Between November 20, 2026 and January 1, 2027 five sets of rules take effect or move to a new stage for online merchants in the EU: the Consumer Credit Directive, the AI Act's transition period, the new product liability regime, the Deforestation Regulation and, in Germany, mandatory e-invoicing. 2027 brings the battery passport, the customs reform and the Cyber Resilience Act. Anyone trying to keep that as a list in their head will lose track.
Hence this calendar: every deadline that affects a Shopware store, in chronological order from November 2026 to 2030, with the question "who does it hit and what has to happen in the store?" – and with a primary source. We checked every date on November 7, 2026 against the legal text, the EU Official Journal or the competent authority, because quite a few have shifted from the original texts. Where we only had secondary sources, it says so. German transposition acts are named where the directive leaves room; the EU regulations apply the same way in every member state.
The next four deadlines
- November 20, 2026 – Consumer Credit Directive: your own invoice payment stays exempt if you defer yourself, interest-free and with at most 50 days to pay; third-party installment and "pay later" offers now fall under consumer credit law even below €200.
- December 2, 2026 – AI Act: the transition period for machine-readable marking by providers of older AI systems ends. Your deployer duties – chatbot disclosure, visible labelling – have applied unchanged since August 2, 2026.
- December 9, 2026 – product liability: software is a product, fulfilment service providers are liable, and every distributor is liable who doesn't name its supplier within one month of being asked.
- December 30, 2026 – EUDR: due diligence for wood, coffee, cocoa, soy, palm oil, cattle and rubber; downstream traders need their suppliers' reference numbers. Books have been removed from the annex.
As with every legal topic here: we're software engineers, not lawyers. The calendar is a working basis for you and your legal counsel, not legal advice.
The calendar: November 2026 to 2030
| Date | Rules | Who it hits | What to do in the store | Fines / status |
|---|---|---|---|---|
| Nov 20, 2026 | Consumer Credit Directive (EU) 2023/2225, German act BGBl. 2026 I No. 139 | B2C stores with invoice or installment payment | Own invoice payment only up to 50 days, interest-free, no third party; checkout ads with “0 %” need standard information | civil law; in force |
| Dec 2, 2026 | AI Act, Art. 111(4) (Digital Omnibus) | Providers of older generative AI systems | End of the transition for machine-readable marking; deployer duties apply since Aug 2, 2026 | up to €15 million or 3 %; in force |
| Dec 9, 2026 | Product Liability Directive (EU) 2024/2853, German act BGBl. 2026 I No. 321 | Manufacturers, importers, fulfilment providers, distributors, marketplaces | Keep supplier data per item (one-month deadline); software counts as a product | civil liability, no fine; published |
| Dec 30, 2026 | EUDR (EU) 2023/1115 as amended by 2025/2650 | Large and medium traders of wood, coffee, cocoa, soy, palm oil, cattle, rubber | Record suppliers’ reference numbers; books are removed | at least 4 % of EU turnover; in force |
| Jan 1, 2027 | German e-invoicing, Section 27(38) VAT Act | B2B issuers with prior-year turnover above €800,000 | Issue XRechnung or ZUGFeRD, no PDF | no fine, risk to input tax deduction; confirmed |
| Jan 12, 2027 | Data Act (EU) 2023/2854, Art. 29 | Cloud and hosting providers | Switching charges disappear – relevant to the hosting contract | in force |
| Feb 18, 2027 | Battery Regulation (EU) 2023/1542, Art. 13 and 77 | Manufacturers and importers; distributors indirectly | QR code on all batteries; battery passport for e-bike, industrial and EV batteries | national; date fixed, implementing act delayed |
| Jun 30, 2027 | EUDR | Micro and small enterprises | as Dec 30, 2026, except timber under the old Timber Regulation | 4 %; in force |
| Aug 18, 2027 | Battery Regulation, Art. 48 | Companies with €40 million turnover or more | Supply chain due diligence for raw materials | postponed from 2025 |
| Sep 21, 2027 | Union Customs Code (EU) 2026/2108 | Importers, distance sellers, platforms | Main part of the customs reform applies; e-commerce rules from Jul 1, 2028 | published Sep 19, 2026 |
| Oct 31 / Dec 31, 2027 | German Packaging Implementation Act, ZSVR approval | Producer responsibility organisations / producers without system participation duty | Apply for approval of own take-back and transport packaging | Section 66 VerpackDG; in force |
| Dec 2, 2027 | AI Act, high-risk under Annex III | Deployers of standalone high-risk AI | AI credit checks in checkout: deployer duties under Art. 26 | €15 million or 3 %; postponed from Aug 2, 2026 |
| Dec 11, 2027 | Cyber Resilience Act (EU) 2024/2847 | Manufacturers of software and IoT goods, plugin vendors included; distributors | CE, declaration of conformity, vulnerability handling, five years of updates; distributors check CE | €15 million / 2.5 % or €10 million / 2 %; in force |
| Dec 30, 2027 | EUDR, new products in Annex I | Traders of the newly added products | Check the range against the updated Annex I | 4 %; adopted |
| Jan 1, 2028 | German e-invoicing, Section 27(38) nos. 2 and 3 VAT Act | All businesses | E-invoices for all B2B invoices, end of the EDI exception | confirmed |
| Jul 1, 2028 | Customs: Regulation (EU) 2026/382 and Customs Code Art. 287 | Third-country distance sellers, platforms, importers | End of the €3 flat duty; launch of the EU customs data platform, platforms become “deemed importers” | published |
| Aug 2, 2028 | AI Act, high-risk under Annex I | Manufacturers of regulated products with AI | Relevant to stores only as distributors of such products | postponed from Aug 2, 2027 |
| Aug 12, 2028 | PPWR (EU) 2025/40, Art. 12 | Everyone placing packaging on the market – printed own-brand boxes included | Harmonised material label; or 24 months after the implementing acts | up to €200,000 in Germany; date subject to change |
| Sep 27, 2028 | Section 15b German UWG expires | Merchants with legacy stock bearing old environmental claims | Sell off or relabel remaining stock with “climate neutral” claims | unfair-competition claims, no fine |
| Jan 1, 2030 | PPWR, Art. 6, 24 and 29 | Shippers, online merchants | Empty space at most 50 %, recyclability grades A to C, 40 % reuse for transport packaging | up to €200,000 in Germany; or three years after the implementing act |
| Jun 27, 2030 | German BFSG, Section 38(1) (EAA Art. 32) | Service providers with old products and old contracts | Old contracts only – the store itself has had to be accessible since Jun 28, 2025 | up to €100,000 in Germany; in force |
Every date checked on November 7, 2026 against the primary source (EUR-Lex, German law databases, authority pages); details and sources are in the sections below. PPWR dates for labelling and empty space depend on implementing acts and may slip.
What already applies since 2024 – and is often still unfinished
The calendar starts with November 2026. Ten obligations are already in force and still being worked through in many stores:
| Since | Rules | Short status |
|---|---|---|
| Dec 13, 2024 | General Product Safety Regulation (EU) 2023/988 | Manufacturer name with postal and email address, responsible person for non-EU manufacturers, product image and type, warnings in the local language – in the listing, not in a PDF. Enforcement is mostly via warning letters |
| Jun 28, 2025 | European Accessibility Act (Germany: BFSG) | B2C stores accessible without grace period, microenterprises exempt – checklist for Shopware |
| Aug 18, 2025 | Battery Regulation, Chapter VIII | Registration, take-back duty also in distance selling |
| Jul 1, 2026 | End of the €150 customs exemption, €3 flat duty per item until Jul 1, 2028 | Consignments up to €150 to EU consumers |
| Jul 19, 2026 | Ecodesign Regulation: ban on destroying unsold clothing, accessories and footwear | Large companies; medium-sized from 2030; records for five years |
| Jul 23 / 31, 2026 | Right to repair, German act BGBl. 2026 I No. 212 | Choice notice and twelve months' extension for contracts from Jul 31, 2026 – the law in detail |
| Aug 2, 2026 | AI Act, Art. 50 transparency | Chatbot disclosure and visible labelling – labelling obligation for stores |
| Aug 12, 2026 | PPWR and German Packaging Implementation Act | Packaging register stays; authorised representative for foreign direct shippers to Germany |
| Sep 11, 2026 | Cyber Resilience Act, Art. 14 reporting duties | 24-hour early warning, 72-hour notification via the ENISA platform |
| Sep 27, 2026 | EmpCo: unfair-competition amendments and information duties | Harmonised warranty notice, guarantee label, update period, repairability – duties on the product page |
The deadlines one by one
November 20, 2026: Consumer Credit Directive
Directive (EU) 2023/2225 applies from November 20, 2026; Germany transposed it with the act of May 12, 2026 (BGBl. 2026 I No. 139). The point for stores sits in the exemption for deferred payment: it survives only if you defer, interest-free, with no charges beyond limited late fees, full payment within 50 days and no third party involved. Large online providers get only 14 days. Anything with a payment service provider – invoice payment via Klarna, PayPal or Ratepay, installments, "pay later" – is consumer credit, and the old €200 minimum is gone. The duties then sit with the lender, but your checkout advertising with "0 %" or "buy now, pay later" needs the standard information.
December 2, 2026: AI Act, end of the transition
The Digital Omnibus (Regulation (EU) 2026/1744, in force since July 27, 2026) postponed the high-risk duties – Annex III to December 2, 2027, Annex I to August 2, 2028 – but not the transparency duties under Art. 50. Those apply since August 2, 2026. The only relief: providers of generative systems on the market before August 2 have until December 2, 2026 for machine-readable marking of their output (new Art. 111(4)). That's a provider duty. Your deployer duties – chatbot disclosure, visible labelling of realistic AI images – don't change. Which generators already mark their images machine-readably and what a store can read from that is in our article on C2PA and IPTC metadata; the Shopware implementation is our plugin EU AI Act Compliance.
December 9, 2026: new product liability regime
Product Liability Directive (EU) 2024/2853 applies to products placed on the market from December 9, 2026; the German Bundestag passed the new Product Liability Act on October 8, 2026, published October 27 (BGBl. 2026 I No. 321). Three changes hit stores directly. First: software is a product – so are Shopware plugins, apps and agency software, with liability for missing security updates. Second: fulfilment service providers are liable when no importer or authorised representative in the EU can be reached. Third: every distributor is liable who, when asked by an injured party, doesn't name an economic operator in the EU or its supplier within one month. In practice: keep supplier and manufacturer data per item so you can deliver it within four weeks. The €500 deductible and the €85 million liability cap are gone. There are no fines – it's strict liability.
December 30, 2026 and June 30, 2027: Deforestation Regulation
After two postponements the EUDR applies from December 30, 2026 to large and medium-sized companies and from June 30, 2027 to micro and small enterprises. The amending Regulation (EU) 2025/2650 also simplified things: only the first party placing goods on the market files the due diligence statement; downstream traders receive the reference numbers and – only the first downstream one – have to record them. Books, newspapers and prints were struck from Annex I. A delegated act of September 17, 2026 adds new products that apply from December 30, 2027. Fines: at least 4 % of EU annual turnover.
January 1, 2027: issuing e-invoices in Germany
Section 27(38) of the German VAT Act is unchanged: anyone with more than €800,000 turnover in 2026 must issue structured e-invoices for domestic B2B sales from January 1, 2027 – XRechnung or ZUGFeRD, not a PDF. From January 1, 2028 it applies to everyone, and the EDI exception ends. The Ministry of Finance confirmed the timetable with its third circular of October 15, 2026. For Shopware that means: identify B2B customers in checkout (VAT ID), set up the document generator or a plugin for e-invoices. There is no dedicated fine; the pressure comes via the recipient's input tax deduction. Other member states run their own e-invoicing timetables.
February 18, 2027: battery passport and QR code
From February 18, 2027 every battery carries a QR code (Art. 13(6) Battery Regulation), and LMT batteries in e-bikes and e-scooters, industrial batteries above 2 kWh and EV batteries get the battery passport (Art. 77). The date stands; what's late is the implementing act on access rights, whose deadline passed on August 18, 2026 – the Commission announced it for the fourth quarter of 2026. For the store: product data and images with QR code, passport link in listings, take-back notices stay.
September 21, 2027 and July 1, 2028: customs reform
Regulation (EU) 2026/2108 of September 16, 2026 creates the new Union Customs Code and the EU Customs Authority. The main part applies from September 21, 2027; the distance-selling rules and the EU customs data platform for e-commerce follow on July 1, 2028 – the same day the €3 per item flat duty expires that has applied since the €150 exemption ended on July 1, 2026. After that, platforms and distance sellers become "deemed importers" with regular duty rates. An additional handling fee per distance-selling consignment has been decided; amount and start are set only by delegated act.
December 2, 2027: high-risk AI under Annex III
For most stores the high-risk part of the AI Act is far away – with one exception: AI-based creditworthiness assessment of consumers is in Annex III no. 5 b. If your checkout uses a payment provider that decides on invoice payment with AI support, you are a deployer under Art. 26 – with duties from December 2, 2027, no longer from August 2026. The provider duties sit with the service provider.
December 11, 2027: Cyber Resilience Act in full
The CRA hits stores from two sides. As a manufacturer counts anyone providing products with digital elements for payment – commercial Shopware plugins, themes, apps, IoT goods. From December 11, 2027: security by design, vulnerability handling, a software bill of materials, CE marking with declaration of conformity and security updates for at least five years. As a distributor of hardware or software you then have to check CE marking and manufacturer details (Art. 20). The reporting duties for actively exploited vulnerabilities already apply since September 11, 2026 – 24-hour early warning, 72-hour notification, final report after 14 days via the ENISA platform. Fines up to €15 million or 2.5 % for manufacturers, €10 million or 2 % for distributors.
August 12, 2028 and January 1, 2030: Packaging Regulation
The PPWR applies since August 12, 2026; its stages come later. From August 12, 2028 – or 24 months after the implementing acts, whichever is later – every package needs the harmonised material label; with printed own-brand boxes you are the packaging producer yourself. From January 1, 2030: at most 50 % empty space in e-commerce packaging, recyclability grades A to C and a 40 % reuse quota for transport packaging including shipping. In Germany fines under Section 66 VerpackDG reach €200,000.
September 27, 2028: end of the EmpCo legacy-stock rule
Section 15b of the German Unfair Competition Act, inserted on October 22, 2026, requires a proportionality test for injunction claims concerning goods placed on the market before September 27, 2026 with old environmental claims or labels – not a sell-off period, but a buffer. It expires on September 27, 2028. By then, remaining stock with "climate neutral" or generic "eco-friendly" claims has to be sold or relabelled. Websites and stores were never covered by it.
Announced, but still without a date
- Digital Product Passport: as of November 7, 2026 there was no delegated act requiring a product passport. The first binding passport is the battery passport on February 18, 2027; textiles are expected in 2028 at the earliest.
- Digital Fairness Act: the Commission proposal against dark patterns and subscription traps was in the work programme for the fourth quarter of 2026 and hadn't been published by early November. Probably not binding before 2029.
- Digital Omnibus on GDPR and cookies: the Council adopted its negotiating mandate on October 21, 2026, Parliament has no position – not applicable law.
What has shifted from the original texts
| Rules | Originally | Now |
|---|---|---|
| AI Act, high-risk Annex III | Aug 2, 2026 | Dec 2, 2027 |
| AI Act, high-risk Annex I | Aug 2, 2027 | Aug 2, 2028 |
| AI Act, Art. 50(2) for legacy systems | Aug 2, 2026 | Dec 2, 2026 |
| EUDR | Dec 30, 2024, then Dec 30, 2025 | Dec 30, 2026 / Jun 30, 2027 |
| Battery Regulation, due diligence | Aug 18, 2025 | Aug 18, 2027 |
| Battery Regulation, implementing act on passport access | Aug 18, 2026 | open, announced for Q4 2026 |
| €150 customs exemption | with the customs reform | brought forward to Jul 1, 2026, flat duty until Jul 1, 2028 |
| Textile labelling, revision | proposal Q2 2026 | not tabled |
| Digital Fairness Act | proposal Q4 2026 | not tabled |
Unchanged are consumer credit (Nov 20, 2026), product liability (Dec 9, 2026), German e-invoicing (Jan 1, 2027 and Jan 1, 2028), the battery passport (Feb 18, 2027), the CRA (Sep 11, 2026 and Dec 11, 2027) and the PPWR stages – though the PPWR dates for labelling and empty space are tied to implementing acts and may still slip.
Three sets of duties, three plugins
Three of the duties in this calendar we've turned into Shopware plugins, because theme tweaks and spreadsheets don't model them cleanly over time:
- AI Act, Art. 50: EU AI Act Compliance implements the transparency badge, chatbot disclosure, aggregate disclosure and the evidence via an AI register – fully local, for Shopware 6.6 and 6.7, available in the store.
- Right to repair and EmpCo: Right to Repair & EmpCo guides claims through the remedy process with a timestamped choice notice, calculates the twelve-month extension and shows repairability on the product page – for Shopware 6.7, currently on request. Which gap it fills in the store is shown in our comparison of returns plugins.
- Accessibility, criterion 1.1.1: Alt-Text Optimizer Pro generates alt text for thousands of product images through your own OpenAI key – the most visible building block of accessibility, compared with the alternatives in our alt text generator comparison.
For the remaining duties – supplier data for product liability, EUDR reference numbers in the product master, e-invoicing, QR codes for batteries – custom adjustments are usually cheaper than another subscription. How we build Shopware plugins and what such a development costs is on our pages.
Quarterly routine: keeping the calendar current
A calendar is only as good as its upkeep. Four steps per quarter that take us an hour:
- Check the dates: read every deadline of the next six months once more at the primary source – EUR-Lex, the national law database or the authority's page. Postponements show up there first, not in newsletters.
- Match against your business: hold range, payment methods, destination countries and turnover thresholds against the "who it hits" column. New product groups (EUDR annex, Annex II of the repair directive) change the answer.
- Check store data: add the fields the next deadline needs to the product master – manufacturer data, reference numbers, QR code links, repairability values.
- Secure the evidence: for every implemented duty, record since when and how – screenshot, export, log. In a dispute what counts isn't that you did it but that you can show it.
Frequently asked questions
Which EU laws change for online merchants in 2027?
Dated 2027: German e-invoicing for issuers above €800,000 turnover (January 1), battery passport and QR code on batteries (February 18), EUDR for micro and small enterprises (June 30), the new Union Customs Code (September 21), high-risk duties of the AI Act under Annex III (December 2) and full application of the Cyber Resilience Act (December 11). Just before, at the end of 2026: the Consumer Credit Directive, the new product liability regime and the EUDR for larger companies.
Has the AI Act been postponed for stores?
Only in part. The Digital Omnibus postponed the high-risk duties to December 2, 2027 (Annex III) and August 2, 2028 (Annex I). The transparency duties under Art. 50 – chatbot disclosure, visible labelling of AI images – apply unchanged since August 2, 2026. The transition until December 2, 2026 concerns only machine-readable marking by providers of older AI systems.
What changes on December 9, 2026 in product liability?
For products placed on the market from that day, the new regime applies: software counts as a product, fulfilment service providers are liable when no EU importer can be reached, and every distributor is liable who doesn’t name its supplier or an EU economic operator within one month of being asked. The €500 deductible and the liability cap are abolished.
When does the EUDR apply to small online stores?
For micro and small enterprises established by December 31, 2024, from June 30, 2027; for everyone else from December 30, 2026. As a downstream trader you don’t file your own due diligence statement but must receive your suppliers’ reference numbers. Books and printed matter were removed from the annex.
Does a German store have to issue e-invoices from 2027?
For domestic B2B sales yes, if turnover in 2026 exceeded €800,000 – from January 1, 2027. From January 1, 2028 the duty applies to all businesses. B2C invoices aren’t affected. A structured e-invoice is XRechnung or ZUGFeRD; a PDF from the store isn’t enough. Other member states have their own e-invoicing timetables.
When is the Digital Product Passport coming?
The first binding product passport is the battery passport from February 18, 2027 for e-bike batteries, industrial batteries above 2 kWh and EV batteries. For other product groups there was no delegated act as of November 2026; a passport for textiles is expected in 2028 at the earliest.
Sources
Primary sources, retrieved November 7, 2026. Secondary sources are marked as such in the text.
- Directive (EU) 2023/2225 (consumer credit) and German BGBl. 2026 I No. 139
- Regulation (EU) 2026/1744 (Digital Omnibus on the AI Act) and Regulation (EU) 2024/1689 (AI Act)
- Directive (EU) 2024/2853 (product liability), German Bundestag: product liability law, October 8, 2026 and BGBl. 2026 I No. 321
- Regulation (EU) 2025/2650 (EUDR amendment) and European Commission: Deforestation Regulation
- Section 27(38) German VAT Act and German Ministry of Finance: e-invoicing FAQ
- Regulation (EU) 2023/1542 (batteries) and Regulation (EU) 2025/1561
- Regulation (EU) 2024/2847 (Cyber Resilience Act) and European Commission: CRA reporting
- Regulation (EU) 2026/2108 (Union Customs Code), Regulation (EU) 2026/382 (customs exemption) and German customs: end of the exemption
- Regulation (EU) 2025/40 (PPWR), Section 66 German VerpackDG and ZSVR: what changed on August 12, 2026
- Section 15b German UWG, Sections 37 and 38 German BFSG, Regulation (EU) 2023/988 (product safety)
- European Commission: ban on destroying unsold clothing
Bottom line
The density of the deadlines is the problem, not their weight. None of the duties in this calendar is unsolvable for a store – but five of them land in six weeks around the turn of the year, and several hinge on data in the product master that nobody maintains today: manufacturer data, reference numbers, QR code links, update periods.
Take the table, cross out what your range and payment methods don't touch, and look at what's left. For the "what to do in the store" column it's worth working out once whether a custom adjustment or a plugin solves the task for good – and that's what we're happy to talk about in a free initial call.