Contents8
- 01The dates around New Year
- 022 December: marking generated content
- 039 December: software becomes a product
- 041 January: Colorado regulates automated decisions and chatbots
- 0512 January: the end of cloud switching charges
- 0620 January: the Machinery Regulation replaces the directive
- 07What does not change on 1 January
- 08Frequently asked questions
The move into 2027 does not overturn digital law, but it tightens several rules within a few weeks: between 2 December 2026 and 20 January 2027, five European or American texts reach a new stage. None of them requires redoing everything; each deserves a check before the holidays.
This post from our Business AI section is current as of 19 October 2026, and will be reviewed in early December before publication. It is not legal advice: to know whether a text applies to you, your adviser has the final say. All deadlines up to 2028 are in our digital regulation calendar.
In short
2 December 2026: generative tools already on the market must mark their content, and two AI Act prohibitions apply.
9 December 2026: the new Product Liability Directive covers software placed on the market after that date.
1 January 2027: in Colorado, a law on automated decisions and a law on chatbots take effect.
12 January 2027: no more cloud switching charges, under the Data Act.
20 January 2027: the EU Machinery Regulation replaces the 2006 directive.
The dates around New Year
- 2 December 2026
AI Act, marking of generated content and two new prohibitions.
- 9 December 2026
Directive (EU) 2024/2853, software becomes a product for no-fault liability.
- 1 January 2027
Colorado, SB 26-189 (automated decisions) and HB 26-1263 (chatbots).
- 12 January 2027
Data Act, end of cloud switching charges.
- 20 January 2027
Regulation (EU) 2023/1230 on machinery, including machinery whose safety functions rely on AI.
2 December: marking generated content
Tools that generate images, video, audio or text and were on the market before 2 August 2026 must, by this date, mark their content in a machine-readable format. On the same day, two prohibitions apply, on intimate images generated without consent and on child sexual abuse material, according to the Commission’s official timetable. What a business that publishes such content should check is in our guide to marking by 2 December.
9 December: software becomes a product
Directive (EU) 2024/2853 on liability for defective products must be transposed by Member States by 9 December 2026 at the latest, and applies to products placed on the market or put into service after that date, summarises Gibson Dunn. Its definition of a product “expressly includes stand-alone software”, digital manufacturing files and integrated digital elements. The destruction or corruption of data not used for professional purposes becomes compensable damage.
What it changes: a software or app publisher, or a business selling a device with its app, can be held liable without fault for a defect in its code, like a manufacturer for a hardware defect. In France, the current regime sits in Articles 1245 and following of the Civil Code, which the transposition must amend; as of 19 October 2026, we found no published French transposition text.
1 January: Colorado regulates automated decisions and chatbots
Two Colorado laws take effect on the same day, according to the state Attorney General’s page:
The Colorado Attorney General presents the two laws and their effective date of 1 January 2027. Captured on 19 October 2026.
- SB 26-189, signed in May 2026, replaces the 2024 AI law. It covers automated decision-making technology that materially influences a consequential decision (employment, housing, lending, education, health care, insurance). The deployer must inform consumers and, after an adverse decision, explain the tool’s role within 30 days; consumers can request correction of their data and a meaningful human review, according to the official bill summary.
- HB 26-1263, the Chatbot Safety Act, passed in May 2026, requires the operator of a conversational service to disclose that the user is talking to an AI, to estimate the user’s age and to protect minors.
The implementing rules are not final yet: a revised draft was published on 6 October 2026, and the public hearing is set for 26 October. Skadden notes that the automated decision-making law takes effect on 1 January 2027 provided the attorney general completes the required rulemaking by then.
What it changes: a European business that hires, lends to or insures Colorado residents with the help of an automated tool, or offers them a chatbot, falls within scope. It follows the same logic as Article 22 of the GDPR, presented in automated decisions: can AI decide alone?; California will follow on 1 July 2027 for dismissals, as explained in the human role in the face of AI judgment.
12 January: the end of cloud switching charges
From 12 January 2027, a cloud provider can no longer charge for the process of switching providers; since January 2024, these charges were already limited to the costs directly linked to the switch. The date is the one in Article 29 of the Data Act, recalls McCann FitzGerald, which also notes that since 12 September 2026, connected products placed on the market must give their users access to their data by design.
From the field
For Palmora Property, a real estate portal we run, we migrated 51,566 files, or 19 GB, to object storage, without a single error and freeing 20 GB on the server. The real work was not in the provider’s bill, but in the inventory, the integrity check and a documented rollback. The end of exit fees removes a cost, not that work.
What it changes: one less reason to stay with a host that no longer suits you. The method for leaving without breaking things is in cloud migration without breaking everything, and the underlying calculation in leaving SaaS: the real three-year cost.
20 January: the Machinery Regulation replaces the directive
Regulation (EU) 2023/1230 on machinery applies on a mandatory basis from 20 January 2027, and any machinery placed on the market before that date must comply with the 2006 directive, according to the European Commission. According to the same page, it includes provisions for machinery whose safety functions are AI-powered, and for the cyber safety of software and safety control systems. It concerns manufacturers who design or integrate machinery, and their embedded software suppliers.
What does not change on 1 January
Three often-quoted deadlines fall later:
- French e-invoicing for SMEs: issuing by 1 September 2027 at the latest, receiving having been mandatory for all since 1 September 2026.
- AI Act high-risk rules: 2 December 2027 for recruitment, staff or credit, and 2 August 2028 for AI built into regulated products, since the revision explained in the Digital Omnibus and the AI Act.
- NIS2 in France: no date, as the Resilience bill is still waiting for the National Assembly, as detailed in our update on NIS2.
The GDPR and cookies part of the Digital Omnibus has no date either: it is still being negotiated, as explained in our update on the GDPR Omnibus. October’s news, from Meta’s terms on crawling websites to new models, is in our October AI news for business leaders. To put these dates into an overall approach, start from our guide to integrating AI in your business. To find out which of your AI tools these dates affect, our AI at the right cost offer starts from your actual uses.
Frequently asked questions
What changes for business digital on 1 January 2027?
On 1 January 2027, two Colorado laws take effect, on automated decisions and on chatbots, subject to rules from its attorney general. Around that date, the Data Act bans cloud switching charges from 12 January, and the new product liability rules cover software placed on the market after 9 December 2026.
Does Colorado’s law apply to a European business?
Yes if it does business in Colorado and uses automated decision-making technology for a consequential decision about a resident of the state (employment, lending, housing, insurance), or if it offers a conversational chatbot there. The obligations cover consumer notice, an explanation after an adverse decision and human review.
Do cloud exit fees really disappear on 12 January 2027?
Switching charges do: Article 29 of the Data Act prohibits charging for the switching process from that date. The cost of the migration work, on the customer’s side, still has to be planned, as do the fees of a contract you terminate before its end.
Will a software publisher be liable for bugs in its code?
The new directive makes software a product: a defect that causes damage to a person (injury, damage to property, loss of data not used for professional purposes) can make the publisher liable without any fault on its part. It covers products placed on the market after 9 December 2026, under each country’s transposing law.
Sources
- The Commission’s official timetable (new tab)ai-act-service-desk.ec.europa.eu
- Gibson Dunn (new tab)gibsondunn.com
- The state Attorney General’s page (new tab)coag.gov
- The official bill summary (new tab)leg.colorado.gov
- Provided the attorney general completes the required rulemaking by then (new tab)skadden.com
- McCann FitzGerald (new tab)mccannfitzgerald.com
- The European Commission (new tab)single-market-economy.ec.europa.eu
Provided the attorney general completes the required rulemaking by then
Read on skadden.com(new tab)Jim · founder of Brain Plus AI
Also in business ai
Understand9 min
AI Act and digital rules calendar: deadlines 2026 to 2028
AI Act, Data Act, Cyber Resilience Act, NIS2, e-invoicing in France and the first US state laws: every date that matters for a business, from autumn 2026 to August 2028, on one page kept up to date. For each deadline, who is covered and what to prepare.
Practical guide9 min
Cloud migration: moving what you have without breaking it
A successful cloud migration does not move everything in one block: it picks a strategy for each workload, copies instead of moving and keeps a way back. This is the method we apply, with three migrations we have carried out as examples.
Stepping back8 min
Automated decisions: can AI decide on its own?
An algorithm may be more consistent than a manager in a hurry, but a decision that affects a person's life has to be explainable and open to challenge. The law leans clearly one way: the two positions, our view, and the rule to adopt without waiting for 2027.