Legal Changes 2027: Deadline Calendar for Online Shops

For online shops, the legal changes of 2027 are spread across the whole year: as of 1 January the transition period for e-invoicing no longer applies to businesses with prior-year turnover above €800,000 (UStG), from 18 February portable batteries must be replaceable by the end user (EUR-Lex), and in December the Cyber Resilience Act and the ban on products made with forced labor apply (EUR-Lex). This deadline calendar sorts the key dates from October 2026 to December 2027 by who is affected, names the primary source for each date and links to the in-depth articles on our blog. It is meant as a working basis for the budget and project planning that many shops tackle in the fourth quarter, and as a starting point for consulting on your shop and IT roadmap.

The 2027 deadline calendar at a glance

A good overview is the compilation by Händlerbund, a German association of online retailers, on the legal changes of 2027, as of 24 September 2026 (Händlerbund). It covers, among other things, the deforestation-free supply chain, replaceable portable batteries, producer responsibility for textiles, the Cyber Resilience Act and the ban on products made with forced labor. As a secondary source, however, it does not replace a look at the legal text. For this calendar we checked every date against the primary source: EU law in the Official Journal via EUR-Lex, and e-invoicing in the German VAT Act and in the questions and answers of the Federal Ministry of Finance. We have added dates that are missing from the Händlerbund overview but matter for shops: the new product liability rules, the end of the e-invoicing transition period and the end of switching charges for cloud providers.

Before the turn of the year: product liability and the Deforestation Regulation

The new Product Liability Directive comes first. Member States must transpose it into national law by 9 December 2026 (EUR-Lex), and it applies to products placed on the market or put into service after 9 December 2026 (EUR-Lex). Two points are new for online shops. Software explicitly counts as a product (EUR-Lex). And the chain of liability reaches further than before: if the manufacturer is based outside the EU and there is neither an importer nor an authorized representative in the Union, the fulfillment service provider is liable (EUR-Lex). What this means for software and updates is covered in the article on the new product liability rules.

For retailers, another rule is particularly practical: if no liable economic operator established in the EU can be identified, the directive makes every distributor of the defective product liable if, at the request of the injured person, it does not name such an operator or its own supplier within one month (EUR-Lex). Anyone sourcing goods directly from third countries should therefore document the supply chain per item so that it can be proven within this period. The mandatory information under the General Product Safety Regulation remains in place alongside it.

On 30 December 2026 the obligations of the Deforestation Regulation (EUDR) begin for operators and traders (EUR-Lex). It covers products that contain cattle, cocoa, coffee, oil palm, rubber, soya or wood, have been fed with them or have been made using them (EUR-Lex). In a shop range these are, for example, wooden furniture, chocolate, coffee or tyres; what counts, however, is the customs tariff code in Annex I of the regulation, not the product name. The amending regulation removed books, newspapers and other printed products from the annex (EUR-Lex).

For online retailers that do not import themselves, the amendment has eased the situation. It introduces the category of downstream operators, and neither these nor traders are to be required to submit due diligence statements (EUR-Lex). They are not free of obligations, though: they collect the name, address and email address of their suppliers, and where the supplier is an operator also the reference numbers of the due diligence statements, and keep this information for at least five years (EUR-Lex). Businesses that are not SMEs must also register in the EU information system (EUR-Lex). How due diligence works in detail is explained in our article on the Deforestation Regulation for online retailers.

• Check the product range against Annex I of the EUDR and flag affected items in the product data model
• For every affected item, record the supplier, its address and, where applicable, the reference number of the due diligence statement
• Clarify whether the shop imports goods itself and therefore counts as an operator
• Add the passing on of reference numbers to supplier contracts
• For direct imports, document the supply chain so that it can be named within one month in a liability case

1 January 2027: the e-invoicing transition period ends for larger B2B shops

Since 1 January 2025, domestic businesses in Germany must be able to receive e-invoices; no exceptions are provided for this (BMF). For issuing invoices there is a transition period: from 1 January 2025 to 31 December 2026, all invoice issuers can choose to issue another type of invoice instead of an e-invoice, meaning paper or, with the recipient's consent, for example a PDF by email (BMF).

From 1 January 2027, this relief only applies to businesses whose prior-year turnover does not exceed €800,000; for them it is extended until the end of 2027 (BMF). The legal basis is Section 27(38) of the German VAT Act, which refers to the total turnover of the previous calendar year (UStG). Invoices sent by electronic data interchange (EDI) that do not already meet the requirements for an e-invoice have their own transition period until 31 December 2027 (UStG). Only after that is the e-invoice mandatory for everyone for transactions between domestic businesses (BMF).

Little changes for pure B2C shops, because invoices to final consumers are exempt from the e-invoicing rules (BMF). Things are different as soon as a shop also supplies business customers in Germany, for example via a B2B customer account, purchase on account or quote requests. Small-amount invoices of up to €250 gross remain exempt there as well and do not have to be issued as e-invoices (BMF). Which formats exist and how generation works technically in the shop is described in our article on e-invoicing requirements for online shops. We implement the connection of ZUGFeRD and XRechnung to shop and ERP as an integration project.

12 January 2027: switching cloud providers without switching charges

The Data Act affects an item that many shop budgets list under hosting. From 12 January 2027, providers of data processing services may no longer impose switching charges for the switching process (EUR-Lex). In the transition period from 11 January 2024 to 12 January 2027, only reduced switching charges are permitted (EUR-Lex). This refers to services such as cloud hosting, managed databases or storage services that a shop typically runs on.

For 2027 planning this means that a change of hosting or cloud provider becomes easier to calculate, because the switching charge disappears as a cost item. Other costs remain, for example for migration, testing and a phase of parallel operation. What to check in the hosting contract is covered in the article on switching cloud providers under the Data Act. If you are considering a move anyway, you can combine the question with a look at our shop hosting.

18 February 2027: replaceable batteries and the battery passport

For electronics retail, the key date is 18 February 2027: from that day Article 11 of the EU Battery Regulation applies (EUR-Lex). Anyone placing products with incorporated portable batteries on the market ensures that the end user can readily remove and replace the battery at any time during the lifetime of the product (EUR-Lex). A battery counts as readily removable if commercially available tools are sufficient: no specialized tools unless provided free of charge, no proprietary tools, no thermal energy and no solvents (EUR-Lex).

The obligation includes instructions and safety information on removal and replacement, which must also be made available permanently on a publicly available website (EUR-Lex). Exceptions are narrow: for appliances regularly exposed to splashing or water jets, replacement by independent professionals is sufficient for safety reasons, and the obligation only lapses entirely where a permanent connection to the battery is necessary, for example for safety reasons (EUR-Lex). The obligation lies with whoever places the product on the market, meaning manufacturers, importers and shops with own brands or direct imports. Retailers who buy in stock are well advised to have the replaceability confirmed by their supplier.

The digital battery passport starts on the same day: from 18 February 2027, every LMT battery, every industrial battery with a capacity above 2 kWh and every electric vehicle battery placed on the market must have an electronic record (EUR-Lex). LMT batteries are batteries for light means of transport such as e-bikes and e-scooters. For shops selling such batteries or vehicles, the battery passport becomes another data set per item. Later in the year, the supply chain due diligence obligations for batteries follow: Regulation (EU) 2025/1561 postponed their start to 18 August 2027 (EUR-Lex). Economic operators with a net turnover below EUR 40 million in the financial year before last are exempt unless they belong to a larger group (EUR-Lex). The overall framework is covered in our article on the Battery Regulation in the online shop.

• Create the attribute “battery replaceable by the end user” in the product data model and fill it for each item
• Add a link to the public battery replacement instructions on the product page
• For own brands and direct imports, clarify the design with the supplier before the key date
• Have existing stock assessed legally, because the obligation is tied to placing on the market, not to the day of sale
• For LMT batteries, request the battery passport data from the manufacturer and store it in the PIM system

June 2027: textiles, pay transparency and the EUDR for small businesses

For fashion and footwear shops, 17 June 2027 is the date by which Member States must transpose the amended Waste Framework Directive (EUR-Lex). Its core is extended producer responsibility for textile products and footwear: producers bear the costs of collection, sorting and treatment (EUR-Lex). The schemes for this must be set up by 17 April 2028 (EUR-Lex). Fees are graded by durability, reparability and recyclability (Händlerbund). Exactly when the obligations start for an individual shop will be set by the German transposition act.

The broad definition of producer is important. A producer also includes anyone who sells textiles under their own name or brand, anyone who first makes them available in Germany from another Member State or a third country, and anyone selling directly to end users by distance contract from abroad (EUR-Lex). Online platforms and fulfillment service providers are included in checking producer registration (EUR-Lex). Anyone who also sells via marketplaces should therefore expect queries from the platforms and keep material and product category data clean now.

One date affects shops as employers. The EU Pay Transparency Directive provides that employers with 250 or more workers report on the gender pay gap by 7 June 2027 and annually thereafter (EUR-Lex), and employers with 150 to 249 workers also by that date and every three years thereafter (EUR-Lex). The transposition period of the directive ended on 7 June 2026 (EUR-Lex). According to Händlerbund, Germany missed it, and until the new rules are in place the Pay Transparency Act of 2017 continues to apply (Händlerbund). According to the responsible federal ministry, the amendment is to enter into force at the beginning of 2027, but the new reporting obligations are only to fall due for the first time in June 2028 (Händlerbund). For HR planning, the date set by the German transposition act is therefore what counts.

On 30 June 2027, micro and small enterprises follow under the EUDR: for operators of this size that were established as such on 31 December 2024, the obligations only apply from that day (EUR-Lex). The extension does not apply to timber products that were already covered by the earlier EU Timber Regulation (EUR-Lex).

December 2027: Cyber Resilience Act and the forced labor ban

The Cyber Resilience Act applies in full from 11 December 2027 (EUR-Lex). One part is already in force: the manufacturers' reporting obligations for actively exploited vulnerabilities and severe incidents under Article 14 have applied since 11 September 2026 (EUR-Lex). It concerns products with digital elements, meaning connected devices and software. Manufacturers set a support period during which they handle vulnerabilities; it is at least five years, or correspondingly shorter if the product is expected to be in use for less time (EUR-Lex). The end date of this period must be easily accessible at the time of purchase, stating at least the month and year (EUR-Lex).

For shops acting as distributors, Article 20 sets out their own obligations. Before making such a product available, they check whether it bears the CE marking and whether the manufacturer and importer have provided the required information and documents (EUR-Lex). If distributors become aware of a vulnerability, they inform the manufacturer without undue delay, and in the case of a significant cybersecurity risk also the market surveillance authorities (EUR-Lex). Products placed on the market before 11 December 2027 are only subject to the requirements if they are substantially modified after that date; the reporting obligations under Article 14 apply to them as well (EUR-Lex). More on this in the article on the Cyber Resilience Act for online shops.

• Flag connected devices and software in the range as a separate product group
• Provide a field for the end of the support period (month and year) in the product data model and show it on the product page
• Request CE marking, declaration of conformity and manufacturer details from suppliers
• Define the reporting route: who in the shop informs the manufacturer when a vulnerability becomes known

On 14 December 2027 the regulation prohibiting products made with forced labor also applies (EUR-Lex). Economic operators may then neither place such products on the market, make them available nor export them (EUR-Lex). The ban applies regardless of company size (Händlerbund) and explicitly also to online retail: a product offered online counts as made available if the offer targets end users in the EU (EUR-Lex).

Dates without a fixed day: product passport and simplifications

Not every date is fixed yet. The EU is introducing the digital product passport under the Ecodesign Regulation step by step per product group via delegated acts; according to Händlerbund there is not yet a binding roadmap with specific product groups and key dates (Händlerbund). What a product passport contains and how it can be fed from existing product data is described in our article on the Digital Product Passport.

It is also open whether the EUDR will be adjusted once more. The amending regulation obliges the Commission to simplify the regulation and to present a report on it, accompanied where appropriate by a legislative proposal; it names 30 April 2026 as the date for this (EUR-Lex). Whether further changes follow should be checked before any larger investment in EUDR processes.

Technical deadlines alongside the legal ones

Alongside the legal deadlines there are technical dates that count just as much in budget planning. For PHP 8.2, security support ends on 31 December 2026 (php.net); what this means for WordPress and WooCommerce is shown in our article on upgrading from PHP 8.2. Microsoft's extended support for Dynamics NAV 2017 ends in January 2027 (Microsoft); for connected shops, the interface belongs on the plan as well. And if you still run Shopware 6.5, you will find the background in the article Shopware 6.5: security updates end.

Turning the calendar into a budget plan

For budget planning in the fourth quarter, a deadline calendar is only the first step; what matters is assigning a task, a system and a responsible person to each date. The work usually lands in the same places in the shop, and that is where effort can be bundled.

1. October to December 2026: check the range against the EUDR, Battery Regulation and Cyber Resilience Act, get e-invoicing ready for 1 January if prior-year turnover is above €800,000, and document supply chains for product liability.
2. January to March 2027: transfer battery replaceability and battery passport data into the product data before 18 February, review hosting contracts with the Data Act in mind.
3. April to June 2027: prepare material and product category data for textile producer responsibility, follow up on evidence from small suppliers for the EUDR.
4. July to December 2027: record support periods and conformity documents for connected products and complete supplier declarations on forced labor.

How we support the planning

We do not provide legal advice. Whether and how a date affects your company is something to clarify with your law firm, your association or your tax adviser. Our part begins where an obligation turns into a requirement for the shop, interfaces and data. In IT consulting for shops we capture the requirements, assess the existing systems in a technology audit and translate the dates into a roadmap with budget planning. Implementation then follows in the shop, the PIM and the interfaces to ERP and accounting.

A sensible starting point is a short check: which product groups do you carry, do you supply business customers in Germany, what infrastructure does your shop run on, and which suppliers are based outside the EU? The answers show which rows of the calendar apply to you.