How the acts take effect
| When | What happens | Source |
|---|---|---|
| On enactment | The state may immediately establish and staff the Data Trusteeship Authority, begin rulemaking, develop FCGIAS implementation materials, run inventories and conformance assessments, revise procurement, and train staff. | PDTA §28(b); VIDA §33(b); GAAFA §43(b) |
| Effective date (bracketed at 180 days) | Transactional duties apply: no unauthorized access, disclosure or secondary use, no purpose laundering or retaliation. New systems and new structural capability must conform. New or materially expanded AI systems must meet GAAFA's immediately applicable requirements. | PDTA §28(a), (c), (d); GAAFA §40(c) |
| Transition period | Existing systems are inventoried and classified, and agencies submit remediation plans with milestones and dates for removing or narrowing prohibited capability. A limited legacy safe harbor delays structural remediation only. | PDTA §28; VIDA §30; GAAFA §40 |
A transition period never creates authority. No legacy system, model, contract or commercial service acquires governmental informational authority merely because it existed before enactment.
What agencies do first
- Stop expansion. No new integrations or data-sharing arrangements that create prohibited capability.
- Inventory. Every system holding personal information: sources, integration points, who can reach what, under which authority, including administrators, vendors and AI agents.
- Classify and prioritize. Identify capability that exceeds authority, starting with systems that affect the most people or pose the greatest risk.
- Pilot. Holder-controlled credentials, sequestered stores and query-without-collection in limited settings.
- Change procurement. Apply the model procurement specification to every new solicitation.
Fiscal considerations
A formal fiscal note depends on each state's systems, but the main drivers are predictable:
- Oversight. Staffing the Data Trusteeship Authority with fiduciary, identity-architecture and AI expertise.
- Assessment. Inventories and conformance assessment of existing systems.
- Records. Access logging and audit infrastructure sufficient for review.
- Remediation. Scheduled into existing replacement cycles wherever possible, so that most cost falls on specifications rather than new projects.
Offsetting savings come from smaller breach exposure, fewer duplicative data stores, and avoiding the cost of building surveillance-capable systems only to retrofit them later. Funding sources and penalty amounts are bracketed for each legislature.
An illustrative five-year path
Data Lakes Are a Choice sets out an example timeline that a state can adapt: year one for a moratorium on new integrations, inventories and pilots; years two and three for Zero Trust deployment, credential expansion and initial sequestration; years four and five for completing sequestration and retiring legacy integrations. Read the paper. Its statutory deadlines refer to earlier drafts; Version 2.2 uses the framework above.