| January 202722 | | |
|---|
| in 3moin 3 months |  California AI Auditor RegistryCalifornia AI Auditor RegistryCaliforniaAct takes effect | Act takes effect | in 3mo |
| in 3moin 3 months | CA SB 942California AI Transparency Act (SB 942)California Large online platform and hosting platform duties | Large online platform and hosting platform duties | in 3mo |
| in 3moin 3 months | California Digital Age Assurance ActCalifornia Digital Age Assurance ActCalifornia Age signal duties begin | Age signal duties begin | in 3mo |
| in 3moin 3 months | CA SB 53California SB 53 (TFAIA)California First OES anonymized incident report and CDT definition review | First OES anonymized incident report and CDT definition review | in 3mo |
| in 3moin 3 months | California SB 976 addictive feedsCalifornia SB 976 addictive feedsCalifornia Age assurance duty and AG rules | Age assurance duty and AG rules | in 3mo |
| in 3moin 3 months | CCPA / CPRACCPA / CPRACalifornia ADMT requirements compliance date | ADMT requirements compliance date | in 3mo |
| in 3moin 3 months | CCPA / CPRACCPA / CPRACalifornia Browsers must support opt-out preference signal (AB 566) | Browsers must support opt-out preference signal (AB 566) | in 3mo |
| in 3moin 3 months |  Colorado AI ActColorado AI ActColoradoADMT obligations apply | ADMT obligations apply | in 3mo |
| in 3moin 3 months | Colorado AI ActColorado AI ActColorado AG rules due | AG rules due | in 3mo |
| in 3moin 3 months |  CTDPAConnecticut Data Privacy Act (CTDPA)ConnecticutData broker registration required | Data broker registration required | in 3mo |
| in 3moin 3 months |  Delaware DPDPADelaware Personal Data Privacy Act (DPDPA)DelawareAmended thresholds and third-party duties take effect | Amended thresholds and third-party duties take effect | in 3mo |
| in 3moin 3 months | LALouisiana LDPALouisiana Data Privacy ActLouisiana Louisiana Data Privacy Act takes effect | Louisiana Data Privacy Act takes effect | in 3mo |
| in 3moin 3 months | NHNH Privacy ActNew Hampshire Privacy ActNew Hampshire Ban on selling personal data of children under 13 (HB 1460) | Ban on selling personal data of children under 13 (HB 1460) | in 3mo |
| in 3moin 3 months |  NY RAISE ActNY RAISE ActNew YorkRAISE Act takes effect | RAISE Act takes effect | in 3mo |
| in 3moin 3 months | OKOKCDPAOklahoma OKCDPAOklahoma Oklahoma Consumer Data Privacy Act takes effect | Oklahoma Consumer Data Privacy Act takes effect | in 3mo |
| in 3moin 3 months |  UAE Child Digital Safety LawUAE Child Digital Safety LawUnited Arab EmiratesCompliance deadline under the Decree by Law | Compliance deadline under the Decree by Law | in 3mo |
| in 3moin 3 months |  Utah UCPAUtah UCPAUtahUCPA extends to motor vehicle manufacturers | UCPA extends to motor vehicle manufacturers | in 3mo |
| in 3moin 3 months |  Vermont Kids CodeVermont Kids CodeVermontTakes effect | Takes effect | in 3mo |
| in 3moin 3 months | EUEU Data ActEU Data ActEuropean Union Cloud switching charges abolished | Cloud switching charges abolished | in 4mo |
| in 3moin 3 months |  Indonesia PDPIndonesia PDP LawIndonesiaImplementing regulation GR 33/2026 takes effect | Implementing regulation GR 33/2026 takes effect | in 4mo |
| in 4moin 4 months | NY SAFE for Kids ActNY SAFE for Kids ActNew York Act and rules take effect | Act and rules take effect | in 4mo |
| in 4moin 4 months | CA Delete ActCalifornia Delete Act / DROPCalifornia Annual data broker registration deadline | Annual data broker registration deadline | in 4mo |
| February 20272 | | |
|---|
| in 4moin 4 months | EUEU Cyber Solidarity ActEU Cyber Solidarity ActEuropean Union First Commission evaluation | First Commission evaluation | in 4mo |
| in 4moin 4 months | EUEU DSADigital Services ActEuropean Union DSA SME impact report | DSA SME impact report | in 5mo |
| March 20272 | | |
|---|
| in 5moin 5 months |  Vietnam AI LawVietnam AI LawVietnamTransition ends for existing AI systems (general) | Transition ends for existing AI systems (general) | in 5mo |
| in 6moin 6 months | EUEU EHDSEuropean Health Data Space (EHDS)European Union EHDS general application date | EHDS general application date | in 6mo |
| April 20274 | | |
|---|
| in 6moin 6 months |  Section 1033CFPB Open Banking Rule (Section 1033)United StatesTier 2 compliance date (original)tentative | Tier 2 compliance date (original)tentative | in 6mo |
| in 6moin 6 months |  Maryland MODPAMaryland Online Data Privacy Act (MODPA)MarylandDiscretionary 60-day cure period ends | Discretionary 60-day cure period ends | in 6mo |
| in 6moin 6 months | EUGDPRGDPREuropean Union GDPR Procedural Regulation applies | GDPR Procedural Regulation applies | in 6mo |
| in 6moin 6 months | EUNIS2NIS2European Union Next biennial entity notification | Next biennial entity notification | in 7mo |
| May 20272 | | |
|---|
| in 7moin 7 months |  Alabama APDPAAlabama Personal Data Protection Act (APDPA)AlabamaAPDPA takes effect | APDPA takes effect | in 7mo |
| in 7moin 7 months |  India DPDPIndia DPDP ActIndiaMain data fiduciary obligations apply (18 months) | Main data fiduciary obligations apply (18 months) | in 8mo |
| June 20271 | | |
|---|
| in 9moin 9 months | UAE Child Digital Safety LawUAE Child Digital Safety LawUnited Arab Emirates Social media platforms' transition ends | Social media platforms' transition ends | in 9mo |
| July 20276 | | |
|---|
| in 9moin 9 months | California Digital Age Assurance ActCalifornia Digital Age Assurance ActCalifornia Deadline for existing devices and apps | Deadline for existing devices and apps | in 9mo |
| in 9moin 9 months | CA SB 243California SB 243 (companion chatbots)California First annual report to Office of Suicide Prevention | First annual report to Office of Suicide Prevention | in 9mo |
| in 9moin 9 months |  Korea PIPASouth Korea PIPASouth KoreaMandatory ISMS-P certification | Mandatory ISMS-P certification | in 9mo |
| in 9moin 9 months | Utah AIPAUtah AI Policy ActUtah Scheduled repeal of Title 13, Ch. 72 | Scheduled repeal of Title 13, Ch. 72 | in 9mo |
| in 9moin 9 months | Vietnam Cybersecurity Law 2025Vietnam Cybersecurity Law 2025Vietnam Transition ends for existing systems and products | Transition ends for existing systems and products | in 9mo |
| in 10moin 10 months | LALouisiana LDPALouisiana Data Privacy ActLouisiana 30-day cure period expires | 30-day cure period expires | in 10mo |
| August 20271 | | |
|---|
| in 10moin 10 months | EUEU AI ActEU AI ActEuropean Union Legacy GPAI models must comply; national AI sandboxes operational | Legacy GPAI models must comply; national AI sandboxes operational | in 10mo |
| September 20273 | | |
|---|
| in 11moin 11 months | Vietnam AI LawVietnam AI LawVietnam Transition ends for existing AI systems in health, education and finance | Transition ends for existing AI systems in health, education and finance | in 11mo |
| in 11moin 11 months | PEPeru AI Law and RegulationPeru AI Law and RegulationPeru Private sector: transport, commerce, labourtentative | Private sector: transport, commerce, labourtentative | in 11mo |
| in 11moin 11 months | EUEU Data ActEU Data ActEuropean Union Unfair-terms rules extend to older long-term contracts | Unfair-terms rules extend to older long-term contracts | in 12mo |
| October 20271 | | |
|---|
| in 1yin 1 year | EUNIS2NIS2European Union Commission review of NIS2 | Commission review of NIS2 | in 13mo |
| November 20273 | | |
|---|
| in 1yin 1 year | CMMC 2.0CMMC 2.0United States (Federal) Phase 3: Level 3 certification | Phase 3: Level 3 certification | in 13mo |
| in 1yin 1 year |  Japan Active Cyber Defense ActJapan Active Cyber Defense ActJapanCommunications data measures in force (latest date)tentative | Communications data measures in force (latest date)tentative | in 14mo |
| in 1yin 1 year | PEPeru PDPL and 2024 RegulationPeru PDPL and 2024 RegulationPeru DPO required: small companies | DPO required: small companies | in 14mo |
| December 20275 | | |
|---|
| in 1yin 1 year | CLChile PDPLChile Personal Data Protection Law (Ley 21.719)Chile Proposed postponement of entry into forcetentative | Proposed postponement of entry into forcetentative | in 14mo |
| in 1yin 1 year | EUEU AI ActEU AI ActEuropean Union High-risk obligations apply to Annex III systems | High-risk obligations apply to Annex III systems | in 14mo |
| in 1yin 1 year | EUEU CRACyber Resilience ActEuropean Union CRA fully applies | CRA fully applies | in 15mo |
| in 1yin 1 year | EUeIDAS 2eIDAS 2 / EU Digital Identity WalletEuropean Union Private relying parties must accept wallets | Private relying parties must accept wallets | in 15mo |
| in 1yin 1 year | CCPA / CPRACCPA / CPRACalifornia Risk assessments for pre-existing processing due | Risk assessments for pre-existing processing due | in 15mo |