March 31, 2026
First public prior authorization metrics
Payers covered by CMS-0057-F publish their first annual prior authorization metrics. The initial report covers 2025 activity.
U.S. healthcare · covered payers
Regulatory timeline
Know which dates reach your AI agents
Some of these rules already apply, and others arrive over the next two years. Each entry links to its official source and to the VeriProof page that covers it. Sources last reviewed September 2026.
Already in effect
These dates have passed. If they reach your agents, the duties apply now.
August 2, 2026
EU AI Act transparency duties (Article 50)
People must be told when they are interacting with an AI system, and certain AI-generated content must be marked or disclosed. The duties fall on providers and deployers.
EU AI · providers and deployers of covered systems
Coming up
In date order. Check each official source for the scope that applies to you.
Starting January 1, 2027
Prior authorization API requirements
CMS-0057-F API requirements begin for covered payers. For managed care plans and exchange issuers, timing follows the applicable rating period or plan year.
U.S. healthcare · covered payers
January 1, 2027
Colorado automated decision-making law (SB 26-189)
SB 26-189 repealed and replaced SB 24-205. Covered automated decision-making technology used in consequential decisions needs notice when people interact with it and disclosure after an adverse decision.
U.S. state law · Colorado consequential decisions
Expected January 18, 2027
GENIUS Act stablecoin rules
The general effective date is the earlier of January 18, 2027, or 120 days after final implementing rules. Treasury’s August 2026 proposal points to January 18, 2027.
U.S. payments · payment stablecoin issuers
January 20, 2027
EU Machinery Regulation applies
The regulation sets safety requirements for covered machinery and related products, including certain software safety components.
EU manufacturing · covered machinery
May 1, 2027
OSFI Guideline E-23 takes effect
Model risk management expectations apply to federally regulated financial institutions. The guideline’s model definition includes AI and machine learning.
Canadian financial services · federally regulated institutions
December 2, 2027
High-risk AI rules for Annex III uses
High-risk rules apply to covered uses such as admissions and recruitment. The AI Omnibus moved this milestone from August 2026.
EU AI · covered Annex III systems
August 2, 2028
High-risk AI rules for regulated products
A separate application date covers high-risk AI embedded in regulated products. Product safety requirements have their own timelines.
EU AI · covered Annex I products
Windows that start from an event
Incident-reporting windows start when a covered event becomes known, not on a calendar date.
From awareness of a significant incident
NIS2 significant-incident reporting
NIS2 sets a 24-hour early-warning window and generally a 72-hour incident notification window. National law and provider type determine the applicable duties.
EU cybersecurity · covered entities
Optional brief
Connect a requirement to your workflow
Discuss the rules, review decisions, and evidence your team needs for a specific use case.
See where your agent stands before the next date
Answer eight questions about one agent and see which of the handoffs your approvers expect are already in place.