The Change Desk

A dated log of AI price changes, metered billing, default settings, laws and security fixes, with who it affects and what to do about each.

Checked October 9, 2026.

December 2, 2027 (coming): EU AI Act high-risk rules start, after the AI Omnibus moved the date. The AI Omnibus, in force since July 27, 2026, moved the EU AI Act's high-risk rules (such as AI used for hiring or credit decisions) to Dec 2, 2027. AI built into regulated products follows on Aug 2, 2028. Who: Businesses that use AI for hiring, credit or similar decisions about people in the EU. What to do: List any AI you use to decide about EU workers or customers, and name a trained person to oversee each one before Dec 2, 2027.
October 1, 2027 (coming): Connecticut: written notice before AI-assisted job decisions. The main duty of Connecticut PA 26-15 starts: employers must give written notice before AI helps make hiring, promotion, discipline or firing decisions, and tell people when they are chatting with an AI hiring tool unless it is obvious. Who: Employers with staff or applicants in Connecticut that use AI in job decisions. What to do: Draft the notice now and add it to your hiring and HR process before Oct 1, 2027.
July 1, 2027 (coming): Utah's AI Policy Act is set to end unless Utah extends it. Utah's Artificial Intelligence Policy Act, which requires businesses to answer truthfully when asked if a customer is talking to AI, is set to expire on July 1, 2027. Who: Businesses that use AI chat or voice with Utah consumers, especially licensed professions. What to do: Keep your AI disclosure in place and check in spring 2027 whether Utah extended the law.
July 1, 2027 (coming): Nebraska and Idaho chatbot safety laws start; customer service bots excluded. Nebraska LB 525 and Idaho SB 1297 take effect for public AI chat services that go beyond customer service: AI disclosure, a self-harm response plan and protections for minors. Bots used only for customer service or business operations are excluded. Who: Businesses offering a public AI chat service to people in Nebraska or Idaho that does more than customer service. What to do: Confirm your chatbot sticks to customer service and product questions, and write that scope down.
July 1, 2027 (coming): California: no firing or discipline based only on an automated system. SB 947 takes effect. Employers can't rely only on AI or similar software to discipline or fire someone. If they rely mainly on it, a person must corroborate the decision with other facts, and the worker gets a written notice with a human contact. $500 civil penalty per violation. Who: Employers with California workers who use software that scores, flags or ranks staff performance or conduct. What to do: Write a one-page review step: who checks an AI flag, what other facts they look at, and the notice the worker receives.
March 1, 2027 (coming): Gemini Gems stop working for Workspace business accounts; Skills replace them. Google is replacing Gems with Skills, reusable instructions for Gemini. Skills roll out in Workspace from Oct 5, 2026 and in the Gemini app from Oct 13. Gems move to Settings on Nov 17, and no sooner than March 1, 2027 business and enterprise users can no longer create, edit or use them. Who: Google Workspace businesses whose staff built Gems for proposals, replies or meeting notes. What to do: List your team's Gems now and rebuild the ones worth keeping as Skills before March 2027.
February 26, 2027 (coming): OpenAI shuts down whisper-1 and gpt-4o transcription models. OpenAI will shut down whisper-1, gpt-4o-transcribe, gpt-4o-mini-transcribe and gpt-4o-transcribe-diarize on Feb 26, 2027. The replacements are gpt-live-transcribe and gpt-transcribe. Who: Businesses whose call-recording, dictation or meeting-notes tools call these OpenAI models directly or through a vendor. What to do: Ask your developer or vendor which transcription model your tools use and schedule the switch before February 2027.
January 20, 2027 (coming): OpenAI retires its older realtime and audio models used by voice agents. OpenAI will shut down gpt-realtime, gpt-audio, gpt-4o-audio, gpt-4o-realtime and their variants on Jan 20, 2027. Replacements include gpt-realtime-2.1 and gpt-audio-1.5. Who: Businesses running an AI phone receptionist or voice agent built on OpenAI's realtime models. What to do: Ask your voice-agent vendor or developer to move to the replacement models and test calls before January 2027.
January 1, 2027 (coming): Colorado's automated decision law (SB 26-189) takes effect. Colorado SB 26-189 replaced the 2024 AI Act. When AI materially influences a major decision about a person (job, housing, loan, insurance, education, health care), you must tell them first, explain adverse outcomes within 30 days, allow correction and human review, and keep records three years. There is no small-business exemption. Who: Businesses doing business in Colorado that let AI influence hiring, lending, housing, insurance or similar decisions. What to do: List every tool that scores or screens people, then set up notices, a 30-day explanation step and a human review path before Jan 1, 2027.
January 1, 2027 (coming): Colorado chatbot safety law (HB 26-1263) takes effect. Colorado HB 26-1263 requires public AI chatbots to disclose they are AI, estimate users' ages and protect minors, keep a self-harm response plan, and file an annual report. Proposed rules exempt simple menu bots and staff-only tools. Who: Businesses with an AI chatbot the public in Colorado can use. What to do: Add a clear 'you are chatting with AI' notice to your website bot and check whether the final rules exempt it.
January 1, 2027 (coming): California's automated decision-making rules under the CCPA take effect. California's CPPA rules require a notice before AI makes or replaces human decisions on jobs, lending, housing, education or health care, an opt-out or human appeal, and answers about how the AI decided. Who: Businesses covered by the CCPA (over $26.6M revenue, or data on 100,000+ Californians) that use AI in those decisions. What to do: Check whether the CCPA covers you and, if so, write the pre-use notice and appeal process before Jan 1, 2027.
January 1, 2027 (coming): California requires labels on AI performers in ads, audio included. California SB 1050, signed Sept 16, 2026, requires a clear label when an ad reaching California shows or voices a human-like AI performer who is not a real person. Audio-only ads are covered. Who: Businesses whose video, social or radio ads reach California and use AI-generated people or voices. What to do: Ask your agency to list which ads use synthetic performers and add the disclosure before Jan 1, 2027.
January 1, 2027 (coming): Oregon and Washington companion-chatbot laws start; business bots excluded. Oregon SB 1546 and Washington HB 2225 require AI disclosure, self-harm referral and protections for minors, but only for chatbots built as ongoing companions. Customer service and business bots are excluded. Who: Businesses with chatbots used by people in Oregon or Washington (most business bots fall outside these laws). What to do: Confirm your chatbot is limited to customer service and keep a one-line record of that scope.
January 1, 2027 (coming): California layoff notices must say when AI caused the job cuts. SB 951 adds to Cal/WARN. When a covered layoff, relocation or closing is caused in whole or in large part by AI or automation, the notice must say "This notice is for a technology displacement" and list the jobs, the functions being automated and the type of technology. The state will publish the notices. Who: California sites with 75 or more employees that file a Cal/WARN notice. What to do: If automation is part of a restructuring plan, involve whoever drafts your WARN notices early so the disclosure is accurate.
January 1, 2027 (coming): California bans AI tools that read workers' emotions. AB 1883 takes effect. Employers may not use AI-powered monitoring tools to recognize or predict employees' emotional states, or to collect neural data. Limited exceptions cover safety and federal requirements. Up to $500 per violation; no size threshold. Who: Employers with California workers who use call-center analytics, video interview or meeting tools, wearables or other monitoring software. What to do: Ask your call, video and HR software vendors whether any feature scores mood, stress or sentiment of employees, and turn it off for California staff.
December 31, 2026 (coming): Copilot Business $18 promo and the Business Basic bundle promo end. Microsoft 365 Copilot Business is $18/user/month on a 15% promo, and Business Basic plus Copilot Business is $21/user/month on a 25% promo, both through December 2026 (1-300 licenses, annual terms). List price for Copilot Business is $21. Who: Businesses on Microsoft 365 Business Basic, Standard or Premium weighing Copilot. What to do: Decide before December whether to lock in a year at the promo price, and budget the list price for the renewal after.
December 1, 2026 (coming): New Copilot Business licenses from partners come with pay-as-you-go turned on. From Dec 1, 2026 (moved from Nov 2), new Microsoft 365 Copilot Business licenses bought through a Microsoft partner (CSP), including bundles, have usage-based billing on by default, so metered services such as Copilot Cowork work without extra setup. The default limit is 4,000 Copilot Credits per user per month, about $40 at $0.01 each. Not yet in some markets. Who: Businesses that buy Copilot Business, or Business Standard or Premium with Copilot, through an IT partner. What to do: Before you buy, decide your real monthly limit and have it set in Microsoft 365 admin center > Copilot > Cost management. 100 users at the default could reach $4,000 a month.
November 30, 2026 (coming): OpenAI shuts down Agent Builder and reusable prompts. OpenAI will shut down Agent Builder and reusable prompts on Nov 30, 2026. The Evals platform goes read-only Oct 31 and shuts down the same day. Replacements are the Agents SDK or ChatGPT Workspace Agents. Who: Businesses or IT partners that built agents in OpenAI's Agent Builder or store prompts on OpenAI's platform. What to do: Export or rebuild any Agent Builder agent and copy stored prompts into your own files before Nov 30, 2026.
November 1, 2026 (coming): AI Builder credits end; Power Automate AI steps move to Copilot Credits. AI Builder capacity add-ons can no longer be renewed or bought, and new premium licenses stop including seeded AI Builder credits. There is no automatic conversion; once AI Builder credits run out, AI steps use Copilot Credits or are blocked. Who: Businesses with Power Automate or Power Apps flows that read invoices, forms or documents with AI Builder. What to do: List flows that use AI Builder and set up Copilot Credits with a spending limit before your credits or contract run out.
October 26, 2026 (coming): Colorado holds a hearing on its draft AI decision and chatbot rules. The Colorado attorney general proposed rules for SB 26-189 and the chatbot law, including exemptions for simple menu bots; a hearing is set for Oct 26, 2026. The final rules may set how often chatbots must disclose. Who: Businesses preparing for Colorado's Jan 1, 2027 AI laws. What to do: Read the final rules after the hearing before you finish your Colorado notices.
October 1, 2026: ChatGPT for Word turns on by default. OpenAI's ChatGPT add-in for Word, usable on every plan including Free, is set to be enabled by default from Oct 1, 2026. Workspace admins can turn it off in the ChatGPT admin console, and Microsoft 365 admins still control whether the add-in can be installed. Who: Businesses on Microsoft 365 whose staff use ChatGPT, including personal free accounts. What to do: Decide which AI assistant is allowed in Word, then set the ChatGPT workspace setting and the Microsoft 365 add-in policy to match.
October 1, 2026: Connecticut layoff notices must say whether AI played a role. From Oct 1, 2026, any Connecticut layoff (WARN) notice must state whether AI played a role in the decision. Using AI is no defense to a discrimination claim. Who: Employers with staff in Connecticut who file a layoff notice. What to do: Add an AI-role statement to your layoff notice template now.
September 30, 2026: California's governor signs the No Robo Bosses Act (SB 947). On Sept 30, 2026 the governor signed SB 947, reversing his 2025 veto of an earlier version. It bars employers from relying only on automated systems to fire or discipline workers and requires a person to corroborate the decision. It starts July 1, 2027. Who: Employers with California workers who use software that scores, flags or disciplines staff. What to do: List any software that scores, flags or disciplines your California staff, and plan a human review step before July 1, 2027.
September 29, 2026: Meta launches Muse for Small Business: free, with $20 and $100 monthly plans. Meta's Muse agent gained business skills and connectors to tools such as QuickBooks, Shopify, Stripe, Canva, Slack and Dropbox, plus Facebook and Instagram business pages and ad accounts. Most use is free; paid plans are $20 and $100 a month, per person, billed monthly. Who: Owners who run their marketing on Facebook and Instagram and are tempted to connect their books and payments too. What to do: Connect your social pages first. Leave accounting, payments and email off until you have watched it work for a few weeks.
September 25, 2026: Copilot spending policies add new metered services automatically. Microsoft's admin guide says 'Auto-apply new services' is on by default in Copilot Credit spending policies, so newly supported agents and services join a policy as they arrive. 'Don't limit monthly spending' is one of the setup options. Who: Businesses that turned on usage-based billing for Copilot Cowork or other Copilot Credit services. What to do: Open Microsoft 365 admin center > Copilot > Cost management and set a monthly limit, a per-user limit and alerts, and turn off auto-apply if you want to approve new services.
September 24, 2026: SalesBleed: hidden text in web lead forms hijacked Agentforce agents. Researchers showed that instructions hidden in a Salesforce Web-to-Lead form could make an Agentforce agent leak CRM data with no clicks, or post phishing messages in Slack. Salesforce fixed all three flaws by Sept 21, 2026. Who: Businesses that let any AI agent read what strangers type into website forms, email or chat, on Salesforce or elsewhere. What to do: Limit what data an agent that reads outside input can reach, and require approval before it sends messages.
September 22, 2026: Claude Opus 5.5 released at $4 input / $20 output per million tokens. Anthropic released Claude Opus 5.5 on Sept 22, 2026, priced at $4 per million input tokens and $20 per million output tokens on the API. Anthropic lists its earliest retirement as no sooner than Sept 22, 2027. Who: Businesses whose custom apps, chatbots or voice agents call Claude Opus through the API. What to do: Rerun your own test prompts on Opus 5.5 and switch the model ID if results hold, then compare the bill.
September 15, 2026: Claude for Small Business waits for approval before it sends, posts or pays. Anthropic's Claude for Small Business update added workflows and integrations, with approval on by default: Claude does the work and waits for your approval before anything sends, posts or pays. It is available on every paid Claude plan. Who: Businesses on paid Claude plans, including Claude Team, that connect it to QuickBooks, email or other tools. What to do: Keep approval on for anything that sends, posts or pays until you have checked a few weeks of its work.
September 10, 2026: Microsoft warns of an AI-built fake-CEO invoice scam sent to 1M+ inboxes. Between Aug 3 and 5, 2026, attackers sent more than a million emails posing as company CEOs and asking accounts payable for ACH payments of about $50,000, with fake invoices and forged threads. Microsoft saw signs the templates were built with generative AI. Who: Any business where staff can pay invoices or change vendor bank details. What to do: Require a phone callback to a known number before any new payee, bank change or urgent CEO payment request.
September 8, 2026: Google: stolen Claude and Gemini accounts are in high demand. Google's threat group found more buyers and sellers of stolen AI accounts in 2026, with average prices more than doubling. Infostealer malware now grabs the files where coding tools such as Cline and Continue keep API keys in plain text. The Financial Times reported listings offering access at discounts of up to 97%, and Okta traced a reseller that proxies traffic and can read every prompt. Who: Businesses that pay for AI accounts or API keys, especially if anyone codes or automates with them. What to do: Set a monthly spending limit and usage alert on every AI account, and rotate any API key stored in a plain-text file.
September 4, 2026: Google Assistant removed from Android phones; Gemini replaces it. From Sept 4, 2026, Google began removing Google Assistant from Android phones, tablets, Wear OS watches, headphones and Android Auto, replacing it with Gemini over a few weeks. There is no switching back; cars with Google built-in, Google TV and Home speakers are not covered. Who: Businesses whose staff use voice commands on company Android phones or in Android Auto. What to do: Test the voice routines field staff rely on (calls, navigation, reminders) with Gemini on a company phone.
August 26, 2026: OpenAI's Assistants API shut down. OpenAI shut down the Assistants API on Aug 26, 2026, one year after announcing it. The replacements are the Responses API and Conversations API. Who: Businesses with a custom chatbot or internal tool built on OpenAI's Assistants API. What to do: Confirm with your developer or vendor that your chatbot was moved to the Responses API and still works.
August 10, 2026: ChatGPT Business adds a $100 premium seat. ChatGPT Business added premium seats at $100/user/month billed annually or $125 monthly, with 5x the usage of a standard seat and no 5-hour limit. Standard seats stay $20 annually or $25 monthly, and seat types can be mixed. Who: Businesses on ChatGPT Business with a few heavy users. What to do: Give premium seats only to people who hit usage limits, and keep everyone else on standard.
August 5, 2026: Claude Opus 4.1 retired on the Claude API. Anthropic retired claude-opus-4-1-20250805 on Aug 5, 2026; requests to it now fail. The recommended replacement is claude-opus-4-8. Who: Businesses whose custom apps or vendor tools called Claude Opus 4.1 through the API. What to do: Check your API usage export for Opus 4.1 calls and confirm every app now points to a current model.
August 2, 2026: EU AI Act transparency rules (Article 50) apply. From Aug 2, 2026, people in the EU must be told when they are talking with AI, and realistic AI images, audio and video must be labeled. The rules apply to non-EU companies too. Who: Businesses with EU customers who chat with an AI or see AI-made content from them. What to do: Add an AI notice to any chatbot EU customers can reach and label realistic AI images or video in your marketing.
August 1, 2026: Copilot in 30: a free 25-user, 30-day Copilot Business trial via partners. Microsoft's Copilot in 30 offers businesses under 300 employees a 25-user, 30-day Microsoft 365 Copilot Business trial through CSP partners, available from Aug 1, 2026. Who: Businesses under 300 employees on Microsoft 365, and the IT partners that sell to them. What to do: Ask your Microsoft partner for the trial and pick two or three real tasks to measure before buying seats.
July 1, 2026: Microsoft 365 Business Basic and Standard prices rise. From July 1, 2026, Business Basic rose from $6.00 to $7.00 and Business Standard from $12.50 to $14.00 per user/month (with Teams). Business Premium stayed at $22.00. Plans gained 50 GB more email and Copilot Chat enhancements. Who: Businesses on Microsoft 365 Business Basic or Business Standard, at their next renewal. What to do: Check your renewal quote for the new price and compare it with the with-Copilot bundles before you renew.
July 1, 2026: Microsoft 365 Business Standard and Premium with Copilot become permanent plans. Microsoft 365 Business Standard with Copilot ($23.50/user/month) and Business Premium with Copilot ($32/user/month) became generally available July 1, 2026, on annual terms with a 300-license maximum. Who: Businesses with up to 300 users on Business Standard or Premium. What to do: Price the bundle against your current plan plus a Copilot Business add-on before your next renewal.
June 16, 2026: Copilot Cowork goes live, billed per use in Copilot Credits. Copilot Cowork, an agent that carries out multi-step work, became generally available June 16, 2026. It needs a Microsoft 365 Copilot license and bills per use at $0.01 per Copilot Credit; tenants that tried it in the Frontier program were not billed until July 1, 2026. Who: Businesses with Microsoft 365 Copilot or Copilot Business seats. What to do: Set a monthly spending limit before anyone uses Cowork, and have users type /cost to see what a task used.
June 15, 2026: Claude Sonnet 4 and Opus 4 retired on the Claude API. Anthropic retired claude-sonnet-4-20250514 and claude-opus-4-20250514 on June 15, 2026. Replacements are claude-sonnet-4-6 and claude-opus-4-8. Bedrock and Google Cloud set their own dates. Who: Businesses whose apps or vendor tools called Claude Sonnet 4 or Opus 4 through the API. What to do: Check your API usage export and confirm your tools moved to a current model.
June 9, 2026: New York requires disclosure of AI performers in ads. From June 9, 2026, ads in New York that knowingly show a human-like AI performer who is not a real person must clearly disclose it. Fines are $1,000 for a first violation and $5,000 after. Who: Businesses whose ads reach New York and use AI-generated people. What to do: Ask your agency to flag every ad with a synthetic performer and add the disclosure.
June 1, 2026: GitHub Copilot moves to usage-based AI Credits. From June 1, 2026, GitHub Copilot Business ($19/user/month) includes $19 of AI Credits per user, pooled; chat and agent sessions draw credits by tokens, while code completions use none. Admins can cap or allow usage past the pool. Who: Businesses that pay for GitHub Copilot for staff or contractors who write code. What to do: Set budgets at the organization and user level and decide whether usage past the included pool is allowed.
May 1, 2026: CISA and Five Eyes: start AI agents on low-risk tasks with limited access. CISA, the NSA and international partners published guidance on adopting agentic AI: restrict what agents can access, start with low-risk, non-sensitive tasks, and include agents in security planning. Who: Businesses turning on AI agents in email, accounting, CRM or phone systems, and their IT partners. What to do: Start each new agent on one low-risk task with read-only or narrow access, and widen it only after review.
April 20, 2026: All Claude 3-series models are now retired. Anthropic retired Claude Opus 3 (Jan 5, 2026), Claude Sonnet 3.7 and Haiku 3.5 (Feb 19, 2026) and Claude Haiku 3 (Apr 20, 2026). Requests to these models fail. Who: Businesses running older chatbots, scripts or vendor tools built on Claude 3-series models. What to do: Ask your developer or vendor to confirm no tool still calls a Claude 3 model.
April 14, 2026: HubSpot agents now bill per result: $0.50 per resolved chat, $1 per lead. From April 14, 2026, HubSpot's Customer Agent costs 50 credits ($0.50) per conversation it resolves, down from $1.00 per conversation, and Prospecting Agent costs 100 credits ($1.00) per lead recommended, replacing a monthly charge per enrolled contact. Who: Businesses on HubSpot Starter, Professional or Enterprise using Breeze agents. What to do: Set feature-level credit limits and alerts in HubSpot, since overage is pay-as-you-go by default.
February 18, 2026: Copilot Chat bug summarized emails marked confidential. From January 2026, Microsoft 365 Copilot Chat processed draft and sent emails carrying a confidential label despite data-loss policies. Microsoft began rolling out a fix in early February (tracked as CW1226324). Who: Businesses on Microsoft 365 that use sensitivity labels to keep email away from Copilot. What to do: Check message CW1226324 in your admin center and test that labeled email stays out of Copilot answers.
February 13, 2026: GPT-4o and other older models removed from ChatGPT. OpenAI retired GPT-4o, GPT-4.1, GPT-4.1 mini and o4-mini from ChatGPT on Feb 13, 2026. Business, Enterprise and Edu workspaces kept GPT-4o in custom GPTs until April 3, 2026. The API was not affected at the time. Who: Businesses on ChatGPT Business with custom GPTs built around GPT-4o. What to do: Retest your custom GPTs on the current default model and fix any that changed behavior.
January 1, 2026: Illinois: tell workers when AI is used in job decisions. Illinois HB 3773 took effect Jan 1, 2026 for employers with 1+ employees in Illinois: AI used in hiring, promotion, discipline or firing must not discriminate, ZIP codes cannot stand in for protected traits, and workers must be told. The state paused its notice rules in June 2026 with no new timeline. Who: Employers with any staff or applicants in Illinois who use AI in job decisions. What to do: Tell applicants and staff where AI is used in hiring and HR, even while the notice rules are paused.
January 1, 2026: Texas Responsible AI Governance Act (TRAIGA) takes effect. Texas TRAIGA took effect Jan 1, 2026. For most businesses it bans intentionally discriminatory or harmful uses of AI; health care providers must also tell patients when AI is used in their care. Only the attorney general enforces it, after a 60-day cure period. Who: Businesses serving Texans that use AI, with extra duties for health care providers. What to do: If you provide health care in Texas, add an AI-use notice to patient intake materials.
January 1, 2026: California limits shared pricing algorithms that use competitors' data. California AB 325 took effect Jan 1, 2026. It bars using or pushing shared pricing software that draws on competitors' data to align prices, and makes such antitrust suits easier to bring. Tools that use only your own data are not covered. Who: Businesses that set prices in California with software other businesses also use, such as rent or rate-setting tools. What to do: Ask your pricing software vendor whether its recommendations use competitors' data.
January 1, 2026: California CCPA risk assessments required for AI decision-making. Under the CPPA's regulations, businesses covered by the CCPA have had to do written risk assessments since Jan 1, 2026 for certain uses, including AI that makes significant decisions about people. The notice and opt-out duties follow on Jan 1, 2027. Who: Businesses covered by the CCPA (over $26.6M revenue, or data on 100,000+ Californians) that use AI on personal data. What to do: Write a short risk assessment for each AI tool that makes decisions about California consumers or staff.