Regulatory watch: week of 2 November 2026
This week's watch covers two India DPDP dates still ahead and where the EU AI Act stands on transparency and high-risk duties. The dates below are those listed in the sources as at 2 November 2026. The first date still ahead is 13 November 2026, in 11 days.
1. India: consent managers can register from 13 November 2026
The DPDP Rules were notified on 13 November 2025, and the Data Protection Board provisions came into force on that date [1]. On 13 November 2026, in 11 days, consent managers can register with the Data Protection Board [1]. This date matters mainly to organisations that wish to register in that role.
2. India: most DPDP duties apply from 13 May 2027
On 13 May 2027, in about six months, most DPDP duties apply: notice, consent, security, breach reporting and rights [1]. Mapping what personal data is held about users in India, and which duty applies to each data set, is good practice ahead of that date. It is not itself a legal requirement.
Text version
- 13 November 2026: Consent managers can register with the Board
- 13 May 2027: Most DPDP duties apply
3. EU AI Act: Article 50 applies now; high-risk dates are still ahead
The Article 50 transparency duties have applied since 2 August 2026 [2]. Whether a particular system is within scope depends on the text of the Article.
Two high-risk dates are still ahead:
- 2 December 2027: high-risk duties for Annex III systems, as amended by Regulation (EU) 2026/1744 [2].
- 2 August 2028: high-risk duties for AI in products covered by EU product law [2].
It is good practice, not a legal requirement, to begin inventorying AI systems well before the Annex III date.
Text version
- 2 August 2026: Article 50 transparency duties (applied since this date)
- 2 December 2027: High-risk duties, Annex III systems (as amended)
- 2 August 2028: High-risk duties, AI in products under EU product law
What to keep in view
For India, 13 November 2026 is the first date ahead (consent manager registration). 13 May 2027 is the later date, when most DPDP duties apply. For AI sold into the EU, the next high-risk date is 2 December 2027 for Annex III systems.
Sources
- Ministry of Electronics and Information Technology, Data Protection Framework – https://www.meity.gov.in/data-protection-framework
- Regulation (EU) 2024/1689 (EU AI Act), EUR-Lex, including the amendment made by Regulation (EU) 2026/1744 – https://eur-lex.europa.eu/eli/reg/2024/1689/oj
Sources
General information, not legal advice. Prepared with AI assistance and checked against the official sources cited. Laws change; check the date above.