2027 compliance deadlines: a 22-date US and UK calendar for software teams

Summary. Thirteen of the 22 verified US and UK deadlines in this calendar fall in January 2027. On 1 January, Colorado's rewritten AI law (SB 26-189) and its Chatbot Safety Act start, California's CCPA rules on automated decisionmaking technology (ADMT) and its Digital Age Assurance Act apply, New York's amended RAISE Act and Vermont's Age-Appropriate Design Code take effect, Louisiana's and Oklahoma's privacy laws and Alabama's app store law begin, CMS expects payers to run four FHIR APIs, and UK employees gain unfair dismissal rights after 6 months. Windows Server 2016 loses support on 12 January, the GENIUS Act takes effect on 18 January, and the Openreach copper phone network closes on 31 January. Spring brings Making Tax Digital at £30,000 and mandatory payrolling of benefits in kind (both 6 April), the ADA Title II web rule for governments of 50,000 or more people (26 April) and HHS Section 504 for recipients with 15 or more staff (11 May). Later come Louisiana's app store law (1 July), a $10 million Same Day ACH limit (17 September), the end of SQL Server 2017 and Windows 10 consumer ESU (12 October) and the expected FCA crypto regime (25 October). Seven more items are labelled as draft, estimated or not fully confirmed. From 12 November 2026, 50 days remain to 1 January.

About this article. For product, engineering, privacy and IT leads at software firms that sell or employ in the US or UK. We checked every date on 12 November 2026 against primary sources: statutes and enrolled bills, regulator and agency pages, the Federal Register and vendor lifecycle pages. Colorado, Vermont, Louisiana and California legislature pages, and the Colorado Attorney General's page, refused automated access, so we read archived copies of those official pages. This is general information, not legal advice; confirm scope with counsel before you commit budget. Researched with AI assistance and reviewed by our editorial team.

What changed for 2027, and how to read this calendar

Several 2027 dates exist because a 2026 decision moved them. A Department of Justice interim final rule, published on 20 April 2026, pushed the ADA Title II web and app date for large state and local governments to 26 April 2027. HHS moved its Section 504 date for recipients with 15 or more employees to 11 May 2027. Colorado repealed and re-enacted its 2024 AI Act as an ADMT law, signed on 14 May 2026. New York replaced the RAISE Act text with S8828, signed on 27 March 2026. Louisiana stopped its 2025 app store law from taking effect and passed a new one for 1 July 2027. California rewrote its age-signal law through AB 1856, approved on 10 September 2026. Nacha chose 17 September 2027 for its $10 million Same Day ACH limit, later than the 19 March 2027 date it proposed.

The first table holds 22 dates we confirmed on a primary source or an archived copy of one: a statute, an enrolled bill, a regulator's page, an agency rule or a vendor lifecycle page. The second holds 7 items that carry a label: a draft instrument, an estimate, a month-only timeline, or a signature we could not confirm. Anything we could not verify is left out.

Two reading rules. First, the effective date is not the build date: most of these rules expect the notice, API or accessibility fix to be live on day one, so work back by at least one release cycle. Second, a US state law reaches you if you serve its residents and cross its thresholds, wherever you are based; a UK rule reaches you through UK staff, customers or sites.

The 2027 calendar: 22 verified US and UK deadlines

Sources for each row are cited in the sections that follow; the January state laws are summarised from their bill texts and official pages.

Also on the 2027 radar: 7 labelled items

Treat these as amber until the label clears. The sources are the Alabama enrolled bill, DBT's draft guidance, GOV.UK's Employment Rights Act timeline, FedRAMP, HM Treasury and HMRC's e-invoicing roadmap, Ofcom's roadmap and the NHS toolkit news page.

One date we dropped: a 27 January 2027 Cyber Essentials Plus cut-off circulates on secondary sites. IASME says the April 2026 scheme changes apply to assessment accounts created after 26 April 2026, with 6 months on the old version for earlier accounts. We found no 2027 date from IASME.

1 January 2027: the US AI, privacy and kids' online cluster

Eight state regimes start on one day, and they overlap in what they ask you to build.

Automated decisions. Colorado's SB 26-189 takes effect on 1 January 2027, and the Attorney General must adopt rules before then. Proposed rules were filed on 11 August 2026, with written comments accepted until 26 October 2026; check the Attorney General's page for the adopted text. Deployers must explain a covered ADMT's role in plain language within 30 days of an adverse outcome, and developers and deployers keep compliance records for at least 3 years. Our Colorado SB 26-189 guide covers the duties in detail. California's CPPA says businesses using ADMT for significant decisions must comply from 1 January 2027, and the regulations set out a pre-use notice, an opt-out and access requests. Both laws want an inventory of every model or rules engine that shapes hiring, lending, housing, education or healthcare decisions, a notice before use, and a route to get information, correct data or seek review. Build that once, with state-specific text.

Chatbots and frontier models. Colorado's HB 26-1263, signed on 29 May 2026, requires operators of public conversational AI services to estimate users' ages, disclose that the service is AI, protect minors, keep a self-harm protocol and report annually to the Attorney General. New York's S8828 requires frontier developers to report critical safety incidents to an office in the Department of Financial Services within 72 hours, and to alert law enforcement or public safety agencies within 24 hours when there is an imminent risk of death or serious injury. Large frontier developers face penalties up to $1 million for a first violation and $3 million after. Most software teams use frontier models rather than train them, so New York reaches them mainly through vendor contract terms.

Kids and age signals. Vermont's code covers online services reasonably likely to be accessed by minors and requires the most private settings by default. California's Digital Age Assurance Act, as amended, makes operating system providers send an age-bracket signal and developers request it; for devices set up and apps downloaded before 2027, the deadline is 1 July 2027. Alabama's HB 161 makes app stores verify an age category and parental consent, with developers reading those signals through the store, and requires stores to verify existing accounts before 1 October 2027. Alabama's Attorney General can seek $7,500 per violation; Louisiana's 1 July law allows $10,000 per violation after a 45-day notice to cure. The trade group CCIA sued to block Alabama's law on 28 October 2026, so watch the docket. Apple's Declared Age Range API and Google's Play Age Signals API (in beta) are the practical integration points. Our app store age law guide maps the duties to both APIs.

Privacy and health payers. Louisiana's Act 502 and Oklahoma's SB 546, approved by the governor on 20 March 2026, both take effect on 1 January 2027. The build is the usual one: a rights-request pipeline with identity checks and deadlines, and data maps that feed assessments. CMS gives impacted payers until generally 1 January 2027 for the CMS-0057-F APIs, and says exact dates vary by payer type.

UK deadlines: employment, telecoms, tax and payroll

1 January: unfair dismissal at 6 months. SI 2026/559 brings section 25 of the Employment Rights Act 2025 into force on 1 January 2027. GOV.UK's timeline, updated on 5 November 2026, says this cuts the unfair dismissal qualifying period to 6 months for dismissals from that date, removes the cap on compensatory awards and comes with a duty to tell workers they can join a trade union. HR platforms need the new rule in probation and dismissal workflows. Our guide to the 2027 dates under the Employment Rights Act 2025 lists the later phases.

31 January: copper closes. Openreach says all traditional phone lines go digital on 31 January 2027, and lines not moved may go to EVAc, a temporary voice-only fallback. The software risk is the forgotten device: alarm diallers, lift phones, card terminals and door entry systems that talk to a back end over an analogue line. Test each on a digital line, as our PSTN switch-off plan sets out.

6 April: two HMRC changes. Sole traders and landlords with qualifying income over £30,000 in 2025 to 2026 must use Making Tax Digital for Income Tax from 6 April 2027, and the £20,000 group, based on 2026 to 2027 income, follows on 6 April 2028. The same day, company cars and fuel, vans and fuel, and medical insurance must be reported through payroll, with Income Tax and Class 1A National Insurance taken in real time; all other benefits except loans and accommodation follow in April 2028. Payroll vendors need benefit values in the Full Payment Submission before the first April pay run.

25 October (expected): crypto. The FCA expects its cryptoasset regime to come into force on 25 October 2027. The application period opened on 30 September 2026 and closes on 28 February 2027.

Accessibility: two federal WCAG 2.1 AA dates

Both US accessibility dates use WCAG 2.1 Level AA and reach private vendors through their customers. The Department of Justice says a mobile app a city offers through a private company, such as a parking payment app, must still conform. If you sell to US cities, counties, school districts or transit agencies serving 50,000 or more people, expect conformance reports and remediation clauses before 26 April 2027. Smaller governments and special districts have until 26 April 2028.

HHS's interim final rule moved the Section 504 date for recipients with 15 or more employees from 11 May 2026 to 11 May 2027; smaller recipients have until 10 May 2028. It is an interim rule whose comment period closed on 6 July 2026, so HHS could still change it. Patient portals, scheduling, telehealth and payment pages are the usual gaps. For both, scan for volume, then test the 10 to 20 key journeys with a screen reader and keyboard, and fix shared components first.

End-of-support dates that auditors treat as deadlines

Microsoft lists Windows Server 2016 extended support and Visual Studio 2022 mainstream support as ending at 06:59:59 on 13 January 2027, which closes Patch Tuesday, 12 January, in Pacific time. Paid ESU Year 1 for Windows Server 2016 starts at that point. SQL Server 2017 ends the same way on 12 October 2027, the day Windows 10 consumer ESU ends. Commercial Windows 10 ESU costs $61 per device for Year One and doubles each year, for up to three years. Our Windows Server 2016 playbook prices ESUs against an upgrade.

These are compliance dates in practice. Cyber Essentials fails an assessment automatically when high-risk or critical updates are not installed within 14 days of release, and an unsupported server gets no updates. The NHS Data Security and Protection Toolkit's 2026 to 2027 audit areas for IT suppliers include 8.1 and 8.2, on unsupported software and hardware.

Payments and federal procurement

GENIUS Act, 18 January. The Act takes effect on the earlier of 18 months after enactment (18 January 2027) or 120 days after the primary federal stablecoin regulators issue final implementing rules. The OCC published its final rule on 23 October 2026, effective 18 January 2027, and states that the Act takes effect that day. Start with an inventory of which stablecoins you touch and who issues them.

Same Day ACH, 17 September. Nacha will raise the Same Day ACH limit from $1 million to $10 million per payment, for credits and debits in all three settlement windows; IAT entries stay ineligible. Review hard-coded limits and fraud rules.

FedRAMP, 11 June (estimate). FedRAMP says it will stop accepting new Rev5 certifications on 11 June 2027, in a phase it marks as estimated. New federal SaaS bids should plan around the 20x classes.

Turning the calendar into a backlog

1. Scope each row. Do you have users, staff or sites there; do you cross the threshold; does your product do the regulated thing? Most teams find only some rows apply.

1. Name an owner and an artefact for each row: a notice, an API, a conformance report or a migration record.

1. Group by build, not by law. ADMT notices, age signals and WCAG fixes are each one stream with state-specific text.

1. Re-check the amber table monthly, and write down why any row does not apply.

A worked planning example: a 150-person US and UK SaaS firm

Take a hypothetical HR and payroll SaaS firm with 110 staff in the US and 40 in the UK, county government customers, a UK office with an alarm and lift, and an applicant-scoring feature.

The firm has 10 of the 22 rows in scope. The chatbot, frontier-model, age-signal, stablecoin and Section 504 rows drop out, each with a one-line written reason.

How eCorpIT can help

eCorpIT is a Gurugram-based technology organisation, founded in 2021, assessed at CMMI Level 5 and MSME certified, with senior-led engineering teams working across AWS, Microsoft and Google platforms. Our application development services team turns rows in this calendar into shipped work, from ADMT notices and age-signal integrations to WCAG 2.1 AA fixes and server upgrades. Talk to us at /contact-us/.

Last updated: 12 November 2026.

References

1. SB26-189 Automated Decision-Making Technology — Colorado General Assembly

1. HB26-1263 Conversational Artificial Intelligence Service Operator Requirements — Colorado General Assembly

1. California Finalizes Regulations to Strengthen Consumers' Privacy, 23 September 2025 — California Privacy Protection Agency

1. AB-1856 Age verification signals: software applications, chaptered 10 September 2026 — California Legislative Information

1. Senate Bill S8828 (2025-2026 session) — New York State Senate

1. Act 63 (S.69), an act relating to an age-appropriate design code, as enacted — Vermont General Assembly

1. Act No. 502 of the 2026 Regular Session (SB 386), Louisiana Data Privacy Act — Louisiana State Legislature

1. SB 546 enrolled (final version) — Oklahoma Legislature

1. HB161 enrolled, 2026 Regular Session — Alabama Legislature

1. CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F) fact sheet — Centers for Medicare and Medicaid Services

1. Plan to Make Work Pay and Employment Rights Act: timeline update, updated 5 November 2026 — Department for Business and Trade, GOV.UK

1. Windows Server 2016 lifecycle — Microsoft Learn

1. Implementing the GENIUS Act for the Issuance of Stablecoins by Entities Subject to the Jurisdiction of the OCC, final rule, 23 October 2026 — Federal Register

1. Switching off the PSTN across the UK (The Big Switch Off) — Openreach

1. Find out if and when you need to use Making Tax Digital for Income Tax — HMRC, GOV.UK

1. Prepare for mandatory payrolling of benefits in kind — HMRC, GOV.UK

1. Fact sheet: new rule on the accessibility of web content and mobile apps provided by state and local governments — US Department of Justice, ADA.gov

1. Extension of compliance dates for web content and mobile application accessibility of recipients, interim final rule, 11 May 2026 — Federal Register via GovInfo

1. Act No. 185 of the 2026 Regular Session (HB 977) — Louisiana State Legislature

1. Increasing the Same Day ACH dollar limit to $10 million — Nacha

1. SQL Server 2017 lifecycle — Microsoft Learn

1. Windows 10 Extended Security Updates (consumer) — Microsoft

1. New regime for cryptoasset regulation, updated 10 November 2026 — Financial Conduct Authority

1. Colorado Automated Decision-Making Technology and Chatbot Safety Rulemaking — Colorado Attorney General

1. Approved regulation text: CCPA updates, cybersecurity audits, risk assessments and ADMT (sections 7200 to 7222) — California Privacy Protection Agency

1. CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F) — Centers for Medicare and Medicaid Services

1. HB351 enrolled, Alabama Personal Data Protection Act — Alabama Legislature

1. Subscription contracts: draft guidance on the subscription contracts rules, 19 October 2026 — Department for Business and Trade, GOV.UK

1. FedRAMP 20x — FedRAMP, US General Services Administration

1. Roadmap for e-invoicing implementation — HM Treasury and HMRC, GOV.UK

1. Roadmap to regulation: online safety — Ofcom

1. DSPT Audit 26-27 areas of mandatory audit, including IT suppliers, 1 October 2026 — NHS Data Security and Protection Toolkit

1. Important update: changes to Cyber Essentials for April 2026 — IASME

1. CCIA files lawsuit arguing Alabama's app store law likely violates First Amendment, 28 October 2026 — Computer and Communications Industry Association

1. Declared Age Range — Apple Developer Documentation

1. Play Age Signals overview — Android Developers

1. Bill information for SB 546 (2026 Regular Session) — Oklahoma Legislature

1. The Employment Rights Act 2025 (Commencement No. 4 and Transitional and Saving Provisions) Regulations 2026, SI 2026/559, regulation 3 — legislation.gov.uk

1. Cryptoassets: how the gateway will operate — Financial Conduct Authority

1. Visual Studio 2022 lifecycle — Microsoft Learn

1. Extended Security Updates (ESU) program for Windows 10 — Microsoft Learn

1. 12 U.S. Code 5901, statutory note on effective date — Legal Information Institute, Cornell Law School