The next dated AI-compliance deadline for banks is Oct 20, 2026: CFTC — CFTC Compute Derivatives RFC: comment period closes. 100 documents are in force today, 2 consultations are open for comment, and the binding dated obligations ahead are Colorado's ADMT and chatbot acts (January 1, 2027), the EU AI Act's high-risk regime for credit scoring (December 2, 2027) and its product-embedded extension (August 2, 2028). Everything below is generated from the tracker's primary-source documents and recomputed daily.
Q4 2026 — this quarter
What must banks do this quarter?
| Date | Authority | Obligation / event | Who must act |
|---|---|---|---|
| Oct 20, 2026 | CFTC | CFTC Compute Derivatives RFC: comment period closes · Comment deadline | Designated contract markets, swap execution facilities, clearinghouses, swap dealers, FCMs, and market participants interested in… |
| Oct 26, 2026 | Colorado AI Act | Colorado AG proposed ADMT rules: comment period closes · Comment deadline | Developers, 'midstream developers', and deployers of covered ADMT under SB 26-189, and operators of conversational AI services… |
| Oct 31, 2026 | ECB | Deadline for significant institutions to submit AI-cyber action plans to their JSTs · Milestone | The ~110 significant euro-area banking groups directly supervised under the SSM |
| Nov 2026 | NY DFS | RAISE Act: DFS begins directing large frontier developers to register · Milestone | Roughly 3,000 DFS-licensed or -chartered entities: New York state-chartered banks and trust companies, New York branches and… |
| Nov 20, 2026 | EU AI Act | Consumer Credit Directive (EU) 2023/2225 takes effect · Takes effect | Creditors and credit intermediaries offering consumer credit in the EU, as transposed by member states |
| Dec 1, 2026 | Colorado AI Act | Regulation 10-1-1: annual life insurer reports and non-use attestations due · Milestone | Developers and deployers of automated decision-making technology that materially influences consequential decisions for Colorado… |
| Dec 2, 2026 | EU AI Act | Article 50(2) marking transition ends · Milestone | Any bank, lender, or fintech that develops or uses AI systems in the EU — including non-EU firms whose AI outputs are used in the… |
Q1 2027
What AI obligations land in Q1 2027?
| Date | Authority | Obligation / event | Who must act |
|---|---|---|---|
| Jan 1, 2027 | Colorado AI Act | SB 26-189 takes effect · Takes effect | Developers and deployers of covered ADMT that materially influences consequential decisions about Colorado consumers in financial… |
| Jan 1, 2027 | Colorado AI Act | HB 26-1263 takes effect · Takes effect | Operators of conversational AI services accessible to the public in Colorado, including bank customer-service chatbots |
| Jan 1, 2027 | California CPPA | AB 1609 takes effect · Takes effect | Any "large private business" — more than $500 million in gross annual revenue nationally — that provides goods or services to… |
| Jan 1, 2027 | NY DFS | New York RAISE Act takes effect · Takes effect | Frontier models developed, deployed or operating in whole or in part in New York: all frontier developers (more than 10^26… |
| Jan 1, 2027 | NY DFS | RAISE Act takes effect · Milestone | Roughly 3,000 DFS-licensed or -chartered entities: New York state-chartered banks and trust companies, New York branches and… |
Q2 2027
What AI obligations land in Q2 2027?
| Date | Authority | Obligation / event | Who must act |
|---|---|---|---|
| May 1, 2027 | OSFI | OSFI Guideline E-23 takes effect · Takes effect | All federally regulated financial institutions (FRFIs) in Canada: banks, foreign bank branches (to the extent consistent with… |
Q3 2027
What AI obligations land in Q3 2027?
| Date | Authority | Obligation / event | Who must act |
|---|---|---|---|
| Jul 1, 2027 | California CPPA | SB 947 takes effect · Takes effect | Any California employer — including banks and credit unions — that uses an automated decision system (ADS) to make or assist… |
| Jul 1, 2027 | Utah Division of Consumer Protection | Scheduled repeal of the Artificial Intelligence Policy Act (Title 13, Chapter 72) · Milestone | Any supplier that uses generative AI to interact with an individual in a consumer transaction (disclosure on request), and… |
| Jul 10, 2027 | EBA | EU Anti-Money Laundering Regulation applies · Milestone | All EU credit institutions and payment providers, via national competent authorities |
| Aug 2, 2027 | EU AI Act | Deadline for general-purpose AI models placed on the market before August 2025 · Milestone | Any bank, lender, or fintech that develops or uses AI systems in the EU — including non-EU firms whose AI outputs are used in the… |
Q4 2027
What AI obligations land in Q4 2027?
| Date | Authority | Obligation / event | Who must act |
|---|---|---|---|
| Oct 7, 2027 | MAS | MAS Guidelines on Artificial Intelligence Risk Management takes effect · Takes effect | All financial institutions regulated by MAS, including full, merchant and wholesale banks and banking financial holding… |
| Dec 2, 2027 | EU AI Act | High-risk AI obligations for stand-alone Annex III systems become applicable · Milestone | Any bank, lender, or fintech that develops or uses AI systems in the EU — including non-EU firms whose AI outputs are used in the… |
| Dec 2, 2027 | BaFin | BaFin begins monitoring high-risk AI system requirements · Milestone | Banks, insurers, asset managers and other financial entities supervised by BaFin; for AI Act purposes, financial companies… |
Q3 2028
What AI obligations land in Q3 2028?
| Date | Authority | Obligation / event | Who must act |
|---|---|---|---|
| Aug 2, 2028 | EU AI Act | Deferred deadline for high-risk AI embedded in regulated products · Milestone | Any bank, lender, or fintech that develops or uses AI systems in the EU — including non-EU firms whose AI outputs are used in the… |
In force today
Which AI rules is a bank examined against right now?
The newest documents currently in force — the working baseline for an AI compliance program. Full index: all documents →
| Since | Document | The obligation |
|---|---|---|
| Sep 3, 2026 | FIN-2026-Alert005 (Digital Asset Investment Scam Centers) | FinCEN Alert FIN-2026-Alert005, issued September 3, 2026, urges financial institutions to detect and report money laundering tied to digital asset investment ('pig butchering') scam centers,… |
| Sep 2, 2026 | FCA multi-firm review: Frontier AI and cyber resilience (Sep 2026) | The FCA published a multi-firm review on 2 September 2026 sharing what it learned engaging with firms on frontier AI and cyber resilience. |
| Jul 31, 2026 | ESA Statement on ICT risks from frontier AI models (JC 2026 25) | On July 31, 2026 the EBA, EIOPA and ESMA published joint statement JC 2026 25 on ICT risks from frontier AI models, warning that highly capable AI models sharply accelerate vulnerability discovery… |
| Jul 24, 2026 | FIN-2026-Alert004 (Federal Student Aid Fraud) | FinCEN Alert FIN-2026-Alert004, issued July 24, 2026, asks financial institutions to detect and report fraud rings stealing federal student aid through 'ghost students' and 'straw students.' It… |
| Jul 27, 2026 | Regulation (EU) 2026/1744 (Digital Omnibus on AI) | Regulation (EU) 2026/1744, the Digital Omnibus on AI, was proposed by the European Commission on November 19, 2025, agreed by Parliament and Council in May 2026, adopted July 8, 2026, published in… |
| Jul 20, 2026 | Commission guidelines on AI Act Article 50 transparency | The European Commission adopted its Guidelines on the transparency obligations under Article 50 of the AI Act on 20 July 2026 (Communication C(2026) 5054), less than two weeks before Article 50 began… |
| Jul 7, 2026 | ECB 'Dear CEO' letter on AI-enabled cybersecurity threats (SSM-2026-0301) | On 7 July 2026 Claudia Buch, Chair of the ECB Supervisory Board, sent letter SSM-2026-0301, 'Addressing AI-enabled cybersecurity threats', to the CEO of every significant institution. |
| Jun 2, 2026 | SFC Circular 26EC32 (AI-enabled cyberattacks) | SFC Circular 26EC32 (reference SFO/IS/020/2026), issued on 2 June 2026, reminds licensed corporations, SFC-licensed virtual asset trading platforms and their associated entities to review and enhance… |
| May 25, 2026 | IOSCO FR/02/2026 | IOSCO's Supervisory Toolkit for AI Use in Capital Markets (Final Report FR/02/2026), published May 25, 2026, gives securities supervisors 'practical, non-binding, non-prescriptive supervisory tools'… |
| May 22, 2026 | Japan FSA/BOJ frontier AI request | On 22 May 2026 the Japan Financial Services Agency and the Bank of Japan jointly requested financial institutions to take short-term measures against the changed cyber threat posed by frontier AI,… |
| May 21, 2026 | DFS Frontier AI Models Industry Letter (May 2026) | On May 21, 2026, DFS issued an Industry Letter warning that 'frontier AI models' able to identify vulnerabilities and build exploits at unprecedented speed and scale will soon become widely… |
| May 21, 2026 | DFS Heightened Threat Environment Guidance (May 2026) | Issued May 21, 2026 as the companion to DFS's frontier-AI letter, this guidance defines a 'heightened cybersecurity threat environment' as one where risks are significantly elevated with a high… |
Already passed in 2026
Which AI deadlines have banks already been through this year?
| Date | Authority | What happened |
|---|---|---|
| Oct 12, 2026 | FSB | FSB confirms finalised AI sound practices ahead of G20 delivery · Milestone |
| Oct 7, 2026 | MAS | MAS issues final Guidelines on AI Risk Management · Milestone |
| Oct 6, 2026 | Colorado AI Act | AG releases interim draft redline of the ADMT and Chatbot Act rules · Milestone |
| Oct 1, 2026 | Basel Committee | Committee agrees to review operational-risk loss categories for AI and cyber risk · Milestone |
| Sep 30, 2026 | ACPR | ACPR algorithmic fairness consultation closes · Milestone |
| Sep 30, 2026 | EBA | EBA 2027 Work Programme names AI/ML as a supervisory-technology priority · Milestone |
| Sep 29, 2026 | White House | EO 14434 directs agencies to say 'Super Intelligence' instead of 'AI' · Milestone |
| Sep 23, 2026 | ESMA | ESMA announces digital innovation Union Strategic Supervisory Priority from 2027 · Milestone |
| Sep 21, 2026 | NY DFS | RAISE Act implementation: registration opens November 2026, DIGIT office staffed · Milestone |
| Sep 21, 2026 | CFTC | Innovation Task Force announces Frontier Forum Series; inaugural forum on AI and agentic finance Oct 28, 2026 · Milestone |
| Sep 16, 2026 | NIST | Conference of State Bank Supervisors cites the RMF in its new AI Supervisory Framework · Milestone |
| Sep 15, 2026 | NCUA | NCUA joins the OCC, Fed and FDIC on a proposed interagency Third-Party Risk Management guidance — its first joint banking-agency guidance · Milestone |
| Sep 1, 2026 | Texas AG | Deadline for the Attorney General to post the TRAIGA information and online complaint mechanism · Milestone |
| Aug 31, 2026 | California CPPA | Legislature adjourns: AB 1018 not passed; chatbot and workplace-ADS bills go to the Governor · Milestone |
| Aug 27, 2026 | APRA / ASIC | APRA and ASIC urge action on frontier AI after industry roundtables · Milestone |
| Aug 27, 2026 | HKMA | First GenA.I. Sandbox++ cohort announced · Milestone |
| Aug 20, 2026 | CFTC | Inaugural Innovation Advisory Committee meeting: 'Preparing for Intelligent Markets' · Milestone |
| Aug 5, 2026 | MAS | Parliamentary reply: AI Risk Management Guidelines to be finalised soon · Milestone |
| Aug 5, 2026 | UK (BoE / PRA / FCA) | AI Consortium June 2026 minutes published · Milestone |
| Aug 2, 2026 | EU AI Act | Article 50 transparency obligations apply; Annex III high-risk start deferred · Milestone |
| Jul 31, 2026 | UK (BoE / PRA / FCA) | 2026 BoE/FCA AI survey closes to responses · Milestone |
| Jul 31, 2026 | UK (BoE / PRA / FCA) | 2026 BoE/FCA AI survey: comment period closes · Comment deadline |
| Jul 29, 2026 | BaFin | BaFin sets out its role as AI Act market surveillance authority for financial services · Milestone |
| Jul 28, 2026 | MAS | MAS and ABS establish the AI-Driven Cyber and Technology Risk Taskforce · Milestone |
| Jul 27, 2026 | EU AI Act | Regulation (EU) 2026/1744 (Digital Omnibus on AI) takes effect · Takes effect |
| Jul 24, 2026 | RBI | Comment period on the draft Model Risk Management Guidance closes · Milestone |
| Jul 24, 2026 | RBI | RBI draft Guidance on Regulatory Principles for Model Risk Management: comment period closes · Comment deadline |
| Jul 23, 2026 | EU AI Act | Draft Commission guidelines on high-risk classification: comment period closes · Comment deadline |
| Jul 22, 2026 | FSB | Comment deadline passes on FSB AI sound-practices consultation · Milestone |
| Jul 22, 2026 | FSB | FSB AI sound practices consultation (June 2026): comment period closes · Comment deadline |
| Jul 21, 2026 | CFPB | Amended Regulation B takes effect: no disparate-impact liability under ECOA · Milestone |
| Jul 21, 2026 | CFPB | Regulation B final rule on disparate impact (April 2026) takes effect · Takes effect |
| Jul 9, 2026 | FINRA | FINRA proposes to modernize Rule 2210, citing generative AI (Regulatory Notice 26-14) · Milestone |
| Jul 3, 2026 | MAS | MAS releases SAFR white paper on safeguards for AI agents · Milestone |
| Jul 1, 2026 | APRA / ASIC | Amended CPS 230 and CPG 230 commence · Milestone |
| Jul 1, 2026 | ACPR | ACPR launches public consultation on algorithmic fairness · Milestone |
| Jul 1, 2026 | Colorado AI Act | Regulation 10-1-1: auto and health insurers' first governance report · Milestone |
| Jul 1, 2026 | White House | FTC seeks comment on a proposed policy statement on AI accuracy under EO 14365 Sec. 7 · Milestone |
| Jul 2026 | OSFI | Technology Risk Bulletin on generative and agentic AI · Milestone |
| Jun 30, 2026 | Colorado AI Act | Original SB 24-205 effective date passes without the law taking effect · Milestone |
| Jun 26, 2026 | IOSCO | Stakeholder feedback on the AI supervisory toolkit closes · Milestone |
| Jun 22, 2026 | HKMA | Report "Supporting Adoption of Artificial Intelligence in Fighting Financial Crime" · Milestone |
| Jun 19, 2026 | UK (BoE / PRA / FCA) | Data (Use and Access) Act complaints duty takes effect · Milestone |
| Jun 10, 2026 | EU AI Act | Code of Practice on marking and labelling AI-generated content published · Milestone |
| Jun 9, 2026 | FinCEN | Comment period closes on the April 2026 AML/CFT program proposal · Milestone |
| Jun 9, 2026 | FinCEN | 2026 AML/CFT Program Proposed Rule: comment period closes · Comment deadline |
| Jun 2, 2026 | HKMA | Circular on cyber resilience amid AI-empowered cyber threats · Milestone |
| Jun 2, 2026 | White House | EO 14409 directs a Treasury-led AI cybersecurity clearinghouse and extends AI cyber tools to community banks · Milestone |
| Jun 2, 2026 | U.S. Treasury | Executive Order 14409 assigns Treasury an AI cybersecurity clearinghouse · Milestone |
| May 20, 2026 | Basel Committee | Committee flags frontier AI models as a cyber-risk accelerant · Milestone |
| May 15, 2026 | Illinois IDHR | IDHR publishes proposed rules implementing the AI in employment law (First Notice) · Milestone |
| May 6, 2026 | Utah Division of Consumer Protection | HB 320 amendments to the Office of Artificial Intelligence Policy take effect · Milestone |
| Apr 30, 2026 | APRA / ASIC | APRA finalises targeted amendments to CPS 230 · Milestone |
| Apr 27, 2026 | RBI | ECL Directions for commercial banks include model-risk principles; in force 1 April 2027 · Milestone |
| Apr 27, 2026 | Colorado AI Act | AG commits not to enforce until rulemaking concludes; federal court stays xAI challenge · Milestone |
| Apr 24, 2026 | Japan FSA | FSA public-private meeting on strengthening financial-sector cybersecurity against AI threats · Milestone |
| Apr 24, 2026 | Colorado AI Act | Justice Department intervenes against Colorado's AI Act · Milestone |
| Apr 24, 2026 | White House | DOJ moves to intervene in xAI's challenge to Colorado SB 24-205 · Milestone |
| Apr 17, 2026 | NIST | US model-risk revision amplifies the RMF's role · Milestone |
| Apr 17, 2026 | FinCEN | 2021 BSA/AML model risk statement rescinded · Milestone |
| Apr 17, 2026 | NCUA | NCUA sits out the revised interagency model risk management guidance · Milestone |
| Apr 10, 2026 | RBI | RBI adopts Utkarsh 2029 medium-term strategy framework · Milestone |
| Apr 2026 | MAS | MAS advisory to FIs on frontier AI cyber threats · Milestone |
| Apr 2026 | OSFI | Technology Risk Bulletin on frontier AI · Milestone |
| Apr 2026 | DNB / AFM | AFM publishes report on AI in the Dutch asset management sector · Milestone |
| Mar 24, 2026 | CFTC | Innovation Task Force formed with an AI and autonomous systems workstream · Milestone |
| Mar 20, 2026 | White House | White House publishes legislative recommendations for a national AI policy framework · Milestone |
| Mar 9, 2026 | NIST | CAISI RFI on AI agent security (2026): comment period closes · Comment deadline |
| Feb 18, 2026 | U.S. Treasury | Treasury announces completion of the AIEOG public-private AI initiative · Milestone |
| Feb 5, 2026 | UK (BoE / PRA / FCA) | Data (Use and Access) Act 2025 takes effect · Takes effect |
| Jan 31, 2026 | MAS | Consultation on proposed AI Risk Management Guidelines closes · Milestone |
| Jan 31, 2026 | MAS | MAS Consultation Paper P017-2025 (AI Risk Management Guidelines): comment period closes · Comment deadline |
| Jan 30, 2026 | NIST | NIST IR 8596 (Cyber AI Profile): comment period closes · Comment deadline |
| Jan 27, 2026 | FINRA | FINRA blog publishes observations on AI agents · Milestone |
| Jan 19, 2026 | DNB / AFM | AFM Agenda 2026 expands AI supervision · Milestone |
| Jan 12, 2026 | CFTC | Technology Advisory Committee renamed Innovation Advisory Committee · Milestone |
| Jan 9, 2026 | White House | DOJ establishes the AI Litigation Task Force · Milestone |
| Jan 1, 2026 | California CPPA | CPPA regulations on ADMT, risk assessments and cybersecurity audits take effect · Milestone |
| Jan 1, 2026 | Illinois IDHR | Illinois HB 3773 (P.A. 103-0804) takes effect · Takes effect |
| Jan 1, 2026 | Texas AG | Texas TRAIGA (HB 149) takes effect · Takes effect |
| Jan 1, 2026 | California CPPA | California SB 53 (Transparency in Frontier AI Act) takes effect · Takes effect |
| Jan 1, 2026 | EBA | EBA Work Programme 2026 takes effect · Takes effect |
| Jan 1, 2026 | ECB | SSM supervisory priorities 2026–28 takes effect · Takes effect |
| Jan 1, 2026 | California CPPA | CPPA ADMT, risk-assessment and cybersecurity-audit regulations takes effect · Takes effect |
Common questions
What are the next AI regulation deadlines for banks?
The next dated deadlines are: Oct 20, 2026 — CFTC: CFTC Compute Derivatives RFC: comment period closes; Oct 26, 2026 — Colorado AI Act: Colorado AG proposed ADMT rules: comment period closes; Oct 31, 2026 — ECB: Deadline for significant institutions to submit AI-cyber action plans to their JSTs. The full calendar through 2028 is maintained on this page and at /ai-regulation/deadlines.
Do US banks face binding AI compliance deadlines?
At the federal level, no — US bank AI is governed through supervisory guidance (the April 2026 revised model risk management guidance) and existing statutes like ECOA and the FCRA, which carry no AI-specific dates. The binding dated obligations come from states and the EU: Colorado's Automated Decision-Making Technology Act takes effect January 1, 2027 and its Chatbot Safety Act (in force since August 12, 2026) applies its operator duties from January 1, 2027, New York DFS applies its Part 500 cybersecurity regulation to AI threats now, and the EU AI Act's high-risk regime reaches EU credit-scoring operations on December 2, 2027.
When does the EU AI Act apply to bank credit scoring?
December 2, 2027. The original date was August 2, 2026, but the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force July 27, 2026) deferred stand-alone Annex III high-risk systems — which include credit scoring of natural persons — to December 2, 2027, and AI embedded in regulated products to August 2, 2028. Article 50 transparency duties have applied since August 2, 2026.
What should a bank compliance team do before the end of 2026?
Four concrete items: file the AI-cybersecurity action plan the ECB requires from significant euro-area institutions by October 31, 2026 (SSM-2026-0301, if in scope); map models against the revised interagency model risk management guidance in force since April 17, 2026; review adverse-action notice processes against the Regulation B rule effective July 21, 2026; and prepare for Colorado's ADMT Act taking effect January 1, 2027 — the state rulemaking finishes in late 2026.
Navigate
New obligations land in the brief first
when one of these regulators moves, the next morning's brief says so · six sourced stories · 7 am ET · free
plus every tracker, bank and agent page update, the morning after · leave any morning