Agent Index by Heritage Services
Submit / Claim
AI
Agent Index by Heritage Services
theagentindex.io/guides/compliance-deadlines/ · Last reviewed 27 Oct 2026

Agent Index by Heritage Services · theagentindex.io/guides/compliance-deadlines/ · Not legal or audit advice · CC BY 4.0
Home / Guides / Compliance deadlines

Free guide · Calendar · 27 Oct 2026

GRC & AI compliance deadlines and surveillance calendar (2025–2028)

Fixed statutory and standard dates first, then recurring annual surveillance and quarterly GRC planning windows. Every row links to a primary source. Not a ranking. Not legal advice.

Last reviewed 27 Oct 202630 dated items

Download .ics calendar Check an auditor

General information, not legal advice. Confirm scope with your counsel or auditor. Recurring rows are planning reminders. Confirm your actual ROC, surveillance or Type II observation dates with your assessor.

ISO/IEC 27001 & 42001

31 Oct 2025 · Fixed standard / scheme date

ISO/IEC 27001:2022 transition completed

IAF transition from ISO/IEC 27001:2013 to ISO/IEC 27001:2022 ends 31 October 2025. Certificates to the 2013 edition are not valid after this date. 2026–2027 work is annual surveillance and the three-year recertification cycle, plus optional ISO/IEC 42001 AI management-system adoption. [1] [2] [3]

31 Oct 2026 · Recurring / planning cycle

ISO/IEC 27001 / 42001 annual surveillance milestone (2026)

First full surveillance year after the 2022-edition transition. ISO/IEC 17021-1 requires surveillance in each calendar year; recertification is typically on a three-year cycle. Also a planning marker for ISO/IEC 42001 adoption. [1] [3]

31 Oct 2027 · Recurring / planning cycle

ISO/IEC 27001 / 42001 annual surveillance / recertification window (2027)

2027 surveillance or three-year recertification planning marker after the 31 October 2025 transition. [1] [3]

PCI DSS v4.0.1

31 Mar 2025 · Fixed standard / scheme date

PCI DSS v4.0.1 future-dated requirements become mandatory

All 51 future-dated PCI DSS v4.0.1 controls that were published as future-dated become effective. Entities that validate PCI DSS after this date must address the full v4.0.1 control set in the ROC or SAQ. [4] [5]

31 Mar 2026 · Recurring / planning cycle

PCI DSS annual ROC / SAQ validation cycle (2026)

Typical annual PCI DSS assessment anniversary after the 31 March 2025 future-dated cutover. Confirm your entity’s actual ROC/SAQ date with the QSA or ISA. [5]

31 Mar 2027 · Recurring / planning cycle

PCI DSS annual ROC / SAQ validation cycle (2027)

Typical 2027 annual PCI DSS assessment anniversary. Confirm your actual ROC/SAQ date with the QSA or ISA. [5]

DORA

17 Jan 2025 · Fixed statutory date

EU DORA applies (Regulation (EU) 2022/2554)

The Digital Operational Resilience Act applies to in-scope EU financial entities and their critical ICT third-party providers. Ongoing Register of Information submissions, ICT third-party risk reviews and threat-led penetration testing (TLPT) cycles continue through 2026–2027. [6] [7]

17 Jan 2026 · Recurring / planning cycle

DORA: annual Register of Information / ICT third-party review window

Recurring 2026 planning window for Register of Information updates, ICT third-party risk reviews and TLPT scoping under DORA. Confirm current ESA / national-competent-authority filing dates. [6] [7]

17 Jan 2027 · Recurring / planning cycle

DORA: annual Register of Information / ICT third-party review window (2027)

Recurring 2027 planning window for DORA Register of Information, ICT third-party reviews and TLPT cycles. [6] [7]

EU AI Act

Full sourced timeline after the Digital Omnibus: EU AI Act timeline 2026. High-risk Annex III rules apply 2 Dec 2027; Annex I product rules apply 2 Aug 2028.

2 Feb 2025 · Fixed statutory date

EU AI Act: prohibited AI practices and AI literacy (Chapters I & II)

Article 113: Chapters I and II apply from 2 February 2025 — prohibited AI practices and AI-literacy obligations. [8] [9] [10]

2 Aug 2025 · Fixed statutory date

EU AI Act: general-purpose AI (GPAI) model obligations (Chapter V)

Article 113: Chapter V (GPAI models) and related governance obligations apply from 2 August 2025, 12 months after entry into force. [8] [9] [10]

2 Aug 2026 · Fixed statutory date

EU AI Act: most rules apply + Art. 50 transparency + enforcement starts

Most AI Act rules apply from 2 August 2026, including Article 50 transparency. Enforcement starts at national and EU level for GPAI, prohibitions, transparency and AI literacy. High-risk Chapter III Sections 1–3 no longer apply on this date (Regulation (EU) 2026/1744). See /guides/eu-ai-act-timeline/. [10] [9] [11]

2 Dec 2026 · Fixed statutory date

EU AI Act: new Art. 5 prohibitions + Art. 50(2) transition

New Article 5(1)(ba)/(bb) prohibitions (AI that generates non-consensual intimate material or child sexual abuse material) apply. Providers of generative AI systems placed on the market before 2 August 2026 must comply with Article 50(2) marking (new Art. 111(4)). [10] [11]

2 Aug 2027 · Fixed statutory date

EU AI Act: legacy GPAI models and national sandboxes

Providers of GPAI models placed on the market before 2 August 2025 must comply (Art. 111(3)); at least one national AI regulatory sandbox per Member State operational (amended Art. 57(1)); Commission delegated acts under new Art. 2(13) due. [10] [11]

2 Dec 2027 · Fixed statutory date

EU AI Act: high-risk rules for Annex III systems

High-risk rules (Chapter III Sections 1–3) apply for Annex III systems (biometrics, critical infrastructure, education, employment, migration/asylum/border, etc.). [10] [9] [11]

2 Aug 2028 · Fixed statutory date

EU AI Act: high-risk rules for AI in Annex I regulated products

High-risk rules apply for AI in products under Annex I (e.g. lifts, toys, machinery). Regulation (EU) 2026/1744 moved this date from 2 August 2027. See /guides/eu-ai-act-timeline/. [10] [9] [11]

CMMC 2.0

Phase 2 is suspended (13 July 2026). Phase 3 is unconfirmed. Do not treat 10 Nov 2026 or 10 Nov 2027 as scheduled start dates.

10 Nov 2025 · Fixed statutory date

CMMC Phase 1: Level 1 and Level 2 self-assessments in DoD solicitations

32 CFR Part 170 phased rollout. Phase 1 began 10 November 2025 and introduces CMMC Level 1 and Level 2 self-assessment requirements in applicable DoD solicitations (DFARS 252.204-7021). Phase 2 (originally 10 Nov 2026) is suspended as of 13 July 2026. [12] [13] [15]

10 Nov 2026 · Fixed statutory date

CMMC Phase 2 (suspended): C3PAO Level 2 certification in DoD solicitations

On 13 July 2026 the Department of War suspended CMMC Phase II (originally 10 Nov 2026); during the suspension solicitations may only require Level 1 (Self) or Level 2 (Self); NIST SP 800-171 Rev 2 and DFARS 252.204-7012 still apply. [13] [14] [12] [15]

10 Nov 2027 · Fixed statutory date

CMMC Phase 3 (suspended, date unconfirmed): broader Level 2 / Level 3 requirements

The CMMC phased schedule is suspended and the 10 November 2027 Phase 3 date is unconfirmed. Do not treat this as scheduled. On 13 July 2026 the Department of War suspended CMMC Phase II; during the suspension solicitations may only require Level 1 (Self) or Level 2 (Self). [13] [14] [12]

India DPDP & CERT-In

13 Nov 2026 · Fixed statutory date

India DPDP Rule 4 in force (Consent Manager registration)

DPDP Rules, 2025 (G.S.R. 846(E), rule 1(3)): Rule 4 (Consent Manager registration with the Data Protection Board) comes into force one year after publication of the Gazette of 13 November 2025, i.e. 13 November 2026. This calendar does not claim that the Board has opened applications. [17] [16]

13 May 2027 · Fixed statutory date

India DPDP Act: remaining Rules duties (18 months after 13 Nov 2025)

DPDP Rules, 2025 (G.S.R. 846(E), rule 1(4)): Rules 3, 5–16, 22 and 23 come into force 18 months after publication of the Gazette of 13 November 2025, i.e. 13 May 2027 (notice, security, breach, retention and other Data Fiduciary duties). Rule 4 (Consent Manager registration) is earlier — 13 November 2026. This calendar does not claim that the Data Protection Board has opened applications. CERT-In’s 6-hour incident-reporting Direction (28 April 2022) already applies. [16] [17] [18]

NIS2 Directive

17 Oct 2024 · Fixed statutory date

NIS2 national transposition, registration and supply-chain audits

Directive (EU) 2022/2555 required Member State transposition by 17 October 2024. 2025–2027 work is national transposition and essential/important-entity registration, incident reporting, and supply-chain security audits. Several Member States missed the original date — confirm your national law. [19] [20]

Annual SOC 2 / HITRUST / FedRAMP windows

15 Jan 2026 · Recurring / planning cycle

2026 Q1 GRC / SOC 2 Type II observation-period planning

Planning reminder for SOC 2 Type II observation periods, HITRUST validated assessments, and FedRAMP continuous monitoring / 3PAO scheduling. Not a statutory deadline — align to your report period and authorizing official. [21] [22] [23]

15 Apr 2026 · Recurring / planning cycle

2026 Q2 GRC / HITRUST / FedRAMP continuous-monitoring review

Planning reminder for SOC 2 Type II observation periods, HITRUST validated assessments, and FedRAMP continuous monitoring / 3PAO scheduling. Not a statutory deadline — align to your report period and authorizing official. [21] [22] [23]

15 Jul 2026 · Recurring / planning cycle

2026 Q3 GRC / 3PAO and CPA scheduling window

Planning reminder for SOC 2 Type II observation periods, HITRUST validated assessments, and FedRAMP continuous monitoring / 3PAO scheduling. Not a statutory deadline — align to your report period and authorizing official. [21] [22] [23]

15 Oct 2026 · Recurring / planning cycle

2026 Q4 GRC / Type II evidence close and renewal planning

Planning reminder for SOC 2 Type II observation periods, HITRUST validated assessments, and FedRAMP continuous monitoring / 3PAO scheduling. Not a statutory deadline — align to your report period and authorizing official. [21] [22] [23]

15 Jan 2027 · Recurring / planning cycle

2027 Q1 GRC / SOC 2 Type II observation-period planning

Planning reminder for SOC 2 Type II observation periods, HITRUST validated assessments, and FedRAMP continuous monitoring / 3PAO scheduling. Not a statutory deadline — align to your report period and authorizing official. [21] [22] [23]

15 Apr 2027 · Recurring / planning cycle

2027 Q2 GRC / HITRUST / FedRAMP continuous-monitoring review

Planning reminder for SOC 2 Type II observation periods, HITRUST validated assessments, and FedRAMP continuous monitoring / 3PAO scheduling. Not a statutory deadline — align to your report period and authorizing official. [21] [22] [23]

15 Jul 2027 · Recurring / planning cycle

2027 Q3 GRC / 3PAO and CPA scheduling window

Planning reminder for SOC 2 Type II observation periods, HITRUST validated assessments, and FedRAMP continuous monitoring / 3PAO scheduling. Not a statutory deadline — align to your report period and authorizing official. [21] [22] [23]

15 Oct 2027 · Recurring / planning cycle

2027 Q4 GRC / Type II evidence close and renewal planning

Planning reminder for SOC 2 Type II observation periods, HITRUST validated assessments, and FedRAMP continuous monitoring / 3PAO scheduling. Not a statutory deadline — align to your report period and authorizing official. [21] [22] [23]

Get 30-day email reminders before major GRC deadlines

Free. We email the weekly Agent Index Brief and a 30-day heads-up before the fixed statutory and standard dates above. Subscribing also unlocks the .ics download. The open dataset (CC BY 4.0) is free to download with no sign-up.

Sources

  1. ISO — ISO/IEC 27001:2022
  2. IAF — ISO/IEC 27001:2022 transition (ends 31 Oct 2025)
  3. ISO — ISO/IEC 42001 AI management system
  4. PCI SSC — PCI DSS v4.0.1 publication
  5. PCI SSC — PCI DSS v4.0.1 future-dated requirements (31 March 2025)
  6. EUR-Lex — Regulation (EU) 2022/2554 (DORA)
  7. EIOPA — Digital Operational Resilience Act (DORA)
  8. EUR-Lex — Regulation (EU) 2024/1689 (EU AI Act)
  9. European Commission — AI Act regulatory framework
  10. European Commission — AI Act Service Desk timeline
  11. EUR-Lex — Regulation (EU) 2026/1744 (Digital Omnibus on AI)
  12. eCFR — 32 CFR Part 170 (CMMC Program)
  13. DoD CIO — About CMMC
  14. USW(A&S) — Implementing the Suspension of CMMC Phase II (13 July 2026)
  15. Acquisition.gov — DFARS 252.204-7021
  16. MeitY — Digital Personal Data Protection Act, 2023
  17. MeitY — Digital Personal Data Protection Rules, 2025
  18. CERT-In Directions, 28 April 2022 (6-hour incident reporting)
  19. EUR-Lex — Directive (EU) 2022/2555 (NIS2)
  20. European Commission — NIS2 Directive
  21. AICPA — 2017 Trust Services Criteria
  22. HITRUST — Authorized External Assessor list
  23. FedRAMP — Marketplace assessors (3PAO)

Related tools: Check an Auditor · EU AI Act timeline · Which framework · Audit-prep templates · Open dataset, search API and MCP.

NIS2 note: Directive (EU) 2022/2555 required Member State transposition by 17 October 2024. 2025–2027 work is national transposition and essential/important-entity registration, incident reporting, and supply-chain security audits. Several Member States missed the original date — confirm your national law.