Product compliance deadlines in 2027: AI Act, Cyber Resilience Act and the Machinery Regulation

20 January 2027: the Machinery Regulation

From 20 January 2027, Regulation (EU) 2023/1230 applies to every machine, partly completed machine, lifting accessory, safety component and piece of interchangeable equipment placed on the EU market. It replaces Directive 2006/42/EC in one step, with the same CE mark and a renewed technical file. The regulation brings three things a manufacturer outside the EU feels at once: digital instructions with a paper copy on request, specific requirements for software-driven safety functions and self-evolving behaviour, and the duties of importers and authorised representatives written into the regulation itself.

For your Dutch BV the date works like this. The BV that imports the machine is the importer under the regulation: it checks that the conformity assessment was done, that the EU declaration of conformity and the technical documentation exist, and it puts its own name and address on the machine. When the manufacturer appoints the BV as authorised representative by written mandate, the BV also keeps the documentation and answers the authorities. The detail of the roles, the high-risk list in Annex I and the gap check for unsold stock are on machinery and electronics in Europe.

11 September 2026 and 11 December 2027: the Cyber Resilience Act

The Cyber Resilience Act, Regulation (EU) 2024/2847, covers every product with digital elements that connects to a device or a network: routers, smart home products, industrial controllers, connected machinery, sensors, wearables and the software that comes with them. It applies in two steps. Since 11 September 2026 the manufacturer reports an actively exploited vulnerability or a severe incident through the single reporting platform of ENISA, the EU cybersecurity agency: an early warning within 24 hours, a notification within 72 hours, and a final report within 14 days after a fix is available or within one month after a severe incident. The report goes to the national incident response team (CSIRT) of the country of the main establishment. This duty also covers products that were on the market before that date.

From 11 December 2027 the full requirements apply: security built into the design, a process for handling vulnerabilities, security updates during the support period, technical documentation and CE marking that covers cybersecurity. The manufacturer, also one outside the EU, has these duties itself. An authorised representative is optional under the Act. The importer, the company that places the product on the EU market, checks that the manufacturer did the work and answers the authorities. Your Dutch BV can be that importer. For electronic and radio equipment, Article 4 of Regulation (EU) 2019/1020 requires an economic operator established in the EU in every case.

2 December 2027 and 2 August 2028: the AI Act after the 2026 amendment

Regulation (EU) 2026/1744 of 8 July 2026, in force since 27 July 2026, changed the calendar of the AI Act. High-risk AI systems listed in Annex III of the law, such as recruitment tools, credit scoring, education and biometrics, must comply from 2 December 2027 instead of 2 August 2026. AI built into products that already need CE marking under other EU laws, Annex I, follows on 2 August 2028. Systems already on the market had a transition of four months, until 2 December 2026, for the technical marking of generated content. Every member state has at least one national AI regulatory sandbox by 2 August 2027. The amendment also extended the lighter documentation and quality rules for small and medium-sized enterprises to small mid-caps, and banned AI systems that generate intimate images of people against their will.

The rules for general-purpose AI models have applied since 2 August 2025, and a provider outside the EU has had to appoint an authorised representative since that date. For a high-risk system, the provider outside the EU appoints the representative before the system goes on the EU market. Your Dutch BV can be that representative, or the EU provider of the product itself. What the representative does, the fines, and the duties of importers and distributors are on the AI Act and the EU representative.

Which role your Dutch BV takes, per rule

One Dutch BV can hold all of these roles at once, next to its VAT number, its customs number (EORI) and the Article 23 licence for import VAT. Which representative each product group needs, with the dates, is on EU representative requirements.

What to do before each date, in order

1. Now, for connected products. Check that your reporting process works: who in your company becomes aware of an exploited vulnerability, who files the early warning within 24 hours, and under which CSIRT your main establishment falls. The platform has been open since 11 September 2026.
2. Before 20 January 2027, for machinery. Order the gap check of the technical file against Regulation (EU) 2023/1230 for every model that ships after that date, including unsold stock. Decide whether your Dutch BV is the importer, the authorised representative, or both.
3. Before 2 December 2027, for high-risk AI. Classify your system against Annex III. If it is high-risk, appoint the authorised representative, finish the technical documentation and plan the registration in the EU database. For AI inside a CE-marked product, the date is 2 August 2028.
4. Before 11 December 2027, for connected products. Plan the conformity assessment under the Cyber Resilience Act and the update of the CE file, so that products placed on the market from that date meet the cybersecurity requirements.
5. For every product. Put the name and address of the EU operator on the product or its packaging, in the format each law prescribes, and keep the documentation for the period each law sets.

These three laws are part of a longer calendar. Consumer products have needed a responsible operator in the EU since 13 December 2024 under the product safety rules; packaging has needed a registration per country of sale since 12 August 2026; the battery passport starts on 18 February 2027; and from 14 December 2027 products made with forced labour are banned from the EU market. Those dates are on battery passport, packaging and the forced labour ban and on consumer products in the EU. The customs and CBAM dates of 2027 are on EU import rules 2027.

Questions founders ask

Sources

• Regulation (EU) 2023/1230 on machinery: eur-lex.europa.eu
• Regulation (EU) 2024/2847, the Cyber Resilience Act: eur-lex.europa.eu; European Commission, CRA reporting obligations: digital-strategy.ec.europa.eu
• Regulation (EU) 2026/1744 of 8 July 2026 amending the AI Act (Digital Omnibus on AI): eur-lex.europa.eu; Council of the EU, Artificial intelligence: Council and Parliament agree to simplify and streamline rules (7 May 2026): consilium.europa.eu