What's coming but not yet binding — proposed rules, enacted-but-not-in-force rules, and phase-in deadlines. Forward-looking dates move; confirm against the primary source before acting.
Proposed rules, enacted-but-not-in-force rules, phase-in deadlines and open comment windows, sorted by date. Day counts run from 5 Oct 2026, the date this page was built. A proposal whose comment period has closed has no date until a final rule is published; one that has since been finalized is in the in-force rulebook, not here.
| Date | When | In | Regulator | Rule / milestone | Type |
|---|---|---|---|---|---|
| 2027-03-18 | in 164 days | UK | UK_FCA | PS26/2 — Operational incident and third party reporting Single, cross-authority (FCA/PRA/Bank of England) regime for reporting operational incidents and material third-party arrangements. Defines an operational incident and reporting thresholds, a standardised single incident report, and a… | Final — not yet in force |
| 2027-08-02 | in 301 days | EU | EU_AI | Regulation (EU) 2024/1689 — Artificial Intelligence Act Art. 6(1) high-risk obligations apply (Annex III: credit scoring, insurance pricing) | Phase-in |
| 2027-08-02 | in 301 days | EU | EU_AI | Regulation (EU) 2024/1689 — Artificial Intelligence Act EU Artificial Intelligence Act: risk-based requirements for AI systems including high-risk systems (creditworthiness/credit scoring and life/health insurance pricing are high-risk in financial services), risk management, data governance… | Final — not yet in force |
| 2027-09-01 | in 331 days | CA | CA_OSFI | OSFI Guideline E-21 — Operational Risk and Resilience Scenario testing of all critical operations | Phase-in |
Knowing which rules bind you is step one. WSquare Advisory builds the operating capability behind compliance — the continuity, third-party, and recovery disciplines these regimes expect. If that's your challenge, let's talk.
Start with an Operating Survey · $5,000 →Not sure it is the right moment? Take the five-minute check first.