Translate regulatory changes into requirements, evidence and actions for your buying team.
First SB 253 emissions submission for in-scope reporting entities; CARB’s initial regulation became effective on 12 October 2026.
upcoming
Comment deadline for proposed interagency third-party risk management guidance. This is a consultation date, not a new compliance deadline.
proposed
IIA Organizational Behavior Topical Requirement becomes effective.
upcoming
California ADMT requirements begin for covered uses making significant decisions.
upcoming
Colorado’s replacement automated decision-making law takes effect.
upcoming
Start of the first cybersecurity-audit coverage period for the earliest California audit cohort.
upcoming
IIA Organizational Resilience Topical Requirement becomes effective.
upcoming
Compliance with the 2024 Part 2 final rule was required by 16 February 2026. HHS also launched its civil enforcement programme from that date.
confirmed
No final replacement was established by the official sources reviewed. HHS continues to describe the overhaul as a proposed rule.
proposed
The official record reviewed still shows the final rule pending White House review, not an operative final reporting regime.
undated
Status reflects the supplied research’s 28 October 2026 cut-off.
Legal and compliance specialists should approve those determinations.
Prioritise an accurate obligation register, defensible evidence and changeable workflows—not the largest regulatory content library.
Treat cybersecurity audits, privacy risk assessments and automated decision-making as three connected—but separately scoped—workflows.
Colorado’s operative planning baseline is the 2026 replacement legislation, not an unchanged implementation of the original 2024 AI Act.
The final November 2025 implementation milestones are already in force; they are now an evidence and exception-management problem.
Both implementation deadlines have passed: larger entities were due on 3 December 2025 and smaller entities on 3 June 2026.
Three separate developments matter: revised model-risk guidance, proposed third-party guidance and an updated examination work programme.
Treat Part 2 implementation as a current obligation, the HIPAA Security Rule overhaul as proposed, and the newly announced HTI-5 rule as a separate certification-programme change.
The official record reviewed still shows the final rule pending White House review, not an operative final reporting regime.
No: the July 2026 suspension changes that planning assumption.
The immediate task is an applicability and submission decision for 10 November 2026—not a broad ESG-platform transformation.
The implementation requirement is engagement-level applicability and evidence, not merely adding new audit-universe labels.
The high-risk timetable has changed, and a single “August 2026 AI Act deadline” is no longer an adequate implementation plan.
It warrants a separate data-access assessment where the programme’s transaction and data conditions may apply.
Use synthetic data and require the same scenario from every shortlisted supplier:
Our recommendation is to close immediate obligation and evidence gaps first, then implement reusable platform capabilities.
Official regulators, government records and standard-setting bodies support the regulatory conclusions below.
No questions match. Try a different term.
Strong fit for US enterprise GRC selection and implementation: dates, legal status and affected workflows are connected to concrete acceptance tests and operating responsibilities. Extensive official-source research captures several superseded or suspended planning assumptions. Coverage is deliberately selective rather than an exhaustive legal inventory; newly announced HTI-5 details, pending rulemaking, court developments and organisation-specific exemptions require follow-up. Search terms are integrated naturally without turning the report into a vendor-ranking or pricing page.
Download this section as Markdown · Reading progress is saved only in this browser.