2028 compliance deadlines

17 data, privacy, AI and cybersecurity deadlines in 2028, across 14 regulations.2027 2029

Add to calendar

Apple Calendar or Outlook Google Calendar Download .ics

17 of 17 deadlines

Date	Regulation	What happens	When
January 20284
Jan 1in 1 year	CA SB 942California AI Transparency Act (SB 942)California Capture device manufacturer duties	Capture device manufacturer duties	in 15mo
Jan 1in 1 year	CA Delete ActCalifornia Delete Act / DROPCalifornia Independent third-party audits begin	Independent third-party audits begin	in 15mo
Jan 1in 1 year	Vermont VDPOSAVermont VDPOSAVermont Vermont Data Privacy and Online Surveillance Act takes effect	Vermont Data Privacy and Online Surveillance Act takes effect	in 15mo
Jan 14in 1 year	Taiwan AI Basic ActTaiwan AI Basic ActTaiwan Agencies must align laws with the Acttentative	Agencies must align laws with the Acttentative	in 16mo
February 20281
Feb 1in 1 year	EU CSAM Interim RegulationEU CSAM Interim RegulationEuropean Union Commission implementation report	Commission implementation report	in 16mo
April 20284
Apr 1in 1 year	CCPA / CPRACCPA / CPRACalifornia First risk assessment submission to CPPA	First risk assessment submission to CPPA	in 18mo
Apr 1in 1 year	CCPA / CPRACCPA / CPRACalifornia Cybersecurity audit due: revenue over $100M	Cybersecurity audit due: revenue over $100M	in 18mo
Apr 1in 1 year	Section 1033CFPB Open Banking Rule (Section 1033)United States Tier 3 compliance date (original)tentative	Tier 3 compliance date (original)tentative	in 18mo
Apr 3in 1 year	EU CSAM Interim RegulationEU CSAM Interim RegulationEuropean Union Interim derogation expires	Interim derogation expires	in 18mo
June 20281
Jun 11in 1 year	EU CRACyber Resilience ActEuropean Union Legacy type-examination certificates expire	Legacy type-examination certificates expire	in 21mo
August 20281
Aug 2in 1 year	EU AI ActEU AI ActEuropean Union High-risk obligations apply to Annex I product-embedded systems	High-risk obligations apply to Annex I product-embedded systems	in 22mo
September 20283
Sep 10in 1 year	Peru AI Law and RegulationPeru AI Law and RegulationPeru Private sector: production, agriculture, energy, miningtentative	Private sector: production, agriculture, energy, miningtentative	in 24mo
Sep 11in 1 year	EU CRACyber Resilience ActEuropean Union Report on single reporting platform	Report on single reporting platform	in 24mo
Sep 12in 1 year	EU Data ActEU Data ActEuropean Union Commission evaluation	Commission evaluation	in 24mo
October 20281
Oct 1in 2 years	CTDPAConnecticut Data Privacy Act (CTDPA)Connecticut Data brokers must process state deletion mechanism requests	Data brokers must process state deletion mechanism requests	in 2y
November 20282
Nov 10in 2 years	CMMC 2.0CMMC 2.0United States (Federal) Phase 4: full implementation	Phase 4: full implementation	in 2.1y
Nov 30in 2 years	Peru PDPL and 2024 RegulationPeru PDPL and 2024 RegulationPeru DPO required: micro companies	DPO required: micro companies	in 2.2y

2028 compliance deadlines

Rule changes by email