On this page
A year of deadlines for anything digital
New EU rules in 2027 reach almost every business that sells software, runs a website or buys cloud services in Europe. Cloud providers lose the right to charge you for leaving, website certificates get shorter again, Google rewires part of Google Ads, and anyone selling software or using AI for hiring meets the heaviest rules of the year in December.
The dates are listed above. Below, per rule: what it asks, who it reaches, whether it applies to a company outside the EU, and what to do now. Every subject with its own article is linked.
Any business using cloud or SaaS
Worth a check
From 12 January a provider may charge nothing when you leave.
Ask in which format your data comes with you.
Every website
Something to change
Certificates are valid for 100 days from March.
Check that your certificate renews itself.
Google Ads advertiser
Something to change
Call-only ads stop, Dynamic Search Ads move to AI Max.
Review your campaigns in early February.
Company with a Belgian entity
Something to change
NIS2 certification for essential entities and the end of a Belgian e-invoicing deduction.
Check which Belgian dates apply to that entity.
Anyone selling software or connected products
Work with a deadline
The Cyber Resilience Act applies in full from 11 December 2027.
Track and report vulnerabilities, get the documentation in order.
Anyone using AI for hiring, education or biometrics
Work with a deadline
The high-risk rules of Annex III apply from 2 December 2027.
List your AI systems and their risk.
Most dates reach providers from outside the EU too, as soon as they sell into it.
Cloud contracts become a choice
The Data Act cuts the cost of switching cloud providers in two steps. Since 12 September 2025 a provider may only charge what a switch actually costs. From 12 January 2027 it may charge nothing, also when you move your data back in-house. A contract you thought you were stuck in turns into a choice. The charge for data egress goes too, and a software or platform provider has to offer open interfaces and export your data at least in a commonly used, machine-readable format. For a French publisher on a hosted CMS or a German retailer on a SaaS ERP, that is the clause to read before renewing. That is the moment to ask whether your data and processes still sit in a package that fits, or whether custom software is cheaper over three years; our comparison of build vs buy software works through the numbers. The full rule is in the Data Act and cloud switching.
The padlock needs renewing four times a year
The SSL certificate behind the padlock in the browser is getting shorter-lived step by step. The CA/Browser Forum, where certificate authorities and browser makers set the rules, decided the schedule.
| Since or from | Maximum validity | Renewals a year, at least |
|---|---|---|
| Until March 2026 | 398 days | 1 |
| March 2026 | 200 days | 2 |
| March 2027 | 100 days | 4 |
| March 2029 | 47 days | 8 |
The last column is 365 divided by the validity, rounded up; in practice you renew earlier, so even more often. A site on modern hosting renews automatically. An older set-up with a bought certificate that someone replaces by hand once a year will break, and an expired certificate shows visitors a warning instead of your site. Check yours with our SEO checker, which also tests that the site loads securely, and see what website maintenance covers.
To settle before 31 December
- Ask your cloud and SaaS providers how your data leaves without charges after 12 January 2027, and in which format.
- Check that every website you run renews its certificate automatically.
- If you ship software or connected products to the EU, set up a way to track and report actively exploited vulnerabilities.
- Find out which of your AI tools generate content for the public, and whether their output is marked.
- Put early February in the calendar for a Google Ads review.
Google Ads changes in February
In February 2027 call-only ads stop serving; Google recommends a responsive search ad with a call asset instead. Dynamic Search Ads move into AI Max automatically, and Search campaigns that also run on the Display Network move to the new channel prioritisation. Google has not named a day. Review your Google Ads in early February and recalculate the budget with our Google Ads budget calculator.
December, the heavy month for software and AI
Anyone placing software or connected products on the EU market has a full year. Member states must have transposed the new product liability rules for software by December 2026. The Cyber Resilience Act applies in full in December 2027, after the reporting duty that runs since September 2026. Companies using AI for hiring, education or biometrics fall under the high-risk rules in the same month; read the AI Act delay and test your own case with the EU AI Act checker. Providers of generative AI already on the market must have their output marked from December 2026.
One change many expected is not coming in 2027: easier cookie rules. The Council agreed its position on the Digital Omnibus in October 2026, but Parliament has not, so today's consent rules stay; read what the Council wants for cookies.
Selling into the EU from outside it
The EU dates apply to you as soon as you place software or products on the EU market or serve EU customers: the AI Act, the Cyber Resilience Act and the Data Act all reach providers from outside the Union. Country dates reach you only through an entity or a contract there. A US SaaS company with a Belgian subsidiary, for example, meets Belgium's NIS2 certification deadline if that subsidiary is an essential entity, and Belgian e-invoicing penalties if it invoices Belgian businesses. Further out, the temporary EU duty of 3 euros per item on low-value parcels runs until 1 July 2028, and the high-risk rules for AI in regulated products follow on 2 August 2028. For VAT, the timeline of ViDA VAT in the digital age runs on to 2030.