Calendarby GlyphCompliance deadlines
Tech, data and AI · 137 this year · Subscribe
2026
Coming upThis week
CMMC 2.0: Phase 2: Level 2 C3PAO certificationUnited States (Federal)Phase 2 begins one calendar year after Phase 1; applicable solicitations require CMMC Level 2 third-party (C3PAO) certification (32 CFR 170.3(e)(2)). Not...RegulationsDetails →India DPDP Act: Consent Manager registration rule in force (12 months)IndiaRule 4 (registration and obligations of Consent Managers) comes into force one year after publication.RegulationsDetails →
Coming upNext week
Coming upLater this month
Coming upDecember
Chile Personal Data Protection Law (Ley 21.719): Law in forceChileMain obligations apply and the Personal Data Protection Agency begins supervision.RegulationsDetails →EU AI Act: New bans on sexual deepfakes and CSAM generation; Art 50(2) grace period endsEuropean UnionNew Art 5(1)(ba)/(bb) prohibitions on AI systems that generate non-consensual intimate imagery of identifiable persons or child sexual abuse material apply....RegulationsDetails →EU Platform Work Directive: Transposition deadlineEuropean UnionMember States must bring national laws into force to comply with the Directive (Article 29).RegulationsDetails →Product Liability Directive: Transposition deadline; old PLD repealedEuropean UnionMember States must transpose by 9 Dec 2026 (Art 22). Directive 85/374/EEC is repealed from that date but still applies to products placed on the market...RegulationsDetails →Australia Privacy Act: Automated decision-making transparency appliesAustraliaPrivacy policies must disclose the kinds of personal information used in substantially automated decisions that significantly affect individuals (24 months...RegulationsDetails →Australia Privacy Act: Children's Online Privacy Code must be registeredAustraliaOAIC must develop and register the Children's Online Privacy Code within 24 months of Royal Assent.RegulationsDetails →eIDAS 2 / EU Digital Identity Wallet: Member States must provide EU Digital Identity WalletsEuropean UnionEach Member State must provide at least one wallet within 24 months of the entry into force of the implementing acts under Arts 5a(23) and 5c(6) (Art...RegulationsDetails →Malaysia Online Safety Act: Online Safety Plan due to MCMCMalaysiaLicensed providers must prepare an Online Safety Plan and submit it to MCMC within 180 days of 1 July 2026. Updates are due each year and after material...RegulationsDetails →Utah App Store Accountability Act: Private right of action beginsUtahSection 13-75-401 takes effect.RegulationsDetails →
PastEarlier this month
PastOctober
UK Cyber Security and Resilience Bill: Lords report stage scheduledUnited KingdomHouse of Lords report stage scheduled (committee stage sat 1, 3 and 7 Sept 2026).RegulationsDetails →Connecticut Data Privacy Act (CTDPA): PA 26-64 (SB 4) amendments take effectConnecticutProhibits controllers and third parties from selling precise geolocation data and enacts data broker and other consumer protection provisions.RegulationsDetails →Japan Active Cyber Defense Act: Registration and incident reporting duties startJapanMain provisions take effect, including Chapter 2 duties for special social infrastructure operators to register important computers and report specified...RegulationsDetails →
PastSeptember
Data (Use and Access) Act: ICO abolished; Information Commission takes overUnited KingdomSections 118-119 commence: office of Information Commissioner abolished and functions transferred to the Information Commission (Commencement No. 9...RegulationsDetails →Thailand Cybersecurity Act: Website Security Standard B.E. 2568 enforcedThailandThe website security standard announced on 16 September 2025 becomes enforceable for government agencies, regulators and CII organisations.RegulationsDetails →Australia Social Media Minimum Age: Strengthened enforcement amendments commenceAustraliaThe Online Safety Amendment (Strengthening Enforcement for the Social Media Minimum Age) Act 2026 (No. 83, 2026) commences. The maximum civil penalty for...RegulationsDetails →EU Data Act: Access-by-design for new connected productsEuropean UnionArt 3(1) design obligation (product data and related service data accessible to the user by default) applies to connected products and related services...RegulationsDetails →South Korea PIPA: 2026 PIPA amendments take effectSouth Korea10%-of-revenue fines, CEO accountability, and notice duties for possible breaches apply.RegulationsDetails →Cyber Resilience Act: Vulnerability and incident reporting obligations applyEuropean UnionArt 14: manufacturers must report actively exploited vulnerabilities and severe incidents (24-hour early warning, 72-hour notification) via the single...RegulationsDetails →Peru AI Law and Regulation: Private sector: health, education, justice, security, financePeruHigh-risk and related obligations apply one year after publication for these sectors.RegulationsDetails →California Senate Bill 813: Signed by GovernorCaliforniaGovernor Gavin Newsom signed Senate Bill 813, establishing a framework for independent verification organizations to assess AI systems and models for...RegulationsDetails →California AI Auditor Registry: Signed by GovernorCaliforniaChaptered as Chapter 178, Statutes of 2026.RegulationsDetails →China Small PI Handler Simplified Measures: Simplified measures for small handlers take effectChinaSmall handlers may use simplified notice, audit and assessment methods.RegulationsDetails →
PastAugust
Digital Services Act: ChatGPT designated as VLOSE; Reddit and Roblox as VLOPsEuropean UnionCommission designated ChatGPT as a very large online search engine and Reddit and Roblox as very large online platforms. They have four months (by January...RegulationsDetails →China Data Security Risk Assessment Measures: Risk assessment measures take effectChinaAnnual risk assessment and reporting duties for important data handlers apply.RegulationsDetails →EU e-Evidence Package: e-Evidence Regulation appliesEuropean UnionEuropean Production and Preservation Orders become available.RegulationsDetails →New Zealand Biometric Processing Privacy Code: Grace period ends for existing biometric processingNew ZealandAgencies already using biometrics before the code started must comply by this date.RegulationsDetails →California AI Transparency Act (SB 942): Covered provider duties applyCaliforniaDetection tool, manifest and latent disclosures, and license-revocation duties become operative.RegulationsDetails →EU AI Act: General application: transparency obligations, GPAI fines, most other rulesEuropean UnionThe AI Act's general date of application. Article 50 transparency obligations (chatbot disclosure, deepfake labelling, machine-readable marking of synthetic...RegulationsDetails →California Delete Act / DROP: Data brokers must begin processing DROP deletion requestsCaliforniaBrokers must access DROP at least every 45 days, process verified deletion requests within 45 days, and treat unverified requests as opt-outs of...RegulationsDetails →Connecticut Data Privacy Act (CTDPA): Profiling impact assessments applyConnecticutImpact assessment requirements apply to profiling activities created or generated on or after Aug 1, 2026 (Conn. Gen. Stat. 42-522 as amended). Not legal...RegulationsDetails →
PastJuly
EU CSAM Interim Regulation: New interim regulation enters into forceEuropean UnionPublished in the OJ on Jul 28, 2026; enters into force on the third day.RegulationsDetails →AI state-law preemption EO: FTC policy statement comments closeUnited StatesComment deadline on the proposed FTC AI policy statement.RegulationsDetails →NY SAFE for Kids Act: Rules published in State RegisterNew YorkStarts the 180-day clock.RegulationsDetails →NY SAFE for Kids Act: Final SAFE for Kids rules releasedNew YorkAG releases final 13 NYCRR Part 700 rules.RegulationsDetails →EU AI Act: Digital Omnibus on AI enters into forceEuropean UnionRegulation (EU) 2026/1744 (adopted 8 July 2026, OJ 24 July 2026) enters into force on the third day after publication. Amended Articles 102 to 110 apply...RegulationsDetails →Japan APPI: 2026 APPI amendment act promulgatedJapanAmendment enacted by the Diet on 10 July 2026 and promulgated; main provisions take effect by cabinet order within two years of promulgation.RegulationsDetails →China Anthropomorphic AI Measures: Anthropomorphic AI measures take effectChinaAI disclosure, usage reminders, minor protection, data and security assessment duties apply.RegulationsDetails →AI state-law preemption EO: FTC proposes AI accuracy policy statementUnited StatesFTC publishes a proposed policy statement on deceptive suppression of accuracy in AI systems (91 FR 41638), linked to Section 7 of the EO.RegulationsDetails →Arkansas COPPA 2.0: Takes effectArkansasSection 3: effective on and after July 1, 2026.RegulationsDetails →Connecticut Data Privacy Act (CTDPA): PA 25-113 (SB 1295) amendments take effectConnecticutThresholds drop to 35,000 consumers or any sensitive-data processing or data sale; expanded sensitive data, minors' protections, and LLM-training disclosure...RegulationsDetails →Louisiana app store age verification law: Takes effectLouisianaSection 5: act effective July 1, 2026.RegulationsDetails →Malaysia Online Safety Act: Online Safety Plan and compounding regulations in forceMalaysiaP.U. (A) 244/2026 and P.U. (A) 245/2026 take effect.RegulationsDetails →Nebraska Kids Code: Civil penalties availableNebraskaAG may begin actions to recover civil penalties.RegulationsDetails →New Jersey NJDPA: Mandatory 30-day cure period expiresNew JerseyThe Division's duty to issue a cure notice before enforcement ends on the first day of the 18th month after the effective date (N.J.S.A. 56:8-166.17(b))....RegulationsDetails →Utah UCPA: Right to correct takes effectUtahConsumers may ask controllers to correct inaccurate personal data (13-61-201(4), as amended by Laws 2025, ch. 468).RegulationsDetails →Vietnam Cybersecurity Law 2025: Cybersecurity Law 2025 takes effectVietnamThe new law takes effect. Law 86/2015/QH13 and Law 24/2018/QH14 cease to have effect.RegulationsDetails →Virginia VCDPA: Ban on selling precise geolocation data (SB 338)VirginiaControllers may not sell consumers' precise geolocation data (1,750-ft radius), replacing the prior consent-based treatment.RegulationsDetails →
PastJune
New Jersey NJDPA: A5328 sensitive data sale ban takes effectNew JerseyA5328, signed June 30, 2026, prohibits selling sensitive personal data; the ban took effect on signing.RegulationsDetails →UAE Child Digital Safety Law: Social media minimum age resolution takes effectUnited Arab EmiratesCabinet Resolution No. 106 of 2026 applies from the day after publication in Official Gazette No. 826 on 29 June 2026.RegulationsDetails →CFPB Open Banking Rule (Section 1033): First compliance date (stayed, enjoined)United StatesLargest data providers (banks with $250B or more in assets; nondepositories with $10B or more in receipts). Originally Apr 1, 2026, moved 90 days by court...RegulationsDetails →Colorado AI Act: Delayed effective date (superseded)ColoradoSB 25B-004 date; superseded by SB 26-189 before it arrived, so no obligations applied.RegulationsDetails →Singapore Online Safety (Relief and Accountability) Act: OSC begins operations and first provisions commenceSingaporeOSC starts taking reports for five harms, and the statutory torts for those harms take effect.RegulationsDetails →Data (Use and Access) Act: Mandatory data protection complaints procedureUnited KingdomControllers must have a process for data subject complaints (s.103 and Sch. 10), per Commencement No. 6 Regulations 2026, reg. 3.RegulationsDetails →UK Cyber Security and Resilience Bill: Passes House of CommonsUnited KingdomReport stage and third reading completed in the Commons after carry-over into the new session.RegulationsDetails →Canada Bill C-36 (PPCDA): Bill C-36 tabled (first reading)CanadaGovernment introduces the PPCDA in the House of Commons.RegulationsDetails →Canada Bill C-8 / CCSPA: Royal AssentCanadaBill C-8 receives Royal Assent (S.C. 2026, c. 9); Telecommunications Act amendments take effect.RegulationsDetails →Cyber Resilience Act: Conformity assessment body provisions applyEuropean UnionChapter IV (Arts 35-51, notification of conformity assessment bodies) applies (Art 71(2)).RegulationsDetails →Alberta POPA: Privacy management programs requiredAlberta, CanadaPublic bodies must establish and implement a privacy management program one year after the section comes into force (s. 25(5)).RegulationsDetails →SEC Regulation S-P: Smaller entities must complyUnited States (Federal)Smaller covered institutions (24 months after Federal Register publication) must comply with the amended Regulation S-P.RegulationsDetails →Illinois AI in Employment Law (HB 3773): IDHR withdraws and postpones proposed rulesIllinoisIDHR withdraws the Subpart J proposal and postpones the June 10, 2026 hearing; no new date announced.RegulationsDetails →
PastMay
eIDAS 2 / EU Digital Identity Wallet: Legacy qualified trust service providers conformity reportEuropean UnionQTSPs qualified before 20 May 2024 had to submit a conformity assessment report proving compliance with Art 24(1), (1a) and (1b) by 21 May 2026. Not legal...RegulationsDetails →TAKE IT DOWN Act: Platform notice-and-removal process requiredUnited States (Federal)Covered platforms must have a clear notice-and-removal process and remove valid reported content within 48 hours (Sec. 3, one year after enactment). Not...RegulationsDetails →Illinois AI in Employment Law (HB 3773): IDHR proposed notice rules publishedIllinoisIDHR publishes proposed Subpart J rules on AI notice in the Illinois Register.RegulationsDetails →Colorado AI Act: SB 26-189 signed (repeal and reenact)ColoradoSB 26-189 replaces SB 24-205 with a narrower ADMT disclosure framework and moves the effective date to January 1, 2027.RegulationsDetails →Texas App Store Accountability Act: Stay pending appeal deniedTexasDistrict court keeps the injunction in place during the state's appeal.RegulationsDetails →Utah App Store Accountability Act: App store and developer duties applyUtahSections 13-75-201 and 13-75-202 take effect.RegulationsDetails →Digital Markets Act: DMA first reviewEuropean UnionCommission evaluation of the DMA under Article 53, then every 3 years.RegulationsDetails →New Zealand Biometric Processing Privacy Code: Amendment No. 1 applies (IPP 3A)New ZealandThe amended code, which reflects IPP 3A, is in force from 1 May 2026.RegulationsDetails →New Zealand Privacy Act: IPP 3A indirect-collection notification appliesNew ZealandAgencies collecting personal information from third parties must take reasonable steps to notify individuals, subject to exceptions.RegulationsDetails →
PastApril
COPPA Rule: Full compliance with amended COPPA RuleUnited States (Federal)Operators must comply with all amended provisions (separate third-party disclosure consent, written retention policy, written security program, updated...RegulationsDetails →CoE AI Framework Convention: EU concludes the ConventionCouncil of EuropeCouncil Decision (EU) 2026/1080 approves conclusion on behalf of the EU (published May 13, 2026).RegulationsDetails →NYDFS Cybersecurity Regulation (Part 500): Annual compliance notificationNew YorkAnnual certification or acknowledgment covering calendar year 2025 due.RegulationsDetails →UK Online Safety Act: Fee notification window closes (2026/27)United KingdomFee-liable providers must notify Ofcom before the notification window for the first charging year closes.RegulationsDetails →EU CSAM Interim Regulation: Previous interim regulation expiresEuropean UnionRegulation (EU) 2021/1232, as extended by Regulation (EU) 2024/1307, applied until this date.RegulationsDetails →China Minors Online Protection Regulations: Measures identifying large or influential platforms for minors take effectChinaPlatforms meeting the thresholds (for example 10 million registered or 1 million monthly active minor users) must apply to be designated.RegulationsDetails →Japan Active Cyber Defense Act: Supervisory Commission provisions in forceJapanProvisions setting up the Cyber Communications Information Supervisory Commission take effect, per the e-Gov revision history.RegulationsDetails →Illinois BIPA: Seventh Circuit: amendment applies retroactivelyIllinoisClay v. Union Pacific (No. 25-2185) holds the damages amendment is remedial and applies to pending cases.RegulationsDetails →Maryland Kids Code: Data protection impact assessments dueMarylandCovered entities must complete DPIAs by this date.RegulationsDetails →Maryland Online Data Privacy Act (MODPA): MODPA applies to personal data processingMarylandThe act applies to personal data processing activities from April 1, 2026 (Section 2 of ch. 455).RegulationsDetails →
PastMarch
NY RAISE Act: Chapter amendment S8828 signedNew YorkChapter amendment (ch. 96) finalizes the RAISE Act text.RegulationsDetails →Brazil ECA Digital: ECA Digital in forceBrazilArt. 41-A (as set by Law 15.352/2026, following MP 1.319/2025) fixes entry into force on 17 March 2026.RegulationsDetails →AI state-law preemption EO: Commerce state-law evaluation, BEAD notice and FTC statement dueUnited StatesWithin 90 days of the order: Commerce publishes its list of onerous state AI laws, NTIA issues the BEAD policy notice, and the FTC issues a policy statement...RegulationsDetails →South Korea PIPA: 2026 PIPA amendment promulgated (Act No. 21445)South KoreaAmendment raising fines to 10% of revenue and adding CEO accountability promulgated.RegulationsDetails →Australia Cyber Security Act (ransomware reporting): Smart device security standard appliesAustraliaPart 2 and Schedule 1 of the Cyber Security (Security Standards for Smart Devices) Rules 2025 commence. Manufacturers and suppliers of relevant connectable...RegulationsDetails →China Minors Online Protection Regulations: Classification measures for content harmful to minors take effectChinaImplementing measures classify online information that may affect minors' physical and mental health.RegulationsDetails →Vietnam AI Law: AI Law takes effectVietnamRisk classification, transparency and labeling obligations apply to new AI systems.RegulationsDetails →
PastFebruary
Virginia VCDPA: SB 854 preliminarily enjoined (NetChoice v. Jones)VirginiaE.D. Va. preliminarily enjoined enforcement of the SB 854 social media time-limit provisions on First Amendment grounds; Virginia has appealed. Not legal...RegulationsDetails →India IT Rules amendment on synthetic content: Synthetic content rules take effectIndiaSGI labeling, user declaration and verification duties, and the shorter 3 hour, 36 hour and 2 hour takedown timelines apply.RegulationsDetails →EU e-Evidence Package: Legal representatives Directive transpositionEuropean UnionMember States must transpose Directive (EU) 2023/1544 on designated establishments and legal representatives.RegulationsDetails →HIPAA: Notice of Privacy Practices updates (Part 2 alignment)United States (Federal)Covered entities must update Notices of Privacy Practices under 45 CFR 164.520 for the 2024 Part 2 (substance use disorder records) changes; this NPP piece...RegulationsDetails →Data (Use and Access) Act: Stage 3: main data protection changes commenceUnited KingdomRecognised legitimate interests, ADM reforms, DSAR changes, international transfer test, cookie exemptions and PECR fines at UK GDPR levels apply...RegulationsDetails →UK GDPR: DUAA amendments to UK GDPR commenceUnited KingdomMain Data (Use and Access) Act 2025 Part 5 amendments (recognised legitimate interests, ADM, DSAR, transfers, cookies, PECR fines) apply.RegulationsDetails →Colorado AI Act: Original effective date (superseded)ColoradoOriginal SB 24-205 date; postponed by SB 25B-004, so no obligations applied.RegulationsDetails →
PastJanuary
Minnesota Consumer Data Privacy Act (MCDPA): 30-day cure period expiresMinnesotaThe requirement that the AG send a warning letter and allow 30 days to cure before suing expires Jan 31, 2026 (325M.20(a)).RegulationsDetails →California Delete Act / DROP: Annual data broker registration deadlineCaliforniaData brokers must register with CalPrivacy and pay the annual fee ($6,000 for 2026) by January 31.RegulationsDetails →
| Date | Event | |||
|---|---|---|---|---|
| Coming upThis week | ||||
| Nov 10Tuetomorrow | CMMC 2.0: Phase 2: Level 2 C3PAO certificationPhase 2 begins one calendar year after Phase 1; applicable solicitations require CMMC Level 2 third-party (C3PAO) certification (32 CFR 170.3(e)(2)). Not...United States (Federal) · Regulations | United States (Federal) | one-off | Regulations |
| Nov 13Friin 4 days | India DPDP Act: Consent Manager registration rule in force (12 months)Rule 4 (registration and obligations of Consent Managers) comes into force one year after publication.India · Regulations | India | one-off | Regulations |
| Coming upNext week | ||||
| Nov 20Friin 11 days | EU Consumer Credit Directive 2 (CCD2): National rules applyMember States must apply the transposing measures from this date and the 2008 Directive is repealed.European Union · Regulations | European Union | one-off | Regulations |
| Coming upLater this month | ||||
| Nov 30Monin 3 weeks | Peru PDPL and 2024 Regulation: DPO required: medium companiesCompanies with annual sales above 1,700 UIT up to 2,300 UIT.Peru · Regulations | Peru | one-off | Regulations |
| Coming upDecember | ||||
| Dec 1Tuein 3 weeks | Chile Personal Data Protection Law (Ley 21.719): Law in forceMain obligations apply and the Personal Data Protection Agency begins supervision.Chile · Regulations | Chile | one-off | Regulations |
| Dec 2Wedin 3 weeks | EU AI Act: New bans on sexual deepfakes and CSAM generation; Art 50(2) grace period endsNew Art 5(1)(ba)/(bb) prohibitions on AI systems that generate non-consensual intimate imagery of identifiable persons or child sexual abuse material apply....European Union · Regulations | European Union | one-off | Regulations |
| EU Platform Work Directive: Transposition deadlineMember States must bring national laws into force to comply with the Directive (Article 29).European Union · Regulations | European Union | one-off | Regulations | |
| Dec 9Wedin 4 weeks | Product Liability Directive: Transposition deadline; old PLD repealedMember States must transpose by 9 Dec 2026 (Art 22). Directive 85/374/EEC is repealed from that date but still applies to products placed on the market...European Union · Regulations | European Union | one-off | Regulations |
| Dec 10Thuin 4 weeks | Australia Privacy Act: Automated decision-making transparency appliesPrivacy policies must disclose the kinds of personal information used in substantially automated decisions that significantly affect individuals (24 months...Australia · Regulations | Australia | one-off | Regulations |
| Australia Privacy Act: Children's Online Privacy Code must be registeredOAIC must develop and register the Children's Online Privacy Code within 24 months of Royal Assent.Australia · Regulations | Australia | one-off | Regulations | |
| Dec 24Thuin 6 weeks | eIDAS 2 / EU Digital Identity Wallet: Member States must provide EU Digital Identity WalletsEach Member State must provide at least one wallet within 24 months of the entry into force of the implementing acts under Arts 5a(23) and 5c(6) (Art...European Union · Regulations | European Union | one-off | Regulations |
| Dec 28Monin 7 weeks | Malaysia Online Safety Act: Online Safety Plan due to MCMCLicensed providers must prepare an Online Safety Plan and submit it to MCMC within 180 days of 1 July 2026. Updates are due each year and after material...Malaysia · Regulations | Malaysia | one-off | Regulations |
| Dec 31Thuin 7 weeks | Utah App Store Accountability Act: Private right of action beginsSection 13-75-401 takes effect.Utah · Regulations | Utah | one-off | Regulations |
| PastEarlier this month | ||||
| Nov 2Mon7 days ago | Egypt PDPL: One-year compliance window endsTentativeArticle 6 of the issuing law gives those covered one year from the issue of the Executive Regulations to comply. The decree's signing date was not shown, so...Egypt · Regulations | Egypt | one-off | Regulations |
| PastOctober | ||||
| Oct 26Mon2 weeks ago | UK Cyber Security and Resilience Bill: Lords report stage scheduledTentativeHouse of Lords report stage scheduled (committee stage sat 1, 3 and 7 Sept 2026).United Kingdom · Regulations | United Kingdom | one-off | Regulations |
| Oct 1Thu5 weeks ago | Connecticut Data Privacy Act (CTDPA): PA 26-64 (SB 4) amendments take effectProhibits controllers and third parties from selling precise geolocation data and enacts data broker and other consumer protection provisions.Connecticut · Regulations | Connecticut | one-off | Regulations |
| Japan Active Cyber Defense Act: Registration and incident reporting duties startMain provisions take effect, including Chapter 2 duties for special social infrastructure operators to register important computers and report specified...Japan · Regulations | Japan | one-off | Regulations | |
| PastSeptember | ||||
| Sep 30Wed5 weeks ago | Data (Use and Access) Act: ICO abolished; Information Commission takes overSections 118-119 commence: office of Information Commissioner abolished and functions transferred to the Information Commission (Commencement No. 9...United Kingdom · Regulations | United Kingdom | one-off | Regulations |
| Sep 16Wed7 weeks ago | Thailand Cybersecurity Act: Website Security Standard B.E. 2568 enforcedThe website security standard announced on 16 September 2025 becomes enforceable for government agencies, regulators and CII organisations.Thailand · Regulations | Thailand | one-off | Regulations |
| Sep 12Sat8 weeks ago | Australia Social Media Minimum Age: Strengthened enforcement amendments commenceThe Online Safety Amendment (Strengthening Enforcement for the Social Media Minimum Age) Act 2026 (No. 83, 2026) commences. The maximum civil penalty for...Australia · Regulations | Australia | one-off | Regulations |
| EU Data Act: Access-by-design for new connected productsArt 3(1) design obligation (product data and related service data accessible to the user by default) applies to connected products and related services...European Union · Regulations | European Union | one-off | Regulations | |
| Sep 11Fri8 weeks ago | South Korea PIPA: 2026 PIPA amendments take effect10%-of-revenue fines, CEO accountability, and notice duties for possible breaches apply.South Korea · Regulations | South Korea | one-off | Regulations |
| Cyber Resilience Act: Vulnerability and incident reporting obligations applyArt 14: manufacturers must report actively exploited vulnerabilities and severe incidents (24-hour early warning, 72-hour notification) via the single...European Union · Regulations | European Union | one-off | Regulations | |
| Sep 10Thu2 months ago | Peru AI Law and Regulation: Private sector: health, education, justice, security, financeTentativeHigh-risk and related obligations apply one year after publication for these sectors.Peru · Regulations | Peru | one-off | Regulations |
| Sep 9Wed2 months ago | California Senate Bill 813: Signed by GovernorUnverifiedGovernor Gavin Newsom signed Senate Bill 813, establishing a framework for independent verification organizations to assess AI systems and models for...California · Regulations | California | one-off | Regulations |
| California AI Auditor Registry: Signed by GovernorChaptered as Chapter 178, Statutes of 2026.California · Regulations | California | one-off | Regulations | |
| Sep 1Tue2 months ago | China Small PI Handler Simplified Measures: Simplified measures for small handlers take effectSmall handlers may use simplified notice, audit and assessment methods.China · Regulations | China | one-off | Regulations |
| PastAugust | ||||
| Aug 31Mon2 months ago | Digital Services Act: ChatGPT designated as VLOSE; Reddit and Roblox as VLOPsCommission designated ChatGPT as a very large online search engine and Reddit and Roblox as very large online platforms. They have four months (by January...European Union · Regulations | European Union | one-off | Regulations |
| Aug 20Thu2 months ago | China Data Security Risk Assessment Measures: Risk assessment measures take effectAnnual risk assessment and reporting duties for important data handlers apply.China · Regulations | China | one-off | Regulations |
| Aug 18Tue2 months ago | EU e-Evidence Package: e-Evidence Regulation appliesEuropean Production and Preservation Orders become available.European Union · Regulations | European Union | one-off | Regulations |
| Aug 3Mon3 months ago | New Zealand Biometric Processing Privacy Code: Grace period ends for existing biometric processingAgencies already using biometrics before the code started must comply by this date.New Zealand · Regulations | New Zealand | one-off | Regulations |
| Aug 2Sun3 months ago | California AI Transparency Act (SB 942): Covered provider duties applyDetection tool, manifest and latent disclosures, and license-revocation duties become operative.California · Regulations | California | one-off | Regulations |
| EU AI Act: General application: transparency obligations, GPAI fines, most other rulesThe AI Act's general date of application. Article 50 transparency obligations (chatbot disclosure, deepfake labelling, machine-readable marking of synthetic...European Union · Regulations | European Union | one-off | Regulations | |
| Aug 1Sat3 months ago | California Delete Act / DROP: Data brokers must begin processing DROP deletion requestsBrokers must access DROP at least every 45 days, process verified deletion requests within 45 days, and treat unverified requests as opt-outs of...California · Regulations | California | one-off | Regulations |
| Connecticut Data Privacy Act (CTDPA): Profiling impact assessments applyImpact assessment requirements apply to profiling activities created or generated on or after Aug 1, 2026 (Conn. Gen. Stat. 42-522 as amended). Not legal...Connecticut · Regulations | Connecticut | one-off | Regulations | |
| PastJuly | ||||
| Jul 31Fri3 months ago | EU CSAM Interim Regulation: New interim regulation enters into forcePublished in the OJ on Jul 28, 2026; enters into force on the third day.European Union · Regulations | European Union | one-off | Regulations |
| AI state-law preemption EO: FTC policy statement comments closeComment deadline on the proposed FTC AI policy statement.United States · Regulations | United States | one-off | Regulations | |
| Jul 29Wed3 months ago | NY SAFE for Kids Act: Rules published in State RegisterStarts the 180-day clock.New York · Regulations | New York | one-off | Regulations |
| Jul 28Tue3 months ago | NY SAFE for Kids Act: Final SAFE for Kids rules releasedAG releases final 13 NYCRR Part 700 rules.New York · Regulations | New York | one-off | Regulations |
| Jul 27Mon3 months ago | EU AI Act: Digital Omnibus on AI enters into forceRegulation (EU) 2026/1744 (adopted 8 July 2026, OJ 24 July 2026) enters into force on the third day after publication. Amended Articles 102 to 110 apply...European Union · Regulations | European Union | one-off | Regulations |
| Jul 17Fri3 months ago | Japan APPI: 2026 APPI amendment act promulgatedAmendment enacted by the Diet on 10 July 2026 and promulgated; main provisions take effect by cabinet order within two years of promulgation.Japan · Regulations | Japan | one-off | Regulations |
| Jul 15Wed3 months ago | China Anthropomorphic AI Measures: Anthropomorphic AI measures take effectAI disclosure, usage reminders, minor protection, data and security assessment duties apply.China · Regulations | China | one-off | Regulations |
| Jul 7Tue4 months ago | AI state-law preemption EO: FTC proposes AI accuracy policy statementFTC publishes a proposed policy statement on deceptive suppression of accuracy in AI systems (91 FR 41638), linked to Section 7 of the EO.United States · Regulations | United States | one-off | Regulations |
| Jul 1Wed4 months ago | Arkansas COPPA 2.0: Takes effectSection 3: effective on and after July 1, 2026.Arkansas · Regulations | Arkansas | one-off | Regulations |
| Connecticut Data Privacy Act (CTDPA): PA 25-113 (SB 1295) amendments take effectThresholds drop to 35,000 consumers or any sensitive-data processing or data sale; expanded sensitive data, minors' protections, and LLM-training disclosure...Connecticut · Regulations | Connecticut | one-off | Regulations | |
| Louisiana app store age verification law: Takes effectSection 5: act effective July 1, 2026.Louisiana · Regulations | Louisiana | one-off | Regulations | |
| Malaysia Online Safety Act: Online Safety Plan and compounding regulations in forceP.U. (A) 244/2026 and P.U. (A) 245/2026 take effect.Malaysia · Regulations | Malaysia | one-off | Regulations | |
| Nebraska Kids Code: Civil penalties availableAG may begin actions to recover civil penalties.Nebraska · Regulations | Nebraska | one-off | Regulations | |
| New Jersey NJDPA: Mandatory 30-day cure period expiresThe Division's duty to issue a cure notice before enforcement ends on the first day of the 18th month after the effective date (N.J.S.A. 56:8-166.17(b))....New Jersey · Regulations | New Jersey | one-off | Regulations | |
| Utah UCPA: Right to correct takes effectConsumers may ask controllers to correct inaccurate personal data (13-61-201(4), as amended by Laws 2025, ch. 468).Utah · Regulations | Utah | one-off | Regulations | |
| Vietnam Cybersecurity Law 2025: Cybersecurity Law 2025 takes effectThe new law takes effect. Law 86/2015/QH13 and Law 24/2018/QH14 cease to have effect.Vietnam · Regulations | Vietnam | one-off | Regulations | |
| Virginia VCDPA: Ban on selling precise geolocation data (SB 338)Controllers may not sell consumers' precise geolocation data (1,750-ft radius), replacing the prior consent-based treatment.Virginia · Regulations | Virginia | one-off | Regulations | |
| PastJune | ||||
| Jun 30Tue4 months ago | New Jersey NJDPA: A5328 sensitive data sale ban takes effectA5328, signed June 30, 2026, prohibits selling sensitive personal data; the ban took effect on signing.New Jersey · Regulations | New Jersey | one-off | Regulations |
| UAE Child Digital Safety Law: Social media minimum age resolution takes effectCabinet Resolution No. 106 of 2026 applies from the day after publication in Official Gazette No. 826 on 29 June 2026.United Arab Emirates · Regulations | United Arab Emirates | one-off | Regulations | |
| CFPB Open Banking Rule (Section 1033): First compliance date (stayed, enjoined)TentativeLargest data providers (banks with $250B or more in assets; nondepositories with $10B or more in receipts). Originally Apr 1, 2026, moved 90 days by court...United States · Regulations | United States | one-off | Regulations | |
| Colorado AI Act: Delayed effective date (superseded)SB 25B-004 date; superseded by SB 26-189 before it arrived, so no obligations applied.Colorado · Regulations | Colorado | one-off | Regulations | |
| Jun 29Mon4 months ago | Singapore Online Safety (Relief and Accountability) Act: OSC begins operations and first provisions commenceOSC starts taking reports for five harms, and the statutory torts for those harms take effect.Singapore · Regulations | Singapore | one-off | Regulations |
| Jun 19Fri4 months ago | Data (Use and Access) Act: Mandatory data protection complaints procedureControllers must have a process for data subject complaints (s.103 and Sch. 10), per Commencement No. 6 Regulations 2026, reg. 3.United Kingdom · Regulations | United Kingdom | one-off | Regulations |
| Jun 16Tue4 months ago | UK Cyber Security and Resilience Bill: Passes House of CommonsReport stage and third reading completed in the Commons after carry-over into the new session.United Kingdom · Regulations | United Kingdom | one-off | Regulations |
| Jun 15Mon4 months ago | Canada Bill C-36 (PPCDA): Bill C-36 tabled (first reading)Government introduces the PPCDA in the House of Commons.Canada · Regulations | Canada | one-off | Regulations |
| Canada Bill C-8 / CCSPA: Royal AssentBill C-8 receives Royal Assent (S.C. 2026, c. 9); Telecommunications Act amendments take effect.Canada · Regulations | Canada | one-off | Regulations | |
| Jun 11Thu5 months ago | Cyber Resilience Act: Conformity assessment body provisions applyChapter IV (Arts 35-51, notification of conformity assessment bodies) applies (Art 71(2)).European Union · Regulations | European Union | one-off | Regulations |
| Alberta POPA: Privacy management programs requiredPublic bodies must establish and implement a privacy management program one year after the section comes into force (s. 25(5)).Alberta, Canada · Regulations | Alberta, Canada | one-off | Regulations | |
| Jun 3Wed5 months ago | SEC Regulation S-P: Smaller entities must complySmaller covered institutions (24 months after Federal Register publication) must comply with the amended Regulation S-P.United States (Federal) · Regulations | United States (Federal) | one-off | Regulations |
| Jun 2Tue5 months ago | Illinois AI in Employment Law (HB 3773): IDHR withdraws and postpones proposed rulesIDHR withdraws the Subpart J proposal and postpones the June 10, 2026 hearing; no new date announced.Illinois · Regulations | Illinois | one-off | Regulations |
| PastMay | ||||
| May 21Thu5 months ago | eIDAS 2 / EU Digital Identity Wallet: Legacy qualified trust service providers conformity reportQTSPs qualified before 20 May 2024 had to submit a conformity assessment report proving compliance with Art 24(1), (1a) and (1b) by 21 May 2026. Not legal...European Union · Regulations | European Union | one-off | Regulations |
| May 19Tue5 months ago | TAKE IT DOWN Act: Platform notice-and-removal process requiredCovered platforms must have a clear notice-and-removal process and remove valid reported content within 48 hours (Sec. 3, one year after enactment). Not...United States (Federal) · Regulations | United States (Federal) | one-off | Regulations |
| May 15Fri5 months ago | Illinois AI in Employment Law (HB 3773): IDHR proposed notice rules publishedIDHR publishes proposed Subpart J rules on AI notice in the Illinois Register.Illinois · Regulations | Illinois | one-off | Regulations |
| May 14Thu5 months ago | Colorado AI Act: SB 26-189 signed (repeal and reenact)SB 26-189 replaces SB 24-205 with a narrower ADMT disclosure framework and moves the effective date to January 1, 2027.Colorado · Regulations | Colorado | one-off | Regulations |
| May 6Wed6 months ago | Texas App Store Accountability Act: Stay pending appeal deniedDistrict court keeps the injunction in place during the state's appeal.Texas · Regulations | Texas | one-off | Regulations |
| Utah App Store Accountability Act: App store and developer duties applySections 13-75-201 and 13-75-202 take effect.Utah · Regulations | Utah | one-off | Regulations | |
| May 3Sun6 months ago | Digital Markets Act: DMA first reviewCommission evaluation of the DMA under Article 53, then every 3 years.European Union · Regulations | European Union | one-off | Regulations |
| May 1Fri6 months ago | New Zealand Biometric Processing Privacy Code: Amendment No. 1 applies (IPP 3A)The amended code, which reflects IPP 3A, is in force from 1 May 2026.New Zealand · Regulations | New Zealand | one-off | Regulations |
| New Zealand Privacy Act: IPP 3A indirect-collection notification appliesAgencies collecting personal information from third parties must take reasonable steps to notify individuals, subject to exceptions.New Zealand · Regulations | New Zealand | one-off | Regulations | |
| PastApril | ||||
| Apr 22Wed6 months ago | COPPA Rule: Full compliance with amended COPPA RuleOperators must comply with all amended provisions (separate third-party disclosure consent, written retention policy, written security program, updated...United States (Federal) · Regulations | United States (Federal) | one-off | Regulations |
| Apr 21Tue6 months ago | CoE AI Framework Convention: EU concludes the ConventionCouncil Decision (EU) 2026/1080 approves conclusion on behalf of the EU (published May 13, 2026).Council of Europe · Regulations | Council of Europe | one-off | Regulations |
| Apr 15Wed6 months ago | NYDFS Cybersecurity Regulation (Part 500): Annual compliance notificationAnnual certification or acknowledgment covering calendar year 2025 due.New York · Regulations | New York | one-off | Regulations |
| Apr 11Sat7 months ago | UK Online Safety Act: Fee notification window closes (2026/27)Fee-liable providers must notify Ofcom before the notification window for the first charging year closes.United Kingdom · Regulations | United Kingdom | one-off | Regulations |
| Apr 3Fri7 months ago | EU CSAM Interim Regulation: Previous interim regulation expiresRegulation (EU) 2021/1232, as extended by Regulation (EU) 2024/1307, applied until this date.European Union · Regulations | European Union | one-off | Regulations |
| Apr 1Wed7 months ago | China Minors Online Protection Regulations: Measures identifying large or influential platforms for minors take effectPlatforms meeting the thresholds (for example 10 million registered or 1 million monthly active minor users) must apply to be designated.China · Regulations | China | one-off | Regulations |
| Japan Active Cyber Defense Act: Supervisory Commission provisions in forceProvisions setting up the Cyber Communications Information Supervisory Commission take effect, per the e-Gov revision history.Japan · Regulations | Japan | one-off | Regulations | |
| Illinois BIPA: Seventh Circuit: amendment applies retroactivelyClay v. Union Pacific (No. 25-2185) holds the damages amendment is remedial and applies to pending cases.Illinois · Regulations | Illinois | one-off | Regulations | |
| Maryland Kids Code: Data protection impact assessments dueCovered entities must complete DPIAs by this date.Maryland · Regulations | Maryland | one-off | Regulations | |
| Maryland Online Data Privacy Act (MODPA): MODPA applies to personal data processingThe act applies to personal data processing activities from April 1, 2026 (Section 2 of ch. 455).Maryland · Regulations | Maryland | one-off | Regulations | |
| PastMarch | ||||
| Mar 27Fri7 months ago | NY RAISE Act: Chapter amendment S8828 signedChapter amendment (ch. 96) finalizes the RAISE Act text.New York · Regulations | New York | one-off | Regulations |
| Mar 17Tue7 months ago | Brazil ECA Digital: ECA Digital in forceArt. 41-A (as set by Law 15.352/2026, following MP 1.319/2025) fixes entry into force on 17 March 2026.Brazil · Regulations | Brazil | one-off | Regulations |
| Mar 11Wed8 months ago | AI state-law preemption EO: Commerce state-law evaluation, BEAD notice and FTC statement dueWithin 90 days of the order: Commerce publishes its list of onerous state AI laws, NTIA issues the BEAD policy notice, and the FTC issues a policy statement...United States · Regulations | United States | one-off | Regulations |
| Mar 10Tue8 months ago | South Korea PIPA: 2026 PIPA amendment promulgated (Act No. 21445)Amendment raising fines to 10% of revenue and adding CEO accountability promulgated.South Korea · Regulations | South Korea | one-off | Regulations |
| Mar 4Wed8 months ago | Australia Cyber Security Act (ransomware reporting): Smart device security standard appliesPart 2 and Schedule 1 of the Cyber Security (Security Standards for Smart Devices) Rules 2025 commence. Manufacturers and suppliers of relevant connectable...Australia · Regulations | Australia | one-off | Regulations |
| Mar 1Sun8 months ago | China Minors Online Protection Regulations: Classification measures for content harmful to minors take effectImplementing measures classify online information that may affect minors' physical and mental health.China · Regulations | China | one-off | Regulations |
| Vietnam AI Law: AI Law takes effectRisk classification, transparency and labeling obligations apply to new AI systems.Vietnam · Regulations | Vietnam | one-off | Regulations | |
| PastFebruary | ||||
| Feb 27Fri8 months ago | Virginia VCDPA: SB 854 preliminarily enjoined (NetChoice v. Jones)E.D. Va. preliminarily enjoined enforcement of the SB 854 social media time-limit provisions on First Amendment grounds; Virginia has appealed. Not legal...Virginia · Regulations | Virginia | one-off | Regulations |
| Feb 20Fri8 months ago | India IT Rules amendment on synthetic content: Synthetic content rules take effectSGI labeling, user declaration and verification duties, and the shorter 3 hour, 36 hour and 2 hour takedown timelines apply.India · Regulations | India | one-off | Regulations |
| Feb 18Wed8 months ago | EU e-Evidence Package: Legal representatives Directive transpositionMember States must transpose Directive (EU) 2023/1544 on designated establishments and legal representatives.European Union · Regulations | European Union | one-off | Regulations |
| Feb 16Mon8 months ago | HIPAA: Notice of Privacy Practices updates (Part 2 alignment)Covered entities must update Notices of Privacy Practices under 45 CFR 164.520 for the 2024 Part 2 (substance use disorder records) changes; this NPP piece...United States (Federal) · Regulations | United States (Federal) | one-off | Regulations |
| Feb 5Thu9 months ago | Data (Use and Access) Act: Stage 3: main data protection changes commenceRecognised legitimate interests, ADM reforms, DSAR changes, international transfer test, cookie exemptions and PECR fines at UK GDPR levels apply...United Kingdom · Regulations | United Kingdom | one-off | Regulations |
| UK GDPR: DUAA amendments to UK GDPR commenceMain Data (Use and Access) Act 2025 Part 5 amendments (recognised legitimate interests, ADM, DSAR, transfers, cookies, PECR fines) apply.United Kingdom · Regulations | United Kingdom | one-off | Regulations | |
| Feb 1Sun9 months ago | Colorado AI Act: Original effective date (superseded)Original SB 24-205 date; postponed by SB 25B-004, so no obligations applied.Colorado · Regulations | Colorado | one-off | Regulations |
| PastJanuary | ||||
| Jan 31Sat9 months ago | Minnesota Consumer Data Privacy Act (MCDPA): 30-day cure period expiresThe requirement that the AG send a warning letter and allow 30 days to cure before suing expires Jan 31, 2026 (325M.20(a)).Minnesota · Regulations | Minnesota | one-off | Regulations |
| California Delete Act / DROP: Annual data broker registration deadlineData brokers must register with CalPrivacy and pay the annual fee ($6,000 for 2026) by January 31.California · Regulations | California | one-off | Regulations | |