Regulatory changelog

High-risk obligations for AI embedded in products covered by harmonisation legislation (medical devices, machinery...).

EU AI Act · Official source

Security-by-design requirements for products with digital elements placed on the EU market (reporting duties start Sept. 2026).

Cyber Resilience Act · Official source

Full obligations for standalone high-risk AI systems (HR, credit, education, justice...). Deferred from August 2026 to December 2027 by the June 2026 omnibus.

EU AI Act · Official source

Bill C-36 (tabled June 2026) would replace PIPEDA Part 1: new Commission, fines up to C$25M or 5% of global revenue. Estimated adoption date.

Projet de loi C-36 (PPCDA) · Official source

The substantive Data Fiduciary obligations (notice, consent, security, breach notification, rights) apply eighteen months after the Rules were notified. The internal programme mentions 14 May; the exact date is to be confirmed at review.

DPDP Act 2023 / Rules 2025 · Official source

Narrowed automated-decision transparency (ADMT) framework, delayed and rewritten by SB 26-189 (May 2026).

Colorado AI Act · Official source

Announced enforcement date for the federal data protection law (Decree-Law 45/2021), pending executive regulations. Date to be verified.

PDPL (EAU) · Official source

Ley 21.719 (GDPR-style) replaces Ley 19.628; new Data Protection Agency and substantial penalties.

Ley 21.719 · Official source

The consent-manager provisions of the DPDP Rules 2025 (notified 13 November 2025) take effect twelve months after publication.

DPDP Rules 2025 · Official source

Two years after the transposition deadline (Oct. 2024), essential and important entities should revalidate scope, risk management and 24h/72h notification procedures.

NIS2 · Official source

Chatbots, deepfakes and AI-generated content must be clearly disclosed. Kept at August 2, 2026 by the digital omnibus.

EU AI Act · Official source

Data protection assessments become mandatory for high-risk processing created on or after June 1, 2026.

KCDPA · Official source

Three new comprehensive state privacy laws applicable since January 1, 2026.

INCDPA / KCDPA / RIDTPPA · Official source

Targeted prohibitions (manipulation, social scoring, intentional discrimination) and public-sector disclosure duties.

TRAIGA · Official source

Ban on AI discrimination in employment decisions and duty to notify candidates/employees of AI use.

HB 3773 · Official source

Law 91/2025/QH15 replaces the 2023 PDPD decree: penalties up to 5% of revenue, ban on selling personal data.

PDPL 2025 · Official source

The NDPC's GAID (March 2025) details how the NDPA applies: registration of controllers of major importance, annual compliance audits, DPO. Effective date to be confirmed.

NDPA 2023 — GAID · Official source

Commencement phase of the 2024 PDPA amendments: mandatory DPO appointment and breach notification to the Commissioner. Phase date to be confirmed.

PDPA (amendé 2024) · Official source