Last updated October 21, 2026. Mid-market security, privacy and AI teams face more than twenty dated compliance milestones between now and the end of 2028. The densest cluster lands on January 1, 2027: California’s automated decisionmaking rules, Colorado’s rewritten AI law, new Louisiana and Oklahoma privacy laws, and mandatory FedRAMP CR26. The biggest EU deadlines that moved are the AI Act’s high-risk obligations, now December 2, 2027 (Annex III) and August 2, 2028 (Annex I). On the healthcare side, the HIPAA Security Rule final rule now has a July 2027 target.
The state privacy map alone keeps growing. Louisiana’s law, signed May 29, 2026, is the nation’s twenty-second comprehensive state privacy law. Venable’s 2026 mid-year update lists four new omnibus laws (Louisiana, Oklahoma, Alabama and Vermont) taking effect between January 2027 and January 2028. In Europe, four EU member states still had not transposed NIS2 as of late May 2026, more than eighteen months after the October 17, 2024 deadline.
Key takeaways
- January 1, 2027 is the single busiest date. CCPA automated decisionmaking technology (ADMT) obligations, Colorado SB 26-189, the Louisiana and Oklahoma privacy laws, Connecticut data broker registration, the Illinois AI Safety Measures Act and mandatory FedRAMP CR26 all start that day.
- Two big deadlines moved later. The Digital Omnibus on AI, Regulation (EU) 2026/1744, pushed EU AI Act high-risk obligations to December 2, 2027 and August 2, 2028. HHS now targets July 2027 for the HIPAA Security Rule final rule.
- Some obligations are already live. EU Cyber Resilience Act vulnerability and incident reporting has applied since September 11, 2026. EU AI Act Article 50 transparency has applied since August 2, 2026.
- California’s audit clock runs to 2030. Risk assessment attestations are due April 1, 2028, and cybersecurity audit certifications are phased in on April 1 of 2028, 2029 and 2030 by revenue tier.
- Your baseline frameworks are stable. ISO/IEC 27001:2022, PCI DSS v4.0.1 and the SOC 2 Trust Services Criteria have no new editions on the calendar.
What is on the 2027 compliance calendar?
The master table lists every milestone we verified against a regulator or law firm source, sorted by date from Q4 2026 through 2028, plus California’s audit tiers to 2030.
| Date | Regulation / framework | What happens | Who it applies to | Source |
|---|---|---|---|---|
| Nov 17, 2026 | FedRAMP 20x (CR26) | Rev5 Ready providers must convert to Class A Certification if their annual assessment has not expired | Cloud providers holding FedRAMP Rev5 Ready status | Secureframe |
| Dec 2, 2026 | EU AI Act, Article 50(2) | Grace period ends for marking AI-generated content in systems placed on the market before Aug 2, 2026 | Providers of generative AI systems used in the EU | Gibson Dunn |
| Dec 15, 2026 | AICPA Code of Professional Conduct | Revised “attest engagement team” definition takes effect for attest engagements beginning on or after this date | CPA firms performing attest work, and the companies they audit | Journal of Accountancy |
| Jan 1, 2027 | FedRAMP CR26 | CR26 becomes mandatory for all providers, including current Rev5 certifications; default grace period begins | All FedRAMP cloud providers | Secureframe |
| Jan 1, 2027 | CCPA regulations (ADMT) | Businesses using ADMT to make significant decisions must comply | CCPA-covered businesses using ADMT | Hunton |
| Jan 1, 2027 | Colorado SB 26-189 | Rewritten Colorado AI law takes effect; Attorney General rules on adverse-outcome disclosures due | Developers and deployers of ADMT used in consequential decisions | Holland & Knight |
| Jan 1, 2027 | Louisiana and Oklahoma privacy laws | New comprehensive consumer privacy laws take effect | Businesses meeting each state’s applicability thresholds | Venable |
| Jan 1, 2027 | Connecticut data broker registration; Illinois AI Safety Measures Act | Connecticut data broker registration begins; Illinois law takes effect | Data brokers (CT); covered AI developers (IL) | Venable |
| Feb 1, 2027 | Washington generative AI disclosure law | Law takes effect | Providers of generative AI covered by the law | Venable |
| Apr 15, 2027 | NYDFS 23 NYCRR Part 500 | Certification of material compliance or acknowledgment of noncompliance for calendar year 2026 | NYDFS-regulated covered entities | O365HQ |
| Spring 2027 | New Jersey data broker law | Data broker and “data collector” registration | Data brokers and data collectors | Venable |
| May 1, 2027 | Alabama privacy law | New comprehensive consumer privacy law takes effect | Businesses meeting the law’s thresholds | Venable |
| Jun 11, 2027 | FedRAMP Rev5 | FedRAMP stops accepting new Rev5 certification applications | Providers seeking a new Rev5 certification | Secureframe |
| Jul 2027 (target) | HIPAA Security Rule | HHS regulatory agenda target for the final rule | HIPAA covered entities and business associates | Alston & Bird |
| Jul 31, 2027 | Louisiana privacy law | Mandatory 30-day cure period sunsets | Businesses covered by the Louisiana law | WilmerHale |
| Aug 2, 2027 | EU AI Act | Providers of general-purpose AI models placed on the market before Aug 2, 2025 must comply; member state sandboxes due | GPAI model providers; EU member states | AI Act timeline |
| Dec 2, 2027 | EU AI Act, Annex III | High-risk obligations apply to stand-alone systems (for example employment and education) | Providers and deployers of Annex III high-risk AI | Hunton |
| Dec 11, 2027 | EU Cyber Resilience Act | Most remaining CRA obligations apply | Manufacturers of products with digital elements sold in the EU | Jones Day |
| Dec 31, 2027 | FedRAMP | “Legacy FedRAMP Ready” status removed entirely | Providers relying on Legacy FedRAMP Ready status | Secureframe |
| Jan 1, 2028 | Vermont privacy law; Illinois AI Safety Measures Act | Vermont law takes effect; Illinois covered developers’ publication, audit and reporting duties apply | Businesses meeting Vermont’s thresholds; covered AI developers (IL) | Venable |
| Feb 1, 2028 | FedRAMP CR26 | Grace period ends; providers not following CR26 lose FedRAMP Certification | All FedRAMP cloud providers | Secureframe |
| Apr 1, 2028 | CCPA regulations | Risk assessment attestation and summary due to the CPPA; first cybersecurity audit certifications due for the highest revenue tier | CCPA-covered businesses | Hunton |
| Aug 2, 2028 | EU AI Act, Annex I | High-risk obligations apply to AI embedded in regulated products | Providers of AI in Annex I regulated products | Hunton |
| Apr 1, 2029 and Apr 1, 2030 | CCPA regulations | Cybersecurity audit certifications due for the middle and smallest revenue tiers | CCPA-covered businesses required to audit | Hunton |
Which obligations are ongoing rather than dated?
These have no single 2027 date but belong on the same calendar.
| Regulation / framework | Current status | Recurring work | Source |
|---|---|---|---|
| DORA | Applied since January 17, 2025 | ICT risk management, register of information, incident reporting for EU financial entities and their ICT providers | EIOPA |
| NIS2 | Transposition deadline was Oct 17, 2024; four member states had not transposed as of May 2026 | Track each national law where you operate; obligations vary by country | Cullen International |
| EU Cyber Resilience Act reporting | Applies since Sep 11, 2026 | 24-hour early warning, 72-hour notification and final report for actively exploited vulnerabilities and severe incidents | Jones Day |
| PCI DSS v4.0.1 | Replaced v4.0 on Dec 31, 2024; no new requirements | Annual assessment; future-dated v4 requirements have been effective since March 31, 2025 | usd AG, PCI SSC |
| ISO/IEC 27001 | 2022 edition with Amendment 1:2024 (climate action changes); no active revision | Surveillance and recertification audits | ISO |
| SOC 2 | 2017 Trust Services Criteria with revised points of focus (2022) | Annual Type 2 report and observation period | AICPA & CIMA |
| SEC cybersecurity disclosure | In effect | Form 8-K Item 1.05 within four business days of a materiality determination; annual 10-K disclosure of risk management, strategy and governance | SEC |
What should you do now for Q4 2026 deadlines?
Three dates fall before year-end.
FedRAMP Rev5 Ready providers (November 17, 2026)
According to Secureframe’s FedRAMP 20x roadmap, Rev5 Ready providers whose annual assessment has not expired must convert to Class A Certification by November 17. Confirm your assessment date with your 3PAO now.
Generative AI products sold in the EU (December 2, 2026)
The four-month grace period for marking AI-generated content ends December 2 for systems that were already on the market before August 2, 2026, per Gibson Dunn. Inventory every product feature that outputs synthetic text, images, audio or video. Assign an owner to each Article 50 marking control.
SOC 2 and other attest engagements (December 15, 2026)
The AICPA’s revised attest engagement team definition, reported by the Journal of Accountancy, explicitly excludes internal auditors and external specialists from the engagement team. It applies to engagements beginning on or after December 15, 2026. If your SOC 2 audit starts in early 2027, ask your auditor whether it changes their approach.
What should you do now for Q1 2027 deadlines?
How do you prepare for California’s ADMT rules?
The CCPA regulations require businesses that use automated decisionmaking technology for significant decisions to comply beginning January 1, 2027, per Hunton. Build an inventory of every model, scoring tool or vendor feature that touches hiring, lending, housing, education or healthcare decisions. Tie each one to a notice, an opt-out or appeal path, and an owner. For a broader view, see our US state AI laws compliance guide.
What changes under Colorado SB 26-189?
Colorado’s rewritten AI law takes effect January 1, 2027, per Holland & Knight. It swaps “high-risk AI system” for “automated decision-making technology” and drops the mandatory risk management program and annual impact assessments. Deployers still owe consumers notice before using ADMT in a consequential decision, a plain-language explanation after an adverse outcome, and three years of records. HIPAA-covered entities are broadly exempt for non-employment uses, which matters for healthcare teams.
Which new state privacy laws start January 1, 2027?
Louisiana and Oklahoma’s comprehensive privacy laws take effect January 1, 2027, alongside Connecticut data broker registration and the Illinois AI Safety Measures Act, per Venable. Washington’s generative AI disclosure law follows on February 1, 2027. Louisiana’s law includes access, correction, deletion and portability rights plus opt-outs for targeted advertising, per WilmerHale. Update your privacy notice, your data subject request workflow and your processor contracts once, then map them to each new state.
What do FedRAMP providers need on January 1, 2027?
CR26 becomes mandatory for all FedRAMP providers on January 1, 2027, including current Rev5 certifications, and the default grace period starts. Providers that are not following CR26 by February 1, 2028 lose their certification, per Secureframe.
What should you do now for Q2 and Q3 2027 deadlines?
NYDFS Part 500 certification (April 15, 2027)
Every year by April 15, NYDFS covered entities file either a certification of material compliance or an acknowledgment of noncompliance that names the sections, the gaps and a remediation timeline, per Cooley. The April 2027 filing covers calendar year 2026. It is the first full year with the November 1, 2025 MFA and asset inventory requirements in force, as O365HQ explains. Start collecting evidence for every Part 500 section in January. Our NYDFS 23 NYCRR 500 compliance guide walks through each one.
Alabama privacy law and the Louisiana cure window (May 1 and July 31, 2027)
Alabama’s comprehensive privacy law takes effect May 1, 2027. Louisiana’s mandatory 30-day cure period ends July 31, 2027. After that, the Attorney General no longer has to offer a cure window before investigating.
FedRAMP Rev5 intake closes (June 11, 2027)
FedRAMP stops accepting new Rev5 certification applications on June 11, 2027. A provider planning a new Rev5 package needs to file before then or plan for the 20x path.
EU AI Act general-purpose AI legacy models (August 2, 2027)
Providers of general-purpose AI models placed on the market before August 2, 2025 must have taken the steps to comply by August 2, 2027, according to the AI Act implementation timeline. Most mid-market companies are deployers rather than GPAI providers, but you should still ask your model vendors for their compliance status during vendor review.
What should you do now for Q4 2027 and 2028 deadlines?
Budget the late-2027 build work in your 2027 plan.
- EU AI Act Annex III (December 2, 2027). If you provide or deploy stand-alone high-risk AI in the EU, such as employment or education systems, the Chapter III high-risk requirements start applying. Our EU AI Act compliance guide maps the obligations.
- EU Cyber Resilience Act (December 11, 2027). Most remaining CRA obligations apply, per Jones Day.
- Vermont and Illinois (January 1, 2028). Vermont’s privacy law takes effect, and Illinois covered AI developers’ publication, audit and reporting duties apply.
- California (April 1, 2028). Risk assessment attestations and summaries are due to the CPPA. The first cybersecurity audit certifications are due for the highest revenue tier, with the remaining tiers following in 2029 and 2030.
- EU AI Act Annex I (August 2, 2028). High-risk obligations apply to AI embedded in products regulated under Annex I harmonisation legislation.
Which compliance deadlines moved in 2026?
Two of the deadlines most mid-market teams had planned around changed this year. If your roadmap still shows the old dates, update it.
| Obligation | Old date | New date | What moved it |
|---|---|---|---|
| EU AI Act high-risk, Annex III (stand-alone systems) | Aug 2, 2026 | Dec 2, 2027 | Digital Omnibus on AI, Regulation (EU) 2026/1744 |
| EU AI Act high-risk, Annex I (AI in regulated products) | Aug 2, 2027 | Aug 2, 2028 | Digital Omnibus on AI, Regulation (EU) 2026/1744 |
| EU AI Act Article 50 marking for systems already on the market | Aug 2, 2026 | Dec 2, 2026 (grace period) | Digital Omnibus on AI |
| HIPAA Security Rule final rule | May 2026 (target) | July 2027 (target) | HHS OCR regulatory agenda |
How did the Digital Omnibus change the EU AI Act?
Regulation (EU) 2026/1744 entered into force on July 27, 2026, three days after publication in the Official Journal, per Hunton. It deferred Annex III high-risk obligations to December 2, 2027 and Annex I obligations to August 2, 2028. Article 50 transparency obligations largely stayed on schedule and have applied since August 2, 2026. Systems already on the market before then get a grace period for content marking until December 2, 2026, per Gibson Dunn. It also softened the Article 4 AI literacy duty.
Why did the HIPAA Security Rule slip to 2027?
HHS proposed the Security Rule update in January 2025. The earlier OCR regulatory agenda had raised expectations of a final rule in May 2026. The newer agenda lists July 2027, according to Alston & Bird, which also notes that finalization “at least in some form” still appears likely. Keep building toward the proposed rule rather than pausing. See our HIPAA Security Rule update readiness guide.
How do you run a deadline calendar in your GRC program?
A spreadsheet of dates goes stale fast. A working calendar ties each date to obligations, controls, owners and evidence.
- Scope by applicability first. For each row in the master table, record whether it applies to you, why, and who made that call.
- Translate each deadline into obligations. “Colorado SB 26-189” is not a task. “Provide pre-decision notice for ADMT used in hiring” is. Break every law into discrete requirements.
- Map obligations to controls you already run. Most new laws reuse controls you have for SOC 2, ISO 27001 or HIPAA: access reviews, vendor risk, incident response, data inventory. Our control mapping guide shows how.
- Assign an owner and a lead time. Work back from each date. A notice update might need four weeks; an AI system inventory might need a quarter.
- Collect evidence continuously. Certifications such as NYDFS Part 500 cover a full year. Collect evidence as controls run, not in March.
- Review the calendar monthly. Dates move: this year alone the EU AI Act and HIPAA timelines shifted. Re-verify sources and log changes in your risk register.
- Report readiness, not just dates. Show leadership tested controls and open gaps per deadline.
How does Compyl help you manage 2027 compliance deadlines?
Best for: mid-market security and compliance teams that need one program to absorb new privacy, AI and security laws without adding a tool for each one.
Compyl is a GRC platform built by CISOs for 200 to 1,000 employee companies in software, healthcare, financial services and higher education. Its single control library is cross-mapped across 70+ frameworks, so a new obligation maps onto controls you already test rather than starting a new project. More than 125 in-house integrations are included at no extra cost, with unlimited integrations per control, so evidence for annual certifications like NYDFS Part 500 is collected as controls run. Evidence logic is transparent, not a black box.
Each customer runs in a dedicated single-tenant environment. Risk is quantified in dollars using FAIR, so you can show the board which deadlines carry the most exposure. Compyl also covers policy management for the notice and policy updates new laws require, plus vendor risk management, user access reviews, a Trust Center, Questionnaire Assist for security questionnaires and Evidence Studio. Compyl’s “Intentional AI” keeps a human approving actions. There are no per-framework, per-module or per-connector fees, and quotes are itemized line by line. See how it works on our compliance management page.
Book a Compyl demo to see your 2027 deadlines mapped to the controls you already run.
Frequently asked questions
What are the biggest compliance deadlines in 2027?
The biggest are January 1, 2027 (California ADMT rules, Colorado SB 26-189, the Louisiana and Oklahoma privacy laws and mandatory FedRAMP CR26), April 15, 2027 (NYDFS Part 500 certification), December 2, 2027 (EU AI Act Annex III high-risk obligations) and December 11, 2027 (full EU Cyber Resilience Act application).
When do EU AI Act high-risk requirements apply now?
After the Digital Omnibus on AI, Regulation (EU) 2026/1744, high-risk obligations for stand-alone Annex III systems apply from December 2, 2027, and obligations for AI embedded in Annex I regulated products apply from August 2, 2028.
When is the HIPAA Security Rule final rule expected?
The HHS Office for Civil Rights regulatory agenda now targets July 2027, after an earlier target of May 2026. The rule was proposed in January 2025, and a regulatory agenda target is a planning signal rather than a compliance date.
Does the Colorado AI Act still take effect?
Colorado repealed and reenacted its 2024 AI law through SB 26-189, signed May 14, 2026. The new law takes effect January 1, 2027 and regulates automated decision-making technology used in consequential decisions, with notice, explanation and record-keeping duties instead of mandatory impact assessments.
When do the California CCPA automated decisionmaking rules start?
Businesses that use automated decisionmaking technology to make significant decisions must comply beginning January 1, 2027. Risk assessment attestations are due April 1, 2028, and cybersecurity audit certifications are phased in on April 1 of 2028, 2029 and 2030 depending on revenue.
Which new state privacy laws take effect in 2027?
Louisiana and Oklahoma take effect January 1, 2027 and Alabama on May 1, 2027. Vermont follows on January 1, 2028. Connecticut data broker registration starts January 1, 2027 and Washington’s generative AI disclosure law on February 1, 2027.
When is the NYDFS Part 500 certification due in 2027?
Covered entities must file by April 15, 2027. The filing covers calendar year 2026 and is either a certification of material compliance or an acknowledgment of noncompliance with a remediation timeline.
Is there a new version of ISO 27001, PCI DSS or SOC 2 coming in 2027?
No new edition is scheduled. ISO/IEC 27001:2022 with its 2024 climate amendment is current with no active revision, PCI DSS v4.0.1 has been the active version since December 31, 2024, and SOC 2 uses the 2017 Trust Services Criteria with revised points of focus from 2022.
