Published on October 17, 2026 · The mitza.es team
Every few weeks a new date shows up: a postponement, an order published in the Official State Gazette (BOE), an end of support. This page gathers the ones that affect SMEs and freelancers in Spain, organized by year, and separates what is already enforceable from what has only been announced. Last reviewed: October 17, 2026. We update it every time a date changes, and each item links to the guide where we explain it in detail.
Already here (2026)
- August 2, 2026, AI Act: transparency (article 50). If your website uses a chatbot or AI-generated content, you have to disclose it. We explain it in what changes for your website and your chatbot.
- September 11, 2026, Cyber Resilience Act: vulnerability reporting. Manufacturers of products with digital elements must report actively exploited vulnerabilities and serious incidents. Details in the CRA guide.
- October 13, 2026, Windows 11 24H2 (Home and Pro) and Office 2021 lose support. Anyone still on those versions stops receiving security updates. What to do, in this guide.
What's left of 2026
- November 2026, Windows 11 23H2 (Enterprise, Education and IoT Enterprise). They stop receiving security updates. It is covered in the same October Patch Tuesday roundup.
- November 27, 2026, Black Friday (Cyber Monday is on the 30th). It's not an obligation, but it is the traffic peak of the year for any online store: a countdown to get ready.
- December 2, 2026, AI Act. The deadline ends for already-marketed generative systems to mark their synthetic content, and the new prohibitions come into force. Full calendar in AI Act postponed: what changes with the Digital Omnibus.
2027
- January 1, 2027, VeriFactu for corporations. This is the legal date currently in force for those who pay Corporate Income Tax (Impuesto sobre Sociedades).
- July 1, 2027, VeriFactu for freelancers and everyone else. Hacienda, Spain's tax ministry, has announced that it plans to postpone it to October 2028, but as of October 17, 2026 that is not approved. The details, in VeriFactu: what applies today.
- October 6, 2027, B2B e-invoicing for companies above €8 million. Official calendar and formats in the e-invoicing guide.
- October 12, 2027, end of the Windows 10 ESU extension for personal computers. If you run a business, review the options with Windows 10.
- December 2, 2027, AI Act: high-risk systems in Annex III. It affects AI used in recruitment, credit, education or border control.
- December 11, 2027, Cyber Resilience Act: full application, including the essential requirements and CE marking of products with digital elements.
2028 and 2029
- August 2, 2028, AI Act: AI embedded in regulated products (Annex I).
- October 6, 2028, B2B e-invoicing for all other companies and freelancers. This is the date that affects most SMEs and freelancers.
- October 2028, VeriFactu (announced, not approved). This is the new date Hacienda plans in order to align it with e-invoicing. Until the amendment is published, the legal dates remain those of 2027.
- October 6, 2029, invoice statuses. Reporting statuses and payments becomes mandatory for freelancers and income-attribution entities with less than €8 million; until then it is voluntary.
- Until 2029, SSL/TLS certificates with ever-shorter validity. The reduction is phased and forces you to automate renewal. We cover it in the SSL certificates guide.
No date or pending approval
- NIS2 (cybersecurity). The Spanish law transposing it has not been published in the BOE; the previous regime remains in force. What it means for your SME, in the NIS2 guide.
- Digital time tracking. The decree has not been approved and there is no date for it to take effect; the obligation to record daily working hours has existed since 2019. Current status in the time tracking guide.
- Kit Digital. As of mid-October 2026 there is no open call. Requirements and amounts in the Kit Digital guide.
- Plan IA360 and Bono IA. Announced on September 21, 2026 with €600 million for about 25,000 companies, with no rules or call yet. More in the Plan IA360 analysis.
Where to start depending on your business
- If you issue invoices, ask your software provider or your accountant now whether they will comply with VeriFactu and the e-invoicing formats, and note which date applies to you based on your volume of operations.
- If your website uses a chatbot, a WhatsApp assistant or AI-generated images and videos, review the AI Act transparency obligations.
- If you sell online, get your store ready before Black Friday, check that your SSL certificate renewal is automatic and keep your plugins up to date.
- If you have computers running Windows 10 or Windows 11 24H2, decide now whether to upgrade them, renew them or replace them.
How we can help
If you're not sure which of these dates affect you, an audit of your website and your tools will make it clear. And if what you need is to keep your computers and updates current, our computer maintenance service and our website maintenance service take care of it.