AI & DATA GOVERNANCE • 2026–2030
A practical regulatory horizon and a scored readiness check for organizations developing, buying, or deploying AI.
THE BASELINE • REQUIRED NOW WHERE APPLICABLE
Organizations should map where they operate, whose data they process, whether AI influences consequential decisions, and whether they act as a provider, deployer, developer, or vendor.
Prohibited-practice and AI-literacy duties have applied since February 2025; GPAI duties since August 2025; most remaining provisions and enforcement applied from August 2026.
GDPR, CCPA/CPRA and other privacy laws continue to govern personal data used to train, configure, operate, monitor, or evaluate AI.
New York City Local Law 144 restricts use of covered automated employment decision tools without a recent independent bias audit, public summary, and required notices.
Anti-discrimination, consumer protection, financial, health, employment, safety, cybersecurity, recordkeeping, and contractual duties may apply even without an AI-specific law.
CURRENT LAW WATCH • SEPTEMBER 2026
A cross-jurisdiction executive map for scoping conversations. Confirm applicability, effective dates, and implementation rules with counsel.
Operationalize role classification, AI literacy, transparency, governance evidence, and post-market monitoring. High-risk obligations remain staged.
2026 rules bring risk-assessment, automated decision-making rights, and annual cybersecurity-audit considerations into the operating agenda.
Track prohibited uses, required disclosures, complaint paths, and governance expectations around high-impact systems.
ADMT revisions and chatbot-safety duties make age safeguards, AI disclosure, privacy tools, and escalation design timely planning items.
Covered developers face safety-framework, critical-incident reporting, and oversight expectations. Map exposure across the supply chain.
Plan for synthetic-content disclosures, provenance metadata, model/version records, and clear user-facing AI notices.
This is an applicability map, not legal advice. Sources: EU AI Act consolidated text, California CPPA, Texas HB 149, Colorado AG, and New York RAISE.
BY 31 DECEMBER 2026
This is a governance readiness baseline developed by The Neitsch Group. It is not itself a universal statutory checklist.
REGULATORY HORIZON
Confirmed dates are distinguished from planning horizons. Monitor official sources because legislative and implementation dates can change.
EU AI Act transparency rules apply from August 2026, alongside existing privacy, employment, consumer, sector, and contractual duties. Build the inventory, classification, literacy, disclosure, and evidence foundation now.
Prepare disclosure and provenance processes for covered AI-generated or manipulated content, including provider, system, version, and timestamp records where feasible.
EU requirements apply to specified high-risk uses including employment, education, essential services, biometrics, critical infrastructure, migration, and law enforcement. Expected work includes risk management, data governance, logging, documentation, human oversight, accuracy, robustness, and cybersecurity.
The extended transition applies to high-risk systems that are safety components of products covered by specified EU product-safety legislation.
Expect overlapping requirements around impact assessment, consequential decisions, notice, contestability, testing, vendor diligence, cybersecurity, and documentation. Maintain a regulatory register rather than designing around one statute.
Move from periodic policy exercises to a governed system lifecycle: discovery, classification, approval, data controls, evaluation, monitoring, incident response, change control, retirement, and board reporting.
FREE 5-MINUTE GRC SCORECARD
Complete eight focused questions to receive your GRC score, risk band, and recommended next actions. Your answers stay in this browser and are not submitted.
Educational screening only. The score does not determine compliance, legal exposure, certification, or the applicability of any law.
THE SCORE IS A STARTING POINT
We can help validate applicability, prioritize gaps, and define the work ahead.