EU post-quantum roadmap: consultation feedback, 2 September 2026
The Commission published the roadmap consultation feedback on 2 September 2026; the FAQ of 15 April 2026 answers the milestone and inventory questions.
Affected
Operators of public-sector and other critical infrastructure, including entities in scope of the NIS2 Directive, and the suppliers behind their cryptography.
Action
Start the cryptographic inventory and the quantum risk analysis now, and put the end-of-2026 first-steps milestone into the plan rather than the backlog.
Commission Recommendation (EU) 2024/1101 of 11 April 2024 asked Member States to form a
post-quantum cryptography sub-group inside the NIS Cooperation Group. It also asked for a
coordinated roadmap in two years
. The
roadmap's first part, version 1.1 of 11 June 2025, asks every Member State to implement its
First Steps, and to establish an initial national transition roadmap, before the close of
2026. High-risk use cases move by the end of 2030, medium-risk by the end of 2035, and
low-risk as far as feasible
.
On 2 September 2026 the Commission published the consultation results. That survey ran between
11 August and 29 September 2025, drawing 97 submissions
.
The FAQ of 15 April 2026 states that the milestones apply to deployment, putting standards
bodies and suppliers ahead of them. It adds that an inventory need not be finished before
planning begins. Nor must the First Steps close before the Next Steps open
.
The roadmap binds nobody, but the first-steps date is four months out and the inventory under
it is slow.
China: simplified personal information duties for small processors, in force 1 September 2026
Order No. 25 gives a processor under one hundred thousand people a five-year audit cycle, form-based impact assessments and six export exemptions.
Affected
Personal information processors in China holding the data of fewer than one hundred thousand people, and the platforms whose rules they sit under.
Action
Count the people whose data is held, then move to the annexed forms while the count stays under the threshold.
Order No. 25 of the Cyberspace Administration of China and the Ministry of Public Security
promulgated the simplified personal information protection measures for small processors on
22 July 2026, published two days later. Article 22 set them running from 1 September 2026.
Article 2 makes a small processor one that handles the personal information of fewer than one
hundred thousand people
.
Article 13 lets that processor run its compliance audit at least once every five years, on the
self-check table annexed to the rules, and keep the table for five years. Article 14 does the
same for the impact assessment, on an annexed form kept three years. Article 17 excuses the
audit while a personal information protection certification is valid
.
Article 8 goes further for a processor operating only through a network platform and sharing
outside it with nobody. Where the platform's rules cover it, and it stays inside them, it writes
no rules of its own and repeats
neither the audit nor the impact assessment. Article 10 lists six exports that skip the security
assessment, the standard contract and certification. One is fewer than a hundred thousand
people's non-sensitive data since 1 January, outside critical information infrastructure
.
The threshold is a headcount, not a turnover. It moves the moment a customer list does.
小型个人信息处理者个人信息保护简化措施规定 (Provisions on Simplified Personal Information Protection Measures for Small Personal Information Processors). 国家互联网信息办公室、公安部令第25号, adopted 26 June 2026, signed 22 July 2026, published 24 July 2026, in force 1 September 2026. https://www.cac.gov.cn/2026-07/24/c_1786638889704872.htm · accessed 2026-09-06
NIST finalised the CSF 2.0 informative references guide on 25 August 2026
NIST SP 1347 reached final status on 25 August 2026, covering what a CSF 2.0 informative reference is and which NIST tools serve the reference data.
Affected
Anyone maintaining a crosswalk between the CSF 2.0 Core and a control set, a questionnaire or a regulation.
Action
Re-source the mapping from the published reference data rather than a spreadsheet copied once, and record which release the crosswalk was built from.
NIST SP 1347, NIST Cybersecurity Framework 2.0: Informative References Quick-Start Guide,
carries a publication date of August 2026. Its publication record shows a draft on
23 March 2026 and the final on 25 August 2026
.
The abstract sets out what a reference is, and the part one plays in reaching a CSF 2.0
outcome. Three routes to the data are named: a plain download, the Reference Tool built for
CSF 2.0, and the Online Informative References Program. Two sample use cases are recorded in
the abstract, with a passage on the part artificial intelligence tooling can play in handling
reference data
.
Why that matters to a control owner is a point the framework itself makes. Informative
references are mappings between the Core and other standards, guidelines and regulations.
Some sit below a Subcategory, such as a single control from SP 800-53. Others sit above it,
such as a policy requirement touching several Subcategories at once. The online resources are
updated more often than the framework document, and are published in machine-readable form
.
That is the practical warning. A crosswalk kept as a one-off spreadsheet drifts from the
published mapping quietly, and the drift only surfaces when a customer questionnaire disagrees
with the control set.
NIST CSWP 29, The NIST Cybersecurity Framework (CSF) 2.0, section 4. National Institute of Standards and Technology, 26 February 2024. https://doi.org/10.6028/NIST.CSWP.29 · accessed 2026-09-06
China: annual network data risk assessments from 20 August 2026
Order No. 24 makes an annual risk assessment compulsory for important data processors, with the report filed within twenty working days.
Affected
Network data processors handling important data inside China, and the assessment bodies they engage.
Action
Fix the annual assessment cycle, name the owner, and settle the filing route to the competent department or the provincial cyberspace authority.
Order No. 24 of the Cyberspace Administration of China, the Ministry of Industry and
Information Technology and the Ministry of Public Security promulgated the Measures for
Network Data Security Risk Assessment on 18 June 2026. Article 25 sets them running from
20 August 2026
.
A processor of important data runs a risk assessment every year. Where a material change in
the security state of important data may adversely affect data security, the affected part is
assessed again without waiting for the annual cycle. Processors of ordinary data are
encouraged, not required, to assess at least once every three years
.
The work may be done in house, with a named owner, or by a contracted body. Article 12 bars
the same body and its affiliates from running three or more consecutive annual assessments for
one processor. Two in a row is the ceiling
.
Article 15 keeps the report for at least three years. Article 16 allows twenty working days
after the assessment closes to file it with the competent department, or with the provincial or
national cyberspace authority where no department is named. Where the authorities require a
third-party assessment under Article 17, Article 18 adds duties. They include fifteen working
days after remediation to report what was fixed
.
The shape is familiar: a fixed cycle, a rotation rule, a filed record.
Netherlands: the NIS2 and CER acts took effect on 15 August 2026
The Cyberbeveiligingswet and the Wet weerbaarheid kritieke entiteiten entered into force on 15 August 2026, and the decree carries no transitional law.
Affected
Essential and important entities, and critical entities, where those operations sit in the Netherlands.
Action
Register in the national register, and, for the listed digital service categories, file the ENISA register information within one month of 15 August 2026.
The Cyberbeveiligingswet implements Directive (EU) 2022/2555, the Wet weerbaarheid kritieke
entiteiten Directive (EU) 2022/2557. Both are acts of 8 July 2026, published in the Staatsblad
of 10 July 2026
.
Article 35 of the Cyberbeveiligingsbesluit fixes 15 August 2026 for that decree and for the
act. Its explanatory note records that the decree provides no transitional law
.
Article 19 of the Besluit weerbaarheid kritieke entiteiten sets the same date for the
critical-entities act
.
Article 47 holds the only dated clock. It covers the register kept under Article 27 of the
directive, for the digital service categories the act names. Article 47's first three
paragraphs took effect after 17 January 2025, so the information is due one month later, on
15 September 2026. Article 44 sets no date for the first supply to the national register, and
two weeks for a change. Article 98 gives the register itself until one month after Article 43 takes effect
.
The decree's duties therefore bite on day one. The act's § 16.2 preserves decisions and
notifications under the Wet beveiliging netwerk- en informatiesystemen.
Article 97 defers Articles 21 and 24, the duty of care and governance, for thirty-six months
after a higher education institution's designation
.
HIPAA Security Rule: the rewrite moved to long-term actions on 14 August 2026
The 2026 Unified Agenda moved the HIPAA Security Rule rewrite out of the final rule stage and projected final action in July 2027, with no day set.
Affected
HIPAA regulated entities under the Security Rule, and the programmes already budgeting against the proposed rule.
Action
Keep the gap analysis against the proposed text, but move the remediation budget out of 2026 and into a later cycle.
The proposed rewrite of the Security Rule was published on 6 January 2025 at 90 FR 898. Its
comment period closed on 7 March 2025; no final rule, supplemental proposal or withdrawal has
followed
.
In the 2026 Unified Agenda the rulemaking sits under long-term actions, with final action
projected for July 2027 and no day given
.
That heading carries a definition. The edition's introduction appeared in the Federal Register
on 14 August 2026. It describes long-term actions as items under development, where the agency
expects no regulatory action within twelve months of publication
.
The entry's own data was not printed there
.
The slippage is measurable. The Spring 2025 edition had the same rulemaking in the final rule
stage, with May 2026 projected
.
A proposal nobody has withdrawn is still the published direction. The date moved; the
direction did not.
China: police cyberspace security inspections apply from 1 October 2026
Order No. 176 replaces the 2018 internet inspection rules, holds routine on-site checks to one a year, and reuses another regulator's inspection result.
Affected
Network operators, data processors and personal information processors in China, and the security service firms police engage for technical support.
Action
Map the eleven inspection topics onto evidence already held, and record which regulator inspected this year so the result can be reused.
Order No. 176 of the Ministry of Public Security issued the measures on police supervision and
inspection of cyberspace security on 7 August 2026. Article 23 applies them from 1 October 2026
and repeals the 2018 internet security inspection provisions, Order No. 151. Article 2 reaches
network operators, data processors and personal information processors, and reads cyberspace
security as network, data and information security together
.
Article 4 allows online patrol by information inspection, review-capability testing and
vulnerability scanning that leaves normal operation alone. Municipal police and above may probe
and penetration-test facilities outside critical information infrastructure, on three working
days' notice, without disturbing them. Article 7 lists eleven inspection topics, among them
graded protection filing and testing, log retention, vulnerability remediation, algorithm
accountability, and data and personal information duties
.
Article 9 is the part that removes work. A level-three or higher network operator or a critical
information infrastructure operator gets one routine on-site check a year. Where another
competent department has already inspected that year, the police reuse the result rather than
repeat it. Article 10 sends a multi-sector inspection programme to the central cyberspace
commission for approval
.
Reuse works only where the earlier inspection was recorded. That record is now worth keeping.
公安机关网络空间安全监督检查办法 (Measures for Supervision and Inspection of Cyberspace Security by Public Security Organs). 中华人民共和国公安部, 公安部令第176号, issued 7 August 2026, in force 1 October 2026, repealing 公安部令第151号 of 15 September 2018. https://app.mps.gov.cn/gdnps/files/c10576548/10576575.pdf · accessed 2026-09-07
EU AI Act: high-risk dates deferred, two prohibitions added
The Digital Omnibus on AI moves the high-risk obligations to December 2027 and August 2028, and adds two prohibited practices from December 2026.
Affected
Providers and deployers of AI systems on the EU market, and providers of general-purpose AI models.
Action
Re-plan the high-risk conformity work against the split timetable, and screen the model estate against the two new prohibitions before 2 December 2026.
Regulation (EU) 2026/1744, the Digital Omnibus on AI, was published in the Official Journal
of 24 July 2026. It entered into force on the third day after publication
.
Obligations for systems classified under Article 6(2) apply from 2 December 2027, and
those under Article 6(1) from 2 August 2028
.
The general application date of 2 August 2026 stands, the general-purpose AI model chapter
has applied since 2 August 2025, and the Article 5 prohibitions since 2 February 2025.
Articles 102 to 110 apply from 27 July 2026. A generative system placed on the market
before 2 August 2026 has until 2 December 2026 to meet the Article 50(2) marking duty.
Article 111(4) sets that period
.
Two practices were added to Article 5: AI systems that generate or manipulate
intimate imagery of an identifiable person without that person's explicit consent, and
systems that generate child sexual abuse material. Placing such a system on the market is
caught where the generation is the intended purpose, or a reasonably foreseeable outcome without
adequate safeguard. Use is caught only where the deployer uses it for that purpose. Both apply from 2 December 2026
.
Cyber Resilience Act: the Commission's application guidance, 27 July 2026
C(2026) 5252 and its annex set out how the Commission reads scope, substantial modification, support periods and the reporting duties.
Affected
Manufacturers of products with digital elements placed on the EU market, and the importers and distributors behind them.
Action
Re-test the scope decision and the support period against the guidance, then rehearse the reporting path before 11 September 2026.
The Commission published its first guidance on applying the Cyber Resilience Act on
27 July 2026. It takes the form of a communication, C(2026) 5252, with an annex titled
Commission Guidance on the Application of the Cyber Resilience Act. The guidance is
non-binding
.
Four questions take most of the space. The first is scope, including remote data processing
solutions and free and open source software. The others are substantial modification, how a
support period is set and applied, and how the reporting and risk-assessment duties work
.
The Commission's own milestone list places this guidance on 27 July 2026. It puts the
reporting obligations on 11 September 2026, and the first standardisation deliverables in the
third quarter of 2026
.
The reporting side is being built in parallel. ENISA states that its single reporting platform
will be used by CSIRTs and manufacturers from 11 September 2026. It has published a factsheet
and step-by-step pages for assigned representatives, revised during August 2026
.
Non-binding is not the same as ignorable. Where a manufacturer and a market surveillance
authority read scope differently, this document is where the authority starts.
EU AI Act: the transparency code and guidelines arrived before 2 August 2026
The Code of Practice on Transparency of AI-generated Content closed on 10 June 2026, and the Commission's Article 50 guidelines followed on 20 July 2026.
Affected
Providers and deployers of interactive AI systems, and of systems that generate or manipulate content.
Action
Decide whether to sign the code, then map each Article 50 duty to a marking, labelling or disclosure control that can be shown to work.
Article 50 of the AI Act sets transparency duties for certain AI systems. Two instruments now
sit under it, both published in the weeks before those duties applied.
The Code of Practice on Transparency of AI-generated Content was released at its closing
plenary on 10 June 2026. It addresses Article 50(2), (4) and (5): marking synthetic content,
labelling deep fakes, and disclosing AI-generated text on matters of public interest. Signing
is voluntary; the duties underneath are not. A non-signatory has to satisfy a market
surveillance authority that its own measures are adequate
.
On 8 July 2026 the Commission gave its opinion that the code adequately covers those
paragraphs and helps their effective implementation. The AI Board adopted its adequacy
assessment the following day
.
The Commission then published guidelines on the Article 50 obligations on 20 July 2026. They
define the scope of those obligations for providers and deployers. The obligations start to
apply on 2 August 2026
.
Neither instrument moves a date. Both change the evidence a supervisor expects: a marking
method, a labelling rule, and a record of which systems each covers.
Japan: the 2026 amendment to the personal information act adds a surcharge
Promulgated 17 July 2026, the amending act adds a surcharge regime; one tranche is in force from 17 January 2027 and the rest await a Cabinet Order.
Affected
Businesses handling personal information under Japanese law, and the compliance functions that price their exposure.
Action
Re-price the exposure against a surcharge tied to the gain, and watch for the Cabinet Order that follows the 17 January 2027 tranche.
The act partially amending the Act on the Protection of Personal Information and related acts
passed the Diet on 10 July 2026, and was promulgated on 17 July 2026
.
Supplementary Provision Article 1 sets a rule and three exceptions. Articles 13 and 16 of those
provisions took effect on promulgation. A third set is in force from 17 January 2027,
penal renumbering and service-by-publication rules among them. The rest await a Cabinet
Order, due within two years of promulgation
.
The national law database dates that outer bound 16 July 2028
.
New Articles 148-3 to 148-17 add a surcharge. Where a business gains money or property from a
listed unlawful handling, the Commission orders payment matching that gain, computed by a
method the Cabinet Order sets. No order issues where the data subjects number one thousand or
fewer, or in other low-harm cases the Cabinet Order names. Article 148-5 raises the amount by
half where a final order was made in the preceding ten years and the conduct continued after
it. Article 148-6 cuts the amount by half where the business reports the facts itself. That cut
is withheld where the report anticipates an order because an investigation has already happened
.
A surcharge measured by the gain changes the arithmetic. The saving from a shortcut is now the
floor of the penalty.
China: rules for anthropomorphic AI interaction services, in force 15 July 2026
Order No. 21 reaches AI that sustains emotional interaction, with a security assessment at a million registered users and algorithm filing verified each year.
Affected
Providers of AI services to the public in China that simulate a person and sustain emotional interaction, and the app stores that list them.
Action
Test whether the service sustains emotional interaction, then run the security assessment and file the algorithm before the user thresholds arrive.
Order No. 21 of the Cyberspace Administration of China and four other departments promulgated
the interim measures for anthropomorphic artificial intelligence interaction services on
10 April 2026. Article 32 set them running from 15 July. Article 2 reaches services offered to
the public in China that simulate a natural person's personality, thinking and communication
style in sustained emotional interaction, by text, image, audio or video. Customer service,
knowledge answering, work assistants, teaching and research sit outside it where no sustained
emotional interaction is involved
.
Article 9 asks for management systems covering algorithm review, science and technology ethics
review, content management, network and data security, and incident response. Article 10 sets
security duties across the lifecycle, from deployment through upgrade to termination, with
monitoring, risk assessment and retained network logs. Article 11 governs training data: lawful
source, cleaning and labelling, defence against poisoning and tampering, and a safety check on
synthetic data
.
Article 22 triggers a security assessment, reported to the provincial cyberspace authority. It
runs on launch or a new function, on a major change from new technology, at a million registered
or a hundred thousand monthly active users, and where national security may be affected. Article 26
requires algorithm filing under the recommendation rules, verified each year. Article 16 keeps
sensitive interaction data out of model training without separate consent
.
人工智能拟人化互动服务管理暂行办法 (Interim Measures for the Administration of Anthropomorphic Artificial Intelligence Interaction Services). 国家互联网信息办公室、国家发展和改革委员会、工业和信息化部、公安部、国家市场监督管理总局令第21号, adopted 2 February 2026, promulgated 10 April 2026, in force 15 July 2026. https://www.cac.gov.cn/2026-04/10/c_1777558395078289.htm · accessed 2026-09-06
CER Directive: Swedish bill proposes entry into force on 1 January 2027
Sweden's bill implementing the critical entities resilience directive was laid before the Riksdag on 14 July 2026, proposing effect from 1 January 2027.
Affected
Operators of essential services in the sectors the directive covers, where those operations sit in Sweden.
Action
Assume identification as a critical entity is coming, and start the all-hazards risk assessment the directive requires rather than waiting for the designation letter.
Directive (EU) 2022/2557 required Member States to adopt and publish implementing measures
by 17 October 2024 and to apply them from 18 October 2024
. Sweden did not meet
that date.
The Swedish Government laid its implementing bill, prop. 2025/26:303, before the Riksdag on
14 July 2026. It proposes a new act on the resilience of critical operators, with the act
and the related amendments entering into force on 1 January 2027
. Until that
date the directive has no Swedish implementing act behind it.
That leaves a two-track position worth naming in a risk register. The cybersecurity half of
the same December 2022 package, Directive (EU) 2022/2555, already has Swedish law behind
it: the Cybersecurity Act took effect on 15 January 2026. The physical-resilience half will
not, for another quarter or more.
The practical read is that the underlying obligations are stable even where the national
instrument is not. Identification as a critical entity, an all-hazards risk assessment,
resilience measures and incident notification are directive-level duties, and the drafting
window is the cheapest time to build them.
ISO replaced the ISMS overview standard and the auditing guidelines in 2026
ISO/IEC 27000:2026 was published on 3 July 2026 and ISO 19011:2026 in May 2026, withdrawing the editions an older audit file cites.
Affected
Certified organisations, internal audit programmes, and any policy set that defines a term by reference to the ISMS overview standard.
Action
Re-point the citations before the next audit cycle: the audit procedure at ISO 19011:2026, the glossary at ISO/IEC 27000:2026.
ISO/IEC 27000:2026 was published on 3 July 2026 as a sixth edition from ISO/IEC JTC 1/SC 27,
and runs to 11 pages. That date is also the withdrawal date of the fifth edition, ISO/IEC
27000:2018, which ran to 27 pages
.
The 2018 edition was titled Overview and vocabulary. The 2026 title ends at Overview
.
ISO 19011:2026, Guidelines for auditing management systems, was published in May 2026 as a
fourth edition: 46 pages, stage 60.60
. The catalogue
lists ISO/TMBG, while the Foreword names Project Committee ISO/PC 302.
ISO 19011:2018 is withdrawn, at stage 95.99
.
No requirement of ISO/IEC 27001:2022 moves. What moves is where a citation lands. An internal
audit procedure naming clause numbers in ISO 19011:2018 now points at a withdrawn edition, and
so does a glossary citing ISO/IEC 27000 with no edition year. The catalogue gives the shape of
the change, not its substance. Read the new editions, then re-point the citations.
China: the cybersecurity label scheme took effect on 1 July 2026
A voluntary three-star label rates a connected product's security, filed with a designated body and scannable to the test report and conformity declaration.
Affected
Producers of internet-connected products sold in China once the product class reaches the published catalogue, and the laboratories testing them.
Action
Check whether the product class sits in the first catalogue, then decide which star level the security baseline can actually carry.
The Cyberspace Administration of China, the Ministry of Industry and Information Technology
and the Ministry of Public Security circulated the cybersecurity label measures as
国信办发文〔2026〕4号 on 2 April 2026. Article 23 set them running from 1 July. Article 2 makes
the label a mark of the product's own security capability, reaching connected products through
a published catalogue. Article 3 keeps a producer's participation
voluntary
.
Article 5 grades capability as basic, enhanced or leading, shown as one, two or three stars.
Basic asks for national-standard baselines, such as no weak or common default passwords, a vulnerability mechanism
that remediates as it goes, and software kept updated. Leading adds
penetration testing against high-grade attack. Article 7 lets one and two stars be tested in
house or by an accredited third party, and sends three stars to a third-party penetration test
.
Article 6 puts seven items on the label, among them a code that scans to the test report, key
indicators and the producer's conformity declaration. Article 9 allows
the filing body ten working days for a formal check. Article 10 asks for re-filing when a
technical change may affect security. The first catalogue followed on 15 June 2026 as
国信办通字〔2026〕3号, and it opens with consumer connected cameras
.
Voluntary holds only until a buyer starts asking for the star.
网络安全标识管理办法 (Measures for the Administration of Cybersecurity Labels). 国家互联网信息办公室、工业和信息化部、公安部, circulated as 国信办发文〔2026〕4号, 2 April 2026; in force 1 July 2026. https://www.cac.gov.cn/2026-04/10/c_1777558393316312.htm · accessed 2026-09-06
实施网络安全标识的产品目录（第一批）及相关实施规则 (First catalogue of products implementing the cybersecurity label, with implementation rules). 国家互联网信息办公室、工业和信息化部、公安部, 国信办通字〔2026〕3号, 15 June 2026. https://www.cac.gov.cn/2026-06/18/c_1783525604615337.htm · accessed 2026-09-06
China: the personal information audit standard applies from 1 July 2026
GB/T 46903-2025 took effect on 1 July 2026, giving the compliance audit already required of large processors a published national method.
Affected
Personal information processors operating in China, and the professional bodies engaged to audit them.
Action
Set the audit cycle against the ten-million threshold, then re-cut the audit programme against the standard now in force.
GB/T 46903-2025, Data security technology — Personal information protection compliance audit
requirements, was published on 31 December 2025 and took effect on 1 July 2026. The national
standards platform lists it as current, under the national cybersecurity standardisation
technical committee
.
The duty it serves is older. Order No. 18 of the Cyberspace Administration of China, the
Measures for Personal Information Protection Compliance Audits, was promulgated on
12 February 2025 and applied from 1 May 2025. A processor handling the personal information
of more than ten million people runs a compliance audit at least once every two years
.
Article 5 lets the authorities require an audit by an outside body where the processing
carries large risk, or where it may harm the rights of many people. It also applies
after an incident that leaks, tampers with, loses or destroys personal information. The
threshold is one million or more people, or one hundred thousand or more for sensitive
information
.
A GB/T designation marks a recommended standard, not a mandatory one. Article 6 of the
Measures points an audit at the compliance audit guidelines annexed to them
.
That is a different document, and a published method is what a processor is asked to explain
a departure from.
个人信息保护合规审计管理办法 (Measures for Personal Information Protection Compliance Audits). Cyberspace Administration of China, Order No. 18, 12 February 2025. https://www.cac.gov.cn/2025-02/14/c_1741233507681519.htm · accessed 2026-09-05
China: guidance on AI in banking and insurance, issued 18 June 2026
Thirty-two items put AI in banks and insurers under a board committee, a graded application inventory, and risk committee approval for high-risk uses.
Affected
Banking and insurance institutions in China that develop or use artificial intelligence, and the financial holding companies addressed alongside them.
Action
Grade every AI use, then hold anything on the guidance's high-risk list until the risk management committee has approved it.
The National Financial Regulatory Administration issued 金发〔2026〕8号 on 18 June 2026, guidance
on the safe development and application of artificial intelligence in banking and insurance.
Eight parts hold thirty-two items, and no commencement date. Item 1 puts a committee
named by the board in charge. Item 2 asks for lifecycle management from requirement analysis
through data preparation, training, deployment and retirement. It carries data security
assessment, algorithm risk screening, ethics review and traceable accountability
.
It reaches the regulator's bureaux and the banks, insurers, asset managers and holding
companies it supervises. Item 15 grades each use by scenario importance, scale, customer
impact, model dependence and complexity, against a written application inventory. Item 16
marks generative uses high risk where they touch fund transactions, asset valuation, credit
approval, underwriting, claims, risk management, customer interests or contract formation.
High-risk uses wait for the risk management committee's approval
.
A security function must show records, not intent. Item 21 keeps development, change
and training logs for at least the life of the business served. Item 22 allows a weakly
explainable model into a high-risk scenario only as an aid, with a person deciding. Item 24
keeps names, identity numbers, phone and card numbers out of generative training.
Item 25 names prompt injection, context poisoning, memory poisoning and tool misuse. Item 29
has public-facing and high-risk generative use reported to the regulator
.
The shape is familiar to a model risk function. What is new is that security duties sit
inside the same approval.
Cyber Resilience Act: manufacturer reporting starts on 11 September 2026
Article 14 applies from 11 September 2026, ahead of full application on 11 December 2027, and it reaches products already placed on the market.
Affected
Manufacturers of products with digital elements placed on the EU market, including products placed there before 11 December 2027.
Action
Stand up the 24-hour and 72-hour notification path, with its two final-report clocks, to the coordinating CSIRT and ENISA before 11 September 2026, and rehearse it once.
The Cyber Resilience Act applies in stages. Chapter IV, Articles 35 to 51, has applied since
11 June 2026, which is what allows conformity assessment bodies to be notified. Article 14
applies from 11 September 2026, and the rest of the Regulation from 11 December 2027
.
Article 14 is the reporting article. A manufacturer must notify an actively exploited
vulnerability, and a severe incident affecting the security of the product. Both go to the
CSIRT designated as coordinator and to ENISA at the same time, through the single reporting
platform. The clock is an early warning within 24 hours and a fuller notification within
72 hours. The final report differs by track. For a vulnerability it is due no later than
14 days after a corrective or mitigating measure is available. For a severe incident it is
due within one month of the 72-hour notification
.
The transitional rule is the part that surprises people. Products placed on the market
before 11 December 2027 escape the substantive requirements unless they are substantially
modified. Article 69(3) then applies the Article 14 duties to all of them
. A shipped fleet is in
scope for reporting from September 2026 even though it is not yet in scope for the essential
requirements.
NIST reissued the ransomware profile against CSF 2.0
NIST IR 8374 Revision 1 was published in June 2026 and supersedes the 2022 ransomware profile, which predates the six-Function Core.
Affected
Organisations using a shared profile to set ransomware readiness, and anyone whose control mapping still cites the 2022 profile.
Action
Replace the 2022 profile wherever it is cited, and add the governance outcomes the older Core did not carry.
NIST published Revision 1 of Interagency Report 8374, Ransomware Risk Management: A
Cybersecurity Framework 2.0 Community Profile, in June 2026. It supersedes IR 8374 of
23 February 2022
. The announcement is
dated 11 June 2026
.
The report states its purpose plainly. It identifies the CSF 2.0 outcomes that support
governing the management of ransomware, and identifying, protecting against, detecting,
responding to and recovering from ransomware events
.
Two things follow from the title. A Community Profile, in CSF 2.0 terms, is a published
baseline of outcomes shared by several organisations. It is built for one sector, technology
or threat type, and may serve as the basis of an organisation's own target profile. The Core
those outcomes hang from has six Functions, of which Govern is one
.
That is why the reissue matters more than a revision number suggests. The superseded profile
was written against the earlier framework. A readiness sheet or questionnaire answer still
citing it points at a document NIST has withdrawn, and at a structure with no governance
Function.
NIST IR 8374 Rev. 1, Ransomware Risk Management: A Cybersecurity Framework 2.0 Community Profile. National Institute of Standards and Technology, June 2026. https://doi.org/10.6028/NIST.IR.8374r1 · accessed 2026-09-05
The NIST Cybersecurity Framework (CSF) 2.0. National Institute of Standards and Technology, NIST CSWP 29. https://doi.org/10.6028/NIST.CSWP.29 · accessed 2026-09-05
UN Regulation No 156: amendments binding on applying Contracting Parties from 4 June 2026
In force since 22 January 2021; amended by ECE/TRANS/WP.29/2025/142, binding on applying Contracting Parties from 4 June 2026 per the UN depositary record.
Affected
Vehicle manufacturers operating a software update management system under the 1958 Agreement, and their approval authorities.
Action
Read the amendment text in ECE/TRANS/WP.29/2025/142 against the approval file, and take the consolidated supplement designation from the UNECE status document before citing a clause number.
UN Regulation No 156 covers software update and software update management systems. It
entered into force on 22 January 2021 and was published in the Official Journal of
9 March 2021.
On 4 December 2025 the UNECE Executive Secretary
notified the Contracting Parties of proposed amendments (notification UNECE/TRANS/2025/12).
No Contracting Party applying the regulation objected within the six-month period. Under
Article 12(2) of the 1958 Agreement the amendments are considered adopted. They bind all
Contracting Parties applying the regulation as of 4 June 2026. The amendment
text is document ECE/TRANS/WP.29/2025/142, as amended by paragraph 78(c) of the session report
ECE/TRANS/WP.29/1188.
The depositary record names the amendments by document, not by supplement number. The
consolidated designation that a type-approval file cites is a UNECE-side label, read from the
status document TRANS/WP.29/343. The Official Journal has not republished Regulation No 156
in consolidated form. Regulation No 155 was republished in January 2025 incorporating text up to Supplement 3.
The shape of the obligation is unchanged; what changed is the text it is assessed against.
UN Regulation No. 156 — Uniform provisions concerning the approval of vehicles with regards to software update and software updates management system [2021/388]. Published in the Official Journal of the European Union, OJ L 82, 9.3.2021, p. 60. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:42021X0388 · accessed 2026-09-03
China: implementation opinion on AI agents, issued 8 May 2026
Thirty-eight tasks for AI agents: a registration platform carrying digital identity, a permission boundary, anomaly tooling and graded sector treatment.
Affected
Agent developers, development platforms, distribution platforms and service providers in China, and the sensitive fields and key sectors whose scenarios the cyberspace departments open.
Action
Write down which decisions an agent may take alone, which need the user's authorisation, and which stay with the user.
The Cyberspace Administration of China and two other departments jointly issued an implementation
opinion on the regulated application and innovative development of agents on 8 May 2026. Six parts
hold thirty-eight numbered tasks, no document number and no commencement date. An agent is an
intelligent system that perceives, remembers, decides, interacts and acts autonomously. Item 4
explores an agent registration platform carrying digital identity management, discovery and
capability declaration
.
It reaches developers, development platforms, distribution platforms and service providers, whose
platform rules, service agreements and privacy policies item 13 addresses. Item 11 grades by
application scenario and potential impact. In sensitive fields and key sectors, the cyberspace
departments and the sector regulator decide which scenarios open, under filing, testing and recall.
Lower-risk leisure and office uses rely on self-testing, information reporting and platform
management.
Item 6 draws the permission line: decisions reserved to the user, decisions the user authorises,
and decisions the agent takes alone. The user keeps the right to be informed and the final say,
and the agent may not act beyond that authorisation. Item 2 asks for adversarial-sample and
behavioural-anomaly tooling that can find, interrupt, block and recover. Item 9 extends lifecycle
security to model access, interface calls and extension tools
.
Nothing here commences, and the registration platform is still an exploration. The permission
boundary is not: it can be written down first.
智能体规范应用与创新发展实施意见 (Implementation Opinion on the Regulated Application and Innovative Development of Agents). 国家网信办、国家发展改革委、工业和信息化部, 8 May 2026; no 文号 printed. https://www.cac.gov.cn/2026-05/08/c_1779979789523320.htm · accessed 2026-09-07
EDPB: the Board approved a Chapter V transfer certification on 15 April 2026
Two opinions adopted on 15 April 2026 approve an updated European Data Protection Seal and, separately, one usable as an Article 46(2)(f) transfer tool.
Affected
Exporters in the European Economic Area looking for a transfer tool other than clauses, and importers outside it that want to be certified.
Action
Before relying on a certificate, check that it is current and covers the transfer, and finish any certification under the 2022 criteria before 2026 ends.
On 15 April 2026 the European Data Protection Board adopted two opinions on the Europrivacy
certification criteria. Opinion 15/2026 approves a separate set for certifying data importers
under Article 46, so a European Data Protection Seal can serve as the Article 46(2)(f)
safeguard. Data reaches the importer only once it holds the certificate and has signed
binding, enforceable commitments to the exporter
.
Opinion 14/2026 covers the ordinary route. It approves version 82 of the core criteria, whose
scope now takes in applicants caught by Article 3(2) because they offer goods or services to
people in the European Economic Area, or watch their behaviour. The Luxembourg authority
lodged both sets on 29 January 2026
.
Certificates already issued do not stay put. Opinion 14/2026 records that certification work
under the 2022 criteria ends with 2026. Issued certificates run out their three years, and
renewal moves to version 82
.
A certificate is not a transfer decision. The exporter still checks that it is current and
covers the transfer at hand.
Korea: the PIPA amendment adds a ten per cent surcharge tier from 11 September 2026
Act No. 21445, promulgated 10 March 2026, is in force from 11 September 2026, with a ten per cent turnover tier and a board resolution for the privacy officer.
Affected
Personal information processors subject to the Korean Act, and the boards that appoint and remove their privacy officers.
Action
Test the organisation against the Presidential Decree threshold, and put the privacy officer appointment on a board agenda before 11 September 2026.
The Personal Information Protection Act was amended by Act No. 21445, promulgated on
10 March 2026. The national law information centre prints the consolidated text as in force
from 11 September 2026. Supplementary Provision Article 1 puts that six months after
promulgation. Two changes are in force from 1 July 2027 instead: the proviso to
Article 32-2(1), and Article 75(2)15
.
Article 64-2(2) is new. It lets the Commission impose a surcharge of up to ten per cent of
total turnover, against the three per cent ceiling that Article 64-2(1) keeps. Where
turnover is absent or hard to compute, the cap becomes five billion won rather than two
billion. Three gates open that tier. One is a repeat of the same breach within three years of
a surcharge, with intent or gross negligence. Another is intent or gross negligence where ten
million or more data subjects are harmed. The third is a leak that follows a corrective order
the processor did not obey
.
Article 31(3) is also new. A processor above a threshold set by Presidential Decree takes a
board resolution to appoint, change or remove its privacy officer, and reports that to the
Commission. Article 31(4)3 has the officer report the protection position to the
representative and to the board
.
The governance duty is the harder one to retrofit. A board minute cannot be produced after
the fact.
개인정보 보호법 (Personal Information Protection Act), as amended by 법률 제21445호, promulgated 10 March 2026, in force 11 September 2026. 국가법령정보센터 (Korean Law Information Center). https://www.law.go.kr/LSW/lsInfoP.do?lsiSeq=283839&efYd=20260911 · accessed 2026-09-06
China: the 2026 automotive data export guidance, issued 30 January 2026
Eight departments set nine export exemptions for automotive data, scenario rules for judging important data, and three-year tamper-proof log retention.
Affected
Automotive data processors sending data out of mainland China, from vehicle makers and software suppliers to platform operators, dealers and repair businesses.
Action
Map each export against the nine exemptions, then fix log retention at three years before an inspection asks for it.
Eight departments led by the Ministry of Industry and Information Technology circulated the
2026 automotive data export security guidance as 工信部联网安〔2026〕27号 on 30 January 2026,
released on 3 February. It is guidance rather than a rule, with no commencement article and
nothing repealed. Part one reaches automotive data processors. It reads automotive data as the
personal information and important data arising in vehicle design, production, sale, use and
maintenance
.
Part one sets three routes. A security assessment covers important data, a million or more
people's non-sensitive information counted from 1 January, ten thousand or more people's sensitive
information, and any personal information a critical information infrastructure operator exports. Below that,
and outside that class, the processor chooses the standard contract or certification. Nine
situations skip all three, among them fewer than a hundred thousand people's non-sensitive
information and vulnerability data already reported
.
Part two judges important data by business scenario, across research and design, manufacturing,
vehicle automation, software upgrade and connected operation. Bills of materials, design
documents and source code are named under research. Part four asks for a named export owner, an
internal registration and approval mechanism, and identity authentication of the overseas
recipient. Network flow, operation and alert logs are held tamper-proof for at least three years
.
Guidance without a commencement date still tells an inspector what good looks like.
NIS2: Sweden's Cybersecurity Act took effect on 15 January 2026
Cybersäkerhetslag (2025:1506) entered into force on 15 January 2026, fifteen months after the directive's transposition date of 17 October 2024.
Affected
Essential and important entities under the directive's sector lists, where those operations sit in Sweden.
Action
Re-test the entity classification against the Swedish act, then close the gap against the Article 21 measures and the Article 23 reporting deadlines.
Sweden now has a NIS2 act. Cybersäkerhetslag (2025:1506) was issued on 11 December 2025 and
entered into force on 15 January 2026
. It replaces the law that
implemented the 2016 directive.
The directive itself required implementing measures to be adopted and published by
17 October 2024 and applied from 18 October 2024
. Sweden was one of many
Member States that missed that date.
Article 21 sets the risk-management measures and Article 23 the reporting obligations
. For the
digital sectors, Commission Implementing Regulation (EU) 2024/2690 already specifies what
those measures mean in practice and when an incident counts as significant
.
One caution against treating the text as settled: the Commission proposed targeted
amendments to the directive on 20 January 2026, COM(2026) 13, covering jurisdictional rules
and reporting simplification. That
proposal is not law.
China: the amended Cybersecurity Law took effect on 1 January 2026
Presidential Order No. 61 adds an artificial intelligence article to the Cybersecurity Law and sets the top penalty on an operator at ten million yuan.
Affected
Network operators in China and the operators of critical information infrastructure, whose protection duties now carry a rewritten penalty scale.
Action
Re-read the protection duties against the renumbered articles, then price the exposure against the new upper penalty band.
The Standing Committee of the fourteenth National People's Congress adopted the decision
amending the Cybersecurity Law at its eighteenth session on 28 October 2025. Presidential Order
No. 61 promulgated it the same day. The decision makes fourteen numbered changes and runs from
1 January 2026, with the law republished and its articles renumbered
.
Change three inserts a new Article 20. The new article puts state support behind AI research,
training data and computing infrastructure, ethics norms and risk supervision. Its second
paragraph backs the use of artificial intelligence to raise the standard of cybersecurity
protection. Change four adds a paragraph to Article 42, sending an operator's personal
information processing to the Civil Code and the Personal Information Protection Law
.
Change five rewrites the penalties as Article 61. A network operator that refuses to correct,
or lets harm follow, faces fifty thousand to five hundred thousand yuan; a critical information
infrastructure operator faces one hundred thousand to one million. Where either breach carries
an especially serious result, such as that infrastructure losing its main function, the band
becomes two million to ten million yuan. Responsible people then face two hundred thousand to
one million
.
The new article supports rather than restricts. The penalty article is where the amendment
bites.
全国人民代表大会常务委员会关于修改《中华人民共和国网络安全法》的决定 (Decision of the Standing Committee of the National People's Congress on amending the Cybersecurity Law of the People's Republic of China). 第十四届全国人民代表大会常务委员会第十八次会议, adopted 28 October 2025; promulgated by 中华人民共和国主席令第六十一号, 28 October 2025; in force 1 January 2026. http://www.npc.gov.cn/npc/c2/c30834/202510/t20251028_449048.html · accessed 2026-09-06
GB 44495-2024 and GB 44496-2024 took effect in China on 1 January 2026
China's mandatory vehicle cybersecurity and software-update standards moved from issued to in force on 1 January 2026, seventeen months after publication.
Affected
Vehicle manufacturers and their suppliers seeking type approval for vehicles sold in China.
Action
Map the existing R155 and R156 evidence set onto the GB clause structure, and read Amendment No. 1 to each standard before relying on a clause number.
Both standards were issued on 23 August 2024 and became effective on 1 January 2026. The
national catalogue now lists each as 现行, meaning current
.
GB 44495-2024 covers technical requirements for vehicle cybersecurity;
GB 44496-2024 covers general technical requirements for software update of vehicles. Both
were issued by SAMR together with the Standardization Administration, with the Ministry of
Industry and Information Technology as the competent department.
For a manufacturer already holding a UN R155 approval, the shape is familiar and the
paperwork is not. The two GB standards are national mandatory standards, so conformity runs
through the Chinese approval route rather than through a 1958 Agreement type approval. An
existing cybersecurity management system is useful input, not a substitute.
One detail the catalogue flags and most summaries do not: each standard carries an
Amendment No. 1, recorded in the remarks field of its catalogue entry
. Any clause-level
mapping built before that amendment was read is provisional.
Vietnam: Decree 356/2025 replaced the 2023 data protection decree on 1 January 2026
Issued on 31 December 2025 and in force the next day, the decree sets the dossier forms, widens the transfer exemptions and repeals Decree 13/2023.
Affected
Controllers, processors and third parties caught by the Vietnamese personal data protection law, and the small firms it partly excuses.
Action
Move any dossier not yet lodged onto the new annex forms, and re-test whether the small-firm carve-out still holds.
The Government issued Decree 356/2025/NĐ-CP on 31 December 2025, detailing the personal data
protection law. Article 42 set it running from 1 January 2026 and ended Decree 13/2023/NĐ-CP
of 17 April 2023 on the same day. It also amended Decree 165/2025/NĐ-CP so that core and
important data which is personal data follows the personal data rules
.
Article 41 puts a number on the statutory reprieve. For five years small enterprises and
start-ups may skip the processing assessment, the dossier updates and the protection-staff
duty. Business households and micro-enterprises are excused outright; the cross-border dossier
is not among the three. Both reliefs stop once the firm sells personal data processing
services, handles sensitive data directly, or reaches a hundred thousand data subjects
cumulatively
.
Article 17 adds transfer exemptions the law does not list, such as journalism, cross-border
staff administration under labour rules, and data sent to arrange transport, payments, hotels
or visas. Articles 18 and 19 fix the dossier contents. Each takes an annex form, a copy of the
binding contract, and the protection policies behind it
.
A cumulative count has no reset; the carve-out a small firm relies on expires by growth.
India: the DPDP Rules stage their own commencement from 13 November 2025
G.S.R. 846(E) splits commencement three ways: part on publication, consent managers a year on, and the working obligations eighteen months on.
Affected
Data fiduciaries processing digital personal data in India, and those offering goods or services to data principals there.
Action
Date the eighteen-month set from 13 November 2025, then test the breach process against the seventy-two-hour report to the Board.
Notified as G.S.R. 846(E) on 13 November 2025, the Digital Personal Data Protection Rules, 2025
appeared in the Gazette of India, Extraordinary, Part II, Section 3, Sub-section (i). The
gazette file's electronic identifier is dated the 14th. They are made under section 40(1) and
(2) of the Digital Personal Data Protection Act, 2023. Rule 1 splits the commencement three
ways. Rules 1, 2 and 17 to 21 took effect on the date of publication in the Official Gazette
.
Rule 4 is in force from one year after publication. It carries registration of a consent
manager with the Data Protection Board, on the conditions in Part A of the First Schedule.
Rules 3, 5 to 16, 22 and 23 are in force from eighteen months after publication. That later
set holds the working obligations, notice among them
.
Rule 7 sits in the eighteen-month set. On becoming aware of a personal data breach, the data
fiduciary tells each affected data principal without delay, describing the breach, the likely
consequences and the measures taken. It also tells the Board without delay. A detailed account
follows within seventy-two hours, or a longer period the Board allows on request
.
The staging is the trap. A breach process built against the Act alone has not been tested
against the rule that puts a clock on it.
ISO/IEC 27001:2013 certificates stopped being valid after 31 October 2025
The accredited transition period set by IAF MD 26 ended on 31 October 2025; certificates naming the 2013 edition expire or are withdrawn.
Affected
Certified organisations, and anyone accepting an ISO/IEC 27001 certificate as supplier assurance.
Action
Re-read the certificate register: any certificate still naming the 2013 edition is outside the transition and no longer counts as evidence.
The accredited transition to ISO/IEC 27001:2022 is closed. IAF MD 26:2023 Issue 2 set a
36-month transition period. It runs from the last day of the publication month of
ISO/IEC 27001:2022, which the document states as 31 October 2025. Certification bodies had
to complete their clients' transitions by that date
.
The consequence is stated plainly in the same document: all certifications based on
ISO/IEC 27001:2013 expire or are withdrawn at the end of the transition period
. There is no grace window in the
mandatory document, and no route that keeps a 2013 certificate alive.
Two practical consequences follow. First, a certificate presented in a supplier file that
names the 2013 edition is not evidence of a current accredited certification, whatever date
it carries. Second, an organisation that missed the window is starting a certification
cycle rather than continuing one, which changes the audit stages and the timeline.
Worth pairing with the base standard's own amendment. ISO/IEC 27001:2022/Amd 1:2024 adds
climate-action wording, so a statement of applicability written before 2024 is also due a
read.
China: the personal information export certification measures, in force 1 January 2026
Order No. 20 gives the certification route its own rules: who may use it, a three-year certificate, and a bar on splitting volumes to dodge the assessment.
Affected
Processors sending personal information out of mainland China on the certification route, and the certification bodies they engage.
Action
Decide which export route each transfer takes, then diarise the renewal application six months before any certificate expires.
Order No. 20 of the Cyberspace Administration of China and the State Administration for Market
Regulation promulgated the Measures for Personal Information Export Certification on
14 October 2025, published on 17 October. The order records approval at the Administration's
seventeenth office meeting of 2025, held on 21 July. Article 19 set them running from
1 January 2026
.
Article 3 places the route inside Article 38(1)(2) of the Personal Information Protection Law.
A qualified body attests that the transfer meets the law, the regulations and the standards. Article 5 then fixes who may use it. The processor must not be a
critical information infrastructure operator. Volume is counted from 1 January of the year.
It has sent abroad the personal information of at least one hundred thousand and fewer than
one million people, sensitive data excluded. Or it has sent the sensitive data of fewer than
ten thousand. Important data is outside the route
.
Article 5 also closes the obvious workaround. Volumes must not be split so that a transfer
owing a security assessment travels on a certificate instead. Article 6 puts notice, separate
consent and an impact assessment before the application. Article 8 gives the certificate three
years, and asks for the renewal application six months before it expires
.
Three years is short for a transfer programme, and the renewal clock starts at two and a half.
个人信息出境认证办法 (Measures for Personal Information Export Certification). 国家互联网信息办公室、国家市场监督管理总局令第20号, 14 October 2025, published 17 October 2025, in force 1 January 2026. https://www.cac.gov.cn/2025-10/17/c_1762449728720008.htm · accessed 2026-09-06
·California Code of Regulations, title 11, division 6, chapter 1
California: the CCPA regulations put dates on audits, risk assessments and ADMT
Approved on 22 September 2025 and effective 1 January 2026, the package dates ADMT compliance at 2027, first audit reports at 2028 and later.
Affected
Businesses in scope of the California Consumer Privacy Act that process at volume, use automated decision-making, or both.
Action
Fix which of the four articles reaches the business, then work back from the 1 January 2027 automated decision-making date.
On 24 July 2025 the California Privacy Protection Agency board adopted a package adding four
articles to the CCPA regulations: risk assessments, cybersecurity audits, rights over automated
decision-making, and insurance. The Office of Administrative Law approved it on
22 September 2025 and filed it with the Secretary of State, effective 1 January 2026
.
Section 7200(b) sets the first hard date. A business using the technology for a significant
decision before 1 January 2027 must comply with that article no later than that day. One
starting later complies whenever it uses the technology for such a decision
.
Section 7120 decides who audits. One trigger is the threshold in Civil Code section
1798.140(d)(1)(C). The other is the threshold in section 1798.140(d)(1)(A) plus volume:
personal information belonging to at least 250,000 consumers or households, or sensitive
personal information belonging to at least 50,000 consumers. Section 7121 stages the first
audit report by revenue: 1 April 2028, 1 April 2029 or 1 April 2030
.
Section 7155 wants the assessment before the processing starts, a review at least every three
years, and an update within forty-five days of a material change. Section 7157 has assessments
from 2026 and 2027 reported to the agency by 1 April 2028
.
ISO/IEC 42006:2025 completes the certification route for AI management systems
The requirements standard for bodies auditing AI management systems was published on 7 July 2025, alongside the impact-assessment standard of May 2025.
Affected
Organisations building an AI management system, and the certification bodies auditing one.
Action
Decide whether accredited certification is actually the goal; if it is, ask the certification body how it meets ISO/IEC 42006:2025.
ISO/IEC 42001:2023, the AI management system standard, was published on 18 December 2023 as
a first edition by ISO/IEC JTC 1/SC 42
. Until mid-2025 it had no companion
standard telling certification bodies how to audit against it, which left "certified to
42001" meaning different things in different places.
Two publications closed that gap. ISO/IEC 42005:2025, AI system impact assessment, was
published on 28 May 2025. ISO/IEC 42006:2025 followed on 7 July 2025, setting requirements
for bodies providing audit and certification of AI management systems
. Both are first
editions from the same subcommittee.
The consequence for a programme already under way is small but real. An impact assessment
built against a local template can now be pointed at a published one, and a certification
body's competence claim can be tested against a published requirement rather than a
brochure. Neither standard changes what ISO/IEC 42001:2023 asks for; they change what a
certificate is worth and what the assessment file needs to contain.
DORA: the subcontracting technical standard was published on 2 July 2025
Delegated Regulation (EU) 2025/532 sets what a financial entity must determine before ICT services supporting critical or important functions are subcontracted.
Affected
Financial entities in scope of DORA, and the ICT third-party providers supporting critical or important functions.
Action
Re-open the contracts covering critical or important functions and test the subcontracting clauses against the delegated regulation before the next supervisory cycle.
DORA itself has applied since 17 January 2025
.
Commission Delegated Regulation (EU) 2025/532 of 24 March 2025, published in the Official
Journal of 2 July 2025, supplements Article 30(5) of DORA. It specifies the elements a
financial entity has to determine and assess when ICT services supporting critical or
important functions are subcontracted
.
Commission Delegated Regulation (EU) 2024/1774 sets the
ICT risk management tools, methods, processes and policies, including the simplified
framework.
Commission Implementing Regulation (EU) 2024/2956 sets the standard templates for the
register of information
.
The register is where the three meet: filing one is documentation, not assessment.
Commission Delegated Regulation (EU) 2025/532 of 24 March 2025 … regulatory technical standards specifying the elements that a financial entity has to determine and assess when subcontracting ICT services supporting critical or important functions. European Commission. OJ L, 2025/532, 2.7.2025. https://eur-lex.europa.eu/eli/reg_del/2025/532/oj/eng · read at http://publications.europa.eu/resource/celex/32025R0532 · accessed 2026-09-03
·Luật Bảo vệ dữ liệu cá nhân (Luật số 91/2025/QH15)
Vietnam: the personal data protection law has been in force since 1 January 2026
Law No. 91/2025/QH15, passed on 26 June 2025, took effect on 1 January 2026 and caps cross-border transfer fines at five per cent of turnover.
Affected
Vietnamese and foreign organisations processing personal data in Vietnam, and foreign bodies and people taking part in or connected with processing Vietnamese citizens' data.
Action
Test every cross-border flow against the sixty-day dossier duty, then set the breach process to a seventy-two-hour report.
The fifteenth National Assembly passed the personal data protection law at its ninth session
on 26 June 2025. The official gazette printed it in issues 971 and 972 of 24 July 2025, and
Article 38 set it running from 1 January 2026. Article 8 fixes the ceilings. Buying or selling
personal data is capped at ten times the gain taken from the conduct. An organisation that
breaches the cross-border transfer rules faces up to five per cent of its revenue for the
preceding year. Other breaches stop at three billion đồng, and an individual pays half the
organisational figure
.
Article 1 reaches Vietnamese bodies and people, foreign ones present in Vietnam, and foreign
ones processing Vietnamese citizens' data or connected to that work. Article 20
counts three transfer cases: storage moved abroad, a hand-over to a recipient abroad, and
processing on a foreign platform
.
The filing duty is the part that catches people. Articles 20 and 21 want one original
impact-assessment dossier lodged with the specialised authority within sixty days of the first
transfer or processing. Article 23 puts a seventy-two-hour clock on telling that
authority about a qualifying breach
.
Sixty days is short for a dossier that has to describe every flow.
UN Regulation No 155: Supplement 3 entered into force on 10 January 2025
The consolidated R155 text republished in the Official Journal as 2025/5 incorporates all valid text up to Supplement 3 to the original version.
Affected
Vehicle manufacturers holding or seeking a type approval under the 1958 Agreement, and their approval authorities.
Action
Re-read the approval file against the consolidated text published as 2025/5; an argument built on the 2021 publication is out of date.
The cybersecurity regulation for vehicles has been republished. The consolidated text
appears in the Official Journal L series of 10 January 2025 under the number 2025/5. Its
header states that it incorporates all valid text up to Supplement 3 to the original
version. The date of entry into force given there is 10 January 2025
.
The same header names the authentic texts behind the consolidation. Alongside the original
ECE/TRANS/WP.29/2020/79 and its two 2020 amendments, it lists ECE/TRANS/WP.29/2022/54,
ECE/TRANS/WP.29/2023/70 and ECE/TRANS/WP.29/2024/55
. Three amendment
documents therefore post-date the version most internal handbooks quote.
One caveat the Official Journal states itself: only the original UN/ECE texts have legal
effect under international public law. The status and the date of entry into force are to be
checked against the UNECE status document TRANS/WP.29/343
. The
Official Journal is an official publication of the same text, not a substitute for that
status check.
Chile: Ley N° 21.719 is in force from 1 December 2026
Published on 13 December 2024, the law rewrites Chile's data protection regime and creates a supervisory agency, in force from 1 December 2026.
Affected
Controllers and processors handling personal data under Chilean law, and the public bodies the amended regime brings in.
Action
Date the programme from 1 December 2026, and settle the security measures and the breach report to the agency before it.
Ley N° 21.719 was promulgated on 25 November 2024 and published in the Diario Oficial, issue
44023, on 13 December 2024. It amends Ley N° 19.628 on the protection of private life and
creates the Agencia de Protección de Datos Personales
.
The first transitional article sets the date. The amendments to Ley N° 19.628, Ley N° 20.285
and Ley N° 19.496 are in force from the first day of the twenty-fourth month after publication
in the Diario Oficial. That is 1 December 2026. The fourth transitional article has the
agency's governing council appointed six months before then. For twelve months after that, the
sixth lets the agency answer a smaller firm's infringement with a written reprimand
.
Article 14 quinquies asks the controller to adopt security measures against the state of the
art, the cost, and the nature and risk of the processing. Those measures keep systems
confidential, whole, available and resilient. Article 14 sexies asks for a report to the
agency, by the quickest means and without undue delay. It is owed where a breach destroys,
leaks, loses or alters personal data, or opens unauthorised access. A reasonable risk to
rights is the test
.
Twenty-four months looks generous, until an agency has to be stood up inside it.
NIST CSF 2.0 restructured the Core around six Functions
The Cybersecurity Framework 2.0 was published on 26 February 2024 as NIST CSWP 29, with Govern at the centre of a six-Function Core.
Affected
Organisations using the framework as the spine of a control set, a maturity conversation or a customer questionnaire.
Action
Re-cut any crosswalk or scoring sheet that still names five Functions, using the Core transition overview NIST publishes alongside the framework.
The Cybersecurity Framework 2.0 was published on 26 February 2024 as NIST CSWP 29
. The framework is the reference most
often reached for when a control set needs a shared vocabulary, so a change to its Core has
a long tail through mappings, questionnaires and scoring sheets.
The Core is now a hierarchy of six Functions, each holding Categories and Subcategories. The
document depicts them as a wheel whose inner layer is the Govern Function alone, with the
other five surrounding it.
Governance is therefore read as its own Function rather than as material inside another one.
NIST publishes a separate overview of the Core changes between version 1.1 and version 2.0
alongside the framework itself
.
That is the honest starting point for re-cutting an existing mapping, and it is
cheaper than re-deriving the differences by hand.
The work is small and worth doing once. Any artefact that still describes five Functions is
describing an earlier structure, and that is an easy question to be asked in a supplier
review.
EU Data Act: switching charges end on 12 January 2027
Article 29 bars any switching charge for cloud and other data processing services from 12 January 2027, and already caps the reduced charges allowed until then.
Affected
Providers of data processing services offered in the Union, and the customers whose exit terms sit in those contracts.
Action
Pull the switching and exit clauses out of every cloud contract, and check the pre-contract information duty that already applies.
Regulation (EU) 2023/2854 of 13 December 2023 has applied since 12 September 2025, under
Article 50. The same article staggers the rest. The Article 3(1) obligation reaches connected
products, and their related services, placed on the market later than 12 September 2026.
Chapter IV reaches contracts concluded after 12 September 2025 at once. It applies from 12 September 2027 to older contracts running
indefinitely, or expiring at least ten years from 11 January 2024
.
Article 29 has the hard edge. Its bar is in force from 12 January 2027: a provider of data
processing services may then impose no switching charge for the switching process. Between
11 January 2024 and that date, reduced charges are allowed. They must not exceed the provider's
costs directly linked to the switching concerned
.
Article 29(4) already bites. Before a contract is entered into, the provider gives the
prospective customer clear information on standard service fees, on early termination
penalties, and on the reduced switching charges that may apply. Article 29(5) adds a duty
to flag services where switching is highly complex or costly. The duty also reaches switching
impossible without badly disturbing the data, digital assets or architecture
.
Exit cost is a third-party risk control, not a procurement footnote. A cloud dependency in the
register should carry its switching terms.
The radar records what changed. The briefings explain the instrument behind it: who is in scope, the obligations by article, the dates, and how it maps onto a management system.
Component due diligence under Article 13(5), the upstream vulnerability duty, open-source stewards, and the questions a component supplier has to answer.
AI governance as a table of decision rights: the three objects, a five-question test, who decides what an agent may do, and the evidence each decision leaves.
IEC 62443 as a system of roles and decisions: which part binds which role, the concepts a governance reader must own, and where the series gets misread.
Directive (EU) 2022/2555 in one pass: the scope test, the obligations by article, the reporting clock, the fine ceilings and a mapping to ISO 27001 Annex A.