Dates and transitional rules
Statutory dates and entity-specific triggers
Dates describe when provisions apply. They do not establish a new implementation grace period for an organisation starting a project today. AI Act Article 111 contains additional transition rules for existing systems and models; product and sectoral rules can already apply.
| Date / trigger | Requirement and scope |
|---|---|
| 25 May 2018 | GDPR has applied since this date; it is not a new 2026 requirement. |
| 17 January 2025 | DORA applies to Article 2 entities, subject to its exclusions. |
| 2 February 2025 | AI Act Chapters I and II, including AI literacy and the original Article 5 prohibitions. |
| 2 August 2025 | In particular, GPAI provider rules, governance and the penalty framework, except Article 101. For older GPAI models, see Article 111(3). |
| 12 September 2025 | Main application date of the Data Act; Article 50 contains further transitional rules. |
| 1 November 2025 | Czech Cybersecurity Act No. 264/2025 Coll. entered into effect. |
| 27 July 2026 | Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force. |
| 2 August 2026 | General application of the AI Act, including Article 50 transparency according to role and system type. |
| After 12 September 2026 | Data Act Article 3(1): access by design for connected products and related services placed on the market after this date. This is not a general deferral of data access rights. |
| 2 December 2026 | New AI Act Article 5(1)(ba), (bb) prohibitions and paragraphs 1a, 1b; also the Article 111(4) deadline for compliance with Article 50(2) for generative systems placed on the market before 2 August 2026. |
| 12 January 2027 | Data Act Article 29: switching charges prohibited for data processing services, subject to Article 31 exceptions. Ordinary service fees and permissible early termination penalties require separate assessment. |
| 2 August 2027 | AI Act Article 111(3): compliance for providers of GPAI models placed on the market before 2 August 2025. |
| 2 December 2027 | AI Act Chapter III, Sections 1, 2 and 3, except Article 6(5), apply to high-risk systems under Article 6(2) / Annex III (Article 113(c)). |
| 2 August 2028 | AI Act Chapter III, Sections 1, 2 and 3, except Article 6(5), apply to high-risk systems under Article 6(1) / Annex I (Article 113(c)); account for the special Article 2(2) regime for Annex I Section B. |
| Entity-specific — Czech NIS2 implementation | Report the regulated service normally within 60 days of meeting the conditions. Under the general regime, for each regulated service, begin fulfilling the duties to introduce and carry out security measures and to report incidents no later than one year after delivery of that service’s registration decision (Sections 13(4) and 15(4) of Act No. 264/2025 Coll.). Account for the special digital-service regime in Section 18 and Section 71 transitional provisions. |
For existing high-risk AI systems, account for AI Act Article 111(2). For systems outside Article 111(1) placed on the market or put into service before the relevant application date of Chapter III, this transitional provision makes application of the Regulation conditional on significant changes to their design from that date; Article 5 prohibitions are unaffected. Providers and deployers of high-risk systems intended for use by public authorities must in any event take the necessary steps to comply with the requirements and obligations by 2 August 2030.
Data Act Article 31 provides exceptions to Article 29 for services whose main features were mostly custom-built for an individual customer’s specific needs or whose components were all developed for an individual customer, and which are not offered at broad commercial scale through the provider’s service catalogue. Services provided as non-production versions for testing and evaluation for a limited period are also excluded from Chapter VI.
Czech NIS2: calculate the deadline from evidence
- Record the date on which the entity met the conditions for a regulated service.
- Determine the service notification deadline, normally 60 days from that event. For entities already meeting the conditions when the law took effect, this deadline expired on 31 December 2025.
- Retain each service’s registration decision and evidence of its delivery date. Under the general regime, calculate the one-year period for beginning to fulfil the duties to introduce and carry out security measures and to report incidents for that service from delivery, not from 31 December or a generic November date.
- Check regime-specific duties, subsequent changes and the law’s transitional provisions. Previously regulated entities continue their duties to the extent set out in Section 71(1); they must use the new Act’s incident reporting procedure from delivery of the service’s registration decision.
Section 18 of the Czech Cybersecurity Act sets a special regime for specified digital services, including cloud, data centres, CDN, DNS and managed services. For security measures under Section 18(1), Section 13(2) does not apply; the one-year rule in Section 13(4), which refers to that provision, must therefore not be transferred automatically to these services. Section 18(2) and (3) also modify incident reporting and the scope of Czech obligations. Determine the regime of the particular service before calculating a deadline; Section 18 itself sets no separate one-year transition.
Project sequence — recommendations, not statutory dates
| Step | Deliverable | Dependency |
|---|---|---|
| Scope and ownership | Register of applicable requirements, reasons, owners and actual dates | Services, systems, data and contracts |
| Urgent operational gaps | Address current prohibitions, transparency, rights and incident procedures | Applicable duties already in force |
| Risk and evidence | Risk assessments, conditional DPIA/FRIA, supplier review, necessary documentation | Purpose, role and scope |
| Implementation | Controls, training, contracts and records working in practice | Accepted remediation plan |
| Verification | Evidence-based review; certification only when selected or specifically required | Real operation and defined audit criteria |
| Maintenance | Changes, incidents, review frequency and responsibility | Ongoing monitoring of systems and law |
Set durations from actual gaps and resources. A training date, ISO audit date or internal inventory milestone is not an EU-wide legal deadline.
Legal sources: AI Act — Regulation (EU) 2024/1689, as amended here by Regulation (EU) 2026/1744 (Digital Omnibus on AI), published on 24 July 2026. Informative consolidated text: 02024R1689-20260727.
Further legal sources: NIS2 — Directive (EU) 2022/2555, Czech Cybersecurity Act No. 264/2025 Coll., promulgated text, GDPR — Regulation (EU) 2016/679, DORA — Regulation (EU) 2022/2554, Data Act — Regulation (EU) 2023/2854.
Official explanatory material: NÚKIB on registration and deadlines, 11 February 2026.