AI Regulation Outlook 2027
What changed in 2026, and how to get ready
Deadlines moved in 2026, but obligations did not disappear. A 30-page briefing on the EU AI Omnibus, the US state laws, India's synthetic content rules and the DPDP Act, with one compliance calendar to 2029 and a 90-day plan.
- EU AI Omnibus
- Colorado SB 26-189
- California's 2026 AI package
- India's synthetic content rules
- DPDP Act and AI
The figures that defined the year
- 16 monthsadded to the EU deadline for stand-alone high-risk AI, now 2 December 2027
- 3 hrsfor Indian intermediaries to act on a court order or government notice, down from 36
- €35mor 7% of global turnover: the top EU AI Act fine for prohibited practices
- 13 May 2027the date India's core DPDP obligations apply to every business
Organised the way questions arrive in practice
Which laws apply to the AI you build or use, what is enforceable today versus still on paper, and which single set of controls gets you furthest across all of them.
- 00
The short version
2026 in numbers · Where the world stands
- 01
The 2026 reset: delay is not deregulation
The United States: federal pressure, state persistence
- 02
Comprehensive AI laws
EU AI Act after the Omnibus · Asia-Pacific · The Americas · Horizontal laws compared
- 03
Rules by use case
Employment and HR tech · Financial services · Chatbots and disclosure · Deepfakes and provenance · Frontier models
- 04
India spotlight
Synthetic content under the IT Rules · Where the DPDP Act meets AI
- 05
International cooperation and standards
ISO/IEC 42001 · NIST AI RMF · Council of Europe
- 06
Compliance calendar 2026 to 2029
Every date that moved this year
- 07
One control set, many laws
Eleven core controls mapped across seven regimes
- 08
Your 90-day plan and maturity model
Ten questions boards should ask · Our outlook for 2027
Six things a busy leader should take away
- 1
Deadlines moved, obligations did not disappear
The EU pushed its high-risk rules to December 2027 and August 2028, Colorado reset to January 2027 and Korea paused fines for a year. The substance survived every delay.
- 2
Transparency is the first duty to bite
Chatbot disclosure, deepfake labelling and machine-readable marking are live or imminent in the EU, India, China, Korea, Vietnam and several US states.
- 3
The US is a state-by-state map, for now
Federal preemption has been pushed but not passed. State laws stay in force as written until a court, Congress or the state itself says otherwise.
- 4
India regulates AI through existing law
No standalone AI Act, but the IT Rules now cover synthetic media with two to three hour takedowns, and the DPDP Act's main duties land in May 2027.
- 5
One control set covers most of the ground
Inventory, risk classification, impact assessment, notice, human oversight, logging, testing and incident response appear in nearly every regime.
- 6
Start with what you cannot see
Most organisations cannot list every AI system, model and agent they run, including those inside SaaS tools. An inventory is the cheapest first step.
Status boards, calendars and maps you can act on
The short version
Where the world stands
Compliance calendar to 2029
- CISOs
- CIOs
- Risk and compliance leads
- Product owners
- Boards
Turn 2026’s churn into a plan
Get the full 30-page briefing, free. Or talk to us and we’ll tell you which rules reach you and what to do first.
General information for awareness and planning, not legal advice. Laws in this area change quickly; confirm the current position before acting.