Regulationsby GlyphCompliance deadlines: what is due next
November 20265
Egypt PDPLOne-year compliance window endsArticle 6 of the issuing law gives those covered one year from the issue of the Executive Regulations to comply. The decree's signing date was not shown, so this date is counted from publication and is an estimate.EgyptDecember 20269
Chile Personal Data Protection Law (Ley 21.719)Law in forceMain obligations apply and the Personal Data Protection Agency begins supervision.ChileEU AI ActNew bans on sexual deepfakes and CSAM generation; Art 50(2) grace period endsNew Art 5(1)(ba)/(bb) prohibitions on AI systems that generate non-consensual intimate imagery of identifiable persons or child sexual abuse material apply. Generative AI systems placed on the market before 2 Aug 2026 must comply with the Art 50(2) marking duty by this date (new Art 111(4)).European UnionEU Platform Work DirectiveTransposition deadlineMember States must bring national laws into force to comply with the Directive (Article 29).European UnionProduct Liability DirectiveTransposition deadline; old PLD repealedMember States must transpose by 9 Dec 2026 (Art 22). Directive 85/374/EEC is repealed from that date but still applies to products placed on the market before it (Art 21).European UnionJanuary 202722
February 20272
EU Cyber Solidarity ActFirst Commission evaluationCommission evaluates the Regulation and reports to Parliament and Council, then every 4 years (Article 25).European UnionDigital Services ActDSA SME impact reportCommission report under Article 91 on effects on SMEs.European UnionMarch 20272
April 20274
May 20272
June 20271
July 20276
August 20271
EU AI ActLegacy GPAI models must comply; national AI sandboxes operationalProviders of GPAI models placed on the market before 2 Aug 2025 must comply (Art 111(3)). Each Member State must have at least one national AI regulatory sandbox operational (Art 57(1) as amended by the Omnibus).European UnionSeptember 20273
October 20271
NIS2Commission review of NIS2Commission must review the functioning of NIS2 and report to Parliament and Council, then every 36 months (Art 40).European UnionNovember 20273
December 20275
Chile Personal Data Protection Law (Ley 21.719)Proposed postponement of entry into forceGovernment bill Boletin 18623-07 (filed 1 Sep 2026, 'suma' urgency) would replace the 24-month vacatio legis in transitional Art 1 with a fixed date of 1 Dec 2027; in first committee stage in the Senate, not law.ChileEU AI ActHigh-risk obligations apply to Annex III systemsChapter III Sections 1-3 (high-risk requirements and provider/deployer obligations) apply to AI systems classified high-risk under Art 6(2) and Annex III (employment, credit scoring, education, biometrics, essential services and similar). Deferred from 2 Aug 2026 by Regulation (EU) 2026/1744.European UnionCyber Resilience ActCRA fully appliesAll remaining obligations, including essential cybersecurity requirements, conformity assessment and CE marking, apply (Art 71(2)). Products placed on the market earlier are covered only if substantially modified (Art 69(2)).European UnioneIDAS 2 / EU Digital Identity WalletPrivate relying parties must accept walletsPrivate relying parties required by law or contract to use strong user authentication must accept wallets on user request within 36 months of the implementing acts' entry into force (Art 5f(2)).European UnionJanuary 20284
February 20281
EU CSAM Interim RegulationCommission implementation reportCommission report on implementation, including proportionality and error rates (Article 9).European UnionApril 20284
June 20281
Cyber Resilience ActLegacy type-examination certificates expireEU type-examination certificates and approval decisions on cybersecurity requirements under other harmonisation legislation remain valid until this date unless they expire earlier (Art 69(1)).European UnionAugust 20281
EU AI ActHigh-risk obligations apply to Annex I product-embedded systemsChapter III Sections 1-3 apply to AI systems classified high-risk under Art 6(1) and Annex I (safety components of products covered by EU harmonisation legislation). Deferred from 2 Aug 2027 by Regulation (EU) 2026/1744.European UnionSeptember 20283
Peru AI Law and RegulationPrivate sector: production, agriculture, energy, miningObligations apply three years after publication.PeruCyber Resilience ActReport on single reporting platformCommission report assessing the single reporting platform's effectiveness (Art 70(2)).European UnionEU Data ActCommission evaluationCommission evaluation report due, including the impact of cloud switching rules (Arts 23-31) (Art 49(2)).European UnionOctober 20281
November 20282
January 20291
March 20291
European Health Data Space (EHDS)Primary use for first data categories; secondary use framework appliesPatient rights and EHR rules apply to patient summaries, ePrescriptions and eDispensations (Art 14(1)(a)-(c)). Chapter IV secondary-use rules (data permits, Health Data Access Bodies) apply.European UnionApril 20292
June 20291
July 20291
Minnesota Consumer Data Privacy Act (MCDPA)Postsecondary institutions must complyPostsecondary institutions regulated by the Office of Higher Education must comply by July 31, 2029.MinnesotaSeptember 20291
Peru AI Law and RegulationPrivate sector: all other usesObligations apply four years after publication.PeruJanuary 20301
April 20302
August 20301
EU AI ActPublic-authority high-risk systems must complyProviders and deployers of high-risk AI systems intended for use by public authorities that were placed on the market before the Chapter III application date must comply (Art 111(2), as replaced by the Omnibus).European UnionDecember 20302
Cyber Resilience ActFirst CRA evaluationCommission evaluation and review report, then every four years (Art 70(1)).European UnionEU AI ActLarge-scale EU IT systems must complyAI systems that are components of the large-scale IT systems in Annex X (e.g. SIS, VIS, Eurodac, EES, ETIAS) placed on the market before 2 Aug 2027 must be brought into compliance (Art 111(1)).European UnionMarch 20311
European Health Data Space (EHDS)Primary use for second data categories; EHR systems in service; extra secondary-use categoriesPrimary-use rules extend to medical images, lab results and discharge reports (Art 14(1)(d)-(f)). Chapter III applies to EHR systems put into service under Art 26(2). Additional secondary-use categories in Art 51(1)(b),(f),(g),(m),(p) apply.European UnionMarch 20351
European Health Data Space (EHDS)Third-country participation in secondary useArt 75(5) applies from 26 Mar 2035.European Union