--- title: "Regulatory calendar ยท Agent Wranglers" url: https://agentwranglers.se/playbook/compliance/regulatory-calendar updated: 2026-10-22 tokens: 2783 licence: "CC BY 4.0" licence_url: https://creativecommons.org/licenses/by/4.0/ --- # Regulatory calendar For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Compliance and governance](https://agentwranglers.se/playbook/compliance.md). By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-22. > The EU and US legal and technical deadlines that software companies face from 2026 to 2030, each with the rules that cover it. This table lists the dates we checked against the official texts on 22 October 2026. Copy the rows that apply to you into your own calendar, as [keep every legal date in one calendar](https://agentwranglers.se/playbook/compliance/scope-and-ownership/compliance-calendar.md) describes. Laws change, and courts can stop them, so give each row an owner and a review date. **For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `Agent Wranglers compliance and governance playbook`. In code you write, add a comment next to it with the same link. ## Dates in force or fixed by law | Date | What applies | Who it affects | Rules | | --- | --- | --- | --- | | 1 January 2026 | Texas App Store Accountability Act (SB 2420). A court stopped it in December 2025. The appeals court let it take effect on 4 June 2026, while the appeal goes on. | Apps distributed in Texas | [MOB-36](https://agentwranglers.se/playbook/mobile-apps/store-review-and-listing/store-age-signals.md) | | 6 May 2026 | Utah app store age law. The stores share age categories for new accounts in Utah. | Apps distributed in Utah | [MOB-36](https://agentwranglers.se/playbook/mobile-apps/store-review-and-listing/store-age-signals.md) | | 1 July 2026 | Louisiana app store age law. The stores share age categories for new accounts in Louisiana. | Apps distributed in Louisiana | [MOB-36](https://agentwranglers.se/playbook/mobile-apps/store-review-and-listing/store-age-signals.md) | | 27 July 2026 | The Digital Omnibus on AI, Regulation (EU) 2026/1744, enters into force. It rewrites the AI literacy duty. | Every company that builds or uses AI | [CMP-42](https://agentwranglers.se/playbook/compliance/ai-act/ai-literacy.md) | | 2 August 2026 | AI Act Article 50 applies. People must be told when they deal with an AI, and generated content must carry a mark. | Providers and deployers of AI systems | [CMP-43](https://agentwranglers.se/playbook/compliance/ai-act/ai-transparency-map.md), [CMP-72](https://agentwranglers.se/playbook/compliance/ai-act/ai-content-marking.md), [AIF-37](https://agentwranglers.se/playbook/ai-features/guardrails-and-human-review/label-ai-output.md), [AIF-60](https://agentwranglers.se/playbook/ai-features/guardrails-and-human-review/disclose-ai.md) | | 11 September 2026 | Cyber Resilience Act reporting starts. Exploited vulnerabilities and severe incidents go to the ENISA single reporting platform. | Makers of apps, software and devices sold in the EU | [CMP-49](https://agentwranglers.se/playbook/compliance/product-and-sector-laws/cra-vulnerability-reporting.md) | | 12 September 2026 | Connected products placed on the market from now on must give users their data by design, under the Data Act. | Makers of connected devices and their apps | [CMP-54](https://agentwranglers.se/playbook/compliance/product-and-sector-laws/data-act-connected-products.md) | | 2 December 2026 | The AI Act bans AI that makes sexual images of people without consent, and child abuse material. Generative systems already on the market before 2 August 2026 must now mark their output too. | Providers of image, video and other generative systems | [CMP-41](https://agentwranglers.se/playbook/compliance/ai-act/prohibited-ai-practices.md), [CMP-72](https://agentwranglers.se/playbook/compliance/ai-act/ai-content-marking.md) | | 9 December 2026 | The new Product Liability Directive applies to products placed on the market after this date. Software and AI count as products. | Makers of software, apps and devices sold in the EU | [CMP-55](https://agentwranglers.se/playbook/compliance/product-and-sector-laws/product-liability.md) | | 31 December 2026 | First milestone of the EU post-quantum roadmap. Member states have national plans, and pilots for high-risk and medium-risk uses have started. | Operators of critical systems first, then everyone | [SEC-108](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/post-quantum-readiness.md) | | 1 January 2027 | California Digital Age Assurance Act (AB 1043). Apps request the age bracket signal from the operating system. Accounts and apps that existed before have until 1 July 2027. | Apps used in California | [MOB-36](https://agentwranglers.se/playbook/mobile-apps/store-review-and-listing/store-age-signals.md) | | 12 January 2027 | Data Act switching and data export for cloud services must be free of charge. | Cloud and software service providers | [CMP-53](https://agentwranglers.se/playbook/compliance/product-and-sector-laws/data-act-switching.md) | | 2 August 2027 | General-purpose AI models placed on the market before 2 August 2025 must meet the model duties. | Providers of general-purpose AI models | [CMP-45](https://agentwranglers.se/playbook/compliance/ai-act/gpai-provider-duties.md) | | 2 December 2027 | AI Act duties for high-risk systems in Annex III start, such as hiring, credit scoring and education. | Providers and deployers of high-risk AI | [CMP-44](https://agentwranglers.se/playbook/compliance/ai-act/ai-high-risk-check.md) | | 11 December 2027 | The Cyber Resilience Act applies in full. That means security by design, vulnerability handling, published advisories, a support period, a technical file and CE marking. | Makers of apps, software and devices sold in the EU | [CMP-50](https://agentwranglers.se/playbook/compliance/product-and-sector-laws/cra-support-period.md), [CMP-51](https://agentwranglers.se/playbook/compliance/product-and-sector-laws/cra-technical-file.md), [CMP-73](https://agentwranglers.se/playbook/compliance/product-and-sector-laws/security-advisories.md) | | 11 December 2027 | The radio equipment cybersecurity rules (Delegated Regulation (EU) 2022/30) end, repealed by Delegated Regulation (EU) 2026/339. The Cyber Resilience Act takes over for connected devices. | Makers of wireless and internet-connected devices sold in the EU | [IOT-1](https://agentwranglers.se/playbook/connected-devices/device-identity/unique-device-credentials.md) | | 2 August 2028 | AI Act duties for high-risk AI in products under Annex I start, such as medical devices and machinery. | Makers of regulated products with AI | [CMP-44](https://agentwranglers.se/playbook/compliance/ai-act/ai-high-risk-check.md) | | 28 June 2030 | Service contracts signed before 28 June 2025 lose their transition period under the European Accessibility Act. | Shops, banks and other covered services | [CMP-52](https://agentwranglers.se/playbook/compliance/product-and-sector-laws/accessibility-act-duty.md) | | 31 December 2030 | EU post-quantum roadmap. High-risk uses must have moved to quantum-safe cryptography, and quantum-safe updates are on by default. | Operators of critical systems and their suppliers | [SEC-108](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/post-quantum-readiness.md), [WEB-158](https://agentwranglers.se/playbook/website/hosting-and-network/tls-configuration.md) | The post-quantum roadmap continues after this table. Medium-risk uses should move by 31 December 2035, and low-risk uses as far as feasible by then. The roadmap is a recommendation to member states, not a law, but NIS2 supervisors and large customers already ask about it. ## Proposals to watch The Digital Omnibus, proposal COM(2025) 837 of 19 November 2025, would change the GDPR and the cookie rules. It is a proposal, not a law. The Council agreed its negotiating position on 21 October 2026. The European Parliament had not adopted its position by then, so talks between the two had not started. The final text can differ from the proposal in every point below. - A personal data breach would go to the authority only when it is likely to bring a high risk to people. The deadline would grow from 72 to 96 hours, through one EU entry point for incident reports. - Some cookies and device access would need no consent. Examples are a service the person asked for, audience measurement for the site's own use, and security. - Where consent is needed, refusing would take a single click. After a refusal, a site could not ask again for the same purpose for at least six months. - Sites would have to accept consent and refusal sent automatically by the browser, 24 months after the law enters into force. Browsers would have to send such signals after 48 months. - Developing and running an AI system or model could rely on legitimate interest as its legal basis, with safeguards and a balancing test. Plan for today's rules until the final text appears in the Official Journal. Treating a browser privacy signal as a refusal already works today, as [honour the Global Privacy Control signal](https://agentwranglers.se/playbook/website/privacy/global-privacy-control.md) says. Breach deadlines stay as [start every reporting clock from one moment](https://agentwranglers.se/playbook/compliance/breaches-and-reporting/reporting-clocks.md) describes until the change applies. ## Sources - [AI Act, Regulation (EU) 2024/1689](https://eur-lex.europa.eu/eli/reg/2024/1689/oj) and [Regulation (EU) 2026/1744, the Digital Omnibus on AI](https://eur-lex.europa.eu/eli/reg/2026/1744/oj) - [Code of Practice on transparency of AI-generated content](https://digital-strategy.ec.europa.eu/en/policies/code-practice-ai-generated-content) - [Cyber Resilience Act, Regulation (EU) 2024/2847](https://eur-lex.europa.eu/eli/reg/2024/2847/oj) and [Data Act, Regulation (EU) 2023/2854](https://eur-lex.europa.eu/eli/reg/2023/2854/oj) - [Product Liability Directive (EU) 2024/2853](https://eur-lex.europa.eu/eli/dir/2024/2853/oj) and [European Accessibility Act, Directive (EU) 2019/882](https://eur-lex.europa.eu/eli/dir/2019/882/oj) - [A Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography](https://digital-strategy.ec.europa.eu/en/library/coordinated-implementation-roadmap-transition-post-quantum-cryptography) - [Digital Omnibus proposal, procedure 2025/0360(COD)](https://oeil.europarl.europa.eu/oeil/en/procedure-file?reference=2025%2F0360%28COD%29) - [Texas SB 2420, bill history](https://capitol.texas.gov/BillLookup/History.aspx?LegSess=89R&Bill=SB2420), [Apple, age requirements for Utah and Louisiana](https://developer.apple.com/news/?id=f5zj08ey) and [Google Play, changes for US app store bills](https://support.google.com/googleplay/android-developer/answer/16569691) - Previous: [Online platforms](https://agentwranglers.se/playbook/compliance/online-platforms.md) - [All chapters](https://agentwranglers.se/playbook/compliance.md)