44 identity compliance deadlines before 2029, in one calendar you can subscribe to

As of November 5, 2026, there were 44 dated regulatory obligations between then and the end of 2028 that touch identity: how people are verified, how they log in, who holds privileged access and when a breach must be reported. Start with Identity's Identity Compliance Calendar puts them in one place, with the 38 that already fell due in 2026, for 82 events. Every date comes from a legislature, official gazette, regulator or government site, and each event links to the page we checked, with the date we last checked it (October 31 or November 5, 2026).

What the calendar is

Each entry is one obligation: the date and its precision (day, month or year), who it applies to, what changes, the identity controls it touches, and the official source. Where a source only gives a month, as India's DPDP Rules effectively do, the entry says so instead of inventing a day. Two entries are marked expected because the official body states a target, not a date.

Three ways to use it:

• Browse the calendar page, search it, and filter by identity control.
• Subscribe to the feed at https://startwithidentity.com/regulations/calendar.ics. In Outlook, choose Add calendar, then Subscribe from web. In Google Calendar, choose Other calendars, then From URL. Corrections arrive without re-importing.
• Download the data as CSV or JSON.

Why we built it

Identity deadlines are scattered across privacy, financial, cybersecurity and AI law, and a date quoted second-hand goes stale fast. The AI Act's high-risk rules for biometric systems were due on August 2, 2026 until the Digital Omnibus on AI, in force since July 27, 2026, moved them to December 2, 2027. A calendar that accepts only official sources, and says when it last checked them, is what we wanted for our own regulations hub.

The busiest quarters

The rest of 2026 and the first quarter of 2027 are the most crowded stretches ahead, with eight events each. India's Consent Manager rules took effect in November; still to come are CMMC Phase 2 on November 10, Australia's automated-decision transparency duty on December 10, and the deadline for EU Member States to offer a digital identity wallet on December 24.

The first quarter of 2027 is led by January 1, when California's automated decisionmaking rules apply and the FedRAMP Consolidated Rules for 2026 become mandatory for agencies, cloud providers and assessors. The last quarter of 2027 has six, and they weigh most on identity teams: the AI Act's biometric rules, the Cyber Resilience Act's main obligations and mandatory wallet acceptance all fall within four weeks.

Six deadlines that matter most for identity teams

1. December 24, 2026: EU Digital Identity Wallets. Every Member State must offer at least one wallet, under eIDAS 2. Trust service providers must also be able to verify attributes such as age and address against public authentic sources.
2. January 1, 2027: CCPA automated decisionmaking. Businesses that use ADMT for significant decisions, which can include identity and fraud scoring, need pre-use notices and opt-out handling under the CCPA regulations.
3. May 2027: India's DPDP Rules. Notice, verifiable consent, security safeguards including access control and logging, and breach notification apply to all Data Fiduciaries under the DPDP Act.
4. July 10, 2027: EU AML Regulation. One directly applicable customer due diligence rulebook replaces national rules, and it accepts eIDAS electronic identification at assurance level substantial or high for remote onboarding.
5. December 2027: three EU deadlines in a row. High-risk rules for remote biometric identification apply under the EU AI Act on December 2. The Cyber Resilience Act applies in full on December 11, and it classes identity management, PAM and biometric readers as important products. Banks, other regulated relying parties and very large online platforms must accept the wallet from December 24.
6. April 1, 2028: first CCPA cybersecurity audits. Businesses with more than $100 million in revenue must complete independent audits, which explicitly assess MFA (including phishing-resistant MFA), access controls and privileged accounts.

Recurring dates matter too. NYDFS Part 500 certifications are due every April 15, and the April 15, 2027 filing is the first to cover a full year with universal MFA required. DORA registers of information reach the European Supervisory Authorities every March 31.

Sector rules add US dates that are easy to miss. FedRAMP stops accepting new Rev5 certification applications on June 11, 2027, which leaves FedRAMP 20x, with its phishing-resistant MFA and just-in-time authorization indicators, as the route for new cloud offerings. The NERC CIP virtualization standards approved in FERC Order No. 919, which replace the current access management, remote access and system access control standards, take effect on July 1, 2028.

How different teams can use it

• GRC teams: subscribe to the feed. Each event names the regulation and links its source, so it can go straight into a control calendar or risk register.
• IAM leaders: filter by Authentication & MFA, Privileged access (PAM) or Identity verification (KYC/proofing) to see which deadlines will land on your roadmap, not just on legal's.
• Auditors: use the source link and the verified-on date as the evidence trail for "which version of the rule applied on this date."
• Analysts and research organizations: the CSV and JSON are free to reuse under CC BY 4.0, and stable ids (date plus slug) make changes easy to track.
• Vendor compliance teams: if you sell identity, PAM or IDV products in the EU, the Cyber Resilience Act dates (reporting since September 11, 2026, full application December 11, 2027) apply to you as a manufacturer.

Citing it and sending corrections

Cite it as: Start with Identity, Identity Compliance Calendar 2026-2028, startwithidentity.com/regulations/calendar/, with the access date. If a date moves, a regulator publishes a new one, or we missed an obligation, tell us with the official link and we will update the entry and its verified-on date.

The calendar is educational, not legal advice. Dates can change through later legislation or official notice, so confirm anything material against the linked source and with counsel.