Most of what will consume your 2027 technology budget is already fixed. The dates are set; they're simply not in most people's plans yet. Four significant deadlines land within months of each other in 2027, and — because the work in front of each one runs to quarters rather than weeks — the quarter in which they're really decided is this one.
1. The EU Cyber Resilience Act — 11 December 2027
The most under-appreciated of the four. The CRA applies to products with digital elements placed on the EU market — which is a far wider net than "software companies." If you ship a connected product, an application, or firmware into the EU, from 11 December 2027 you face essential cybersecurity requirements, conformity assessment, CE marking, technical documentation, and vulnerability handling across the supported life of the product. Penalties reach €15 million or 2.5% of worldwide annual turnover.
Two things catch people out. First, the reporting obligations already began on 11 September 2026 — part of this regime is live now. Second, conformity assessment is not a document you write in December 2027; it's a way of building and supporting a product that you have to be doing well before then.
2. The EU AI Act's high-risk obligations — 2 December 2027
The Digital Omnibus moved the high-risk deadline out from August 2026 to 2 December 2027 (and to August 2028 for embedded high-risk systems). As we said when enforcement became real, that's a gift of time rather than a reprieve — and crucially, the transparency duties were never deferred: they've applied since August 2026 and are enforceable today. If anything in your estate touches hiring, credit, biometrics, or another Annex III use, 2027 is your year.
3. Post-quantum: discovery finished by 2028
The NCSC's milestones are discovery and a migration plan by 2028, high-priority migration by 2031, full transition by 2035. The trap is reading 2028 as a start date. It isn't — it's when discovery, assessment, strategy and an initial plan are all expected to be complete. A serious cryptographic discovery exercise across a mid-sized estate takes 12 to 24 months. Do that arithmetic and 2027 is when the work happens, not when it gets scheduled. (We wrote about starting the migration and the "harvest now, decrypt later" logic that makes it urgent well ahead of any quantum computer.)
4. The UK Cyber Security and Resilience Bill — phasing to 2028
The Bill is progressing through the Lords and updates the UK's NIS regime. The headline change for our market: it creates a regulated category for managed service providers, pulling many technology suppliers directly into scope for the first time, with stricter incident notification and higher penalties. It broadly tracks NIS2 but differs in scope, reporting thresholds and fines — so firms operating on both sides of the Channel may end up managing two similar-but-different regimes.
What to actually do this quarter
You don't need a compliance programme in Q4. You need enough clarity to put a credible number in next year's budget:
- Inventory three things — your AI systems, any products with digital elements sold into the EU, and where cryptography lives in your estate. Every one of these regimes begins with a list you probably don't have yet.
- Scope honestly. Most mid-market firms are in scope for fewer of these than they fear, and for more than they assume. Getting that call right early is the difference between a line item and a fire drill.
- Budget the work, not the deadline. The cost is discovery, remediation and evidence — spread across 2027 — not a certificate bought in December.
- Reuse what you have. Zero-trust work, an AI inventory, and SBOM/vulnerability handling serve several of these regimes at once. Treat them as one programme, not four.
The bottom line
Compliance deadlines don't compete for budget in the year they land. They compete in the year you plan for them — and that's now. The organisations that will be calm in 2027 are the ones that spend a couple of weeks this quarter turning four dates into an inventory, a scope, and a number. That translation — regulation into a costed, board-ready plan tied to the P&L — is exactly what our Executive Advisory work does.
Want help turning these dates into a 2027 plan you can defend? Let's talk.