The short answer
The biggest 2027 deadlines for websites and apps: California's CCPA rules on automated decision-making from 1 January 2027, Colorado's ADMT law effective the same day, India's DPDP Rules obligations from 14 May 2027, and the EU AI Act's high-risk duties for hiring, credit and education uses from 2 December 2027. Before them, Australia's automated-decision disclosures start on 10 December 2026.
Key takeaways
- Late 2026: India's consent-manager rules (13 Nov), the end of the EU AI Act's marking grace period (2 Dec) and Australia's automated-decision disclosures in privacy policies (10 Dec).
- 1 January 2027: California's ADMT compliance date and Colorado's SB 26-189, which replaced the 2024 Colorado AI Act.
- 14 May 2027: India's DPDP Rules notice, consent, security, breach, children's data and rights obligations.
- 2 December 2027: EU AI Act high-risk duties for Annex III uses, after the Digital Omnibus postponement.
- SafeLaunch's rulebook is versioned and dated, so each report names the rules that applied on the day it ran.
On this page
01
Every deadline from November 2026 to the end of 2027
| Date | Law | What starts | Who it affects |
|---|---|---|---|
| 13 Nov 2026 | India DPDP Rules 2025 | Consent Manager registration rules | Platforms that want to act as consent managers |
| 2 Dec 2026 | EU AI Act Art. 50(2) | End of the grace period for machine-readable marking of AI output, for systems already on the market | Providers of generative AI |
| 10 Dec 2026 | Australia Privacy Act (2024 amendments) | Privacy policies must disclose certain automated decisions; the Children's Online Privacy Code is due | Businesses covered by the Australian Privacy Principles |
| 1 Jan 2027 | California CCPA regulations | Pre-use notice and opt-out for automated decision-making used for significant decisions | CCPA-covered businesses using ADMT |
| 1 Jan 2027 | Colorado SB 26-189 | Notice when ADMT influences consequential decisions; explanation and human review for adverse decisions (enforcement after rulemaking) | Developers and deployers of ADMT |
| 14 May 2027 | India DPDP Act & Rules 2025 | Notice, consent, security, breach intimation, children's data and rights | Anyone processing personal data in India or offering services to people in India |
| 1 Jul 2027 | California SB 243 | Annual reports by companion chatbot operators | AI companion chatbot operators |
| 2 Dec 2027 | EU AI Act (Digital Omnibus) | High-risk duties for Annex III uses: hiring, credit, education, essential services | Providers and deployers of high-risk AI |
| 2028 to 2030 | California CCPA regulations | Cybersecurity audits, phased by business size | Larger CCPA-covered businesses |
| 2 Aug 2028 | EU AI Act | High-risk duties for AI in products covered by Annex I | Product manufacturers using AI |
02
What already started in 2026?
If you haven't checked your site this year, these changes from 2026 apply now:
| Date | Change |
|---|---|
| 1 Jan 2026 | Indiana, Kentucky and Rhode Island comprehensive privacy laws; Texas TRAIGA; California SB 243 for companion chatbots; Illinois's AI-in-employment amendment; amended China Cybersecurity Law; new CCPA regulations take effect |
| 22 Jan 2026 | South Korea's AI Basic Act (fines after a grace period of at least a year) |
| 5 Feb 2026 | UK Data (Use and Access) Act 2025: cookie consent exemption for statistics-only analytics; PECR fines raised to UK GDPR levels |
| March 2026 | Brazil's Digital ECA (Law 15.211/2025) for children's online protection |
| 22 Apr 2026 | Full compliance with the amended US COPPA Rule |
| 1 Jun 2026 | New York's rewritten Rule 7.1 on lawyer advertising |
| 2 Aug 2026 | EU AI Act Article 50 transparency, including chatbot disclosure; California AI Transparency Act (SB 942) |
03
What should a website or app do now?
- 01
If people in India use your product
Build the DPDP notice, consent, rights and breach process now; testing takes time. See the DPDP checklist.
- 02
If your product uses AI to make decisions about people
Plan notices, opt-outs and human review for California and Colorado, and check whether any use is high-risk under the EU AI Act.
- 03
If your product has a chatbot or generates content
Make sure the AI disclosure is live and AI output is marked. See the Article 50 guide.
- 04
If you sell in Australia
Update your privacy policy for automated decisions before 10 December 2026.
- 05
Everyone
Re-check after each deadline. A free scan uses the current rulebook, and every paid report names the rulebook version it was checked against.
One free fix in your inbox each week
A new copy-paste prompt for Lovable, Cursor or Claude Code every week, with the rule behind it and how to check it worked. No spam, unsubscribe in one click.
By signing up you agree to get this weekly email. We send it with Kit, and you can unsubscribe at any time. What we share with Kit is in our privacy notice.
FAQ
Frequently asked questions.
Sources and further reading
- SafeLaunch rulebook and dated changelog
- EU AI Act, Regulation (EU) 2024/1689
- California Privacy Protection Agency: regulations
- DPDP Rules, 2025 (PIB)
This article is general information, not legal advice. SafeLaunch is automated software, not a law firm; a report records what was checked on one version and is not a certificate of compliance. Read the disclaimer.
From the founder
SafeLaunch is built by Raghav R Handa, a lawyer-turned-builder in New Delhi. He writes about this topic in plain English:
See what SafeLaunch finds on your product.
Paste a link and get your score, the most serious problems and what already passes, in about a minute.
Keep reading