AI Regulation Deadline Tracker

Annual independent bias audit for automated employment tools

Local Law 144

Who it lands on

Employers and employment agencies using automated tools in hiring or promotion decisions in New York City.

What it requires

An annual bias audit by an independent auditor, published summary of results, and candidate notice.

Exposure

$500-1,500 per day, per violation.

5 July 2023 is the enforcement start date. Covered tools require an independent audit within one year of use, public audit information and notices at least ten business days before use.

Texas Responsible AI Governance Act in force

TRAIGA (HB 149)

Who it lands on

Government agencies, healthcare providers and their vendors, and anyone deploying AI toward Texas consumers.

What it requires

AI interaction disclosure for government entities and healthcare providers in specified circumstances; prohibited-use rules have a wider scope.

Exposure

Curable violations $10-12K each; uncurable $80-200K; continuing violations $2-40K per day.

Defences and cure provisions have conditions. Framework alignment alone should not be treated as blanket immunity; review the enacted provisions for the actual use.

Training data disclosure

AB 2013

Who it lands on

Developers of generative AI systems made available to Californians.

What it requires

A published, documented summary of the datasets used to train the system.

Frontier model transparency and safety reporting

SB 53 (TFAIA)

Who it lands on

Frontier developers above the compute threshold, with the heavier obligations attaching above a large revenue threshold.

What it requires

Published safety framework, incident reporting, and transparency reporting.

Scope depends on the statutory frontier-model and developer definitions. The safety-framework duty and incident-reporting duty do not have identical thresholds.

Prior Colorado AI Act repealed before it ever took effect

SB 24-205, repealed by SB 26-189

Who it lands on

Teams that built compliance programs against SB 24-205's high-risk framework.

What it requires

Nothing, as of the repeal date. The duty-of-care standard, annual impact assessments, and risk-management programs were all eliminated with the statute that required them. What survives is the narrower notice, explanation, and human-review regime in the row above.

Kept on this list deliberately: a repealed law is easy to keep preparing for by accident. Work already done against the old framework is not wasted — inventory and data-flow mapping carry straight over — but impact-assessment templates can be retired.

Transparency obligations applicable

EU AI Act, Article 50 — Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744

Who it lands on

Providers and deployers of systems that interact with people or generate synthetic content, selling into the EU.

What it requires

Disclosure at the interaction boundary, marking of synthetic content in a machine-readable form, and records that show both are actually happening.

The transparency duties themselves were left untouched by the AI Omnibus; the only change was the marking grace period below.

California AI Transparency Act — provenance obligations

SB 942 (as amended by AB 853)

Who it lands on

Large generative AI providers serving California users.

What it requires

Provenance disclosure and content marking on generated output, plus a detection path.

Attorney General complaint portal required

TRAIGA (HB 149)

Who it lands on

Everyone in scope of TRAIGA, indirectly.

What it requires

This is a deadline for the Attorney General to provide a complaint channel, not a direct engineering duty on a business. The date alone does not verify that the portal is operational.

Content-marking grace period ends for legacy systems

Regulation (EU) 2026/1744 — the AI Omnibus, amending the transitional provisions for Article 50(2)

Who it lands on

Systems already in service before the transparency obligations became applicable.

What it requires

The marking mechanics that new systems already needed, retrofitted onto the deployed estate. This is the one that is usually underestimated: retrofitting provenance into an existing generation path is engineering work, not a policy update.

Adopted 8 July 2026 and in force since 27 July 2026. The transition covers only the Article 50(2) marking duty for qualifying pre-August systems; it does not postpone the other transparency duties.

Colorado AI Act replacement takes effect

SB 26-189

Who it lands on

Deployers of systems making consequential decisions about Colorado residents.

What it requires

Pre-use notice, notice within 30 days of an adverse decision, a human review path, and three years of records.

Exposure

Up to $20K per violation.

Review the enacted definitions, exceptions and cure provisions for the specific workflow. The effective date is separate from any enforcement action.

High-risk obligations apply to Annex III systems

EU AI Act, Annex III

Who it lands on

Systems in the listed high-risk categories: employment, credit, essential services, education, and the rest of the Annex III list.

What it requires

Risk management, data governance, technical documentation, logging, human oversight, accuracy and robustness measures, and conformity assessment.

This date moved once already. It is the deadline most people plan around and the one least safe to treat as fixed — in either direction.

High-risk obligations apply to Annex I systems

EU AI Act, Annex I

Who it lands on

AI embedded in products already covered by EU product-safety legislation.

What it requires

The high-risk regime, routed through the existing sectoral conformity assessment rather than a standalone one.