Tomorrow, September 11, the European Union’s Cyber Resilience Act activates its first concrete enforcement mechanism. Under Article 14, manufacturers placing products with digital elements on the EU market must notify ENISA and the designated national CSIRT within 24 hours of discovering an actively exploited vulnerability or severe incident. A fuller notification follows within 72 hours. Penalties reach EUR 15 million or 2.5 percent of worldwide annual turnover, whichever is higher. For builders shipping agent-connected products into Europe, this is the first deadline with real teeth.
But CRA Article 14 is only the nearest wave. The enforcement calendar for AI agent governance is now crowded across jurisdictions, and the fragmentation is the defining structural fact. Builders are not managing one deadline-they are managing five, each with different triggers, different penalties, and different theories of liability.
The consumer protection front opens next. The FTC’s personalized pricing policy, which targets AI-driven individualized pricing using personal data, closes its comment period on September 25, 2026-extended from the original September 18 deadline. The Commission cannot ban personalized pricing outright; it lacks the statutory authority. But under Section 5 of the FTC Act, it can require transparency: firms must disclose that a price is personalized, the basis for that personalization, and the types of data used. This is the federal layer. The state layer arrives October 1, when Maryland’s HB 895 takes effect-prohibiting dynamic pricing using personal data for food retailers and delivery services, with penalties of $10,000 per violation and $25,000 for repeat offenders.
The three-state pricing patchwork (Connecticut, Maryland, New Jersey) captures agents through broad statutory definitions of “price-setting devices” and “personal data” without ever naming the technology. New Jersey’s Fair Price Protection Act, effective August 1, 2027, is the sharpest instrument: a private right of action with treble damages and no cure period, exposing builders to consumer-led litigation from day one.
Then there is Colorado, where the enforcement timeline has been rewritten by litigation. The state’s Automated Decision-Making Technology Act, originally slated for January 1, 2027, remains blocked by the xAI v. Weiser case (No. 1:26-cv-01515, D. Colo.). The Department of Justice intervened on xAI’s side in April 2026-the first federal intervention in a state AI law challenge. The court-ordered stay extends to successor legislation, and the preliminary injunction motion is still pending. The rulemaking comment period remains open until October 26, but the enforcement date is functionally frozen. Federal preemption is not a theoretical risk here; it is an active judicial process reshaping the compliance landscape in real time.
Across the Atlantic, the EU AI Act’s Article 50 transparency obligations have been active since August 2, 2026-more than five weeks ago. The enforcement ledger reads zero. No fines, no investigations, no actions targeting agent behavior. The structural reasons are clear: the Act contains no definition of agentic systems, the EU AI Office operates with approximately 125 staff members, 12 member states missed the deadline for appointing competent authorities, and 19 have yet to appoint single points of contact. Enforcement has focused on AI washing and marketing deception, not the autonomous decision-making that defines the agent economy. The obligation exists; the enforcement infrastructure does not yet follow.
For builders, the practical challenge is not any single deadline but the accumulation. CRA Article 14 demands incident-response infrastructure with 24-hour reporting. The FTC and state pricing laws require pricing-logic audits and disclosure architectures. The Colorado litigation creates uncertainty about whether compliance with one state framework will be preempted before it takes effect. The EU AI Act’s dormant enforcement creates a temptation to deprioritize transparency obligations that may activate retroactively.
The cost of navigating this environment is measured in compliance teams, legal review cycles, and liability insurance-not just in code. Enforcement is arriving in waves, and each wave carries a different theory of what went wrong. The builders who track the calendar will adapt. The ones who assume the vacuum is permanent will learn otherwise.