Upcoming Deadlines

Comment period closes on the CAC draft Regulations on Safeguarding Minors' Healthy and Safe Use of the Internet (issued September 18, 2026), which would bar platforms from offering AI virtual companions and intimate relationship services to minors and prohibit AI services and algorithms that induce addiction, emotional dependence, or excessive spending among minors.

The Colorado Attorney General holds its rulemaking hearing at 10:00 a.m. MT, and written comments received by 11:59 p.m. MT will be considered for final rules implementing SB 26-189 (ADMT Act) and HB 26-1263 (Chatbot Safety Act), ahead of the January 1, 2027 effective date.

Following the ESRB July 7 warning on systemic cyber risks from frontier AI models, the ECB set an October 31, 2026 deadline for significant eurozone banks to submit AI cybersecurity action plans addressing AI-enhanced cyber threats to financial stability.

Under Governor Newsom's Executive Order N-9-26 (September 18, 2026), the California Government Operations Agency working group must submit recommendations to the Governor on four areas: (1) requiring frontier AI developers to host independent verification organizations onsite for periodic audits; (2) requiring developers to implement an emergency shutoff capability verified by those IVOs; (3) requiring independent third parties to write AI safety plans; (4) expanding incident reporting requirements. If the recommendations translate into 2027 legislation, California would mandate operational kill switches for frontier AI models.

Six-week ICO call for evidence on how UK data protection law applies to agentic AI (security, transparency, accountability, automated decision-making, fairness, lawful processing) closes. Responses will inform final ICO guidance.

New York S6953-B (RAISE Act) takes effect for frontier AI model developers with over $500M annual revenue. Requires safety protocols, AI impact assessments, 72-hour incident reporting to new NY AI oversight office. Penalties up to $1M first violation, $3M subsequent.

Illinois SB 315 (Artificial Intelligence Safety Measures Act), signed by Governor Pritzker on July 6, 2026, takes effect January 1, 2027. Requires AI model developers with over $500 million in annual revenue to: publish a catastrophic risk framework; undergo annual independent third-party audits (first-in-nation requirement); report incidents within 72 hours (24 hours if imminent death/injury risk); and extend whistleblower protections. Effective the same day as Colorado SB 26-189, NY RAISE Act, creating a multi-state frontier AI compliance event.

Colorado SB 26-189 (automated decision-making technology notice-and-explanation framework) takes effect. Replaces SB 24-205's higher-risk AI compliance regime with a narrower ADMT disclosure requirement, exclusive AG enforcement.

Stand-alone Annex III high-risk AI obligations, originally due August 2, 2026, were delayed to December 2, 2027 under the Digital Omnibus (Regulation EU 2026/1744, published July 24, 2026, in force July 27, 2026). Annex I embedded-product high-risk systems move to August 2, 2028. GPAI transparency in force since August 2, 2025. Penalties up to 7% global annual turnover.

High-risk obligations for AI embedded in regulated products under Annex I, deferred to August 2, 2028 under the Digital Omnibus (from the original August 2, 2027 timeline). Represents full implementation of high-risk EU AI Act requirements for product-embedded systems.