Why Your Compliance Calendar for 2026 Is Already Behind

Why Your Compliance Calendar for 2026 Is Already Behind

If your compliance calendar for 2026 still looks like a lightly edited copy of 2025, you have a problem. The regulatory landscape shifting under AI governance alone would be enough to warrant a rebuild. Layer on updated privacy frameworks, sector-specific rules hitting enforcement phases, and a handful of international obligations that now carry real teeth, and you are looking at a year where "we will figure it out in Q1" is genuinely risky.

Here is what should already be on your radar, broken down by quarter, with particular attention to the AI-specific deadlines that keep catching people off guard.

Q1 2026: The Year Starts Fast

EU AI Act, Article 6 High-Risk Obligations (February 2, 2026)

The big one. After the prohibited practices ban took effect in February 2025, the next major EU AI Act milestone lands on February 2, 2026, when obligations for providers and deployers of high-risk AI systems under Annex III become enforceable. If you are operating AI in areas like credit scoring, employment screening, insurance risk assessment, or educational admissions within the EU (or targeting EU persons), this is your hard deadline for conformity assessments, risk management systems, human oversight mechanisms, and technical documentation under Articles 9 through 15.

Penalties scale up to 35 million EUR or 7% of global annual turnover for prohibited practices violations, and up to 15 million EUR or 3% for other non-compliance. Those numbers are not theoretical anymore.

State-Level AI Laws in the U.S.

Colorado's SB 24-205, the Artificial Intelligence Act, has a compliance date of February 1, 2026. It requires deployers of high-risk AI systems to use reasonable care to avoid algorithmic discrimination. The law mandates impact assessments, public disclosure of AI use in consequential decisions, and a notice-and-opt-out framework for consumers. If you operate in financial services, healthcare, education, or insurance in Colorado, this one is live in weeks once the year turns.

Illinois is also worth watching. The Illinois AI Video Interview Act (AIVRA) has been in effect, but proposed amendments circulating in 2025 could expand its scope. Keep an eye on the legislative session starting in January.

DORA Full Enforcement (Ongoing from January 2025)

The Digital Operational Resilience Act hit its application date on January 17, 2025, but supervisory authorities across the EU are ramping up enforcement actions through early 2026. If you are a financial services firm or an ICT third-party service provider, expect the European Supervisory Authorities to start making examples. The Regulatory Technical Standards (RTS) on ICT risk management, incident classification, and third-party oversight are all live, and audit cycles will be in full swing by Q1 2026.

Q2 2026: Privacy and Sector Rules Tighten

HIPAA Security Rule Updates

HHS published a Notice of Proposed Rulemaking in late 2024 to modernize the HIPAA Security Rule for the first time in over a decade. Depending on the final rule timeline, covered entities and business associates could face new requirements around encryption mandates (no more "addressable" ambiguity), network segmentation, multifactor authentication, and 72-hour incident notification to HHS. If the final rule lands in early 2026 as projected, expect a compliance window of 180 days for most entities, putting the effective date squarely in Q2 or Q3. For small entities, the window may extend to 360 days, but the planning needs to start now.

SEC Cybersecurity Disclosure Rules, Year Two

The SEC's cybersecurity disclosure rules under Item 1.05 of Form 8-K and Regulation S-K Item 106 have been in effect since December 2023 for larger registrants. By 2026, the Commission will have two full years of filings to benchmark against, and enforcement actions for inadequate or delayed disclosures are increasingly likely. The SEC's Crypto Assets and Cyber Unit (renamed from the Cyber Unit in 2022) has been staffing up. If your 10-K risk factor disclosures on cybersecurity governance still read like boilerplate, expect scrutiny.

Q3 2026: International Obligations Mature

EU AI Act, General-Purpose AI Models (August 2, 2026)

August 2, 2026 is when obligations for general-purpose AI (GPAI) model providers under Articles 51 through 56 become enforceable. This covers transparency requirements, technical documentation, copyright compliance, and, for GPAI models with systemic risk, adversarial testing and incident reporting. If you are deploying foundation models or fine-tuning third-party GPAI models for enterprise use, you need to understand your position in the value chain. The distinction between "provider" and "deployer" under the Act determines your obligations, and it is more nuanced than most summaries suggest.

UK AI Framework Evolution

The UK's pro-innovation approach to AI regulation, initially outlined in the March 2023 white paper, has been evolving under the current government. The AI Safety Institute continues expanding its remit, and sector regulators like the FCA, Ofcom, and the CMA have been publishing AI-specific guidance throughout 2025. By mid-2026, expect more concrete enforcement positions from these regulators, particularly the FCA around AI use in consumer financial products.

Q4 2026: The Catch-Up Quarter Nobody Wants

CMMC 2.0 Enforcement Ramp

The Cybersecurity Maturity Model Certification program finalized its rule in late 2024, with a phased implementation timeline. By Q4 2026, DoD contracts will increasingly require Level 2 certification (the 110 NIST SP 800-171 controls assessed by a C3PAO). If you are in the defense industrial base and still treating CMMC as a future problem, the contract modification cycle will catch you. Prime contractors are already flowing down certification requirements to subs.

State Privacy Law Enforcement Actions

By the end of 2026, roughly 20 U.S. states will have comprehensive privacy laws in effect. Texas, with its broad TDPSA and an AG's office that has already shown willingness to enforce (see the $1.4 billion Google settlement in 2024), is one to watch. Montana, Oregon, Delaware, Iowa, Tennessee, Indiana, and others all have laws that took effect in 2024 and 2025. Enforcement patterns will be clearer by Q4, and the companies that treated these as "CCPA-lite" without doing state-specific gap analyses will be the ones getting letters.

The AI-Specific Deadlines You Are Probably Missing

Beyond the EU AI Act milestones, there are several AI-related compliance dates that tend to fall through the cracks:

• NIST AI RMF voluntary adoption benchmarks. While not mandatory, federal agencies are increasingly referencing NIST AI 600-1 (the Generative AI Profile) in procurement requirements. If you sell to the federal government, alignment with this framework is becoming a de facto requirement.
• OMB Memorandum M-24-10 implementation. Federal agencies had until December 1, 2024 to implement AI governance requirements, including designating Chief AI Officers and completing rights-impacting AI use case inventories. Vendors and contractors supporting these agencies need to align their own documentation and risk management practices accordingly through 2026.
• NYC Local Law 144 enforcement trends. In effect since July 2023, this automated employment decision tool (AEDT) law has seen slow but steady enforcement by the DCWP. By 2026, audit and bias testing requirements under this law will have generated enough enforcement history to set clear expectations for similar laws in other jurisdictions.
• Canada's AIDA (Artificial Intelligence and Data Act). Part of Bill C-27, AIDA's timeline remains uncertain after parliamentary delays, but if passed, it would create obligations around high-impact AI systems with penalties up to 25 million CAD or 5% of global revenue. Even in draft form, it signals where Canadian regulatory expectations are heading.

How FirmAdapt Addresses This

FirmAdapt's platform was built for exactly this kind of overlapping, multi-jurisdictional regulatory environment. The compliance mapping engine tracks obligations across frameworks, including the EU AI Act, HIPAA, CMMC, state privacy laws, and sector-specific rules, and surfaces upcoming deadlines tied to your specific operational footprint. Rather than maintaining a static spreadsheet that drifts out of date by March, you get a continuously updated view of what applies to you and when.

On the AI governance side specifically, FirmAdapt's architecture supports the documentation, risk assessment, and audit trail requirements that regulators are now expecting. Conformity assessments for high-risk AI systems, bias testing documentation, and GPAI transparency obligations can be managed within the same platform you use for your broader compliance program. It is a single system of record for organizations that are tired of stitching together point solutions across regulatory domains.