Editorially reviewed: 22 October 2026 · Legal status checked up to: 22 October 2026. Time-bound statements are dated; legal acts that are announced but not yet published are marked as such.
For whom: Banks (SI) Banks (LSI) Insurers Reporting service providers Crypto-asset service providers Each entry states in the text whom it applies to.
Three dates carry the year 2027: 1 January (SREP Guidelines, output floor, FRTB), 10 July (Anti-Money Laundering Regulation) and 2 December (high-risk obligations of the AI Act). In between lie the reporting dates that run anyway – and a few announced measures whose final text is not yet available.
How should the roadmap be read?
applicable law is published and applicable or has a statutory start date. politically agreed is politically agreed or formally adopted, but the legal text is not yet in force. official deadline is a deadline announced by the authority where the law itself names only a relative period. supervisory expectation is a requirement from a supervisory letter or data collection – not a legal act, but a deadline. announced / expected rests on an announcement by the authority or an expectation from secondary sources. derived date is a calendar date we calculated from a relative statutory deadline – the law itself does not name it. EBA guidelines bind the competent authorities; they affect institutions through supervisory practice and applicable law, not like a directly applicable regulation. For reports, the reference date and the submission deadline are stated separately.
What is already running in 2026?
Among others the MiCAR CASP Reporting Regulation (since 15 June), the AI transparency duties (since 2 August) and NISG registration by 31 December 2026.
| Date | Status | Rulebook · What applies – and for whom |
|---|---|---|
| 15.06.2026 | applicable law | MiCAR-CASP-MV, Federal Law Gazette II No 71/2026 – In force; first reference date 30.06.2026, first submission by 11.08.2026. Authorised CASPs semi-annually, financial entities under Art. 60 MiCAR only annually. |
| 26.06.2026 | applicable law | EBA/GL/2026/06 – Revised SREP Guidelines published; new section 5.7 “ICT systems, risk data aggregation and risk reporting”. On the same day the ECB announces the revision of its RDARR guide. |
| 27.07.2026 | applicable law | Regulation (EU) 2026/1744 (Digital Omnibus on AI) – In force. High-risk obligations for Annex III systems postponed to 02.12.2027, Annex I to 02.08.2028 – fixed calendar dates, no trigger mechanism. |
| 02.08.2026 | applicable law | AI Act – Transparency obligations under Art. 50 and the sanctions regime apply; the Commission exercises its powers vis-à-vis GPAI providers. |
| 11.09.2026 | applicable law | Cyber Resilience Act, Art. 14 – Reporting obligations for actively exploited vulnerabilities and severe incidents – also for legacy products. CERT.at is the coordinating CSIRT. |
| 01.10.2026 | applicable law | NISG 2026, Federal Law Gazette I No 94/2025 – In force. Registration within three months of entry into force (section 29(3)) via the business service portal (USP). For financial entities the DORA provisions take precedence under section 24(7); the NISG duties on governance, risk management, evidence and reporting do not apply, registration under section 29(2) remains (FMA, BMI, OeNB). Whether an undertaking is an essential or important entity at all is determined by activity and size – not by DORA. |
| 21.10.2026 | politically agreed | Securitisation reform – Political agreement between Council and Parliament: “resilient” category, strengthened STS label, risk-sensitive recalibration of own funds, EU-level supervision of STS third-party verifiers. Legal texts being finalised; application date open. |
| 31.10.2026 | supervisory expectation | ECB letter SSM-2026-0301 – Action plans on AI-enabled cyber threats to the Joint Supervisory Team – significant institutions only. Core element: full identification of ICT assets including third-party and open-source software. |
| November 2026 | announced / expected | SSM supervisory priorities 2027–2029 – Annual update. For 2026–2028, risk data aggregation, ICT resilience and AI governance sit together under priority 2. |
| Q4 2026 | announced / expected | Revised ECB RDARR guide – Announced on 26.06.2026 with clarifications on the scope of the data governance framework and on integrated data architecture; public consultation if changes are substantial. Content not yet known. |
| 02.12.2026 | applicable law | AI Act – New prohibitions; labelling obligation for generative systems placed on the market before 02.08.2026. |
| 31.12.2026 | official deadline | NISG 2026, section 29(3) – registration deadline – The Federal Office for Cybersecurity states registration “from 1 October 2026 until 31 December 2026 at the latest via the USP” (FAQ, as of 25.09.2026); the law itself names only the relative three-month period. Each entity registers separately, there is no group registration; fines up to EUR 50,000, EUR 100,000 for repeat cases (section 45(4)). |
What does 2027, the year of convergence, bring?
SREP section 5.7 and the output floor (1 January), the Solvency II review (30 January), the AMLR (10 July) and AI high-risk duties for credit scoring (2 December).
| Date | Status | Rulebook · What applies – and for whom |
|---|---|---|
| 01.01.2027 | applicable law | EBA/GL/2026/06, section 5.7 – Start of application. ICT systems, risk data aggregation and risk reporting are assessed in one block – addressed to the FMA and OeNB, regardless of an institution's significance. |
| 01.01.2027 | applicable law | CRR III – output floor – 60 % of standardised-approach RWA (2028: 65 %, 2029: 70 %, 2030: 72.5 %). With COM(2026) 615 the Commission announced a review; proposals are expected in Q1 2027. |
| 01.01.2027 | applicable law | CRR III – FRTB – Binding own-funds requirements for market risk (reporting only since 2025). Temporary relief under Delegated Regulation (EU) 2026/1221 until end-2029. |
| 11.01.2027 | applicable law | EBA/GL/2025/01 (ESG risks) – Application for small and non-complex institutions. |
| 30.01.2027 | applicable law | Solvency II review (Directive (EU) 2025/2) – Start of application. Revised quarterly and annual QRTs from reference period Q1 2027 with taxonomy 2.10.0; the 2026 annual submission (filed in 2027) still uses taxonomy 2.8.2. Submission deadlines of 16 weeks solo and 22 weeks group apply for the first time from year-end 2027. Insurers only. |
| 11.02.2027 | applicable law | MiCAR-CASP-MV – Submission of master data (reference date 31.12.2026) and of the first annual report of financial entities under Art. 60 MiCAR (Annex 3). |
| February 2027 | supervisory expectation | ECB IT risk questionnaire – Postponed collection date (originally September 2026) – significant institutions. |
| March 2027 | announced / expected | DORA register of information – Submission with reference date 31.12.2026; error logs to be cleared without delay. Window follows the pattern of previous years, announced annually by the ESAs. |
| Q1 2027 | announced / expected | Commission – output floor – Legislative proposals on the output floor, its transitional arrangements and the simplification of MREL, buffers and Pillar 2 expected (AFME, 2026). |
| 30.06.2027 | applicable law | MiCAR Art. 140 · TFR Art. 37(3) – Commission report on MiCAR (including the question of regular CASP reporting) and application report on the Transfer of Funds Regulation including analysis tools and de-minimis thresholds. |
| 01.07.2027 | applicable law | AMLA Regulation, Art. 13 – AMLA launches the first selection procedure for directly supervised obliged entities; completion within six months. |
| 10.07.2027 | applicable law | Anti-Money Laundering Regulation (AMLR) – Directly applicable: EUR 1,000 threshold for CASPs (Art. 19(3)), correspondent relationships (Art. 37), self-hosted addresses (Art. 40), ban on anonymous crypto accounts (Art. 79). AMLA guidelines on Art. 37 and 40 due by this date – no draft so far. |
| 31.07.2027 | applicable law | Crypto-MPfG, Federal Law Gazette I No 96/2025 – First report by crypto-asset service providers under the Austrian Crypto Reporting Obligations Act. |
| September 2027 | announced / expected | EBA simplification package (EBA/REP/2026/07) – Targeted implementation of the reduced ITS; the proposals aim at net around 50 % fewer EU-harmonised data points – an intended effect, not a reduction already in force and not a figure per institution. Two-year stability phase until then. OeNB implementation in GMD/Basic Cube and AuRep not yet described. |
| 30.09.2027 | applicable law | DAC8 – First automatic exchange of information on crypto-assets between Member States. |
| 30.09.2027 | derived date | NISG 2026, section 33 – Self-declaration twelve months after the registration obligation arises – not applicable to financial entities under section 24(7) (FMA); relevant for group companies that are themselves essential or important entities, such as data centres or IT providers under Annex I points 8 and 9, if they meet the thresholds. |
| H2 2027 | announced / expected | Digital euro · IReF – Digital euro pilot with 36 payment service providers (twelve months) according to ECB planning; IReF consultation. Both depend on the legislative process. What the digital euro means for regulatory reporting: Who sees the payment – the LinkedIn series. |
| 02.12.2027 | applicable law | AI Act, Annex III – High-risk obligations for credit scoring of natural persons (point 5(b)): Art. 9–15, 17, 26, 27, conformity assessment, EU database. The FMA is the market surveillance authority. |
| 11.12.2027 | applicable law | Cyber Resilience Act – Remaining manufacturer obligations: Annex I, SBOM, support period – for institutions as manufacturers of their own apps. |
What comes in 2028 and beyond?
Among others the output floor at 65 % (1 January 2028), AI duties for Annex I products (2 August 2028) and IReF reporting from 2031.
| Date | Status | Rulebook · What applies – and for whom |
|---|---|---|
| 01.01.2028 | applicable law | CRR III – output floor – 65 % of standardised-approach RWA (subject to the announced review). |
| 01.01.2028 | applicable law | DAC8 / Crypto-MPfG – TIN requirements for the reports. |
| 2028 | applicable law | AMLA Regulation – Direct supervision starts six months after publication of the list of selected obliged entities (Art. 13); crypto-asset service providers are a separate category of the risk classification (Art. 12(4)(j)). |
| 02.08.2028 | applicable law | AI Act, Annex I – High-risk obligations for systems embedded in regulated products – secondary for banks, to be kept in the inventory. |
| 01.10.2028 | applicable law | NISG 2026 – First evidence requests by the cybersecurity authority to covered entities – group-owned data centres and IT companies. |
| Q2 2030 / 2031 | announced / expected | ECB IReF – Pilot of the Integrated Reporting Framework in Q2 2030, reporting operations in 2031 according to ECB planning. Crypto-assets and the digital euro are not part of the target picture. |
The 2027 dates are not a series of projects but a series of evidence requests about the same data base. Whoever serves the register of information (March), SREP data capability (from January), AMLR due diligence (July) and credit scoring (December) from one inventory collects once. The page on the data core describes how.
Frequently asked questions
By when must NISG registration be completed?
The law names a relative period of three months from entry into force (section 29(3)). The Federal Office for Cybersecurity announces the resulting deadline of 31 December 2026; registration runs via the business service portal, each entity separately. For financial entities this registration remains, according to the FMA, BMI and OeNB, while the substantive NISG duties are displaced by DORA (section 24(7)).
Is the revised RDARR guide already available?
Not as of this page. What is documented is only the ECB's announcement of 26 June 2026, the expected period (fourth quarter of 2026) and the two focal points of the revision: scope of the data governance framework and integrated data architecture.
Which dates do not concern less significant institutions?
The ECB letter of 7 July 2026 with action plans due 31 October 2026 and the IT risk questionnaire address significant institutions. The SREP Guidelines from 1 January 2027, by contrast, apply to all institutions via the FMA and OeNB.
Ing. Mag. Patrick Eiler
Patrick Eiler advises banks and insurers in Vienna on regulatory reporting, data architecture and AI compliance. More than twenty years in banking, insurance and financial services; speaker at the Hypo-Verband (expert session of 23 September 2026).