| Date | Change and status | Buyers most affected | What to do now |
|---|---|---|---|
| 1 January 2026 | Texas TRAIGA took effect, including AI disclosure obligations concerning healthcare services or treatment. | Dental and healthcare operators; suppliers serving them. | Approve the disclosure, delivery point and evidence of delivery. (texasattorneygeneral.gov) |
| 1 January 2026 | California’s new privacy regulations became effective; covered risk-assessment obligations began, with separate later implementation dates for other requirements. | CCPA-covered enterprises and their service providers. | Determine whether the proposed processing needs a risk assessment before deployment. (cppa.ca.gov) |
| 6 January 2026 | FCC DA 26-12 extended the waiver of the cross-category “revoke all” provision to 31 January 2027. It did not suspend the rest of the revocation regime. | Outbound service, marketing and mixed-purpose programmes. | Separate ordinary suppression controls from the deferred cross-category issue. (docs.fcc.gov) |
| 16 February 2026 | Compliance with the revised federal substance-use-disorder record rules became mandatory. | Providers and service partners handling records covered by 42 CFR Part 2. | Review consent, disclosure and breach-response arrangements separately from the general HIPAA assessment. (hhs.gov) |
| 17 February 2026 | NIST announced its AI Agent Standards Initiative. This is standards-development work, not a new calling licence. | Technical approvers, integrators and enterprise procurement. | Add agent identity, authorisation and interoperability to technical diligence. (nist.gov) |
| 26 March 2026 | The FCC adopted a proposal concerning offshore call centres, including transparency and transfer measures. | BPOs serving FCC-regulated communications providers. | Track the proceeding; do not describe the proposal as a universal onshoring obligation. (docs.fcc.gov) |
| 14 May 2026 | Colorado enacted SB26-189, replacing the earlier AI framework with an ADMT-focused regime. | Healthcare, insurance, finance and other consequential-decision workflows. | Reclassify uses against the replacement law. (leg.colorado.gov) |
| 30 September 2026 | Adoption of FCC consent-revocation revisions was reported. Final primary text and commencement verification remain outstanding in this review. | Outbound calling and texting teams. | Obtain the final order and commencement evidence before changing production behaviour. (infobytes.orrick.com) |
| October 2026—now operative | Pennsylvania Act 47 expanded and modernised telemarketing controls; an official legislative announcement confirmed commencement on 19 October. | Operators soliciting Pennsylvania subscribers; relevant telemarketing providers. | Recheck hours, Sunday restrictions, registration and caller-ID controls. (pasenategop.com) |
| 26 October 2026 | Colorado’s formal comment window on its ADMT and chatbot rules closes. An interim draft was released on 6 October. | Businesses needing clarity on scope, notices or review procedures. | Escalate material implementation questions immediately; distinguish draft rules from final obligations. (coag.gov) |
| 1 January 2027 | Colorado’s replacement ADMT requirements become operational; California’s ADMT compliance deadline also arrives. | Enterprises using automation in significant or consequential decisions. | Complete applicability, documentation, consumer-rights and human-review work. (coag.gov) |
| July 2027—agenda target only | HHS’s regulatory agenda lists anticipated final action on the proposed HIPAA Security Rule overhaul. | Healthcare buyers and business associates. | Budget for change, but do not treat this as an enacted compliance deadline. (reginfo.gov) |
Regulatory news and changes