2027 compliance deadlines

20262028

January 202722

Takes effectJan 1, 2027 · in 2 months

California AI Auditor RegistryAct takes effectDefault effective date for 2026 regular-session statutes.California

ComplianceJan 1, 2027 · in 2 months

California AI Transparency Act (SB 942)Large online platform and hosting platform dutiesLarge online platforms and GenAI hosting platforms must meet the provenance duties added by AB 853.California

Takes effectJan 1, 2027 · in 2 months

California Digital Age Assurance ActAge signal duties beginOS providers must offer the age interface at account setup and developers must request signals.California

ReportingJan 1, 2027 · in 2 months

California SB 53 (TFAIA)First OES anonymized incident report and CDT definition reviewOES begins publishing annual anonymized incident summaries and the Department of Technology begins annual review of the act's definitions; the CalCompute framework report is due to the Legislature.California

ComplianceJan 1, 2027 · in 2 months

California SB 976 addictive feedsAge assurance duty and AG rulesOperators must reasonably determine users are not minors; AG regulations on age assurance and parental consent due.California

ComplianceJan 1, 2027 · in 2 months

CCPA / CPRAADMT requirements compliance dateBusinesses using ADMT for significant decisions must comply with Article 11 (pre-use notice, opt-out, access rights) by this date (11 CCR 7200(b)).California

ComplianceJan 1, 2027 · in 2 months

CCPA / CPRABrowsers must support opt-out preference signal (AB 566)Businesses that develop or maintain a browser must include consumer-configurable functionality to send an opt-out preference signal (Civ. Code 1798.136, operative Jan 1, 2027).California

Takes effectJan 1, 2027 · in 2 months

Colorado AI ActADMT obligations applyDeveloper documentation, consumer notices, post-adverse-outcome disclosure, correction and human-review rights take effect.Colorado

ComplianceJan 1, 2027 · in 2 months

Colorado AI ActAG rules dueAttorney General must adopt rules clarifying the post-adverse-outcome disclosure requirements.Colorado

ComplianceJan 1, 2027 · in 2 months

Connecticut Data Privacy Act (CTDPA)Data broker registration requiredData brokers may not sell or license brokered personal data in Connecticut unless registered with the Department of Consumer Protection ($2,500 initial fee).Connecticut

Takes effectJan 1, 2027 · in 2 months

Delaware Personal Data Privacy Act (DPDPA)Amended thresholds and third-party duties take effectApplicability drops to 10,000 consumers (or 5,000 + 20% revenue from sale) and new third-party duties (12D-107A) apply.Delaware

Takes effectJan 1, 2027 · in 2 months

LALouisiana Data Privacy ActLouisiana Data Privacy Act takes effectConsumer rights and controller duties apply (Act 502, Section 2); data protection assessment requirements apply to processing from this date.Louisiana

Takes effectJan 1, 2027 · in 2 months

NHNew Hampshire Privacy ActBan on selling personal data of children under 13 (HB 1460)HB 1460 (2026, ch. 168) prohibits controllers from selling the personal data of a child under 13.New Hampshire

Takes effectJan 1, 2027 · in 2 months

NY RAISE ActRAISE Act takes effectTransparency reports, frontier AI frameworks, incident reporting and DFS disclosure filings apply.New York

Takes effectJan 1, 2027 · in 2 months

OKOklahoma OKCDPAOklahoma Consumer Data Privacy Act takes effectAll OKCDPA obligations and consumer rights apply.Oklahoma

ComplianceJan 1, 2027 · in 2 months

UAE Child Digital Safety LawCompliance deadline under the Decree by LawArticle 18: those covered must comply within one year from entry into force. The Cabinet may extend this.United Arab Emirates

Takes effectJan 1, 2027 · in 2 months

Utah UCPAUCPA extends to motor vehicle manufacturersMotor vehicle manufacturers whose vehicles are sold or leased in Utah and that collect personal data through vehicle data systems are covered regardless of the revenue and consumer thresholds (13-61-102, as amended by Laws 2026, ch. 193).Utah

Takes effectJan 1, 2027 · in 2 months

Vermont Kids CodeTakes effect9 V.S.A. sections 2449a to 2449j effective.Vermont

ComplianceJan 12, 2027 · in 3 months

EUEU Data ActCloud switching charges abolishedProviders of data processing services may no longer impose any switching charges on customers (Art 29(1)).European Union

ComplianceJan 16, 2027 · in 3 months

Indonesia PDP LawImplementing regulation GR 33/2026 takes effectDetailed PDP implementing rules (DPIA, cross-border, children's consent) apply, 6 months after the 16 Jul 2026 enactment.Indonesia

Takes effectJan 25, 2027 · in 3 months

NY SAFE for Kids ActAct and rules take effect180 days after State Register publication.New York

ReportingJan 31, 2027 · in 3 months

California Delete Act / DROPAnnual data broker registration deadlineData brokers must renew registration with CalPrivacy by January 31 following each year they meet the definition.California

February 20272

ReportingFeb 5, 2027 · in 3 months

EUEU Cyber Solidarity ActFirst Commission evaluationCommission evaluates the Regulation and reports to Parliament and Council, then every 4 years (Article 25).European Union

ReportingFeb 18, 2027 · in 4 months

EUDigital Services ActDSA SME impact reportCommission report under Article 91 on effects on SMEs.European Union

March 20272

Transition endsMar 1, 2027 · in 4 months

Vietnam AI LawTransition ends for existing AI systems (general)Existing AI systems in most sectors must comply (12-month transition).Vietnam

Takes effectMar 26, 2027 · in 5 months

EUEuropean Health Data Space (EHDS)EHDS general application dateThe regulation applies generally from 26 Mar 2027, subject to the phased exceptions below (final article).European Union

April 20274

ComplianceTentativeApr 1, 2027 · in 5 months

CFPB Open Banking Rule (Section 1033)Tier 2 compliance date (original)Banks with $10B to $250B in assets and smaller nondepositories. Original date in 12 CFR 1033.121; subject to the 90-day stay, planned extension and injunction.United States

EnforcementApr 1, 2027 · in 5 months

Maryland Online Data Privacy Act (MODPA)Discretionary 60-day cure period endsThe Division's discretionary notice-and-cure (at least 60 days) applies only to violations occurring on or before April 1, 2027 (Com. Law 14-4614).Maryland

EnforcementApr 2, 2027 · in 5 months

EUGDPRGDPR Procedural Regulation appliesHarmonised rules for cross-border complaint admissibility, rights to be heard and access to preliminary findings, and investigation timelines apply to DPAs from 2 April 2027 (Regulation (EU) 2025/2518, final article).European Union

ReportingApr 17, 2027 · in 6 months

EUNIS2Next biennial entity notificationCompetent authorities notify the Commission and Cooperation Group of the number of essential and important entities, repeated every two years after 17 Apr 2025 (Art 3(5)).European Union

May 20272

Takes effectMay 1, 2027 · in 6 months

Alabama Personal Data Protection Act (APDPA)APDPA takes effectConsumer rights and controller/processor obligations apply (HB 351 section 12).Alabama

ComplianceMay 13, 2027 · in 7 months

India DPDP ActMain data fiduciary obligations apply (18 months)Rules 3, 5-16, 22 and 23 (notice, security safeguards, breach notification, retention, children's consent, SDF duties, cross-border) come into force 18 months after publication.India

June 20271

ComplianceJun 30, 2027 · in 8 months

UAE Child Digital Safety LawSocial media platforms' transition endsArticle 8 of Cabinet Resolution No. 106 of 2026 gives platforms 12 months from entry into force to comply.United Arab Emirates

July 20276

ComplianceJul 1, 2027 · in 8 months

California Digital Age Assurance ActDeadline for existing devices and appsOS providers must offer the age interface for accounts set up before 2027, and developers must request signals for earlier installs.California

ReportingJul 1, 2027 · in 8 months

California SB 243 (companion chatbots)First annual report to Office of Suicide PreventionOperators begin annual reporting on crisis referrals and detection protocols.California

ComplianceJul 1, 2027 · in 8 months

South Korea PIPAMandatory ISMS-P certificationISMS-P certification becomes mandatory for private entities meeting the statutory criteria.South Korea

SunsetJul 1, 2027 · in 8 months

Utah AI Policy ActScheduled repeal of Title 13, Ch. 72SB 332 extends the AI Policy Act repeal date from May 1, 2025 to July 1, 2027.Utah

Transition endsJul 1, 2027 · in 8 months

Vietnam Cybersecurity Law 2025Transition ends for existing systems and productsInformation systems classified under the 2015 law, and security products already in use, must meet the new law's conditions within 12 months of its effective date.Vietnam

EnforcementJul 31, 2027 · in 9 months

LALouisiana Data Privacy Act30-day cure period expiresAG's obligation to give 30-day notice and allow cure before investigating applies only from Jan 1 through July 31, 2027 (R.S. 51:1780.5(D)).Louisiana

August 20271

ComplianceAug 2, 2027 · in 9 months

EUEU AI ActLegacy GPAI models must comply; national AI sandboxes operationalProviders of GPAI models placed on the market before 2 Aug 2025 must comply (Art 111(3)). Each Member State must have at least one national AI regulatory sandbox operational (Art 57(1) as amended by the Omnibus).European Union

September 20273

Transition endsSep 1, 2027 · in 10 months

Vietnam AI LawTransition ends for existing AI systems in health, education and financeExisting AI systems in healthcare, education and finance must comply (18-month transition).Vietnam

ComplianceTentativeSep 10, 2027 · in 10 months

PEPeru AI Law and RegulationPrivate sector: transport, commerce, labourObligations apply two years after publication.Peru

ComplianceSep 12, 2027 · in 11 months

EUEU Data ActUnfair-terms rules extend to older long-term contractsChapter IV (unfair contractual terms) applies to contracts concluded on or before 12 Sep 2025 that are of indefinite duration or expire at least 10 years from 11 Jan 2024 (Art 50).European Union

October 20271

ReportingOct 17, 2027 · in 12 months

EUNIS2Commission review of NIS2Commission must review the functioning of NIS2 and report to Parliament and Council, then every 36 months (Art 40).European Union

November 20273

ComplianceNov 10, 2027 · in 12 months

CMMC 2.0Phase 3: Level 3 certificationPhase 3 begins one year after Phase 2; Level 3 (DIBCAC) requirements added to applicable solicitations (32 CFR 170.3(e)(3)).United States (Federal)

Takes effectTentativeNov 22, 2027 · in 13 months

Japan Active Cyber Defense ActCommunications data measures in force (latest date)Chapters 3 to 7 on agreements with operators and collection of communications data take effect by Cabinet Order within 2 years and 6 months of promulgation. e-Gov lists 22 Nov 2027 as the outer limit, not a fixed date.Japan

ComplianceNov 30, 2027 · in 13 months

PEPeru PDPL and 2024 RegulationDPO required: small companiesCompanies with annual sales above 150 UIT up to 1,700 UIT.Peru

December 20275

MilestoneTentativeDec 1, 2027 · in 13 months

CLChile Personal Data Protection Law (Ley 21.719)Proposed postponement of entry into forceGovernment bill Boletin 18623-07 (filed 1 Sep 2026, 'suma' urgency) would replace the 24-month vacatio legis in transitional Art 1 with a fixed date of 1 Dec 2027; in first committee stage in the Senate, not law.Chile

ComplianceDec 2, 2027 · in 13 months

EUEU AI ActHigh-risk obligations apply to Annex III systemsChapter III Sections 1-3 (high-risk requirements and provider/deployer obligations) apply to AI systems classified high-risk under Art 6(2) and Annex III (employment, credit scoring, education, biometrics, essential services and similar). Deferred from 2 Aug 2026 by Regulation (EU) 2026/1744.European Union

ComplianceDec 11, 2027 · in 13 months

EUCyber Resilience ActCRA fully appliesAll remaining obligations, including essential cybersecurity requirements, conformity assessment and CE marking, apply (Art 71(2)). Products placed on the market earlier are covered only if substantially modified (Art 69(2)).European Union

ComplianceDec 24, 2027 · in 14 months

EUeIDAS 2 / EU Digital Identity WalletPrivate relying parties must accept walletsPrivate relying parties required by law or contract to use strong user authentication must accept wallets on user request within 36 months of the implementing acts' entry into force (Art 5f(2)).European Union

ComplianceDec 31, 2027 · in 14 months

CCPA / CPRARisk assessments for pre-existing processing dueRisk assessments must be completed and documented for high-risk processing that began before Jan 1, 2026 and continues after (11 CCR 7155(b)).California