AI Compliance Calendar 2026–2027

Live countdown across global AI-regulatory deadlines. Powered by our open dataset - every entry has a primary regulatory source. Filter by jurisdiction or status. Refresh: this page reads the JSON live; the underlying dataset is updated on a 90-day cycle.

Upcoming deadlines

United States - Colorado

Duties for automated decision-making technology (ADMT) used in consequential decisions apply

upcoming
Regulation: Colorado automated decision-making technology law (SB 26-189), which repeals and reenacts the Colorado AI Act (SB 24-205); none of SB 24-205's operative duties took effect
Scope: Developers and deployers of ADMT used to materially influence a consequential decision (education, employment, housing, financial or lending services, insurance, health-care services, essential government services and public benefits)
Affects: Any US-facing SaaS with Colorado users whose software materially influences consequential decisions
Primary obligation: Developers give deployers technical documentation (intended uses, categories of training data, known limitations); deployers give clear notice at the point of interaction and, after an adverse outcome, a plain-language description of the ADMT's role within 30 days; both retain compliance records for at least 3 years
Penalty band: Enforced by the Attorney General under the Colorado Consumer Protection Act (a violation is a deceptive trade practice); 60-day notice and cure before an action until 2030; no private right of action
Source: https://leg.colorado.gov/bills/sb26-189
European Union

GPAI models placed on the market before 2025-08-02 must comply

upcoming
Regulation: EU AI Act (Regulation 2024/1689)
Scope: Models placed on EU market before GPAI obligations effective date
Affects: Pre-existing model versions still being offered (legacy GPT-4, Claude 2/3, Llama 2/3, Mistral pre-2025)
Primary obligation: Same as new GPAI obligations (Article 53)
Penalty band: Same as new GPAI
Source: https://artificialintelligenceact.eu/article/111/
European Union

High-risk obligations for Annex III systems take effect (moved from 2 August 2026 by the Digital Omnibus)

upcoming
Regulation: EU AI Act (Regulation 2024/1689), as amended by the Digital Omnibus on AI (Regulation 2026/1744)
Scope: Providers and deployers of high-risk AI systems classified under Article 6(2) and Annex III (biometric ID, critical infrastructure, education, employment, essential public/private services, law enforcement, migration, justice)
Affects: HR-tech vendors, edtech with grading/admissions AI, credit-scoring fintechs, hiring tools, healthcare AI, recommender systems serving these contexts
Primary obligation: Risk management system, data governance, technical documentation, automatic logging, transparency, human oversight, accuracy/robustness/cybersecurity, post-market monitoring, conformity assessment, EU declaration of conformity, CE marking
Penalty band: Up to €15M or 3% global annual turnover
Source: https://artificialintelligenceact.eu/ai-act-explorer/digital-omnibus/
European Union

High-risk obligations for Annex I systems (AI in regulated products) take effect (moved from 2 August 2027 by the Digital Omnibus)

upcoming
Regulation: EU AI Act (Regulation 2024/1689), as amended by the Digital Omnibus on AI (Regulation 2026/1744)
Scope: AI systems classified as high-risk under Article 6(1) and Annex I: safety components of products covered by EU harmonisation legislation, such as machinery, toys, medical devices and vehicles
Affects: Manufacturers of regulated products that embed AI, and the AI vendors supplying them
Primary obligation: The same Chapter III high-risk requirements, assessed within the product's existing conformity assessment
Penalty band: Up to €15M or 3% global annual turnover
Source: https://artificialintelligenceact.eu/ai-act-explorer/digital-omnibus/

Already in force

India

DPDP Rules including AI/automated processing notice

in force
Regulation: Digital Personal Data Protection Act 2023 - Rules notified 2025
Scope: Data fiduciaries (controllers) processing Indian residents' personal data
Affects: Any platform with Indian users; AI training on Indian-citizen data carries higher consent burden
Primary obligation: Notice in 22 official languages, consent management, breach notification within 72h, children's data heightened protections
Penalty band: Up to ₹2.5B (~$30M) per breach
Source: https://www.meity.gov.in/static/uploads/2025/01/Draft-Digital-Personal-Data-Protection-Rules-2025.pdf
Russian Federation

Personal data localization + processing transparency for AI

in force
Regulation: Federal Law 152-FZ on Personal Data + 2025 AI amendments
Scope: Operators processing personal data of Russian citizens
Affects: Any AI service training on or processing Russian citizens' personal data; cross-border data transfers regulated
Primary obligation: Localization of initial personal data collection in RF; AI processing notice; consent flows; cross-border transfer rules with FSIS list
Penalty band: Up to ₽18M for fortified-localization violations; AI-specific penalty schedule under development
Source: http://publication.pravo.gov.ru/Document/View/0001202407080004
European Union

GPAI (general-purpose AI) provider obligations take effect

in force
Regulation: EU AI Act (Regulation 2024/1689)
Scope: Providers of general-purpose AI models placed on EU market
Affects: OpenAI, Anthropic, Google, Meta, Mistral, AWS, Microsoft, every fine-tuner above the systemic-risk threshold
Primary obligation: Technical documentation, training-data summary, copyright policy, codes of practice. Systemic-risk models: additional evaluations, incident reporting, cybersecurity.
Penalty band: Up to €15M or 3% global annual turnover for non-systemic; €35M / 7% for serious cases
Source: https://artificialintelligenceact.eu/article/53/
United Kingdom

Children's safety duties (highly-effective age verification + content controls)

in force
Regulation: Online Safety Act 2023 - children's safety
Scope: Services likely accessed by children
Affects: Sites with pornographic content, gambling, age-restricted UGC - must implement highly-effective age verification (HEAV); knock-on effect on AI age-estimation vendors
Primary obligation: Highly-effective age verification, content categorization, age-appropriate experiences
Penalty band: Up to £18M or 10% global revenue
Source: https://www.ofcom.org.uk/online-safety/protecting-children/protecting-children-online-our-detailed-codes-and-guidance
United Kingdom

Illegal content risk assessment + safety duties

in force
Regulation: Online Safety Act 2023 - illegal content duties
Scope: User-to-user services and search services in scope of OSA
Affects: Social platforms, forums, comment systems, adult platforms with UGC, search engines
Primary obligation: Risk assessment, take-down, transparency reporting, content-moderation systems (often AI-augmented - qualifies for AI-system obligations downstream)
Penalty band: Up to £18M or 10% global revenue
Source: https://www.legislation.gov.uk/ukpga/2023/50/contents
European Union

Prohibited AI practices take effect

in force
Regulation: EU AI Act (Regulation 2024/1689)
Scope: All providers and deployers placing AI systems on the EU market or using outputs in EU
Affects: Anyone offering or using prohibited AI practices (subliminal manipulation, social scoring, biometric categorization on sensitive grounds, untargeted facial-recognition database scraping, emotion inference in workplace/education with exceptions)
Primary obligation: Cease prohibited practices
Penalty band: Up to €35M or 7% global annual turnover
Source: https://eur-lex.europa.eu/eli/reg/2024/1689/oj
Brazil

AI-system data processing transparency under LGPD

in force
Regulation: LGPD + ANPD AI guidance (Resolution CD/ANPD nº 24/2024)
Scope: AI systems processing Brazilian-resident personal data
Affects: Generative AI vendors offering services in Brazil; training-data sourcing transparency obligations
Primary obligation: DPIA for AI processing, automated-decision review right (LGPD Art. 20), legitimate-interest balancing test
Penalty band: Up to 2% Brazil revenue capped at R$50M per violation
Source: https://www.gov.br/anpd/pt-br/canais_atendimento/agente-de-tratamento/inteligencia-artificial
Singapore

Updated voluntary framework + GenAI-specific guidance

voluntary
Regulation: Model AI Governance Framework v2.0 + AI Verify Foundation guidelines
Scope: All AI developers/deployers serving Singapore market
Affects: Voluntary but de-facto baseline; financial-services regulator (MAS) treats compliance as expected
Primary obligation: Risk management, transparency, robustness, GenAI-specific: hallucination management, data lineage, prompt safety, bias mitigation
Penalty band: Voluntary; non-compliance signals risk for sector regulators
Source: https://aiverifyfoundation.sg/downloads/Model_AI_Governance_Framework_Generative_AI.pdf
United States - New York City

Annual bias audit for AEDTs in hiring

in force
Regulation: NYC Local Law 144 - Automated Employment Decision Tools
Scope: Employers and employment agencies using automated tools for hiring or promotion decisions for NYC-based roles
Affects: HR-tech vendors (Workday, SAP SuccessFactors, Greenhouse, Lever, etc.) and their customers operating in NYC
Primary obligation: Independent annual bias audit, summary publication, candidate notice with opt-out mechanism for the AI tool itself
Penalty band: $500 first violation, $1,500 per subsequent per day
Source: https://rules.cityofnewyork.us/wp-content/uploads/2023/04/DCWP-NOA-for-Use-of-Automated-Employment-Decisionmaking-Tools.pdf
Data source: /data/ai-compliance-deadline-tracker.json - CC-BY-4.0. Each entry includes the primary regulatory source URL. Penalty figures are headline maxima; actual penalties at regulator discretion. Found an error or want a jurisdiction added? info@slavin.ai. See the full DCAT catalog and Open Data index for related datasets.