Deadlines that bind websites and software, 2025–2028
Every dated obligation binding websites and software on the EU and US markets — with the instrument, the date, and what it costs to be wrong.
3 of 8 dated obligations already bind websites and software products sold into the EU and US markets; 5 are still ahead. One exposure never had a date at all. This ledger lists each one: the date, who it binds, what it requires, and what it costs to be wrong — every row linked to the source it was verified against.
Last reviewed· Rows are re-verified quarterly, or when the underlying instrument changes.
How to read this ledger
Four things are true of every row below, and they are the reason the ledger is worth trusting rather than just reading.
The instrument is cited by number, not paraphrased — so you can open it.
Every claim links the source it was verified against, with the date of that verification.
Rows whose sources can no longer be opened are removed, not softened into vagueness.
The stamp at the top is bumped only when facts were actually re-checked — never to look fresh.
Businesses selling in-scope products and services on the EU market — e-commerce, banking, e-books, transport — including non-EU sellers.
What it requires
Accessibility of the product or service; for web, conformance is assessed against EN 301 549 (which incorporates WCAG).
What it costs to be wrong
National enforcement, member state by member state. French courts have already gone both ways in 2026: one retailer was ordered to full accessibility in 6 months under a €500-per-day penalty; an identical claim against another was rejected and is on appeal. Both outcomes stand.
Scope notes
Services already on the market before 28 June 2025 have transitional room until 28 June 2030 if unchanged. Enforcement posture is still forming — that cuts both ways.
Providers and deployers of AI systems that interact with people or generate content — including providers outside the EU whose system’s output is used in the EU.
What it requires
People must be “informed that they are interacting with an AI system, unless this is obvious”, and AI-generated or manipulated content must be “marked in a machine-readable format and detectable as artificially generated or manipulated”.
What it costs to be wrong
Fines up to €15,000,000 or 3% of total worldwide turnover for the preceding financial year, whichever is higher. For SMEs and start-ups Article 99(6) inverts that test to whichever is lower, and Regulation (EU) 2026/1744 extends the lower cap to small mid-caps — so a smaller company’s real ceiling is materially below the headline figure.
Scope notes
The Commission lists exemptions from marking: short sequences of numbers, symbols or letters; source code; machine-to-machine outputs; closed-loop industrial uses; assistive standard editing. Knowing what is NOT required is how the job stays scoped and fixed-price.
Every VAT-registered business in France, regardless of size, must be able to receive electronic invoices. The obligation to issue phases in: large and medium companies from the same date, small and micro from 1 September 2027.
What it requires
A working connection to an accredited platform (PDP), with structured formats (UBL 2.1, CII, Factur-X) routed via the tax authority’s directory.
What it costs to be wrong
Non-receipt breaks the invoicing chain with every larger customer that is now obliged to issue electronically.
Manufacturers of products with digital elements placed on the EU market — hardware and software alike.
What it requires
Reporting of actively exploited vulnerabilities and severe incidents: early warning within 24 hours of becoming aware, full notification within 72 hours, final report no later than 14 days after a corrective measure is available (one month for severe incidents) — submitted once, through the CRA Single Reporting Platform, addressed to the CSIRT of your main establishment.
What it costs to be wrong
You cannot report what you have no way of hearing about: the practical gap is intake, triage and named roles, not the form itself.
Scope notes
Article 14 does not require full vulnerability management by September — it requires the ability to discover, decide and report. The rest of the CRA’s essential requirements apply from 11 December 2027.
Only providers of systems placed on the market before 2 August 2026. For everyone else the marking obligation is already live — this is a grace-period expiry, not a second deadline.
What it requires
Machine-readable marking of AI-generated or manipulated content, per Article 50.
What it costs to be wrong
Same penalty tier as the rest of Article 50: €15,000,000 or 3% of worldwide turnover, whichever is higher — but for SMEs and start-ups Article 99(6) applies whichever is lower.
Providers and deployers of standalone high-risk AI systems (Annex III) from 2 December 2027; AI embedded in products under EU product-safety law (Annex I) from 2 August 2028.
What it requires
Risk management, technical documentation, logging, human oversight, conformity assessment and registration — from the deferred dates, not now.
What it costs to be wrong
Preparing for this deadline while ignoring Article 50 is the current market’s standing mistake: the Omnibus left Article 50 exactly where it was.
Manufacturers, importers and distributors of products with digital elements on the EU market.
What it requires
The essential cybersecurity requirements: secure-by-design development, vulnerability handling including an SBOM, security updates, conformity assessment and CE marking.
What it costs to be wrong
Products that cannot show conformity lose the EU market. The Article 14 reporting duty above arrives first, on 11 September 2026.
Not everything on this ledger waits for a date. US web-accessibility litigation runs continuously and is the single most active enforcement mechanism in this table.
US places of public accommodation — in practice, any consumer-facing website. Driven by private plaintiffs under a 1990 statute; independent of the Title II rule and its extensions.
What it requires
Courts assess accessibility in practice; WCAG conformance is the de-facto benchmark. Overlay widgets have not proven a deterrent: 113 of July 2026’s 401 defendants were running one when they were sued.
What it costs to be wrong
Defence and settlement costs, plus remediation on a court’s timetable instead of your own. Filings are on track for roughly 6,176 in 2026 — a record, up nearly 20% on 2025.
Windows that have already closed are not listed as live triggers, and deferred regimes are labelled deferred rather than quietly dropped. A deadline that has passed creates a remediation question, not a preparation one — if you are unsure which side of a date you are on, that is exactly the twenty-minute conversation to have.
How this ledger is maintained
Each row records the instrument by number, links the source the claim was verified against, and carries the date of that verification. Rows whose sources can no longer be opened are removed, not softened. The stamp at the top of the page is only bumped when the facts were actually re-checked.
Tell me the deadline you are looking at and what your site does. You get a straight answer about whether it applies to you, and a fixed price if it does.