Identity Compliance Calendar 2026-2028

Rule 4 (registration and obligations of Consent Managers) comes into force one year after the Rules were published in the Gazette on 13 November 2025, in November 2026.

Applies to: Companies seeking registration as Consent Managers with the Data Protection Board, and Data Fiduciaries that will integrate with them.

Phase 2 begins one calendar year after Phase 1 (which started when the DFARS CMMC rule took effect on 10 November 2025): DoD intends to require CMMC Level 2 (C3PAO) status, which covers NIST SP 800-171 controls including multifactor authentication and least privilege, for applicable contracts.

Applies to: Defense contractors and subcontractors that handle Federal Contract Information or Controlled Unclassified Information.

Section 162 requires a review of the Act's operation no later than 2 years after its commencement on 30 November 2024.

Applies to: The responsible Minister, with impacts on accredited digital ID providers and relying parties.

The Information Commissioner must develop and register the Children's Online Privacy Code within 24 months of Royal Assent on 10 December 2024, so by December 2026; the code will set how covered services handle children's personal information.

Applies to: Social media, online services and apps likely to be accessed by children, and the OAIC.

Section 62 allows these entities to apply to participate in the Australian Government Digital ID System when the application is made more than 2 years after the Act commenced on 30 November 2024; participation still requires approval by the Digital ID Regulator.

Applies to: Accredited digital ID providers and private sector relying parties (Australian entities and registered foreign companies).

New Article 5(1)(ba) and (bb) prohibitions on AI that generates intimate imagery of an identifiable person without consent apply, and generators placed on the market before 2 August 2026 must comply with the Article 50(2) machine-readable marking duty.

Applies to: Providers and deployers of generative AI systems, and identity verification teams that rely on detecting synthetic media.

Schedule 1, Part 15 commences on 10 December 2026: privacy policies must describe the kinds of personal information used and the kinds of decisions made by such programs, which can include automated identity verification or fraud decisions that deny a service.

Applies to: APP entities that use computer programs to make, or substantially make, decisions using personal information that could significantly affect individuals.

Article 45e requires Member States to ensure, within the same 24-month window as the wallet, that qualified trust service providers can verify Annex VI attributes electronically against authentic sources, enabling qualified electronic attestations of attributes.

Applies to: EU Member States and the public bodies that hold authentic sources for the attributes listed in Annex VI (such as address, age, qualifications and licences).

Article 5a(1) requires each Member State to provide at least one European Digital Identity Wallet within 24 months of the wallet implementing acts entering into force; those acts (including Implementing Regulation (EU) 2024/2977) were published on 4 December 2024 and entered into force 20 days later, which sets the deadline at 24 December 2026.

Applies to: All 27 EU Member States, and the relying parties and identity teams preparing to accept the wallets.

Businesses already using ADMT for significant decisions must comply by 1 January 2027: pre-use notice, opt-out (or an exception) and access rights covering how the ADMT, including identity or fraud scoring used in such decisions, affects the consumer.

Applies to: Businesses that use automated decisionmaking technology to make significant decisions about consumers, for example in financial services, housing, employment or access to essential goods and services.

SB 26-189 repeals and reenacts the Colorado AI Act provisions with new ADMT requirements, including a consumer right to request and correct inaccurate personal data used by ADMT; the Attorney General is to adopt implementing rules before this date.

Applies to: Developers and deployers of automated decision-making technology used in consequential decisions about Colorado consumers.

Amended applicability thresholds and definitions take effect, expanding sensitive data (which requires consent) and assessment duties.

Applies to: Persons conducting business in Delaware or targeting Delaware residents.

The Federal Office of Justice expects the trust infrastructure to become operational in the first half of 2027, with the E-ID Act enacted at least in part from that date; the state e-ID itself has no fixed launch date as security work takes priority.

Applies to: Swiss authorities and private relying parties planning to issue or verify credentials in the swiyu ecosystem.

These PSPs must offer receipt of instant euro credit transfers and apply the pricing rules by 9 January 2027, with the sending service and payee verification following on 9 July 2027.

Applies to: Payment service providers located in EU Member States whose currency is not the euro.

The yearly registration and renewal window on the ACN platform runs from 1 January to 28 February.

Applies to: Entities in scope of Italy's NIS regime.

Under the ESAs Decision, competent authorities submit the registers of information on ICT third-party arrangements to the ESAs by 31 March each year, with a reference date of 31 December of the prior year; financial entities must deliver their registers to their competent authority earlier, on national timelines.

Applies to: EU financial entities, through their national competent authorities, and the ICT third-party providers (including identity and access providers) listed in their registers.

Section 14-4714 lets the Consumer Protection Division offer at least 60 days to cure only for violations occurring on or before 1 April 2027; later violations can go straight to enforcement.

Applies to: Controllers and processors subject to the Maryland Online Data Privacy Act.

Section 500.17(b) requires each covered entity to submit electronically by April 15 a certification of material compliance for the prior calendar year, or an acknowledgment of noncompliance with a remediation timeline; universal MFA under section 500.12 has applied since 1 November 2025.

Applies to: Banks, insurers and other entities licensed by the New York Department of Financial Services.

Article 3 requires the list of essential and important entities to be reviewed at least every two years after 17 April 2025, and competent authorities to notify the Commission of entity numbers by 17 April 2025 and every two years thereafter.

Applies to: EU Member States and their NIS2 competent authorities; in-scope entities may be asked to refresh their registration data.

Rules 3 and 5 to 16, 22 and 23 come into force eighteen months after the 13 November 2025 publication, in May 2027: notice, verifiable consent (including for children), reasonable security safeguards such as access control and logging, one-year log retention and personal data breach notification.

Applies to: All Data Fiduciaries processing digital personal data in India, with added duties for Significant Data Fiduciaries.

NIS entities must update their information on the ACN platform by 31 May each year.

Applies to: Registered NIS entities in Italy.

Article 13 requires AMLA to commence the first selection process by 1 July 2027 and conclude it within six months.

Applies to: Cross-border credit and financial institutions with high ML/TF risk profiles that may be selected for direct supervision by the EU Anti-Money Laundering Authority.

Article 5c requires a payer's PSP to check the payee's name against the account identifier before a euro credit transfer is authorised, and PSPs must offer sending of instant euro transfers by this date.

Applies to: Payment service providers located in EU Member States whose currency is not the euro.

Member States must bring into force the laws needed to comply with the Directive, covering beneficial ownership registers, bank account registers and supervision.

Applies to: EU Member States and the supervisors, FIUs and register operators that support customer due diligence.

Directly applicable customer due diligence rules replace national AMLD transpositions: identification and verification of customers and beneficial owners, including remote onboarding using eIDAS electronic identification means, plus record-keeping duties.

Applies to: Obliged entities across the EU, including banks, payment and e-money institutions, crypto-asset service providers and other financial and non-financial firms (football agents and clubs from 10 July 2029).

Article 40 requires the Commission to review the functioning of NIS2 by 17 October 2027 and every 36 months thereafter, assessing among other things the size-cap and sector scope, and to report to Parliament and Council.

Applies to: The European Commission, with knock-on effects for all NIS2 entities.

Phase 3 begins one calendar year after Phase 2: DoD intends to require Level 2 (C3PAO) for all applicable solicitations and contracts as a condition of award, and Level 3 (DIBCAC) where applicable.

Applies to: Defense contractors and subcontractors handling Controlled Unclassified Information.

Chapter III, Sections 1 to 3 (risk management, data governance, logging, human oversight, accuracy and robustness requirements, and provider and deployer duties) apply to Annex III systems from this date, deferred from 2 August 2026 by the Digital Omnibus.

Applies to: Providers and deployers of high-risk AI systems listed in Annex III, which include remote biometric identification, biometric categorisation and emotion recognition systems.

The rest of the Regulation applies, including essential cybersecurity requirements (such as protection against unauthorised access through authentication and identity management) and conformity assessment before CE marking.

Applies to: Manufacturers, importers and distributors of products with digital elements, with identity management systems, PAM products and biometric readers classed as important products.

Article 5f(2) requires these relying parties to accept the European Digital Identity Wallet for authentication at the user's request no later than 36 months after the wallet implementing acts entered into force, which falls on 24 December 2027.

Applies to: Private relying parties legally or contractually required to use strong user authentication (including banking, financial services, transport, energy, health, telecoms and education) and very large online platforms.

For significant-risk processing that began before the regulations took effect and continues after, a documented risk assessment must be completed no later than 31 December 2027.

Applies to: Businesses whose processing presents significant risk, including processing sensitive personal information such as biometric data and using ADMT for significant decisions.

The AMLA Regulation states that direct supervision of selected obliged entities should commence as of 2028, after the first selection process concludes; no day is fixed.

Applies to: The selected high-risk financial institutions.

Beginning 1 January 2028, and every three years thereafter, data brokers must undergo an independent third-party audit of their compliance with the Delete Act.

Applies to: Data brokers registered in California.

Article 58(1) requires the Commission to review DORA by 17 January 2028 and report to Parliament and Council, with a legislative proposal where appropriate.

Applies to: The European Commission, after consulting the ESAs and the ESRB.

The yearly registration and renewal window on the ACN platform runs from 1 January to 28 February.

Applies to: Entities in scope of Italy's NIS regime.

Under the ESAs Decision, competent authorities submit the registers of information on ICT third-party arrangements to the ESAs by 31 March each year, with a reference date of 31 December of the prior year; financial entities must deliver their registers to their competent authority earlier, on national timelines.

Applies to: EU financial entities, through their national competent authorities, and the ICT third-party providers (including identity and access providers) listed in their registers.

The first independent cybersecurity audit report, covering 2027, is due; audits assess components including authentication (MFA), access controls and privileged account management. Businesses with 50 to 100 million dollars follow on 1 April 2029 and smaller ones on 1 April 2030.

Applies to: Businesses whose processing presents significant security risk and whose 2026 annual gross revenue exceeded 100 million dollars.

Risk assessment information (contact, assessment counts and a signed attestation by an executive) for 2026 and 2027 is due to the Agency by 1 April 2028, then by 1 April each following year.

Applies to: Businesses that conducted risk assessments in 2026 and 2027.

Section 500.17(b) requires each covered entity to submit electronically by April 15 a certification of material compliance for the prior calendar year, or an acknowledgment of noncompliance with a remediation timeline; universal MFA under section 500.12 has applied since 1 November 2025.

Applies to: Banks, insurers and other entities licensed by the New York Department of Financial Services.

NIS entities must update their information on the ACN platform by 31 May each year.

Applies to: Registered NIS entities in Italy.

Chapter III, Sections 1 to 3 apply to high-risk systems classified under Article 6(1) and Annex I, including any embedded biometric access or identification functions in those products.

Applies to: Providers of AI systems that are safety components of products covered by Annex I Union harmonisation legislation (for example machinery, toys, medical devices and lifts).

Phase 4 begins one calendar year after Phase 3: DoD will include CMMC requirements in all applicable solicitations and contracts, including option periods on contracts awarded before Phase 4.

Applies to: All defense contractors and subcontractors in scope of CMMC.