THE 10 BIG THINGS “GOING LIVE” IN 2026 THAT MOST COMPANIES ARE NOT READY FOR (AND HOW TO HANDLE THEM)

Going into 2026, a bunch of changes stop being “future policy noise” and turn into real operational risk: taxes reset automatically, negotiated drug prices hit claim flows, privacy rules force new notices and assessments, and the EU starts charging money at the border for embedded carbon. Below are 10 changes with clear effective dates in 2026 (or deadlines during 2026), why they matter, and what a practical company response looks like.

THE U.S. TAX CLIFF: TCJA INDIVIDUAL PROVISIONS SUNSET AFTER DECEMBER 31, 2025

What it is: Many individual-facing provisions of the 2017 Tax Cuts and Jobs Act are scheduled to expire at the end of 2025, meaning tax rules generally revert in 2026 unless Congress changes them.
(Thomson Reuters Tax)

Pros:

• Employees may suddenly care a lot more about withholding, benefits, and total comp structure, which can be a moment to improve financial wellness.
• Some companies can use it as a forcing function to simplify messy payroll and benefits communications.

Cons:

• Employee take-home pay expectations can get weird fast (withholding surprises, bonus timing angst, benefit election confusion).
• Comp and retention pressure rises if employees perceive they “lost money” even when the company did nothing.

Solution for companies:

• Run a “2026 paycheck impact” simulation for common employee profiles (single, married, dependents, high earners, sales with bonuses).
• Update payroll/HR comms: plain-English guidance on W-4 checkups, bonus withholding, and benefit elections in Q4 2025.
• For executives and sales-heavy orgs, pre-brief on bonus timing, equity exercises, and 83(b) planning with your tax counsel, without giving personal tax advice.

MEDICARE NEGOTIATED DRUG PRICES TAKE EFFECT JANUARY 1, 2026

What it is: CMS’s first set of negotiated Maximum Fair Prices for 10 Medicare Part D drugs takes effect January 1, 2026.
(Centers for Medicare & Medicaid Services)

Pros:

• Lower out-of-pocket costs can improve adherence and outcomes for affected populations.
• Plan sponsors and PBMs get a major pricing anchor for specific therapies.

Cons:

• Manufacturers face pricing pressure, contracting rewrites, and potential spillover into commercial negotiations.
• Providers, specialty pharmacies, and patient support programs may need new workflows as utilization and benefit design shift.

Solution for companies:

• If you are pharma/biotech: build a 2026 contracting playbook for Medicare spillover, copay support redesign, and field messaging guardrails.
• If you are an employer plan sponsor: model claims impact, revisit formulary strategy, and prep employee communications on what changes and what does not.
• If you are a healthcare operator: update prior auth playbooks, patient financial counseling scripts, and pharmacy coordination for the impacted molecules.

CALIFORNIA PRIVACY RULES: AUTOMATED DECISIONMAKING, CYBERSECURITY AUDITS, AND RISK ASSESSMENTS EFFECTIVE JANUARY 1, 2026

What it is: The California Privacy Protection Agency’s finalized CCPA/CPRA updates covering automated decisionmaking technology, cybersecurity audits, and risk assessments have an effective date of January 1, 2026.
(California Privacy Protection Agency)

Pros:

• For disciplined operators, this can become a competitive advantage: cleaner data mapping, more defensible AI/automation, better security posture.
• Reduces “shadow AI” inside HR, finance, and growth teams when you force documentation.

Cons:

• Compliance is not just legal text: it requires inventorying systems, decisioning logic, vendors, and data flows.
• Regulatory exposure rises fast if you use automation in employment, lending/financing, housing, education, or healthcare decisions.

Solution for companies:

• Make a single inventory: every system that makes or materially influences a “significant decision” about a consumer or employee, and what data it uses.
• Publish a simple internal rule: no new automated decisioning without a review that covers notice, opt-out where applicable, and risk assessment triggers.
• Contract action: update vendor DPAs and security addenda to require support for audits, risk assessments, and consumer requests.

CALIFORNIA CLIMATE FINANCIAL RISK REPORTS DUE JANUARY 1, 2026 (BUT LEGAL STATUS IS IN FLUX)

What it is: SB 261 requires covered companies to publish a climate-related financial risk report by January 1, 2026, and every two years thereafter, but an appeals court has paused the law’s start. This is exactly the kind of “might unpause suddenly” compliance trap.
(Wilson Sonsini)

Pros:

• If you do it well, it strengthens investor confidence, insurance conversations, and enterprise customer trust.
• For operational teams, it forces alignment on real physical and transition risks.

Cons:

• Costly if you try to do it from scratch in December.
• Legal uncertainty tempts companies to do nothing, which is risky if timing snaps back.

Solution for companies:

• Prepare a “pause-proof” draft: do the core materiality and scenario work now, so you can publish quickly if required.
• Align to a recognized framework (many companies use TCFD-style structure) and keep it decision-useful, not marketing.
• Assign an owner: CFO or GC must co-own, because it touches disclosure risk and financial planning.

CALIFORNIA SCOPE 1 AND 2 EMISSIONS DISCLOSURE DEADLINE IN 2026

What it is: SB 253 requires in-scope companies to disclose Scope 1 and Scope 2 greenhouse gas emissions, with first reporting timelines landing in 2026.
(Harvard Law School Forum on Corporate Governance)

THE EU CARBON BORDER ADJUSTMENT MECHANISM (CBAM) ENTERS ITS “PAY MONEY” PHASE IN 2026

What it is: CBAM moves into its definitive regime from 2026, requiring EU importers of covered goods to purchase CBAM certificates reflecting embedded emissions.
(European Commission – Taxation and Customs Union)

THE EU AI ACT BECOMES “REAL COMPLIANCE” ON AUGUST 2, 2026

What it is: The EU AI Act has a general date of application of August 2, 2026.
(European Parliament)

THE EU DEFORESTATION REGULATION (EUDR) IS NOW SET TO APPLY ON DECEMBER 30, 2026 FOR LARGE AND MEDIUM OPERATORS

What it is: The EU has approved a one-year delay; large companies must comply starting December 30, 2026.
(Reuters)

TSA “CONFIRM.ID” FEE STARTS FEBRUARY 1, 2026 FOR TRAVELERS WITHOUT REAL ID

What it is: TSA plans a $45 fee beginning February 1, 2026 for travelers who do not present a REAL ID or acceptable alternative.
(People.com)

CMS’S “GLOBE” MEDICARE PART B DRUG PRICING PILOT STARTS OCTOBER 1, 2026

What it is: CMS announced the GLOBE pilot program launching October 1, 2026.
(Reuters)

CLOSING PLAYBOOK: HOW TO HANDLE 2026 WITHOUT LOSING YOUR MIND

First, set up one cross-functional “2026 Effective Dates” calendar owned by Legal plus Finance, with operational owners per item.
Second, do not treat these as memos. Each item needs a system change, a contract change, or a workflow change.
Third, build a single evidence folder per topic: policies, assessments, vendor terms, and decision logs. That is what saves you in audits, disputes, and enforcement.