Digital transformation in Europe now runs on a regulatory calendar. NIS2, DORA, the AI Act, the Cyber Resilience Act and French e-invoicing each set dates that a company's information systems have to meet, and several of those dates moved in 2026. This guide gives the status of each text on 12 November 2026, what comes next, and how to turn the calendar into a transformation plan rather than a pile of separate compliance projects.
It is written for large companies and mid-sized groups (ETI) established in France and operating in the EU.
Regulation: the texts that matter
Six instruments shape the period: the French B2B e-invoicing reform (ordonnance n° 2021-1190 of 15 September 2021), the NIS2 directive on cybersecurity (Directive (EU) 2022/2555), the DORA regulation on digital operational resilience in finance (Regulation (EU) 2022/2554), the AI Act (Regulation (EU) 2024/1689, amended by Regulation (EU) 2026/1744), the Cyber Resilience Act on products with digital elements (Regulation (EU) 2024/2847) and the Data Act (Regulation (EU) 2023/2854). The end of Windows 10 support is not a regulation, but it feeds directly into the security obligations of the others.
Synthetic table of regulatory deadlines
| Text | Status on 12 November 2026 | Next date | Maximum fine |
|---|---|---|---|
| E-invoicing, France | In force since 1 September 2026: all VAT-registered companies established in France must be able to receive e-invoices through an approved platform; large companies and ETIs must also issue them. | 1 September 2027: SMEs and micro-enterprises must issue e-invoices. | Per-invoice penalties under French tax law (see DGFiP). |
| NIS2 | Transposition deadline was 17 October 2024. In France, the bill transposing it (loi Résilience) passed the Senate in March 2025 and was being debated in the Assemblée nationale in the week of 9 November 2026. Not yet adopted; this line will be updated once the law is promulgated. | Final adoption, promulgation, implementing decrees. | Directive ceilings: €10M or 2% of worldwide turnover (essential entities), €7M or 1.4% (important entities). |
| DORA | Applies since 17 January 2025 to financial entities and their ICT providers. | Ongoing supervision. | Set by national law and supervisors. |
| AI Act | Prohibited practices and AI literacy since 2 February 2025; general-purpose AI models since 2 August 2025; transparency duties (Article 50) since 2 August 2026. | High-risk systems: 2 December 2027 (Annex III) and 2 August 2028 (Annex I), after Regulation (EU) 2026/1744. | €35M or 7% for prohibited practices; €15M or 3% for most other obligations. |
| Cyber Resilience Act | Reporting of actively exploited vulnerabilities and severe incidents since 11 September 2026. | All requirements, including CE marking: 11 December 2027. | €15M or 2.5% of worldwide turnover. |
| Data Act | Applies since 12 September 2025. | Further obligations phased in. | Set by national law. |
| Windows 10 (not a regulation) | Microsoft support ended on 14 October 2025. | None. | Indirect: unsupported systems weaken compliance with NIS2 and GDPR security duties. |
Two changes since this guide was first published deserve attention. The AI Act's high-risk obligations, originally due on 2 August 2026, were postponed by the Digital Omnibus on AI, in force since 27 July 2026. And France's NIS2 transposition is still pending, more than two years after the deadline: the European Commission referred France to the Court of Justice of the EU over the delay on 8 July 2026.
Compliance roadmap: strategic action plan
| Period | Key actions | Deliverables |
|---|---|---|
| Now to early 2027 | Check e-invoicing reception and, for large companies and ETIs, issuance; map AI systems against the AI Act categories; set up CRA vulnerability reporting if you make products with digital elements. | Approved platform in production; AI inventory; reporting procedure. |
| 2027 | Prepare SMEs in your supply chain for e-invoicing issuance; apply NIS2 requirements as soon as French law and decrees are published; complete high-risk AI documentation. | Supplier readiness plan; NIS2 risk framework; technical files for high-risk AI. |
| Late 2027 to 2028 | Bring products to CRA compliance; meet AI Act high-risk obligations; consolidate governance across texts. | CE-marked products; single compliance governance. |
Each text has its own detail: see the e-invoicing compliance checklist, the analysis of DORA operational compliance, and how three EU regulations converge on invoicing.
Digital transformation: strategic imperative and methodological approach
Treated one by one, these texts produce five compliance projects with five steering committees, often touching the same systems and the same people. Treated together, they become a transformation agenda: one inventory of systems and data, one risk framework, one governance.
The obstacle is rarely technical. It is the number of teams asked to change their way of working at the same time, often while the rules are still moving. That is where a human-centric method earns its place. The RESONANCE™ framework starts by assessing how much change the organisation can absorb, then sequences the regulatory work so that teams are not hit by every deadline at once.
Regulations set the dates. How many changes your teams can absorb at once sets the real schedule.
Customised support
A first useful step is a map of your exposure: which texts apply to you, which dates bind you, and which teams carry the load. It is also where my digital transformation consulting work begins.
Assess your regulatory readiness
Sources
Sources consulted for this article, list updated in November 2026. Regulatory status changes quickly: check the dates against the official texts before relying on them.
EU texts (EUR-Lex)
France
- Ministère de l'Économie, Tout savoir sur la facturation électronique pour les entreprises
- DGFiP, Je passe à la facturation électronique
- Le Monde Informatique, NIS 2 : la loi Résilience arrive enfin à l'Assemblée, 10 November 2026
- AOCSI, Loi Résilience : où en est la transposition de NIS2 (including the referral to the Court of Justice, 8 July 2026)
