Regulatory calendar

The EU and US legal and technical deadlines that software companies face from 2026 to 2030, each with the rules that cover it.

By Agent Wranglers. Updated 22 October 2026.

This table lists the dates we checked against the official texts on 22 October 2026. Copy the rows that apply to you into your own calendar, as keep every legal date in one calendar describes. Laws change, and courts can stop them, so give each row an owner and a review date.

Dates in force or fixed by law

Date	What applies	Who it affects	Rules
1 January 2026	Texas App Store Accountability Act (SB 2420). A court stopped it in December 2025. The appeals court let it take effect on 4 June 2026, while the appeal goes on.	Apps distributed in Texas	MOB-36
6 May 2026	Utah app store age law. The stores share age categories for new accounts in Utah.	Apps distributed in Utah	MOB-36
1 July 2026	Louisiana app store age law. The stores share age categories for new accounts in Louisiana.	Apps distributed in Louisiana	MOB-36
27 July 2026	The Digital Omnibus on AI, Regulation (EU) 2026/1744, enters into force. It rewrites the AI literacy duty.	Every company that builds or uses AI	CMP-42
2 August 2026	AI Act Article 50 applies. People must be told when they deal with an AI, and generated content must carry a mark.	Providers and deployers of AI systems	CMP-43, CMP-72, AIF-37, AIF-60
11 September 2026	Cyber Resilience Act reporting starts. Exploited vulnerabilities and severe incidents go to the ENISA single reporting platform.	Makers of apps, software and devices sold in the EU	CMP-49
12 September 2026	Connected products placed on the market from now on must give users their data by design, under the Data Act.	Makers of connected devices and their apps	CMP-54
2 December 2026	The AI Act bans AI that makes sexual images of people without consent, and child abuse material. Generative systems already on the market before 2 August 2026 must now mark their output too.	Providers of image, video and other generative systems	CMP-41, CMP-72
9 December 2026	The new Product Liability Directive applies to products placed on the market after this date. Software and AI count as products.	Makers of software, apps and devices sold in the EU	CMP-55
31 December 2026	First milestone of the EU post-quantum roadmap. Member states have national plans, and pilots for high-risk and medium-risk uses have started.	Operators of critical systems first, then everyone	SEC-108
1 January 2027	California Digital Age Assurance Act (AB 1043). Apps request the age bracket signal from the operating system. Accounts and apps that existed before have until 1 July 2027.	Apps used in California	MOB-36
12 January 2027	Data Act switching and data export for cloud services must be free of charge.	Cloud and software service providers	CMP-53
2 August 2027	General-purpose AI models placed on the market before 2 August 2025 must meet the model duties.	Providers of general-purpose AI models	CMP-45
2 December 2027	AI Act duties for high-risk systems in Annex III start, such as hiring, credit scoring and education.	Providers and deployers of high-risk AI	CMP-44
11 December 2027	The Cyber Resilience Act applies in full. That means security by design, vulnerability handling, published advisories, a support period, a technical file and CE marking.	Makers of apps, software and devices sold in the EU	CMP-50, CMP-51, CMP-73
2 August 2028	AI Act duties for high-risk AI in products under Annex I start, such as medical devices and machinery.	Makers of regulated products with AI	CMP-44
28 June 2030	Service contracts signed before 28 June 2025 lose their transition period under the European Accessibility Act.	Shops, banks and other covered services	CMP-52
31 December 2030	EU post-quantum roadmap. High-risk uses must have moved to quantum-safe cryptography, and quantum-safe updates are on by default.	Operators of critical systems and their suppliers	SEC-108, WEB-158

The post-quantum roadmap continues after this table. Medium-risk uses should move by 31 December 2035, and low-risk uses as far as feasible by then. The roadmap is a recommendation to member states, not a law, but NIS2 supervisors and large customers already ask about it.

Proposals to watch

The Digital Omnibus, proposal COM(2025) 837 of 19 November 2025, would change the GDPR and the cookie rules. It is a proposal, not a law. The Council agreed its negotiating position on 21 October 2026. The European Parliament had not adopted its position by then, so talks between the two had not started. The final text can differ from the proposal in every point below.

A personal data breach would go to the authority only when it is likely to bring a high risk to people. The deadline would grow from 72 to 96 hours, through one EU entry point for incident reports.
Some cookies and device access would need no consent. Examples are a service the person asked for, audience measurement for the site's own use, and security.
Where consent is needed, refusing would take a single click. After a refusal, a site could not ask again for the same purpose for at least six months.
Sites would have to accept consent and refusal sent automatically by the browser, 24 months after the law enters into force. Browsers would have to send such signals after 48 months.
Developing and running an AI system or model could rely on legitimate interest as its legal basis, with safeguards and a balancing test.

Plan for today's rules until the final text appears in the Official Journal. Treating a browser privacy signal as a refusal already works today, as honour the Global Privacy Control signal says. Breach deadlines stay as start every reporting clock from one moment describes until the change applies.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/compliance/regulatory-calendar">Agent Wranglers compliance and governance playbook</a>. In code you write, add a comment next to it with the same link.