Identity Compliance Deadlines in 2027: A Checklist for IAM Teams

In 2027, identity teams face 22 dated obligations in SWI's identity compliance calendar, and most of them ask for evidence that controls ran all year, not just that they exist. The ones with the largest identity impact are CCPA's automated decisionmaking rules (January 1), the NYDFS Part 500 certification (April 15), India's DPDP Rules (May), the EU AML Regulation (July 10), CMMC Phase 3 (November 10), AI Act high-risk obligations for remote biometric identification (December 2), the Cyber Resilience Act (December 11) and EUDI Wallet acceptance by regulated private relying parties (December 24). Below is each deadline, then a checklist of what to have in place, by control area.

This is educational material, not legal advice. Whether a rule applies to you depends on your jurisdiction, sector and size; confirm scope with counsel. Dates and descriptions come from the calendar dataset, which cites the official source for every entry and was verified on October 31, 2026.

The 2027 identity deadlines at a glance

Of the 22 obligations dated in 2027, the calendar tags 14 with audit, logging and accountability, 10 with identity verification, 7 with authentication and MFA, 7 with customer identity and consent, 3 with privileged access, 2 with identity governance and 1 with breach notification. One obligation can carry several tags.

The rest of the 22 are recurring filings and procedural milestones: Italy's NIS registration (February 28) and annual update (May 31), the Instant Payments receive deadline for non-euro-area providers (January 9), AMLA's first selection of directly supervised entities (from July 1), AMLD6 transposition (July 10), the NIS2 Commission review (October 17) and the expected start of Switzerland's e-ID trust infrastructure in the first half of 2027.

Two late-2026 deadlines lead straight into this list: CMMC Phase 2 on November 10, 2026, and the EUDI Wallet availability deadline of December 24, 2026, when every Member State must offer at least one wallet.

Checklist by control area

Authentication and MFA

Deadlines: NYDFS Part 500 (April 15), India DPDP (May), CMMC Phase 3 (November 10), CRA (December 11), EUDI Wallet acceptance (December 24).

• NYDFS: confirm universal MFA under section 500.12 covered every user and every system for all of 2026. It has applied since November 1, 2025, so the certification due April 15, 2027 covers the first full calendar year in which it applied. Pull IdP sign-in logs that show the method used, and list every documented exception.
• CMMC: if you hold Controlled Unclassified Information, map your MFA and least privilege controls to NIST SP 800-171 now. Level 2 assessments are run by a C3PAO from Phase 2, and Phase 3 makes Level 2 a condition of award for all applicable contracts.
• Phishing resistance: none of these rules in the calendar names a specific factor, but the breach data shows why codes and push are weak evidence of control: MFA was bypassed in 25 of the 40 breaches where MFA status was known. Requiring phishing-resistant MFA at the IdP is covered in the SSO-first enforcement playbook.
• EUDI Wallet: if you are a bank, insurer, transport, energy, health, telecom or education provider required to use strong user authentication, or a very large online platform, plan to accept the EUDI Wallet for authentication at the user's request by December 24, 2027. That means an OpenID4VP verifier in your login flow, registration as a relying party in the wallet ecosystem, and a decision on how a wallet login maps to existing accounts. See the eIDAS 2 and EUDI Wallet standard page and OpenID for Verifiable Credentials.

Privileged access

Deadlines: NYDFS Part 500 (April 15), CMMC Phase 3 (November 10), CRA (December 11).

• Inventory privileged accounts, including service accounts and break-glass accounts, with an owner for each.
• Move standing admin rights to just-in-time access where the platform allows it, and keep approval records. See the zero standing privileges rollout.
• CRA, if you make identity products: the calendar records that identity management systems, PAM products and biometric readers are classed as important products. From December 11, 2027 they must meet the essential cybersecurity requirements, including protection against unauthorized access through authentication and identity management, and pass conformity assessment before CE marking. Product teams at identity vendors should treat this as a release gate, not a document.

Audit, logging and accountability

Deadlines: 14 of the 22, including DORA (March 31), NYDFS (April 15), India DPDP (May), AMLR (July 10), AI Act (December 2) and CCPA risk assessments (December 31).

• India DPDP: the rules require reasonable security safeguards such as access control and logging, and one-year log retention. If May 2027 is your start date, retention settings must already be in place before then. Check that IdP, application and admin logs are kept for a year and are searchable.
• DORA: financial entities deliver registers of information on ICT third-party arrangements to their competent authority on national timelines, ahead of the ESAs' March 31 date. The calendar notes that identity and access providers are among the ICT third-party providers listed. Make sure your IdP, PAM, MFA and verification vendors are in the register with accurate contract data. See identity controls for DORA.
• NIS2: Member States review entity lists by April 17, 2027, and in-scope entities may be asked to refresh their registration data. Keep a current record of the systems and owners behind your NIS2 identity controls. See identity controls for NIS2.
• Evidence package: run access certifications on a schedule that produces at least one complete cycle before each audit, and keep the revocations, not just the completions. The IAM audit preparation guide and access review checklist cover the artifacts.

Identity verification and KYC

Deadlines: Verification of payee for non-euro PSPs (July 9), AMLR (July 10), AI Act Annex III (December 2), EUDI Wallet acceptance (December 24).

• AMLR: from July 10, 2027 directly applicable customer due diligence rules replace national transpositions: identification and verification of customers and beneficial owners, including remote onboarding using eIDAS electronic identification means, plus record-keeping. Review your KYC and AML onboarding flows against the single rulebook, and check that remote onboarding can accept eIDAS means. See the customer identity verification guide.
• Verification of payee: payment providers in EU Member States outside the euro area must check the payee's name against the account identifier before a euro credit transfer is authorized, from July 9, 2027.
• AI Act: from December 2, 2027, high-risk obligations (risk management, data governance, logging, human oversight, accuracy requirements and provider and deployer duties) apply to Annex III systems, which include remote biometric identification, biometric categorisation and emotion recognition. The date was deferred from August 2, 2026 by the Digital Omnibus. If your verification or authentication stack uses biometrics, ask your vendor in writing whether any component is an Annex III system and who carries the provider duties.
• Reusable credentials: the AMLR and wallet deadlines point the same way. The reusable identity and KYC with verifiable credentials guide covers the design.

Customer identity and consent

Deadlines: CCPA ADMT (January 1), Colorado ADMT (January 1), Delaware amendments (January 1), Maryland cure period (April 1), India DPDP (May), CCPA risk assessments (December 31).

• CCPA ADMT: businesses already using automated decisionmaking technology for significant decisions must comply by January 1, 2027, with pre-use notice, opt-out (or an exception) and access rights covering how the ADMT affects the consumer. The calendar entry notes that this can include identity or fraud scoring used in such decisions. List every place your CIAM or fraud stack automatically denies a service.
• CCPA risk assessments: for significant-risk processing that began before the regulations took effect, including processing biometric data, a documented risk assessment is due by December 31, 2027.
• Colorado: SB 26-189 includes a consumer right to request and correct inaccurate personal data used by ADMT; the Attorney General is to adopt implementing rules before January 1, 2027.
• Delaware: amended thresholds take effect and sensitive data, which requires consent, is broader. Recheck what your sign-up flow collects.
• Maryland: the discretionary 60-day cure period applies only to violations on or before April 1, 2027; later violations can go straight to enforcement.
• India DPDP: verifiable consent, including for children, and a notice at collection. Your consent management records must show what each user agreed to and when. See CIAM consent and preference management.

Breach notification

Deadline: India DPDP (May).

• Add DPDP personal data breach notification to the notification matrix in your identity incident response runbook, with owners and contact routes.

Why the evidence matters

Regulators cite missing controls when they are easy to see. In SWI's Identity Breach Report 2026, breaches where MFA was absent drew a regulatory or legal outcome in 6 of 15 cases (40%), against 9 of 75 (12%) where MFA status was unknown or not applicable. Two of the four fines in that dataset, 23andMe and PayPal, cite the lack of required MFA in the regulator's own finding. The same report notes that outcomes tend to arrive about two years after disclosure, so a gap in 2027 can become a finding in 2029.

A working order for the year

1. By January 1: CCPA ADMT inventory and notices; Delaware data mapping.
2. By March: DORA register updated for identity vendors; NYDFS evidence for 2026 assembled.
3. By May: India DPDP logging, one-year retention, consent records and breach notification in place.
4. By July: AMLR due diligence and verification of payee live for EU payments.
5. By November: CMMC Level 2 evidence ready for assessment.
6. By December: AI Act biometric classification confirmed with vendors, CRA conformity for identity products, EUDI Wallet acceptance in production, CCPA risk assessments complete.

Subscribe to the calendar feed for changes; entries are re-verified against their official sources. For vendor selection against these requirements, see the compliant IGA platforms, compliant PAM platforms and compliant CIAM platforms rankings, and the regulations hub for the full text of each rule's identity requirements.