We distinguish between confirmed timelines – statutory effective dates, published standards, and announced regulatory actions – and expected or anticipated developments. Where uncertainty exists, it is stated plainly.
EU AI Act: Confirmed Milestones
The EU AI Act implementation timeline provides the following confirmed compliance milestones:
| Milestone | Confirmed Date |
| Prohibitions on unacceptable-risk AI systems apply | 2 February 2025 – Confirmed, in force |
| AI literacy obligation (Article 4) applies | 2 February 2025 – Confirmed, in force |
| GPAI model obligations, governance provisions, and penalty framework apply | 2 August 2025 – Confirmed |
| Full high-risk system obligations apply (Annex III systems) | 2 August 2026 – Confirmed |
| High-risk AI systems integrated into large-scale EU IT systems must comply | 31 December 2030 – Confirmed |
Organizations with EU market exposure should treat the August 2026 deadline as the primary compliance target for any AI system used in credit scoring, employment, education, healthcare, or law enforcement in the EU.
New ISO/IEC Standards: Published
ISO/IEC 42005:2025, Information Technology – Artificial Intelligence – AI System Impact Assessment, was published in May 2025. It provides a structured methodology for assessing the impacts of AI systems on individuals, organizations, and society – equivalent in purpose to the Algorithmic Impact Assessment tool used in Canada’s federal government, but now available as an internationally recognized standard applicable to any sector and any jurisdiction.
ISO/IEC 42006:2025, Information Technology – Artificial Intelligence – Requirements for Bodies Providing Audit and Certification of Artificial Intelligence Management Systems, was published July 7, 2025. It establishes the requirements for certification bodies that audit and certify AI management systems against ISO/IEC 42001. Its publication means that accredited third-party AI governance audits are now a viable, credentialed service – enabling organizations to obtain externally verified assurance of their AI governance programs.
OSFI Guideline E-23: Confirmed
OSFI Guideline E-23 takes effect May 1, 2027, following an 18-month transition period from its September 2025 publication. All FRFIs – banks, federal credit unions, insurance companies, trust companies – must have enterprise-wide model risk management frameworks meeting the Guideline’s requirements by that date. The 18-month window is not a grace period to begin planning – it is a transition period for organizations that have already begun assessing their gaps. Organizations that start their gap assessment in late 2026 will not complete implementation by May 2027.
Colorado AI Act: Confirmed, Delayed
Colorado’s SB 24-205 was originally set to take effect February 1, 2026. As Clark Hill’s analysis reports, Colorado Governor Jared Polis signed SB 25B-004 on August 28, 2025, delaying the effective date to June 30, 2026. The Colorado legislature has the 2026 regular session to negotiate further amendments. Absent further legislative action, the original law – requiring developers and deployers of high-risk AI systems to conduct impact assessments, provide consumer notices and explanations, offer opportunities to correct data, and publish public risk management statements – takes effect June 30, 2026. Organizations that comply with the NIST AI RMF receive a rebuttable presumption of reasonable care.
US State AI Law Trajectory: Confirmed and Expected
Texas’s TRAIGA took effect January 1, 2026 – a narrowly scoped law prohibiting intentional AI-enabled discrimination and social scoring. It does not impose impact assessment or transparency obligations comparable to Colorado’s.
The Trump administration’s December 2025 executive order establishing an AI Litigation Task Force creates direct legal pressure on state AI laws that conflict with the administration’s deregulatory posture. This creates significant legal uncertainty for state-level AI legislation – the constitutional authority to preempt state consumer protection laws in this manner is contested, and litigation is expected. Organizations operating across multiple U.S. states should monitor both the state legislative landscape and the preemption litigation closely.
Canadian Federal Direction: Confirmed Facts Only
What is confirmed: AIDA died on the Order Paper on January 6, 2025. Minister Evan Solomon has stated that AIDA as drafted will not return, and that the government prefers a “light, tight, right” approach. As the Schwartz Reisman Institute’s analysis concludes, Canada is unlikely to pass comprehensive federal AI legislation for the next several years, and there is no published timeline for new legislation. What is expected but not confirmed: some AI-related provisions may be incorporated into future digital governance legislation, and provincial legislation – particularly Ontario’s Bill 194 for the public sector – will continue to develop. Practitioners should treat the ISED Voluntary Code and OSFI Guideline E-23 as the operative federal frameworks for the foreseeable future, and monitor provincial developments closely.
NIST AI RMF Evolution: Ongoing
NIST continues to develop the AI RMF ecosystem. The Generative AI Profile (NIST AI 600-1, published July 2024) addressed unique risks from large language models and generative systems. According to I.S. Partners’ 2025-2026 update analysis, NIST’s updated guidance emphasizes generative AI governance – including managing hallucinations, preventing data leakage, and establishing human oversight mechanisms – as well as strengthened supply chain and third-party AI risk management guidance, including model provenance and traceability. Organizations should treat NIST guidance as a living document and monitor the NIST AI Resource Center for new profiles and playbooks as they are released.
