What's changing in web development
Regulations, standards, and platform changes that affect your website. What already happened, what's coming next, and what it means for your business.
Colorado AI Act takes effect
The first comprehensive US state AI law requires risk management policies, bias audits, impact assessments, and consumer notification when AI makes consequential decisions. Applies to any business using AI for hiring, lending, insurance, or housing decisions affecting Colorado residents. Penalties reach $20,000 per violation per affected consumer. Following the NIST AI Risk Management Framework provides an affirmative defense.
EU AI Act high-risk system requirements
High-risk AI systems must meet conformity assessments, technical documentation, and EU database registration requirements. This applies to AI used in hiring, creditworthiness, insurance, education, and essential services. Prohibited practices and general-purpose AI obligations are already enforced. Businesses using AI for consequential decisions affecting EU users should begin compliance preparations now.
Chrome moves to HTTPS-only by default
Chrome will attempt HTTPS for all connections starting with Chrome 154. Users visiting HTTP-only sites will see a full-page warning and must explicitly click through. Phase 1 (April 2026) already affects Enhanced Safe Browsing users — over 1 billion people. Sites without HTTPS should migrate immediately using free certificates from Let's Encrypt and set up 301 redirects from HTTP to HTTPS.
ADA Title II web accessibility deadline (extended to 2027)
State and local government entities with populations of 50,000+ must meet WCAG 2.1 AA by April 26, 2027, following the DOJ's April 20, 2026 Interim Final Rule that extended the original April 24, 2026 deadline by one year. Smaller public entities have until April 26, 2028. The DOJ cited overestimating the staffing and technology capabilities of covered entities. Private-sector ADA exposure, EAA compliance, and rising Title III lawsuit volume are unchanged by the extension.
Learn moreADA Title II digital compliance deadline (extended)
April 24, 2026 was the original ADA Title II web accessibility compliance date for state and local government entities with populations of 50,000+. On April 20, 2026, the DOJ published an Interim Final Rule extending the deadline by one year (now April 26, 2027) and pushing smaller public entities to April 26, 2028. The underlying framework still stands: WCAG 2.1 AA, enforced by DOJ. Private-sector ADA exposure, EAA compliance, and rising Title III lawsuit volume are unchanged by the extension.
Learn moreGoogle March 2026 core update
This update explicitly evaluates "information gain" — how much genuinely new information a page contributes compared to existing top results. AI content farms lost 60-80% of traffic, and affiliate sites had a 71% negative impact rate. Pages that simply rephrase existing content without original data, first-hand experience, or unique perspectives lost ground significantly.
Google AI Overviews reshape organic search
Google upgraded AI Overviews to Gemini 3, now appearing in roughly 48% of all queries. Organic click-through rates dropped 61% on queries where AI Overviews appear. Zero-click searches rose to 56-69% overall. Website owners should structure content for AI citation with clear headings and factual paragraphs, implement schema markup, and diversify traffic sources beyond Google organic.
US state privacy laws expand to 19 states
Indiana, Kentucky, and Rhode Island joined the growing list of states with comprehensive consumer privacy laws, bringing the total to 19. Twelve states now legally require businesses to honor Global Privacy Control (GPC) opt-out signals. Website owners serving users in these states must implement cookie consent mechanisms, honor opt-out signals, and keep privacy policies current with each new state law.
Google December 2025 core update
Google's third core update of 2025 expanded E-E-A-T requirements beyond health and finance to all competitive searches. Page experience signals gained more weight — sites with LCP above 3 seconds lost 23% more traffic than faster competitors. E-commerce and affiliate sites saw the steepest drops. Strong author bylines, first-hand expertise, and fast load times are now essential across all niches.
WCAG 2.2 becomes ISO standard
WCAG 2.2 was approved as ISO/IEC 40500:2025, replacing WCAG 2.1 as the international accessibility standard. The update adds 9 new success criteria including minimum target sizes (24x24 CSS pixels), focus appearance, and accessible authentication without cognitive tests. Organizations subject to ISO-referenced regulations should review these new criteria and work toward meeting them.
European Accessibility Act
The EAA requires digital products and services sold to EU customers to meet accessibility standards, regardless of where the business is based. This applies to e-commerce, banking, media, and public services. US-based businesses selling to EU markets are in scope.
Google March 2025 core update
Google's core update adjusted ranking signals with continued emphasis on content quality, E-E-A-T (experience, expertise, authoritativeness, trustworthiness), and user experience. Sites with thin content, poor Core Web Vitals, or aggressive ad placement saw the largest negative impact.
FTC fines accessiBe $1M for deceptive claims
The FTC required accessiBe to pay $1 million for falsely claiming its AI overlay widget could make any website WCAG-compliant. The ruling found the tool failed to make menus, headings, tables, and images accessible. This sets a precedent for the entire overlay industry. Automated tools catch at most 25-57% of accessibility issues — proper remediation requires semantic HTML, manual testing, and expert audits.
WCAG 2.2 published as W3C recommendation
WCAG 2.2 added 9 new success criteria to the 2.1 standard, including focus appearance, dragging movements, and accessible authentication. While ADA Title II references WCAG 2.1, the industry is moving toward 2.2 as the practical target. New projects should build to 2.2 where feasible.
Google Interaction to Next Paint (INP) replaces FID
INP replaced First Input Delay as a Core Web Vitals metric. FID only measured the first interaction. INP measures responsiveness across all interactions during a page visit. Sites that passed FID but have slow JavaScript event handlers or heavy re-renders may now fail INP.
EU AI Act adopted
The EU AI Act establishes risk-based regulation for AI systems. High-risk AI applications (hiring, credit, law enforcement) face strict transparency and documentation requirements. General-purpose AI models must comply with transparency obligations. Businesses integrating AI into customer-facing products should understand which risk tier applies to their use case.
Need help preparing?
Whether it's a compliance deadline or a performance standard, we can help you get ahead of it. Tell us what you're working on.
Get in touch