Most retirement work gets scheduled one deadline at a time: someone notices a server is going out of support, a lease is coming back, or a state law has a new registration date. This calendar puts the 2027 dates in one place, so you can see where they cluster and plan the work, the budget, and the vendor capacity before the deadlines arrive. Every date below was checked against its primary source on November 9, 2026. The interactive version in the Workbench filters the same list to your industry and states, adds your own lease and refresh dates, and prints the year on one page.
01 / HOW TO READ ITThree kinds of date, and a Microsoft convention
Each entry carries one of three labels:
- Firm: set in a statute, a regulation, or an official vendor lifecycle page. Plan to it.
- Target: a date from an agency’s regulatory agenda or plan. Agendas slip often, so treat a target as a date to check rather than a deadline.
- Suspended: a date written into a rule whose implementation has been paused. It is on the calendar so you don’t mistake it for a live deadline.
Microsoft lists end-of-support dates by calendar day, usually a Patch Tuesday, and its product pages show the same cutoff as 6:59:59 a.m. Pacific the next morning. The dates here follow Microsoft’s “ending support in 2027” list. Two clusters stand out: January 12 (Windows Server 2016 and Windows 10 Enterprise LTSC 2021) and October 12 (Windows 10 Extended Security Updates year two, SQL Server 2017, and two Windows 11 versions), with VMware vSphere 8 one day earlier.
The calendar covers dates that change when or how you retire, wipe, recycle, or document IT equipment. It isn’t a complete regulatory calendar, and it isn’t legal advice. Check your own obligations with counsel and your compliance team.
02 / ALREADY IN MOTIONWhat late 2026 left on the table
Several things that ended in the fall of 2026 shape the 2027 plan:
- Windows Server 2012 and 2012 R2 finished their third and final year of Extended Security Updates on October 13, 2026. Hosts still running them no longer receive patches and belong in the first wave of 2027 disposition.
- Windows 10 commercial ESU year one ended the same day. Year two runs to October 12, 2027, so the pay-or-retire decision for the remaining Windows 10 fleet is a 2027 budget line.
- Windows 11 SE, the education edition, reached end of support in October 2026; Microsoft released no feature update after 24H2. School laptops running it no longer get security fixes, which feeds the summer refresh season.
- Secure Boot certificates from 2011 expired between June and October 2026. Microsoft says devices without the 2023 certificates can no longer receive new security protections for the early boot process. Older PCs and servers whose firmware can’t take the new certificates are a security-based reason to retire hardware.
03 / JANUARY–MARCHNew state laws, then the first server cliff
January 1 brings a cluster of state laws. Three e-waste programs change their rules for the new program year, and two state privacy laws take effect (Oklahoma and Louisiana), along with California’s automated-decision rules; Alabama’s follows on May 1. The privacy laws matter to disposition because each one gives consumers a right to deletion and puts security duties on the business. When a deletion request reaches data on a retired drive, the certificate of sanitization or destruction is your proof that it was handled.
Eleven days later, Windows Server 2016 reaches end of support. It is the largest server retirement trigger of the year, and it has a paid escape hatch: Microsoft offers up to three years of Extended Security Updates (through 2030) through Azure Arc, with enrollment open since August 3, 2026 and billing from January 13, 2027, though it had not listed per-year end dates or prices as of November 9, 2026. Hosts that can’t move to a newer release are candidates for decommissioning, data sanitization, and resale.
| Date | What happens | Applies to | Status |
|---|---|---|---|
| Jan 1 | California CCPA rules: automated-decision compliance begins. CCPA businesses using automated decision-making technology for significant decisions must comply. The same rules require cybersecurity audits, which cover data disposal and asset management; the first certifications are due April 1, 2028. Source. | California | Firm |
| Jan 1 | Hawaii manufacturer e-waste goal rises to 70%. Act 162 (2025) raises the manufacturer collection obligation to 70% by weight of devices sold two years earlier and adds reporting on reuse versus recycling; annual reports are due March 31. Source. | Hawaii | Firm |
| Jan 1 | Illinois e-waste program year 2027: new device registrations. Under Public Act 104-0274, manufacturers must register home audio and peripheral brands starting with program year 2027 (registration due April 1), and the program now runs through 2031. Source. | Illinois | Firm |
| Jan 1 | Louisiana Data Privacy Act takes effect (SB 386). Another state with deletion rights and security duties; a cure-notice window runs through July 31, 2027. Source. | Louisiana | Firm |
| Jan 1 | Oklahoma consumer data privacy law takes effect (SB 546). Adds deletion rights and data-security duties for covered businesses. Disposal certificates are part of the proof that deleted data was destroyed. Source. | Oklahoma | Firm |
| Jan 1 | Oregon E-Cycles 2027 program year begins. Second year of Oregon’s modernized producer-run program, which adds devices such as cable and satellite receivers, game consoles, and routers and modems. Check that your Oregon recycler is an approved collector. Source. | Oregon | Firm |
| Jan 12 | Windows 10 Enterprise LTSC 2021 reaches end of support. Kiosks, lab PCs, and medical and shop-floor workstations on LTSC 2021 need an OS migration or a refresh, and the retired devices need certified wiping. Source. | Everyone | Firm |
| Jan 12 | Windows Server 2016 reaches end of support. The largest server retirement trigger of 2027 (Hyper-V Server 2016 and Windows Storage Server 2016 end the same day). Microsoft offers up to three years of paid Extended Security Updates (through 2030) through Azure Arc, billed from January 13, 2027; hosts that won’t move to a newer release become decommission, wipe, and resale candidates. Source. | Everyone | Firm |
04 / APRIL–JUNEFilings, Earth Day, and the school-year turnover
New York’s financial regulator wants its annual Part 500 compliance filing by April 15. Part 500 includes asset-inventory and secure-disposal requirements, so the filing is a good reason to reconcile every 2026 retirement to a certificate first. Earth Day gives sustainability teams a natural date for an employee e-waste drive. By June, schools are planning the summer turnover: dozens of Chromebook models reach their Auto Update Expiration dates between June and August 2027, and each model has its own date to check.
| Date | What happens | Applies to | Status |
|---|---|---|---|
| Apr 15 | NYDFS Part 500 annual compliance filing due. Regulated entities certify compliance for calendar 2026 between January 1 and April 15. Part 500 includes asset-inventory and secure-disposal requirements, so gather 2026 disposal certificates first. Source. | New York · financial services | Firm |
| Apr 22 | Earth Day. A natural date for an employee e-waste drive and for sustainability reporting on what your retired equipment became. Source. | Everyone | Firm |
| May 1 | Alabama Personal Data Protection Act takes effect (HB 351). Adds deletion rights and security duties for businesses that meet its thresholds. Source. | Alabama | Firm |
| May–June | Ubuntu 22.04 LTS standard support ends. Servers and appliances on 22.04 need an upgrade or paid Ubuntu Pro coverage (to 2032), or retirement. Canonical’s pages list May 2027 and June 2027. Source. | Everyone | Firm |
| June–August | Chromebook update expirations: summer 2027 models. Google sets an Auto Update Expiration date per model; dozens of models reach theirs in June or August 2027, lining up with the end of the school year. Check each model’s date. Source. | education | Firm |
05 / JULY–SEPTEMBERBatteries take over the summer
July 1 is the busiest e-waste date of the year. California’s first annual reports for battery-embedded products come due, Washington’s battery collection sites open, and Colorado’s battery stewardship plan is due, with producer participation required from August 1. For an IT department the practical upshot is more places to send loose and removed batteries, and more questions from vendors about where batteries end up.
Two federal dates in this quarter are agency targets, not deadlines. HHS’s regulatory agenda targets July 2027 for a final HIPAA Security Rule, which as proposed would require a technology asset inventory. EPA’s agenda targets August 2027 for a final lithium-battery universal waste rule, but the proposed rule had not been published as of November 2026, so expect that date to slip. One federal date is firm: the Commerce Department’s allocation order that keeps black mass and tungsten scrap in the U.S. is set to expire on August 27 unless it is extended.
| Date | What happens | Applies to | Status |
|---|---|---|---|
| Jul 1 | California SB 1215: first battery-embedded product reports due. Manufacturers of covered battery-embedded products (laptops, tablets, wearables and more) start annual reports to CalRecycle; the consumer fee on these products began in 2026. Source. | California | Firm |
| Jul 1 | Colorado battery stewardship plan due. A battery stewardship organization must submit its plan under SB25-163; producers must participate starting August 1, 2027. Source. | Colorado | Firm |
| July | HIPAA Security Rule final rule: agency target. The federal regulatory agenda targets July 2027 for the final rule (listed as a long-term action). The proposal would require a technology asset inventory and network map; nothing in it is in force until a final rule is published. Source. | healthcare | Target |
| Jul 1 | Washington battery collection sites open. Collection sites start accepting portable batteries under Washington’s battery stewardship law (medium-format batteries follow in 2029), giving a free channel for batteries removed from devices. Source. | Washington | Firm |
| Summer | Wisconsin E-Cycle rule would add wearables. A proposed DNR rule would add wearables, digital cameras and music players, radios, and walkie-talkies to E-Cycle Wisconsin; DNR anticipates a summer 2027 effective date after legislative review. Source. | Wisconsin | Target |
| Jul 12 | SQL Server 2014 Extended Security Updates end (final year). The last paid coverage for SQL Server 2014. Database hosts and their storage become retirement candidates, and the drives need sanitization or destruction. Source. | Everyone | Firm |
| Aug 1 | Colorado: battery producers must join a stewardship program. From August 1, 2027, producers may sell covered batteries and battery-containing products in Colorado only if they participate in and finance a battery stewardship organization that has submitted a plan. Source. | Colorado | Firm |
| August | EPA universal waste rule for lithium batteries: agency target. EPA’s agenda targets a final rule creating lithium-battery universal waste standards; the proposed rule had not been published as of November 2026, so expect the date to slip. Until then, manage lithium batteries under the existing universal waste rules. Source. | Everyone | Target |
| Aug 27 | BIS allocation order for black mass and tungsten scrap expires. The Defense Production Act allocation order that keeps black mass and tungsten waste and scrap in the U.S. is set to expire unless BIS extends it. Ask your recycler how it affects downstream battery and scrap processing. Source. | Everyone | Firm |
| Sep 3 | Microsoft Teams Displays retired. A physical device category reaching end of life: plan a collection of desk displays from offices and conference rooms. Source. | Everyone | Firm |
| Sep 30 | Federal fiscal year 2027 ends. Federal agencies and contractors often push refresh spending into the last quarter of the fiscal year, which brings a disposition wave behind it. Source. | government | Firm |
06 / OCTOBER–DECEMBERThe October 12 cluster
October is the heaviest month on the calendar. VMware vSphere 8 leaves general support on October 11. The next day, Windows 10 commercial ESU year two ends (year three, the last, runs to October 10, 2028, at a higher price), Microsoft’s extended consumer program ends, SQL Server 2017 reaches end of support, and Windows 11 24H2 Enterprise and Education and 25H2 Home and Pro stop being serviced. Expect the largest PC disposition wave of the year around that week, and expect vendor schedules to fill early.
November 10 is the date CMMC Phase 3 would start under the rule, one year after Phase 2. DoD suspended Phase 2 on July 13, 2026 and held later milestones in abeyance, so Phase 3 sits on the calendar as a suspended date. NIST SP 800-171 media sanitization and DFARS 252.204-7012 still apply to defense contractors in the meantime. The year closes with a reconciliation: every retired serial matched to a certificate, disposed assets written off, and a decision on whether any Windows 10 devices need the third ESU year.
| Date | What happens | Applies to | Status |
|---|---|---|---|
| All month | Cybersecurity Awareness Month. A good month to run an end-of-life check: count the storeroom, reconcile certificates, and confirm vendors’ certifications. Source. | Everyone | Firm |
| Oct 11 | VMware vSphere 8 reaches end of general support. ESXi, vCenter, and vSAN 8 leave general support. Hosts that won’t move to the next release, or that leave VMware, become server, storage, and network disposition candidates. Source. | Everyone | Firm |
| Oct 12 | Windows 10 ESU: commercial year two and consumer program end. Commercial Extended Security Updates year two ends (year three, the last, runs to October 10, 2028, at a higher price), and Microsoft’s extended consumer program ends the same day. Expect the largest PC disposition wave of the year around it. Source. | Everyone | Firm |
| Oct 12 | SQL Server 2017 reaches end of support. The second SQL Server retirement of 2027, for Windows and Linux installations; database hosts and storage go to disposition. Source. | Everyone | Firm |
| Oct 12 | Windows 11 24H2 (Enterprise, Education) and 25H2 (Home, Pro) end of servicing. Devices must take a newer feature update. Hardware that can’t is flagged for refresh. Source. | Everyone | Firm |
| Nov 10 | CMMC Phase 3: date in the rule, implementation suspended. 32 CFR 170.3 starts Phase 3 one year after Phase 2, but DoD suspended Phase 2 on July 13, 2026 and held later milestones in abeyance. NIST SP 800-171 media sanitization and DFARS 252.204-7012 still apply. Source. | defense contractors | Suspended |
| Nov 15 | America Recycles Day. A second recycling hook for the year, a month after the Windows 10 deadline. Source. | Everyone | Firm |
| Dec 31 | Year-end close. Reconcile every retired serial to a certificate, write off disposed assets, and decide whether any Windows 10 devices need ESU year three. | Everyone | Firm |
07 / THE WATCH LISTExpected in 2027, no date yet
These are likely to land in 2027 but had no date to put on a calendar as of November 9, 2026:
- CMMC Phase 2 restart. Suspended since July 13, 2026; no task force report or restart date published as of November 9, 2026.
- NIST SP 800-171 Rev. 3 for CMMC. DoD’s rule setting a transition from Rev. 2 had not been published as of November 9, 2026; Rev. 2 governs.
- California battery stewardship (AB 2440). Plan deadlines count from CalRecycle regulations that were still in rulemaking.
- Windows Server 2016 ESU pricing and year dates. Microsoft offers up to three years of ESUs through Azure Arc (through 2030) but had not listed per-year end dates or prices as of November 9, 2026.
- CIRCIA incident-reporting rule. CISA’s final rule (target September 2026) was not yet published; don’t wipe devices tied to a reportable incident.
When one of them gets a date, it goes into the Workbench calendar and this page is updated.
08 / PLANNING AROUND ITWork back from each date
A date on the calendar is the day support or a rule changes, not the day the work starts. A few habits make it manageable:
- Start the inventory about a quarter ahead. For a lifecycle date like January 12 or October 12, you need to know which serials are affected, where they are, and what’s on them. The Refresh Wave Planner turns a fleet count and a deadline into dated waves.
- Book vendor capacity before the cluster. The weeks around October 12 will be busy for every ITAD provider. Schedule pickups or on-site destruction early.
- Decide wipe or destroy by media type. Servers and storage from the January and October retirements carry the most sensitive data. NIST SP 800-88 Rev. 2 sets the method by media type, and the certificate should name it.
- Hold incident devices. Don’t wipe a device tied to a security incident or a litigation hold, whatever the calendar says.
- Keep the paper trail current. The NYDFS filing in April, a state deletion request, and a CMMC assessment all ask the same question: can you show what happened to each device? The Certificate Checker tests whether your certificates would hold up.
09 / CYBERCRUNCHPut the dates on our schedule, too
CyberCrunch is an R2v3, NAID AAA, RIOS, and PA DEP certified IT asset disposition provider headquartered in Greensburg, Pennsylvania, serving all 50 states with on-site and facility-based data destruction. If one of these dates applies to you, tell us which and how many devices are involved, and we’ll help you plan the pickups, the destruction, and the certificates around it. More on our IT asset disposition services.
10 / FAQ2027 compliance calendar FAQ
When does Windows Server 2016 reach end of support?
Windows Server 2016 reaches end of support on January 12, 2027, along with Hyper-V Server 2016 and Windows Storage Server 2016. Microsoft offers up to three years of paid Extended Security Updates (through 2030) through Azure Arc, billed from January 13, 2027. Hosts that won’t move to a newer release become decommissioning, sanitization, and resale candidates.
What IT end-of-support dates fall on October 12, 2027?
October 12, 2027 is the end of Windows 10 commercial Extended Security Updates year two and of Microsoft’s extended consumer ESU program, the end of support for SQL Server 2017, and the end of servicing for Windows 11 24H2 (Enterprise and Education) and 25H2 (Home and Pro). VMware vSphere 8 leaves general support the day before, on October 11.
Which state privacy laws take effect in 2027?
Oklahoma’s SB 546 and the Louisiana Data Privacy Act take effect January 1, 2027, and Alabama’s Personal Data Protection Act takes effect May 1, 2027. California’s CCPA rules on automated decision-making also require compliance from January 1, 2027. Each gives consumers deletion rights, which makes disposal certificates part of the proof that deleted data on retired devices was destroyed.
Is CMMC Phase 3 still scheduled for November 2027?
The rule, 32 CFR 170.3, starts Phase 3 one year after Phase 2, which would be November 10, 2027. DoD suspended Phase 2 on July 13, 2026 and held later milestones in abeyance, so as of November 9, 2026 Phase 3 had no live date. NIST SP 800-171 media sanitization and DFARS 252.204-7012 still apply.
Can I print the 2027 ITAD compliance calendar?
Yes. The free ITAD Compliance Calendar in the CyberCrunch Workbench filters these dates to your industry and states, lets you add up to twelve of your own dates, and prints the whole year on one page. It also exports the dates to your calendar app as an .ics file and to a spreadsheet as a CSV.