When does the EU AI Act apply?

In stages. Transparency duties under Article 50 (chatbot and generative AI disclosure) and general-purpose AI rules apply as of August 2, 2026. High-risk obligations for hiring, credit and education systems (Annex III) apply from December 2, 2027 after the Digital Omnibus delay, and high-risk duties for AI in regulated products (Annex I) from August 2, 2028.

Was the Colorado AI Act delayed?

Colorado SB 26-189 replaces the Colorado AI Act, covering automated decisions in employment, housing, lending and insurance, from January 1, 2027.

Is Texas TRAIGA in effect?

Yes. The Texas Responsible Artificial Intelligence Governance Act has applied since January 1, 2026, with disclosure and prohibited-use duties. Documented alignment with the NIST AI RMF supports an affirmative defense.

Do we need AI governance if the deadlines were delayed?

Usually yes. Customers, insurers and partners ask for AI governance evidence through questionnaires and contracts now, regardless of regulatory dates.

AIRA › AI Laws and Deadlines Tracker

Updated November 12, 2026 · by Scott Walker

AI laws and deadlines tracker, 2026–2028

The EU and Colorado gave organizations more time in 2026. The customers, insurers and boards that fund and oversee you are asking for AI governance evidence today. Here's which rules apply now, which are coming, and what each one asks of you.

In effect now

Rule	Since	What it asks of you
EU AI Act, Article 50 and general-purpose AI rules	Aug 2, 2026	Transparency duties: chatbot and generative AI disclosure applies now, along with general-purpose AI model rules.
Texas TRAIGA	Jan 1, 2026	Disclosure and prohibited-use duties for Texas operations. Documented alignment with the NIST AI RMF supports an affirmative defense.
NYC Local Law 144	In effect	Annual bias audits for automated hiring tools.

Coming next

Rule	Date	What it asks of you
Colorado SB 26-189	Jan 1, 2027	Replaces the Colorado AI Act, covering automated decisions in employment, housing, lending and insurance.
California CCPA automated-decision rules	Jan 1, 2027	Notices, opt-outs and documented risk assessments for significant automated decisions. Risk assessments due by Dec 31, 2027.
EU AI Act, Annex III high-risk	Dec 2, 2027	High-risk obligations for hiring, credit and education systems, after the Digital Omnibus delay.
EU AI Act, Annex I high-risk	Aug 2, 2028	High-risk duties for AI in regulated products such as medical devices and machinery.

Voluntary, but increasingly required by buyers

Standard	Status	Why it matters
ISO/IEC 42001	Voluntary	Increasingly a procurement checkbox. Certification body accreditation under ISO/IEC 42006 is rolling out.
NIST AI RMF 1.0	Voluntary	The U.S. reference framework for AI risk, and the basis of the Texas TRAIGA affirmative defense.

Who's asking, even before the deadlines

Customers: procurement sends AI questionnaires and asks for ISO 42001 status before signing.
Insurers: underwriters ask how AI decisions are controlled, tested and monitored.
Regulators: fair lending, consumer protection and privacy rules already apply to AI decisions.
Boards: directors are expected to show oversight of AI risk they can evidence.
Your own staff: IBM's 2025 breach study found 1 in 5 organizations had a breach tied to unapproved "shadow" AI. You can't govern AI you haven't found.

Which of these apply to your AI?

An AI Risk Snapshot ($7,500, two weeks) inventories your AI systems, tiers their risk and maps the rules that apply, with a one-page governance summary you can attach to questionnaires.

Request a discovery call About AI risk assessments

Dates as of November 2026. We track changes monthly and confirm each date against the official text before it goes in a client report. This page identifies obligations; it is not legal advice. Your counsel decides how to interpret and act on them.