# What should enterprise GRC buyers prioritise?

**Prioritise an accurate obligation register, defensible evidence and changeable workflows—not the largest regulatory content library.** Our buying recommendation is to separate requirements already applicable, future compliance dates, proposals, supervisory guidance, professional standards and suspended implementation milestones before approving platform scope.

The distinction has immediate consequences. **10 November 2026 is the first California SB 253 emissions-reporting deadline, but it is no longer the scheduled launch of CMMC Phase II:** that implementation phase was suspended in July. A platform that treats both dates as active compliance deadlines is starting from the wrong requirements. ([content.govdelivery.com](https://content.govdelivery.com/accounts/CARB/bulletins/42ee5c1?utm_source=openai))

This report concentrates on changes that affect obligation mapping, controls, evidence, third-party risk, audit and reporting. Older changes appear where they remain important to migration or annual assurance. It is not an exhaustive inventory of banking, insurance, healthcare or securities law, and it does not establish applicability to an individual organisation. Legal and compliance specialists should approve those determinations.

### Which upcoming dates need an owner now?

| Date | Change and affected buyers | Recommended action |
|---|---|---|
| **10 November 2026** | First SB 253 emissions submission for in-scope reporting entities; CARB’s initial regulation became effective on 12 October 2026. | Resolve entity scope, submission route, evidence and approval immediately. ([content.govdelivery.com](https://content.govdelivery.com/accounts/CARB/bulletins/42ee5c1?utm_source=openai)) |
| **16 November 2026** | Comment deadline for proposed interagency third-party risk management guidance. This is a consultation date, not a new compliance deadline. | Decide whether to comment; retain a separate proposed-guidance mapping. ([occ.gov](https://www.occ.gov/topics/laws-and-regulations/occ-regulations/proposed-issuances/occ-proposed-issuances-2026.html?utm_source=openai)) |
| **15 December 2026** | IIA Organizational Behavior Topical Requirement becomes effective. | Update applicable assurance-engagement templates and exclusion documentation. ([theiia.org](https://www.theiia.org/en/standards/2024-standards/topical-requirements/organizational-behavior/?utm_source=openai)) |
| **1 January 2027** | California ADMT requirements begin for covered uses making significant decisions. | Complete use-case classification and test the relevant consumer-rights workflows. ([cppa.ca.gov](https://www.cppa.ca.gov/announcements/2025/20250923.html?utm_source=openai)) |
| **1 January 2027** | Colorado’s replacement automated decision-making law takes effect. | Replace obsolete statutory mappings and prepare developer/deployer workflows. ([coag.gov](https://coag.gov/ai/)) |
| **1 January 2027** | Start of the first cybersecurity-audit coverage period for the earliest California audit cohort. | Establish evidence collection before the period starts, rather than waiting for the 2028 report. ([cppa.ca.gov](https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf)) |
| **30 April 2027** | IIA Organizational Resilience Topical Requirement becomes effective. | Incorporate it into the 2027 audit-methodology change plan. ([theiia.org](https://www.theiia.org/en/standards/2024-standards/topical-requirements/organizational-resilience/)) |

**Recommended planning rule:** maintain separate fields for publication, legal effectiveness, compliance, evidence coverage and submission. Do not compress them into one “due date”. The California audit timetable is a particularly useful acceptance test for this distinction.