 117 October 2024 deadline for member states to write NIS2 into national law
- 217 January 2025 DORA applies
- 32 February 2025 bans on prohibited practices and the AI literacy duty apply
- 417 April 2025 member states due to have their first list of essential and important entities
- 52 August 2025 general-purpose model rules and the penalties chapter apply
- 63 April 2026 amended national cybersecurity act in force
- 72 August 2026 general application, including the transparency duties
- 83 October 2026 last day to apply for the entity register, for those in scope on 3 April 2026
- 92 December 2026 two added prohibitions apply; machine-readable marking duty for generators placed on the market before 2 August 2026
- 103 April 2027 chapter 3 duties due, for those in scope on 3 April 2026
- 112 December 2027 high-risk rules apply to Annex III systems, such as recruitment tools
- 123 April 2028 first audit due for essential entities; most fines can be imposed after this date
- 132 August 2028 high-risk rules apply to AI inside regulated products
basis listed row by row in the table on the dates and fines page
01
coming up
| date | rule | what happens | who | basis |
|---|---|---|---|---|
| 2 December 2026 | AI Act | two added prohibitions apply; machine-readable marking duty for generators placed on the market before 2 August 2026 | providers and users of those systems | Regulation 2026/1744 Art. 1 |
| 3 April 2027 | NIS2 in Poland | chapter 3 duties due, for those in scope on 3 April 2026 | Polish essential and important entities | KSC Art. 33(1) |
| 2 December 2027 | AI Act | high-risk rules apply to Annex III systems, such as recruitment tools | providers and deployers | Regulation 2026/1744 Art. 1 |
| 3 April 2028 | NIS2 in Poland | first audit due for essential entities; most fines can be imposed after this date | Polish essential entities; all entities for fines | KSC Art. 33(2) and 35 |
| 2 August 2028 | AI Act | high-risk rules apply to AI inside regulated products | providers and deployers | Regulation 2026/1744 Art. 1 |
02
the ceilings
the fixed ceilings, to scale
- AI Act, prohibited practices€35m
- GDPR, basic principles€20m
- AI Act, deployer and transparency duties€15m
- NIS2, essential entity€10m
- GDPR, security and breach duties€10m
- NIS2, important entity€7m
basis AI Act Art. 99(3), 99(4), 99(6); GDPR Art. 83(4), 83(5); NIS2 Art. 34(4), 34(5); DORA Art. 50(3)
| rule | ceiling | note | basis |
|---|---|---|---|
| NIS2, essential entity | a maximum of at least €10 million or 2% of worldwide annual turnover, whichever is higher | A floor for the ceiling: national law can set it higher. | NIS2 Art. 34(4) |
| NIS2, important entity | a maximum of at least €7 million or 1.4% of worldwide annual turnover, whichever is higher | Same. | NIS2 Art. 34(5) |
| NIS2 in Poland, essential entity | up to €10 million or 2% of revenue, whichever is higher; at least PLN 20,000 | Paragraph 3 of the amended article. | KSC Art. 73 |
| NIS2 in Poland, important entity | up to €7 million or 1.4% of revenue; at least PLN 15,000 | Paragraph 4. Read the higher-of rule with your lawyer: the Polish text states it for essential entities only. | KSC Art. 73 |
| NIS2 in Poland, the head of the entity personally | up to 300% of pay | Private entities. 100% for heads of public entities. | KSC Art. 73a(4) |
| DORA | no EU figure; member states set the penalties | Look it up in your national act and ask your supervisor. | DORA Art. 50(3) |
| GDPR, security and breach duties | up to €10 million or 2% of worldwide annual turnover, whichever is higher | Covers GDPR Art. 25 to 39, which includes security and notification. | GDPR Art. 83(4) |
| GDPR, basic principles | up to €20 million or 4% of worldwide annual turnover, whichever is higher | Principles, legal basis, data subject rights, transfers. | GDPR Art. 83(5) |
| AI Act, prohibited practices | up to €35 million or 7% of worldwide annual turnover, whichever is higher | For SMEs, whichever is lower: AI Act Art. 99(6). | AI Act Art. 99(3) |
| AI Act, deployer and transparency duties | up to €15 million or 3% of worldwide annual turnover, whichever is higher | For SMEs, whichever is lower: AI Act Art. 99(6). | AI Act Art. 99(4) |
These are maximums. Actual fines depend on the circumstances. ISO 27001 and SOC 2 have no legal fines: the cost there is a lost certificate, report or customer.
03
proposed, not yet law
| file | what it would do | where it stands |
|---|---|---|
| Digital Omnibus, 2025/0360(COD) | Would amend GDPR, NIS2 and DORA, including how incidents are reported. Coverage reports a 96-hour GDPR clock. | Parliament: awaiting committee decision. Keep working to 72 hours. |
| NIS2 amendment, 2026/0012(COD) | A small mid-cap tier and other targeted changes to scope. | Parliament: committee stage, first reading indicated for 8 March 2027. |
| SOC 2 criteria, 2027 exposure drafts | Proposed revision of the Trust Services Criteria. | Listed by AICPA on 26 October 2026. The text was not read for this page. |
basis procedure files in the Legislative Observatory; AICPA and CIMA, SOC suite page
04
already passed
| date | rule | what happened | who | basis |
|---|---|---|---|---|
| 3 October 2026 | NIS2 in Poland | last day to apply for the entity register, for those in scope on 3 April 2026 | Polish essential and important entities | KSC Art. 33(3) |
| 2 August 2026 | AI Act | general application, including the transparency duties | providers and deployers of the systems it lists | AI Act Art. 113 |
| 27 July 2026 | AI Act | Digital Omnibus on AI in force, moving the high-risk dates | everyone under the AI Act | Regulation 2026/1744 Art. 4 |
| 3 April 2026 | NIS2 in Poland | amended national cybersecurity act in force | Polish essential and important entities | KSC Art. 49 |
| 2 August 2025 | AI Act | general-purpose model rules and the penalties chapter apply | model providers; member states | AI Act Art. 113 |
| 17 April 2025 | NIS2 | member states due to have their first list of essential and important entities | member states; registration falls on you | NIS2 Art. 3(3) |
| 2 February 2025 | AI Act | bans on prohibited practices and the AI literacy duty apply | providers and deployers | AI Act Art. 113 |
| 17 January 2025 | DORA | DORA applies | financial entities and their ICT providers | DORA Art. 64 |
| 17 October 2024 | NIS2 | deadline for member states to write NIS2 into national law | member states; your duty starts with your national act | NIS2 Art. 41(1) |
| 25 May 2018 | GDPR | GDPR applies | any organisation handling personal data | GDPR Art. 99(2) |
The Polish rows come from the amending act and the Ministry's announcement. Other countries' national dates are not in this table yet, so check your own act.
05
check it yourself
- Directive (EU) 2022/2555 (NIS2) (EUR-Lex)
- Regulation (EU) 2022/2554 (DORA) (EUR-Lex)
- Regulation (EU) 2016/679 (GDPR) (EUR-Lex)
- Regulation (EU) 2024/1689 (AI Act), original text (EUR-Lex)
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), amending the AI Act (EUR-Lex)
- Poland: Act of 23 January 2026 amending the national cybersecurity system act, Dz.U. 2026 poz. 252 (Dziennik Ustaw)
- Ministry of Digital Affairs (Poland): the amended act comes into force
- European Parliament, Legislative Observatory: procedure 2025/0360(COD)
- European Parliament, Legislative Observatory: procedure 2026/0012(COD)
- AICPA and CIMA: SOC suite of services
fyi Last checked 2 November 2026. This is not legal advice. It is a plain reading of the texts listed on this page, and national law can add to them. Before you rely on it in front of a regulator, an auditor or your board, have a lawyer confirm it for your company. What this means.
your next step
Put the next date that applies to you in your calendar, with a name next to it.