# Identity Compliance Deadlines in 2027: A Checklist for IAM Teams Source: https://startwithidentity.com/articles/identity-compliance-deadlines-2027/ Last updated: 2026-11-05 License: content by Start with Identity. Cite the source URL. --- **In 2027, identity teams face 22 dated obligations in SWI's [identity compliance calendar](https://startwithidentity.com/regulations/calendar/), and most of them ask for evidence that controls ran all year, not just that they exist.** The ones with the largest identity impact are CCPA's automated decisionmaking rules (January 1), the NYDFS Part 500 certification (April 15), India's DPDP Rules (May), the EU AML Regulation (July 10), CMMC Phase 3 (November 10), AI Act high-risk obligations for remote biometric identification (December 2), the Cyber Resilience Act (December 11) and EUDI Wallet acceptance by regulated private relying parties (December 24). Below is each deadline, then a checklist of what to have in place, by control area. This is educational material, not legal advice. Whether a rule applies to you depends on your jurisdiction, sector and size; confirm scope with counsel. Dates and descriptions come from the calendar dataset, which cites the official source for every entry and was verified on October 31, 2026. ## The 2027 identity deadlines at a glance Of the 22 obligations dated in 2027, the calendar tags 14 with audit, logging and accountability, 10 with identity verification, 7 with authentication and MFA, 7 with customer identity and consent, 3 with privileged access, 2 with identity governance and 1 with breach notification. One obligation can carry several tags. | Date | Obligation | Identity areas | |---|---|---| | Jan 1 | [CCPA: ADMT rules apply](https://startwithidentity.com/regulations/calendar/#2027-01-01-ccpa-admt-compliance) ([CCPA/CPRA](https://startwithidentity.com/regulations/united-states/ccpa-cpra/)) | Consent, verification | | Jan 1 | [Colorado ADMT law takes effect](https://startwithidentity.com/regulations/calendar/#2027-01-01-colorado-admt-act) | Consent, audit | | Jan 1 | [Delaware DPDPA amendments](https://startwithidentity.com/regulations/calendar/#2027-01-01-delaware-dpdpa-amendments) ([Delaware DPDPA](https://startwithidentity.com/regulations/united-states/dpdpa-delaware/)) | Consent, verification, audit | | Mar 31 | [DORA registers of information (2027 cycle)](https://startwithidentity.com/regulations/calendar/#2027-03-31-dora-register-of-information-2027) ([DORA](https://startwithidentity.com/regulations/european-union/dora/)) | Audit, governance | | Apr 1 | [Maryland MODPA cure period ends](https://startwithidentity.com/regulations/calendar/#2027-04-01-maryland-modpa-cure-period-ends) ([MODPA](https://startwithidentity.com/regulations/united-states/modpa/)) | Consent | | Apr 15 | [NYDFS Part 500 annual certification](https://startwithidentity.com/regulations/calendar/#2027-04-15-nydfs-part-500-annual-notice-of-compliance-2027) ([NYDFS Part 500](https://startwithidentity.com/regulations/united-states/nydfs-part-500/)) | MFA, PAM, audit | | Apr 17 | [NIS2 entity list review](https://startwithidentity.com/regulations/calendar/#2027-04-17-nis2-entity-list-review) ([NIS2](https://startwithidentity.com/regulations/european-union/nis2/)) | Audit | | May | [India DPDP core obligations apply](https://startwithidentity.com/regulations/calendar/#2027-05-01-india-dpdp-full-obligations) ([DPDP Act](https://startwithidentity.com/regulations/india/dpdp-act/)) | Consent, breach notification, MFA, audit | | Jul 9 | [Instant Payments: verification of payee, non-euro PSPs](https://startwithidentity.com/regulations/calendar/#2027-07-09-instant-payments-non-euro-verification-of-payee) | Verification | | Jul 10 | [EU AML Regulation applies](https://startwithidentity.com/regulations/calendar/#2027-07-10-amlr-applies) | Verification, audit | | Nov 10 | [CMMC Phase 3](https://startwithidentity.com/regulations/calendar/#2027-11-10-cmmc-phase-3) | MFA, PAM, audit | | Dec 2 | [AI Act high-risk obligations for Annex III biometrics](https://startwithidentity.com/regulations/calendar/#2027-12-02-ai-act-high-risk-annex-iii-biometrics) ([EU AI Act](https://startwithidentity.com/regulations/european-union/eu-ai-act/)) | Verification, audit, governance | | Dec 11 | [Cyber Resilience Act main obligations](https://startwithidentity.com/regulations/calendar/#2027-12-11-cra-full-application) ([CRA](https://startwithidentity.com/regulations/european-union/cyber-resilience-act/)) | MFA, PAM, audit | | Dec 24 | [EUDI Wallet acceptance by private relying parties](https://startwithidentity.com/regulations/calendar/#2027-12-24-eudi-wallet-private-relying-party-acceptance) ([eIDAS 2](https://startwithidentity.com/regulations/european-union/eidas-2/)) | MFA, verification, consent | | Dec 31 | [CCPA risk assessments for existing processing](https://startwithidentity.com/regulations/calendar/#2027-12-31-ccpa-risk-assessments-existing-processing) | Consent, audit | The rest of the 22 are recurring filings and procedural milestones: Italy's NIS registration (February 28) and annual update (May 31), the Instant Payments receive deadline for non-euro-area providers (January 9), AMLA's first selection of directly supervised entities (from July 1), AMLD6 transposition (July 10), the NIS2 Commission review (October 17) and the expected start of Switzerland's e-ID trust infrastructure in the first half of 2027. Two late-2026 deadlines lead straight into this list: [CMMC Phase 2](https://startwithidentity.com/regulations/calendar/#2026-11-10-cmmc-phase-2) on November 10, 2026, and the [EUDI Wallet availability deadline](https://startwithidentity.com/regulations/calendar/#2026-12-24-eudi-wallet-availability) of December 24, 2026, when every Member State must offer at least one wallet. ## Checklist by control area ### Authentication and MFA **Deadlines:** NYDFS Part 500 (April 15), India DPDP (May), CMMC Phase 3 (November 10), CRA (December 11), EUDI Wallet acceptance (December 24). - [ ] **NYDFS:** confirm universal [MFA](https://startwithidentity.com/glossary/mfa/) under section 500.12 covered every user and every system for all of 2026. It has applied since November 1, 2025, so the certification due April 15, 2027 covers the first full calendar year in which it applied. Pull IdP sign-in logs that show the method used, and list every documented exception. - [ ] **CMMC:** if you hold Controlled Unclassified Information, map your MFA and [least privilege](https://startwithidentity.com/glossary/least-privilege/) controls to NIST SP 800-171 now. Level 2 assessments are run by a C3PAO from Phase 2, and Phase 3 makes Level 2 a condition of award for all applicable contracts. - [ ] **Phishing resistance:** none of these rules in the calendar names a specific factor, but the [breach data](https://startwithidentity.com/reports/identity-breach-report-2026/#finding-2) shows why codes and push are weak evidence of control: MFA was bypassed in 25 of the 40 breaches where MFA status was known. Requiring [phishing-resistant MFA](https://startwithidentity.com/glossary/phishing-resistant-mfa/) at the IdP is covered in the [SSO-first enforcement playbook](https://startwithidentity.com/articles/enforce-phishing-resistant-mfa-across-saas/). - [ ] **EUDI Wallet:** if you are a bank, insurer, transport, energy, health, telecom or education provider required to use strong user authentication, or a very large online platform, plan to accept the [EUDI Wallet](https://startwithidentity.com/glossary/eudi-wallet/) for authentication at the user's request by December 24, 2027. That means an [OpenID4VP](https://startwithidentity.com/glossary/openid4vp/) verifier in your login flow, registration as a relying party in the wallet ecosystem, and a decision on how a wallet login maps to existing accounts. See the [eIDAS 2 and EUDI Wallet standard page](https://startwithidentity.com/standards/eidas-2-eudi-wallet/) and [OpenID for Verifiable Credentials](https://startwithidentity.com/standards/openid4vc/). ### Privileged access **Deadlines:** NYDFS Part 500 (April 15), CMMC Phase 3 (November 10), CRA (December 11). - [ ] Inventory privileged accounts, including [service accounts](https://startwithidentity.com/glossary/service-account/) and [break-glass](https://startwithidentity.com/glossary/break-glass/) accounts, with an owner for each. - [ ] Move standing admin rights to [just-in-time access](https://startwithidentity.com/glossary/jit-access/) where the platform allows it, and keep approval records. See the [zero standing privileges rollout](https://startwithidentity.com/guides/implementation/zero-standing-privileges-rollout/). - [ ] **CRA, if you make identity products:** the calendar records that identity management systems, PAM products and biometric readers are classed as important products. From December 11, 2027 they must meet the essential cybersecurity requirements, including protection against unauthorized access through authentication and identity management, and pass conformity assessment before CE marking. Product teams at identity vendors should treat this as a release gate, not a document. ### Audit, logging and accountability **Deadlines:** 14 of the 22, including DORA (March 31), NYDFS (April 15), India DPDP (May), AMLR (July 10), AI Act (December 2) and CCPA risk assessments (December 31). - [ ] **India DPDP:** the rules require reasonable security safeguards such as access control and logging, and one-year log retention. If May 2027 is your start date, retention settings must already be in place before then. Check that IdP, application and admin logs are kept for a year and are searchable. - [ ] **DORA:** financial entities deliver registers of information on ICT third-party arrangements to their competent authority on national timelines, ahead of the ESAs' March 31 date. The calendar notes that identity and access providers are among the ICT third-party providers listed. Make sure your IdP, PAM, MFA and verification vendors are in the register with accurate contract data. See [identity controls for DORA](https://startwithidentity.com/guides/compliance/identity-controls-for-dora/). - [ ] **NIS2:** Member States review entity lists by April 17, 2027, and in-scope entities may be asked to refresh their registration data. Keep a current record of the systems and owners behind your NIS2 identity controls. See [identity controls for NIS2](https://startwithidentity.com/guides/compliance/identity-controls-for-nis2/). - [ ] **Evidence package:** run [access certifications](https://startwithidentity.com/glossary/access-certification/) on a schedule that produces at least one complete cycle before each audit, and keep the revocations, not just the completions. The [IAM audit preparation guide](https://startwithidentity.com/guides/compliance/iam-audit-preparation-guide/) and [access review checklist](https://startwithidentity.com/templates/access-review-checklist/) cover the artifacts. ### Identity verification and KYC **Deadlines:** Verification of payee for non-euro PSPs (July 9), AMLR (July 10), AI Act Annex III (December 2), EUDI Wallet acceptance (December 24). - [ ] **AMLR:** from July 10, 2027 directly applicable customer due diligence rules replace national transpositions: identification and verification of customers and beneficial owners, including remote onboarding using eIDAS electronic identification means, plus record-keeping. Review your [KYC](https://startwithidentity.com/glossary/kyc/) and [AML](https://startwithidentity.com/glossary/aml/) onboarding flows against the single rulebook, and check that remote onboarding can accept eIDAS means. See the [customer identity verification guide](https://startwithidentity.com/guides/compliance/customer-identity-verification-guide/). - [ ] **Verification of payee:** payment providers in EU Member States outside the euro area must check the payee's name against the account identifier before a euro credit transfer is authorized, from July 9, 2027. - [ ] **AI Act:** from December 2, 2027, high-risk obligations (risk management, data governance, logging, human oversight, accuracy requirements and provider and deployer duties) apply to Annex III systems, which include remote biometric identification, biometric categorisation and emotion recognition. The date was deferred from August 2, 2026 by the Digital Omnibus. If your verification or authentication stack uses biometrics, ask your vendor in writing whether any component is an Annex III system and who carries the provider duties. - [ ] **Reusable credentials:** the AMLR and wallet deadlines point the same way. The [reusable identity and KYC with verifiable credentials guide](https://startwithidentity.com/guides/decentralized-identity/reusable-identity-and-kyc-with-verifiable-credentials/) covers the design. ### Customer identity and consent **Deadlines:** CCPA ADMT (January 1), Colorado ADMT (January 1), Delaware amendments (January 1), Maryland cure period (April 1), India DPDP (May), CCPA risk assessments (December 31). - [ ] **CCPA ADMT:** businesses already using automated decisionmaking technology for significant decisions must comply by January 1, 2027, with pre-use notice, opt-out (or an exception) and access rights covering how the ADMT affects the consumer. The calendar entry notes that this can include identity or fraud scoring used in such decisions. List every place your CIAM or fraud stack automatically denies a service. - [ ] **CCPA risk assessments:** for significant-risk processing that began before the regulations took effect, including processing biometric data, a documented risk assessment is due by December 31, 2027. - [ ] **Colorado:** SB 26-189 includes a consumer right to request and correct inaccurate personal data used by ADMT; the Attorney General is to adopt implementing rules before January 1, 2027. - [ ] **Delaware:** amended thresholds take effect and sensitive data, which requires consent, is broader. Recheck what your sign-up flow collects. - [ ] **Maryland:** the discretionary 60-day cure period applies only to violations on or before April 1, 2027; later violations can go straight to enforcement. - [ ] **India DPDP:** verifiable consent, including for children, and a notice at collection. Your [consent management](https://startwithidentity.com/glossary/consent-management/) records must show what each user agreed to and when. See [CIAM consent and preference management](https://startwithidentity.com/articles/ciam-consent-preference-management/). ### Breach notification **Deadline:** India DPDP (May). - [ ] Add DPDP personal data breach notification to the notification matrix in your [identity incident response runbook](https://startwithidentity.com/templates/identity-incident-response-runbook/), with owners and contact routes. ## Why the evidence matters Regulators cite missing controls when they are easy to see. In SWI's [Identity Breach Report 2026](https://startwithidentity.com/reports/identity-breach-report-2026/#finding-8), breaches where MFA was absent drew a regulatory or legal outcome in 6 of 15 cases (40%), against 9 of 75 (12%) where MFA status was unknown or not applicable. Two of the four fines in that dataset, 23andMe and PayPal, cite the lack of required MFA in the regulator's own finding. The same report notes that outcomes tend to arrive about two years after disclosure, so a gap in 2027 can become a finding in 2029. ## A working order for the year 1. **By January 1:** CCPA ADMT inventory and notices; Delaware data mapping. 2. **By March:** DORA register updated for identity vendors; NYDFS evidence for 2026 assembled. 3. **By May:** India DPDP logging, one-year retention, consent records and breach notification in place. 4. **By July:** AMLR due diligence and verification of payee live for EU payments. 5. **By November:** CMMC Level 2 evidence ready for assessment. 6. **By December:** AI Act biometric classification confirmed with vendors, CRA conformity for identity products, EUDI Wallet acceptance in production, CCPA risk assessments complete. Subscribe to the [calendar](https://startwithidentity.com/regulations/calendar/) feed for changes; entries are re-verified against their official sources. For vendor selection against these requirements, see the [compliant IGA platforms](https://startwithidentity.com/rankings/best-compliant-iga-platforms/), [compliant PAM platforms](https://startwithidentity.com/rankings/best-compliant-pam-platforms/) and [compliant CIAM platforms](https://startwithidentity.com/rankings/best-compliant-ciam-platforms/) rankings, and the [regulations hub](https://startwithidentity.com/regulations/) for the full text of each rule's identity requirements.