The programme is a calendar, and the calendar is the story
The Commission's Work Programme is a scheduling document. It says which proposals the Commission intends to negotiate with the European Parliament and Council, and roughly when. For anyone selling technology into the single market, the useful part is the order of play, not the rhetoric around it.
Five technology files sit on it. The Cloud and AI Development Act (CADA) deals with cloud capacity and how AI systems are deployed across the EU. Chips Act 2.0 follows the first semiconductor package. The Digital Networks Act covers connectivity rules. The Cybersecurity Act is being revised. The Public Procurement Act is being revisited.
The dates attached are these. Agreement on the revised Cybersecurity Act is targeted for the end of 2026. The Quantum Act is expected to be presented on 18 November 2026. A digital transformation package — simplification, copyright and a review of the Digital Decade targets — is planned for the second quarter of 2027, with agreement on Chips Act 2.0 targeted in the same quarter. Agreement on CADA, the Digital Networks Act and the Public Procurement Act is targeted for the fourth quarter of 2027.
None of these are laws yet. They are intentions with dates, and dates in Brussels move. What they do show is the sequence the Commission wants, and that sequence matters for companies planning budgets across 2027 and 2028.
Why procurement is the file to watch
Of the five, two touch money directly. CADA sets the terms on which cloud capacity and AI deployment are bought and run across the EU. The Public Procurement Act is being reopened, and procurement is where a lot of AI money actually enters public budgets — not through research grants, but through ordinary tenders for hosting, translation, document processing and case-management tools.
That is why the eligibility definition matters more than the headline number attached to any of these files. A British company hosting services for a German municipality, or supplying an AI tool used by a French hospital, sits inside EU procurement rules regardless of where its office is. If CADA tightens the definition of an eligible supplier, that company feels it in contract renewals rather than in headlines.
The programme also names five sectors for AI adoption work: health, transport, agri-food, advanced manufacturing, and defence and space. Those are the areas where public money and regulatory attention will concentrate, and they are also the areas where procurement, safety rules and data protection overlap most heavily.
What techUK asked for, and when
techUK's analysis, published through WiredGov on 9 November, argues that UK suppliers risk being treated as third-country providers under initiatives such as CADA unless a mutual access arrangement exists. The body is calling for a Digital Partnership Agreement at the UK–EU Summit scheduled for 20 November 2026, and is due to publish a report titled Protecting Sovereignty Through Partnership on 10 November.
The timing is not accidental. The summit is ten days away. The Cybersecurity Act deadline closes the year. Everything else on the technology list runs into 2027, which means the political window for attaching a digital chapter to the UK–EU relationship is roughly now, before the files are drafted and the positions harden.
What already binds a supplier, whatever 2027 brings
The Work Programme does not reopen the AI Act's core obligations. Those were amended separately. Regulation (EU) 2026/1744, enacted in July 2026, postponed the Annex III high-risk compliance deadline to 2 December 2027 and Annex I product requirements to August 2028. The original August 2026 date that companies spent 2025 preparing for no longer applies.
Other parts are already live. Article 50 transparency obligations took effect on 2 August 2026, requiring explicit labelling of AI-generated synthetic content, watermarking, and technical disclosures passed down the supply chain. General-purpose AI governance under Articles 53 to 55 is binding, with a compute threshold of 1025 FLOPs used to define systemic risk, plus documentation and copyright policy requirements for any model distributed in the single market.
So the picture is mixed. Some deadlines slipped, transparency duties did not. A supplier that paused all AI Act work in 2025 on the assumption of a broader moratorium should check which obligations it is already inside — because those apply to the contract it signs this quarter, not the one it signs after CADA lands.
The next ten days
Three things fall inside the next ten days. The Commission's consultation on copyright and the use of protected content in AI systems closes on 10 November; its answers feed the digital transformation package planned for the second quarter of 2027. The Quantum Act is expected on 18 November. The UK–EU Summit takes place on 20 November. After that, the next fixed point in the programme is agreement on the Cybersecurity Act by the end of the year.
What a small supplier can actually check this month
The realistic action is narrower than the programme suggests. Check whether any current or planned public-sector contract refers to EU procurement eligibility, and whether the awarding body has said anything about third-country suppliers. Check whether the AI tools you deploy already carry the Article 50 labelling and disclosure that has been mandatory since August. And if your business depends on selling into EU tenders, note the fourth quarter of 2027 as the point where the eligibility rules for CADA and public procurement are supposed to be agreed — that is the moment to have a position, not the moment to start reading.
We follow how these rules land for ordinary users and small teams in our magazine coverage of EU digital policy. The full programme text remains the primary document, and the dates in it are targets rather than settled facts.
What is the Cloud and AI Development Act?
It is a planned EU law covering cloud capacity and how AI systems are deployed across the union. It appears in the Commission's 2027 Work Programme with agreement between Parliament and Council targeted for the fourth quarter of 2027. It is not law yet.
Does the 2027 timetable mean the AI Act is on hold?
No. The programme schedules new files. The AI Act's high-risk deadlines were moved separately by Regulation (EU) 2026/1744 in July 2026 — Annex III to 2 December 2027 and Annex I to August 2028 — while the Article 50 transparency duties have applied since 2 August 2026.
Why does the 20 November summit matter for tech suppliers?
techUK is asking London and Brussels to agree a Digital Partnership Agreement there, so that UK suppliers are not automatically classed as third-country providers under initiatives such as CADA. The summit is scheduled for 20 November 2026.
