2028 compliance deadlines

20272029

January 20284

ComplianceJan 1, 2028 · in 14 months

California AI Transparency Act (SB 942)Capture device manufacturer dutiesCapture device manufacturer provenance requirements become operative.California

ComplianceJan 1, 2028 · in 14 months

California Delete Act / DROPIndependent third-party audits beginBeginning Jan 1, 2028 and every 3 years thereafter, data brokers must undergo an independent audit of Delete Act compliance.California

Takes effectJan 1, 2028 · in 14 months

Vermont VDPOSAVermont Data Privacy and Online Surveillance Act takes effectAll obligations under Act 145 apply (sec. 4).Vermont

Transition endsTentativeJan 14, 2028 · in 15 months

TWTaiwan AI Basic ActAgencies must align laws with the ActGovernment agencies must finish amending or adopting laws and administrative measures within 2 years of entry into force (art. 18). Date is computed from the statute.Taiwan

February 20281

ReportingFeb 1, 2028 · in 15 months

EUEU CSAM Interim RegulationCommission implementation reportCommission report on implementation, including proportionality and error rates (Article 9).European Union

April 20284

ReportingApr 1, 2028 · in 17 months

CCPA / CPRAFirst risk assessment submission to CPPABusinesses must submit required risk assessment information and attestation for assessments conducted in 2026 and 2027 (11 CCR 7157(a)(1)); annually by April 1 thereafter.California

ReportingApr 1, 2028 · in 17 months

CCPA / CPRACybersecurity audit due: revenue over $100MFirst cybersecurity audit report (covering Jan 1, 2027 - Jan 1, 2028) and certification due for businesses with 2026 annual gross revenue over $100M (11 CCR 7121(a)(1)).California

ComplianceTentativeApr 1, 2028 · in 17 months

CFPB Open Banking Rule (Section 1033)Tier 3 compliance date (original)Banks with $3B to $10B in assets. Original date; subject to stay, extension and injunction.United States

SunsetApr 3, 2028 · in 17 months

EUEU CSAM Interim RegulationInterim derogation expiresThe Regulation applies until this date.European Union

June 20281

SunsetJun 11, 2028 · in 20 months

EUCyber Resilience ActLegacy type-examination certificates expireEU type-examination certificates and approval decisions on cybersecurity requirements under other harmonisation legislation remain valid until this date unless they expire earlier (Art 69(1)).European Union

August 20281

ComplianceAug 2, 2028 · in 21 months

EUEU AI ActHigh-risk obligations apply to Annex I product-embedded systemsChapter III Sections 1-3 apply to AI systems classified high-risk under Art 6(1) and Annex I (safety components of products covered by EU harmonisation legislation). Deferred from 2 Aug 2027 by Regulation (EU) 2026/1744.European Union

September 20283

ComplianceTentativeSep 10, 2028 · in 23 months

PEPeru AI Law and RegulationPrivate sector: production, agriculture, energy, miningObligations apply three years after publication.Peru

ReportingSep 11, 2028 · in 23 months

EUCyber Resilience ActReport on single reporting platformCommission report assessing the single reporting platform's effectiveness (Art 70(2)).European Union

ReportingSep 12, 2028 · in 23 months

EUEU Data ActCommission evaluationCommission evaluation report due, including the impact of cloud switching rules (Arts 23-31) (Art 49(2)).European Union

October 20281

ComplianceOct 1, 2028 · in 23 months

Connecticut Data Privacy Act (CTDPA)Data brokers must process state deletion mechanism requestsRegistered data brokers must access the DCP accessible deletion mechanism at least every 45 days and process deletion requests.Connecticut

November 20282

ComplianceNov 10, 2028 · in 2 years

CMMC 2.0Phase 4: full implementationCMMC requirements included in all applicable DoD solicitations and contracts, including option periods (32 CFR 170.3(e)(4)).United States (Federal)

ComplianceNov 30, 2028 · in 2.1 years

PEPeru PDPL and 2024 RegulationDPO required: micro companiesMicro companies with annual sales up to 150 UIT.Peru