4 Dec 2026
in 44 days
Due soon
Resumed extraordinary session · MEPC/ES.2 resumed session; MARPOL Annex VI amendments · IMO
Maritime
International
Law
After adjourning in October 2025, the IMO's second extraordinary session of the Marine Environment Protection Committee is due to resume on Friday 4 December 2026, straight after MEPC 85 (30 November to 3 December), subject to confirmation by that session. On the table is adoption of the Net-Zero Framework: a global fuel standard and a pricing mechanism for ships above 5,000 GT. If adopted, entry into force would follow the MARPOL tacit acceptance procedure.
IMO
· IMO press briefing
What to do (4 items)
- Follow the MEPC 85 outcome and whether the vote goes ahead
- Model the fuel standard and pricing against the fleet's fuel mix
- Keep the FuelEU Maritime and EU ETS data ready; the IMO measure builds on similar reporting
- Plan for two regimes running side by side if adoption succeeds
Open this entry to tick items off
9 Dec 2026
in 2 months
Due soon
Transposition deadline; applies to products placed on the market after this date · Directive (EU) 2024/2853 · European Commission
IndustryInfrastructure
EU
Law
The revised Product Liability Directive applies to products placed on the market from 9 December 2026. Software, including AI and updates, counts as a product, and a manufacturer can be liable for damage caused by a missing security update or a vulnerability. Claimants get easier access to evidence and lighter burdens of proof.
EUR-Lex
Date reported, not yet checked against the official text.
What to do (4 items)
- Review product and software insurance cover for liability under the new rules
- Keep records of security updates offered and when, per product version
- Check contracts with software suppliers for who carries the liability
- Make sure documentation and update instructions reach the end user
Open this entry to tick items off
30 Dec 2026
in 2 months
Due soon
Applies to large and medium operators and traders · Regulation (EU) 2023/1115 as amended in December 2025 · European Commission
Industry
EU
Law
After two postponements, the deforestation-free products rules apply from 30 December 2026 for large and medium companies and from 30 June 2027 for micro and small ones. Cattle, cocoa, coffee, palm oil, rubber, soya, wood and products made from them (paper, packaging, furniture, tyres) need a due diligence statement before being placed on the EU market or exported.
European Parliament
· EUR-Lex
What to do (4 items)
- List the products you place on the EU market or export that contain the covered commodities
- Collect geolocation and legality evidence from suppliers
- Register in the EU information system and prepare due diligence statements
- Check whether the company is micro or small and gets the later date
Open this entry to tick items off
2026 (expected)
in 2 months
Due soon
Final rule expected · Cyber Incident Reporting for Critical Infrastructure Act of 2022; proposed rule of 4 April 2024 · CISA
InfrastructureIndustryMaritime
United States
Law
CIRCIA will require covered critical infrastructure entities to report substantial cyber incidents to CISA within 72 hours and ransom payments within 24 hours. The proposed rule was published in April 2024; funding lapses delayed the final rule, and CISA held town halls in June 2026 to gather last input. No final rule had been published as of September 2026. Reporting only starts on the effective date of the final rule.
CISA
What to do (4 items)
- Check whether US operations fall in a critical infrastructure sector under the proposed definitions
- Prepare an incident reporting path that can meet 72 hours to CISA
- Track the final rule on CISA's CIRCIA page
- Align with any sector rule you already follow (Coast Guard, TSA, SEC)
Open this entry to tick items off
Dec 2026
in 2 months
Due soon
Member States start the transition · Commission Recommendation (EU) 2024/1101 and the coordinated implementation roadmap of 23 June 2025 · European Commission, NIS Cooperation Group
MaritimeIndustryInfrastructure
EU
Guidance
The coordinated EU roadmap for post-quantum cryptography asks every Member State to start the transition by the end of 2026: a national strategy, an inventory of cryptography in use and first pilots. High-risk use cases should be migrated by the end of 2030 and as much as feasible by 2035. For operators this is the moment to know where cryptography sits in your systems.
European Commission
· EUR-Lex
What to do (4 items)
- Make an inventory of where you use RSA and elliptic-curve cryptography (VPNs, TLS, signing, HSMs)
- Ask key suppliers for their post-quantum plans and dates
- Prefer products that can swap algorithms without a hardware change
- Watch the national strategy from your cybersecurity authority
Open this entry to tick items off
Dec 2026
in 2 months
Due soon
Member States must offer a wallet · Regulation (EU) 2024/1183 · European Commission
MaritimeIndustryInfrastructure
EU
Law
Under eIDAS 2 each Member State must offer at least one EU Digital Identity Wallet within 24 months of the implementing acts adopted in late 2024, which lands at the end of 2026. Later, certain relying parties (banks, telecoms, large platforms, and services required by law to use strong identification) must accept the wallet. For most companies this is a future login and signing option, not an obligation yet.
EUR-Lex
Date reported, not yet checked against the official text.
What to do (3 items)
- Check whether your sector is one that must accept the wallet and from when
- Plan wallet acceptance for customer and crew onboarding where it saves paperwork
- Watch the national wallet launch in Bulgaria and Greece
Open this entry to tick items off
1 Jan 2027
in 2 months
Due soon
13.625% reduction factor applies to 2027 CII · Resolution MEPC.400(83); MARPOL Annex VI regulation 28 · IMO
Maritime
International
Law
The Carbon Intensity Indicator rating under MARPOL Annex VI regulation 28 uses a yearly reduction factor Z against the 2019 reference line. MEPC 83 (11 April 2025) adopted the factors for 2027 to 2030: 13.625% in 2027, 16.25% in 2028, 18.875% in 2029 and 21.5% in 2030, compared with 11% in 2026. Ships of 5,000 GT and above need a lower attained CII in 2027 to keep the same rating. A D rating three years running or an E rating triggers a corrective action plan in SEEMP Part III.
IMO resolution MEPC.400(83)
· IMO EEXI and CII FAQ
What to do (4 items)
- Recalculate the projected 2027 CII rating for each ship with the 13.625% factor
- List ships that would drop to D or E and the operational measures planned (speed, routing, hull cleaning)
- Update SEEMP Part III and get it verified before the 2027 reporting year starts
- Follow the MEPC Phase 2 review of the CII metric (spring 2026 to spring 2028) for changes
Open this entry to tick items off
1 Jan 2027
in 2 months
Due soon
Offshore ships enter EU ETS · Directive 2003/87/EC Article 3ga, as amended by Directive (EU) 2023/959 · European Commission and Member State administering authorities
Maritime
EU
Law
From 1 January 2027 offshore ships of 5,000 GT and above (offshore supply, construction, accommodation and similar vessels) are inside the EU ETS for emissions on voyages to, from and between EU/EEA ports and at berth. Their operators have reported under the MRV regulation since 2025. The first surrender for 2027 emissions falls due on 30 September 2028.
EUR-Lex
· European Commission (DG CLIMA)
What to do (4 items)
- List offshore ships of 5,000 GT and above that call at EU/EEA ports
- Check that each MRV monitoring plan covers CO2, CH4 and N2O and is approved
- Open or extend the maritime operator holding account in the Union Registry before 2027
- Price allowance costs into 2027 offshore charter rates and contracts
Open this entry to tick items off
2027 (expected)
in 2 months
Due soon
Expected Royal Assent · Cyber Security and Resilience (Network and Information Systems) Bill · UK Parliament, Department for Science, Innovation and Technology
InfrastructureIndustryMaritime
United Kingdom
Law
The Bill updates the UK NIS Regulations 2018: it brings managed service providers, data centres and designated critical suppliers into scope, shortens incident reporting to 24 hours, adds near-miss reporting and raises penalties. It was introduced on 12 November 2025, passed the Commons in June 2026 and is in the House of Lords. Royal Assent is expected around the turn of 2026 and 2027, with obligations following through regulations.
UK Parliament
· gov.uk
Date reported, not yet checked against the official text.
What to do (4 items)
- Check whether UK operations or UK customers make you an operator of essential services or a relevant provider
- Compare the 24-hour reporting expectation with your current incident process
- Watch the regulations that will set the detailed duties after Royal Assent
- If you are a managed service provider to UK organisations, expect to be in scope
Open this entry to tick items off
12 Jan 2027
in 3 months
Due soon
Switching charges withdrawn · Regulation (EU) 2023/2854, Article 29 · European Commission
MaritimeIndustryInfrastructure
EU
Law
From 12 January 2027 cloud and data processing providers may no longer charge switching or egress fees when a customer moves to another provider or back on-premises. Until then charges are capped at the provider's costs. Useful when planning a migration of monitoring or backup data.
EUR-Lex
Date reported, not yet checked against the official text.
What to do (3 items)
- Note the date in any cloud migration or renewal plan
- Ask current providers to confirm their post-2027 switching terms in writing
- Keep exports in open formats so a switch stays practical
Open this entry to tick items off
12 Jan 2027
in 3 months
Due soon
End of extended support · Windows Server 2016 lifecycle · Microsoft
MaritimeIndustryInfrastructure
International
Standard or protocol
Windows Server 2016 leaves extended support on 12 January 2027. After that there are no security updates without paid Extended Security Updates. Domain controllers, file servers and application servers on 2016 need a migration plan this year.
Microsoft Learn
What to do (4 items)
- List servers on Windows Server 2016, including virtual machines and appliances
- Plan upgrades to Windows Server 2022 or 2025, application by application
- Order ESU for anything that must stay past January 2027
- Check application vendor support for the newer server version
Open this entry to tick items off
20 Jan 2027
in 3 months
Upcoming
Applies; Directive 2006/42/EC repealed · Regulation (EU) 2023/1230 · European Commission
IndustryMaritime
EU
Law
The Machinery Regulation replaces the Machinery Directive on 20 January 2027. New for manufacturers: machinery must be protected against corruption of its control logic and software (Annex III, 1.1.9 and 1.2.1), safety-relevant software updates need traceability, and certain high-risk machinery listed in Annex I needs third-party assessment. Machinery already on the market is not affected.
EUR-Lex
Date reported, not yet checked against the official text.
What to do (5 items)
- Map the safety-related control systems and software in each machine you build or import
- Add protection against unauthorised changes to control logic and a log of software versions
- Check Annex I for machinery that now needs a notified body
- Update the technical file and the declaration of conformity to the new Regulation
- Tell integrators and end users what changes for modifications after installation
Open this entry to tick items off
18 Feb 2027
in 4 months
Upcoming
Battery passport required for LMT, industrial and EV batteries · Regulation (EU) 2023/1542, Article 77 · European Commission
IndustryMaritime
EU
Law
From 18 February 2027 every light means of transport battery, industrial battery above 2 kWh and electric vehicle battery placed on the market needs a digital battery passport reachable through a QR code, with data on composition, carbon footprint, performance and durability. Battery due diligence duties were postponed separately to 18 August 2027.
EUR-Lex
Date reported, not yet checked against the official text.
What to do (4 items)
- List the batteries you place on the market above 2 kWh, including in vessels and machinery
- Collect the passport data from the cell and pack suppliers
- Choose a passport service provider and test the QR code flow
- Plan the due diligence policy for the August 2027 date if you exceed the turnover threshold
Open this entry to tick items off
15 Mar 2027
in 5 months
Upcoming
Maximum validity 100 days · Ballot SC-081v3 (Baseline Requirements) · CA/Browser Forum
MaritimeIndustryInfrastructure
International
Standard or protocol
From 15 March 2027 public TLS certificates can be valid for at most 100 days, and domain validation reuse drops with it. Any system that still renews certificates by hand will need attention four times a year.
CA/Browser Forum
Date reported, not yet checked against the official text.
What to do (3 items)
- Finish certificate automation for every public endpoint
- Check that load balancers and appliances accept automated renewals
- Move internal services to a private CA if they do not need public trust
Open this entry to tick items off
Apr 2027
in 6 months
Upcoming
End of standard security maintenance · Ubuntu release cycle · Canonical
MaritimeIndustryInfrastructure
International
Standard or protocol
Ubuntu 22.04 LTS reaches the end of its five years of standard support in April 2027. Security updates continue only with Ubuntu Pro (Expanded Security Maintenance) until 2032. Ubuntu 20.04 already reached that point in May 2025.
Canonical
What to do (3 items)
- List servers, gateways and embedded systems on Ubuntu 22.04 and 20.04
- Plan upgrades to 24.04 LTS or enable Ubuntu Pro
- Check application and driver compatibility before an in-place upgrade
Open this entry to tick items off
16 Jul 2027
in 9 months
Upcoming
Cybersecurity assessment done and plan submitted · 33 CFR part 101, subpart F · US Coast Guard
Maritime
United States
Law
By 16 July 2027 each covered owner or operator must have completed a cybersecurity assessment and submitted a Cybersecurity Plan to the Coast Guard for approval, then repeat the assessment yearly. The plan covers access control, network segmentation, logging, supply chain, incident response and the cyber drills.
Federal Register (govinfo)
What to do (4 items)
- Schedule the cybersecurity assessment early in 2027 so findings can be fixed first
- Write the Cybersecurity Plan in the structure of the rule
- Submit the plan to the Coast Guard for review before the deadline
- Keep evidence of the yearly assessment and drills
Open this entry to tick items off
30 Sep 2027
in 11 months
Upcoming
Surrender certificates for 2026 imports · Regulation (EU) 2023/956 as simplified by Regulation (EU) 2025/2083 · European Commission
Industry
EU
Law
Authorised CBAM declarants must surrender certificates covering the emissions embedded in goods imported during 2026 by 30 September 2027. Sales of certificates start in February 2027. The annual CBAM declaration for 2026 is due in the same year.
EUR-Lex
· European Commission
Date reported, not yet checked against the official text.
What to do (3 items)
- Verify the 2026 emissions figures with suppliers before the declaration
- Buy certificates in time; there is no secondary market
- Reconcile customs import volumes with the CBAM declaration
Open this entry to tick items off
30 Sep 2027
in 11 months
Upcoming
Full surrender obligation, phase-in ends · Directive 2003/87/EC as amended by Directive (EU) 2023/959 · European Commission and Member State administering authorities
Maritime
EU
Law
The phase-in ends with 2026 emissions: shipping companies must surrender allowances for 100% of their verified 2026 emissions by 30 September 2027. The verified 2026 emissions report is due by 31 March 2027. From this cycle on, the full carbon cost of voyages to, from and between EU/EEA ports applies every year. The Commission has to report by 31 December 2026 on bringing ships under 5,000 GT into the ETS.
EUR-Lex
· European Commission (DG CLIMA)
What to do (4 items)
- File the verified 2026 emissions report in THETIS-MRV by 31 March 2027
- Surrender allowances for 100% of verified 2026 emissions by 30 September 2027
- Review EUA purchase hedging for the full-cost years
- Watch the Commission review on ships under 5,000 GT (due 31 December 2026) for scope changes
Open this entry to tick items off
17 Oct 2027
in 12 months
Upcoming
Review report due · Directive (EU) 2022/2555, Article 40 · European Commission
MaritimeIndustryInfrastructure
EU
Law
The Commission has to review how NIS2 is working and report by 17 October 2027. In January 2026 it already proposed targeted amendments as part of a new cybersecurity package. Expect the scope and the reporting rules to be tuned, not loosened.
EUR-Lex
· European Commission
What to do (4 items)
- Keep a note of the NIS2 amendments proposed in January 2026 and their status
- Review which national rules changed since your last compliance check
- Re-check whether the company is essential or important after any size change
- Plan a yearly refresh of the security measures rather than a one-off project
Open this entry to tick items off
2 Dec 2027
in 1 year
Upcoming
High-risk obligations apply · Regulation (EU) 2024/1689, Annex III, as amended by the AI Omnibus · European Commission
MaritimeIndustryInfrastructure
EU
Law
High-risk AI systems listed in Annex III (employment decisions, access to essential services, critical infrastructure management, law enforcement and similar) are subject to the strict obligations from 2 December 2027. That date comes from the AI Omnibus that entered into force on 27 July 2026; the original date was August 2026. Deployers need a risk management system, human oversight, logging and a fundamental rights assessment where required.
EUR-Lex
· European Commission
What to do (5 items)
- Identify any AI used for hiring, worker management, safety of critical infrastructure or credit decisions
- Get the provider's technical documentation and declaration of conformity
- Set human oversight and logging for each high-risk use
- Train the staff who supervise the system and record it
- Register the use in the EU database where the Act requires it
Open this entry to tick items off
11 Dec 2027
in 1 year
Upcoming
Full application · Regulation (EU) 2024/2847 (CRA) · European Commission
IndustryInfrastructureMaritime
EU
Law
From 11 December 2027 products with digital elements placed on the EU market must meet the essential cybersecurity requirements, carry a CE marking based on a conformity assessment, ship with security updates for their support period, and come with documentation and an SBOM. This covers routers, controllers, sensors, onboard equipment and the software in them. Importers and distributors have their own checks to do.
EUR-Lex
· European Commission
What to do (6 items)
- Sort your products into default, important and critical classes
- Run a gap analysis against Annex I: secure by default, no known exploitable vulnerabilities, update mechanism
- Fix the support period per product and how updates will be delivered for that long
- Produce the technical documentation and the software bill of materials
- Ask suppliers of components for their CRA position and their update commitments
- Plan the CE marking and the EU declaration of conformity
Open this entry to tick items off
2028
in 1 year
Upcoming
Wave two reports now start with financial year 2027 · Directive (EU) 2025/794 (stop-the-clock) · European Commission
IndustryMaritimeInfrastructure
EU
Law
The stop-the-clock directive of April 2025 postponed sustainability reporting by two years for large companies that were due to report for financial year 2025 (wave two) and for listed SMEs due for 2026 (wave three). Wave two now reports for financial year 2027, in 2028. The Commission is also narrowing who has to report at all, so check the current threshold before starting.
EUR-Lex
· European Commission
Date reported, not yet checked against the official text.
What to do (4 items)
- Check the company's size against the latest CSRD thresholds after the Omnibus changes
- If still in scope, plan data collection for financial year 2027
- Reuse the EU ETS, FuelEU and energy audit data you already collect
- Agree with the auditor what assurance will be needed
Open this entry to tick items off
2028
in 1 year
Upcoming
Full operation, postponed from 2027 · Directive 2003/87/EC as amended (ETS2) · European Commission
IndustryInfrastructure
EU
Law
The second EU emissions trading system covers fuel used in buildings, road transport and smaller industry not in the main ETS. Fuel suppliers, not end users, surrender the allowances, but the cost passes into fuel prices. Monitoring and reporting started in 2025; the start of full operation was postponed by one year to 2028.
European Commission
What to do (3 items)
- Estimate the fuel cost exposure of sites and vehicle fleets from 2028
- Check whether your fuel supplier will pass the cost through explicitly
- Use the delay to move heating and fleet fuel where a switch is planned anyway
Open this entry to tick items off
26 Jul 2028
in 2 years
Upcoming
Application for the first group of companies · Directive (EU) 2024/1760 as amended by Directive (EU) 2025/794 · European Commission
IndustryMaritimeInfrastructure
EU
Law
The Corporate Sustainability Due Diligence Directive was moved back a year by the stop-the-clock directive: Member States transpose by 26 July 2027 and the first group of companies applies it from 26 July 2028. Only very large companies are directly covered, but they push supplier questionnaires and clauses down the chain.
EUR-Lex
Date reported, not yet checked against the official text.
What to do (3 items)
- Check whether any customer is directly covered and will ask for due diligence information
- Keep supplier and subcontractor records that answer human rights and environment questions
- Watch the Omnibus changes to thresholds before investing in a full programme
Open this entry to tick items off
2 Aug 2028
in 2 years
Upcoming
High-risk obligations apply to AI in regulated products · Regulation (EU) 2024/1689, Annex I, as amended by the AI Omnibus · European Commission
IndustryMaritime
EU
Law
AI systems that are safety components of products covered by EU product law (machinery, lifts, medical devices, vehicles, marine equipment and others) follow the high-risk rules from 2 August 2028 under the AI Omnibus. The AI requirements are checked in the same conformity assessment as the product.
EUR-Lex
· European Commission
What to do (4 items)
- List products you make or buy where AI performs a safety function
- Ask the product's notified body how the AI requirements will be assessed
- Keep the AI risk management file with the product technical file
- Watch the harmonised standards being written for AI in machinery
Open this entry to tick items off
1 Oct 2028
in 2 years
Upcoming
Effective for control centres · CIP-015-1 (FERC Order No. 907 of 26 June 2025) · NERC, FERC
Infrastructure
United States
Standard or protocol
FERC approved CIP-015-1 on 26 June 2025. It requires internal network security monitoring inside the electronic security perimeter of high-impact and medium-impact bulk electric system cyber systems with external routable connectivity. The standard becomes effective 36 months after approval, on the first day of the following calendar quarter, first for control centres and backup control centres, with other applicable systems following on the later date in the implementation plan.
NERC
· FERC
Date reported, not yet checked against the official text.
What to do (4 items)
- Identify high and medium impact BES cyber systems with external routable connectivity
- Deploy network monitoring that collects, detects and retains east-west traffic data
- Write the anomaly evaluation and response process the standard asks for
- Check the implementation plan for the date that applies to each site
Open this entry to tick items off
1 Jan 2029
in 2 years
Upcoming
Revised performance standard mandatory for new ECDIS · Resolution MSC.530(106)/Rev.1 (ECDIS performance standards) · IMO and IHO
Maritime
International
Standard or protocol
From 1 January 2029 every new ECDIS installed on board has to meet the revised performance standards based on IHO S-100, including support for S-101 ENCs. The transition period that started on 1 January 2026 ends. ECDIS installed before that date under the previous standard may continue in use, but chart services will move to S-101 over time.
IMO
· IHO ENC and ECDIS
What to do (4 items)
- Set 1 January 2029 as the cut-off in bridge equipment procurement specifications
- Budget ECDIS replacements for ships whose units cannot be upgraded to S-100
- Confirm ENC service providers' S-101 coverage for the fleet's trading areas
- Update the SMS navigation procedures and type-specific training records for S-100 units
Open this entry to tick items off
2029 (expected)
in 2 years
Upcoming
Expected entry into force · Amendments to the Annex of the FAL Convention (approved FAL 50, adoption at FAL 51 in 2027) · IMO
MaritimeInfrastructure
International
Law
Maritime single windows for ship clearance data have been mandatory under the FAL Convention since 1 January 2024. FAL 50 (March 2026) approved amendments requiring Contracting Governments to apply mandatory cyber security measures to their single windows, together with advance passenger and crew information requirements. Adoption is planned at FAL 51 in 2027 with expected entry into force on 1 January 2029. FAL 50 also started work on a non-mandatory maritime cyber code.
IMO FAL 50
· IMO Maritime Single Window
What to do (4 items)
- Port and national authorities: review the single window's security controls against the draft amendments
- Ship operators and agents: check that pre-arrival data flows through the national single window only
- Follow FAL 51 (2027) for the adopted text and any changes to the 2029 date
- Track the IMO correspondence group on a non-mandatory maritime cyber code
Open this entry to tick items off
9 Jan 2029
in 2 years
Upcoming
End of extended support · Windows Server 2019 lifecycle · Microsoft
MaritimeIndustryInfrastructure
International
Standard or protocol
Windows Server 2019 leaves extended support on 9 January 2029. Far enough away to plan properly, close enough that servers bought today should not be built on it.
Microsoft Learn
What to do (3 items)
- Stop deploying new workloads on Windows Server 2019
- Put the 2029 date in the server lifecycle plan
- Prefer Windows Server 2025 for new builds
Open this entry to tick items off
15 Mar 2029
in 2 years
Upcoming
Maximum validity 47 days; domain validation reuse 10 days · Ballot SC-081v3 (Baseline Requirements) · CA/Browser Forum
MaritimeIndustryInfrastructure
International
Standard or protocol
The final step of the schedule: from 15 March 2029 public TLS certificates are valid for at most 47 days and a domain validation can be reused for only 10 days. Certificates become a monthly event handled by software.
CA/Browser Forum
Date reported, not yet checked against the official text.
What to do (3 items)
- Treat certificate automation as production infrastructure with its own monitoring
- Retire devices that cannot rotate certificates without a manual step
- Plan DNS or HTTP validation that works for every host, including remote sites
Open this entry to tick items off
