The 2027 compliance calendar and the evidence behind it

Compliance programs in mid-market firms usually produce policies, such as a cyber incident policy, a data protection policy and a supplier code of conduct. Regulators, auditors, customers and courts increasingly ask a different question: show us what happened, when, and who decided. A policy cannot answer that. Logs, timestamps, approvals and retained documents can, provided they were created at the time.

The rules arriving over the next eight months make this concrete. Several carry clocks measured in hours, burdens of proof that sit with the business, or data that must travel with a product or a shipment. For each one, the useful question is which system will hold the evidence, who owns it, and whether it exists today.

The calendar below covers rules that commonly reach firms operating in the UK and the EU. It is a planning aid. Whether a rule applies, and how, depends on the business, and this article does not give legal advice. Lawyers and advisers in each jurisdiction confirm scope and obligations.

Companies House identity verification became mandatory on 18 November 2025. Directors in post before that date verify through their company's next confirmation statement filed during a 12-month transitional period, which ends in November 2026. A confirmation statement cannot be filed until every director's verification is in place, and people with significant control have their own 14-day windows. A group with several UK companies and overseas directors has a separate deadline for each role.

Employment rules change in stages. Employment tribunal time limits extended from three to six months for matters arising on or after 1 October 2026. From 1 January 2027 the qualifying period for ordinary unfair dismissal falls to six months and the compensation cap is removed, and restrictions on dismissing and re-engaging staff to change core terms are scheduled for the same month.

The new subscription contracts regime under the Digital Markets, Competition and Consumers Act 2024 is now due in January 2027, brought forward from spring 2027, although the secondary legislation and guidance still had to be made when the date was announced. Traders will carry the burden of showing that required notices, such as cooling-off notices, were given.

The UK Carbon Border Adjustment Mechanism starts on 1 January 2027 for importers of covered aluminium, cement, fertiliser, hydrogen, and iron and steel goods above a £50,000 registration threshold.

Two items are already live and generate evidence now. Under the Data (Use and Access) Act 2025, every controller has needed a data protection complaints procedure since 19 June 2026. Two bills remain before Parliament: the Cyber Security and Resilience Bill, which would widen the Network and Information Systems regime, and the Commercial Payments Bill on payment terms and late payment interest. Neither is law yet.

Product identifiers become mandatory in customs declarations for low-value parcels from 1 November 2026, following the €3 per item duty introduced on 1 July 2026.

Under the AI Act, the transparency obligations in Article 50 have applied since 2 August 2026. The Digital Omnibus on AI, published in July 2026, gave generative systems already on the market until 2 December 2026 to apply machine-readable marking, added two prohibitions from the same date, and moved high-risk obligations for Annex III uses, which include recruitment and credit, to 2 December 2027.

The new Product Liability Directive must be transposed by 9 December 2026. The previous directive is repealed from that date but continues to apply to products placed on the market before it. The new definition of a product covers software, including applications and AI systems.

The Deforestation Regulation applies from 30 December 2026 to large and medium operators, and to micro and small operators already covered by the Timber Regulation, and from 30 June 2027 to other micro and small operators.

Under the Cyber Resilience Act, manufacturers of products with digital elements have had to report actively exploited vulnerabilities and severe incidents since 11 September 2026, including for products already on the market. An early warning is due within 24 hours of becoming aware, a notification within 72 hours, and a final report later. The Act's main obligations apply from 11 December 2027.

CBAM certificates for 2026 imports go on sale on 1 February 2027. Member states must transpose the Omnibus changes to sustainability reporting by 19 March 2027. Employers with 150 or more workers must file their first gender pay gap reports under the Pay Transparency Directive by 7 June 2027.

An evidence trail has four parts: a system of record, a timestamp created by that system, a named owner, and a retention rule. Applied to the calendar, it produces specific records.

Cyber reporting under the Cyber Resilience Act starts its 24-hour clock when the manufacturer becomes aware of active exploitation. The evidence is the ticket or alert that records the moment of awareness, the triage decision and the submission reference from the single reporting platform. If the security tool and the ticketing system are not linked, the timestamp has to be reconstructed after the fact, which is exactly what a regulator will question.

For subscriptions, the evidence is a message log showing which reminder or notice each customer was sent, its content at that date and whether it was delivered. Screenshots of a template do not show that a particular customer received it.

For the deforestation rules, the evidence is the due diligence statement reference held against each purchase order and lot, with the geolocation data that supports it. For CBAM, it is the installation emissions data or default value used for each import entry. For identity verification, it is a register of each director's and controller's verification status and deadline across every UK company in the group. For data protection complaints, it is a log of each complaint, the acknowledgement date, the steps taken and the outcome.

None of this needs a new platform. It usually needs two or three systems connected, fields added to existing records, and a scheduled check that reports gaps to a named owner. We build these trails inside the tools a business already runs, and keep evidence separate from judgement: legal interpretation stays with the client's lawyers.

In October 2026, check every UK company in the group for directors and controllers still to verify their identity, and file confirmation statements early where the transitional period is about to close.

By November 2026, confirm product identifiers on EU parcel declarations, and decide which products with digital elements the business manufactures, so that the Cyber Resilience Act reporting route and the 24-hour awareness record are in place.

By December 2026, have the subscription notice log and the cancellation route ready for January, check AI-generated content for marking where required, and ask product lawyers how the new liability rules treat any software the business supplies.

By the end of December 2026, large and medium operators placing covered commodities on the EU market should hold due diligence statement references against every relevant purchase order.

By February 2027, importers should hold the emissions data or default values behind each 2026 CBAM entry, and UK importers should have tested the CBAM registration threshold.

By June 2027, micro and small operators under the Deforestation Regulation should be ready for 30 June, EU employers with 150 or more workers should have filed pay reports, and every evidence trail above should have an owner, a retention rule and a monthly gap report.