How do we prepare for AI regulation over the next 12 months?

The EU AI Act's high-risk obligations were the headline near-term deadline until Regulation (EU) 2026/1744 deferred them. Stand-alone Annex III systems now have until 2 December 2027, and embedded product systems until 2 August 2028, for conformity assessments, technical documentation, and EU database registration. GPAI model obligations became applicable in August 2025 and were not deferred. All of these apply to non-EU organizations with EU market exposure.

In the US, the state-level regulatory calendar is accelerating. Colorado SB 205 is in effect. New York City's Local Law 144 on AI in hiring is in effect and being enforced. Illinois BIPA continues to generate significant class action exposure for biometric AI. California's AI-related legislation pipeline is active. Financial services and healthcare organizations face ongoing guidance from sector regulators that imposes AI-specific obligations without waiting for comprehensive AI legislation.

A gap assessment maps each specific obligation in an incoming regulation against your current state. For each obligation, the assessment should answer: do we have a process, policy, or control that satisfies this requirement? If yes, is it documented and operating? If not, what would it take to build it?

The output is a prioritized list of gaps with effort and risk estimates. High-effort, high-risk gaps on short timelines are your critical path items. Low-effort gaps can often be resolved quickly: mandatory disclosure language, for example, requires a policy update and a template, not a major project. Separating the quick wins from the complex buildouts allows you to show early progress while managing the longer-term work.

Compliance teams that learn about regulatory changes from press coverage are behind. The organizations with the most effective regulatory monitoring have direct subscriptions to relevant agency publications, track active legislation in their key jurisdictions through government and legal databases, and have established relationships with outside counsel who specialize in AI law and provide proactive alerts.

Monitoring needs to cover three categories: binding requirements (laws and regulations that create compliance obligations), guidance (interpretive documents from regulators that signal enforcement priorities and expected practices), and enforcement actions (cases that reveal how regulators apply the rules in practice). Enforcement actions are often the most informative: they demonstrate which obligations regulators are prioritizing, what documentation they expect to see, and what remediation they consider adequate.

The California AI Transparency Act (SB 942, as amended by AB 853) becomes operative on 2 August 2026, placing it within a typical 12-month preparation window for teams acting now. The law applies to providers of covered generative AI systems serving California consumers, including non-California developers whose systems reach California users. Three obligations stand out as requiring new technical or contractual infrastructure: a free, publicly accessible AI-detection tool capable of identifying content your system generated; latent disclosures embedded in all covered AI-generated content so provenance survives distribution; and license terms that expressly prohibit licensees from stripping or disabling those disclosure capabilities.

The revocation requirement deserves particular attention in your gap assessment. If you discover a licensee has removed or circumvented required disclosure functionality, you must revoke that licensee's access within 96 hours. Organizations that distribute generative AI through resellers or API partners will need contract language, a monitoring mechanism, and an operational process capable of executing revocation on that timeline. Teams that rely on quarterly contract reviews or manual enforcement will likely not meet that window without process changes.