Cybersecurity and compliance deadlines in 2027: 11 dates for your diary

The 2027 dates at a glance

Each row links to the detail below. Dates are when the rule starts to apply, and some depend on how a regulation counts its months, so check the official source before you plan work around a specific day.

1. 12 January 2027: Windows Server 2016 reaches end of support

Windows Server 2016 stops receiving security updates from Microsoft on 12 January 2027, unless you pay for Extended Security Updates. ESU is available for up to three years, and for servers outside Azure it is billed through Azure Arc from 13 January 2027. Servers that move to Azure get ESU at no extra charge. Any 2016 domain controller, file server or line-of-business host still running in January is an unpatched system on your network, and cyber insurers and auditors ask about those. Our guide to Windows Server 2016 end of support covers the upgrade, migration and ESU options.

2. 12 January 2027: EU cloud switching charges end under the Data Act

From 12 January 2027, providers of cloud and data processing services in the EU may not charge customers for switching to another provider or back on premises, including data egress fees for the move. This is Article 29 of the EU Data Act. The wider switching rules in Chapter VI (notice periods, data export, help with the move) have applied since 12 September 2025, and until January providers may only charge their direct costs of switching. Standard service fees and proportionate early-termination penalties in a fixed-term contract are not switching charges, so read your contract terms before planning an exit. If your business relies on one cloud provider, the end of switching charges makes an exit plan cheaper to test. Our article on Microsoft dependency risks covers why that plan is worth having.

3. 15 March 2027: TLS certificates are limited to 100 days

From 15 March 2027, publicly trusted TLS certificates can be valid for no more than 100 days, down from 200 days since March 2026. The schedule comes from CA/Browser Forum Ballot SC-081v3, which the certificate authorities and browser makers adopted in April 2025. The limit falls again to 47 days in March 2029, and the period for reusing domain validation shrinks on the same schedule, to 10 days by 2029. A certificate renewed by hand once a year becomes one renewed at least four times a year. Now is a good time to list every public certificate you hold, find out who renews each one, and move them to automated renewal through ACME or your certificate provider's tooling. An expired certificate takes a website, API or VPN portal offline without any attacker involved.

4. 18 March 2027: FCA and PRA incident and third-party reporting starts

From 18 March 2027, UK financial services firms must report operational incidents that meet set thresholds, and notify the regulator about material third-party arrangements, under FCA PS26/2. The PRA and the Bank of England published matching rules, so dual-regulated firms and financial market infrastructures follow one regime. Incidents are reported in stages, starting with an initial report, and the third-party notifications apply to arrangements that support important business services. If your firm also has EU operations, DORA's incident reporting already applies there, and the two sets of templates and thresholds differ. Our article on DORA for financial services covers the EU side, and our page on breach notification deadlines by country puts both in one table.

5. 13 May 2027: India's DPDP Rules take full effect

India's Digital Personal Data Protection Rules, notified on 13 November 2025, bring most of their obligations into force 18 months later, around 13 May 2027. That tranche includes breach notification: tell the Data Protection Board and each affected person without delay, then send the Board a detailed report within 72 hours. It also covers consent notices, security safeguards and the rights of the people whose data you hold. If you have customers, staff or a development centre in India, add the DPDP Rules to your notification matrix now. They sit alongside CERT-In's six-hour reporting rule, which has applied since 2022 and has not changed. Our breach deadlines page sets out both.

6. 2 August 2027: Older general-purpose AI models must comply with the AI Act

General-purpose AI models placed on the EU market before 2 August 2025 must comply with the AI Act by 2 August 2027, under Article 111(3). Models placed on the market after that date have had to comply from the start, and the Commission's powers to enforce those duties, including fines, have applied since 2 August 2026. This deadline falls on the model providers, not on the businesses that use their products. It still affects you as a customer: ask your AI suppliers for their technical documentation and their summary of training content, because you will need both for your own AI Act assessment. Our EU AI Act compliance guide explains the roles.

7. 12 September 2027: Data Act unfair-terms rules reach older contracts

From 12 September 2027, the Data Act's rules on unfair contract terms also apply to B2B data sharing contracts signed on or before 12 September 2025. Since that date, the rules have covered new contracts only. Under Article 50, the extension only reaches older contracts that run indefinitely or that expire on or after 11 January 2034. A term that one business imposed on another and that grossly departs from good commercial practice is not binding. If you buy or supply data under long-running agreements, review them before September 2027, starting with clauses on liability, access to data and termination.

8. 12 October 2027: SQL Server 2017, Windows 11 24H2 and Windows 10 ESU Year 2 end

Microsoft ends extended support for SQL Server 2017 on 12 October 2027. On the same day, Windows 11 version 24H2 Enterprise and Education editions stop receiving updates (Home and Pro 24H2 already stopped on 13 October 2026), and Year 2 of commercial Extended Security Updates for Windows 10 ends. Year 3 of Windows 10 ESU costs double the Year 2 price, around £232 to £264 per device, and it is the last year Microsoft offers. Check the Microsoft lifecycle pages for each product you run, and budget for the upgrades in your 2027 plan. Our guides on Windows 10 end of life and IT budgeting cover the costs.

9. 2 December 2027: AI Act high-risk obligations apply

From 2 December 2027, providers and deployers of high-risk AI systems listed in Annex III of the AI Act, such as AI used in recruitment, credit scoring or access to education, must meet the Act's high-risk requirements. The original date was 2 August 2026. The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026) moved it, because the harmonised standards were not ready, and moved high-risk AI built into products under Annex I to 2 August 2028. Deployers have their own duties: human oversight, keeping logs, informing the people affected and, for some public and financial uses, a fundamental rights impact assessment. If you use AI to screen job applicants or assess customers, start the inventory now. Our AI Act enforcement timeline lists every date.

10. 11 December 2027: The Cyber Resilience Act applies in full

From 11 December 2027, products with digital elements sold in the EU must meet the Cyber Resilience Act's essential cybersecurity requirements and carry a CE mark to show it. That covers most hardware and software that connects to a device or network, from smart cameras to desktop applications. Two parts already apply: the rules for notified bodies since 11 June 2026, and the duty to report actively exploited vulnerabilities and severe incidents since 11 September 2026. Manufacturers need a software bill of materials, a declared support period and a vulnerability handling process before the December date. Importers and distributors must check that the products they sell comply. Our Cyber Resilience Act guide covers the product classes and conformity routes.

11. December 2027: Regulated firms must accept the EU Digital Identity Wallet

By late December 2027, banks and other private services that are required by law or contract to use strong user authentication must accept the EU Digital Identity Wallet when a user chooses to log in with it. The duty comes from Article 5f of the revised eIDAS Regulation, which sets it at 36 months after the main implementing acts entered into force, in December 2024. Very large online platforms have the same duty. Micro and small enterprises are exempt. Member states must offer citizens a wallet by the end of 2026, so customers will start asking. If you run a regulated customer login in the EU, talk to your identity provider about wallet support during 2027.

A UK deadline with no date yet

The UK Cyber Security and Resilience Bill has passed the House of Commons and is in the House of Lords. Royal Assent could come between late 2026 and spring 2027, but most of the detailed duties will follow in secondary legislation, which the government has suggested will come around 2028. Nothing in the Bill has legal effect yet. When it does, it will bring managed service providers and data centres into scope and require initial incident notification within 24 hours. If you are an MSP, or depend on one, read our article on the Cyber Security and Resilience Bill and watch for the commencement regulations.

How to use this list

Copy the dates that apply to you into your risk register or compliance calendar, with an owner and a start date for the work, not just the deadline itself. Most of them need months of lead time: a server migration, a certificate automation project or an AI system inventory cannot be done in the final week. Review the list each quarter, because dates move. The AI Act high-risk date moved once already, and the UK Bill's timetable depends on Parliament. Our cybersecurity roadmap guide shows how to turn deadlines like these into a plan with a budget.