When each regulation hits each sector.

EU AI Act entered into force

Regulation (EU) 2024/1689 published 12 July 2024; entered into force 1 August 2024. Phased applicability: prohibited practices Feb 2025, GPAI rules Aug 2025, high-risk Aug 2026.

AffectsFintech · Healthtech · HR Tech · InsurTech · EdTech · Govtech · PropTech · LegalTech · AdTech · Customer Support · Cybersecurity · Energy

NIS2 transposition deadline

Member-state transposition deadline for Directive (EU) 2022/2555. Essential + important entities directly liable for risk management + 24h/72h incident reporting.

AffectsCybersecurity · Energy · Fintech · Healthtech · Govtech

California SB 1120 (AI in healthcare)

California Health Insurance: AI/algorithm cannot be sole basis for denying medically necessary care; licensed clinician review required.

AffectsHealthtech

DORA entered into application

Regulation (EU) 2022/2554 applies to financial entities. Art. 17/18 ICT incident classification + Art. 19 24h/72h notification + Art. 28 third-party ICT register all in force.

AffectsFintech · InsurTech · Cybersecurity

AI Act prohibited practices applicable

AI Act Chapter II (Art. 5 — prohibited practices) becomes applicable. Includes social scoring by public authorities, real-time biometric ID in public spaces (with exceptions), exploitation of vulnerabilities.

AffectsGovtech · HR Tech · AdTech · Customer Support

AI Act Art. 5(1)(f) workplace emotion-recognition ban (part of Chapter II)

Prohibition on emotion-recognition AI in workplaces and educational institutions (except medical or safety reasons). Effective alongside the rest of Art. 5 prohibited practices. Affects interview AI doing voice-tone / facial-expression inference.

AffectsHR Tech · EdTech

AI Act GPAI obligations applicable

Art. 53 + Annex XI obligations on general-purpose AI providers (OpenAI / Anthropic / Mistral / Meta / Google). Downstream operators (Art. 25) inherit value-chain obligations.

AffectsFintech · Healthtech · HR Tech · InsurTech · EdTech · Govtech · PropTech · LegalTech · AdTech · Customer Support · Cybersecurity · Energy

CMS Interoperability + PA Final Rule (phased compliance begins)

CMS-0057-F: payers must implement PA APIs + publish PA metrics + provide decisioning rationale. Phased compliance through 2027.

AffectsHealthtech

PSR + PSD3 expected OJ publication (est. H1 2026)

EP + Council reached provisional political agreement on the PSR (COM(2023) 366) + PSD3 (COM(2023) 367) package in November 2025. OJ publication expected H1 2026. PSR applies ~20 days after publication; PSD3 transposition typically 18 months. Proposed PSR Art. 83 (transaction monitoring + fraud explainability) + Arts. 85–89 (SCA + risk-based exemptions).

AffectsFintech

AI Act high-risk obligations applicable

Articles 8-15 + 17-18 obligations on high-risk AI systems become applicable. Annex III high-risk (employment, education, biometrics, law enforcement, migration, justice, essential services, credit, insurance) + Art. 6(1) high-risk via product legislation.

AffectsFintech · Healthtech · HR Tech · InsurTech · EdTech · Govtech · PropTech · LegalTech · Energy

EU Digital Identity Wallet (eIDAS 2) — wallet-issuance deadline

Regulation (EU) 2024/1183 requires member states to make EUDIW available to citizens by end of 2026 (with mandatory acceptance by relying parties from November 2027). Identity-verification AI in govtech must interoperate.

AffectsGovtech

AI Act Art. 6(1) high-risk via product legislation

Extended applicability date for AI systems that are safety components of products under Annex I (MDR, automotive, machinery, etc.). Most Class IIa+ medical-device AI is in scope from this date.

AffectsHealthtech

EU Digital Identity Wallet — mandatory acceptance by relying parties

Public + private relying parties must accept EUDIW from this date. Govtech identity-verification AI integrating with the wallet is operationally relevant from this milestone.

AffectsGovtech

Promethean SDK BSL-1.1 → Apache-2.0 conversion

Auto-conversion date for the Promethean SDK (BSL-1.1 source-available → Apache-2.0). Verifier (verify.mjs) is already Apache-2.0.