A hiring feature planned for 2028, an EU voice product and an open-weight model release need different regulatory plans. Identify the system's use and your legal role before putting a compliance date on the roadmap.
This is a selected planning calendar, checked against the official sources linked below on 6 November 2026. It is not a complete compliance register or legal advice. Ask counsel to map the current text, exceptions and transition rules to the specific product before committing a release date.
Read diagram description
Timeline of selected milestones from 2025 to 2028, as checked on 6 November 2026. EU: original AI Act prohibitions from February 2025, general-purpose model provider duties from August 2025, Article 50 transparency duties from August 2026, two new prohibitions on non-consensual intimate deepfakes and child sexual abuse material from 2 December 2026, Annex III high-risk obligations on 2 December 2027 and Annex I product obligations on 2 August 2028. US: Executive Order 14365 in December 2025, Texas TRAIGA from January 2026, Pennsylvania's Act 99 on deceptive synthetic advertising approved in October 2026, and New York's RAISE Act and Colorado's SB 26-189 in January 2027. India: DPDP Rules notified 13 November 2025, with consent-manager rules from November 2026 and notices, security, breach, children's data and rights from May 2027.
European Union
The original prohibitions have applied since February 2025; workplace emotion recognition is among them, subject to narrow medical and safety exceptions. The 2026 amending regulation, Regulation (EU) 2026/1744, published on 24 July 2026, adds two prohibitions that apply from 2 December 2026: AI that generates realistic intimate or sexually explicit images, video or audio of an identifiable person without their explicit consent, and AI that generates child sexual abuse material. For providers, the ban reaches systems where this is the intended purpose or a foreseeable, reproducible outcome without adequate safeguards. Any image, video or voice product with EU users needs those safeguards tested before that date. Do not treat a later high-risk deadline as permission to ship prohibited functionality.
The same regulation rewrote the AI literacy duty in Article 4: providers and deployers must take measures to support AI literacy, without having to guarantee any specific level of it.
Obligations for providers of general-purpose AI models have applied since 2 August 2025. Providers that release models under free and open-source licences have lighter documentation duties, unless the model is classed as carrying systemic risk.
The 2026 amendments also changed the high-risk timetable. Keep the version of the law used for each planning decision in the regulatory register; an old slide with the original dates is insufficient.
Article 50 transparency duties generally apply from 2 August 2026. The transition for Article 50(2) machine-readable marking concerns systems already placed on the market before that date; it is not a blanket delay for all disclosure duties. Under the amended Article 111(4), providers of generative systems placed on the market before 2 August 2026 must comply with Article 50(2) by 2 December 2026, the same day as the new prohibitions. Confirm with counsel whether a given system qualifies for that transition.
The amended Article 113 and the Commission's enforcement timetable place Annex III high-risk obligations on 2 December 2027 and Annex I regulated-product obligations on 2 August 2028. Recruitment and certain credit and insurance uses fall within Annex III; classify the actual feature and applicable exceptions before assigning its obligations.
United States
Existing sector and consumer-protection law continues to apply. Executive Order 14365, dated 11 December 2025, directs the Attorney General to set up a task force to challenge state AI laws. The order itself does not automatically invalidate any state requirement, and as of November 2026 no court has held a state AI law preempted on that basis; the Justice Department has intervened in individual cases, such as a challenge to Colorado's law. Track actual legal changes with counsel.
Texas TRAIGA's enacted text sets a 1 January 2026 effective date. California's SB 53 guidance covers duties for frontier developers. New York's RAISE Act, as rewritten by chapter 96 of the laws of 2026 (signed 27 March 2026), takes effect on 1 January 2027. Determine whether your organisation and model fall within each statute's scope before adding work to an application team's backlog.
Colorado SB 26-189, enacted on 14 May 2026, replaces the 2024 framework and schedules requirements for 1 January 2027. The attorney general must adopt rules by that date; interim draft rules were published in October 2026 and a hearing held on 26 October, but final rules were not yet adopted when we checked. Do not assume rulemaking suspends the statutory date. Revisit plans built around the superseded law.
Pennsylvania's SB 806, approved on 22 October 2026 as Act 99 of 2026, the Artificial Intelligence Deceptive Advertising Act, targets advertising that uses AI-generated or AI-modified content to mislead consumers without a clear disclosure. If your product generates ad creative, ask counsel for the enacted text and its effective date before designing the disclosure.
India
India's Digital Personal Data Protection Rules were notified on 13 November 2025, and the official announcement describes an eighteen-month phase-in. The notification sets three dates: definitions and the Data Protection Board from publication; the consent-manager rule one year later, around 13 November 2026; and the rules on notices, security safeguards, breach reporting, children's data, data principals' rights and cross-border transfer eighteen months later, around 13 May 2027. Map each obligation to its own commencement provision. For an AI chatbot, inventory personal data in prompts, logs and eval sets, then assign retention and deletion owners. Do not assume every obligation began on the announcement date.
Turning dates into roadmap decisions
Use the calendar to assign dependencies and owners.
If a feature falls into a high-risk category, plan the compliance work as part of the feature, not after it. Risk management, data governance, logging, human oversight and documentation take quarters to put in place, and a December 2027 deadline means building that capacity during 2027 at the latest.
For synthetic media, separate the provider's machine-readable marking work from the deployer's disclosure duties. Confirm which rules and exceptions apply to the release before choosing the implementation date.
If a feature would be prohibited in one market and allowed in another, decide early whether to build it at all. Shipping a capability in some regions and not others carries a product cost, a support cost and a reputational one, and it is usually cheaper to choose a design that works everywhere.
In the interview
In a practice answer, state the date and source of your regulatory assumptions, classify the feature, and work backwards from the applicable milestone. If classification remains uncertain, name the legal question and make the dependent launch decision conditional on its resolution.
Questions about this topic
As of November 2026, under the 2026 amending regulation (EU) 2026/1744, the obligations for Annex III high-risk systems such as hiring, credit and education apply from 2 December 2027, and those for Annex I regulated products from 2 August 2028. Confirm current dates with counsel.