May 2023 – operators designated as very large online platforms (VLOPs) and very large online search engines (VLOSEs) will have to comply with stricter obligations from mid-2023 deadline

2 Feb 2025 – AI literacy provision/ provisions on prohibited systems become applicable

2026 – An AI bill will be pushed to the 2026 Parliamentary session

11 June 2026

First obligation applies

11 Dec 2027

Majority applies

Spring 2026 – subscription contracts regime comes into force

Jan 2025 – digital markets regime and changes to competition law come into force

Summer 2025 – Register of categorised services expected to be published and final transparency notices issued to categorised services. The associated regulations are pending legal challenge and may be delayed

Jan 2025 – Part 5 services must implement highly effective age assurance processes

16 March 2025 – Deadline for completing Illegal Harms risk assessment

April 2025 – Protecting children from harms code expected to be published

16 April 2025 – Children's access assessment completion deadline (U2U and search services)

July 2025 – Highly effective age assurance in place for other types of harmful content and Children's Access Risk Assessments to be completed

Aug 2025 – provisions on general purpose AI become applicable

Aug 2026 – majority of provisions apply including on high-risk systems in Annex III

Aug 2027 – provisions apply for high-risk AI systems that are products, or used as a safety component of products, covered by EU harmonization legislation

March 2029

First group of priority data categories

March 2031

Second group of priority data categories

19 June 2025 – Provisions on data access by government, smart meter communication licences, reasonable and proportionate searches for DSARs

19 Aug 2025 – Provisions on law enforcement processing, powers and notices of the Information Commissioner; smart meter communication licences, some updates to UK GDPR and PECR

Autumn 2025 – Majority of provisions impacting digital verification

19 Dec 2025 – Provisions on remaining UK GDPR and PECR changes and government AI & copyright reporting

Feb 2025 – The legislative package aims to review the Cybersecurity Act, simplify legislation, and develop a clear and coherent framework for data

~Dec 2025? – A small number of ICT third-party service providers will be directly regulated. Assessments are currently ongoing, and final designations will be made by the end of 2025

31 Dec 2025 – Entities capable of bringing a 'super-complaint' and other procedural requirements come into force

Feb 2025 – Included in the European Commission's 2025 work programme, a bill is expected in December 2025

European Technology and Digital Regulation

Horizon Scanner 2025