Skip to content
Innopulse Consulting
Navigate
EnglishDeutsch
Get in touch
Contact
info@innopulse.io+41 79 508 28 06
Gotthardstrasse 30, 6300 Zug

Regulatory deadlines 2023 to 2028: data protection, AI, cyber and anti-money laundering

Between 2025 and 2028 numerous obligations take effect for companies in Switzerland and the DACH region: the Swiss cyberattack reporting duty since April 2025, the European Accessibility Act since June 2025, the Cyber Resilience Act reporting duties since September 2026, the Swiss transparency register and AMLA revision since October 2026, the EU AMLR from July 2027 and the AI Act high-risk obligations from December 2027.

Last updated: 07.11.2026

This overview collects the key dates of the regulations we write about on this website, in chronological order, each linked to the detailed explanation. It is updated whenever the law changes.

The legal text is always decisive. The overview does not replace an assessment of whether a regulation applies to a specific company.

DateRegulationWhat appliesWho is affectedExplainer
1 Sep 2023Swiss FADP (revised)Fully revised Data Protection Act in forceAnyone processing personal data of people in SwitzerlandExplainer
17 Jan 2025DORA (EU)Digital operational resilience requirementsFinancial entities in the EU and their ICT third-party providers
2 Feb 2025EU AI ActProhibitions under Art. 5 and AI literacy under Art. 4 (a best-efforts duty since the Digital Omnibus)Providers and deployers of AI systems with an EU nexusExplainer
1 Apr 2025Swiss ISADuty to report cyberattacks to the federal office within 24 hoursCritical infrastructure operatorsExplainer
28 Jun 2025European Accessibility ActAccessibility requirements for certain products and servicesProviders serving consumers in the EU; microenterprises exempt for servicesExplainer
2 Aug 2025EU AI ActObligations for general-purpose AI models, governance, penaltiesProviders of GPAI modelsExplainer
12 Sep 2025EU Data ActRules on access to and use of data from connected products and switching cloud servicesManufacturers of connected products, cloud service providers
1 Oct 2025Swiss ISAFines of up to CHF 100,000 for breaching the reporting dutyCritical infrastructure operatorsExplainer
6 Dec 2025NIS2 (Germany)NIS2 implementation act in forceAround 29,500 important and essential entitiesExplainer
6 Mar 2026NIS2 (Germany)Deadline for BSI registration of entities already coveredImportant and essential entities
2 Aug 2026EU AI ActMost of the regulation applies, including transparency duties under Art. 50Providers and deployers of AI systemsExplainer
11 Sep 2026Cyber Resilience ActReporting duties for actively exploited vulnerabilities and severe incidents via the ENISA platformManufacturers of products with digital elementsExplainer
1 Oct 2026Swiss TJPGTransparency register live, reporting of beneficial ownersLegal entities under Swiss law and certain foreign entitiesExplainer
1 Oct 2026Swiss AMLA revisionCertain advisory activities brought under the Anti-Money Laundering ActAdvisers, for example in real estate transactions and setting up legal entitiesExplainer
2 Dec 2026EU AI ActEnd of the transition period for labelling synthetic content under Art. 50(2) for existing systemsProviders of generative AI systems
December 2026Swiss AMLA revisionEnd of the transition period for advisers’ SRO applications; confirm the exact date with the chosen SRONewly covered advisersExplainer
March 2027Swiss TJPGDeadline for first reports by foreign legal entities, six months after entry into force (Art. 53 TJPG)Foreign legal entities with a Swiss nexus
10 Jul 2027EU AMLRSingle EU anti-money laundering rulebook appliesObliged entities in the EU, including EU subsidiaries of Swiss groupsExplainer
2 Dec 2027EU AI ActObligations for high-risk AI systems under Annex IIIProviders and deployers of high-risk AIExplainer
11 Dec 2027Cyber Resilience ActEssential requirements, conformity assessment and CE markingManufacturers, importers and distributors of products with digital elements
2 Aug 2028EU AI ActObligations for high-risk AI in products under Annex IManufacturers of products with AI safety components

Notes

  • Dates reflect the legal position on 7 November 2026. The AI Act is considered as amended by the Digital Omnibus (Regulation (EU) 2026/1744).
  • EU regulations do not apply in Switzerland directly but cover Swiss companies active on the EU market or with EU subsidiaries.
  • Where a deadline depends on the chosen organisation, such as SRO membership, confirm the date there.

Frequently asked questions

Does the AI Act apply to Swiss companies?

If they place AI systems on the EU market or their output is used in the EU, yes. Purely domestic Swiss applications are not covered.

Which deadline is most urgent for Swiss SMEs?

It depends on the business. For advisers it is SRO membership by December 2026, for manufacturers of digital products with EU customers the ongoing CRA reporting duty, for critical infrastructure the ISA reporting duty.

How current is the overview?

It carries a date and is updated whenever a relevant legal change occurs. The legal text remains decisive.

Sources

More overviews

Book an initial conversation
LM
Reviewed by
Leutrim Miftaraj
Founder & CEO · MSc Innovation Management (FFHS) · PMP · IREB CPRE · Author of “Identity Over Discipline”
Mandates incl. EDA, MeteoSwiss, FSO, SERI, FINMA, Swisscom and BLS
Editorial policy