AI &amp; Data Compliance Deadlines Developers Must Meet in 2026

ACTIVE — HHS OCR AI guidance issued 2023. First AI-specific fines in 2024.

HIPAA + AI (PHI in LLMs)

Fine: $100 – $1.9 million per violation category per year

ACTIVE since July 5, 2023 — NYC is auditing employers NOW

NYC Local Law 144

Fine: $500 first violation, $1,500 per subsequent violation PER APPLICANT

🇪🇺ACTIVE NOW

EU AI Act GPAI

August 2, 2026 — Full GPAI obligations apply

Fine: €30 million or 6% of global annual turnover

🇿🇦ENFORCED

POPIA (SA)

ACTIVE ENFORCEMENT — Fines being issued now

Fine: R10 million or 10 years imprisonment

🌐ENFORCED

Multi-Tenant RLS

NOT a deadline — a live engineering risk that can destroy your company overnight

Fine: GDPR: €20M. POPIA: R10M. Plus class action. Plus lost customers.

🇪🇺ENFORCED

EU DORA (Financial AI)

ACTIVE since January 17, 2025 — ESAs conducting first compliance reviews

Fine: 1% of average daily worldwide turnover per day of infringement

ACTIVE — CFPB issued guidance Sep 2023. Enforcement actions ongoing.

CFPB ECOA/FCRA AI Rules

Fine: Up to $50,000 per day per violation. Class action exposure.

Illinois BIPA (Biometrics)

ACTIVE — Courts awarding class action damages. Amazon paid $5.5M in 2023.

Fine: $1,000 per negligent violation, $5,000 per intentional/reckless violation

🇪🇺ENFORCED

GDPR Art. 22

ACTIVE ENFORCEMENT — reinforced by EU AI Act 2026

Fine: €20 million or 4% of global annual turnover

🇺🇸ACTIVE NOW

US AI Laws 2026

Colorado active July 1. Texas, Illinois, Virginia bills advancing.

Fine: Varies by state — $5,000–$20,000 per violation

Enterprise buyers require SOC 2 Type II before signing — no deadline but blocks every deal

SOC 2 Type II

Fine: Not a fine — but no SOC 2 = no enterprise customer

🇰🇪ENFORCED

Kenya DPA (2019)

ACTIVE — Data Commissioner issuing enforcement notices since 2023.

Fine: KSh 5 million (~$38,000 USD) per violation

🌐ACTIVE NOW

ISO 42001 (AI Management)

Published December 2023 — Enterprise RFPs now requiring ISO 42001 certification.

Fine: Not a fine — but required to win enterprise AI contracts in 2026

🇸🇦ENFORCED

Saudi Arabia PDPL

ACTIVE enforcement since September 2023. SDAIA auditing proactively.

Fine: SAR 5 million (~$1.3M USD) per violation + operational suspension

Colorado SB 21-169 (Insurance AI)

ACTIVE — Colorado Division of Insurance conducting examinations

Fine: $100,000 per violation + license suspension

🇪🇺Europe

Article 50 of the EU AI Act mandates that any AI system generating synthetic text, images, audio, or video output must e...

Max fine: €15 millionSee implementation →

General Purpose AI (GPAI) model providers must publish technical documentation, train data summaries, and comply with co...

Max fine: €30 millionSee implementation →

GDPR Article 22 prohibits solely automated decisions that have significant effects on individuals without human oversigh...

Max fine: €20 millionSee implementation →

🇪🇺

EU DORA (Financial AI)

European Union

Max fine: 1% ofSee implementation →

EU DORA requires all financial entities — banks, insurers, investment firms, crypto asset providers — to test all ICT sy...

🌎Americas

Colorado SB 24-205 became effective July 1, 2026. It requires developers and deployers of 'high-risk AI systems' — those...

Max fine: $20,000 perSee implementation →

Brazil's LGPD is fully enforced by the ANPD (National Data Protection Authority). With 214 million internet users and on...

Max fine: R$50 millionSee implementation →

Following Colorado's AI Act (effective July 1, 2026), Illinois, Texas, Virginia, and California are advancing AI-specifi...

Max fine: Varies bySee implementation →

HIPAA + AI (PHI in LLMs)

United States

Max fine: $100 –See implementation →

Using OpenAI, Anthropic, or any LLM API with patient data (PHI) without a signed Business Associate Agreement (BAA) is a...

NYC Local Law 144 requires any employer using an AI AEDT (automated employment decision tool) for NYC-based hiring to: (...

Max fine: $500 firstSee implementation →

CFPB ECOA/FCRA AI Rules

United States

Max fine: Up toSee implementation →

CFPB requires lenders using AI models to provide specific, accurate adverse action notices — 'algorithmic' is not suffic...

Illinois BIPA (Biometrics)

Illinois, USA

Max fine: $1,000 perSee implementation →

Illinois BIPA applies to any AI system processing biometric identifiers: facial recognition, voiceprint, fingerprint. AI...

🇨🇦

Canada AIDA (Bill C-27)

Canada

90d left

Canada's AIDA classifies high-impact AI systems with extensive obligations: impact assessments, registration with ISED, ...

Max fine: CAD 10MSee implementation →

Colorado SB 21-169 (Insurance AI)

Colorado, USA

Max fine: $100,000 perSee implementation →

Colorado SB 21-169 prohibits insurers from using algorithms or predictive models that unfairly discriminate based on rac...

🌏Asia-Pacific

India's DPDP Act 2023 is the world's largest data protection law by population covered. With 1.4 billion residents and I...

Max fine: ₹250 croreSee implementation →

🌍Africa

POPIA has been actively enforced since July 2021. The Information Regulator of South Africa is actively investigating co...

Max fine: R10 millionSee implementation →

Nigeria's NDPA 2023 established the Nigeria Data Protection Commission (NDPC), which has been actively issuing complianc...

Max fine: ₦10 millionSee implementation →

Kenya's Data Protection Act 2019 is actively enforced by the Data Commissioner. Any company processing M-Pesa transactio...

Max fine: KSh 5See implementation →

🌍Middle East

UAE's Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) is now fully in effect. With Dubai as a global bu...

Max fine: AED 5See implementation →

Saudi Arabia PDPL covers all AI systems processing Saudi citizen data — including data processed outside the Kingdom. Th...

Max fine: SAR 5See implementation →

🌐Global

United States (Global Standard)

SOC 2 Type II