Mandatory IT dates 2027: What now belongs in the budget

In these weeks, many companies are creating the IT budgets for 2027. Rarely were so many fixed dates in a year: invoice formats, server operating systems, cloud contracts, AI regulation, product security and the end of SAP ECC maintenance. Not every appointment affects every company, and not everyone costs money. But if you only notice in February that a project is missing, you will find neither budget nor service provider. This article sorts out the deadlines and shows which of them belong in the planning.

What just expired

Before it comes to 2027, it is worth taking a look at the contaminated sites, which are often not yet in the budget. On October 13, 2026, Microsoft shipped the latest security update for Windows Server 2012 and 2012 R2. The program of Extended Security Updates is finished, there is no extension, not even for servers in Azure. Anyone who still operates such systems no longer has a planning topic, but an open security problem.

Similarly, SQL Server 2016, whose support expired in July, and Windows 10. Companies that continue to secure their jobs through the paid ESU program started their second year in October, and Microsoft has doubled the price for it. For a third year, it doubles again. So these costs grow the longer you wait.

January 2027: three dates in two weeks

The beginning of the year is the densest section, and it directly follows the holidays. What has not been done until then falls into a time when, according to experience, projects are starting slowly.

• 1. January 2027 – e-bill: Companies with more than 800,000 euros in previous year’s turnover are only allowed to issue domestic B2B invoices as structured e-invoices. This is especially expensive where bills come from several systems. Details of the contribution to E-Invoicing obligation 2027.
• 12. January 2027 – Windows Server 2016: Extended support ends. After that, there are security updates only against payment via ESU. What paths there are in the contribution to End of Support for Windows Server 2016.
• 12. January 2027 – Data Act: Cloud and SaaS providers may no longer charge for a change of provider. This is not an obligation for users, but changes the negotiating position in current contracts.

The first two dates generate real project costs. The third is more of an opportunity to know before renewing cloud contracts in the coming year.

Later in the year: AI Act, Cyber Resilience Act, SAP

The second half of the year works further away, but it is only on paper. The preparation for these dates must be budgeted for 2027, even if the deadline is only in December.

• 2. December 2027 – High-risk AI under the EU AI Act: The Digital Omnibus postponed this date from August 2026. AI systems are affected, for example, in the selection of applicants, lending or performance evaluation of employees. Anyone who uses or offers such systems needs risk management, documentation and human supervision until then. More about this in the contribution to EU AI Act.
• 11. December 2027 – Cyber Resilience Act: From that date, the safety requirements for products with digital elements apply fully, including conformity assessment and CE marking. The reporting requirements have been in place since September 2026. This applies to manufacturers of machines with control or remote maintenance as well as software providers. See also the contribution to Cyber Resilience Act.
• 31. December 2027 – SAP ECC 6.0: Regular maintenance ends. Extended maintenance until the end of 2030 is available at an additional cost, but only from Enhancement Package 6. For older stands, maintenance has already expired at the end of 2025.
• 31. December 2027 – Transition in e-bills: From 2028, all companies will have to issue e-bills, including the smaller ones. At the same time, the exemptions for older EDI procedures that do not comply with the European standard end.

The dates of December 2027 are the dangerous ones. They stand far enough away to move them, and close enough that a normal project won’t finish in time until it starts in the fall.

What belongs in the budget

For planning, it helps to sort the dates by the type of their cost. The first group are projects with a fixed end: e-bill, server replacement, SAP migration. They cost a one-off effort for inventory, implementation and testing, and their scope can be estimated quite well in advance if you know how many systems are affected.

The second group is bridging costs. ESU for Windows Server or Windows 10, extended SAP maintenance, licenses for legacy systems. They are sometimes useful in order to replace a difficult system. In the budget, however, they should always be with an end date, otherwise the bridge will become a permanent condition, which becomes more expensive every year.

The third group are duties that primarily require organization and documentation: AI Act, Cyber Resilience Act and NIS2. Here, the effort is less in technology than in processes, proofs and responsibilities. Some of this can be done internally, for evaluation and technical implementation usually needs external support.

How to Process the List

The first step costs little and saves a lot: an inventory of which of the dates apply at all. How many servers are still running Windows Server 2012 or 2016? How many systems generate invoices? Does the company use AI in human resources processes, or does it bring products with software to market? With these answers, the list usually shrinks to three or four points.

The order then decides. What is due in January belongs in the next few weeks. What is due in December 2027 should start in the first quarter so that there is enough air for testing and rework. And where multiple appointments affect the same system, such as an old server with SQL Server 2016 and billing software that needs to be extended for e-billing, it is worth solving both in one project instead of touching twice.

Conclusion

2027 does not bring a single major change, but a series of fixed dates, which are spread throughout the year and clench in January and December. Anyone who goes through them completely now plans with realistic budgets instead of emergency projects. If you want to know which of the deadlines affect your company and how the projects can be bundled sensibly, we support you in the Cloud Migration, which Data Migration and in AI governance and EU AI Act. Talk to us.

Additional sources

• Microsoft Learn – Windows Server 2012 and 2012 R2: End of Support
• Federal Ministry of Finance – Questions and answers on e-bills
• EUR-Lex – Regulation (EU) 2026/1744 (Digital Omnibus to the AI Act)
• EUR-Lex – Regulation (EU) 2024/2847 (Cyber Resilience Act)
• SAP Community – Maintenance Timelines for SAP ERP 6.0

Note: This post gives the status of 15. October 2026 again and serves for general information. It does not replace legal or tax advice. Whether an appointment affects your company depends on the individual case.