Regulatory calendar for legal and compliance teams: Switzerland, Germany and the EU

Short answer: The key regulatory deadlines for 2027 for legal and compliance teams in Switzerland, Germany and the EU are the initial filings with the Swiss transparency register (staggered from 31 December 2026 to 31 March 2027), the transposition deadline for the amended CSRD on 19 March 2027, the application of the EU Anti-Money Laundering Regulation (AMLR) from 10 July 2027 and the AI Act's high-risk obligations from 2 December 2027. Before that, Swiss advisers must apply to join a self-regulatory organisation by 1 December 2026, and new AI Act prohibitions apply from 2 December 2026. From 1 January 2027, FINMA Circular 2026/1 on climate risks applies to banks and insurers in supervisory categories 3 to 5.

This calendar is for general counsel, heads of compliance and programme leads in Switzerland and Germany. It brings together every verified deadline from 2025 to 2029 in one table, groups them by regulation and links to our detailed guides. We review the calendar every month; last checked on 30 October 2026.

The next twelve deadlines

From the date of this calendar until early 2028, these twelve deadlines are coming up:

1. 1 Dec 2026 (CH): advisers under Art. 2(3bis) of the Swiss Anti-Money Laundering Act (AMLA-CH) who were already active on 1 October 2026 apply to join a self-regulatory organisation (SRO) (transitional provision of the Anti-Money Laundering Ordinance, GwV; anyone starting later has two months, Art. 12g(1)(b) GwV).
2. 2 Dec 2026 (EU): AI Act: two new prohibitions; Article 50(2) labelling for legacy generative systems.
3. 31 Dec 2026 (CH): transparency register: initial filing for companies limited by shares (AG) with a full audit.
4. 1 Jan 2027 (CH): FINMA Circular 2026/1: climate risks for institutions in supervisory categories 3 to 5.
5. 31 Jan 2027 (CH): transparency register: other companies with a full audit.
6. 28 Feb 2027 (CH): transparency register: AGs without a full audit.
7. 19 Mar 2027 (EU/DE): transposition deadline for the CSRD amendments in Omnibus I.
8. 31 Mar 2027 (CH): transparency register: all other legal entities and foreign entities; from 1 April 2027, financial intermediaries report discrepancies.
9. 10 Jul 2027 (EU/DE): AMLR applies; transposition deadline for AMLD6.
10. Jul–Dec 2027 (EU): the EU Anti-Money Laundering Authority (AMLA) selects up to 40 institutions for direct supervision.
11. 2 Dec 2027 (EU): AI Act: high-risk obligations for Annex III systems.
12. 1 Jan 2028 (CH): FINMA Circular 2026/1 covers all nature-related financial risks.

On top of these comes the annual submission of the DORA register of information: BaFin expects the register by 31 March at the latest, reflecting the position as at 31 December of the previous year, and announces at the start of each year when it begins accepting submissions. New sanctions packages can arrive at any time and without notice.

Regulatory calendar 2025–2029: all deadlines in order

The table lists every verified deadline, including past ones whose obligations still apply. Market shows where the rules apply.

Note on GmbHs: for companies that are not AGs and do not require a full audit, such as most Swiss limited liability companies (GmbH), the wording of the TJPG is not clear-cut. Art. 51(3)(d) TJPG sets six months for "other companies that do not meet the conditions for a limited audit" and for other legal entities. To be on the safe side, file by 28 February 2027, the deadline for AGs without a full audit.

Outside this window are 2 August 2030 (AI Act, high-risk systems of public authorities) and 30 June 2032 (end of the time limit on the Swiss pay equity analysis under the Gender Equality Act).

What the deadlines mean for resourcing

The deadlines cluster into three peaks in which legal and compliance need extra capacity. Spotting them early lets you spread the work.

• Winter 2026/2027: Swiss transparency register filings, the December AI Act deadline, FINMA climate risks and CSRD transposition fall in the same quarter.
• Mid-2027: by the time the AMLR applies on 10 July 2027, gap analyses, internal directives, customer data and training must be updated.
• End of 2027: the AI Act's high-risk obligations require an inventory, documentation and contracts, especially for HR systems.
• Unplanned peaks: in 2026 alone, several EU sanctions packages each triggered re-screening and contract reviews.

Alpinum Solutions provides legal and compliance professionals for such peaks through staff leasing or freelancing, part-time or full-time, individually or as a project team, from junior to senior level. Selected profiles are usually available within 48 hours; the company and Alpinum agree the start date together. How to run such programmes methodically is covered in our guide to regulatory change management.

Switzerland: the regulations at a glance

In Switzerland, the anti-money laundering revision, the transparency register and FINMA circulars dominate the agenda for 2026 and 2027.

AML revision and transparency register

Since 1 October 2026, the revised Anti-Money Laundering Act and the Transparency Act (TJPG) have been in force and the transparency register is live. Existing legal entities file in stages until 31 March 2027, and advisers now fall under the AML Act. Details in our guide to the Swiss AML revision and transparency register.

FINMA Circulars 2023/1 and 2026/1

Circular 2023/1 on operational resilience has been fully applicable since 1 January 2026; Circular 2026/1 on nature-related financial risks applies in stages until 2028. More in our guide to implementing FINMA Circular 2023/1.

Cyber reporting under the ISA

Since 1 April 2025, operators of critical infrastructure have had to report cyber attacks to the BACS within 24 hours. See NIS2 and the Swiss cyber reporting duty.

Sanctions

Switzerland adopts EU packages one by one, usually with a delay, through the Ukraine Ordinance. What to do after a package is set out in sanctions compliance: tasks and roles.

AI, data protection, whistleblowing, sustainability

Switzerland is preparing to ratify the Council of Europe AI Convention (consultation on binding rules planned for spring 2027 according to the Federal Office of Communications, OFCOM, as at October 2026). Swiss companies with EU exposure are affected by the AI Act. The revised Federal Act on Data Protection (FADP) has applied since 1 September 2023 (comparison in our guide to GDPR vs Swiss FADP). There is no general whistleblowing law for the private sector (whistleblowing in Germany and Switzerland). The consultation on the new Act on Sustainable Corporate Governance ran until 9 July 2026 (CSRD, CSDDD and supply chain law). Employers with 100 or more employees must carry out a pay equity analysis (Art. 13a et seq. Gender Equality Act); the rule is time-limited until 30 June 2032.

Germany and the EU: the regulations at a glance

In Germany and the EU, AI, digital resilience and anti-money laundering will shape the next two years.

AI Act and the German implementation act

After the Digital Omnibus, the high-risk obligations apply from 2 December 2027 and 2 August 2028 respectively; in Germany, the Federal Network Agency is the central supervisor. More in AI Act: deadlines, obligations and capacity.

DORA

Financial entities keep a register of information, update ICT contracts and report major incidents in three stages. See DORA workstreams for legal and compliance.

NIS2 in the BSIG

An estimated 29,500 entities must register with the BSI (section 33 BSIG); management is liable for implementation (section 38 BSIG). See NIS2 in Germany.

AMLR, AMLA and a new German Money Laundering Act

The AMLR applies from 10 July 2027. Germany is preparing to adapt its anti-money laundering law: on 28 October 2026, the Federal Ministry of Finance published a ministry draft of an Act implementing the Sixth EU Anti-Money Laundering Directive and strengthening money laundering prevention; according to media reports, the new act is to replace the 2017 Money Laundering Act on that date. Cabinet approval was still pending as at 31 October 2026. More in AMLR and AMLA from 2027.

Pay transparency

Germany missed the transposition deadline of 7 June 2026; until the directive is transposed, the Pay Transparency Act (EntgTranspG) applies. See pay transparency in Germany.

Whistleblower protection, sustainability, data protection, sanctions

The Whistleblower Protection Act (HinSchG) requires an internal reporting channel for employers with, as a rule, at least 50 employees (section 12 HinSchG). Omnibus I narrowed the CSRD and CSDDD; according to our information as at October 2026, the German CSRD implementation act and the amendment to the Supply Chain Act (LkSG) had not yet been passed. On the GDPR, the Council adopted its mandate on the Digital Omnibus on 21 October 2026; until agreement is reached, the 72-hour breach notification deadline applies. New Russia packages take effect in the EU when the regulations enter into force.

How to use the calendar

The calendar becomes useful once every row has an owner and a lead time. This approach works well:

1. Mark relevance: for each row, record whether and through which entities your company is affected.
2. Assign ownership: name one owner in legal or compliance and one in the business.
3. Plan backwards: schedule gap analysis, implementation, testing and sign-off from the deadline.
4. Spot peaks: group deadlines by quarter and decide early where to staff internally, externally or on an interim basis.
5. Check dependencies: for example AI Act and data protection impact assessments, or DORA and breach notification.
6. Update regularly: reconcile open points, moved deadlines and new packages every month.

Limits of this calendar

The calendar contains only deadlines we have checked against a source. Points from ongoing procedures are marked "as at October 2026"; where no primary source was accessible, we say "according to specialist reports" or "according to media reports". Sector-specific deadlines, cantonal rules and company-specific obligations are not included. Whether a regulation applies to your company is for your legal department or advisers to assess. Alpinum is not a law firm.

Frequently asked questions about the regulatory calendar

How often is the calendar updated?

We review the calendar every month and update it when new decisions, postponements or sanctions packages arrive. The date of the last review appears in the introduction, the date of the last change at the end of the page. Points still in motion, such as the German CSRD implementation act or the Swiss AI consultation, are flagged and checked first at every update.

Do EU rules apply to Swiss companies?

Not as Swiss law. They can still reach Swiss companies through EU subsidiaries, through client contracts with EU institutions or through the territorial scope of individual regulations, for example the AI Act, which also covers providers and deployers in third countries where the output of the AI system is used in the EU (Art. 2(1)(c) AI Act). Swiss banks are subject to FINMA Circular 2023/1 instead of DORA, and Switzerland adopts EU sanctions only by its own decision.

Which regulatory deadlines matter most in 2027?

In Switzerland, the initial transparency register filings by 31 March 2027 and FINMA's climate risk requirements from 1 January 2027. In the EU and Germany, CSRD transposition by 19 March 2027, the application of the AMLR from 10 July 2027 and the AI Act's high-risk obligations from 2 December 2027.

What happens if Germany transposes an EU directive late?

Existing German law continues to apply and must be interpreted in line with the directive. For pay transparency this means that, until transposition, the right to information in establishments with more than 200 employees and the reporting duty for employers that must prepare a management report and normally have more than 500 employees under the Pay Transparency Act still apply. Companies should prepare for the directive regardless.

Which past deadlines still matter?

An expired deadline does not mean the duty is done. A missing BSI registration under NIS2 must still be made. The DORA register of information is submitted every year, to BaFin by 31 March at the latest, and the ISA reporting duty applies continuously. Anyone who has not yet met one of these duties should prioritise it ahead of new deadlines.

Next step

Tell us which deadlines matter for your company in 2026 and 2027. We will show you which profiles can support your team at the peaks.

• Regulatory compliance and regulatory change
• Interim compliance
• AMLR and AMLA: what changes from 2027
• Discuss your requirements

Last updated: 31 October 2026.