Compliance updates

What's changing in 2026 and 2027

Rules affecting IT controls, security, data protection and AI governance with key dates between late 2026 and the end of 2027, across the US and the countries FindingFirst covers. Each entry links to its source so you can check the current position.

Last verified October 13, 2026. Pending items can change at any time. Entries marked law firm summary link to a reputable secondary source where the official text was not available to confirm the date.

Dates show when obligations start, not whether they apply to your organization. Ask counsel or your auditor which ones apply to you. FindingFirst gives no guidance on sanctions, export control or trade restrictions.

United States, federal United States, states European Union United Kingdom Canada Asia Pacific

United States, federal

Rule	What it covers	Key dates	Source
PCAOB QC 1000	New quality control standard for audit firms, including how firms manage technology and resources. Adopted, future date	December 15, 2026	PCAOB announcement
PCAOB amendments on technology assisted analysis	Sets auditor duties when testing electronic data with technology, which affects how system reports are tested. In force	Audits of fiscal years beginning on or after December 15, 2025, so most calendar 2026 audits	PCAOB implementation page
CMMC 2.0	Cybersecurity certification for defense contractors, phasing in. In force, phasing in	Phase 2: November 10, 2026. Phase 3: November 10, 2027	32 CFR 170.3 (eCFR) · dates law firm summary
HIPAA Security Rule update	Proposed stricter required safeguards for health data. Not final. Pending	Final rule now targeted for July 2027	status report law firm summary
PCI DSS	Payment card security. Version 4.0.1 remains current; no newer version has been published. In force	No new date	PCI SSC document library

United States, states

Rule	What it covers	Key dates	Source
California CCPA regulations	Mandatory cybersecurity audits, privacy risk assessments and rules for automated decision making. In force, phasing in	Took effect January 1, 2026. Automated decision rules from January 1, 2027. Audit certifications due from April 1, 2028 by company size	California Privacy Protection Agency · phase in law firm summary
Colorado SB 26-189	Replaces the original Colorado AI Act with notice, explanation and human review rights for automated decisions. Adopted, future date	January 1, 2027	Colorado General Assembly
Connecticut privacy amendments	Facial recognition rules, a ban on selling precise geolocation, and data broker registration. Adopted, future date	October 1, 2026; broker registration January 1, 2027	summary law firm summary
Oklahoma privacy law (SB 546)	Comprehensive consumer privacy. Adopted, future date	January 1, 2027	summary law firm summary
Louisiana privacy law	Comprehensive consumer privacy. Adopted, future date	January 1, 2027	summary law firm summary
Alabama privacy law (HB 351)	Comprehensive consumer privacy. Adopted, future date	May 1, 2027	summary law firm summary

European Union

Rule	What it covers	Key dates	Source
EU AI Act, as amended by the Digital Omnibus	AI obligations by risk level. The amendment moved the high risk deadlines later. In force, phasing in	December 2, 2026: certain prohibitions and watermarking. August 2, 2027: legacy general purpose AI models. December 2, 2027: Annex III high risk systems. August 2, 2028: Annex I high risk systems	Official Journal (EUR-Lex)
Cyber Resilience Act	Security requirements for products with digital elements. In force, phasing in	September 11, 2026: reporting of exploited vulnerabilities and severe incidents. December 11, 2027: full application	European Commission
Data Act	Access to and sharing of connected device data, and cloud switching. In force, phasing in	September 12, 2026: access by design for new products. September 12, 2027: unfair terms rules reach older long term contracts	European Commission
NIS2	Cybersecurity duties for essential and important entities. In force, transposition ongoing	Some member states were still transposing it as of mid 2026	transposition tracker law firm summary

United Kingdom

Rule	What it covers	Key dates	Source
Data (Use and Access) Act 2025	UK GDPR reforms and regulator restructuring. In force	Main data protection changes in force since February 5, 2026	GOV.UK commencement plan
Cyber Security and Resilience Bill	Extends the NIS rules to managed service providers and data centres. Pending	No dates yet	UK Parliament

Canada

Rule	What it covers	Key dates	Source
Bill C-36, Protecting Privacy and Consumer Data Act	Federal private sector privacy reform that would replace part of PIPEDA. Pending	Introduced June 15, 2026; no in force date	summary law firm summary

Asia Pacific

Rule	What it covers	Key dates	Source
India DPDP Rules 2025	Personal data protection obligations, phasing in. Adopted, future date	November 13, 2026: consent manager framework. May 13, 2027: core obligations, including security safeguards and breach reporting	Government of India · dates law firm summary
Japan APPI amendments	First administrative fines, biometric data rules and tougher penalties. Adopted, future date	January 17, 2027: tougher criminal penalties. Main reforms no later than July 17, 2028	summary law firm summary
Australia Privacy Act reforms	Privacy policies must disclose automated decision making. Adopted, future date	December 10, 2026	OAIC
South Korea AI Basic Act	AI transparency and high impact AI duties. In force, grace period	In force January 22, 2026; fines held back until about January 2027	summary law firm summary
China network data security risk assessment measures	Risk assessments for network data processors. In force	August 20, 2026	summary law firm summary

For the laws and regulators in each country, see Coverage by country.

See how your issue plays out by country

Describe a control issue, pick every country it touches, and the free preview shows which rules may apply and where the answer changes.

Check an issue free