Navigating Future AI Regulations

The EU AI Act entered into force on 1 August 2024. Per the European Commission's AI Act page, the prohibited practices and the AI literacy provisions have applied since 2 February 2025, and the obligations for general-purpose AI (GPAI) model providers have applied since 2 August 2025.

The big change this year is the Digital Omnibus on AI. It was formally adopted as Regulation (EU) 2026/1744, dated 8 July 2026, published in the Official Journal and in force since 27 July 2026. It moves the main high-risk obligations: Annex III areas (employment, credit, education and similar) now apply from 2 December 2027, and AI in regulated products under Annex I from 2 August 2028. The Article 50 transparency duties, such as telling users they are interacting with a chatbot and labeling deepfakes, kept their 2 August 2026 date, with a short grace period to 2 December 2026 for watermarking on systems already on the market.

So there is no high-risk deadline this quarter, but transparency rules apply now if your product talks to people or generates content.

Canada still has no federal AI-specific law. The Artificial Intelligence and Data Act (AIDA) died on the order paper when Parliament was prorogued on 6 January 2025. On 15 June 2026, the federal government tabled Bill C-36, the Protecting Privacy and Consumer Data Act. It is a privacy bill, not an AI act, but it would require transparency about automated decision-making for significant decisions about individuals. As of late September 2026 it had completed first reading only, so treat its details as proposals that can change.

Provincial rules already bite. Quebec's Law 25 added section 12.1 to the private-sector privacy act: if you make a decision based exclusively on automated processing of personal information, you must tell the person, explain on request the information and principal factors used, and let them submit observations to someone who can review the decision. In Ontario, employers with 25 or more employees have had to disclose AI use to screen, assess or select applicants in publicly advertised job postings since 1 January 2026.

There is no comprehensive federal AI statute. On 11 December 2025 the President signed the executive order Ensuring a National Policy Framework for Artificial Intelligence, which created a Justice Department task force to challenge state AI laws. The order does not itself preempt state law, and the March 2026 White House legislative framework that followed is a set of non-binding recommendations to Congress.

Meanwhile the states keep legislating. Texas's TRAIGA (HB 149) took effect 1 January 2026. Colorado repealed and replaced its 2024 AI Act with SB 26-189, an automated decision-making technology law signed on 14 May 2026 and effective 1 January 2027. California's privacy regulator has finalized rules that require businesses using automated decisionmaking technology to comply from 1 January 2027.

Almost every row asks for the same four things: know where you use AI, know which uses affect people, tell those people, and keep a human able to review the outcome.

Because the laws converge on controls even when they diverge on dates. Texas makes this explicit: its affirmative defense covers a company that substantially complies with the NIST generative AI profile "or another nationally or internationally recognized risk management framework for artificial intelligence systems." That is a legislature telling you a framework is the defense.

The two frameworks I use as the baseline are the NIST AI Risk Management Framework, voluntary and released in January 2023, and ISO/IEC 42001, the certifiable AI management system standard published in December 2023. NIST defines good AI risk management; ISO 42001 gives you the management system that proves you do it consistently. Our ISO 42001 readiness checklist covers the clauses.

Across our assessments, companies that answer AI questionnaires quickly have the same seven things in place.

If you already run a security program aligned to ISO 27001 or SOC 2, much of this plugs into your existing governance, risk and compliance structure. Quebec, California and Colorado regulate the decision, not just the model, so check your data security and privacy controls too.

This is the sequence I run with founders, assuming one internal owner working with a fractional security leader.

After day 90 it is maintenance: re-classify when the roadmap adds AI, update the mapping when a law changes. Our AI governance playbook packages the templates for this sequence.

It will not make you compliant by itself. You still apply it to each jurisdiction's specifics, such as Colorado's 30-day window for explaining adverse decisions.

It will not stop a determined attacker either. Prompt injection, data poisoning and agent misuse need technical safeguards and guardrails on top of policy.

It can. The Act reaches non-EU providers and deployers when their systems are placed on the EU market or their outputs are used in the EU.

Yes. Regulation (EU) 2026/1744, in force since 27 July 2026, moved Annex III high-risk obligations to 2 December 2027 and Annex I product-embedded AI to 2 August 2028. Prohibited practices, GPAI obligations and most transparency duties were not delayed.

No. AIDA died in January 2025. Bill C-36, tabled in June 2026, is a privacy bill with automated decision-making transparency rules, and it has not passed. Quebec's Law 25 already regulates fully automated decisions.

Start with the inventory; every later decision depends on it. If you want a second set of eyes, our AI governance services and ISO 42001 readiness offering are built for exactly this baseline, and our Virtual CISO services start with the Crawling tier from $2,000 a month for teams that need fractional leadership to own it. Book a free consultation and bring your AI questionnaire; we will tell you honestly which parts matter now and which can wait.