AI Compliance Deadlines 2026 to 2028
The dates that matter for AI compliance in the EU, the US states that have legislated, and Australia, in one place. Each entry shows how we checked it.
Last verified October 30, 2026. Add these dates to your calendar (.ics). Not sure which dates apply to you? Try the “Which AI laws apply to me?” checker. Found an error? See our corrections log and how we verify.
Upcoming
2026
- Australia
Automated decision-making transparency (Privacy Act, APP 1.7 to 1.9)
Entities covered by the Australian Privacy Principles must say in their privacy policy when a computer program that uses personal information makes, or carries out a step central to making, a decision that could significantly affect a person's rights or interests.
Affects: Organizations covered by the Privacy Act that use automated decisions.
Checked against an official summary. Sources: OAIC — resources on transparency for AI and automated decision-making
- European Union
New Article 5 prohibition on AI-generated child sexual abuse material
The consolidated text of Article 5 adds prohibitions on AI that generates non-consensual intimate or sexually explicit images of identifiable people and AI that generates child sexual abuse material. The consolidated text dates the second from December 2, 2026. We could not confirm the application date of the first, or the amending instrument, from the Official Journal.
Affects: Providers and deployers of generative AI systems placed on the EU market.
Based on secondary sources — verify before relying on it. Sources: AI Act Explorer — Article 5 (consolidated text); AI Act Explorer — Article 113
2027
- Colorado
SB 26-189 developer duties begin; attorney general rules due
Developers of automated decision-making technology used in consequential decisions must provide deployers with documentation, and the attorney general must adopt rules on post-adverse-outcome disclosures by this date. SB 26-189 repealed and replaced the original SB 24-205, which never took effect. For actions before January 1, 2030 the attorney general must give 60 days' notice and a chance to cure where possible.
Affects: Developers and deployers of automated decision-making tools used for education, employment, housing, financial, insurance, health care or essential government decisions.
Checked against an official summary. Sources: Colorado General Assembly — SB26-189
- California
CPPA automated decision-making technology (ADMT) rules apply
Businesses that use ADMT to make significant decisions about consumers must comply with the ADMT requirements, including pre-use notice and consumer rights, by this date. A business already using ADMT for significant decisions before this date has until this date to comply.
Affects: Businesses subject to the CCPA that use ADMT for significant decisions such as employment, lending, housing or health care.
Checked against the official text. Sources: CPPA — Text of Regulations, Article 11, section 7200(b)
- New York
RAISE Act takes effect
Large developers of frontier AI models must maintain and publish a safety and security protocol and report safety incidents. A chapter amendment signed March 27, 2026 (chapter 96) moved the effective date from 90 days after signing to January 1, 2027.
Affects: Developers of frontier-scale AI models.
Checked against the official text. Sources: NY Senate — S8828 (chapter amendment), section 3; NY Senate — S6953 (RAISE Act)
- Washington
HB 2225 AI companion chatbot rules take effect
Operators of AI companion chatbots take on disclosure and safety duties, including recurring notifications to users during a conversation and stricter intervals for minors.
Affects: Operators of AI companion chatbots available to Washington users.
Checked against an official summary. Sources: Washington Legislature — House Bill Report, HB 2225
- Connecticut
SB 5 (Public Act 26-15) AI companion provisions take effect
Systems built to simulate a sustained human-like relationship with a user take on the act's companion-chatbot duties. The act's other tracks start on different dates.
Affects: Operators of AI companion systems reaching Connecticut users.
Based on secondary sources — verify before relying on it. Sources: Faegre Drinker — Connecticut enacts comprehensive AI regulation (June 2026); KTS Law — What businesses need to know about SB 5
- Washington
HB 1170 AI content provenance rules take effect
Covered providers of generative AI systems must offer a free tool letting the public check whether image, video or audio content was created or materially altered by their system, and support disclosure data in the content. Only the attorney general can enforce it; there is no private right of action.
Affects: Covered providers of generative AI systems that produce image, video or audio content.
Checked against the official text. Sources: Washington Legislature — HB 1170 session law (E2SHB 1170), section 9
- Utah
Artificial Intelligence Policy Act scheduled repeal
SB 332 (2025) extended the Policy Act's repeal date to July 1, 2027. A 2026 legislative interim committee recommended extending it again, but we have not found that enacted, so check the Utah Legislature before planning around either outcome.
Affects: Businesses relying on the Act's disclosure rules and regulatory mitigation program.
Checked against the official text. Sources: Utah Legislature — SB 332 (2025), enrolled
- European Union
High-risk AI obligations apply to standalone Annex III systems
The EU AI Act's high-risk requirements, including provider duties, deployer duties under Article 26 and the fundamental rights impact assessment under Article 27, apply to stand-alone high-risk systems such as those used for employment, credit, education and biometrics. The Digital Omnibus on AI moved this date from August 2, 2026.
Affects: Providers and deployers of Annex III high-risk AI systems.
Based on secondary sources — verify before relying on it. Sources: AI Act Explorer — Article 113 (consolidated text); AI Act Explorer — Article 26
- California
Risk assessments due for processing already under way
For processing that began before the CPPA regulations took effect and continues afterward, a business must complete and document a risk assessment by this date.
Affects: Businesses subject to the CCPA whose processing requires a risk assessment.
Checked against the official text. Sources: CPPA — Text of Regulations, Article 10 (risk assessments)
2028
- Connecticut
SB 5 obligations for recommendation-driven platforms used by minors
The act's farthest-out track covers notification limits, parental controls, warning labels and restrictions on engagement-maximizing feeds for users a platform knows are minors.
Affects: Online platforms that use recommendation algorithms and know a user is a minor.
Based on secondary sources — verify before relying on it. Sources: Faegre Drinker — Connecticut enacts comprehensive AI regulation (June 2026); KTS Law — What businesses need to know about SB 5
- California
First risk assessment submissions and cybersecurity audit reports due to the CPPA
Businesses must submit information on risk assessments conducted in 2026 and 2027 to the CPPA by this date. Businesses with 2026 gross revenue above $100 million must also have their first cybersecurity audit report ready, covering January 1, 2027 to January 1, 2028.
Affects: Businesses subject to the CCPA that run covered risk assessments, and larger businesses subject to cybersecurity audits.
Checked against the official text. Sources: CPPA — Text of Regulations, sections 7157 and the cybersecurity audit article
- European Union
High-risk AI obligations apply to systems embedded in Annex I products
The same high-risk requirements apply to AI systems that are safety components of, or are themselves, products covered by the EU harmonisation legislation listed in Annex I, such as medical devices, machinery and vehicles.
Affects: Manufacturers and providers of regulated products with AI safety components.
Based on secondary sources — verify before relying on it. Sources: AI Act Explorer — Article 113 (consolidated text)
Recently started
- , European Union: General date of application of the EU AI Act, including Article 50 transparency duties. EU AI Act implementation timeline
- , Connecticut: First wave of SB 5 provisions, reported to include the employment AI amendments. Connecticut AI regulation
No scheduled deadline
Neither the United Kingdom nor Canada has an AI-specific statute with a compliance date. Existing privacy, consumer and sector law applies. At the US federal level there is no comprehensive AI statute; see our federal overview.
Watchlist: not yet confirmed
Items we are tracking but have kept out of the calendar because the date or scope is not settled.
- Illinois: HB 3773 notice rules. The Illinois Department of Human Rights proposed notice rules in May 2026 and withdrew them in June. No new timeline has been announced.
- United Kingdom: Frontier AI Bill. The government has said it will introduce a bill to put the AI Security Institute on a statutory footing. We are not aware of a date or of the bill being introduced.
Governome provides general information for educational purposes and is not legal advice. Consult qualified counsel before making compliance decisions. Dates can change when a legislature amends or delays a law; check the linked source before relying on one.