AI Compliance Calendar: Every Deadline from November 2026 to July 2027
Nine AI and data obligations fall due between November 2026 and July 2027, from India's Consent Manager rule on 13 November to California's SB 947 on 1 July. We checked each date at the statute, gazette or regulator, said who it binds, and listed the evidence each asks for. Most ask for the same things: an inventory, notices, review records and logs.
S
Sofia Reyes
Head of Compliance
Oct 30, 2026
Nine AI and data obligations fall due between November 2026 and July 2027: India's DPDP dates (13 November and 13 May), EU AI Act marking and prohibition dates (2 December), Australia's disclosure rule (10 December), three US rules on 1 January and California's employer rule (1 July). Most ask for the same evidence: an inventory, notices, review records and logs.
Most of them land on someone else.
Two of the nine bind only a narrow class of company: Consent Managers in India and frontier model developers in New York. Two more bind AI providers before they bind you. The rest fall on ordinary enterprises that use software to make or shape decisions about people, and they ask for the same few things: a list of the systems involved, a notice, a record of human review and logs you can produce later.
Last verified: 30 October 2026, against the Official Journal text of Regulation (EU) 2026/1744, the Commission's transparency Code of Practice, India's Gazette notifications G.S.R. 843(E) and 846(E), Australia's Federal Register of Legislation, the California Privacy Protection Agency's approved text, and the Colorado, California, New York, Connecticut and Utah legislature sites. California and New York bill pages were read through Internet Archive copies because those sites blocked our fetcher.
Figure 1. 1 January 2027 is the busiest day in the window, with three US rules starting at once.
Which AI compliance deadlines fall between November 2026 and July 2027?
Every date below was confirmed at a primary source. The last column names the evidence a discovery and audit-log tool can feed in; it is an input, not proof that any rule is met.
Date
Jurisdiction
Rule
Who it applies to
What to have ready
Where AccuroAI evidence helps
13 November 2026 (14 November on another reading)
India
DPDP Rules 2025, Rule 4; Act sections 6(9) and 27(1)(d)
Applicants to register as Consent Managers
Nothing, unless you build consent-management services
None needed
2 December 2026
EU
AI Act Article 111(4): Article 50(2) marking for generative systems on the market before 2 August 2026
Providers of those systems
Deployers: each vendor's written answer on how outputs are marked
Inventory export of generative tools in use
2 December 2026
EU
AI Act Article 5(1)(ba) and (bb): new bans on generating non-consensual intimate imagery and child sexual abuse material
Providers; deployers only where they use a system for that purpose
Acceptable use policy clause; vendor statements on safeguards
Audit logs of which image tools staff use
10 December 2026
Australia
Australian Privacy Principles 1.7 to 1.9
APP entities using computer programs in decisions that significantly affect people
List of those programs, data kinds and decision kinds; updated privacy policy
Discovery inventory as the starting list
1 January 2027
California
CCPA ADMT regulations, section 7200(b)
CCPA businesses using ADMT for a significant decision
Pre-use Notice, opt-out and access handling, ADMT inventory
Inventory export; audit logs
1 January 2027
Colorado
SB 26-189, Automated Decision-Making Technology
Developers and deployers of covered ADMT in consequential decisions
Notice before use, 30-day adverse-outcome disclosure, human review route, three-year records
Inventory export; logs for the record
1 January 2027
New York
RAISE Act (Chapter 699 of 2025, amended by Chapter 96 of 2026)
Frontier model developers
Buyers: the vendor's published frontier AI framework
None directly
13 May 2027 (14 May on another reading)
India
DPDP Rules 3, 5 to 16, 22 and 23; most of the Act
Every Data Fiduciary
Notices, consent records, safeguards, one year of logs, 72-hour breach report
Audit logs; evidence mapped to 8 frameworks
1 July 2027
California
SB 947, Chapter 859 of 2026 (automated decision systems in employment)
Employers using an ADS in discipline or termination
Tool list, human corroboration records, post-use notice, data request process
Inventory export of HR tools
What changes in November and December 2026?
India comes first, and for most companies it is a false alarm. Rule 1(3) of the Digital Personal Data Protection Rules, 2025 brings Rule 4, "Registration and obligations of Consent Manager", into force "one year after the date of publication of this Gazette". The Act's commencement notification, G.S.R. 843(E), adds only sections 6(9) and 27(1)(d) on that limb, and both concern Consent Managers. The notifications are dated 13 November 2025, so by our arithmetic the date is 13 November 2026; the Gazette's electronic stamp reads 14 November, which is why some advisers count from that day. Our DPDP and AI guide explains why ordinary enterprises owe nothing in November.
The EU dates need careful reading.
Article 50 of the AI Act has applied since 2 August 2026. Regulation (EU) 2026/1744, the Digital Omnibus, added a paragraph 4 to Article 111: providers of generative systems "placed on the market before 2 August 2026 shall take the necessary steps in order to comply with Article 50(2) by 2 December 2026." One duty, one group of providers. A deployer's job is to ask each vendor which date applies and how outputs are marked, as our Article 50 checklist sets out.
The same regulation inserted two bans into Article 5(1). Point (ba) covers AI that generates realistic intimate images of an identifiable person without explicit consent; point (bb) covers child sexual abuse material. Under the amended Article 113 they "shall apply from 2 December 2026". A deployer is caught only where it uses a system for the purpose of generating such material, so the evidence is an acceptable use policy that says so and a record of which image tools are in use.
Australia follows eight days later. Part 15 of Schedule 1 to the Privacy and Other Legislation Amendment Act 2024 commences the day after 24 months from Royal Assent, and the Act's own table gives that as 10 December 2026. New APP 1.7 requires the privacy policy to describe the kinds of personal information used, and the kinds of decisions made, where a computer program makes or substantially shapes a decision that "could reasonably be expected to significantly affect the rights or interests of an individual". It applies to decisions made after commencement, even by programs set up earlier. Our Australian disclosure guide starts with the inventory.
What lands on 1 January 2027?
Three US rules start on the same day, and only two of them reach ordinary deployers.
California's ADMT regulations
The approved CCPA regulation text took effect on 1 January 2026, but section 7200(b) gives automated decision-making its own clock: a business using ADMT for a significant decision before 1 January 2027 "must be in compliance with the requirements of this Article no later than January 1, 2027." Significant decisions cover lending, housing, education, employment and pay, and healthcare. The article requires a Pre-use Notice, an opt-out and a right of access (sections 7220 to 7222). A résumé screener is the obvious case. A chatbot an HR team quietly uses to rank applicants may be one too.
Colorado's replacement law
Colorado's 2024 AI Act never took effect. SB 26-189, signed on 14 May 2026, repeals and reenacts that part of the statutes, and apart from listed sections "this act takes effect January 1, 2027". A deployer must give notice before using a covered system to materially influence a consequential decision, and after an adverse outcome must provide a plain-language description "within thirty days after making the decision". Consumers can request correction and "meaningful human review and reconsideration", to the extent commercially reasonable. Deployers keep records for at least three years. The Attorney General enforces, with a 60-day cure period, and nothing in the act "creates a new private right of action". Our US state AI law tracker has the developer and deployer split.
New York's RAISE Act
Signed in December 2025 as Chapter 699, the RAISE Act was amended by S8828, Chapter 96 of 2026, to take effect "JANUARY 1, 2027". It binds developers of models trained with more than 10^26 operations, with extra duties above five hundred million dollars in revenue, and requires critical safety incidents to be reported within seventy-two hours. Buyers meet it only in procurement.
That leaves a short list of evidence types, shared across almost every date in the window.
Figure 2. Build the inventory once; four of the rules in this window start from it.
What comes due between February and July 2027?
India's main date is the big one. Rule 1(4) brings Rules 3, 5 to 16, 22 and 23 into force "eighteen months after the date of publication": 13 May 2027 by our arithmetic, or 14 May on the stamp reading. G.S.R. 843(E) commences most of the Act on the same limb, including the penalty sections 28 to 34. Rule 6(1)(e) requires logs to be kept "for a period of one year", and Rule 7(2)(b) requires a detailed breach report to the Board "within seventy-two hours of becoming aware of the breach". A log you never kept cannot be produced later, so May is the reason to switch logging on now.
California's employer rule follows. SB 947, approved on 30 September 2026 as Chapter 859, says "This part shall become operative on July 1, 2027." An employer "shall not rely solely on an ADS when making a disciplinary or termination decision". If it primarily relies on one, a human must corroborate the output and the employee gets a written post-use notice. Its predecessor, SB 7, was vetoed in October 2025.
Four narrower dates sit in the same months:
1 January 2027, Connecticut. Public Act 26-15 sets duties for operators of "artificial intelligence companions"; its employer provisions wait until 1 October 2027.
1 January 2027, California. AB 853 provenance duties for large online platforms become operative.
2 February 2027, EU, voluntary. Signatories of the Code of Practice on transparency of AI-generated content commit to "an interoperability solution for their detection mechanisms by 2 February 2027" (Measure 3.4). It binds signatories, not the market.
1 July 2027, California and Utah. Companion chatbot operators start annual reports under SB 243, and Utah Code section 63I-2-213 repeals Utah's Artificial Intelligence Policy Act.
Which dates sit just outside the window?
EU member states must have an AI regulatory sandbox running by 2 August 2027. Annex III high-risk obligations moved to 2 December 2027 and Annex I systems to 2 August 2028; the AI compliance hub collects our EU coverage. California risk assessments for existing processing are due by 31 December 2027. Texas TRAIGA has been in force since 1 January 2026. For the UK and Singapore we found no dated obligation in the window.
What should you do this month, quarter by quarter?
November and December 2026
Run discovery before 10 December. The Australian, California and Colorado notices all start from one question: which programs make or shape decisions about people? Send each generative AI vendor a written question on Article 50(2) marking. Add the two new Article 5 bans to your acceptable use policy.
January to March 2027
Test the California opt-out with a real request, not a slide. Wire the Colorado 30-day clock into whatever sends adverse decisions. If logging for India is not on yet, turn it on this quarter.
April to June 2027
Rehearse India's 72-hour Board report end to end, including finding which AI tool held the data. Then write the SB 947 post-use notice and name who in HR corroborates an ADS output.
July 2027
Confirm SB 947 is live. Then look at December 2027: Annex III work needs lead time, and its cost belongs in the 2027 AI security budget line.
What can software do here, and what can't it?
Software can tell you what is in use. AccuroAI discovers 1,400+ AI tools with the signed-in account and plan, which gives every rule above a starting inventory, including tools nobody procured. It keeps admin and employee audit logs with evidence mapped to 8 frameworks, the raw material for India's one-year log duty and Colorado's three-year record. It also redacts personal data inline before a prompt reaches a model.
It cannot write your privacy policy, decide whether a decision is "significant" or "consequential", or do the human review Colorado and California expect. Those are judgments, and they stay with people. No tool makes you compliant with any of these laws.
This calendar is general information, not legal advice. Check the dates that matter to you with counsel.
FAQ
Is 13 November 2026 a DPDP deadline for my company?
Almost certainly not. Rule 4 and the two Act provisions starting then concern Consent Managers, which must be Indian companies registered with the Data Protection Board. Ordinary Data Fiduciaries pick up their obligations at the eighteen-month mark, 13 May 2027 by our count, or 14 May if you count from the Gazette's electronic stamp.
Did the EU delay Article 50 to December 2026?
No. Article 50 applied from 2 August 2026. Regulation (EU) 2026/1744 gave only providers of generative systems placed on the market before that day until 2 December 2026 to meet the marking duty in Article 50(2). Deployer disclosure duties got no extra time.
Does the Colorado AI Act still require impact assessments?
Not in the form most guides describe. SB 26-189 replaced the 2024 text from 1 January 2027 with notice before use, a disclosure within 30 days of an adverse outcome, correction and human review on request, and record keeping. The Attorney General enforces it, with a 60-day cure period.
What do the California ADMT rules require by 1 January 2027?
A business already using automated decision-making technology for a significant decision must comply with the ADMT article by that day. In practice that means a Pre-use Notice, a working opt-out, and responses to access requests about how the technology was used. New uses after that date must comply from the start.
Where are the EU high-risk obligations in this calendar?
Outside it. Annex III high-risk obligations apply from 2 December 2027 and Annex I product-embedded systems from 2 August 2028, under the amended Article 113. Inventory work for both should still start in this window, because the documentation needs months of lead time.
