Compliance deadlines: what is due next

524 dated deadlines across 189 regulations, 102 still ahead.

Add to calendar

Apple Calendar or Outlook Google Calendar Download .ics

102 deadlines from today onPast All

Date	Regulation	What happens	When
September 20261
Sep 30in 4 days	UK DUAAData (Use and Access) ActUnited Kingdom ICO abolished; Information Commission takes over	ICO abolished; Information Commission takes over	in 4d
October 20263
Oct 1in 5 days	CTDPAConnecticut Data Privacy Act (CTDPA)Connecticut PA 26-64 (SB 4) amendments take effect	PA 26-64 (SB 4) amendments take effect	in 5d
Oct 1in 5 days	Japan Active Cyber Defense ActJapan Active Cyber Defense ActJapan Registration and incident reporting duties start	Registration and incident reporting duties start	in 5d
Oct 26in 4 weeks	UK CSR BillUK Cyber Security and Resilience BillUnited Kingdom Lords report stage scheduledtentative	Lords report stage scheduledtentative	in 30d
November 20265
Nov 2in 5 weeks	Egypt PDPLEgypt PDPLEgypt One-year compliance window endstentative	One-year compliance window endstentative	in 37d
Nov 10in 6 weeks	CMMC 2.0CMMC 2.0United States (Federal) Phase 2: Level 2 C3PAO certification	Phase 2: Level 2 C3PAO certification	in 45d
Nov 13in 6 weeks	India DPDPIndia DPDP ActIndia Consent Manager registration rule in force (12 months)	Consent Manager registration rule in force (12 months)	in 48d
Nov 20in 7 weeks	CCD2EU Consumer Credit Directive 2 (CCD2)European Union National rules apply	National rules apply	in 55d
Nov 30in 2 months	Peru PDPL and 2024 RegulationPeru PDPL and 2024 RegulationPeru DPO required: medium companies	DPO required: medium companies	in 2mo
December 20269
Dec 1in 2 months	Chile PDPLChile Personal Data Protection Law (Ley 21.719)Chile Law in force	Law in force	in 2mo
Dec 2in 2 months	EU AI ActEU AI ActEuropean Union New bans on sexual deepfakes and CSAM generation; Art 50(2) grace period ends	New bans on sexual deepfakes and CSAM generation; Art 50(2) grace period ends	in 2mo
Dec 2in 2 months	EU Platform Work DirectiveEU Platform Work DirectiveEuropean Union Transposition deadline	Transposition deadline	in 2mo
Dec 9in 2 months	EU PLDProduct Liability DirectiveEuropean Union Transposition deadline; old PLD repealed	Transposition deadline; old PLD repealed	in 2mo
Dec 10in 2 months	AU Privacy ActAustralia Privacy ActAustralia Children's Online Privacy Code must be registered	Children's Online Privacy Code must be registered	in 2mo
Dec 10in 2 months	AU Privacy ActAustralia Privacy ActAustralia Automated decision-making transparency applies	Automated decision-making transparency applies	in 2mo
Dec 24in 2 months	eIDAS 2eIDAS 2 / EU Digital Identity WalletEuropean Union Member States must provide EU Digital Identity Wallets	Member States must provide EU Digital Identity Wallets	in 3mo
Dec 28in 3 months	Malaysia Online Safety ActMalaysia Online Safety ActMalaysia Online Safety Plan due to MCMC	Online Safety Plan due to MCMC	in 3mo
Dec 31in 3 months	Utah App Store Accountability ActUtah App Store Accountability ActUtah Private right of action begins	Private right of action begins	in 3mo
January 202722
Jan 1in 3 months	California AI Auditor RegistryCalifornia AI Auditor RegistryCalifornia Act takes effect	Act takes effect	in 3mo
Jan 1in 3 months	CA SB 942California AI Transparency Act (SB 942)California Large online platform and hosting platform duties	Large online platform and hosting platform duties	in 3mo
Jan 1in 3 months	California Digital Age Assurance ActCalifornia Digital Age Assurance ActCalifornia Age signal duties begin	Age signal duties begin	in 3mo
Jan 1in 3 months	CA SB 53California SB 53 (TFAIA)California First OES anonymized incident report and CDT definition review	First OES anonymized incident report and CDT definition review	in 3mo
Jan 1in 3 months	California SB 976 addictive feedsCalifornia SB 976 addictive feedsCalifornia Age assurance duty and AG rules	Age assurance duty and AG rules	in 3mo
Jan 1in 3 months	CCPA / CPRACCPA / CPRACalifornia ADMT requirements compliance date	ADMT requirements compliance date	in 3mo
Jan 1in 3 months	CCPA / CPRACCPA / CPRACalifornia Browsers must support opt-out preference signal (AB 566)	Browsers must support opt-out preference signal (AB 566)	in 3mo
Jan 1in 3 months	Colorado AI ActColorado AI ActColorado ADMT obligations apply	ADMT obligations apply	in 3mo
Jan 1in 3 months	Colorado AI ActColorado AI ActColorado AG rules due	AG rules due	in 3mo
Jan 1in 3 months	CTDPAConnecticut Data Privacy Act (CTDPA)Connecticut Data broker registration required	Data broker registration required	in 3mo
Jan 1in 3 months	Delaware DPDPADelaware Personal Data Privacy Act (DPDPA)Delaware Amended thresholds and third-party duties take effect	Amended thresholds and third-party duties take effect	in 3mo
Jan 1in 3 months	Louisiana LDPALouisiana Data Privacy ActLouisiana Louisiana Data Privacy Act takes effect	Louisiana Data Privacy Act takes effect	in 3mo
Jan 1in 3 months	NH Privacy ActNew Hampshire Privacy ActNew Hampshire Ban on selling personal data of children under 13 (HB 1460)	Ban on selling personal data of children under 13 (HB 1460)	in 3mo
Jan 1in 3 months	NY RAISE ActNY RAISE ActNew York RAISE Act takes effect	RAISE Act takes effect	in 3mo
Jan 1in 3 months	OKCDPAOklahoma OKCDPAOklahoma Oklahoma Consumer Data Privacy Act takes effect	Oklahoma Consumer Data Privacy Act takes effect	in 3mo
Jan 1in 3 months	UAE Child Digital Safety LawUAE Child Digital Safety LawUnited Arab Emirates Compliance deadline under the Decree by Law	Compliance deadline under the Decree by Law	in 3mo
Jan 1in 3 months	Utah UCPAUtah UCPAUtah UCPA extends to motor vehicle manufacturers	UCPA extends to motor vehicle manufacturers	in 3mo
Jan 1in 3 months	Vermont Kids CodeVermont Kids CodeVermont Takes effect	Takes effect	in 3mo
Jan 12in 3 months	EU Data ActEU Data ActEuropean Union Cloud switching charges abolished	Cloud switching charges abolished	in 4mo
Jan 16in 3 months	Indonesia PDPIndonesia PDP LawIndonesia Implementing regulation GR 33/2026 takes effect	Implementing regulation GR 33/2026 takes effect	in 4mo
Jan 25in 4 months	NY SAFE for Kids ActNY SAFE for Kids ActNew York Act and rules take effect	Act and rules take effect	in 4mo
Jan 31in 4 months	CA Delete ActCalifornia Delete Act / DROPCalifornia Annual data broker registration deadline	Annual data broker registration deadline	in 4mo
February 20272
Feb 5in 4 months	EU Cyber Solidarity ActEU Cyber Solidarity ActEuropean Union First Commission evaluation	First Commission evaluation	in 4mo
Feb 18in 4 months	EU DSADigital Services ActEuropean Union DSA SME impact report	DSA SME impact report	in 5mo
March 20272
Mar 1in 5 months	Vietnam AI LawVietnam AI LawVietnam Transition ends for existing AI systems (general)	Transition ends for existing AI systems (general)	in 5mo
Mar 26in 6 months	EU EHDSEuropean Health Data Space (EHDS)European Union EHDS general application date	EHDS general application date	in 6mo
April 20274
Apr 1in 6 months	Section 1033CFPB Open Banking Rule (Section 1033)United States Tier 2 compliance date (original)tentative	Tier 2 compliance date (original)tentative	in 6mo
Apr 1in 6 months	Maryland MODPAMaryland Online Data Privacy Act (MODPA)Maryland Discretionary 60-day cure period ends	Discretionary 60-day cure period ends	in 6mo
Apr 2in 6 months	GDPRGDPREuropean Union GDPR Procedural Regulation applies	GDPR Procedural Regulation applies	in 6mo
Apr 17in 6 months	NIS2NIS2European Union Next biennial entity notification	Next biennial entity notification	in 7mo
May 20272
May 1in 7 months	Alabama APDPAAlabama Personal Data Protection Act (APDPA)Alabama APDPA takes effect	APDPA takes effect	in 7mo
May 13in 7 months	India DPDPIndia DPDP ActIndia Main data fiduciary obligations apply (18 months)	Main data fiduciary obligations apply (18 months)	in 8mo
June 20271
Jun 30in 9 months	UAE Child Digital Safety LawUAE Child Digital Safety LawUnited Arab Emirates Social media platforms' transition ends	Social media platforms' transition ends	in 9mo
July 20276
Jul 1in 9 months	California Digital Age Assurance ActCalifornia Digital Age Assurance ActCalifornia Deadline for existing devices and apps	Deadline for existing devices and apps	in 9mo
Jul 1in 9 months	CA SB 243California SB 243 (companion chatbots)California First annual report to Office of Suicide Prevention	First annual report to Office of Suicide Prevention	in 9mo
Jul 1in 9 months	Korea PIPASouth Korea PIPASouth Korea Mandatory ISMS-P certification	Mandatory ISMS-P certification	in 9mo
Jul 1in 9 months	Utah AIPAUtah AI Policy ActUtah Scheduled repeal of Title 13, Ch. 72	Scheduled repeal of Title 13, Ch. 72	in 9mo
Jul 1in 9 months	Vietnam Cybersecurity Law 2025Vietnam Cybersecurity Law 2025Vietnam Transition ends for existing systems and products	Transition ends for existing systems and products	in 9mo
Jul 31in 10 months	Louisiana LDPALouisiana Data Privacy ActLouisiana 30-day cure period expires	30-day cure period expires	in 10mo
August 20271
Aug 2in 10 months	EU AI ActEU AI ActEuropean Union Legacy GPAI models must comply; national AI sandboxes operational	Legacy GPAI models must comply; national AI sandboxes operational	in 10mo
September 20273
Sep 1in 11 months	Vietnam AI LawVietnam AI LawVietnam Transition ends for existing AI systems in health, education and finance	Transition ends for existing AI systems in health, education and finance	in 11mo
Sep 10in 11 months	Peru AI Law and RegulationPeru AI Law and RegulationPeru Private sector: transport, commerce, labourtentative	Private sector: transport, commerce, labourtentative	in 11mo
Sep 12in 11 months	EU Data ActEU Data ActEuropean Union Unfair-terms rules extend to older long-term contracts	Unfair-terms rules extend to older long-term contracts	in 12mo
October 20271
Oct 17in 1 year	NIS2NIS2European Union Commission review of NIS2	Commission review of NIS2	in 13mo
November 20273
Nov 10in 1 year	CMMC 2.0CMMC 2.0United States (Federal) Phase 3: Level 3 certification	Phase 3: Level 3 certification	in 13mo
Nov 22in 1 year	Japan Active Cyber Defense ActJapan Active Cyber Defense ActJapan Communications data measures in force (latest date)tentative	Communications data measures in force (latest date)tentative	in 14mo
Nov 30in 1 year	Peru PDPL and 2024 RegulationPeru PDPL and 2024 RegulationPeru DPO required: small companies	DPO required: small companies	in 14mo
December 20275
Dec 1in 1 year	Chile PDPLChile Personal Data Protection Law (Ley 21.719)Chile Proposed postponement of entry into forcetentative	Proposed postponement of entry into forcetentative	in 14mo
Dec 2in 1 year	EU AI ActEU AI ActEuropean Union High-risk obligations apply to Annex III systems	High-risk obligations apply to Annex III systems	in 14mo
Dec 11in 1 year	EU CRACyber Resilience ActEuropean Union CRA fully applies	CRA fully applies	in 15mo
Dec 24in 1 year	eIDAS 2eIDAS 2 / EU Digital Identity WalletEuropean Union Private relying parties must accept wallets	Private relying parties must accept wallets	in 15mo
Dec 31in 1 year	CCPA / CPRACCPA / CPRACalifornia Risk assessments for pre-existing processing due	Risk assessments for pre-existing processing due	in 15mo
January 20284
Jan 1in 1 year	CA SB 942California AI Transparency Act (SB 942)California Capture device manufacturer duties	Capture device manufacturer duties	in 15mo
Jan 1in 1 year	CA Delete ActCalifornia Delete Act / DROPCalifornia Independent third-party audits begin	Independent third-party audits begin	in 15mo
Jan 1in 1 year	Vermont VDPOSAVermont VDPOSAVermont Vermont Data Privacy and Online Surveillance Act takes effect	Vermont Data Privacy and Online Surveillance Act takes effect	in 15mo
Jan 14in 1 year	Taiwan AI Basic ActTaiwan AI Basic ActTaiwan Agencies must align laws with the Acttentative	Agencies must align laws with the Acttentative	in 16mo
February 20281
Feb 1in 1 year	EU CSAM Interim RegulationEU CSAM Interim RegulationEuropean Union Commission implementation report	Commission implementation report	in 16mo
April 20284
Apr 1in 1 year	CCPA / CPRACCPA / CPRACalifornia First risk assessment submission to CPPA	First risk assessment submission to CPPA	in 18mo
Apr 1in 1 year	CCPA / CPRACCPA / CPRACalifornia Cybersecurity audit due: revenue over $100M	Cybersecurity audit due: revenue over $100M	in 18mo
Apr 1in 1 year	Section 1033CFPB Open Banking Rule (Section 1033)United States Tier 3 compliance date (original)tentative	Tier 3 compliance date (original)tentative	in 18mo
Apr 3in 1 year	EU CSAM Interim RegulationEU CSAM Interim RegulationEuropean Union Interim derogation expires	Interim derogation expires	in 18mo
June 20281
Jun 11in 1 year	EU CRACyber Resilience ActEuropean Union Legacy type-examination certificates expire	Legacy type-examination certificates expire	in 21mo
August 20281
Aug 2in 1 year	EU AI ActEU AI ActEuropean Union High-risk obligations apply to Annex I product-embedded systems	High-risk obligations apply to Annex I product-embedded systems	in 22mo
September 20283
Sep 10in 1 year	Peru AI Law and RegulationPeru AI Law and RegulationPeru Private sector: production, agriculture, energy, miningtentative	Private sector: production, agriculture, energy, miningtentative	in 24mo
Sep 11in 1 year	EU CRACyber Resilience ActEuropean Union Report on single reporting platform	Report on single reporting platform	in 24mo
Sep 12in 1 year	EU Data ActEU Data ActEuropean Union Commission evaluation	Commission evaluation	in 24mo
October 20281
Oct 1in 2 years	CTDPAConnecticut Data Privacy Act (CTDPA)Connecticut Data brokers must process state deletion mechanism requests	Data brokers must process state deletion mechanism requests	in 2y
November 20282
Nov 10in 2 years	CMMC 2.0CMMC 2.0United States (Federal) Phase 4: full implementation	Phase 4: full implementation	in 2.1y
Nov 30in 2 years	Peru PDPL and 2024 RegulationPeru PDPL and 2024 RegulationPeru DPO required: micro companies	DPO required: micro companies	in 2.2y
January 20291
Jan 1in 2 years	California AI Auditor RegistryCalifornia AI Auditor RegistryCalifornia Registry opens and registration required	Registry opens and registration required	in 2.3y
March 20291
Mar 26in 2 years	EU EHDSEuropean Health Data Space (EHDS)European Union Primary use for first data categories; secondary use framework applies	Primary use for first data categories; secondary use framework applies	in 2.5y
April 20292
Apr 1in 2 years	CCPA / CPRACCPA / CPRACalifornia Cybersecurity audit due: revenue $50M-$100M	Cybersecurity audit due: revenue $50M-$100M	in 2.5y
Apr 1in 2 years	Section 1033CFPB Open Banking Rule (Section 1033)United States Tier 4 compliance date (original)tentative	Tier 4 compliance date (original)tentative	in 2.5y
June 20291
Jun 30in 2 years	Vermont VDPOSAVermont VDPOSAVermont Mandatory 60-day cure period expires	Mandatory 60-day cure period expires	in 2.8y
July 20291
Jul 31in 2 years	Minnesota MCDPAMinnesota Consumer Data Privacy Act (MCDPA)Minnesota Postsecondary institutions must comply	Postsecondary institutions must comply	in 2.8y
September 20291
Sep 10in 2 years	Peru AI Law and RegulationPeru AI Law and RegulationPeru Private sector: all other usestentative	Private sector: all other usestentative	in 3y
January 20301
Jan 1in 3 years	Colorado AI ActColorado AI ActColorado Mandatory cure period ends	Mandatory cure period ends	in 3.3y
April 20302
Apr 1in 3 years	CCPA / CPRACCPA / CPRACalifornia Cybersecurity audit due: revenue under $50M	Cybersecurity audit due: revenue under $50M	in 3.5y
Apr 1in 3 years	Section 1033CFPB Open Banking Rule (Section 1033)United States Tier 5 compliance date (original)tentative	Tier 5 compliance date (original)tentative	in 3.5y
August 20301
Aug 2in 3 years	EU AI ActEU AI ActEuropean Union Public-authority high-risk systems must comply	Public-authority high-risk systems must comply	in 3.8y
December 20302
Dec 11in 4 years	EU CRACyber Resilience ActEuropean Union First CRA evaluation	First CRA evaluation	in 4.2y
Dec 31in 4 years	EU AI ActEU AI ActEuropean Union Large-scale EU IT systems must comply	Large-scale EU IT systems must comply	in 4.3y
March 20311
Mar 26in 4 years	EU EHDSEuropean Health Data Space (EHDS)European Union Primary use for second data categories; EHR systems in service; extra secondary-use categories	Primary use for second data categories; EHR systems in service; extra secondary-use categories	in 4.5y
March 20351
Mar 26in 8 years	EU EHDSEuropean Health Data Space (EHDS)European Union Third-country participation in secondary use	Third-country participation in secondary use	in 8.5y

Compliance deadlines: what is due next

Rule changes by email