Compliance deadlines: what is due next

326 dated deadlines across 110 regulations, 70 still ahead.

Add to calendar

Apple Calendar or Outlook Google Calendar Download .ics

70 deadlines from today onPast All

Date	Regulation	What happens	When
September 20261
Sep 30in 6d	UK DUAAData (Use and Access) ActUnited Kingdom ICO abolished; Information Commission takes over	ICO abolished; Information Commission takes over	in 6d
October 20262
Oct 1in 7d	CTDPAConnecticut Data Privacy Act (CTDPA)Connecticut PA 26-64 (SB 4) amendments take effect	PA 26-64 (SB 4) amendments take effect	in 7d
Oct 26in 32d	UK CSR BillUK Cyber Security and Resilience BillUnited Kingdom Lords report stage scheduledtentative	Lords report stage scheduledtentative	in 32d
November 20262
Nov 10in 47d	CMMC 2.0CMMC 2.0United States (Federal) Phase 2: Level 2 C3PAO certification	Phase 2: Level 2 C3PAO certification	in 47d
Nov 13in 50d	India DPDPIndia DPDP ActIndia Consent Manager registration rule in force (12 months)	Consent Manager registration rule in force (12 months)	in 50d
December 20266
Dec 1in 2mo	Chile PDPLChile Personal Data Protection Law (Ley 21.719)Chile Law in force	Law in force	in 2mo
Dec 2in 2mo	EU AI ActEU AI ActEuropean Union New bans on sexual deepfakes and CSAM generation; Art 50(2) grace period ends	New bans on sexual deepfakes and CSAM generation; Art 50(2) grace period ends	in 2mo
Dec 9in 3mo	EU PLDProduct Liability DirectiveEuropean Union Transposition deadline; old PLD repealed	Transposition deadline; old PLD repealed	in 3mo
Dec 10in 3mo	AU Privacy ActAustralia Privacy ActAustralia Children's Online Privacy Code must be registered	Children's Online Privacy Code must be registered	in 3mo
Dec 10in 3mo	AU Privacy ActAustralia Privacy ActAustralia Automated decision-making transparency applies	Automated decision-making transparency applies	in 3mo
Dec 24in 3mo	eIDAS 2eIDAS 2 / EU Digital Identity WalletEuropean Union Member States must provide EU Digital Identity Wallets	Member States must provide EU Digital Identity Wallets	in 3mo
January 202716
Jan 1in 3mo	CA SB 942California AI Transparency Act (SB 942)California Large online platform and hosting platform duties	Large online platform and hosting platform duties	in 3mo
Jan 1in 3mo	CA SB 53California SB 53 (TFAIA)California First OES anonymized incident report and CDT definition review	First OES anonymized incident report and CDT definition review	in 3mo
Jan 1in 3mo	CCPA / CPRACCPA / CPRACalifornia ADMT requirements compliance date	ADMT requirements compliance date	in 3mo
Jan 1in 3mo	CCPA / CPRACCPA / CPRACalifornia Browsers must support opt-out preference signal (AB 566)	Browsers must support opt-out preference signal (AB 566)	in 3mo
Jan 1in 3mo	Colorado AI ActColorado AI ActColorado ADMT obligations apply	ADMT obligations apply	in 3mo
Jan 1in 3mo	Colorado AI ActColorado AI ActColorado AG rules due	AG rules due	in 3mo
Jan 1in 3mo	CTDPAConnecticut Data Privacy Act (CTDPA)Connecticut Data broker registration required	Data broker registration required	in 3mo
Jan 1in 3mo	Delaware DPDPADelaware Personal Data Privacy Act (DPDPA)Delaware Amended thresholds and third-party duties take effect	Amended thresholds and third-party duties take effect	in 3mo
Jan 1in 3mo	Louisiana LDPALouisiana Data Privacy ActLouisiana Louisiana Data Privacy Act takes effect	Louisiana Data Privacy Act takes effect	in 3mo
Jan 1in 3mo	NH Privacy ActNew Hampshire Privacy ActNew Hampshire Ban on selling personal data of children under 13 (HB 1460)	Ban on selling personal data of children under 13 (HB 1460)	in 3mo
Jan 1in 3mo	NY RAISE ActNY RAISE ActNew York RAISE Act takes effect	RAISE Act takes effect	in 3mo
Jan 1in 3mo	OKCDPAOklahoma OKCDPAOklahoma Oklahoma Consumer Data Privacy Act takes effect	Oklahoma Consumer Data Privacy Act takes effect	in 3mo
Jan 1in 3mo	Utah UCPAUtah UCPAUtah UCPA extends to motor vehicle manufacturers	UCPA extends to motor vehicle manufacturers	in 3mo
Jan 12in 4mo	EU Data ActEU Data ActEuropean Union Cloud switching charges abolished	Cloud switching charges abolished	in 4mo
Jan 16in 4mo	Indonesia PDPIndonesia PDP LawIndonesia Implementing regulation GR 33/2026 takes effect	Implementing regulation GR 33/2026 takes effect	in 4mo
Jan 31in 4mo	CA Delete ActCalifornia Delete Act / DROPCalifornia Annual data broker registration deadline	Annual data broker registration deadline	in 4mo
March 20272
Mar 1in 5mo	Vietnam AI LawVietnam AI LawVietnam Transition ends for existing AI systems (general)	Transition ends for existing AI systems (general)	in 5mo
Mar 26in 6mo	EU EHDSEuropean Health Data Space (EHDS)European Union EHDS general application date	EHDS general application date	in 6mo
April 20273
Apr 1in 6mo	Maryland MODPAMaryland Online Data Privacy Act (MODPA)Maryland Discretionary 60-day cure period ends	Discretionary 60-day cure period ends	in 6mo
Apr 2in 6mo	GDPRGDPREuropean Union GDPR Procedural Regulation applies	GDPR Procedural Regulation applies	in 6mo
Apr 17in 7mo	NIS2NIS2European Union Next biennial entity notification	Next biennial entity notification	in 7mo
May 20272
May 1in 7mo	Alabama APDPAAlabama Personal Data Protection Act (APDPA)Alabama APDPA takes effect	APDPA takes effect	in 7mo
May 13in 8mo	India DPDPIndia DPDP ActIndia Main data fiduciary obligations apply (18 months)	Main data fiduciary obligations apply (18 months)	in 8mo
July 20274
Jul 1in 9mo	CA SB 243California SB 243 (companion chatbots)California First annual report to Office of Suicide Prevention	First annual report to Office of Suicide Prevention	in 9mo
Jul 1in 9mo	Korea PIPASouth Korea PIPASouth Korea Mandatory ISMS-P certification	Mandatory ISMS-P certification	in 9mo
Jul 1in 9mo	Utah AIPAUtah AI Policy ActUtah Scheduled repeal of Title 13, Ch. 72	Scheduled repeal of Title 13, Ch. 72	in 9mo
Jul 31in 10mo	Louisiana LDPALouisiana Data Privacy ActLouisiana 30-day cure period expires	30-day cure period expires	in 10mo
August 20271
Aug 2in 10mo	EU AI ActEU AI ActEuropean Union Legacy GPAI models must comply; national AI sandboxes operational	Legacy GPAI models must comply; national AI sandboxes operational	in 10mo
September 20272
Sep 1in 11mo	Vietnam AI LawVietnam AI LawVietnam Transition ends for existing AI systems in health, education and finance	Transition ends for existing AI systems in health, education and finance	in 11mo
Sep 12in 12mo	EU Data ActEU Data ActEuropean Union Unfair-terms rules extend to older long-term contracts	Unfair-terms rules extend to older long-term contracts	in 12mo
October 20271
Oct 17in 13mo	NIS2NIS2European Union Commission review of NIS2	Commission review of NIS2	in 13mo
November 20271
Nov 10in 14mo	CMMC 2.0CMMC 2.0United States (Federal) Phase 3: Level 3 certification	Phase 3: Level 3 certification	in 14mo
December 20275
Dec 1in 14mo	Chile PDPLChile Personal Data Protection Law (Ley 21.719)Chile Proposed postponement of entry into forcetentative	Proposed postponement of entry into forcetentative	in 14mo
Dec 2in 14mo	EU AI ActEU AI ActEuropean Union High-risk obligations apply to Annex III systems	High-risk obligations apply to Annex III systems	in 14mo
Dec 11in 15mo	EU CRACyber Resilience ActEuropean Union CRA fully applies	CRA fully applies	in 15mo
Dec 24in 15mo	eIDAS 2eIDAS 2 / EU Digital Identity WalletEuropean Union Private relying parties must accept wallets	Private relying parties must accept wallets	in 15mo
Dec 31in 15mo	CCPA / CPRACCPA / CPRACalifornia Risk assessments for pre-existing processing due	Risk assessments for pre-existing processing due	in 15mo
January 20283
Jan 1in 15mo	CA SB 942California AI Transparency Act (SB 942)California Capture device manufacturer duties	Capture device manufacturer duties	in 15mo
Jan 1in 15mo	CA Delete ActCalifornia Delete Act / DROPCalifornia Independent third-party audits begin	Independent third-party audits begin	in 15mo
Jan 1in 15mo	Vermont VDPOSAVermont VDPOSAVermont Vermont Data Privacy and Online Surveillance Act takes effect	Vermont Data Privacy and Online Surveillance Act takes effect	in 15mo
April 20282
Apr 1in 18mo	CCPA / CPRACCPA / CPRACalifornia First risk assessment submission to CPPA	First risk assessment submission to CPPA	in 18mo
Apr 1in 18mo	CCPA / CPRACCPA / CPRACalifornia Cybersecurity audit due: revenue over $100M	Cybersecurity audit due: revenue over $100M	in 18mo
June 20281
Jun 11in 21mo	EU CRACyber Resilience ActEuropean Union Legacy type-examination certificates expire	Legacy type-examination certificates expire	in 21mo
August 20281
Aug 2in 22mo	EU AI ActEU AI ActEuropean Union High-risk obligations apply to Annex I product-embedded systems	High-risk obligations apply to Annex I product-embedded systems	in 22mo
September 20282
Sep 11in 24mo	EU CRACyber Resilience ActEuropean Union Report on single reporting platform	Report on single reporting platform	in 24mo
Sep 12in 24mo	EU Data ActEU Data ActEuropean Union Commission evaluation	Commission evaluation	in 24mo
October 20281
Oct 1in 2y	CTDPAConnecticut Data Privacy Act (CTDPA)Connecticut Data brokers must process state deletion mechanism requests	Data brokers must process state deletion mechanism requests	in 2y
November 20281
Nov 10in 2.1y	CMMC 2.0CMMC 2.0United States (Federal) Phase 4: full implementation	Phase 4: full implementation	in 2.1y
March 20291
Mar 26in 2.5y	EU EHDSEuropean Health Data Space (EHDS)European Union Primary use for first data categories; secondary use framework applies	Primary use for first data categories; secondary use framework applies	in 2.5y
April 20291
Apr 1in 2.5y	CCPA / CPRACCPA / CPRACalifornia Cybersecurity audit due: revenue $50M-$100M	Cybersecurity audit due: revenue $50M-$100M	in 2.5y
June 20291
Jun 30in 2.8y	Vermont VDPOSAVermont VDPOSAVermont Mandatory 60-day cure period expires	Mandatory 60-day cure period expires	in 2.8y
July 20291
Jul 31in 2.9y	Minnesota MCDPAMinnesota Consumer Data Privacy Act (MCDPA)Minnesota Postsecondary institutions must comply	Postsecondary institutions must comply	in 2.9y
January 20301
Jan 1in 3.3y	Colorado AI ActColorado AI ActColorado Mandatory cure period ends	Mandatory cure period ends	in 3.3y
April 20301
Apr 1in 3.5y	CCPA / CPRACCPA / CPRACalifornia Cybersecurity audit due: revenue under $50M	Cybersecurity audit due: revenue under $50M	in 3.5y
August 20301
Aug 2in 3.9y	EU AI ActEU AI ActEuropean Union Public-authority high-risk systems must comply	Public-authority high-risk systems must comply	in 3.9y
December 20302
Dec 11in 4.2y	EU CRACyber Resilience ActEuropean Union First CRA evaluation	First CRA evaluation	in 4.2y
Dec 31in 4.3y	EU AI ActEU AI ActEuropean Union Large-scale EU IT systems must comply	Large-scale EU IT systems must comply	in 4.3y
March 20311
Mar 26in 4.5y	EU EHDSEuropean Health Data Space (EHDS)European Union Primary use for second data categories; EHR systems in service; extra secondary-use categories	Primary use for second data categories; EHR systems in service; extra secondary-use categories	in 4.5y
March 20351
Mar 26in 8.5y	EU EHDSEuropean Health Data Space (EHDS)European Union Third-country participation in secondary use	Third-country participation in secondary use	in 8.5y

Summaries for reference, not legal advice. Check the official text.

Compliance deadlines: what is due next

Rule changes by email