Not legal advice. This read summarizes primary legal texts for engineers. Check the source, and talk to a lawyer before acting on it.
One day carries half the list
Arbiter's law tracker now lists 95 duties that start between this week and the end of 2027 and touch AI or the personal data it runs on. Every start date was read in the statute, the regulation or the official journal 7. They are not spread evenly:
Tracked AI and privacy duties, by the month they start
95 rows, one per law per start date, November 2026 to December 2027
Source: Arbiter law tracker; each date read in the statute, regulation or official journal 7
Show the data
| label | value | display | series |
|---|---|---|---|
| Nov 2026 | 2 | 2 | 0 |
| Dec 2026 | 6 | 6 | 0 |
| Jan 2027 | 49 | 49 | 1 |
| Feb 2027 | 2 | 2 | 0 |
| Mar 2027 | 4 | 4 | 0 |
| Apr 2027 | 3 | 3 | 0 |
| May 2027 | 2 | 2 | 0 |
| Jun 2027 | 1 | 1 | 0 |
| Jul 2027 | 17 | 17 | 0 |
| Aug 2027 | 1 | 1 | 0 |
| Sep 2027 | 2 | 2 | 0 |
| Oct 2027 | 2 | 2 | 0 |
| Dec 2027 | 4 | 4 | 0 |
January 2027 holds 49 of them, 46 on the first. Part of that is the calendar: many US states start new laws on 1 January, and California, which contributes 20 of the 46, does so by default for any bill without its own operative date. July 2027 is the second wave, with 17.
Where the 1 January duties come from
46 rows by jurisdiction
Source: Arbiter law tracker 7
Show the data
| label | value | display | note |
|---|---|---|---|
| California | 20 | 20 | |
| Colorado | 3 | 3 | |
| New York | 3 | 3 | |
| Illinois | 3 | 3 | |
| 14 other states and federal | 17 | 17 | Connecticut, Utah, Vermont, US federal, Washington, Oregon, Georgia, Rhode Island, New Hampshire, Delaware, Oklahoma, Louisiana, Alabama, Indiana |
Most of the 1 January duties are privacy rules, not AI rules. Chatbot and AI-companion laws are the largest AI-specific group:
What starts on 1 January 2027, by category
46 rows; each row has one category
Source: Arbiter law tracker 7
Show the data
| label | value | display |
|---|---|---|
| Privacy and data protection | 22 | 22 |
| Chatbots and AI companions | 9 | 9 |
| Health AI | 5 | 5 |
| Automated decisions | 3 | 3 |
| Transparency and labeling | 3 | 3 |
| General AI rules | 2 | 2 |
| Frontier models | 2 | 2 |
For health AI, the week of 28 December
Four changes land within five days for anyone building AI on health data:
- 28 December, federal. ONC's HTI-5 rule ends the requirement that certified EHRs support "source attributes" for decision-support AI, the model cards, and risk management for predictive tools 1. (Our read on HTI-5.)
- 1 January, California SB 503. Developers of clinical decision support must give the health systems that deploy it documentation on training data, including demographic representativeness, on evaluation and on risks, and deployers must monitor for biased impacts 3. For California deployers, this replaces some of what the federal rule drops.
- 1 January, California AB 1979. A consumer "health care chatbot" is treated as a provider of health care under California's medical confidentiality law, and AI may not independently perform licensed clinical functions 2.
- 1 January, Colorado HB 26-1139. AI used in utilization review must use the individual's clinical data and be auditable, and a medical-necessity denial cannot rest on AI output without licensed human review 4.
The dates that matter for health AI
Selected rows; the full list is on the tracker
- 2026-11-02Today
- 28 Dec 2026ONC HTI-5 takes effectCertified EHRs no longer have to support AI source attributes or predictive-AI risk management
- 1 Jan 2027California AB 1979A consumer health care chatbot is treated as a provider of health care under the state's medical confidentiality law
- 1 Jan 2027California SB 503Clinical decision support developers give deployers training-data, representativeness, evaluation and risk documentation
- 1 Jan 2027Colorado HB 26-1139AI in utilization review must use individual clinical data and be auditable; no medical-necessity denial on AI output without licensed human review
- 1 Jan 2027California CCPA rules on automated decisionsPre-use notice, opt-out or human appeal, and access rights for significant decisions
- 1 Jan 2027Colorado SB 26-189Notice, explanation of adverse decisions, correction and human review; HIPAA covered entities largely exempt
- 1 Jul 2027California SB 1119 child-safety dutiesRisk assessment and protections before releasing a companion chatbot
- 2 Dec 2027EU AI Act high-risk rules (delayed)Risk management, data governance, human oversight for stand-alone high-risk systems
- 31 Dec 2027California CCPA risk assessmentsDue for high-risk processing that began before 2026, including training automated decision tools
Source: Federal Register, California and Colorado legislatures, CPPA, EUR-Lex 1234568
Show the data
| date | human | label | detail | tone |
|---|---|---|---|---|
| 2026-12-28 | 28 Dec 2026 | ONC HTI-5 takes effect | Certified EHRs no longer have to support AI source attributes or predictive-AI risk management | 0 |
| 2027-01-01 | 1 Jan 2027 | California AB 1979 | A consumer health care chatbot is treated as a provider of health care under the state's medical confidentiality law | 0 |
| 2027-01-01 | 1 Jan 2027 | California SB 503 | Clinical decision support developers give deployers training-data, representativeness, evaluation and risk documentation | 0 |
| 2027-01-01 | 1 Jan 2027 | Colorado HB 26-1139 | AI in utilization review must use individual clinical data and be auditable; no medical-necessity denial on AI output without licensed human review | 0 |
| 2027-01-01 | 1 Jan 2027 | California CCPA rules on automated decisions | Pre-use notice, opt-out or human appeal, and access rights for significant decisions | 1 |
| 2027-01-01 | 1 Jan 2027 | Colorado SB 26-189 | Notice, explanation of adverse decisions, correction and human review; HIPAA covered entities largely exempt | 1 |
| 2027-07-01 | 1 Jul 2027 | California SB 1119 child-safety duties | Risk assessment and protections before releasing a companion chatbot | 2 |
| 2027-12-02 | 2 Dec 2027 | EU AI Act high-risk rules (delayed) | Risk management, data governance, human oversight for stand-alone high-risk systems | 3 |
| 2027-12-31 | 31 Dec 2027 | California CCPA risk assessments | Due for high-risk processing that began before 2026, including training automated decision tools | 1 |
Two broader rules reach automated decisions on the same day. California's CCPA regulations require businesses that use automated decisionmaking technology for significant decisions to give a pre-use notice, an opt-out or a human appeal, and access rights; risk assessments for older processing, including training such tools, are due by 31 December 2027 5. Colorado's rewritten AI law, SB 26-189, requires notice, an explanation of adverse decisions, correction and human review, though HIPAA covered entities are largely exempt except for employment decisions 6.
Also starting on 1 January
- Frontier models. New York's RAISE Act requires a published safety framework, transparency reports and incident reports within 72 hours 9, and Illinois adds a disclosure filing before developing or operating a frontier model 10.
- Children and chatbots. California's SB 1119 removes SB 243's duties for known minors on 1 January, but its replacement child-safety duties start only on 1 July 2027, a six-month gap 11.
- Training data. California's AB 1159 bars using K-12 and preschool student data to train generative AI from 1 January, and higher-education data from 1 July 12.
What this changes in Arbiter's agent
Arbiter's agent runs under a written policy, and new law is a reason to change it. This research opened two proposals, published on the policy log for review:
- SB 503: extend the decision-support inventory the agent already keeps for Section 1557, so every tool entry must document training data, evaluation and known risks, and the agent refuses to start without them.
- HB 26-1139: cite Colorado alongside California on the existing rule that blocks coverage and medical-necessity determinations, so the audit trail names the law that applied.
Neither is enforced until a person reviews it. The agent already meets the substance of both: it makes no determinations, and it keeps the inventory.
Show your work
How this was done
A research pass on 2 November 2026 started from Arbiter's earlier AI-law tracker and searched for every law, regulation or rule whose duties start between 2 November 2026 and 31 December 2027 and that touches AI or the personal data AI uses. Each row's start date was read in primary text: the statute or bill on the legislature's site, the official journal (EUR-Lex), federalregister.gov or eCFR, or the regulator's own page. 93 of 95 rows were re-opened in a final check; two Vietnam rows rest on one reading of a scanned gazette. Where a law gives a period instead of a date, the date is computed and the row says so. California bills with no operative-date clause take the state's default, 1 January after enactment. The counts in the charts are computed from the published CSV, one row per law per distinct start date 7.
What this does not tell you
"Verified" covers the start date. The short duty summaries for some states outside California, Colorado, Connecticut and New York come from a first reading of the bill and should be checked in the linked text before quoting. Counting rows is not weighting them: a federal API rule and a state student-privacy law each count once. Some dates may move: Chile's new data protection law (1 Dec 2026) has a postponement bill pending, and New York's companion-chatbot amendments may shift. Colorado's attorney general has not adopted final rules, and the litigation over Colorado's AI law and several California laws was not followed here.
Data
Every number in the charts, as CSV:
Agent policy
This read is evidence for these rules in the agent's policy:
Sources
- ONC, HTI-5 final rule, 91 FR 67916 (28 Oct 2026)
- California AB 1979, Health care services: artificial intelligence (Ch. 854, Stats. 2026)
- California SB 503, Health care services: AI clinical decision support (Ch. 857, Stats. 2026)
- Colorado HB 26-1139, Use of AI in Health Care (session law)
- California Privacy Protection Agency, CCPA regulations on cybersecurity audits, risk assessments and ADMT (approved text)
- Colorado SB 26-189, Automated Decision-Making Technology Act
- Arbiter law tracker, all 95 rows with primary links (CSV)
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), EUR-Lex
- New York RAISE Act as rewritten by S8828
- Illinois SB 315, AI Safety Measures Act (P.A. 104-0538)
- California SB 1119, Adam's Law (Ch. 190, Stats. 2026)
- California AB 1159, student personal information (Ch. 182, Stats. 2026)
Corrections
None so far. Found an error? Tell me and it will be corrected here, with the date.