Section 04 of 11 / Read the evidence
Identify the calling and data controls that affect a pilot.
1 January 2026 · confirmed
Dental and healthcare operators; suppliers serving them.
Approve the disclosure, delivery point and evidence of delivery. (texasattorneygeneral.gov)
1 January 2026 · confirmed
CCPA-covered enterprises and their service providers.
Determine whether the proposed processing needs a risk assessment before deployment. (cppa.ca.gov)
6 January 2026 · confirmed
Outbound service, marketing and mixed-purpose programmes.
Separate ordinary suppression controls from the deferred cross-category issue. (docs.fcc.gov)
16 February 2026 · confirmed
Providers and service partners handling records covered by 42 CFR Part 2.
Review consent, disclosure and breach-response arrangements separately from the general HIPAA assessment. (hhs.gov)
17 February 2026 · confirmed
Technical approvers, integrators and enterprise procurement.
Add agent identity, authorisation and interoperability to technical diligence. (nist.gov)
26 March 2026 · proposed
BPOs serving FCC-regulated communications providers.
Track the proceeding; do not describe the proposal as a universal onshoring obligation. (docs.fcc.gov)
14 May 2026 · confirmed
Healthcare, insurance, finance and other consequential-decision workflows.
Reclassify uses against the replacement law. (leg.colorado.gov)
30 September 2026 · verification outstanding
Outbound calling and texting teams.
Obtain the final order and commencement evidence before changing production behaviour. (infobytes.orrick.com)
October 2026—now operative · confirmed
Operators soliciting Pennsylvania subscribers; relevant telemarketing providers.
Recheck hours, Sunday restrictions, registration and caller-ID controls. (pasenategop.com)
26 October 2026 · upcoming
Businesses needing clarity on scope, notices or review procedures.
Escalate material implementation questions immediately; distinguish draft rules from final obligations. (coag.gov)
1 January 2027 · upcoming
Enterprises using automation in significant or consequential decisions.
Complete applicability, documentation, consumer-rights and human-review work. (coag.gov)
July 2027—agenda target only · proposed
Healthcare buyers and business associates.
Budget for change, but do not treat this as an enacted compliance deadline. (reginfo.gov)
This is procurement and deployment research, not a legal opinion or a complete 50-state survey. “In force”, “upcoming”, “proposed” and “verification outstanding” are deliberately different statuses.
Approve a defined calling workflow—not a supplier’s general claim of “AI compliance”.
| Date | Change and status | Buyers most affected | What to do now | | | | | | | 1 January 2026 | Texas TRAIGA took effect, including AI disclosure obligat
The FCC’s position is that AI-generated human voices fall within the TCPA’s artificial-or-prerecorded-voice restrictions—not that every AI-assisted telephone interaction is prohibited.
There are three separate issues: existing opt-out duties, the deferred cross-category requirement, and the newly reported FCC revisions.
What must Pennsylvania callers change now?
Is the proposed HIPAA Security Rule overhaul already law?
Are recording permission and calling permission interchangeable?
Assess the actual payment path, not just a supplier’s PCI claim.
What does NIST’s 2026 agent initiative change?
Use an evidence-based release gate with named owners.