You might recognise this. It's the first Monday in November. The partners' meeting has three items on the agenda: the Christmas party, the coffee machine, and a line someone has typed as "AI: anything we need to know?"
The first two take forty minutes. The third gets a shrug and "didn't the EU do something?"
The shrug is understandable. Over the next two years, changes are coming from HMRC, the ICO, the Treasury, Brussels and Parliament. They're on different timetables, and at different stages of readiness. The good news is that most of them already have a date. And you can plan for a date.
£30,000
MTD for Income Tax threshold from 6 April 2027, based on 2025–26 qualifying income
HMRC, Making Tax Digital for Income Tax
£20,000
MTD for Income Tax threshold from 6 April 2028, based on 2026–27 qualifying income
HMRC, Making Tax Digital for Income Tax
3 months
for each group to apply for tax adviser registration, from its own start date
HMRC, Check if and when you need to register as a tax adviser
Qualifying income is gross turnover from self-employment and property, before expenses. Whether you're in depends on the earlier tax year's income, subject to exemptions. The registration window is for the groups that must apply. If you already have an agent services account, you don't register again.
The diary, in one place
- 19 June 2026 (passed)Data (Use and Access) Act fully in force for data protection
- 2 August 2026 (passed)EU AI Act general application and transparency duties
- 18 November 2026Tax adviser registration window opens for payroll-only advisers
- 31 December 2026Registration window opens for financial-services organisations
- 31 March 2027Tax adviser registration rollout completes
- 6 April 2027MTD for Income Tax threshold falls to £30,000
- 2 December 2027EU AI Act rules for Annex III high-risk systems
- 6 April 2028MTD for Income Tax threshold falls to £20,000
- 2 August 2028EU AI Act rules for high-risk AI in regulated products (Annex I)
- No date yetAML supervision of accountants moves to a single supervisor within the FCA
- Expected, no dateICO statutory code on AI and automated decision-making
- In ParliamentCyber Security and Resilience Bill
Read as a table
| Change | Date |
|---|---|
| Tax adviser registration | 18 Nov 2026 |
| Tax adviser registration | 31 Dec 2026 |
| Tax adviser registration | 31 Mar 2027 |
| MTD for Income Tax | £30,000 · 6 Apr 2027 |
| MTD for Income Tax | £20,000 · 6 Apr 2028 |
| EU AI Act | Annex III · 2 Dec 2027 |
| EU AI Act | Annex I · 2 Aug 2028 |
| AML supervision to the FCA | No date yet |
| ICO code on AI and ADM | No date yet |
| Cyber Security and Resilience Bill | No date yet |
Tax adviser registration comes first for most practices
Mandatory registration is already law. HMRC's rollout began on 18 May 2026, and each group gets a three-month window to apply, from its own start date.
Advisers with legacy Self Assessment or Corporation Tax agent accounts started on 18 August 2026. Payroll-only advisers follow from 18 November, and financial-services organisations from 31 December.
If you already have an agent services account, you don't need to register again. HMRC will contact you through your account if it needs more information. That's in the window that runs from 31 December 2026 to 31 March 2027, when the rollout ends.
Register late, or not at all, and you may not be able to deal with HMRC. You could face sanctions too, so "we'll look at it after January" is a braver plan than it sounds. HMRC says it'll give you a chance to put things right before any sanction. But the window is three months, so put it in your diary.
AI doesn't change any of this. It doesn't alter who provides the paid service, or who carries the registration and authorisation duties.
MTD for Income Tax keeps stepping down
Whether a client comes in from April 2027 usually depends on their 2025–26 qualifying income. If it's over £30,000, subject to exemptions, they're in. So the client list you need is built from a tax year that's already closed. Both steps are in regulations: the £30,000 step in SI 2024/167, and the £20,000 step, for 2026–27 income and later, in SI 2026/336.
More clients in MTD means more quarterly updates, more digital records and more temptation to let a tool categorise quickly. None of that is an AI rule. It just means more places where an unchecked extraction can become a submitted figure.
The EU AI Act has real dates, and a narrower reach than the headlines
The Act entered into force on 1 August 2024 and arrives in phases. Prohibitions and AI literacy applied from 2 February 2025, and general-purpose model rules from 2 August 2025. General application and transparency duties followed on 2 August 2026. These cover things like chatbots and some generated content.
The AI Omnibus, in force since 27 July 2026, moved the high-risk dates. Annex III systems, such as some employment uses, now start on 2 December 2027. High-risk AI built into regulated products follows on 2 August 2028. These dates are already law, not just proposals.
If you're in scope, the Act asks providers and deployers to help the people who act for them understand AI. Sensible staff training does the job. No set course or certificate is required.
Data protection is in force now, with a code to follow
The Data (Use and Access) Act's main data-protection changes started on 5 February 2026. The ICO says all its data-protection provisions were in force by 19 June 2026. That includes the rules on meaningful human involvement and complaint handling, covered in Part 1.
Regulations in force since 12 May 2026 tell the ICO to prepare a statutory code on AI and automated decision-making. A final code hasn't been confirmed. Until it lands, the ICO's existing AI guidance is the one to use. That guidance is itself under review.
AML supervision will change, but not yet
On 21 October 2025, the Government announced that AML supervision of accountants will move to a single supervisor inside the FCA. Implementation policy followed in June 2026. It still needs a new law, and no date has been set for the move.
Until the law changes, your current supervisor is still your supervisor, and the Money Laundering Regulations still mean what they meant on Friday.
Cyber law, and the standards shifting underneath
In September 2026, the Cyber Security and Resilience Bill had just finished its Lords committee stage. It's a proposal, not law yet, and its scope isn't settled. Keep an eye on it, but don't plan around a guess.
Standards are changing too, though none of this is law. The deadline to move accredited ISO/IEC 27001 certificates to the 2022 version passed on 31 October 2025. That was a deadline for certification, not a legal duty to get certified. ISO published ISO/IEC 42005, on assessing AI's impact, in 2025.
In February 2026, the Government decided not to publish AI Management Essentials. It said it would create basic guidance instead, to help SMEs set up rules for how they use AI. The Government still hadn't published that guidance as at 27 September 2026. NIST says it's revising its AI Risk Management Framework.
Three diary entries for this week
- Registration. Check which group you're in, or make sure you already have an agent services account.
- MTD. List the clients whose 2025–26 qualifying income is over £30,000.
- EU work. If it matters to you, book a scoping call now. Some AI Act duties already apply, and the Annex III date is 2 December 2027.
Part 1 covers the rules that already apply. Part 3 shows what good looks like, with five things you can do this quarter.