BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//Start with Identity//Identity Compliance Calendar//EN
CALSCALE:GREGORIAN
METHOD:PUBLISH
X-WR-CALNAME:Identity Compliance Calendar (Start with Identity)
X-WR-CALDESC:Dated identity-related regulatory obligations 2026-2028 from o
 fficial sources. Educational\, not legal advice.
REFRESH-INTERVAL;VALUE=DURATION:P1D
X-PUBLISHED-TTL:P1D
BEGIN:VEVENT
UID:2026-01-01-delete-act-drop-launch@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20260101
DTEND;VALUE=DATE:20260102
SUMMARY:California Delete Act: DROP opens to consumers
DESCRIPTION:California residents can submit one deletion request to all reg
 istered data brokers through the Delete Request and Opt-out Platform (DROP
 ).\nApplies to: Registered data brokers and California residents.\nStatus:
  past. Source: CalPrivacy: Delete Request and Opt-out Platform (DROP) time
 line https://privacy.ca.gov/drop/\nCalendar: https://startwithidentity.com
 /regulations/calendar/#2026-01-01-delete-act-drop-launch
LOCATION:United States (California)
URL:https://startwithidentity.com/regulations/calendar/#2026-01-01-delete-a
 ct-drop-launch
CATEGORIES:California Delete Act (SB 362)
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2026-01-01-ccpa-admt-risk-audit-regulations-effective@startwithidentity
 .com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20260101
DTEND;VALUE=DATE:20260102
SUMMARY:CCPA: regulations on ADMT\, risk assessments and cybersecurity audi
 ts take effect
DESCRIPTION:The CPPA regulations approved by the Office of Administrative L
 aw on 22 September 2025 take effect\, starting the clocks for risk assessm
 ents\, ADMT duties and cybersecurity audits.\nApplies to: Businesses subje
 ct to the California Consumer Privacy Act.\nStatus: past. Source: Californ
 ia Privacy Protection Agency: CCPA updates\, cybersecurity audits\, risk a
 ssessments and ADMT rulemaking https://cppa.ca.gov/regulations/ccpa_update
 s.html\nSWI summary: https://startwithidentity.com/regulations/united-stat
 es/ccpa-cpra/\nCalendar: https://startwithidentity.com/regulations/calenda
 r/#2026-01-01-ccpa-admt-risk-audit-regulations-effective
LOCATION:United States (California)
URL:https://startwithidentity.com/regulations/calendar/#2026-01-01-ccpa-adm
 t-risk-audit-regulations-effective
CATEGORIES:CCPA/CPRA regulations (11 CCR 7000 et seq.)
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2026-01-01-italy-nis-incident-reporting-starts@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20260101
DTEND;VALUE=DATE:20260102
SUMMARY:Italy NIS: significant-incident reporting obligation starts (Januar
 y 2026)
DESCRIPTION:ACN states that from January 2026 NIS entities must report sign
 ificant incidents\, including identity-driven compromises\, under the nati
 onal NIS framework.\nApplies to: Entities registered as NIS entities with 
 Italy's National Cybersecurity Agency (ACN).\nStatus: past. Source: Agenzi
 a per la Cybersicurezza Nazionale (ACN): NIS https://www.acn.gov.it/portal
 e/en/nis\nCalendar: https://startwithidentity.com/regulations/calendar/#20
 26-01-01-italy-nis-incident-reporting-starts
LOCATION:Italy
URL:https://startwithidentity.com/regulations/calendar/#2026-01-01-italy-ni
 s-incident-reporting-starts
CATEGORIES:NIS2 transposition (Legislative Decree 138/2024)
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2026-01-01-kentucky-consumer-data-protection-act@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20260101
DTEND;VALUE=DATE:20260102
SUMMARY:Kentucky Consumer Data Protection Act takes effect
DESCRIPTION:Consent is required for sensitive data\, including biometric da
 ta used to identify a person\; data protection assessments and consumer ri
 ghts apply\, with a 30-day notice-and-cure before Attorney General action.
 \nApplies to: Controllers and processors doing business in Kentucky that m
 eet the Act's consumer thresholds.\nStatus: past. Source: Kentucky General
  Assembly: 2024 Acts Chapter 72 (HB 15)\, Kentucky Consumer Data Protectio
 n Act https://apps.legislature.ky.gov/law/acts/24RS/documents/0072.pdf\nCa
 lendar: https://startwithidentity.com/regulations/calendar/#2026-01-01-ken
 tucky-consumer-data-protection-act
LOCATION:United States (Kentucky)
URL:https://startwithidentity.com/regulations/calendar/#2026-01-01-kentucky
 -consumer-data-protection-act
CATEGORIES:Kentucky Consumer Data Protection Act (2024 HB 15)
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2026-01-01-oregon-cure-period-ends@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20260101
DTEND;VALUE=DATE:20260102
SUMMARY:Oregon Consumer Privacy Act: cure period ends for most controllers
DESCRIPTION:From 1 January 2026 the Attorney General's 30-day notice-and-cu
 re step applies only to noncommercial educational broadcast stations\, and
  HB 2008 amendments banning the sale of precise geolocation data and data 
 of consumers known to be under 16 take effect.\nApplies to: Controllers su
 bject to the Oregon Consumer Privacy Act (other than noncommercial educati
 onal broadcast stations).\nStatus: past. Source: Oregon Legislature: ORS C
 hapter 646A https://www.oregonlegislature.gov/bills_laws/ors/ors646a.html\
 nSWI summary: https://startwithidentity.com/regulations/united-states/ocpa
 /\nCalendar: https://startwithidentity.com/regulations/calendar/#2026-01-0
 1-oregon-cure-period-ends
LOCATION:United States (Oregon)
URL:https://startwithidentity.com/regulations/calendar/#2026-01-01-oregon-c
 ure-period-ends
CATEGORIES:Oregon Consumer Privacy Act (ORS 646A.570 to 646A.589)
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2026-01-01-rhode-island-data-privacy-act@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20260101
DTEND;VALUE=DATE:20260102
SUMMARY:Rhode Island Data Transparency and Privacy Protection Act takes eff
 ect
DESCRIPTION:Consumer rights\, sensitive data consent (including biometric d
 ata) and data protection assessments apply from 1 January 2026.\nApplies t
 o: Businesses that control or process personal data of Rhode Island custom
 ers above the Act's thresholds.\nStatus: past. Source: Rhode Island Genera
 l Laws: Chapter 6-48.1\, Data Transparency and Privacy Protection Act http
 s://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm\nCalendar
 : https://startwithidentity.com/regulations/calendar/#2026-01-01-rhode-isl
 and-data-privacy-act
LOCATION:United States (Rhode Island)
URL:https://startwithidentity.com/regulations/calendar/#2026-01-01-rhode-is
 land-data-privacy-act
CATEGORIES:Rhode Island Data Transparency and Privacy Protection Act (R.I. 
 Gen. Laws 6-48.1)
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2026-01-01-vietnam-pdpl-effective@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20260101
DTEND;VALUE=DATE:20260102
SUMMARY:Vietnam Personal Data Protection Law takes effect
DESCRIPTION:The law takes effect on 1 January 2026\, setting consent\, sens
 itive data (including biometric data)\, cross-border transfer and breach n
 otification rules.\nApplies to: Organisations and individuals processing p
 ersonal data of people in Vietnam\, with a five-year option for small busi
 nesses and start-ups to defer certain obligations.\nStatus: past. Source: 
 Official Gazette of Vietnam (Cong bao): Law on Personal Data Protection No
 . 91/2025/QH15 https://congbaocdn.chinhphu.vn/CongBaoCP/VanBan/2025/6/4557
 8/57730-1-2025971-97291-2025-qh15.pdf\nSWI summary: https://startwithident
 ity.com/regulations/vietnam/vietnam-pdpl/\nCalendar: https://startwithiden
 tity.com/regulations/calendar/#2026-01-01-vietnam-pdpl-effective
LOCATION:Vietnam
URL:https://startwithidentity.com/regulations/calendar/#2026-01-01-vietnam-
 pdpl-effective
CATEGORIES:Law on Personal Data Protection No. 91/2025/QH15
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2026-01-09-japan-appi-reform-policy@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20260109
DTEND;VALUE=DATE:20260110
SUMMARY:Japan: PPC adopts APPI reform policy\, including facial feature dat
 a rules
DESCRIPTION:The Personal Information Protection Commission decided its trie
 nnial review policy: disclosures and opt-out prohibitions for facial featu
 re data\, parental consent under 16\, administrative monetary penalties an
 d relaxed low-risk breach notices\; it expects a bill as early as spring 2
 026\, effective about two years after passage.\nApplies to: Businesses han
 dling personal information in Japan\, especially those using facial recogn
 ition.\nStatus: past. Source: Personal Information Protection Commission\,
  Japan: System Reform Policy under the Triennial Review of the APPI https:
 //www.ppc.go.jp/en/topix/triennial_review_2026_02/\nSWI summary: https://s
 tartwithidentity.com/regulations/japan/appi/\nCalendar: https://startwithi
 dentity.com/regulations/calendar/#2026-01-09-japan-appi-reform-policy
LOCATION:Japan
URL:https://startwithidentity.com/regulations/calendar/#2026-01-09-japan-ap
 pi-reform-policy
CATEGORIES:Act on the Protection of Personal Information (APPI)
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2026-01-20-nis2-targeted-amendments-proposed@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20260120
DTEND;VALUE=DATE:20260121
SUMMARY:NIS2: Commission proposes targeted amendments in new cybersecurity 
 package
DESCRIPTION:The Commission proposed targeted amendments to NIS2 to increase
  legal clarity as part of a new cybersecurity package\; the proposal goes 
 through the ordinary legislative procedure before any change applies.\nApp
 lies to: Essential and important entities under NIS2 and the national auth
 orities that supervise them.\nStatus: past. Source: European Commission: N
 IS2 Directive policy page https://digital-strategy.ec.europa.eu/en/policie
 s/nis2-directive\nSWI summary: https://startwithidentity.com/regulations/e
 uropean-union/nis2/\nCalendar: https://startwithidentity.com/regulations/c
 alendar/#2026-01-20-nis2-targeted-amendments-proposed
LOCATION:European Union
URL:https://startwithidentity.com/regulations/calendar/#2026-01-20-nis2-tar
 geted-amendments-proposed
CATEGORIES:NIS2 Directive (Directive (EU) 2022/2555)
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2026-01-31-minnesota-cure-period-ends@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20260131
DTEND;VALUE=DATE:20260201
SUMMARY:Minnesota Consumer Data Privacy Act: cure period expires
DESCRIPTION:The 30-day warning-letter cure provision in section 325M.20 exp
 ires on 31 January 2026\, so the Attorney General can bring enforcement ac
 tions without first offering a cure.\nApplies to: Controllers and processo
 rs subject to the Minnesota Consumer Data Privacy Act.\nStatus: past. Sour
 ce: Minnesota Revisor of Statutes: section 325M.20 https://www.revisor.mn.
 gov/statutes/cite/325M.20\nSWI summary: https://startwithidentity.com/regu
 lations/united-states/mcdpa-minnesota/\nCalendar: https://startwithidentit
 y.com/regulations/calendar/#2026-01-31-minnesota-cure-period-ends
LOCATION:United States (Minnesota)
URL:https://startwithidentity.com/regulations/calendar/#2026-01-31-minnesot
 a-cure-period-ends
CATEGORIES:Minnesota Consumer Data Privacy Act (Minn. Stat. 325M)
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2026-02-05-duaa-main-data-protection-commencement@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20260205
DTEND;VALUE=DATE:20260206
SUMMARY:UK Data (Use and Access) Act: main data protection changes commence
DESCRIPTION:Commencement No. 6 Regulations bring most Part 5 changes into f
 orce\, including recognised legitimate interests\, revised automated decis
 ion-making rules with safeguards\, subject access changes and new cookie e
 xemptions.\nApplies to: Controllers and processors subject to the UK GDPR\
 , the Data Protection Act 2018 and PECR.\nStatus: past. Source: GOV.UK: Da
 ta (Use and Access) Act 2025\, plans for commencement https://www.gov.uk/g
 uidance/data-use-and-access-act-2025-plans-for-commencement\nSWI summary: 
 https://startwithidentity.com/regulations/united-kingdom/duaa-2025/\nCalen
 dar: https://startwithidentity.com/regulations/calendar/#2026-02-05-duaa-m
 ain-data-protection-commencement
LOCATION:United Kingdom
URL:https://startwithidentity.com/regulations/calendar/#2026-02-05-duaa-mai
 n-data-protection-commencement
CATEGORIES:Data (Use and Access) Act 2025
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2026-02-16-42-cfr-part-2-compliance@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20260216
DTEND;VALUE=DATE:20260217
SUMMARY:42 CFR Part 2 final rule: compliance date
DESCRIPTION:Part 2 programs must comply with the 2024 final rule\, which al
 igns consent\, breach notification and penalties with HIPAA.\nApplies to: 
 Federally assisted substance use disorder programs and lawful holders of P
 art 2 records.\nStatus: past. Source: Federal Register: Confidentiality of
  Substance Use Disorder Patient Records final rule (16 February 2024) http
 s://www.federalregister.gov/documents/2024/02/16/2024-02544/confidentialit
 y-of-substance-use-disorder-sud-patient-records\nCalendar: https://startwi
 thidentity.com/regulations/calendar/#2026-02-16-42-cfr-part-2-compliance
LOCATION:United States
URL:https://startwithidentity.com/regulations/calendar/#2026-02-16-42-cfr-p
 art-2-compliance
CATEGORIES:Confidentiality of Substance Use Disorder Patient Records (42 CF
 R Part 2)
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2026-02-28-italy-nis-registration-2026@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20260228
DTEND;VALUE=DATE:20260301
SUMMARY:Italy NIS: annual registration window closes
DESCRIPTION:ACN runs the registration and renewal window for NIS entities e
 ach year from 1 January to 28 February.\nApplies to: Entities in scope of 
 Italy's NIS regime.\nStatus: past. Source: Agenzia per la Cybersicurezza N
 azionale (ACN): NIS https://www.acn.gov.it/portale/en/nis\nCalendar: https
 ://startwithidentity.com/regulations/calendar/#2026-02-28-italy-nis-regist
 ration-2026
LOCATION:Italy
URL:https://startwithidentity.com/regulations/calendar/#2026-02-28-italy-ni
 s-registration-2026
CATEGORIES:NIS2 transposition (Legislative Decree 138/2024)
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2026-03-31-australia-aml-ctf-reforms-commence@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20260331
DTEND;VALUE=DATE:20260401
SUMMARY:Australia AML/CTF reforms commence\, including new customer due dil
 igence rules
DESCRIPTION:Schedules 1 to 3 commence on 31 March 2026\, replacing the cust
 omer due diligence framework (initial and ongoing CDD\, including identity
  verification) and expanding regulation to additional high-risk services.\
 nApplies to: Existing AUSTRAC reporting entities such as banks\, remitters
  and digital currency exchanges.\nStatus: past. Source: Federal Register o
 f Legislation: Anti-Money Laundering and Counter-Terrorism Financing Amend
 ment Act 2024 (as made) https://www.legislation.gov.au/C2024A00110/asmade/
 2024-12-10/text/original/pdf\nCalendar: https://startwithidentity.com/regu
 lations/calendar/#2026-03-31-australia-aml-ctf-reforms-commence
LOCATION:Australia
URL:https://startwithidentity.com/regulations/calendar/#2026-03-31-australi
 a-aml-ctf-reforms-commence
CATEGORIES:Anti-Money Laundering and Counter-Terrorism Financing Amendment 
 Act 2024
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2026-03-31-dora-register-of-information-2026@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20260331
DTEND;VALUE=DATE:20260401
SUMMARY:DORA: registers of information reported to the ESAs (2026 cycle)
DESCRIPTION:Under the ESAs Decision\, competent authorities submit the regi
 sters of information on ICT third-party arrangements to the ESAs by 31 Mar
 ch each year\, with a reference date of 31 December of the prior year\; fi
 nancial entities must deliver their registers to their competent authority
  earlier\, on national timelines.\nApplies to: EU financial entities\, thr
 ough their national competent authorities\, and the ICT third-party provid
 ers (including identity and access providers) listed in their registers.\n
 Status: past. Source: ESAs Decision on reporting by competent authorities 
 of information for CTPP designation (EIOPA) https://www.eiopa.europa.eu/pu
 blications/esas-decision-reporting-competent-authorities-esas-information-
 necessary-designation-critical-ict_en\nSWI summary: https://startwithident
 ity.com/regulations/european-union/dora/\nCalendar: https://startwithident
 ity.com/regulations/calendar/#2026-03-31-dora-register-of-information-2026
LOCATION:European Union
URL:https://startwithidentity.com/regulations/calendar/#2026-03-31-dora-reg
 ister-of-information-2026
CATEGORIES:DORA (Regulation (EU) 2022/2554)
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2026-04-01-maryland-modpa-processing-applies@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20260401
DTEND;VALUE=DATE:20260402
SUMMARY:Maryland Online Data Privacy Act applies to processing activities
DESCRIPTION:The Act\, in force since 1 October 2025\, applies to personal d
 ata processing activities from 1 April 2026\, including its strict necessi
 ty limits on collecting and processing sensitive data such as biometric da
 ta.\nApplies to: Controllers and processors subject to the Maryland Online
  Data Privacy Act.\nStatus: past. Source: Maryland General Assembly: 2024 
 Laws of Maryland Chapter 455 (SB 541) https://mgaleg.maryland.gov/2024RS/C
 hapters_noln/CH_455_sb0541e.pdf\nSWI summary: https://startwithidentity.co
 m/regulations/united-states/modpa/\nCalendar: https://startwithidentity.co
 m/regulations/calendar/#2026-04-01-maryland-modpa-processing-applies
LOCATION:United States (Maryland)
URL:https://startwithidentity.com/regulations/calendar/#2026-04-01-maryland
 -modpa-processing-applies
CATEGORIES:Maryland Online Data Privacy Act (2024 SB 541)
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2026-04-15-nydfs-part-500-annual-notice-of-compliance-2026@startwithide
 ntity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20260415
DTEND;VALUE=DATE:20260416
SUMMARY:NYDFS Part 500: annual certification of compliance or acknowledgmen
 t of noncompliance due (2026)
DESCRIPTION:Section 500.17(b) requires each covered entity to submit electr
 onically by April 15 a certification of material compliance for the prior 
 calendar year\, or an acknowledgment of noncompliance with a remediation t
 imeline\; universal MFA under section 500.12 has applied since 1 November 
 2025.\nApplies to: Banks\, insurers and other entities licensed by the New
  York Department of Financial Services.\nStatus: past. Source: NYDFS: 23 N
 YCRR Part 500 (Cybersecurity Requirements for Financial Services Companies
 ) https://www.dfs.ny.gov/cybersecurity/23-NYCRR-Part-500\nSWI summary: htt
 ps://startwithidentity.com/regulations/united-states/nydfs-part-500/\nCale
 ndar: https://startwithidentity.com/regulations/calendar/#2026-04-15-nydfs
 -part-500-annual-notice-of-compliance-2026
LOCATION:United States (New York)
URL:https://startwithidentity.com/regulations/calendar/#2026-04-15-nydfs-pa
 rt-500-annual-notice-of-compliance-2026
CATEGORIES:NYDFS 23 NYCRR Part 500
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2026-04-22-coppa-rule-amendments-compliance@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20260422
DTEND;VALUE=DATE:20260423
SUMMARY:FTC COPPA Rule amendments: compliance date
DESCRIPTION:Regulated entities must comply with the amended Rule\, which up
 dates verifiable parental consent methods (including knowledge-based and g
 overnment ID with facial match methods)\, adds biometric identifiers to pe
 rsonal information\, and requires a written information security program.\
 nApplies to: Operators of websites and online services directed to childre
 n under 13\, or with actual knowledge they collect children's personal inf
 ormation.\nStatus: past. Source: Federal Register: Children's Online Priva
 cy Protection Rule final rule (22 April 2025) https://www.federalregister.
 gov/documents/2025/04/22/2025-05904/childrens-online-privacy-protection-ru
 le\nSWI summary: https://startwithidentity.com/regulations/united-states/c
 oppa/\nCalendar: https://startwithidentity.com/regulations/calendar/#2026-
 04-22-coppa-rule-amendments-compliance
LOCATION:United States
URL:https://startwithidentity.com/regulations/calendar/#2026-04-22-coppa-ru
 le-amendments-compliance
CATEGORIES:COPPA Rule (16 CFR Part 312)
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2026-05-21-eidas-commission-review-report@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20260521
DTEND;VALUE=DATE:20260522
SUMMARY:eIDAS 2: Commission review report due
DESCRIPTION:Article 49 requires the Commission to review the application of
  the Regulation and report to Parliament and Council\, including whether t
 o modify its scope. The same date is set for assessing reference standards
  for advanced electronic signatures and seals.\nApplies to: The European C
 ommission.\nStatus: past. Source: Regulation (EU) 2024/1183 (European Digi
 tal Identity Framework)\, Official Journal text (Publications Office of th
 e EU) https://publications.europa.eu/resource/celex/32024R1183\nSWI summar
 y: https://startwithidentity.com/regulations/european-union/eidas-2/\nCale
 ndar: https://startwithidentity.com/regulations/calendar/#2026-05-21-eidas
 -commission-review-report
LOCATION:European Union
URL:https://startwithidentity.com/regulations/calendar/#2026-05-21-eidas-co
 mmission-review-report
CATEGORIES:eIDAS 2 (Regulation (EU) 2024/1183)
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2026-05-21-eidas-qtsp-conformity-reports@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20260521
DTEND;VALUE=DATE:20260522
SUMMARY:eIDAS 2: legacy qualified trust service providers file conformity a
 ssessment reports
DESCRIPTION:Must submit a conformity assessment report to their supervisory
  body proving compliance with the revised Article 24 rules\, which govern 
 how identity is verified before a qualified certificate or attestation is 
 issued.\nApplies to: Qualified trust service providers granted qualified s
 tatus before 20 May 2024.\nStatus: past. Source: Regulation (EU) 2024/1183
  (European Digital Identity Framework)\, Official Journal text (Publicatio
 ns Office of the EU) https://publications.europa.eu/resource/celex/32024R1
 183\nSWI summary: https://startwithidentity.com/regulations/european-union
 /eidas-2/\nCalendar: https://startwithidentity.com/regulations/calendar/#2
 026-05-21-eidas-qtsp-conformity-reports
LOCATION:European Union
URL:https://startwithidentity.com/regulations/calendar/#2026-05-21-eidas-qt
 sp-conformity-reports
CATEGORIES:eIDAS 2 (Regulation (EU) 2024/1183)
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2026-05-31-italy-nis-annual-update-2026@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20260531
DTEND;VALUE=DATE:20260601
SUMMARY:Italy NIS: annual information update due
DESCRIPTION:NIS entities must update their information on the ACN platform 
 by 31 May each year.\nApplies to: Registered NIS entities in Italy.\nStatu
 s: past. Source: Agenzia per la Cybersicurezza Nazionale (ACN): NIS https:
 //www.acn.gov.it/portale/en/nis\nCalendar: https://startwithidentity.com/r
 egulations/calendar/#2026-05-31-italy-nis-annual-update-2026
LOCATION:Italy
URL:https://startwithidentity.com/regulations/calendar/#2026-05-31-italy-ni
 s-annual-update-2026
CATEGORIES:NIS2 transposition (Legislative Decree 138/2024)
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2026-06-03-regulation-s-p-smaller-entities@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20260603
DTEND;VALUE=DATE:20260604
SUMMARY:SEC Regulation S-P amendments: compliance date for smaller entities
DESCRIPTION:Covered institutions must have an incident response program and
  notify affected individuals within 30 days when sensitive customer inform
 ation is\, or is reasonably likely to have been\, accessed or used without
  authorization\; the compliance period is 24 months after Federal Register
  publication on 3 June 2024.\nApplies to: Smaller broker-dealers\, investm
 ent companies\, registered investment advisers and transfer agents (larger
  entities had to comply six months earlier).\nStatus: past. Source: Federa
 l Register: Regulation S-P final rule (89 FR 47688\, 3 June 2024) https://
 www.federalregister.gov/documents/2024/06/03/2024-11116/regulation-s-p-pri
 vacy-of-consumer-financial-information-and-safeguarding-customer-informati
 on\nCalendar: https://startwithidentity.com/regulations/calendar/#2026-06-
 03-regulation-s-p-smaller-entities
LOCATION:United States
URL:https://startwithidentity.com/regulations/calendar/#2026-06-03-regulati
 on-s-p-smaller-entities
CATEGORIES:SEC Regulation S-P
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2026-06-09-uk-dvs-trust-framework-1-0@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20260609
DTEND;VALUE=DATE:20260610
SUMMARY:UK digital verification services trust framework 1.0 published as t
 he current certifiable version
DESCRIPTION:The Office for Digital Identities and Attributes published trus
 t framework 1.0 and updated which versions are current and which have expi
 red\; providers should read section 0 of the latest version to see which v
 ersions they can certify against.\nApplies to: Identity service providers 
 and attribute service providers certifying against the UK digital verifica
 tion services trust framework\, and the conformity assessment bodies that 
 certify them.\nStatus: past. Source: GOV.UK: UK digital verification servi
 ces trust framework collection (OfDIA) https://www.gov.uk/government/colle
 ctions/uk-digital-identity-and-attributes-trust-framework\nSWI summary: ht
 tps://startwithidentity.com/regulations/united-kingdom/duaa-2025/\nCalenda
 r: https://startwithidentity.com/regulations/calendar/#2026-06-09-uk-dvs-t
 rust-framework-1-0
LOCATION:United Kingdom
URL:https://startwithidentity.com/regulations/calendar/#2026-06-09-uk-dvs-t
 rust-framework-1-0
CATEGORIES:Data (Use and Access) Act 2025\, Part 2
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2026-06-11-cra-conformity-assessment-bodies@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20260611
DTEND;VALUE=DATE:20260612
SUMMARY:Cyber Resilience Act: rules on conformity assessment bodies apply
DESCRIPTION:Chapter IV (Articles 35 to 51) on notification of conformity as
 sessment bodies applies\, so third-party assessors can be in place before 
 the main obligations start.\nApplies to: Notifying authorities and conform
 ity assessment bodies that will certify important and critical products\, 
 including identity management and privileged access products.\nStatus: pas
 t. Source: Regulation (EU) 2024/2847 (Cyber Resilience Act)\, Official Jou
 rnal text (Publications Office of the EU) https://publications.europa.eu/r
 esource/celex/32024R2847\nSWI summary: https://startwithidentity.com/regul
 ations/european-union/cyber-resilience-act/\nCalendar: https://startwithid
 entity.com/regulations/calendar/#2026-06-11-cra-conformity-assessment-bodi
 es
LOCATION:European Union
URL:https://startwithidentity.com/regulations/calendar/#2026-06-11-cra-conf
 ormity-assessment-bodies
CATEGORIES:Cyber Resilience Act (Regulation (EU) 2024/2847)
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2026-06-19-duaa-complaints-process@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20260619
DTEND;VALUE=DATE:20260620
SUMMARY:UK Data (Use and Access) Act: controllers must run a data protectio
 n complaints process
DESCRIPTION:Section 103 is in force from 19 June 2026 (S.I. 2026/82): data 
 subjects can complain to the controller\, which must facilitate complaints
 \, acknowledge them within 30 days and respond without undue delay.\nAppli
 es to: Controllers subject to the UK GDPR and the Data Protection Act 2018
 .\nStatus: past. Source: legislation.gov.uk: Data (Use and Access) Act 202
 5\, section 103 https://www.legislation.gov.uk/ukpga/2025/18/section/103\n
 SWI summary: https://startwithidentity.com/regulations/united-kingdom/duaa
 -2025/\nCalendar: https://startwithidentity.com/regulations/calendar/#2026
 -06-19-duaa-complaints-process
LOCATION:United Kingdom
URL:https://startwithidentity.com/regulations/calendar/#2026-06-19-duaa-com
 plaints-process
CATEGORIES:Data (Use and Access) Act 2025
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2026-07-01-australia-aml-ctf-tranche-2@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20260701
DTEND;VALUE=DATE:20260702
SUMMARY:Australia AML/CTF: obligations apply to tranche 2 professions
DESCRIPTION:The transitional provisions delay AML/CTF program\, customer du
 e diligence and reporting obligations for these services until 1 July 2026
 \, from which they must identify and verify customers.\nApplies to: Provid
 ers of the newly regulated designated services (item 2 of table 2 and tabl
 es 5 and 6 in section 6 of the AML/CTF Act)\, which the reforms extend to 
 sectors such as real estate\, dealers in precious metals and stones\, and 
 professional services.\nStatus: past. Source: Federal Register of Legislat
 ion: Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2
 024 (as made) https://www.legislation.gov.au/C2024A00110/asmade/2024-12-10
 /text/original/pdf\nCalendar: https://startwithidentity.com/regulations/ca
 lendar/#2026-07-01-australia-aml-ctf-tranche-2
LOCATION:Australia
URL:https://startwithidentity.com/regulations/calendar/#2026-07-01-australi
 a-aml-ctf-tranche-2
CATEGORIES:Anti-Money Laundering and Counter-Terrorism Financing Amendment 
 Act 2024
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2026-07-01-connecticut-ctdpa-amendments@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20260701
DTEND;VALUE=DATE:20260702
SUMMARY:Connecticut Data Privacy Act amendments take effect
DESCRIPTION:Public Act 25-113 expands applicability\, widens the definition
  of sensitive data\, revises minors' protections and requires impact asses
 sments for certain profiling\, all effective 1 July 2026.\nApplies to: Per
 sons doing business in Connecticut\, now including any controller that pro
 cesses sensitive data\, regardless of volume.\nStatus: past. Source: Conne
 cticut General Assembly OLR: Public Act 25-113 summary (SB 1295) https://w
 ww.cga.ct.gov/2025/SUM/PDF/2025SUM00113-R02SB-01295-SUM.PDF\nSWI summary: 
 https://startwithidentity.com/regulations/united-states/ctdpa/\nCalendar: 
 https://startwithidentity.com/regulations/calendar/#2026-07-01-connecticut
 -ctdpa-amendments
LOCATION:United States (Connecticut)
URL:https://startwithidentity.com/regulations/calendar/#2026-07-01-connecti
 cut-ctdpa-amendments
CATEGORIES:Connecticut Data Privacy Act as amended by Public Act 25-113
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2026-07-10-amld6-beneficial-ownership-access@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20260710
DTEND;VALUE=DATE:20260711
SUMMARY:AMLD6: transposition deadline for beneficial ownership register acc
 ess rules
DESCRIPTION:Member States must bring into force Articles 11\, 12\, 13 and 1
 5 (access to beneficial ownership information\, including legitimate-inter
 est access) by 10 July 2026\, and notify the Commission of the authorities
  entitled to consult the registers.\nApplies to: EU Member States and the 
 obliged entities and authorities that query central beneficial ownership r
 egisters.\nStatus: past. Source: Directive (EU) 2024/1640 (sixth AML Direc
 tive)\, Official Journal text (Publications Office of the EU) https://publ
 ications.europa.eu/resource/celex/32024L1640\nCalendar: https://startwithi
 dentity.com/regulations/calendar/#2026-07-10-amld6-beneficial-ownership-ac
 cess
LOCATION:European Union
URL:https://startwithidentity.com/regulations/calendar/#2026-07-10-amld6-be
 neficial-ownership-access
CATEGORIES:Sixth AML Directive (Directive (EU) 2024/1640)
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2026-07-27-ai-act-digital-omnibus-in-force@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20260727
DTEND;VALUE=DATE:20260728
SUMMARY:AI Act: Digital Omnibus on AI in force\, high-risk dates deferred
DESCRIPTION:Regulation (EU) 2026/1744 amends the AI Act: high-risk obligati
 ons for Annex III systems (including biometrics) move to 2 December 2027 a
 nd for Annex I systems to 2 August 2028\, and the penalty provisions in Ar
 ticles 102 to 110 apply from 27 July 2026.\nApplies to: Providers and depl
 oyers of AI systems\, including biometric identification and categorisatio
 n systems.\nStatus: past. Source: Regulation (EU) 2026/1744 (Digital Omnib
 us on AI)\, Official Journal text (Publications Office of the EU) https://
 publications.europa.eu/resource/celex/32026R1744\nSWI summary: https://sta
 rtwithidentity.com/regulations/european-union/eu-ai-act/\nCalendar: https:
 //startwithidentity.com/regulations/calendar/#2026-07-27-ai-act-digital-om
 nibus-in-force
LOCATION:European Union
URL:https://startwithidentity.com/regulations/calendar/#2026-07-27-ai-act-d
 igital-omnibus-in-force
CATEGORIES:EU AI Act (Regulation (EU) 2024/1689) as amended by Regulation (
 EU) 2026/1744
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2026-08-01-delete-act-drop-processing@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20260801
DTEND;VALUE=DATE:20260802
SUMMARY:California Delete Act: data brokers must process DROP deletion requ
 ests
DESCRIPTION:Beginning 1 August 2026\, data brokers must access DROP at leas
 t once every 45 days and process consumer deletion requests\, subject to l
 imited exceptions.\nApplies to: Data brokers registered in California.\nSt
 atus: past. Source: California Privacy Protection Agency: data brokers and
  DROP https://cppa.ca.gov/data_brokers/\nCalendar: https://startwithidenti
 ty.com/regulations/calendar/#2026-08-01-delete-act-drop-processing
LOCATION:United States (California)
URL:https://startwithidentity.com/regulations/calendar/#2026-08-01-delete-a
 ct-drop-processing
CATEGORIES:California Delete Act (SB 362)
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2026-08-02-ai-act-general-application@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20260802
DTEND;VALUE=DATE:20260803
SUMMARY:AI Act: general application\, including transparency for biometric 
 categorisation and emotion recognition
DESCRIPTION:The AI Act applies generally\, including Article 50: deployers 
 of biometric categorisation or emotion recognition systems must inform the
  people exposed to them\, and chatbots and synthetic content must be discl
 osed.\nApplies to: Deployers of emotion recognition or biometric categoris
 ation systems and providers of AI systems that interact with people or gen
 erate synthetic content.\nStatus: past. Source: Regulation (EU) 2024/1689 
 (AI Act)\, Official Journal text (Publications Office of the EU) https://p
 ublications.europa.eu/resource/celex/32024R1689\nSWI summary: https://star
 twithidentity.com/regulations/european-union/eu-ai-act/\nCalendar: https:/
 /startwithidentity.com/regulations/calendar/#2026-08-02-ai-act-general-app
 lication
LOCATION:European Union
URL:https://startwithidentity.com/regulations/calendar/#2026-08-02-ai-act-g
 eneral-application
CATEGORIES:EU AI Act (Regulation (EU) 2024/1689)
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2026-09-11-cra-vulnerability-incident-reporting@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20260911
DTEND;VALUE=DATE:20260912
SUMMARY:Cyber Resilience Act: manufacturers must report exploited vulnerabi
 lities and severe incidents
DESCRIPTION:Article 14 applies: actively exploited vulnerabilities and seve
 re incidents must be notified through the single reporting platform with a
 n early warning within 24 hours of the manufacturer becoming aware.\nAppli
 es to: Manufacturers of products with digital elements sold in the EU\, in
 cluding identity management systems\, privileged access management softwar
 e and hardware\, and biometric readers (Annex III\, Class I).\nStatus: pas
 t. Source: Regulation (EU) 2024/2847 (Cyber Resilience Act)\, Official Jou
 rnal text (Publications Office of the EU) https://publications.europa.eu/r
 esource/celex/32024R2847\nSWI summary: https://startwithidentity.com/regul
 ations/european-union/cyber-resilience-act/\nCalendar: https://startwithid
 entity.com/regulations/calendar/#2026-09-11-cra-vulnerability-incident-rep
 orting
LOCATION:European Union
URL:https://startwithidentity.com/regulations/calendar/#2026-09-11-cra-vuln
 erability-incident-reporting
CATEGORIES:Cyber Resilience Act (Regulation (EU) 2024/2847)
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2026-09-30-uk-information-commission@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20260930
DTEND;VALUE=DATE:20261001
SUMMARY:UK: Information Commission replaces the Information Commissioner
DESCRIPTION:Commencement No. 9 Regulations abolish the office of the Inform
 ation Commissioner and transfer its functions to the board-led Information
  Commission from 30 September 2026\; enforcement powers carry over.\nAppli
 es to: All organisations regulated by the UK data protection regulator.\nS
 tatus: past. Source: GOV.UK: Data (Use and Access) Act 2025\, plans for co
 mmencement https://www.gov.uk/guidance/data-use-and-access-act-2025-plans-
 for-commencement\nSWI summary: https://startwithidentity.com/regulations/u
 nited-kingdom/duaa-2025/\nCalendar: https://startwithidentity.com/regulati
 ons/calendar/#2026-09-30-uk-information-commission
LOCATION:United Kingdom
URL:https://startwithidentity.com/regulations/calendar/#2026-09-30-uk-infor
 mation-commission
CATEGORIES:Data (Use and Access) Act 2025
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2026-10-01-italy-nis-security-measures@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20261001
DTEND;VALUE=DATE:20261002
SUMMARY:Italy NIS: basic security measures must be in place (October 2026)
DESCRIPTION:ACN states that NIS entities must have implemented the required
  basic security measures by October 2026\, covering risk management\, supp
 ly chain security and business continuity among other areas.\nApplies to: 
 Registered NIS entities in Italy.\nStatus: past. Source: Agenzia per la Cy
 bersicurezza Nazionale (ACN): NIS https://www.acn.gov.it/portale/en/nis\nC
 alendar: https://startwithidentity.com/regulations/calendar/#2026-10-01-it
 aly-nis-security-measures
LOCATION:Italy
URL:https://startwithidentity.com/regulations/calendar/#2026-10-01-italy-ni
 s-security-measures
CATEGORIES:NIS2 transposition (Legislative Decree 138/2024)
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2026-11-01-india-dpdp-consent-managers@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20261101
DTEND;VALUE=DATE:20261102
SUMMARY:India DPDP Rules: Consent Manager provisions commence (November 202
 6)
DESCRIPTION:Rule 4 (registration and obligations of Consent Managers) comes
  into force one year after the Rules were published in the Gazette on 13 N
 ovember 2025\, in November 2026.\nApplies to: Companies seeking registrati
 on as Consent Managers with the Data Protection Board\, and Data Fiduciari
 es that will integrate with them.\nStatus: confirmed. Source: Gazette of I
 ndia: Digital Personal Data Protection Rules\, 2025 (G.S.R. 846(E)\, 13 No
 vember 2025) https://egazette.gov.in/WriteReadData/2025/267650.pdf\nSWI su
 mmary: https://startwithidentity.com/regulations/india/dpdp-act/\nCalendar
 : https://startwithidentity.com/regulations/calendar/#2026-11-01-india-dpd
 p-consent-managers
LOCATION:India
URL:https://startwithidentity.com/regulations/calendar/#2026-11-01-india-dp
 dp-consent-managers
CATEGORIES:Digital Personal Data Protection Act 2023 and DPDP Rules 2025
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2026-11-10-cmmc-phase-2@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20261110
DTEND;VALUE=DATE:20261111
SUMMARY:CMMC Phase 2: Level 2 third-party (C3PAO) certification in DoD cont
 racts
DESCRIPTION:Phase 2 begins one calendar year after Phase 1 (which started w
 hen the DFARS CMMC rule took effect on 10 November 2025): DoD intends to r
 equire CMMC Level 2 (C3PAO) status\, which covers NIST SP 800-171 controls
  including multifactor authentication and least privilege\, for applicable
  contracts.\nApplies to: Defense contractors and subcontractors that handl
 e Federal Contract Information or Controlled Unclassified Information.\nSt
 atus: confirmed. Source: eCFR: 32 CFR 170.3\, CMMC applicability and phase
 d implementation https://www.ecfr.gov/current/title-32/subtitle-A/chapter-
 I/subchapter-G/part-170/subpart-A/section-170.3\nCalendar: https://startwi
 thidentity.com/regulations/calendar/#2026-11-10-cmmc-phase-2
LOCATION:United States
URL:https://startwithidentity.com/regulations/calendar/#2026-11-10-cmmc-pha
 se-2
CATEGORIES:Cybersecurity Maturity Model Certification (32 CFR Part 170)
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2026-11-30-australia-digital-id-act-review@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20261130
DTEND;VALUE=DATE:20261201
SUMMARY:Australia Digital ID Act: statutory review of the Act due
DESCRIPTION:Section 162 requires a review of the Act's operation no later t
 han 2 years after its commencement on 30 November 2024.\nApplies to: The r
 esponsible Minister\, with impacts on accredited digital ID providers and 
 relying parties.\nStatus: confirmed. Source: Federal Register of Legislati
 on: Digital ID Act 2024 (Compilation No. 1) https://www.legislation.gov.au
 /C2024A00025/2024-12-11/2024-12-11/text/original/pdf\nCalendar: https://st
 artwithidentity.com/regulations/calendar/#2026-11-30-australia-digital-id-
 act-review
LOCATION:Australia
URL:https://startwithidentity.com/regulations/calendar/#2026-11-30-australi
 a-digital-id-act-review
CATEGORIES:Digital ID Act 2024
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2026-12-01-australia-childrens-online-privacy-code@startwithidentity.co
 m
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20261201
DTEND;VALUE=DATE:20261202
SUMMARY:Australia: Children's Online Privacy Code must be registered (Decem
 ber 2026)
DESCRIPTION:The Information Commissioner must develop and register the Chil
 dren's Online Privacy Code within 24 months of Royal Assent on 10 December
  2024\, so by December 2026\; the code will set how covered services handl
 e children's personal information.\nApplies to: Social media\, online serv
 ices and apps likely to be accessed by children\, and the OAIC.\nStatus: c
 onfirmed. Source: Federal Register of Legislation: Privacy and Other Legis
 lation Amendment Act 2024 (as made) https://www.legislation.gov.au/C2024A0
 0128/asmade/2024-12-10/text/original/pdf\nSWI summary: https://startwithid
 entity.com/regulations/australia/privacy-act-1988/\nCalendar: https://star
 twithidentity.com/regulations/calendar/#2026-12-01-australia-childrens-onl
 ine-privacy-code
LOCATION:Australia
URL:https://startwithidentity.com/regulations/calendar/#2026-12-01-australi
 a-childrens-online-privacy-code
CATEGORIES:Privacy Act 1988 as amended by the Privacy and Other Legislation
  Amendment Act 2024
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2026-12-01-australia-agdis-private-sector-participation@startwithidenti
 ty.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20261201
DTEND;VALUE=DATE:20261202
SUMMARY:Australian Government Digital ID System: private sector entities ca
 n apply to participate
DESCRIPTION:Section 62 allows these entities to apply to participate in the
  Australian Government Digital ID System when the application is made more
  than 2 years after the Act commenced on 30 November 2024\; participation 
 still requires approval by the Digital ID Regulator.\nApplies to: Accredit
 ed digital ID providers and private sector relying parties (Australian ent
 ities and registered foreign companies).\nStatus: confirmed. Source: Feder
 al Register of Legislation: Digital ID Act 2024 (Compilation No. 1) https:
 //www.legislation.gov.au/C2024A00025/2024-12-11/2024-12-11/text/original/p
 df\nCalendar: https://startwithidentity.com/regulations/calendar/#2026-12-
 01-australia-agdis-private-sector-participation
LOCATION:Australia
URL:https://startwithidentity.com/regulations/calendar/#2026-12-01-australi
 a-agdis-private-sector-participation
CATEGORIES:Digital ID Act 2024
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2026-12-02-ai-act-new-prohibitions-and-legacy-marking@startwithidentity
 .com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20261202
DTEND;VALUE=DATE:20261203
SUMMARY:AI Act: new prohibitions on non-consensual intimate deepfakes and m
 arking deadline for legacy generators
DESCRIPTION:New Article 5(1)(ba) and (bb) prohibitions on AI that generates
  intimate imagery of an identifiable person without consent apply\, and ge
 nerators placed on the market before 2 August 2026 must comply with the Ar
 ticle 50(2) machine-readable marking duty.\nApplies to: Providers and depl
 oyers of generative AI systems\, and identity verification teams that rely
  on detecting synthetic media.\nStatus: confirmed. Source: Regulation (EU)
  2026/1744 (Digital Omnibus on AI)\, Official Journal text (Publications O
 ffice of the EU) https://publications.europa.eu/resource/celex/32026R1744\
 nSWI summary: https://startwithidentity.com/regulations/european-union/eu-
 ai-act/\nCalendar: https://startwithidentity.com/regulations/calendar/#202
 6-12-02-ai-act-new-prohibitions-and-legacy-marking
LOCATION:European Union
URL:https://startwithidentity.com/regulations/calendar/#2026-12-02-ai-act-n
 ew-prohibitions-and-legacy-marking
CATEGORIES:EU AI Act (Regulation (EU) 2024/1689) as amended by Regulation (
 EU) 2026/1744
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2026-12-10-australia-automated-decisions-transparency@startwithidentity
 .com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20261210
DTEND;VALUE=DATE:20261211
SUMMARY:Australia Privacy Act: privacy policies must disclose automated dec
 isions
DESCRIPTION:Schedule 1\, Part 15 commences on 10 December 2026: privacy pol
 icies must describe the kinds of personal information used and the kinds o
 f decisions made by such programs\, which can include automated identity v
 erification or fraud decisions that deny a service.\nApplies to: APP entit
 ies that use computer programs to make\, or substantially make\, decisions
  using personal information that could significantly affect individuals.\n
 Status: confirmed. Source: Federal Register of Legislation: Privacy and Ot
 her Legislation Amendment Act 2024 (as made) https://www.legislation.gov.a
 u/C2024A00128/asmade/2024-12-10/text/original/pdf\nSWI summary: https://st
 artwithidentity.com/regulations/australia/privacy-act-1988/\nCalendar: htt
 ps://startwithidentity.com/regulations/calendar/#2026-12-10-australia-auto
 mated-decisions-transparency
LOCATION:Australia
URL:https://startwithidentity.com/regulations/calendar/#2026-12-10-australi
 a-automated-decisions-transparency
CATEGORIES:Privacy Act 1988 as amended by the Privacy and Other Legislation
  Amendment Act 2024
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2026-12-24-eidas-authentic-source-attribute-verification@startwithident
 ity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20261224
DTEND;VALUE=DATE:20261225
SUMMARY:eIDAS 2: attributes from public authentic sources must be verifiabl
 e by trust service providers
DESCRIPTION:Article 45e requires Member States to ensure\, within the same 
 24-month window as the wallet\, that qualified trust service providers can
  verify Annex VI attributes electronically against authentic sources\, ena
 bling qualified electronic attestations of attributes.\nApplies to: EU Mem
 ber States and the public bodies that hold authentic sources for the attri
 butes listed in Annex VI (such as address\, age\, qualifications and licen
 ces).\nStatus: confirmed. Source: Regulation (EU) 2024/1183 (European Digi
 tal Identity Framework)\, Official Journal text (Publications Office of th
 e EU) https://publications.europa.eu/resource/celex/32024R1183\nSWI summar
 y: https://startwithidentity.com/regulations/european-union/eidas-2/\nCale
 ndar: https://startwithidentity.com/regulations/calendar/#2026-12-24-eidas
 -authentic-source-attribute-verification
LOCATION:European Union
URL:https://startwithidentity.com/regulations/calendar/#2026-12-24-eidas-au
 thentic-source-attribute-verification
CATEGORIES:eIDAS 2 (Regulation (EU) 2024/1183)
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2026-12-24-eudi-wallet-availability@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20261224
DTEND;VALUE=DATE:20261225
SUMMARY:EU Digital Identity Wallet: every Member State must offer at least 
 one wallet
DESCRIPTION:Article 5a(1) requires each Member State to provide at least on
 e European Digital Identity Wallet within 24 months of the wallet implemen
 ting acts entering into force\; those acts (including Implementing Regulat
 ion (EU) 2024/2977) were published on 4 December 2024 and entered into for
 ce 20 days later\, which sets the deadline at 24 December 2026.\nApplies t
 o: All 27 EU Member States\, and the relying parties and identity teams pr
 eparing to accept the wallets.\nStatus: confirmed. Source: Regulation (EU)
  2024/1183 (European Digital Identity Framework)\, Official Journal text (
 Publications Office of the EU) https://publications.europa.eu/resource/cel
 ex/32024R1183\nSWI summary: https://startwithidentity.com/regulations/euro
 pean-union/eidas-2/\nCalendar: https://startwithidentity.com/regulations/c
 alendar/#2026-12-24-eudi-wallet-availability
LOCATION:European Union
URL:https://startwithidentity.com/regulations/calendar/#2026-12-24-eudi-wal
 let-availability
CATEGORIES:eIDAS 2 (Regulation (EU) 2024/1183)
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2027-01-01-ccpa-admt-compliance@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20270101
DTEND;VALUE=DATE:20270102
SUMMARY:CCPA: automated decisionmaking technology rules apply
DESCRIPTION:Businesses already using ADMT for significant decisions must co
 mply by 1 January 2027: pre-use notice\, opt-out (or an exception) and acc
 ess rights covering how the ADMT\, including identity or fraud scoring use
 d in such decisions\, affects the consumer.\nApplies to: Businesses that u
 se automated decisionmaking technology to make significant decisions about
  consumers\, for example in financial services\, housing\, employment or a
 ccess to essential goods and services.\nStatus: confirmed. Source: Califor
 nia Privacy Protection Agency: approved text of CCPA updates\, cybersecuri
 ty audit\, risk assessment and ADMT regulations https://cppa.ca.gov/regula
 tions/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf\nSWI summary: https:/
 /startwithidentity.com/regulations/united-states/ccpa-cpra/\nCalendar: htt
 ps://startwithidentity.com/regulations/calendar/#2027-01-01-ccpa-admt-comp
 liance
LOCATION:United States (California)
URL:https://startwithidentity.com/regulations/calendar/#2027-01-01-ccpa-adm
 t-compliance
CATEGORIES:CCPA/CPRA regulations (11 CCR 7000 et seq.)
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2027-01-01-colorado-admt-act@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20270101
DTEND;VALUE=DATE:20270102
SUMMARY:Colorado automated decision-making technology law takes effect
DESCRIPTION:SB 26-189 repeals and reenacts the Colorado AI Act provisions w
 ith new ADMT requirements\, including a consumer right to request and corr
 ect inaccurate personal data used by ADMT\; the Attorney General is to ado
 pt implementing rules before this date.\nApplies to: Developers and deploy
 ers of automated decision-making technology used in consequential decision
 s about Colorado consumers.\nStatus: confirmed. Source: Colorado Attorney 
 General: Automated Decision-Making Technology and AI laws https://coag.gov
 /ai/\nCalendar: https://startwithidentity.com/regulations/calendar/#2027-0
 1-01-colorado-admt-act
LOCATION:United States (Colorado)
URL:https://startwithidentity.com/regulations/calendar/#2027-01-01-colorado
 -admt-act
CATEGORIES:Colorado SB 26-189 (Automated Decision-Making Technology law)
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2027-01-01-delaware-dpdpa-amendments@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20270101
DTEND;VALUE=DATE:20270102
SUMMARY:Delaware Personal Data Privacy Act amendments take effect (lower th
 resholds\, broader sensitive data)
DESCRIPTION:Amended applicability thresholds and definitions take effect\, 
 expanding sensitive data (which requires consent) and assessment duties.\n
 Applies to: Persons conducting business in Delaware or targeting Delaware 
 residents.\nStatus: confirmed. Source: Delaware Code: Title 6\, Chapter 12
 D\, Delaware Personal Data Privacy Act https://delcode.delaware.gov/title6
 /c012d/index.html\nSWI summary: https://startwithidentity.com/regulations/
 united-states/dpdpa-delaware/\nCalendar: https://startwithidentity.com/reg
 ulations/calendar/#2027-01-01-delaware-dpdpa-amendments
LOCATION:United States (Delaware)
URL:https://startwithidentity.com/regulations/calendar/#2027-01-01-delaware
 -dpdpa-amendments
CATEGORIES:Delaware Personal Data Privacy Act as amended by 85 Del. Laws c.
  463
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2027-01-01-switzerland-trust-infrastructure-operational@startwithidenti
 ty.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20270101
DTEND;VALUE=DATE:20270102
SUMMARY:Switzerland: e-ID trust infrastructure expected to become operation
 al (first half of 2027) (2027)
DESCRIPTION:The Federal Office of Justice expects the trust infrastructure 
 to become operational in the first half of 2027\, with the E-ID Act enacte
 d at least in part from that date\; the state e-ID itself has no fixed lau
 nch date as security work takes priority.\nApplies to: Swiss authorities a
 nd private relying parties planning to issue or verify credentials in the 
 swiyu ecosystem.\nStatus: expected. Source: Swiss Federal Office of Justic
 e: New timeline for the introduction of the e-ID and the trust infrastruct
 ure https://www.eid.admin.ch/en/20260625-neuer-zeitplan-fuer-die-einfuehru
 ng-der-e-id-und-der-vertrauensinfrastruktur-en\nCalendar: https://startwit
 hidentity.com/regulations/calendar/#2027-01-01-switzerland-trust-infrastru
 cture-operational
LOCATION:Switzerland
URL:https://startwithidentity.com/regulations/calendar/#2027-01-01-switzerl
 and-trust-infrastructure-operational
CATEGORIES:Federal Act on Electronic Identity and Other Electronic Credenti
 als (E-ID Act)
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2027-01-09-instant-payments-non-euro-receive@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20270109
DTEND;VALUE=DATE:20270110
SUMMARY:Instant Payments Regulation: non-euro-area PSPs must receive instan
 t euro transfers
DESCRIPTION:These PSPs must offer receipt of instant euro credit transfers 
 and apply the pricing rules by 9 January 2027\, with the sending service a
 nd payee verification following on 9 July 2027.\nApplies to: Payment servi
 ce providers located in EU Member States whose currency is not the euro.\n
 Status: confirmed. Source: Regulation (EU) 2024/886 (Instant Payments Regu
 lation)\, Official Journal text (Publications Office of the EU) https://pu
 blications.europa.eu/resource/celex/32024R0886\nCalendar: https://startwit
 hidentity.com/regulations/calendar/#2027-01-09-instant-payments-non-euro-r
 eceive
LOCATION:European Union
URL:https://startwithidentity.com/regulations/calendar/#2027-01-09-instant-
 payments-non-euro-receive
CATEGORIES:Instant Payments Regulation (Regulation (EU) 2024/886)
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2027-02-28-italy-nis-registration-2027@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20270228
DTEND;VALUE=DATE:20270301
SUMMARY:Italy NIS: annual registration window closes
DESCRIPTION:The yearly registration and renewal window on the ACN platform 
 runs from 1 January to 28 February.\nApplies to: Entities in scope of Ital
 y's NIS regime.\nStatus: confirmed. Source: Agenzia per la Cybersicurezza 
 Nazionale (ACN): NIS https://www.acn.gov.it/portale/en/nis\nCalendar: http
 s://startwithidentity.com/regulations/calendar/#2027-02-28-italy-nis-regis
 tration-2027
LOCATION:Italy
URL:https://startwithidentity.com/regulations/calendar/#2027-02-28-italy-ni
 s-registration-2027
CATEGORIES:NIS2 transposition (Legislative Decree 138/2024)
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2027-03-31-dora-register-of-information-2027@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20270331
DTEND;VALUE=DATE:20270401
SUMMARY:DORA: registers of information reported to the ESAs (2027 cycle)
DESCRIPTION:Under the ESAs Decision\, competent authorities submit the regi
 sters of information on ICT third-party arrangements to the ESAs by 31 Mar
 ch each year\, with a reference date of 31 December of the prior year\; fi
 nancial entities must deliver their registers to their competent authority
  earlier\, on national timelines.\nApplies to: EU financial entities\, thr
 ough their national competent authorities\, and the ICT third-party provid
 ers (including identity and access providers) listed in their registers.\n
 Status: confirmed. Source: ESAs Decision on reporting by competent authori
 ties of information for CTPP designation (EIOPA) https://www.eiopa.europa.
 eu/publications/esas-decision-reporting-competent-authorities-esas-informa
 tion-necessary-designation-critical-ict_en\nSWI summary: https://startwith
 identity.com/regulations/european-union/dora/\nCalendar: https://startwith
 identity.com/regulations/calendar/#2027-03-31-dora-register-of-information
 -2027
LOCATION:European Union
URL:https://startwithidentity.com/regulations/calendar/#2027-03-31-dora-reg
 ister-of-information-2027
CATEGORIES:DORA (Regulation (EU) 2022/2554)
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2027-04-01-maryland-modpa-cure-period-ends@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20270401
DTEND;VALUE=DATE:20270402
SUMMARY:Maryland Online Data Privacy Act: discretionary cure period ends
DESCRIPTION:Section 14-4714 lets the Consumer Protection Division offer at 
 least 60 days to cure only for violations occurring on or before 1 April 2
 027\; later violations can go straight to enforcement.\nApplies to: Contro
 llers and processors subject to the Maryland Online Data Privacy Act.\nSta
 tus: confirmed. Source: Maryland General Assembly: Commercial Law section 
 14-4714 https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gc
 l&section=14-4714&enactments=false\nSWI summary: https://startwithidentity
 .com/regulations/united-states/modpa/\nCalendar: https://startwithidentity
 .com/regulations/calendar/#2027-04-01-maryland-modpa-cure-period-ends
LOCATION:United States (Maryland)
URL:https://startwithidentity.com/regulations/calendar/#2027-04-01-maryland
 -modpa-cure-period-ends
CATEGORIES:Maryland Online Data Privacy Act (2024 SB 541)
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2027-04-15-nydfs-part-500-annual-notice-of-compliance-2027@startwithide
 ntity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20270415
DTEND;VALUE=DATE:20270416
SUMMARY:NYDFS Part 500: annual certification of compliance or acknowledgmen
 t of noncompliance due (2027)
DESCRIPTION:Section 500.17(b) requires each covered entity to submit electr
 onically by April 15 a certification of material compliance for the prior 
 calendar year\, or an acknowledgment of noncompliance with a remediation t
 imeline\; universal MFA under section 500.12 has applied since 1 November 
 2025.\nApplies to: Banks\, insurers and other entities licensed by the New
  York Department of Financial Services.\nStatus: confirmed. Source: NYDFS:
  23 NYCRR Part 500 (Cybersecurity Requirements for Financial Services Comp
 anies) https://www.dfs.ny.gov/cybersecurity/23-NYCRR-Part-500\nSWI summary
 : https://startwithidentity.com/regulations/united-states/nydfs-part-500/\
 nCalendar: https://startwithidentity.com/regulations/calendar/#2027-04-15-
 nydfs-part-500-annual-notice-of-compliance-2027
LOCATION:United States (New York)
URL:https://startwithidentity.com/regulations/calendar/#2027-04-15-nydfs-pa
 rt-500-annual-notice-of-compliance-2027
CATEGORIES:NYDFS 23 NYCRR Part 500
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2027-04-17-nis2-entity-list-review@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20270417
DTEND;VALUE=DATE:20270418
SUMMARY:NIS2: Member States review entity lists and notify the Commission
DESCRIPTION:Article 3 requires the list of essential and important entities
  to be reviewed at least every two years after 17 April 2025\, and compete
 nt authorities to notify the Commission of entity numbers by 17 April 2025
  and every two years thereafter.\nApplies to: EU Member States and their N
 IS2 competent authorities\; in-scope entities may be asked to refresh thei
 r registration data.\nStatus: confirmed. Source: Directive (EU) 2022/2555 
 (NIS2)\, Official Journal text (Publications Office of the EU) https://pub
 lications.europa.eu/resource/celex/32022L2555\nSWI summary: https://startw
 ithidentity.com/regulations/european-union/nis2/\nCalendar: https://startw
 ithidentity.com/regulations/calendar/#2027-04-17-nis2-entity-list-review
LOCATION:European Union
URL:https://startwithidentity.com/regulations/calendar/#2027-04-17-nis2-ent
 ity-list-review
CATEGORIES:NIS2 Directive (Directive (EU) 2022/2555)
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2027-05-01-india-dpdp-full-obligations@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20270501
DTEND;VALUE=DATE:20270502
SUMMARY:India DPDP Rules: core Data Fiduciary obligations apply (May 2027)
DESCRIPTION:Rules 3 and 5 to 16\, 22 and 23 come into force eighteen months
  after the 13 November 2025 publication\, in May 2027: notice\, verifiable
  consent (including for children)\, reasonable security safeguards such as
  access control and logging\, one-year log retention and personal data bre
 ach notification.\nApplies to: All Data Fiduciaries processing digital per
 sonal data in India\, with added duties for Significant Data Fiduciaries.\
 nStatus: confirmed. Source: Gazette of India: Digital Personal Data Protec
 tion Rules\, 2025 (G.S.R. 846(E)\, 13 November 2025) https://egazette.gov.
 in/WriteReadData/2025/267650.pdf\nSWI summary: https://startwithidentity.c
 om/regulations/india/dpdp-act/\nCalendar: https://startwithidentity.com/re
 gulations/calendar/#2027-05-01-india-dpdp-full-obligations
LOCATION:India
URL:https://startwithidentity.com/regulations/calendar/#2027-05-01-india-dp
 dp-full-obligations
CATEGORIES:Digital Personal Data Protection Act 2023 and DPDP Rules 2025
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2027-05-31-italy-nis-annual-update-2027@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20270531
DTEND;VALUE=DATE:20270601
SUMMARY:Italy NIS: annual information update due
DESCRIPTION:NIS entities must update their information on the ACN platform 
 by 31 May each year.\nApplies to: Registered NIS entities in Italy.\nStatu
 s: confirmed. Source: Agenzia per la Cybersicurezza Nazionale (ACN): NIS h
 ttps://www.acn.gov.it/portale/en/nis\nCalendar: https://startwithidentity.
 com/regulations/calendar/#2027-05-31-italy-nis-annual-update-2027
LOCATION:Italy
URL:https://startwithidentity.com/regulations/calendar/#2027-05-31-italy-ni
 s-annual-update-2027
CATEGORIES:NIS2 transposition (Legislative Decree 138/2024)
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2027-07-01-amla-first-direct-supervision-selection@startwithidentity.co
 m
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20270701
DTEND;VALUE=DATE:20270702
SUMMARY:AMLA: first selection of directly supervised entities must start
DESCRIPTION:Article 13 requires AMLA to commence the first selection proces
 s by 1 July 2027 and conclude it within six months.\nApplies to: Cross-bor
 der credit and financial institutions with high ML/TF risk profiles that m
 ay be selected for direct supervision by the EU Anti-Money Laundering Auth
 ority.\nStatus: confirmed. Source: Regulation (EU) 2024/1620 (AMLA Regulat
 ion)\, Official Journal text (Publications Office of the EU) https://publi
 cations.europa.eu/resource/celex/32024R1620\nCalendar: https://startwithid
 entity.com/regulations/calendar/#2027-07-01-amla-first-direct-supervision-
 selection
LOCATION:European Union
URL:https://startwithidentity.com/regulations/calendar/#2027-07-01-amla-fir
 st-direct-supervision-selection
CATEGORIES:AMLA Regulation (Regulation (EU) 2024/1620)
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2027-07-09-instant-payments-non-euro-verification-of-payee@startwithide
 ntity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20270709
DTEND;VALUE=DATE:20270710
SUMMARY:Instant Payments Regulation: verification of payee required for non
 -euro-area PSPs
DESCRIPTION:Article 5c requires a payer's PSP to check the payee's name aga
 inst the account identifier before a euro credit transfer is authorised\, 
 and PSPs must offer sending of instant euro transfers by this date.\nAppli
 es to: Payment service providers located in EU Member States whose currenc
 y is not the euro.\nStatus: confirmed. Source: Regulation (EU) 2024/886 (I
 nstant Payments Regulation)\, Official Journal text (Publications Office o
 f the EU) https://publications.europa.eu/resource/celex/32024R0886\nCalend
 ar: https://startwithidentity.com/regulations/calendar/#2027-07-09-instant
 -payments-non-euro-verification-of-payee
LOCATION:European Union
URL:https://startwithidentity.com/regulations/calendar/#2027-07-09-instant-
 payments-non-euro-verification-of-payee
CATEGORIES:Instant Payments Regulation (Regulation (EU) 2024/886)
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2027-07-10-amld6-transposition@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20270710
DTEND;VALUE=DATE:20270711
SUMMARY:AMLD6: general transposition deadline
DESCRIPTION:Member States must bring into force the laws needed to comply w
 ith the Directive\, covering beneficial ownership registers\, bank account
  registers and supervision.\nApplies to: EU Member States and the supervis
 ors\, FIUs and register operators that support customer due diligence.\nSt
 atus: confirmed. Source: Directive (EU) 2024/1640 (sixth AML Directive)\, 
 Official Journal text (Publications Office of the EU) https://publications
 .europa.eu/resource/celex/32024L1640\nCalendar: https://startwithidentity.
 com/regulations/calendar/#2027-07-10-amld6-transposition
LOCATION:European Union
URL:https://startwithidentity.com/regulations/calendar/#2027-07-10-amld6-tr
 ansposition
CATEGORIES:Sixth AML Directive (Directive (EU) 2024/1640)
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2027-07-10-amlr-applies@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20270710
DTEND;VALUE=DATE:20270711
SUMMARY:EU AML Regulation applies: single rulebook for customer due diligen
 ce
DESCRIPTION:Directly applicable customer due diligence rules replace nation
 al AMLD transpositions: identification and verification of customers and b
 eneficial owners\, including remote onboarding using eIDAS electronic iden
 tification means\, plus record-keeping duties.\nApplies to: Obliged entiti
 es across the EU\, including banks\, payment and e-money institutions\, cr
 ypto-asset service providers and other financial and non-financial firms (
 football agents and clubs from 10 July 2029).\nStatus: confirmed. Source: 
 Regulation (EU) 2024/1624 (AML Regulation)\, Official Journal text (Public
 ations Office of the EU) https://publications.europa.eu/resource/celex/320
 24R1624\nCalendar: https://startwithidentity.com/regulations/calendar/#202
 7-07-10-amlr-applies
LOCATION:European Union
URL:https://startwithidentity.com/regulations/calendar/#2027-07-10-amlr-app
 lies
CATEGORIES:AML Regulation (Regulation (EU) 2024/1624)
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2027-10-17-nis2-commission-review@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20271017
DTEND;VALUE=DATE:20271018
SUMMARY:NIS2: first Commission review of the Directive
DESCRIPTION:Article 40 requires the Commission to review the functioning of
  NIS2 by 17 October 2027 and every 36 months thereafter\, assessing among 
 other things the size-cap and sector scope\, and to report to Parliament a
 nd Council.\nApplies to: The European Commission\, with knock-on effects f
 or all NIS2 entities.\nStatus: confirmed. Source: Directive (EU) 2022/2555
  (NIS2)\, Official Journal text (Publications Office of the EU) https://pu
 blications.europa.eu/resource/celex/32022L2555\nSWI summary: https://start
 withidentity.com/regulations/european-union/nis2/\nCalendar: https://start
 withidentity.com/regulations/calendar/#2027-10-17-nis2-commission-review
LOCATION:European Union
URL:https://startwithidentity.com/regulations/calendar/#2027-10-17-nis2-com
 mission-review
CATEGORIES:NIS2 Directive (Directive (EU) 2022/2555)
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2027-11-10-cmmc-phase-3@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20271110
DTEND;VALUE=DATE:20271111
SUMMARY:CMMC Phase 3: Level 2 (C3PAO) for all applicable contracts and Leve
 l 3 introduced
DESCRIPTION:Phase 3 begins one calendar year after Phase 2: DoD intends to 
 require Level 2 (C3PAO) for all applicable solicitations and contracts as 
 a condition of award\, and Level 3 (DIBCAC) where applicable.\nApplies to:
  Defense contractors and subcontractors handling Controlled Unclassified I
 nformation.\nStatus: confirmed. Source: eCFR: 32 CFR 170.3\, CMMC applicab
 ility and phased implementation https://www.ecfr.gov/current/title-32/subt
 itle-A/chapter-I/subchapter-G/part-170/subpart-A/section-170.3\nCalendar: 
 https://startwithidentity.com/regulations/calendar/#2027-11-10-cmmc-phase-
 3
LOCATION:United States
URL:https://startwithidentity.com/regulations/calendar/#2027-11-10-cmmc-pha
 se-3
CATEGORIES:Cybersecurity Maturity Model Certification (32 CFR Part 170)
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2027-12-02-ai-act-high-risk-annex-iii-biometrics@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20271202
DTEND;VALUE=DATE:20271203
SUMMARY:AI Act: high-risk obligations apply to Annex III systems\, includin
 g remote biometric identification
DESCRIPTION:Chapter III\, Sections 1 to 3 (risk management\, data governanc
 e\, logging\, human oversight\, accuracy and robustness requirements\, and
  provider and deployer duties) apply to Annex III systems from this date\,
  deferred from 2 August 2026 by the Digital Omnibus.\nApplies to: Provider
 s and deployers of high-risk AI systems listed in Annex III\, which includ
 e remote biometric identification\, biometric categorisation and emotion r
 ecognition systems.\nStatus: confirmed. Source: Regulation (EU) 2026/1744 
 (Digital Omnibus on AI)\, Official Journal text (Publications Office of th
 e EU) https://publications.europa.eu/resource/celex/32026R1744\nSWI summar
 y: https://startwithidentity.com/regulations/european-union/eu-ai-act/\nCa
 lendar: https://startwithidentity.com/regulations/calendar/#2027-12-02-ai-
 act-high-risk-annex-iii-biometrics
LOCATION:European Union
URL:https://startwithidentity.com/regulations/calendar/#2027-12-02-ai-act-h
 igh-risk-annex-iii-biometrics
CATEGORIES:EU AI Act (Regulation (EU) 2024/1689) as amended by Regulation (
 EU) 2026/1744
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2027-12-11-cra-full-application@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20271211
DTEND;VALUE=DATE:20271212
SUMMARY:Cyber Resilience Act: main obligations apply
DESCRIPTION:The rest of the Regulation applies\, including essential cybers
 ecurity requirements (such as protection against unauthorised access throu
 gh authentication and identity management) and conformity assessment befor
 e CE marking.\nApplies to: Manufacturers\, importers and distributors of p
 roducts with digital elements\, with identity management systems\, PAM pro
 ducts and biometric readers classed as important products.\nStatus: confir
 med. Source: Regulation (EU) 2024/2847 (Cyber Resilience Act)\, Official J
 ournal text (Publications Office of the EU) https://publications.europa.eu
 /resource/celex/32024R2847\nSWI summary: https://startwithidentity.com/reg
 ulations/european-union/cyber-resilience-act/\nCalendar: https://startwith
 identity.com/regulations/calendar/#2027-12-11-cra-full-application
LOCATION:European Union
URL:https://startwithidentity.com/regulations/calendar/#2027-12-11-cra-full
 -application
CATEGORIES:Cyber Resilience Act (Regulation (EU) 2024/2847)
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2027-12-24-eudi-wallet-private-relying-party-acceptance@startwithidenti
 ty.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20271224
DTEND;VALUE=DATE:20271225
SUMMARY:EU Digital Identity Wallet: regulated private relying parties and v
 ery large online platforms must accept the wallet
DESCRIPTION:Article 5f(2) requires these relying parties to accept the Euro
 pean Digital Identity Wallet for authentication at the user's request no l
 ater than 36 months after the wallet implementing acts entered into force\
 , which falls on 24 December 2027.\nApplies to: Private relying parties le
 gally or contractually required to use strong user authentication (includi
 ng banking\, financial services\, transport\, energy\, health\, telecoms a
 nd education) and very large online platforms.\nStatus: confirmed. Source:
  Regulation (EU) 2024/1183 (European Digital Identity Framework)\, Officia
 l Journal text (Publications Office of the EU) https://publications.europa
 .eu/resource/celex/32024R1183\nSWI summary: https://startwithidentity.com/
 regulations/european-union/eidas-2/\nCalendar: https://startwithidentity.c
 om/regulations/calendar/#2027-12-24-eudi-wallet-private-relying-party-acce
 ptance
LOCATION:European Union
URL:https://startwithidentity.com/regulations/calendar/#2027-12-24-eudi-wal
 let-private-relying-party-acceptance
CATEGORIES:eIDAS 2 (Regulation (EU) 2024/1183)
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2027-12-31-ccpa-risk-assessments-existing-processing@startwithidentity.
 com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20271231
DTEND;VALUE=DATE:20280101
SUMMARY:CCPA: risk assessments due for processing that predates the regulat
 ions
DESCRIPTION:For significant-risk processing that began before the regulatio
 ns took effect and continues after\, a documented risk assessment must be 
 completed no later than 31 December 2027.\nApplies to: Businesses whose pr
 ocessing presents significant risk\, including processing sensitive person
 al information such as biometric data and using ADMT for significant decis
 ions.\nStatus: confirmed. Source: California Privacy Protection Agency: ap
 proved text of CCPA updates\, cybersecurity audit\, risk assessment and AD
 MT regulations https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk
 _admt_appr_text.pdf\nSWI summary: https://startwithidentity.com/regulation
 s/united-states/ccpa-cpra/\nCalendar: https://startwithidentity.com/regula
 tions/calendar/#2027-12-31-ccpa-risk-assessments-existing-processing
LOCATION:United States (California)
URL:https://startwithidentity.com/regulations/calendar/#2027-12-31-ccpa-ris
 k-assessments-existing-processing
CATEGORIES:CCPA/CPRA regulations (11 CCR 7000 et seq.)
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2028-01-01-amla-direct-supervision-begins@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20280101
DTEND;VALUE=DATE:20280102
SUMMARY:AMLA: direct supervision of selected obliged entities expected to b
 egin (2028)
DESCRIPTION:The AMLA Regulation states that direct supervision of selected 
 obliged entities should commence as of 2028\, after the first selection pr
 ocess concludes\; no day is fixed.\nApplies to: The selected high-risk fin
 ancial institutions.\nStatus: expected. Source: Regulation (EU) 2024/1620 
 (AMLA Regulation)\, Official Journal text (Publications Office of the EU) 
 https://publications.europa.eu/resource/celex/32024R1620\nCalendar: https:
 //startwithidentity.com/regulations/calendar/#2028-01-01-amla-direct-super
 vision-begins
LOCATION:European Union
URL:https://startwithidentity.com/regulations/calendar/#2028-01-01-amla-dir
 ect-supervision-begins
CATEGORIES:AMLA Regulation (Regulation (EU) 2024/1620)
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2028-01-01-delete-act-data-broker-audits@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20280101
DTEND;VALUE=DATE:20280102
SUMMARY:California Delete Act: independent audits of data brokers begin
DESCRIPTION:Beginning 1 January 2028\, and every three years thereafter\, d
 ata brokers must undergo an independent third-party audit of their complia
 nce with the Delete Act.\nApplies to: Data brokers registered in Californi
 a.\nStatus: confirmed. Source: California Privacy Protection Agency: data 
 brokers and DROP https://cppa.ca.gov/data_brokers/\nCalendar: https://star
 twithidentity.com/regulations/calendar/#2028-01-01-delete-act-data-broker-
 audits
LOCATION:United States (California)
URL:https://startwithidentity.com/regulations/calendar/#2028-01-01-delete-a
 ct-data-broker-audits
CATEGORIES:California Delete Act (SB 362)
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2028-01-17-dora-commission-review@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20280117
DTEND;VALUE=DATE:20280118
SUMMARY:DORA: Commission review report due
DESCRIPTION:Article 58(1) requires the Commission to review DORA by 17 Janu
 ary 2028 and report to Parliament and Council\, with a legislative proposa
 l where appropriate.\nApplies to: The European Commission\, after consulti
 ng the ESAs and the ESRB.\nStatus: confirmed. Source: Regulation (EU) 2022
 /2554 (DORA)\, Official Journal text (Publications Office of the EU) https
 ://publications.europa.eu/resource/celex/32022R2554\nSWI summary: https://
 startwithidentity.com/regulations/european-union/dora/\nCalendar: https://
 startwithidentity.com/regulations/calendar/#2028-01-17-dora-commission-rev
 iew
LOCATION:European Union
URL:https://startwithidentity.com/regulations/calendar/#2028-01-17-dora-com
 mission-review
CATEGORIES:DORA (Regulation (EU) 2022/2554)
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2028-02-28-italy-nis-registration-2028@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20280228
DTEND;VALUE=DATE:20280229
SUMMARY:Italy NIS: annual registration window closes
DESCRIPTION:The yearly registration and renewal window on the ACN platform 
 runs from 1 January to 28 February.\nApplies to: Entities in scope of Ital
 y's NIS regime.\nStatus: confirmed. Source: Agenzia per la Cybersicurezza 
 Nazionale (ACN): NIS https://www.acn.gov.it/portale/en/nis\nCalendar: http
 s://startwithidentity.com/regulations/calendar/#2028-02-28-italy-nis-regis
 tration-2028
LOCATION:Italy
URL:https://startwithidentity.com/regulations/calendar/#2028-02-28-italy-ni
 s-registration-2028
CATEGORIES:NIS2 transposition (Legislative Decree 138/2024)
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2028-03-31-dora-register-of-information-2028@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20280331
DTEND;VALUE=DATE:20280401
SUMMARY:DORA: registers of information reported to the ESAs (2028 cycle)
DESCRIPTION:Under the ESAs Decision\, competent authorities submit the regi
 sters of information on ICT third-party arrangements to the ESAs by 31 Mar
 ch each year\, with a reference date of 31 December of the prior year\; fi
 nancial entities must deliver their registers to their competent authority
  earlier\, on national timelines.\nApplies to: EU financial entities\, thr
 ough their national competent authorities\, and the ICT third-party provid
 ers (including identity and access providers) listed in their registers.\n
 Status: confirmed. Source: ESAs Decision on reporting by competent authori
 ties of information for CTPP designation (EIOPA) https://www.eiopa.europa.
 eu/publications/esas-decision-reporting-competent-authorities-esas-informa
 tion-necessary-designation-critical-ict_en\nSWI summary: https://startwith
 identity.com/regulations/european-union/dora/\nCalendar: https://startwith
 identity.com/regulations/calendar/#2028-03-31-dora-register-of-information
 -2028
LOCATION:European Union
URL:https://startwithidentity.com/regulations/calendar/#2028-03-31-dora-reg
 ister-of-information-2028
CATEGORIES:DORA (Regulation (EU) 2022/2554)
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2028-04-01-ccpa-first-cybersecurity-audits-large@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20280401
DTEND;VALUE=DATE:20280402
SUMMARY:CCPA: first cybersecurity audit reports due for businesses over $10
 0 million revenue
DESCRIPTION:The first independent cybersecurity audit report\, covering 202
 7\, is due\; audits assess components including authentication (MFA)\, acc
 ess controls and privileged account management. Businesses with 50 to 100 
 million dollars follow on 1 April 2029 and smaller ones on 1 April 2030.\n
 Applies to: Businesses whose processing presents significant security risk
  and whose 2026 annual gross revenue exceeded 100 million dollars.\nStatus
 : confirmed. Source: California Privacy Protection Agency: approved text o
 f CCPA updates\, cybersecurity audit\, risk assessment and ADMT regulation
 s https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_te
 xt.pdf\nSWI summary: https://startwithidentity.com/regulations/united-stat
 es/ccpa-cpra/\nCalendar: https://startwithidentity.com/regulations/calenda
 r/#2028-04-01-ccpa-first-cybersecurity-audits-large
LOCATION:United States (California)
URL:https://startwithidentity.com/regulations/calendar/#2028-04-01-ccpa-fir
 st-cybersecurity-audits-large
CATEGORIES:CCPA/CPRA regulations (11 CCR 7000 et seq.)
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2028-04-01-ccpa-risk-assessment-submission@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20280401
DTEND;VALUE=DATE:20280402
SUMMARY:CCPA: first risk assessment information submitted to the CPPA
DESCRIPTION:Risk assessment information (contact\, assessment counts and a 
 signed attestation by an executive) for 2026 and 2027 is due to the Agency
  by 1 April 2028\, then by 1 April each following year.\nApplies to: Busin
 esses that conducted risk assessments in 2026 and 2027.\nStatus: confirmed
 . Source: California Privacy Protection Agency: approved text of CCPA upda
 tes\, cybersecurity audit\, risk assessment and ADMT regulations https://c
 ppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf\nSWI
  summary: https://startwithidentity.com/regulations/united-states/ccpa-cpr
 a/\nCalendar: https://startwithidentity.com/regulations/calendar/#2028-04-
 01-ccpa-risk-assessment-submission
LOCATION:United States (California)
URL:https://startwithidentity.com/regulations/calendar/#2028-04-01-ccpa-ris
 k-assessment-submission
CATEGORIES:CCPA/CPRA regulations (11 CCR 7000 et seq.)
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2028-04-15-nydfs-part-500-annual-notice-of-compliance-2028@startwithide
 ntity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20280415
DTEND;VALUE=DATE:20280416
SUMMARY:NYDFS Part 500: annual certification of compliance or acknowledgmen
 t of noncompliance due (2028)
DESCRIPTION:Section 500.17(b) requires each covered entity to submit electr
 onically by April 15 a certification of material compliance for the prior 
 calendar year\, or an acknowledgment of noncompliance with a remediation t
 imeline\; universal MFA under section 500.12 has applied since 1 November 
 2025.\nApplies to: Banks\, insurers and other entities licensed by the New
  York Department of Financial Services.\nStatus: confirmed. Source: NYDFS:
  23 NYCRR Part 500 (Cybersecurity Requirements for Financial Services Comp
 anies) https://www.dfs.ny.gov/cybersecurity/23-NYCRR-Part-500\nSWI summary
 : https://startwithidentity.com/regulations/united-states/nydfs-part-500/\
 nCalendar: https://startwithidentity.com/regulations/calendar/#2028-04-15-
 nydfs-part-500-annual-notice-of-compliance-2028
LOCATION:United States (New York)
URL:https://startwithidentity.com/regulations/calendar/#2028-04-15-nydfs-pa
 rt-500-annual-notice-of-compliance-2028
CATEGORIES:NYDFS 23 NYCRR Part 500
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2028-05-31-italy-nis-annual-update-2028@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20280531
DTEND;VALUE=DATE:20280601
SUMMARY:Italy NIS: annual information update due
DESCRIPTION:NIS entities must update their information on the ACN platform 
 by 31 May each year.\nApplies to: Registered NIS entities in Italy.\nStatu
 s: confirmed. Source: Agenzia per la Cybersicurezza Nazionale (ACN): NIS h
 ttps://www.acn.gov.it/portale/en/nis\nCalendar: https://startwithidentity.
 com/regulations/calendar/#2028-05-31-italy-nis-annual-update-2028
LOCATION:Italy
URL:https://startwithidentity.com/regulations/calendar/#2028-05-31-italy-ni
 s-annual-update-2028
CATEGORIES:NIS2 transposition (Legislative Decree 138/2024)
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2028-08-02-ai-act-high-risk-annex-i@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20280802
DTEND;VALUE=DATE:20280803
SUMMARY:AI Act: high-risk obligations apply to Annex I product systems
DESCRIPTION:Chapter III\, Sections 1 to 3 apply to high-risk systems classi
 fied under Article 6(1) and Annex I\, including any embedded biometric acc
 ess or identification functions in those products.\nApplies to: Providers 
 of AI systems that are safety components of products covered by Annex I Un
 ion harmonisation legislation (for example machinery\, toys\, medical devi
 ces and lifts).\nStatus: confirmed. Source: Regulation (EU) 2026/1744 (Dig
 ital Omnibus on AI)\, Official Journal text (Publications Office of the EU
 ) https://publications.europa.eu/resource/celex/32026R1744\nSWI summary: h
 ttps://startwithidentity.com/regulations/european-union/eu-ai-act/\nCalend
 ar: https://startwithidentity.com/regulations/calendar/#2028-08-02-ai-act-
 high-risk-annex-i
LOCATION:European Union
URL:https://startwithidentity.com/regulations/calendar/#2028-08-02-ai-act-h
 igh-risk-annex-i
CATEGORIES:EU AI Act (Regulation (EU) 2024/1689) as amended by Regulation (
 EU) 2026/1744
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:2028-11-10-cmmc-phase-4-full-implementation@startwithidentity.com
DTSTAMP:20261031T204725Z
DTSTART;VALUE=DATE:20281110
DTEND;VALUE=DATE:20281111
SUMMARY:CMMC Phase 4: full implementation
DESCRIPTION:Phase 4 begins one calendar year after Phase 3: DoD will includ
 e CMMC requirements in all applicable solicitations and contracts\, includ
 ing option periods on contracts awarded before Phase 4.\nApplies to: All d
 efense contractors and subcontractors in scope of CMMC.\nStatus: confirmed
 . Source: eCFR: 32 CFR 170.3\, CMMC applicability and phased implementatio
 n https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/
 part-170/subpart-A/section-170.3\nCalendar: https://startwithidentity.com/
 regulations/calendar/#2028-11-10-cmmc-phase-4-full-implementation
LOCATION:United States
URL:https://startwithidentity.com/regulations/calendar/#2028-11-10-cmmc-pha
 se-4-full-implementation
CATEGORIES:Cybersecurity Maturity Model Certification (32 CFR Part 170)
TRANSP:TRANSPARENT
END:VEVENT
END:VCALENDAR