On This Page
- Recent regulatory changes: SMB compliance deadlines for 2027
- AI governance: prepare for decisions that receive closer scrutiny
- Data privacy: identify the work behind the deadline
- Cybersecurity: separate recurring filings from new product requirements
- How should an SMB organize its 2027 preparation?
- Frequently Asked Questions
- Preparing for 2027? See where your company stands.
Preparing for 2027?
Our free 8-minute TPS Snapshot highlights risk areas and your top gap based on how your business handles data, AI, and security today.
Get your free TPS SnapshotUpdated October 26, 2026. A planning guide to selected U.S. and EU developments in AI governance, data privacy, and cybersecurity.
Aetos provides nonlegal compliance consulting. This article summarizes public regulatory information for general education and operational planning. The author is not a lawyer. It does not determine which laws apply to a particular business. Consult qualified legal counsel about applicability, exemptions, and legal obligations.
Several dates deserve attention, including California’s automated decisionmaking requirements, Oklahoma’s new consumer privacy law, and EU requirements affecting certain AI systems and digital products.
The practical task is to connect those developments to your business’s technology, data, and operating processes. A useful calendar records the official source, potential relevance, legal-review status, operational owner, and preparation tasks.
Recent regulatory changes: SMB compliance deadlines for 2027
| Date | Development | Businesses that should flag it for review |
|---|---|---|
| January 1, 2027 | California’s automated decisionmaking technology requirements begin. | CCPA-covered businesses using qualifying technology to make significant decisions. California Privacy Protection Agency |
| January 1, 2027 | Oklahoma’s comprehensive consumer privacy law takes effect. | Businesses operating in Oklahoma or targeting its residents that meet the law’s processing thresholds. Oklahoma SB 546 |
| April 15, 2027 | Annual cybersecurity compliance notification concerning 2026 is due. | Entities covered by New York’s financial services cybersecurity regulation, subject to specified full exemptions. This is a recurring filing. NYDFS submission requirements |
| July 1, 2027 | California’s restrictions on automated disciplinary and termination decisions become operative. | Employers using automated decision systems for covered employment decisions. California State Senate |
| December 2, 2027 | EU AI Act requirements begin applying to covered Annex III high-risk AI systems under the revised timetable. | Businesses with relevant AI activities connected to the EU market, subject to applicable transition provisions. European Commission timeline update |
| December 11, 2027 | The EU Cyber Resilience Act’s main obligations apply. | Businesses placing covered digital products on the EU market, subject to product scope and transition provisions. European Commission CRA overview |
| December 31, 2027 | California’s transition deadline for certain existing processing risk assessments arrives. | Covered businesses continuing qualifying processing initiated before January 1, 2026. CCPA regulations, §7155 |
This calendar covers selected U.S. and EU developments. Businesses serving the UK or other markets should also arrange a review of the requirements relevant to those markets.
AI governance: prepare for decisions that receive closer scrutiny
For the broader foundations, see our guide to AI governance principles for business leaders. For 2027 planning, concentrate on the following changes.
California’s automated decisionmaking requirements
California’s finalized CCPA regulations address qualifying automated decisionmaking technology used for significant decisions. They include pre-use notices, access rights, and opt-out rights, with specified exceptions. The definition concerns technology that replaces or substantially replaces human decisionmaking. Final CCPA regulations
Use the CPPA’s published criteria to flag potential coverage for legal review. CCPA coverage involves revenue, data-handling, and revenue-from-data thresholds, along with additional provisions affecting related entities and service providers. CPPA applicability FAQ
For background, our CCPA and CPRA guide for growing businesses explains the basic framework.
Operational preparation: Identify potentially relevant systems, collect vendor documentation, and record how notices, requests, and human review currently work.
California’s workplace AI restrictions
A separate California law, SB 947, becomes operative on July 1, 2027. It prohibits employers from relying solely on an automated decision system for disciplinary or termination decisions. When employers rely primarily on such a system, a human must corroborate the decision using relevant information. California State Senate’s explanation
Operational preparation: Review automated performance scores, attendance flags, and disciplinary recommendations. Document who examines the underlying evidence and who can change a proposed outcome.
The EU AI Act’s revised timetable
The EU AI Act can reach organizations outside Europe that place covered AI systems or models on its market, or put systems into service or use them in the EU. Providers and deployers have different responsibilities. European Commission AI Act FAQ
The 2026 AI Omnibus changes set December 2, 2027 as the application date for Annex III high-risk requirements. The timetable for high-risk AI embedded in regulated products extends to August 2, 2028. European Commission’s revised timetable
Operational preparation: Record intended uses, deployment locations, vendor documentation, and your organization’s role. Have the relevant classification and deadline confirmed before building an implementation plan around them.
Data privacy: identify the work behind the deadline
Two developments are especially useful to flag for 2027 review.
Oklahoma’s privacy law takes effect in January
Oklahoma’s new law generally covers businesses operating in the state or targeting its residents that process personal data of:
- At least 100,000 consumers during a calendar year; or
- At least 25,000 consumers, while deriving over 50% of gross revenue from selling personal data.
The law includes consumer rights, privacy notices, reasonable security requirements, and consent requirements for sensitive data. Exemptions apply, and its consumer definition excludes commercial and employment contexts. Oklahoma SB 546
Operational preparation: Gather relevant processing volumes and data-flow information for a coverage review. Where implementation is needed, test how requests move between your business and its vendors.
California’s existing-processing assessment deadline arrives in December
December 31, 2027 is a transition deadline for qualifying processing that began before January 1, 2026 and continues afterward. New covered processing generally requires an assessment before it begins. Initial assessment attestations and summary information are due April 1, 2028. CCPA regulations, §§7155–7157
Operational preparation: Separate existing processing activities from new projects. Record assessment status, missing information, responsible owners, and review dates.
Cybersecurity: separate recurring filings from new product requirements
New York’s annual cybersecurity notification
For businesses covered by New York’s financial services cybersecurity regulation, April 15, 2027 is the annual notification deadline concerning compliance during 2026. Limited exemptions do not necessarily eliminate this filing; specified full exemptions do. NYDFS annual notification guidance
Operational preparation: Confirm filing responsibilities and assemble the supporting records early enough for appropriate review and approval.
The EU Cyber Resilience Act
For businesses selling covered software or connected hardware into Europe, December 11, 2027 is a major product-security milestone. The Cyber Resilience Act introduces requirements addressing product cybersecurity, vulnerability handling, and conformity assessment. European Commission CRA overview
Products placed on the market before that date generally become subject to the main requirements only if subsequently substantially modified. Product scope and associated remote processing also require attention. Commission’s legislative summary
Manufacturers should also recognize that reporting obligations for actively exploited vulnerabilities and severe product-security incidents began on September 11, 2026. ENISA reporting platform announcement
Operational preparation: Gather product inventories, vulnerability-management records, update commitments, and technical documentation. Assign owners for any preparation identified through the scope review.
How should an SMB organize its 2027 preparation?
- Official source: The regulator’s guidance or published legal text.
- Relevant date: Distinguish effective dates, compliance dates, and filing deadlines.
- Potential relevance: The business activity, product, or processing that prompted review.
- Legal-review status: Record confirmed conclusions and unresolved questions.
- Operational owner: Name the person coordinating implementation.
- Preparation tasks and records: Track changes, testing, approvals, and supporting documentation.
This calendar can sit alongside your broader operating roadmap. Our Startup Trust and Compliance Timeline organizes preparation around business milestones such as launch, enterprise procurement, and expansion.
Frequently Asked Questions
Preparing for 2027? See where your company stands.
A deadline calendar tells you what is approaching. Your next step is understanding where your current practices need attention.
Aetos’s free TPS Snapshot takes about eight minutes and gives you an immediate view of risk areas and your top gap based on how your business operates today. Use it to start a practical conversation about priorities, ownership, and preparation.
