Regulatory monitoring
Regulatory Tracker
Key dates, obligations and documents concerning AI regulation, data, cybersecurity and liability related to digital technologies.
The ORAI Regulatory Tracker helps monitor regulatory developments relevant to organisations implementing or using artificial intelligence systems, from the AI Act and national legislation to rules concerning cybersecurity, data, digital products and liability.
As at:
This tracker is for information purposes only and does not constitute legal advice. Dates, obligations and the scope of individual regulations should always be verified with reference to the specific organisation, its role, sector and manner of using AI systems.
Regulatory timeline
Key dates
| Area | Act / topic | Key date | Relevance for organisations |
|---|---|---|---|
| Artificial intelligenceEU | AI Act, Regulation (EU) 2024/1689 | General date of application for most provisions of the AI Act. Organisations should verify their inventory of AI systems, their role and the scope of their obligations. | |
| Artificial intelligenceEU | AI Act: transparency obligations | Deadline for bringing certain content-generating systems placed on the market before 2 August 2026 into compliance with the transparency requirements under Article 50(2) of the AI Act. | |
| Artificial intelligenceEU | AI Act: high-risk AI, Annex III | Application of requirements for stand-alone high-risk AI systems listed in Annex III, including systems used in HR, education, public services, access to certain benefits and critical infrastructure. | |
| Artificial intelligenceEU | AI Act: high-risk AI in regulated products | Application of requirements for high-risk AI systems that are safety components of, or themselves constitute, products governed by sectoral legislation listed in Annex I. | |
| Artificial intelligencePoland | Polish Act on Artificial Intelligence Systems | Entry into force of the Polish Act supplementing the AI Act and establishing national arrangements for the supervision of AI systems. | |
| Artificial intelligencePoland | Polish Act on Artificial Intelligence Systems | Entry into force of a significant part of the provisions governing the national supervisory system, proceedings and enforcement of AI Act obligations. | |
| CybersecurityPoland | NIS2 / amendment to the Act on the National Cybersecurity System | Deadline for applications for entry in the KSC Register by essential and important entities not registered ex officio. Organisations should also review cyber risks associated with their use of AI. | |
| CybersecurityPoland | NIS2 / amendment to the KSC Act | End of the main implementation period. Entities within scope should have implemented the required cybersecurity risk-management measures. | |
| CybersecurityPoland | NIS2 / amendment to the KSC Act | Deadline for the first mandatory audits for certain essential entities and application of certain penalty provisions. | |
| CybersecurityEU | Cyber Resilience Act, CRA | Application of reporting obligations for actively exploited vulnerabilities and severe incidents affecting the security of products with digital elements. | |
| CybersecurityEU | Cyber Resilience Act, CRA | Full application of the CRA, including secure-by-design requirements, vulnerability handling and conformity assessment for products with digital elements. | |
| DataEU | Data Act, Regulation (EU) 2023/2854 | Requirement for connected products and related services placed on the market after 12 September 2026 to be designed so that data are accessible to the user. | |
| DataEU | Data Act | Prohibition on switching charges by providers of data processing services. This is particularly relevant to cloud services, data infrastructure and services used for AI deployment. | |
| DataPoland | Act on Fair Access to and Use of Data | 2026, legislative process | Polish legislation supplementing the Data Act, including provisions on competent authorities, procedures and penalties. |
| DataPoland | Act on Data Governance | Entry into force of national provisions supplementing the Data Governance Act, including the re-use and making available of protected data. | |
| ProductsEU | Product Liability Directive, Directive (EU) 2024/2853 | Deadline for transposing the new rules on liability for defective products, which also cover software and AI systems. | |
| ProductsPoland | Implementation of the Product Liability Directive | Expected changes to Polish product liability rules, including those concerning software, updates, digital services and AI systems. | |
| ProductsEU | Machinery Regulation, Regulation (EU) 2023/1230 | New requirements for machinery, including certain solutions using machine learning, autonomous functions and digital components. |
Monitoring scope
Areas monitored
ORAI monitors regulatory developments and implementation practice in areas directly relevant to organisations using AI and digital technologies.
- the AI Act and national legislation concerning AI systems;
- AI classification, high-risk AI and transparency obligations;
- AI governance, AI literacy, documentation and human oversight;
- AI in HR, recruitment and workforce management;
- NIS2/KSC, the CRA and cybersecurity of AI and digital products;
- the Data Act, DGA and rules concerning access to data;
- AI vendors, cloud, SaaS and technology supply chains;
- liability for software, AI systems and digital products;
- sector-specific AI regulation, particularly machinery, healthcare, finance and critical infrastructure;
- regulatory guidance and technical standards.
Application
How to use the tracker
The tracker does not replace individual legal or technical analysis. Its purpose is to identify regulatory checkpoints that may require action by an organisation, including mapping AI systems, classifying risk, updating documentation, reviewing vendors, implementing procedures, providing training or changing the governance model.