| Activity | When | Who leads | Evidence |
|---|
| AI Governance Board regular meeting (special sessions within 3 business days of any pause or escalated incident) | Monthly | AI Accountability Leader (chair) | 07_governance_records: minutes, decision log |
| Reconcile the six inventory feeds and classify new entries, suspected High uses first | Weekly, with a monthly summary to the board | Inventory team | 01_inventory |
| Outcome and error monitoring for High uses | Monthly or quarterly, as set in each system's monitoring plan | Business owner, with data science | 06_monitoring_and_incidents |
| Review open exceptions, open pauses, and overdue conditions | Monthly | AI Accountability Leader | 07_governance_records: exceptions register |
| Activity | When | Who leads | Evidence |
|---|
| Confirm compliance with laws that took effect January 1 (many state laws start on this date) | First two weeks of January | Counsel, with the AI Accountability Leader | 07_governance_records: legal change log |
| Quarterly business owner attestation that every use entry is current | January | Business owners | 01_inventory: signed attestations |
| Quarterly review of every High use and every agent with write access | January to February | AI Accountability Leader | 03_systems; 05_vendors_and_security |
| Quarterly AI report to the board committee (the five map numbers, log readiness, open pauses) | February | AI Accountability Leader | 07_governance_records: board papers |
| Annual review of the AI policy, the acceptable use policy, and the classification rubric against new law | February to March | AI Accountability Leader, with counsel | 02_policies: version history |
| Annual AI literacy and acceptable use training refresh for all staff, and role-based training for reviewers and agent owners | Launch in Q1, complete by the end of Q2 | HR and learning, with the AI Accountability Leader | 07_governance_records: training records |
| Review AI claims and AI risk disclosures in the annual report, marketing, and investor materials (public companies and regulated firms) | Before the annual report is filed | Counsel and the disclosure committee | 02_policies: claims register |
| Prepare California risk assessment summaries for the April 1 submission (from 2028) | February to March | Privacy office, with counsel | 03_systems: risk assessments |
| Activity | When | Who leads | Evidence |
|---|
| California submission of risk assessment information to the CPPA. The first submission, for assessments done in 2026 and 2027, is due April 1, 2028, and then each April 1 | April 1 | Privacy office | 03_systems: submission receipt |
| California cybersecurity audit certification, phased by revenue: April 1, 2028 (over $100 million), April 1, 2029 ($50 to $100 million), April 1, 2030 (under $50 million) | April 1 of the applicable year | Chief Information Security Officer | 05_vendors_and_security |
| Quarterly business owner attestation | April | Business owners | 01_inventory |
| Quarterly AI report to the board committee | May | AI Accountability Leader | 07_governance_records |
| Annual bias testing for High hiring and promotion tools, and the NYC Local Law 144 independent bias audit (must be no more than one year old at the time of use, with a public summary). Schedule it ahead of each tool's anniversary, not by quarter | At least yearly; Q2 in this example | HR, with an independent auditor | 03_systems: test results; published summary |
| Track state legislative sessions as they close and log new AI bills signed into law (many legislatures adjourn in the spring) | April to June | Counsel | 07_governance_records: legal change log |
| Mid-year incident response tabletop exercise, including an Agentic AI scenario | June | AI Accountability Leader, with security | 06_monitoring_and_incidents |
| Activity | When | Who leads | Evidence |
|---|
| Quarterly business owner attestation | July | Business owners | 01_inventory |
| EU AI Act date check. August 2 is a recurring EU milestone: transparency duties applied from August 2, 2026, and Annex I product rules apply from August 2, 2028 | July, ahead of August 2 | Counsel | 07_governance_records: legal change log |
| Annual vendor AI feature questionnaire: ask every vendor of an inventoried system to list the AI features added in the past year | July to August | Procurement, with the AI Accountability Leader | 05_vendors_and_security |
| Quarterly AI report to the board committee | August | AI Accountability Leader | 07_governance_records |
| Annual review of every Minimal and Limited use | August to September | Inventory team, with business owners | 01_inventory |
| Annual internal audit of the AI governance program, using the Audit Guide (and, for certified organizations, the ISO/IEC 42001 surveillance audit) | September, or as your audit plan sets | Internal audit | 07_governance_records: audit reports |
| Activity | When | Who leads | Evidence |
|---|
| Quarterly business owner attestation | October | Business owners | 01_inventory |
| Targeted re-classification before the year-end and January 1 legal dates | October to November | Inventory team, with counsel | 01_inventory: classification records |
| EU December 2 deadlines: new prohibitions and the deadline for legacy synthetic-content marking (December 2, 2026); Annex III high-risk rules, including fundamental rights impact assessments where required (December 2, 2027) | Before December 2 of the applicable year | Counsel and system owners | 03_systems; 07_governance_records |
| California risk assessments for ADMT and other processing already under way by December 31, 2027; after that, review each assessment at least every three years and within 45 days of a material change | December 31, 2027, then ongoing | Privacy office | 03_systems: risk assessments |
| Quarterly AI report to the board committee, plus the annual program report and next year's plan and budget | November | AI Accountability Leader | 07_governance_records |
| Readiness check for laws starting January 1, including Colorado SB 26-189 and the Colorado Chatbot Safety Act (HB 26-1263) and California's ADMT rules, all from January 1, 2027 | November to December | Counsel | 02_policies; 07_governance_records |
| Annual records retention review: confirm logs and decision records are kept for the longest period any applicable law requires | December | Records management, with counsel | 06_monitoring_and_incidents |
This page does not keep these dates current. Follow the source link for each one.
| Date | What happens | Who it affects | Official source |
|---|
| Already in force | Texas TRAIGA prohibitions and disclosure duties (January 1, 2026); Illinois HB 3773 employment rules (January 1, 2026); NYC Local Law 144 (enforced since July 5, 2023); EU prohibitions (February 2, 2025), general-purpose AI duties (August 2, 2025), and Article 50 transparency duties (August 2, 2026) | Anyone using AI in those places | TX-001, IL-001, NYC-001, EU-001 |
| October 26, 2026 | Colorado Attorney General written comment deadline and formal hearing on the ADMT rules | Organizations making consequential decisions about Colorado consumers | CO-001 |
| December 2, 2026 | EU: new prohibitions on non-consensual intimate imagery and child sexual abuse material; legacy generative systems must meet the Article 50(2) marking rule | Providers and deployers in the EU market | EU-001, EU-002 |
| January 1, 2027 | Colorado SB 26-189 and HB 26-1263 take effect (enforcement of SB 26-189 is under a court-approved stay; check its status); California ADMT duties for existing uses begin | Deployers and developers serving Colorado and California consumers | CO-001, CA-001 |
| December 2, 2027 | EU Annex III high-risk rules apply | Providers and deployers of high-risk systems in the EU | EU-001 |
| December 31, 2027 | California: first risk assessments due for processing already under way | Businesses subject to the CCPA | CA-001 |
| April 1, 2028 | California: first risk assessment submissions and the first cybersecurity audit certifications (largest businesses) | Businesses subject to the CCPA | CA-001 |
| August 2, 2028 | EU Annex I high-risk rules for AI in regulated products apply | Product manufacturers and their AI suppliers | EU-001 |
| April 1, 2029 and April 1, 2030 | California cybersecurity audit certifications for the next two revenue tiers | Businesses subject to the CCPA | CA-001 |