AI & DATA GOVERNANCE • 2026–2030
A practical regulatory horizon and a scored readiness check for organizations developing, buying, or deploying AI.
THE BASELINE • REQUIRED NOW WHERE APPLICABLE
Organizations should map where they operate, whose data they process, whether AI influences consequential decisions, and whether they act as a provider, deployer, developer, or vendor.
Prohibited-practice and AI-literacy duties have applied since February 2025; GPAI duties since August 2025; most remaining provisions and enforcement applied from August 2026.
GDPR, CCPA/CPRA and other privacy laws continue to govern personal data used to train, configure, operate, monitor, or evaluate AI.
New York City Local Law 144 restricts use of covered automated employment decision tools without a recent independent bias audit, public summary, and required notices.
Anti-discrimination, consumer protection, financial, health, employment, safety, cybersecurity, recordkeeping, and contractual duties may apply even without an AI-specific law.
BY 31 DECEMBER 2026
This is a governance readiness baseline developed by The Neitsch Group. It is not itself a universal statutory checklist.
REGULATORY HORIZON
Confirmed dates are distinguished from planning horizons. Monitor official sources because legislative and implementation dates can change.
EU AI Act transparency rules apply from August 2026, alongside existing privacy, employment, consumer, sector, and contractual duties. Build the inventory, classification, literacy, disclosure, and evidence foundation now.
EU requirements apply to specified high-risk uses including employment, education, essential services, biometrics, critical infrastructure, migration, and law enforcement. Expected work includes risk management, data governance, logging, documentation, human oversight, accuracy, robustness, and cybersecurity.
The extended transition applies to high-risk systems that are safety components of products covered by specified EU product-safety legislation.
Expect overlapping requirements around impact assessment, consequential decisions, notice, contestability, testing, vendor diligence, cybersecurity, and documentation. Maintain a regulatory register rather than designing around one statute.
Move from periodic policy exercises to a governed system lifecycle: discovery, classification, approval, data controls, evaluation, monitoring, incident response, change control, retirement, and board reporting.
5-MINUTE GOVERNANCE RISK CHECKER
Answer eight questions. The score combines inherent exposure with missing governance controls. Your answers stay in this browser and are not submitted.
Educational screening only. The score does not determine compliance, legal exposure, certification, or the applicability of any law.
THE SCORE IS A STARTING POINT
We can help validate applicability, prioritize gaps, and define the work ahead.