AI Regulation Deadline Tracker

Which AI law deadlines are next?

Which AI law deadlines are next? This table tracks 157 obligation deadlines across 13 AI laws — 111 already in force, 46 still ahead — each with its statutory citation. Sourced from versioned regulation packs, last verified 2026-09-16.

By the Shieldra Compliance Team · Last updated 2026-09-16

Upcoming AI-law deadlines

Date	Law	Obligation	Applies to	Status / deadline	Citation
2026-10-01	Connecticut AI Act (PA 26-15)	Run and document anti-bias testing — AEDT use is no defense in discrimination claims	developer, deployer	applies from 1 October 2026	Conn. Pub. Act No. 26-15, §§ 13–14 (2026), amending CGS 46a-60(b) and 46a-81c — https://www.cga.ct.gov/2026/ACT/PA/PDF/2026PA-00015-R00SB-00005-PA.PDF
2026-10-01	Connecticut AI Act (PA 26-15)	Pre-sale key-terms notice and written acceptance for AI subscriptions	developer, deployer	applies from 1 October 2026	Conn. Pub. Act No. 26-100, § 46 (2026) (replacing Pub. Act No. 26-15, § 1) — https://www.cga.ct.gov/2026/ACT/PA/PDF/2026PA-00100-R00HB-05222-PA.PDF
2026-10-01	Connecticut AI Act (PA 26-15)	Disclose AI-related layoffs when filing a federal WARN notice with CT DOL	developer, deployer	applies from 1 October 2026	Conn. Pub. Act No. 26-15, § 26 (2026) — https://www.cga.ct.gov/2026/ACT/PA/PDF/2026PA-00015-R00SB-00005-PA.PDF
2026-10-01	Connecticut AI Act (PA 26-15)	Frontier developer: whistleblower anti-retaliation and rights notices	developer, deployer	applies from 1 October 2026	Conn. Pub. Act No. 26-15, § 2(b), (d)–(e) (2026) — https://www.cga.ct.gov/2026/ACT/PA/PDF/2026PA-00015-R00SB-00005-PA.PDF
2026-10-01	Connecticut AI Act (PA 26-15)	Covered generative AI provider: embed tamper-resistant provenance data	developer, deployer	applies from 1 October 2026	Conn. Pub. Act No. 26-15, § 15 (2026) — https://www.cga.ct.gov/2026/ACT/PA/PDF/2026PA-00015-R00SB-00005-PA.PDF
2026-12-02	EU AI Act	Cease or do not launch the prohibited practice	provider, deployer, importer, distributor	prohibited from 2 December 2026 (Art. 5(1)(ba)-(bb), Digital Omnibus)	Art. 5 — https://artificialintelligenceact.eu/article/5/
2026-12-02	EU AI Act	Mark AI-generated content machine-readably	provider	2 December 2026 for systems already on the market before 2 August 2026 (Art. 111(4), Digital Omnibus)	Art. 50(2) — https://artificialintelligenceact.eu/article/50/
2027-01-01	California AI Laws	GenAI hosting platform: do not host non-compliant downloadable systems	developer, deployer	applies from 1 January 2027 (BPC § 22757.3.2 operative date)	Bus. & Prof. Code § 22757.3.2 (AB 853) — https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=BPC&sectionNum=22757.3.2.
2027-01-01	California AI Laws	Deliver the ADMT pre-use notice	developer, deployer	applies from 1 January 2027	Cal. Code Regs. tit. 11, § 7220 — https://cppa.ca.gov/regulations/ccpa_updates.html
2027-01-01	California AI Laws	Build the ADMT opt-out or qualify for an exception	developer, deployer	applies from 1 January 2027	Cal. Code Regs. tit. 11, § 7221 — https://cppa.ca.gov/regulations/ccpa_updates.html
2027-01-01	California AI Laws	Answer ADMT access requests	developer, deployer	applies from 1 January 2027	Cal. Code Regs. tit. 11, § 7222 — https://cppa.ca.gov/regulations/ccpa_updates.html
2027-01-01	Colorado ADMT Law (SB 26-189)	Developer: provide deployers with technical documentation	developer	applies from 1 January 2027	SB 26-189, C.R.S. 6-1-1702(1) — https://leg.colorado.gov/bills/sb26-189
2027-01-01	Colorado ADMT Law (SB 26-189)	Developer: notify deployers of material updates and modifications	developer	applies from 1 January 2027	SB 26-189, C.R.S. 6-1-1702(2) — https://leg.colorado.gov/bills/sb26-189
2027-01-01	Colorado ADMT Law (SB 26-189)	Deployer: give consumers clear notice before ADMT use	deployer	applies from 1 January 2027	SB 26-189, C.R.S. 6-1-1704(1)–(2) — https://leg.colorado.gov/bills/sb26-189
2027-01-01	Colorado ADMT Law (SB 26-189)	Deployer: explain adverse decisions within 30 days	deployer	applies from 1 January 2027	SB 26-189, C.R.S. 6-1-1704(3) — https://leg.colorado.gov/bills/sb26-189
2027-01-01	Colorado ADMT Law (SB 26-189)	Deployer: honour correction and human-review requests after adverse outcomes	deployer	applies from 1 January 2027	SB 26-189, C.R.S. 6-1-1705 — https://leg.colorado.gov/bills/sb26-189
2027-01-01	Colorado ADMT Law (SB 26-189)	Keep compliance records and be ready for the AG cure window	developer, deployer	applies from 1 January 2027	SB 26-189, C.R.S. 6-1-1702(4), 6-1-1703, 6-1-1706 — https://leg.colorado.gov/bills/sb26-189
2027-01-01	Connecticut AI Act (PA 26-15)	AI companion: published crisis protocol and no-human-claim measures	developer, deployer	applies from 1 January 2027	Conn. Pub. Act No. 26-15, § 5(a), (c) (2026) — https://www.cga.ct.gov/2026/ACT/PA/PDF/2026PA-00015-R00SB-00005-PA.PDF
2027-01-01	Connecticut AI Act (PA 26-15)	AI companion: disclose non-human status on the statutory cadence	developer, deployer	applies from 1 January 2027	Conn. Pub. Act No. 26-15, § 5(b)–(c) (2026) — https://www.cga.ct.gov/2026/ACT/PA/PDF/2026PA-00015-R00SB-00005-PA.PDF
2027-01-01	Connecticut AI Act (PA 26-15)	AI companion: minor-user safeguards and parental tools	developer, deployer	applies from 1 January 2027	Conn. Pub. Act No. 26-15, § 6 (2026) — https://www.cga.ct.gov/2026/ACT/PA/PDF/2026PA-00015-R00SB-00005-PA.PDF
2027-01-01	Connecticut AI Act (PA 26-15)	Large frontier developer: anonymous internal catastrophic-risk reporting channel	developer, deployer	required by 1 January 2027	Conn. Pub. Act No. 26-15, § 2(c), (e) (2026) — https://www.cga.ct.gov/2026/ACT/PA/PDF/2026PA-00015-R00SB-00005-PA.PDF
2027-01-01	US Conversational AI (Multi-State)	2027 wave: general conversational-AI duties (CO, NE, ID, IA) — crisis protocol and no-therapy-representation	developer, deployer	applies from 1 January 2027 (CO HB 26-1263) and from 1 July 2027 (NE LB 525, ID S 1297, IA SF 2417)	Idaho Code 48-2103(2)–(3) (S 1297); Neb. LB 525 secs. 16–17; Colo. HB 26-1263; Iowa SF 2417 (Iowa Code ch. 554J) — https://legislature.idaho.gov/wp-content/uploads/sessioninfo/2026/legislation/S1297E1.pdf
2027-01-01	US Conversational AI (Multi-State)	Get ready for the 2027 conversational-AI wave (CO, WA, OR, RI, NE, ID, GA, IA)	developer, deployer	applies from 1 January 2027 (CO HB 26-1263, WA HB 2225, OR SB 1546, RI S 2195) and from 1 July 2027 (NE LB 525, ID S 1297, GA SB 540, IA SF 2417)	Colo. HB 26-1263; Wash. HB 2225; Or. SB 1546; R.I. S 2195; Neb. LB 525; Idaho S 1297; Ga. SB 540; Iowa SF 2417 — https://leg.colorado.gov/bills/HB26-1263
2027-01-01	US Conversational AI (Multi-State)	Document per-state carve-out and safe-harbor fit; re-screen on product changes	developer, deployer	re-verify before the first 2027-wave duties apply from 1 January 2027	Neb. LB 525 (business-entity/narrow-topic exclusions); Ga. SB 540; Wash. HB 2225; N.Y. GBL art. 47; Nev. AB 406 safe harbors — https://nebraskalegislature.gov/FloorDocs/109/PDF/Slip/LB525.pdf
2027-01-01	US State Privacy Laws (AI provisions)	Honor opt-outs from profiling used in significant decisions	controller	California only: automated-decision opt-out applies from 1 January 2027 (new ADMT before first use)	Va. Code §59.1-577(A)(5) and equivalents; 11 CCR §7221 (CCPA ADMT opt-out); Conn. Gen. Stat. §42-518 as amended — https://www.venable.com/insights/publications/2026/07/2026-mid-year-state-privacy-law-update
2027-01-01	US State Privacy Laws (AI provisions)	CCPA automated decision-making: pre-use notice, opt-out, and access	controller	applies from 1 January 2027 for ADMT in use before then; new ADMT must comply before first use	11 CCR §§7200–7222 (CPPA ADMT regulations) — https://cppa.ca.gov/regulations/ccpa_updates.html
2027-08-02	EU AI Act	GPAI model documentation and downstream information	provider	legacy models placed before 2 August 2025: comply by 2 August 2027 (Art. 111(3))	Art. 53(1)(a)-(b) — https://artificialintelligenceact.eu/article/53/
2027-08-02	EU AI Act	Copyright policy and public training-content summary	provider	legacy models placed before 2 August 2025: comply by 2 August 2027 (Art. 111(3))	Art. 53(1)(c)-(d) — https://artificialintelligenceact.eu/article/53/
2027-08-02	EU AI Act	Systemic-risk model duties: evaluations, incident reporting, cybersecurity	provider	legacy models placed before 2 August 2025: comply by 2 August 2027 (Art. 111(3))	Arts. 52, 55 — https://artificialintelligenceact.eu/article/55/
2027-08-02	EU AI Act	Appoint an authorised representative in the EU	provider	2 August 2027 for models placed on the market before 2 August 2025 (Art. 111(3))	Arts. 22, 54 — https://artificialintelligenceact.eu/article/22/
2027-10-01	Connecticut AI Act (PA 26-15)	Deployer: written pre-decision notice for employment AI	developer, deployer	applies from 1 October 2027 (deployments on or after that date)	Conn. Pub. Act No. 26-15, §§ 10–12 (2026) — https://www.cga.ct.gov/2026/ACT/PA/PDF/2026PA-00015-R00SB-00005-PA.PDF
2027-10-01	Connecticut AI Act (PA 26-15)	Deployer: disclose interactive employment AI to the people using it	developer, deployer	applies from 1 October 2027 (deployments on or after that date)	Conn. Pub. Act No. 26-15, §§ 9, 12 (2026) — https://www.cga.ct.gov/2026/ACT/PA/PDF/2026PA-00015-R00SB-00005-PA.PDF
2027-10-01	Connecticut AI Act (PA 26-15)	Developer: supply deployers everything they need for the §§ 9–10 notices	developer, deployer	applies from 1 October 2027 (deployments on or after that date)	Conn. Pub. Act No. 26-15, §§ 8, 11–12 (2026) — https://www.cga.ct.gov/2026/ACT/PA/PDF/2026PA-00015-R00SB-00005-PA.PDF
2027-12-02	EU AI Act	High-risk provider obligations (risk management, data governance, technical docs, logging, oversight, accuracy, QMS, conformity assessment, CE marking, registration, post-market monitoring)	provider	2 December 2027 (Annex III, deferred by the Digital Omnibus)	Arts. 8-21, 43, 47-49, 72-73 — https://artificialintelligenceact.eu/article/8/
2027-12-02	EU AI Act	High-risk deployer duties (use per instructions, human oversight, monitoring, logs, worker notification)	deployer	2 December 2027 (Annex III, deferred by the Digital Omnibus)	Art. 26 — https://artificialintelligenceact.eu/article/26/
2027-12-02	EU AI Act	Fundamental rights impact assessment (FRIA)	deployer	2 December 2027 (deferred by the Digital Omnibus)	Art. 27 — https://artificialintelligenceact.eu/article/27/
2027-12-02	EU AI Act	Importer duties for high-risk AI systems	importer	2 December 2027 (Annex III, deferred by the Digital Omnibus)	Art. 23 — https://artificialintelligenceact.eu/article/23/
2027-12-02	EU AI Act	Distributor duties for high-risk AI systems	distributor	2 December 2027 (Annex III, deferred by the Digital Omnibus)	Art. 24 — https://artificialintelligenceact.eu/article/24/
2027-12-02	EU AI Act	Appoint an authorised representative in the EU	provider	2 December 2027 (Annex III, deferred by the Digital Omnibus)	Arts. 22, 54 — https://artificialintelligenceact.eu/article/22/
2027-12-02	EU AI Act	Document the Art. 6(3) assessment and register the system	provider	before placing on the market; Annex III rules apply from 2 December 2027 (Digital Omnibus)	Arts. 6(4), 49(2) — https://artificialintelligenceact.eu/article/6/
2028-08-02	EU AI Act	High-risk provider obligations (risk management, data governance, technical docs, logging, oversight, accuracy, QMS, conformity assessment, CE marking, registration, post-market monitoring)	provider	2 August 2028 (Annex I, deferred by the Digital Omnibus)	Arts. 8-21, 43, 47-49, 72-73 — https://artificialintelligenceact.eu/article/8/
2028-08-02	EU AI Act	High-risk deployer duties (use per instructions, human oversight, monitoring, logs, worker notification)	deployer	2 August 2028 (Annex I, deferred by the Digital Omnibus)	Art. 26 — https://artificialintelligenceact.eu/article/26/
2028-08-02	EU AI Act	Importer duties for high-risk AI systems	importer	2 August 2028 (Annex I, deferred by the Digital Omnibus)	Art. 23 — https://artificialintelligenceact.eu/article/23/
2028-08-02	EU AI Act	Distributor duties for high-risk AI systems	distributor	2 August 2028 (Annex I, deferred by the Digital Omnibus)	Art. 24 — https://artificialintelligenceact.eu/article/24/
2028-08-02	EU AI Act	Appoint an authorised representative in the EU	provider	2 August 2028 (Annex I, deferred by the Digital Omnibus)	Arts. 22, 54 — https://artificialintelligenceact.eu/article/22/
2028-08-02	EU AI Act	Follow the AI requirements in your sector's type-approval rules	provider, deployer, importer, distributor	Art. 6(1) classification applies from 2 August 2028; requirements arrive through sectoral delegated and implementing acts (Arts. 102-112)	Art. 2(2), Arts. 102-112 — https://artificialintelligenceact.eu/article/2/

AI-law obligations already in force

Date	Law	Obligation	Applies to	Status / deadline	Citation
2013-09-23	US Federal AI Requirements	HIPAA: business associate agreements and risk analysis for AI handling PHI	developer, deployer	in force (Privacy and Security Rules unchanged; Security Rule overhaul targeted for July 2027)	45 CFR Parts 160 and 164; HIPAA Security Rule NPRM, 90 FR 898 (6 Jan. 2025), not final — https://www.hhs.gov/hipaa/for-professionals/index.html
2013-09-23	US Health Care AI Rules	HIPAA: business associate agreements, risk analysis, and no training on PHI without authorization	provider, payer, health_tech_vendor	in force (Privacy and Security Rules unchanged; Security Rule overhaul targeted for July 2027)	45 CFR Parts 160 and 164; HIPAA Security Rule NPRM, 90 FR 898 (6 Jan. 2025), not final — https://www.hhs.gov/hipaa/for-professionals/index.html
2018-05-24	US Federal AI Requirements	FCRA duties when AI decisions use consumer reports	developer, deployer	in force (FCRA §615 notice duties, unchanged)	FCRA §615, 15 U.S.C. 1681m; §604 permissible purpose — https://www.law.cornell.edu/uscode/text/15/1681m
2019-07-01	California AI Laws	Label commercial bots as automated (BOT Act safe harbor)	developer, deployer	in force since 1 July 2019	Bus. & Prof. Code §§ 17940–17941 (BOT Act, SB 1001) — https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=17941&lawCode=BPC
2023-01-01	NYC Local Law 144 (AEDTs)	Annual independent bias audit of each AEDT (audit must be under 1 year old at every use)	employer, employment_agency	in force since 1 January 2023; DCWP enforcement since 5 July 2023	NYC Admin. Code § 20-871(a)(1); 6 RCNY §§ 5-300–5-302 — https://rules.cityofnewyork.us/wp-content/uploads/2023/04/DCWP-NOA-for-Use-of-Automated-Employment-Decisionmaking-Tools-2.pdf
2023-01-01	NYC Local Law 144 (AEDTs)	Publicly post the audit summary and the tool's distribution date before use	employer, employment_agency	in force since 1 January 2023; DCWP enforcement since 5 July 2023	NYC Admin. Code § 20-871(a)(2); 6 RCNY § 5-303 — https://rules.cityofnewyork.us/wp-content/uploads/2023/04/DCWP-NOA-for-Use-of-Automated-Employment-Decisionmaking-Tools-2.pdf
2023-01-01	NYC Local Law 144 (AEDTs)	Give NYC-resident candidates 10 business days' advance notice of AEDT use	employer, employment_agency	in force since 1 January 2023; DCWP enforcement since 5 July 2023	NYC Admin. Code § 20-871(b)(1)–(2); 6 RCNY § 5-304(a)–(c) — https://rules.cityofnewyork.us/wp-content/uploads/2023/04/DCWP-NOA-for-Use-of-Automated-Employment-Decisionmaking-Tools-2.pdf
2023-01-01	NYC Local Law 144 (AEDTs)	Disclose AEDT data types, sources, and retention policy (30-day response duty)	employer, employment_agency	in force since 1 January 2023; DCWP enforcement since 5 July 2023	NYC Admin. Code § 20-871(b)(3); 6 RCNY § 5-304(d) — https://rules.cityofnewyork.us/wp-content/uploads/2023/04/DCWP-NOA-for-Use-of-Automated-Employment-Decisionmaking-Tools-2.pdf
2023-01-01	NYC Local Law 144 (AEDTs)	Halt non-compliant AEDT use until audit, posting, and notice gaps are closed	employer, employment_agency	in force since 1 January 2023; DCWP enforcement since 5 July 2023	NYC Admin. Code §§ 20-871(a), 20-872–20-873 — https://www.dfs.ny.gov/system/files/documents/2022/04/NYC_Council_Automated_Employment_Decision_Tools.pdf
2023-01-01	NYC Local Law 144 (AEDTs)	Keep a per-tool compliance file (audit, posting, notice, and disclosure evidence)	employer, employment_agency	in force since 1 January 2023; DCWP enforcement since 5 July 2023	NYC Admin. Code §§ 20-872–20-874; 6 RCNY § 5-303(c) — https://www.dfs.ny.gov/system/files/documents/2022/04/NYC_Council_Automated_Employment_Decision_Tools.pdf
2023-01-01	US State Privacy Laws (AI provisions)	Privacy-law contract terms with every AI vendor and processor	controller, processor	in force in every state privacy law (California since 2020; latest Indiana, Kentucky, Rhode Island 1 January 2026)	11 CCR §7051 (CCPA service-provider contract terms); Va. Code §59.1-579 and the equivalent processor provisions in each state law — https://www.law.cornell.edu/regulations/california/11-CCR-7051
2023-01-01	US State Privacy Laws (AI provisions)	Privacy notice covers AI uses, profiling, and model training	controller	in force (all state laws require notice of purposes, categories, and third-party sharing)	Conn. Gen. Stat. §42-520 as amended by SB 1295 (2025); Cal. Civ. Code §1798.100; Connecticut AG AI guidance (25 Feb. 2026) — https://www.hunton.com/privacy-and-cybersecurity-law-blog/connecticut-ag-clarifies-ai-compliance-obligations-under-ctdpa
2023-01-01	US State Privacy Laws (AI provisions)	Honor opt-outs from profiling used in significant decisions	controller	in force in 16 states (Virginia since 1 January 2023; latest Indiana, Kentucky, Rhode Island 1 January 2026); California from 1 January 2027	Va. Code §59.1-577(A)(5) and equivalents; 11 CCR §7221 (CCPA ADMT opt-out); Conn. Gen. Stat. §42-518 as amended — https://www.venable.com/insights/publications/2026/07/2026-mid-year-state-privacy-law-update
2023-01-01	US State Privacy Laws (AI provisions)	Data protection assessment before profiling for significant decisions	controller	in force (Virginia since 1 January 2023; Kentucky from 1 June 2026; Maryland per algorithm from 1 April 2026)	Va. Code §59.1-580 and equivalents; Md. Com. Law §14-4607; Conn. SB 1295 (2025) impact assessments; Ky. KCDPA (assessments from 1 June 2026) — https://www.cooley.com/news/insight/2025/2025-09-09-marylands-unique-state-privacy-law-takes-effect-october-1--what-you-should-know
2023-01-01	US State Privacy Laws (AI provisions)	Consent and use limits for sensitive data in AI processing	controller	in force (opt-in consent in the Virginia-model states; California 'limit use' right)	Va. Code §59.1-578(A)(5) and equivalents; Cal. Civ. Code §1798.121; N.J.S.A. 56:8-166.4 et seq. (2026 amendment) — https://www.venable.com/insights/publications/2026/07/2026-mid-year-state-privacy-law-update
2023-01-01	US State Privacy Laws (AI provisions)	Treat vendor model-training on your data as a sale or share with opt-outs	controller	in force (CCPA since 2020; opt-out states since 2023)	Cal. Civ. Code §1798.140(ad), (ah); 11 CCR §7051; state 'sale' definitions — https://www.law.cornell.edu/regulations/california/11-CCR-7051
2023-06-09	US Financial Services AI Rules	GLBA Safeguards: AI tools and vendors inside the information security program	lender_or_creditor, insurer	in force (FTC Safeguards Rule amendments fully effective 9 June 2023; breach notification since May 2024; Interagency Guidelines for banks)	16 CFR Part 314 (FTC Safeguards Rule); Interagency Guidelines Establishing Information Security Standards; 12 CFR Part 364 App. B — https://www.ftc.gov/legal-library/browse/rules/safeguards-rule
2023-12-04	US Financial Services AI Rules	Written AI Systems Program under the NAIC Model Bulletin (or the state's own instrument)	insurer	adopted in 26 jurisdictions between February 2024 and July 2026; Texas TDI Bulletin B-0003-26 since 12 June 2026	NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers (4 Dec. 2023) and state adoptions; Tex. TDI Bulletin B-0003-26 — https://content.naic.org/sites/default/files/legal-adoption-map-ai-model-bulletin.pdf
2024-01-01	US Financial Services AI Rules	Medicare Advantage: individual circumstances, physician review, and prior-authorization timelines	insurer	in force since 1 January 2024 (CMS-4201-F); prior-authorization timelines and denial reasons since 1 January 2026 (CMS-0057-F)	42 CFR 422.101(c), 422.566(d), 422.137; CMS HPMS memo of 6 Feb. 2024 on AI and algorithms; CMS-0057-F — https://www.cms.gov/newsroom/fact-sheets/cms-interoperability-and-prior-authorization-final-rule-cms-0057-f
2024-01-01	US Health Care AI Rules	Coverage decisions: individual circumstances, physician review, no AI-only denials, 2026 prior-authorization timelines	payer	in force since 1 January 2024 (Medicare Advantage); prior-authorization timelines and denial reasons since 1 January 2026; state clinician-review laws in force in at least eleven states	42 CFR 422.101(c), 422.566(d); CMS HPMS memo of 6 Feb. 2024; CMS-0057-F; state payer-AI statutes (CA, AZ, MD, NE, TX, IL, IN, WA, AL, UT, GA) — https://www.kff.org/patient-consumer-protections/regulation-of-ai-in-prior-authorization-and-claims-review-a-look-at-federal-and-state-consumer-protections/
2024-02-08	US Federal AI Requirements	TCPA: prior express consent, identification, and opt-out for AI-generated voice calls	developer, deployer	in force since the FCC's declaratory ruling of 8 February 2024; revocation rules since 11 April 2025	47 U.S.C. 227; 47 CFR 64.1200; FCC Declaratory Ruling FCC 24-17 (CG Docket 23-362) — https://docs.fcc.gov/public/attachments/FCC-24-17A1.pdf
2024-03-18	US Federal AI Requirements	Accurate AI disclosures to investors and clients (no 'AI-washing')	developer, deployer	in force — first SEC AI-washing cases 18 March 2024; FY2026 examination priority	Securities Act §17(a); Exchange Act §10(b) and Rule 10b-5; Advisers Act §206 and Marketing Rule 206(4)-1; SEC FY2026 Examination Priorities (17 Nov. 2025) — https://www.sec.gov/newsroom/press-releases/2024-36
2024-03-18	US Financial Services AI Rules	SEC: accurate AI representations, pre-deployment evaluation, and human oversight	securities_firm	in force — first AI-washing cases 18 March 2024; FY2026 examination priorities (17 November 2025)	Advisers Act §206 and Marketing Rule 206(4)-1; Exchange Act §10(b); SEC FY2026 Examination Priorities — https://www.sec.gov/files/2026-exam-priorities.pdf
2024-03-31	US State Privacy Laws (AI provisions)	Consumer health data outside HIPAA: consent, no sale without authorization, no geofencing (WA, NV)	controller	in force (Washington since 31 March 2024; Nevada since 31 March 2024)	RCW 19.373 (My Health My Data Act); Nev. Rev. Stat. ch. 603A as amended by SB 370 (2023) — https://www.wilmerhale.com/en/insights/blogs/wilmerhale-privacy-and-cybersecurity-law/20250220-first-lawsuit-filed-under-washingtons-my-health-my-data-act
2024-06-27	US Financial Services AI Rules	FINRA: supervise AI under Rules 3110, 2210, and 4511 as technology-neutral rules	securities_firm	in force (rules unchanged; Regulatory Notice 24-09 of 27 June 2024; 2026 Oversight Report of 9 December 2025)	FINRA Rules 3110, 2210, 4511; SEA Rule 17a-4; FINRA Regulatory Notice 24-09; 2026 Annual Regulatory Oversight Report — https://www.finra.org/rules-guidance/notices/24-09
2024-07-11	US Financial Services AI Rules	NYDFS Circular Letter 7: proxy analysis, disparate-impact testing, governance, and transparency for AI underwriting and pricing	insurer	in force since 11 July 2024 (interpreting Insurance Law §§2303, 3221, 4224 and 11 NYCRR 89, 90, 243)	NYDFS Insurance Circular Letter No. 7 (2024) — https://www.dfs.ny.gov/industry-guidance/circular-letters/cl2024-07
2024-09-18	US Health Care AI Rules	Substantiate clinical accuracy and hallucination-rate claims; document intended use and known misuses	health_tech_vendor	in force (FTC Act §5 and state unfair-practice statutes; Texas AG–Pieces Technologies settlement 18 September 2024)	FTC Act §5; Tex. Bus. & Com. Code ch. 17 (DTPA); Texas AG v. Pieces Technologies (AVC, 18 Sept. 2024) — https://www.texasattorneygeneral.gov/news/releases/attorney-general-ken-paxton-reaches-settlement-first-its-kind-healthcare-generative-ai-investigation
2024-09-23	US Federal AI Requirements	Maintain a documented AI risk-management program (NIST AI RMF-aligned)	developer, deployer	expected now — DOJ corporate compliance guidance since 23 September 2024; voluntary framework, statutory safe harbor in Texas	DOJ Evaluation of Corporate Compliance Programs (Sept. 2024); NIST AI RMF 1.0 and NIST AI 600-1 (Generative AI Profile) — https://www.nist.gov/itl/ai-risk-management-framework
2024-09-25	US Federal AI Requirements	Substantiate every AI capability, accuracy, and automation claim before making it	developer, deployer	in force — FTC Act §5; 'Operation AI Comply' enforcement sweep since 25 September 2024	FTC Act §5, 15 U.S.C. 45; FTC Operation AI Comply (25 Sept. 2024) and follow-on orders (Workado, Aug. 2025; Air AI, Mar. 2026; Cox Media Group, Aug. 2026) — https://www.ftc.gov/news-events/news/press-releases/2024/09/ftc-announces-crackdown-deceptive-ai-claims-schemes
2024-10-21	US Federal AI Requirements	No AI-generated or fake reviews and testimonials	developer, deployer	in force since 21 October 2024	FTC Consumer Reviews and Testimonials Rule, 16 CFR Part 465 (89 FR 68077) — https://www.law.cornell.edu/cfr/text/16/part-465
2024-12-19	US Financial Services AI Rules	AI governance your regulator expects: inventory, validation, human oversight, vendor oversight	lender_or_creditor, insurer, securities_firm	expected now (Treasury report of 19 December 2024; regulator examinations)	U.S. Treasury, Uses, Opportunities, and Risks of AI in Financial Services (Dec. 2024); NIST AI RMF 1.0 — https://home.treasury.gov/news/press-releases/jy2760
2025-01-01	US Financial Services AI Rules	State payer-AI laws: a licensed clinician decides every medical-necessity denial; no sole reliance on AI	insurer	in force in stages — CA since 1 Jan 2025, TX since 1 Sep 2025, MD since 1 Oct 2025, NE since 1 Jan 2026, WA since 11 Jun 2026, IN since 1 Jul 2026, AL from 1 Oct 2026, UT and GA from 1 Jan 2027	Cal. Health & Safety Code §1367.01 / Ins. Code §10123.135 (SB 1120); Tex. SB 815; Md. HB 820 and HB 1563; Neb. LB 77; Wash. SB 5395; Ind. HB 1271; Ala. SB 63; Utah SB 319; Ga. SB 544; Ariz. HB 2175; Ill. HB 2472 — https://www.hklaw.com/en/insights/publications/2026/05/states-continue-efforts-to-regulate-ai-in-healthcare
2025-01-01	US Health Care AI Rules	California SB 1120: physicians make medical-necessity decisions; AI tools must use individual history and stay open to audit	payer	in force since 1 January 2025; CDI Guidance SB 1120:1 issued 5 May 2025	Cal. Health & Safety Code §1367.01; Cal. Ins. Code §10123.135(j) (SB 1120, Stats. 2024 ch. 879) — https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202320240SB1120
2025-01-01	US Health Care AI Rules	California AB 3030: disclaimer on AI-generated clinical communications unless a licensed provider reviews them	provider	in force since 1 January 2025	Cal. Health & Safety Code §1339.75 (AB 3030, Stats. 2024) — https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202320240AB3030
2025-01-01	US Health Care AI Rules	ONC-certified health IT: decision-support source attributes and intervention risk management (HTI-1)	health_tech_vendor	compliance since 1 January 2025; HTI-5 proposal to remove the requirements (29 December 2025) not final	45 CFR 170.315(b)(11) (HTI-1 final rule, 89 FR 1192); HTI-5 proposed rule (90 FR, 29 Dec. 2025) — https://www.healthit.gov/topic/laws-regulation-and-policy/hti-5-proposed-rule-fact-sheet
2025-01-27	US Federal AI Requirements	Validate AI hiring and workforce tools and provide accommodations (Title VII, ADA, ADEA)	developer, deployer	in force — statutes unchanged; EEOC AI guidance withdrawn 27 January 2025	Title VII (42 U.S.C. 2000e-2(k)); ADA; ADEA; Uniform Guidelines on Employee Selection Procedures, 29 CFR Part 1607; Mobley v. Workday, No. 3:23-cv-00770 (N.D. Cal.) — https://www.law.cornell.edu/cfr/text/29/part-1607
2025-02-02	EU AI Act	Support the AI literacy of staff operating the system	provider, deployer	in force since 2 February 2025 (wording amended 27 July 2026)	Art. 4 (as amended by Reg. (EU) 2026/1744) — https://artificialintelligenceact.eu/article/4/
2025-02-02	EU AI Act	Cease or do not launch the prohibited practice	provider, deployer, importer, distributor	prohibited since 2 February 2025	Art. 5 — https://artificialintelligenceact.eu/article/5/
2025-05-01	US Federal AI Requirements	Section 1557: identify and mitigate discrimination risk in patient-care decision-support tools	developer, deployer	in force since 1 May 2025 (confirmed unaffected by the October 2025 vacatur; HHS notice of 2 June 2026)	45 CFR §92.210 (89 FR 37522, 6 May 2024); HHS Notice of Vacatur, 91 FR (2 June 2026) — https://www.federalregister.gov/documents/2024/05/06/2024-08711/nondiscrimination-in-health-programs-and-activities
2025-05-01	US Health Care AI Rules	AI inventory and governance for clinical, coverage, and operational AI	provider, payer, health_tech_vendor	expected now (Section 1557 tool identification since 1 May 2025; OIG compliance guidance; DOJ compliance-program evaluation)	45 CFR §92.210; HHS-OIG Medicare Advantage Compliance Program Guidance; DOJ Evaluation of Corporate Compliance Programs (Sept. 2024) — https://www.mcdermottlaw.com/insights/section-1557-patient-care-decision-support-tools-anti-discrimination-compliance-12-things-to-consider/
2025-05-01	US Health Care AI Rules	Section 1557: identify decision-support tools using protected characteristics and mitigate discrimination risk	provider, payer	in force since 1 May 2025; unaffected by the October 2025 vacatur (HHS notice, 2 June 2026)	45 CFR §92.210 (89 FR 37522); HHS Notice of Vacatur, 91 FR (2 June 2026) — https://www.federalregister.gov/documents/2024/05/06/2024-08711/nondiscrimination-in-health-programs-and-activities
2025-05-07	US Conversational AI (Multi-State)	Stop or restructure AI-therapy representations and functions	developer, deployer	in force in stages — UT since 7 May 2025, NV since 1 July 2025, IL since 1 August 2025, VT since 17 June 2026, RI since 22 June 2026, TN since 1 July 2026, ME since 29 July 2026, CO since 12 August 2026, MO since 28 August 2026	Nev. AB 406 (NRS chs. 433/629 new sections); Ill. P.A. 104-0054; R.I. S 2197; Me. LD 2082; Tenn. SB 1580; Vt. Act 156; Colo. HB 26-1195; Utah Code §13-72a; Mo. SB 1019 (§407.3007) — https://archive.leg.state.nv.us/Session/83rd2025/Bills/AB/AB406_EN.pdf
2025-05-07	US Health Care AI Rules	AI therapy and mental-health features: state bans, licensure, and representation limits	provider, payer, health_tech_vendor	in force in stages — UT since 7 May 2025, NV since 1 July 2025, IL since 1 August 2025, VT since 17 June 2026, RI since 22 June 2026, TN since 1 July 2026, ME since 29 July 2026, CO since 12 August 2026, MO since 28 August 2026	Nev. AB 406; Ill. P.A. 104-0054; Utah Code §13-72a; R.I. S 2197; Tenn. SB 1580; Vt. Act 156; Me. LD 2082; Colo. HB 26-1195; Mo. SB 1019 — https://archive.leg.state.nv.us/Session/83rd2025/Bills/AB/AB406_EN.pdf
2025-05-07	Utah AI Policy Act	Regulated professional: disclose AI use prominently in high-risk interactions	regulated_professional	in force since 7 May 2025 (SB 226; the original blanket duty dated from 1 May 2024 and was narrowed)	Utah Code §13-77-103(2)–(3) — https://le.utah.gov/xcode/Title13/Chapter77/13-77.html
2025-05-07	Utah AI Policy Act	Disclose AI use when a consumer clearly asks	business, regulated_professional	as amended 7 May 2025 (SB 226)	Utah Code §13-77-103(1) — https://le.utah.gov/xcode/Title13/Chapter77/13-77.html
2025-05-07	Utah AI Policy Act	Implement the §13-77-104 safe harbor: have the AI identify itself	business, regulated_professional	available since 7 May 2025 (SB 226)	Utah Code §13-77-104 — https://le.utah.gov/xcode/Title13/Chapter77/13-77.html
2025-05-07	Utah AI Policy Act	Mental health chatbot: comply with the Utah 13-72a regime	business, regulated_professional	in force since 7 May 2025 (HB 452)	Utah Code §13-72a (HB 452) — https://le.utah.gov/xcode/Title13/Chapter72a/13-72a.html
2025-07-01	US Health Care AI Rules	Nevada AB 406: no AI delivering care directly; independent review of AI-generated notes	provider	in force since 1 July 2025	Nev. AB 406 (2025), NRS chs. 433 and 629 (new sections) — https://archive.leg.state.nv.us/Session/83rd2025/Bills/AB/AB406_EN.pdf
2025-07-01	US State Privacy Laws (AI provisions)	Biometric identifiers: written consent, policy, and retention schedule (IL, TX, WA, CO)	controller, processor	in force (Illinois BIPA since 2008, amended 2 August 2024; Texas CUBI as amended by TRAIGA 1 January 2026; Colorado employer rules since 1 July 2025)	740 ILCS 14 (BIPA); Tex. Bus. & Com. Code §503.001 (CUBI); RCW 19.375; Colo. Rev. Stat. §6-1-1314 (HB 24-1130) — https://www.rainintelligence.com/litigation-trend-reports/voiceprint-bipa
2025-07-31	US State Privacy Laws (AI provisions)	Let consumers question profiling results, see the data used, and get a re-evaluation (Minnesota, Connecticut)	controller	Minnesota in force since 31 July 2025; Connecticut since 1 July 2026	Minn. Stat. §325O.05, subd. 1(f); Conn. Gen. Stat. §42-518 as amended by SB 1295 (2025) — https://perkinscoie.com/insights/blog/minnesotas-unique-spin-consumer-data-privacy
2025-08-02	EU AI Act	GPAI model documentation and downstream information	provider	in force since 2 August 2025	Art. 53(1)(a)-(b) — https://artificialintelligenceact.eu/article/53/
2025-08-02	EU AI Act	Copyright policy and public training-content summary	provider	in force since 2 August 2025	Art. 53(1)(c)-(d) — https://artificialintelligenceact.eu/article/53/
2025-08-02	EU AI Act	Systemic-risk model duties: evaluations, incident reporting, cybersecurity	provider	in force since 2 August 2025	Arts. 52, 55 — https://artificialintelligenceact.eu/article/55/
2025-08-02	EU AI Act	Appoint an authorised representative in the EU	provider	since 2 August 2025 for general-purpose AI model providers (Art. 54)	Arts. 22, 54 — https://artificialintelligenceact.eu/article/22/
2025-09-01	US Health Care AI Rules	Texas: review AI-generated records, disclose AI use in diagnosis and treatment, store EHRs in the US	provider	SB 1188 in force since 1 September 2025 (data localization since 1 January 2026); TRAIGA written disclosure since 1 January 2026	Tex. SB 1188 (89R); Tex. Bus. & Com. Code §552.051(f) (TRAIGA, HB 149) — https://capitol.texas.gov/tlodocs/89R/billtext/html/SB01188F.htm
2025-09-24	US Conversational AI (Multi-State)	Maine: disclose that the consumer is talking to AI, not a human	developer, deployer	in force since 24 September 2025	10 M.R.S. §1500-DD (enacted as §1500-Y by P.L. 2025, c. 294; reallocated by RR 2025, c. 1) (Me. P.L. 2025, ch. 294; LD 1727) — https://legislature.maine.gov/statutes/10/title10sec1500-DD.html
2025-09-24	US Conversational AI (Multi-State)	Maintain persistent non-human labeling on every consumer surface	developer, deployer	earliest binding duty (Maine) in force since 24 September 2025	10 M.R.S. §1500-DD (enacted as §1500-Y by P.L. 2025, c. 294; reallocated by RR 2025, c. 1) (anchor); N.Y. GBL art. 47; Utah Code §13-2-12/13-72; Cal. B&P Code §22601 et seq. — https://legislature.maine.gov/statutes/10/title10sec1500-DD.html
2025-09-24	US Conversational AI (Multi-State)	Document per-state carve-out and safe-harbor fit; re-screen on product changes	developer, deployer	in-force layer (Maine, New York, Hawaii, therapy bans) — document current fit; earliest duty in force since 24 September 2025	Neb. LB 525 (business-entity/narrow-topic exclusions); Ga. SB 540; Wash. HB 2225; N.Y. GBL art. 47; Nev. AB 406 safe harbors — https://nebraskalegislature.gov/FloorDocs/109/PDF/Slip/LB525.pdf
2025-09-30	US Federal AI Requirements	Federal procurement: AI contract terms and large-language-model disclosures	developer, deployer	in force — M-25-22 terms for solicitations issued on or after 30 September 2025; M-26-04 LLM disclosures for solicitations after 11 December 2025	OMB M-25-22 (3 Apr. 2025); OMB M-25-21; OMB M-26-04 (11 Dec. 2025); EO 14319 (23 July 2025) — https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf
2025-10-01	California AI Laws	Assess employment ADS for discrimination and document anti-bias testing	developer, deployer	in force since 1 October 2025	2 CCR §§ 11008.1, 11009(f) — https://www.mayerbrown.com/en/insights/publications/2025/08/california-adopts-new-employment-ai-regulations-effective-october-1-2025
2025-10-01	California AI Laws	Retain ADS data and employment records for four years	developer, deployer	in force since 1 October 2025	Cal. Code Regs. tit. 2, § 11013(c) — https://www.mayerbrown.com/en/insights/publications/2025/08/california-adopts-new-employment-ai-regulations-effective-october-1-2025
2025-10-01	California AI Laws	Treat ATS and screening vendors as your FEHA agents	developer, deployer	in force since 1 October 2025	Cal. Code Regs. tit. 2, §§ 11008–11008.1 ('agent' and ADS definitions) — https://www.mayerbrown.com/en/insights/publications/2025/08/california-adopts-new-employment-ai-regulations-effective-october-1-2025
2025-10-01	California AI Laws	Screen ADS assessments for medical-inquiry and disability exposure	developer, deployer	in force since 1 October 2025	2 CCR §§ 11008.1, 11016, 11071(e) — https://www.mayerbrown.com/en/insights/publications/2025/08/california-adopts-new-employment-ai-regulations-effective-october-1-2025
2025-10-15	US Financial Services AI Rules	Colorado Regulation 10-1-1: governance, quantitative testing, and annual attested reporting for external data and predictive models	insurer	in force since 15 October 2025 for auto and health (life since 14 November 2023); auto and health compliance reports due 1 July 2026 and annually	3 CCR 702-10, Regulation 10-1-1 (as amended, eff. 15 Oct. 2025), implementing C.R.S. §10-3-1104.9 (SB 21-169) — https://www.faegredrinker.com/en/insights/publications/2025/9/colorado-division-of-insurance-expands-ai-related-governance-and-risk-management-obligations-for-insurers
2025-11-05	US Conversational AI (Multi-State)	New York: AI-companion disclosure cadence and crisis protocol	developer, deployer	in force since 5 November 2025	N.Y. Gen. Bus. Law art. 47, §§1700–1704 — https://www.nysenate.gov/legislation/laws/GBS/A47
2025-12-03	US Financial Services AI Rules	Regulation S-P: incident response and oversight of AI service providers	securities_firm	in force since 3 December 2025 (larger entities) and 3 June 2026 (smaller entities)	Regulation S-P amendments (adopted 16 May 2024), 17 CFR Part 248 — https://www.sec.gov/files/rules/final/2024/regulation-s-p-small-entity-compliance-guide.pdf
2025-12-09	US Financial Services AI Rules	Controls for generative and agentic AI: testing, logging, human-in-the-loop, guardrails	lender_or_creditor, insurer, securities_firm	supervisory expectation since FINRA's 2026 Regulatory Oversight Report (9 December 2025) and the OCC Spring 2026 Risk Perspective	FINRA 2026 Annual Regulatory Oversight Report (Gen AI and agentic AI sections); OCC Semiannual Risk Perspective, Spring 2026; NIST AI 600-1 — https://www.finra.org/rules-guidance/guidance/reports/2026-finra-annual-regulatory-oversight-report/gen-ai
2025-12-15	US Financial Services AI Rules	New Jersey and Illinois: documented disparate-impact and less-discriminatory-alternative testing for credit models	lender_or_creditor	New Jersey rules in force since 15 December 2025; Illinois credit standard applies from 1 January 2027	N.J.A.C. 13:16 (adopted 15 Dec. 2025); Ill. P.A. 104-0744 (SB 3777, signed 31 July 2026, eff. 1 Jan. 2027); Mass. AG–Earnest settlement (July 2025) — https://www.consumerfinancemonitor.com/2026/08/14/illinois-enacts-disparate-impact-standard-for-credit-decisions-what-lenders-need-to-know/
2025-12-18	US Federal AI Requirements	DoD contracts: no 'covered AI' from designated adversary-linked companies	developer, deployer	in force since 18 December 2025	FY2026 National Defense Authorization Act, Pub. L. 119-60, §1532 — https://www.congress.gov/crs-product/IF13197
2026-01-01	California AI Laws	Post the 12-element training-data disclosure before public availability	developer, deployer	in force since 1 January 2026	Cal. Civ. Code § 3111(a) (AB 2013) — https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=3111.
2026-01-01	California AI Laws	Refresh the training-data disclosure on every substantial modification	developer, deployer	in force since 1 January 2026	Cal. Civ. Code §§ 3110(d), 3111(a) (AB 2013) — https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=3110.
2026-01-01	California AI Laws	Complete risk assessments before high-risk processing and calendar CPPA filings	developer, deployer	in force since 1 January 2026 (pre-2026 processing must be assessed by 31 December 2027; first CPPA attestation due 1 April 2028)	Cal. Code Regs. tit. 11, § 7150 et seq. (risk assessments); §§ 7120–7124 (cybersecurity audits) — https://cppa.ca.gov/regulations/ccpa_updates.html
2026-01-01	California AI Laws	Companion chatbot: disclose AI status clearly and conspicuously	developer, deployer	in force since 1 January 2026	Bus. & Prof. Code §§ 22601–22606 (SB 243) — https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB243
2026-01-01	California AI Laws	Companion chatbot: maintain and publish the self-harm crisis protocol	developer, deployer	in force since 1 January 2026	Bus. & Prof. Code §§ 22601–22606 (SB 243) — https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB243
2026-01-01	California AI Laws	Companion chatbot: implement the known-minor protections	developer, deployer	in force since 1 January 2026	Bus. & Prof. Code §§ 22601–22606 (SB 243) — https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB243
2026-01-01	California AI Laws	Frontier developer: transparency reports and Cal OES incident reporting	developer, deployer	in force since 1 January 2026	Bus. & Prof. Code §§ 22757.12, 22757.13, 22757.15 (SB 53 TFAIA) — https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=BPC&sectionNum=22757.12.
2026-01-01	Illinois HB 3773 (AI in Employment)	Notify employees and applicants of AI use in employment decisions	employer, employment_agency	in force since 1 January 2026	775 ILCS 5/2-102(L)(2) — https://www.ilga.gov/Documents/legislation/ilcs/documents/077500050K2-102.htm
2026-01-01	Illinois HB 3773 (AI in Employment)	Ensure AI in employment decisions does not discriminate	employer, employment_agency	in force since 1 January 2026	775 ILCS 5/2-102(L)(1) — https://www.ilga.gov/Documents/legislation/ilcs/documents/077500050K2-102.htm
2026-01-01	Illinois HB 3773 (AI in Employment)	Vet vendor-supplied AI tools (bias testing and audit rights)	employer, employment_agency	in force since 1 January 2026	775 ILCS 5/2-102(L)(1) (effects-based liability standard) — https://www.ilga.gov/Documents/legislation/ilcs/documents/077500050K2-102.htm
2026-01-01	Illinois HB 3773 (AI in Employment)	Stop using zip code as a proxy for protected classes	employer, employment_agency	in force since 1 January 2026	775 ILCS 5/2-102(L)(1) — https://www.ilga.gov/Documents/legislation/ilcs/documents/077500050K2-102.htm
2026-01-01	Illinois HB 3773 (AI in Employment)	Preserve AI notices and related records (recommended practice)	employer, employment_agency	recommended from the Act's effective date (1 January 2026) — no binding AI-specific retention rule is in force	IDHR proposed Subpart J (proposed 15 May 2026, withdrawn 2 June 2026) — https://ogletree.com/insights-resources/blog-posts/illinois-postpones-proposed-regulations-on-ai-in-employment/
2026-01-01	Texas TRAIGA	Cease or redesign the prohibited practice	developer, deployer	in force since 1 January 2026	Bus. & Com. Code §§552.052–.057, .105 (TRAIGA, HB 149) — https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm
2026-01-01	Texas TRAIGA	Government agency: disclose AI interaction to consumers	deployer	in force since 1 January 2026	Bus. & Com. Code §552.051(b) (TRAIGA, HB 149) — https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm
2026-01-01	Texas TRAIGA	Health care provider: disclose AI use in care or treatment	deployer	in force since 1 January 2026	Bus. & Com. Code §552.051(f) (TRAIGA, HB 149) — https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm
2026-01-01	Texas TRAIGA	Run a documented internal review and red-team program (TRAIGA defense readiness)	developer, deployer	in force since 1 January 2026	Bus. & Com. Code §552.105(e)(2) (TRAIGA, HB 149) — https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm
2026-01-01	Texas TRAIGA	Maintain records to answer the AG and cure within 60 days	developer, deployer	in force since 1 January 2026	Bus. & Com. Code §§552.104–.106 (TRAIGA, HB 149) — https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm
2026-01-01	US Health Care AI Rules	California AB 489: no titles, terms, or design implying a licensed clinician	provider, health_tech_vendor	in force since 1 January 2026	Cal. AB 489 (2025) — https://www.akerman.com/en/perspectives/hrx-new-year-new-ai-rules-healthcare-ai-laws-now-in-effect.html
2026-01-01	US State Privacy Laws (AI provisions)	CCPA risk assessment for automated decisions, sensitive data, and model training	controller	in force since 1 January 2026; first attestation and summary due to the CPPA by 1 April 2028	11 CCR §§7150–7157 (CPPA regulations approved 22 Sept. 2025) — https://cppa.ca.gov/announcements/2025/20250923.html
2026-01-01	US State Privacy Laws (AI provisions)	Minors' data: no sale or targeted advertising to known minors; heightened design duties	controller	in force (Connecticut minors' provisions since 1 October 2024; Maryland since 1 October 2025; Oregon under-16 sale ban since 1 January 2026; Nebraska design code since 1 January 2026)	Conn. SB 3 (2023) and SB 1295 (2025); Md. Com. Law §14-4607(a)(3); Or. Rev. Stat. §646A.578 (2025 amendment); Neb. Age-Appropriate Design Code Act — https://www.wsgr.com/en/insights/nebraska-and-vermont-pass-age-appropriate-design-codes.html
2026-01-06	US Health Care AI Rules	FDA: keep clinical decision support outside device regulation, or follow the device pathway	health_tech_vendor	revised guidance in force since 6 January 2026 (supersedes the September 2022 guidance)	FDA, Clinical Decision Support Software — Guidance (Jan. 2026); FDCA §520(o)(1)(E); PCCP guidance (Dec. 2024) — https://www.fda.gov/regulatory-information/search-fda-guidance-documents/clinical-decision-support-software
2026-04-01	US State Privacy Laws (AI provisions)	Maryland: strict data minimization and no sale of sensitive data	controller	in force since 1 October 2025 for processing on or after 1 April 2026; AG cure period until 1 April 2027	Md. Com. Law §§14-4601 to 14-4613 (Maryland Online Data Privacy Act) — https://www.cooley.com/news/insight/2025/2025-09-09-marylands-unique-state-privacy-law-takes-effect-october-1--what-you-should-know
2026-04-17	US Financial Services AI Rules	Model risk management under the revised interagency guidance (April 2026)	lender_or_creditor, insurer, securities_firm	in force since 17 April 2026 (supersedes SR 11-7 / OCC 2011-12)	OCC Bulletin 2026-13; Federal Reserve SR 26-2; FDIC FIL (17 Apr. 2026) — https://www.occ.treas.gov/news-issuances/bulletins/2026/bulletin-2026-13.html
2026-04-22	US Federal AI Requirements	COPPA: separate parental consent before any AI training or third-party disclosure of children's data	developer, deployer	amended rule fully in force since 22 April 2026 (effective 23 June 2025)	COPPA Rule amendments, 90 FR 16977 (22 Apr. 2025), 16 CFR Part 312 — https://www.federalregister.gov/documents/2025/04/22/2025-05904/childrens-online-privacy-protection-rule
2026-05-19	US Federal AI Requirements	Run a 48-hour notice-and-removal process for non-consensual intimate imagery, including AI forgeries	developer, deployer	in force since 19 May 2026 (FTC enforcement began that day)	TAKE IT DOWN Act, Pub. L. 119-12 §3 (signed 19 May 2025) — https://www.ftc.gov/business-guidance/resources/complying-take-it-down-act
2026-06-30	US State Privacy Laws (AI provisions)	Consent and use limits for sensitive data in AI processing	controller	in force (opt-in consent states since 2023); New Jersey ban on selling sensitive data since 30 June 2026	Va. Code §59.1-578(A)(5) and equivalents; Cal. Civ. Code §1798.121; N.J.S.A. 56:8-166.4 et seq. (2026 amendment) — https://www.venable.com/insights/publications/2026/07/2026-mid-year-state-privacy-law-update
2026-07-01	US State Privacy Laws (AI provisions)	Privacy notice covers AI uses, profiling, and model training	controller	Connecticut: must state whether personal data trains large language models since 1 July 2026	Conn. Gen. Stat. §42-520 as amended by SB 1295 (2025); Cal. Civ. Code §1798.100; Connecticut AG AI guidance (25 Feb. 2026) — https://www.hunton.com/privacy-and-cybersecurity-law-blog/connecticut-ag-clarifies-ai-compliance-obligations-under-ctdpa
2026-07-01	US State Privacy Laws (AI provisions)	Let consumers question profiling results, see the data used, and get a re-evaluation (Minnesota, Connecticut)	controller	Connecticut in force since 1 July 2026	Minn. Stat. §325O.05, subd. 1(f); Conn. Gen. Stat. §42-518 as amended by SB 1295 (2025) — https://perkinscoie.com/insights/blog/minnesotas-unique-spin-consumer-data-privacy
2026-07-14	US Conversational AI (Multi-State)	Hawaii: conversational-AI disclosure, minor safeguards, crisis protocol, and no professional-care representation	developer, deployer	in force since 14 July 2026 (Act 248); annual report to the Department of Health from 1 January 2028	Haw. Act 248 (2026) (SB 3001 CD1) — https://data.capitol.hawaii.gov/sessions/session2026/bills/SB3001_CD1_.HTM
2026-07-21	US Federal AI Requirements	Give specific, accurate principal reasons for AI-driven credit denials (Regulation B)	developer, deployer	in force — Reg. B §1002.9 unchanged; disparate-impact removal effective 21 July 2026	ECOA §701(d); 12 CFR 1002.9; CFPB Reg. B final rule, 91 FR (22 Apr. 2026), effective 21 July 2026 — https://www.federalregister.gov/documents/2026/04/22/2026-07804/equal-credit-opportunity-act-regulation-b
2026-07-21	US Financial Services AI Rules	Specific, accurate principal reasons in AI-driven adverse-action notices (Reg. B and FCRA)	lender_or_creditor	in force — 12 CFR 1002.9 unchanged; Reg. B disparate-impact removal effective 21 July 2026	12 CFR 1002.9(b)(2); FCRA §615, 15 U.S.C. 1681m; CFPB Reg. B final rule (22 Apr. 2026, eff. 21 July 2026) — https://www.federalregister.gov/documents/2026/04/22/2026-07804/equal-credit-opportunity-act-regulation-b
2026-08-01	US Health Care AI Rules	Iowa: verbal disclosure before recording appointments for AI transcription	provider	in force since 1 August 2026	Iowa HB 475 (2026), signed 2 June 2026 — https://www.transparencycoalition.ai/news/state-lawmakers-have-passed-15-new-laws-regulating-the-use-of-ai-in-health-care
2026-08-01	US State Privacy Laws (AI provisions)	Data protection assessment before profiling for significant decisions	controller	Connecticut impact assessments for covered profiling apply to processing on or after 1 August 2026; other states in force since 2023–2026	Va. Code §59.1-580 and equivalents; Md. Com. Law §14-4607; Conn. SB 1295 (2025) impact assessments; Ky. KCDPA (assessments from 1 June 2026) — https://www.cooley.com/news/insight/2025/2025-09-09-marylands-unique-state-privacy-law-takes-effect-october-1--what-you-should-know
2026-08-02	California AI Laws	Covered provider: provide a free public AI detection tool	developer, deployer	in force since 2 August 2026	Bus. & Prof. Code § 22757.2 (SB 942 as amended by AB 853) — https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=BPC&sectionNum=22757.2.
2026-08-02	California AI Laws	Covered provider: embed latent disclosures and offer a manifest disclosure option	developer, deployer	in force since 2 August 2026	Bus. & Prof. Code § 22757.3(a)–(b) (SB 942 as amended by AB 853) — https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=BPC&sectionNum=22757.3.
2026-08-02	California AI Laws	Covered provider: bind licensees to preserve disclosures and revoke within 96 hours	developer, deployer	in force since 2 August 2026	Bus. & Prof. Code § 22757.3(c) (SB 942 as amended by AB 853) — https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=BPC&sectionNum=22757.3.
2026-08-02	California AI Laws	Licensee: do not disable the licensed system's disclosure capability	developer, deployer	in force since 2 August 2026	Bus. & Prof. Code §§ 22757.3(c)(3), 22757.4 (SB 942 as amended by AB 853) — https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=BPC&sectionNum=22757.3.
2026-08-02	EU AI Act	Tell people they are interacting with AI	provider	from 2 August 2026	Art. 50(1) — https://artificialintelligenceact.eu/article/50/
2026-08-02	EU AI Act	Mark AI-generated content machine-readably	provider	from 2 August 2026	Art. 50(2) — https://artificialintelligenceact.eu/article/50/
2026-08-02	EU AI Act	Disclose deep fakes you deploy	deployer	from 2 August 2026	Art. 50(4) — https://artificialintelligenceact.eu/article/50/
2026-08-02	EU AI Act	Disclose AI-generated text published to inform the public	deployer	from 2 August 2026	Art. 50(4), second subparagraph — https://artificialintelligenceact.eu/article/50/
2026-08-02	EU AI Act	Notify people subject to emotion recognition or biometric categorisation	deployer	from 2 August 2026	Art. 50(3) — https://artificialintelligenceact.eu/article/50/

Frequently asked questions

Which AI law deadlines are next?

2026-10-01: Connecticut AI Act (PA 26-15) — Run and document anti-bias testing — AEDT use is no defense in discrimination claims (applies from 1 October 2026). 2026-10-01: Connecticut AI Act (PA 26-15) — Pre-sale key-terms notice and written acceptance for AI subscriptions (applies from 1 October 2026). 2026-10-01: Connecticut AI Act (PA 26-15) — Disclose AI-related layoffs when filing a federal WARN notice with CT DOL (applies from 1 October 2026)

How many AI-law obligations are already in force?

111 of the 157 tracked obligation deadlines across 13 laws have passed their effective date. The table on this page lists each with its citation.

Where do these dates come from?

Every date is rendered from Shieldra's versioned regulation packs, which cite the statutory source for each obligation. The packs were last verified 2026-09-16.