Published on · Last updated
Upcoming EU product regulations will change what a manufacturer or exporter outside the EU must arrange before its goods reach Dutch customers, warehouses or the port of Rotterdam. This EU product regulation timeline lists the confirmed dates from 2026 to 2028, the rule behind each date and who it affects, so you can check your products and contracts with a lawyer in the Netherlands in time.
The timeline is part of our overview of EU product law in the Netherlands. It does not explain each regulation; for that, each rule links to an in-depth article. Two facts decide which dates matter to you: your role in the supply chain (manufacturer, importer, distributor or authorised representative) and the moment each individual product is placed on the market.
What already applies before the 2026–2028 dates?
Several EU product rules already apply. Some get no new date in this period: the General Product Safety Regulation (GPSR) applies since 13 December 2024, the Market Surveillance Regulation since 16 July 2021 and the Conflict Minerals Regulation since 1 January 2021.
- Conflict Minerals Regulation (EU) 2017/821: since 1 January 2021
- Market Surveillance Regulation (EU) 2019/1020: since 16 July 2021
- Digital Services Act (EU) 2022/2065: since 17 February 2024
- Batteries Regulation (EU) 2023/1542, general application: since 18 February 2024
- GPSR (EU) 2023/988: since 13 December 2024
- Data Act (EU) 2023/2854, general application: since 12 September 2025
- CBAM (EU) 2023/956, definitive period: since 1 January 2026
These rules are the baseline for every product that enters the EU through the Netherlands. The route itself is covered in placing products on the EU market; for tin, tantalum, tungsten and gold, see the EU Conflict Minerals Regulation.
Which EU product rules apply in 2026?
Most 2026 dates have already passed. The AI Act applies generally since 2 August 2026, the CRA reporting obligation since 11 September 2026, and three dates remain this year: 2 December (AI Act), 9 December (product liability) and 30 December 2026 (EUDR).
| Date | Rule | What applies | For whom |
|---|---|---|---|
| 19 July 2026 | ESPR (EU) 2024/1781 | Ban on destroying unsold clothing and footwear; deadline for the Commission to set up the digital product passport register | Large enterprises (clothing, footwear) |
| 2 August 2026 | AI Act (EU) 2024/1689 | General application, including Article 50 (transparency) | Providers and deployers |
| 12 August 2026 | PPWR (EU) 2025/40 | Regulation applies; one provision only from 12 February 2029 | Producers, importers, distributors of packaging |
| 15 August 2026 | NIS2, Dutch Cyberbeveiligingswet and Cyberbeveiligingsbesluit | In force | Essential and important entities; suppliers that are not entities themselves: through their contracts |
| 11 September 2026 | Cyber Resilience Act (EU) 2024/2847 | Reporting of actively exploited vulnerabilities and severe incidents, also for products placed on the market earlier | Manufacturers of products with digital elements |
| 12 September 2026 | Data Act (EU) 2023/2854 | Design obligation of Article 3(1) for products placed on the market after 12 September 2026 | Manufacturers of connected products |
| 10 November 2026 | Dutch bill 36 906 (implementing Directive 2024/2853) | Adopted by the Senate; entry into force by royal decree | Manufacturers, importers |
| 2 December 2026 | AI Act | New prohibitions in Article 5; Article 50(2) for existing generative AI systems | Providers |
| 9 December 2026 | Product Liability Directive 2024/2853 | Applies to products placed on the market or put into service from 9 December 2026 | Manufacturers, importers, authorised representatives, fulfilment service providers |
| 30 December 2026 | EUDR (EU) 2023/1115 | Main obligations apply | Operators and traders in coffee, cocoa, wood, rubber, soy, palm oil, cattle |
For AI features in your product, see Article 50 of the EU AI Act. Connected products are covered in the EU Data Act article, and the new liability regime in the EU Product Liability Directive.
The Dutch implementation of the Product Liability Directive (bill 36 906) was adopted by the Senate (Eerste Kamer) on 10 November 2026; entry into force is by royal decree and has not yet been published. The EU date of 9 December 2026 in the Directive itself does not change.
Important: The CRA reporting obligation applies since 11 September 2026, also to products with digital elements that were already on the market before that date. If a vulnerability in a device sold years ago is actively exploited, Article 14 now requires the manufacturer to report it. Have a Dutch product law lawyer review who reports what, and how, before you answer your Dutch importer’s question about it.
Look first at what already applies: the CRA reporting obligation since 11 September 2026 and the GPSR since 13 December 2024. Then look at your contracts. A supply agreement you sign now will often still be running when the Machinery Regulation or the CRA applies in full.
Which EU product rules start to apply in 2027?
2027 has the most dates. The Machinery Regulation applies from 20 January 2027, the battery passport from 18 February 2027, the CRA in full from 11 December 2027 and the forced labour ban from 14 December 2027.
| Date | Rule | What applies | For whom |
|---|---|---|---|
| 1 January 2027 | CBAM | Quarterly duty: certificates for at least 50 % of embedded emissions | Authorised CBAM declarants |
| 20 January 2027 | Machinery Regulation (EU) 2023/1230 | General application; Machinery Directive 2006/42/EC repealed; Dutch Warenwetbesluit machines 2026 in force | Manufacturers, importers, distributors of machinery |
| 1 February 2027 | CBAM | Sale of CBAM certificates on the central platform | Declarants |
| 18 February 2027 | Batteries Regulation | Battery passport for LMT, industrial above 2 kWh and EV batteries; QR code on all batteries | Manufacturers and economic operators |
| 2 March 2027 | ESPR | Format for disclosure of unsold products applies | Large enterprises |
| 30 June 2027 | EUDR | Same obligations for operators that were established as micro or small enterprises on 31 December 2024; not for products covered by the Annex to Regulation (EU) No 995/2010 | Micro and small enterprises |
| 2 August 2027 | AI Act | Existing general-purpose AI models | Providers of GPAI models |
| 18 August 2027 | Batteries Regulation | Due diligence obligation, Article 48(1) | Economic operators |
| 12 September 2027 | Data Act | Chapter IV on unfair terms also for certain older contracts | Parties to data contracts |
| 21 September 2027 | Union Customs Code (EU) 2026/2108 | Applies, with exceptions | Importers, declarants |
| 30 September 2027 | CBAM | First annual declaration and surrender of certificates for 2026 | Declarants |
| 2 December 2027 | AI Act | High-risk systems in Annex III | Providers, deployers |
| 11 December 2027 | Cyber Resilience Act | Full application: essential requirements, CE marking, conformity assessment | Manufacturers, importers, distributors |
| 14 December 2027 | Forced Labour Regulation (EU) 2024/3015 | Ban on products made with forced labour | Every operator placing, making available or exporting products |
| 30 December 2027 | EUDR | Later application for certain Annex I items | Operators |
For machinery, the practical work sits in conformity assessment and notified bodies. Products with software or a network connection are covered in the Cyber Resilience Act article, batteries in the battery passport under the EU Batteries Regulation, and supply chain rules in the EU Forced Labour Regulation. EUDR and CBAM are part of the EU sustainability rules for products.
Important: The forced labour ban only applies from 14 December 2027, but according to the Commission’s guidelines it also covers stock. Goods produced and shipped to a Dutch warehouse in 2027 can still be caught after that date. Before you commit to deliveries that run past December 2027, have a Dutch product law lawyer review your supplier contracts and stock planning.
Planning your 2027 launches and contracts? Put your products and dates to me through our product law team in the Netherlands.
What changes in 2028 and after?
In 2028 further CRA and AI Act phases follow, together with the second stage of the new customs code on 1 July 2028. After 2028 only a few dates are fixed, mostly for packaging, timber and medium-sized enterprises.
| Date | Rule | What applies | For whom |
|---|---|---|---|
| 11 June 2028 | Cyber Resilience Act | Existing EU-type examination certificates under other Union harmonisation legislation remain valid for CRA requirements up to and including this date | Manufacturers |
| 1 July 2028 | Union Customs Code | EU Customs Data Hub and e-commerce rules | Importers, platforms |
| 2 August 2028 | AI Act | High-risk systems in Annex I, Section A | Providers |
| 2 August 2028 | Machinery Regulation | Delegated acts on AI requirements in Annex III (not yet adopted) apply from this date | Manufacturers of machinery |
Looking further ahead: one PPWR provision applies from 12 February 2029, the EUDR transition for timber produced before 29 June 2023 ends on 31 December 2029, and from 19 July 2030 the ESPR ban on destroying unsold clothing and footwear and the duty to disclose discarded unsold consumer products also apply to medium-sized enterprises.
Why does the date of placing on the market decide?
Under several rules, the date that counts is when a product is placed on the market, not when the model was designed. For product liability, the date on which each individual unit is placed on the market decides which regime applies.
Three examples from the timeline:
- Product liability. Directive 2024/2853 applies to products placed on the market or put into service from 9 December 2026. Directive 85/374/EEC continues to apply to products placed on the market before that date. For some time, two regimes run side by side, sometimes for the same product line.
- Data Act. The design obligation of Article 3(1) applies to products placed on the market after 12 September 2026. Existing products are not covered.
- Cyber Resilience Act. Products placed on the market before 11 December 2027 only fall under the full CRA if they are substantially modified. The reporting obligation applies to them already.
The date companies most often overlook is the date the individual product is placed on the market. Under the new product liability rules, what counts is not when the model was designed, but whether this particular product is placed on the market from 9 December 2026. I advise clients to make a simple list per product line: what leaves the door before that date, and what after.
Important: If your Dutch importer receives the same model from you in November 2026 and again in mid-December 2026, the two shipments can fall under different liability regimes, because the Directive looks at each product placed on the market from 9 December 2026. Have a Dutch product law lawyer check your liability and indemnity clauses before you agree the delivery schedule for that period.
What is not fixed yet?
Some dates people expect are not fixed. ESPR requirements per product group, later PPWR requirements, an implementing act under the Batteries Regulation and the entry into force of the Dutch product liability act have no confirmed date yet.
- ESPR product groups (for example steel, textiles, tyres, furniture): the Commission’s working plan only gives indicative years; no application date has been set. See the ESPR ecodesign rules.
- PPWR: later requirements, such as labelling, recyclability and recycled content, apply in stages on later dates.
- Batteries Regulation: the implementing act on “legitimate interest” for access to the battery passport has not yet been adopted.
- Dutch implementation of the Product Liability Directive (bill 36 906): entry into force by royal decree, not yet published.
Plan with a date only once the act has been published. Until then, it helps to ask your own suppliers which product data they can provide.
What do these dates mean if you sell into the EU through the Netherlands?
The dates in the EU regulations are the same in every Member State; the NIS2 date in the timeline is the Dutch one. For a manufacturer outside the EU, the practical point of contact in the Netherlands is the Dutch importer or authorised representative, who deals with Dutch regulators and customers.
That party will ask you for documentation, information and contractual guarantees before each date in the timeline, because it is the party a Dutch regulator or customer can address directly. For product liability, the Dutch implementation is adopted but not yet in force, so your Dutch counterparty may ask questions before the final rules are clear.
Yes, a supplier outside the EU should look at Dutch dates too. The EU date is the same, but your Dutch importer or authorised representative is in the firing line, and it will put that back on you in the contract.
Example: an e-bike exporter selling through a Dutch importer
Suppose a manufacturer outside the EU sells e-bikes with a battery and a companion app to a Dutch importer, which supplies retailers in the Netherlands and other Member States. The exporter plans a new model for 2027.
Several dates from the timeline can meet in this one product. If the e-bike and its app qualify as a product with digital elements, the CRA reporting obligation applies since 11 September 2026, also to the models already sold, and the full CRA from 11 December 2027. If the e-bike is a connected product placed on the market after 12 September 2026, the Data Act design obligation applies. Every unit placed on the market from 9 December 2026 falls under the new product liability regime. And if the battery falls within the categories of the battery passport, that passport is required from 18 February 2027.
The Dutch importer is a party customers and regulators in the Netherlands can address directly. It will want to know, per model and per shipment, which of these dates apply, and it will try to cover that in its contract with the exporter.
When do you need a lawyer in the Netherlands?
As soon as a Dutch importer, customer or regulator asks for declarations, guarantees or documentation linked to one of these dates, or when you are unsure about your role in the supply chain. A short review then costs less than a correction afterwards.
Typical moments are a first sale into the EU, a new supply or distribution agreement with a Dutch counterparty, a model launch close to one of the dates above, and a question from an authority about an older product, for example under the CRA reporting obligation.
How does MAAK Advocaten work with exporters on these dates?
We start from your product and your role in the chain. For many companies half of the rules then drop out, and two or three dates remain that really count. We then review the contracts with your Dutch importer or authorised representative against those dates.
Where a Dutch regulator or customer raises questions, we prepare the answer with you and deal with the Dutch side. You keep the overview of your own business; we check the dates and the Dutch implementation that matter for your products.
Frequently asked questions about upcoming EU product regulations
Which EU product rules start to apply in 2027?
The main ones are the Machinery Regulation (20 January 2027), the battery passport (18 February 2027), the AI Act rules for high-risk systems in Annex III (2 December 2027), the full Cyber Resilience Act (11 December 2027) and the forced labour ban (14 December 2027). CBAM, EUDR, the Data Act and the new customs code also have dates in 2027.
When does the new EU product liability regime apply?
Directive 2024/2853 applies to products placed on the market or put into service from 9 December 2026. Products placed on the market before that date remain under Directive 85/374/EEC. In the Netherlands, bill 36 906 was adopted by the Senate on 10 November 2026; entry into force is by royal decree.
Does the Cyber Resilience Act already apply?
Partly. The reporting obligation for actively exploited vulnerabilities and severe incidents applies since 11 September 2026, also to products placed on the market earlier. The rest of the Regulation, including the essential requirements and CE marking, applies from 11 December 2027.
What is not fixed yet?
ESPR requirements per product group, later PPWR requirements, the implementing act on legitimate interest under the Batteries Regulation and the entry into force of the Dutch product liability act. None of these has a confirmed date.
When should a manufacturer outside the EU involve a lawyer in the Netherlands?
When a Dutch importer, customer or regulator asks for declarations, guarantees or documentation linked to one of these dates, or when your role in the supply chain is unclear. At MAAK Advocaten in Amsterdam we review your role, your dates and your contracts with Dutch counterparties.
Primary sources
- Regulation (EU) 2024/2847 (Cyber Resilience Act): Articles 14, 69 and 71
- Regulation (EU) 2023/1230 (Machinery Regulation): Articles 8, 51 and 54
- Directive (EU) 2024/2853 (product liability): Articles 2(1), 21 and 22(1)
- Dutch bill 36 906 (implementation of Directive 2024/2853)
- Regulation (EU) 2024/1689 (AI Act): Articles 111 and 113
- Regulation (EU) 2023/2854 (Data Act): Article 50
- Regulation (EU) 2023/1542 (Batteries Regulation): Articles 13, 48, 77 and 96
- Regulation (EU) 2024/3015 (Forced Labour Regulation): Article 39
- Regulation (EU) 2024/1781 (ESPR): Articles 13, 24 and 25
- Regulation (EU) 2025/40 (PPWR): Article 71
- Regulation (EU) 2023/1115 (EUDR): Articles 37 and 38
- Regulation (EU) 2023/956 (CBAM): Articles 20, 22 and 36
- Regulation (EU) 2026/2108 (Union Customs Code): Articles 284, 285 and 287
- Directive (EU) 2022/2555 (NIS2)
- Regulation (EU) 2023/988 (GPSR): Article 52
- Regulation (EU) 2019/1020 (market surveillance): Article 44
- Regulation (EU) 2017/821 (conflict minerals): Article 20(3)
Selling into the EU through the Netherlands, and unsure which of these dates apply to your products? Put your situation to me through our product law team in the Netherlands. — Martin Krüger
