AI law is moving faster than any other area of regulation most organisations deal with. In the twelve months to September 2026 alone, the EU rewrote its high-risk timeline, Colorado repealed and replaced its AI Act, New York finalised the RAISE Act, Canada tabled a new privacy bill, and a US executive order set out to challenge state laws. A mature programme has a way to notice these changes and a calendar of the ones already known.
Known dates ahead (as of September 2026)
- 2 December 2026, EU: end of the grace period for machine-readable marking of AI-generated content by systems already on the market before 2 August 2026, and the date the new prohibition on AI that generates non-consensual intimate imagery or child sexual abuse material applies (Digital Omnibus on AI, Regulation (EU) 2026/1744).
- 1 January 2027, Colorado: obligations under SB 26-189 for developers and deployers of automated decision-making technology used in consequential decisions. The Attorney General's rules on "material influence" and "meaningful human review" are being finalised through autumn 2026.
- 1 January 2027, New York: the RAISE Act applies to large frontier-model developers, including 72-hour incident reporting.
- 1 July 2027, Utah: the AI Policy Act's disclosure rules sunset unless the legislature renews them (extended in 2025).
- 2 August 2027, EU: member states must have at least one AI regulatory sandbox in place.
- 2 December 2027, EU: obligations for stand-alone high-risk AI systems (Annex III: hiring, credit, education, essential services and more) apply.
- 2 August 2028, EU: obligations for high-risk AI embedded in regulated products (Annex I) apply.
- Through 2028, California: SB 942's additional generative-AI content-provenance requirements phase in under AB 853.
Things in motion without a date
- US federal framework: Executive Order 14365 directed a proposed national legislative framework and a task force to challenge state laws; litigation against Colorado and other states is possible. Watch for a federal statute that pre-empts state rules.
- Illinois: the Department of Human Rights' notice rules under HB 3773 were proposed in 2026, withdrawn for revision, and are expected back.
- NYC Local Law 144: DCWP promised proactive enforcement after the State Comptroller's December 2025 audit.
- Canada: Bill C-36 (tabled 15 June 2026) would replace PIPEDA's private-sector rules with stronger enforcement.
- NIST AI RMF: under revision; a new version will change what "NIST-aligned" means in Texas and in contracts.
- EU guidance and standards: the Commission's high-risk guidelines and the harmonised standards from CEN-CENELEC will determine what "compliant" looks like in practice before December 2027.
A tracking routine that takes an hour a month
- Subscribe to the primary sources: the EU AI Office news page, your relevant state attorney general or legislature feeds, the Privacy Commissioner of Canada, NIST's AI updates, and one or two law-firm trackers you trust.
- Log every change in a "legal changes" sheet: what changed, date, which inventory entries it touches, action, owner.
- Re-screen in the Academy when a change affects your jurisdictions; the applicable-law list and the key-date timeline update as the content is reviewed.
- Brief leadership quarterly with the dates in the next twelve months and what each requires.
- Re-assess every ninety days. Your maturity score should move with the law, not only with your effort.
Dates are only useful if attached to work
For every date above that applies to you, write the task that must be finished before it and the person who owns it. A date with no task is trivia; a date with a task and an owner is a plan.