AI Governance Deadlines 2026: What Is Live Now

Article 50 transparency duties are live. Fannie Mae's AI and ML governance framework is already effective for lenders, and the ECB's directly supervised banks face an October 31 filing on AI-enabled cyber threats. The 2026 compliance calendar is now a mix of active obligations and deadlines that moved under the EU Digital Omnibus.

This guide lists the operative dates, scope tests, and evidence each instrument asks an organization to produce. The high-risk EU AI Act obligations for standalone Annex III systems now apply on December 2, 2027, while Article 50 transparency remains an active requirement.

TL;DR

Article 50 transparency duties, mortgage AI governance rules, and the ECB's October filing are already active 2026 obligations. Standalone Annex III high-risk duties move to December 2, 2027, so teams should use the time to establish a single inventory, authorization model, and evidence record.

The EU AI Act, and what moved

The Act is the largest instrument, with Tier 2 penalties reaching €15 million or 3% of global annual turnover for high-risk non-compliance (Article 99).

What moved under the Omnibus: standalone Annex III high-risk obligations shifted from August 2, 2026 to December 2, 2027, embedded high-risk systems to August 2, 2028, and national regulatory sandboxes to August 2, 2027.

What did not move: Article 50 transparency obligations apply from August 2, 2026. The Commission adopted its final Article 50 guidelines on July 20, 2026, covering the duty to disclose interactive AI systems and the marking of synthetic content (European Commission). Generative systems already on the market get until December 2, 2026 for machine-readable marking. A prohibition on non-consensual intimate imagery and CSAM generation applies from December 2026.

The deferral bought paperwork time on conformity assessment. It bought nothing on transparency, logging, or the evidence layer, which is the read developed in the omnibus deferral piece.

Article 12 is the clause with the longest operational tail. It requires automatic recording of events over the lifetime of a high-risk system, in enough detail to reconstruct what happened (Article 12 analysis). Deferred to December 2027 for standalone Annex III systems, and the architecture it implies takes longer than 17 months to retrofit in most enterprises.

US state law

Texas TRAIGA took effect January 1, 2026, with civil penalties and Attorney General enforcement (Gunder). The California AI Transparency Act also took effect January 1, 2026, mandating disclosure for AI systems with more than one million monthly users (WSGR).

Colorado SB 26-189, signed May 14, 2026, scaled back the Colorado AI Act and removed the carry-over of the HIPAA covered-entity exemption, with a new consequential-decision test for clinical AI. Effective January 1, 2027 with a 60-day AG cure period. Tennessee SB 1580 took effect July 1, 2026, prohibiting AI systems from presenting themselves as licensed mental-health professionals.

The state layer is where the compliance cost actually lands for US-only businesses, because there is no single scope test. A system that is out of scope in Texas can be in scope in Colorado on a different definition.

Financial services

The ECB's Supervisory Board wrote to the 110 banks it directly supervises on July 7, 2026, giving them until October 31 to submit plans against AI-enabled cyber threats, and pushed its annual IT Risk Questionnaire from September 2026 to February 2027. The asks span vulnerability management, monitoring and detection, third-party provider scrutiny, legacy modernization, and crisis management. Two of those, third-party AI provider scrutiny and monitoring of AI traffic, produce evidence a supervisor can inspect. Patch cadence and legacy modernization do not, and a filing that conflates them reads badly (the October 31 filing detail).

DORA applies across EU financial entities with its ICT third-party register and exit-strategy requirements, covered in DORA AI compliance for banks. The FCA published the Mills Review on July 6, 2026, which is a review rather than a rule and signals where UK supervision is heading on agentic finance.

Mortgage and housing

Fannie Mae issued Lender Letter LL-2026-04 on April 8, 2026, a governance framework for AI and ML in mortgage origination and servicing, effective August 6, 2026 (Fannie Mae). Freddie Mac Section 1302.8 has been enforced since March 3, 2026. Sector rules like these get less attention than the EU AI Act and arrive sooner for the firms they cover.

What they converge on

• EU AI Act Article 50 has applied since August 2, 2026. It requires disclosure and marking of AI interaction.
• EU AI Act Article 12 applies to standalone Annex III systems from December 2, 2027. It requires automatic event records across the system lifetime.
• Texas TRAIGA has applied since January 1, 2026, with governance duties and Attorney General enforcement.
• California's AI Transparency Act has applied since January 1, 2026, with disclosure duties for systems above one million monthly users.
• Tennessee SB 1580 has applied since July 1, 2026, barring AI systems from presenting themselves as licensed mental-health professionals.
• Colorado SB 26-189 applies from January 1, 2027, with its consequential-decision test for clinical AI.
• The ECB AI cyber letter requires a supervisor-inspectable plan from directly supervised banks by October 31, 2026.
• Fannie Mae LL-2026-04 has applied since August 6, 2026, as an AI and ML governance framework for lenders.
• Freddie Mac Section 1302.8 has been enforced since March 3, 2026.

Read down the right column and three demands repeat under different names. An inventory of the AI systems in use. Control over who may use them and under what conditions. Records demonstrating both, produced at the time rather than reconstructed afterward.

Each regime writes those in its own vocabulary, which is what makes cross-regime mapping feel harder than it is. The full crosswalk is in AI audit trail requirements by regulation.

The mistake worth naming

Programs get organized by regulation. One workstream for the AI Act, one for the state laws, one for the sector rule, each with its own owner and its own tracker. Two quarters later there are three inventories that disagree and three sets of records in different formats, and the organization is worse off than if it had built one.

I would organize by control instead and map the controls to the regimes afterward. The inventory is one inventory. The authorization model is one model. The record schema is one schema, superset of what the regimes ask, retained at the strictest applicable period. That is a harder sell to three separate compliance owners and it is the only version that stays coherent past the first year.

Where the inventory usually fails

Every instrument above starts with knowing which AI systems you operate, and inventories built from interviews record what people remembered. 78% of employees use unauthorized AI tools at work, and 86% of IT leaders report being completely blind to those interactions (Cloud Radix). A register assembled without traffic-level visibility is a register of the sanctioned subset, and the unsanctioned remainder is where the regulatory exposure sits.

DeepInspect

This is the gap DeepInspect closes. Across every instrument above, the recurring asks are an inventory of AI use, control over who may use what, and records that survive inspection, and DeepInspect sits inline on the HTTP path between authenticated users or agents and any LLM.

Every request is bound to a verified caller identity, classified against your own data classes, and evaluated against identity-aware policy, with a deterministic fail-closed decision before the call reaches the provider. The same pass produces the inventory each regime asks for first, because every model endpoint in use appears in the record whether or not it was declared. Each decision commits a signed audit record on a write path the calling application never controls, held in one schema that satisfies the strictest applicable retention rather than one format per regulation. DeepInspect covers the AI traffic layer and leaves conformity assessment, impact assessment, and model documentation to the programs that own them. Organizations mapping obligations across the AI Act, a state law, and a sector rule need one evidence model that survives each review. Let's talk today.