Regulationsby GlyphThe brief · Tue Oct 27Metadata identifiers were updated for California Senate Bill 813 and EU KIDS Act. Upcoming deadlines in November 2026 include the Egypt PDPL compliance window, CMMC 2.0 Phase 2 certification, and India DPDP Act Consent Manager rule. In December 2026, enforcement begins for Chile Personal Data Protection Law (Ley 21.719) alongside new restrictions under the EU AI Act.
Read more
What to do
- Complete compliance preparations for Egypt PDPL before the tentative one-year compliance window ends on 2026-11-02.
- Obtain Phase 2 Level 2 C3PAO certification for CMMC 2.0 by 2026-11-10.
- Implement Consent Manager registration capabilities for India DPDP Act by 2026-11-13.
- Enforce bans on sexual deepfakes and CSAM generation under EU AI Act by 2026-12-02.
Next 60 days
12Egypt PDPLOne-year compliance window endsArticle 6 of the issuing law gives those covered one year from the issue of the Executive Regulations to comply. The decree's signing date was not shown, so this date is counted from publication and is an estimate.Egypt
CMMC 2.0Phase 2: Level 2 C3PAO certificationPhase 2 begins one calendar year after Phase 1; applicable solicitations require CMMC Level 2 third-party (C3PAO) certification (32 CFR 170.3(e)(2)).United States (Federal)
India DPDP ActConsent Manager registration rule in force (12 months)Rule 4 (registration and obligations of Consent Managers) comes into force one year after publication.IndiaEU Consumer Credit Directive 2 (CCD2)National rules applyMember States must apply the transposing measures from this date and the 2008 Directive is repealed.European UnionPeru PDPL and 2024 RegulationDPO required: medium companiesCompanies with annual sales above 1,700 UIT up to 2,300 UIT.PeruChile Personal Data Protection Law (Ley 21.719)Law in forceMain obligations apply and the Personal Data Protection Agency begins supervision.ChileEU AI ActNew bans on sexual deepfakes and CSAM generation; Art 50(2) grace period endsNew Art 5(1)(ba)/(bb) prohibitions on AI systems that generate non-consensual intimate imagery of identifiable persons or child sexual abuse material apply. Generative AI systems placed on the market before 2 Aug 2026 must comply with the Art 50(2) marking duty by this date (new Art 111(4)).European UnionEU Platform Work DirectiveTransposition deadlineMember States must bring national laws into force to comply with the Directive (Article 29).European UnionProduct Liability DirectiveTransposition deadline; old PLD repealedMember States must transpose by 9 Dec 2026 (Art 22). Directive 85/374/EEC is repealed from that date but still applies to products placed on the market before it (Art 21).European Union
Australia Privacy ActChildren's Online Privacy Code must be registeredOAIC must develop and register the Children's Online Privacy Code within 24 months of Royal Assent.AustraliaAustralia Privacy ActAutomated decision-making transparency appliesPrivacy policies must disclose the kinds of personal information used in substantially automated decisions that significantly affect individuals (24 months after assent).AustraliaeIDAS 2 / EU Digital Identity WalletMember States must provide EU Digital Identity WalletsEach Member State must provide at least one wallet within 24 months of the entry into force of the implementing acts under Arts 5a(23) and 5c(6) (Art 5a(1)).European Union
Add every deadline to your calendar →2 to 6 months
32December 20262 deadlines
January 202722 deadlines
Later
31six to eighteen monthsMay 20272 deadlines
June 20271 deadline
July 20276 deadlines
August 20271 deadline
EU AI ActLegacy GPAI models must comply; national AI sandboxes operationalProviders of GPAI models placed on the market before 2 Aug 2025 must comply (Art 111(3)). Each Member State must have at least one national AI regulatory sandbox operational (Art 57(1) as amended by the Omnibus).European UnionSeptember 20273 deadlines