https://grcide.com/radar Changes to the instruments that land in scope: what moved, who it affects, and what it asks of a program. en Sun, 06 Sep 2026 00:00:00 +0000 https://grcide.com/radar#eu-pqc-roadmap-faq https://grcide.com/radar#eu-pqc-roadmap-faq Wed, 02 Sep 2026 00:00:00 +0000 The Commission published the roadmap consultation feedback on 2 September 2026; the FAQ of 15 April 2026 answers the milestone and inventory questions. https://grcide.com/radar#china-small-pi-processors https://grcide.com/radar#china-small-pi-processors Tue, 01 Sep 2026 00:00:00 +0000 Order No. 25 gives a processor under one hundred thousand people a five-year audit cycle, form-based impact assessments and six export exemptions. https://grcide.com/radar#nist-csf-informative-references https://grcide.com/radar#nist-csf-informative-references Tue, 25 Aug 2026 00:00:00 +0000 NIST SP 1347 reached final status on 25 August 2026, covering what a CSF 2.0 informative reference is and which NIST tools serve the reference data. https://grcide.com/radar#china-network-data-risk-assessment https://grcide.com/radar#china-network-data-risk-assessment Thu, 20 Aug 2026 00:00:00 +0000 Order No. 24 makes an annual risk assessment compulsory for important data processors, with the report filed within twenty working days. https://grcide.com/radar#nl-cyberbeveiligingswet https://grcide.com/radar#nl-cyberbeveiligingswet Sat, 15 Aug 2026 00:00:00 +0000 The Cyberbeveiligingswet and the Wet weerbaarheid kritieke entiteiten entered into force on 15 August 2026, and the decree carries no transitional law. https://grcide.com/radar#hipaa-security-rule-long-term-actions https://grcide.com/radar#hipaa-security-rule-long-term-actions Fri, 14 Aug 2026 00:00:00 +0000 The 2026 Unified Agenda moved the HIPAA Security Rule rewrite out of the final rule stage and projected final action in July 2027, with no day set. https://grcide.com/radar#china-police-cyberspace-inspection https://grcide.com/radar#china-police-cyberspace-inspection Fri, 07 Aug 2026 00:00:00 +0000 Order No. 176 replaces the 2018 internet inspection rules, holds routine on-site checks to one a year, and reuses another regulator's inspection result. https://grcide.com/radar#ai-act-high-risk-deferral https://grcide.com/radar#ai-act-high-risk-deferral Mon, 27 Jul 2026 00:00:00 +0000 The Digital Omnibus on AI moves the high-risk obligations to December 2027 and August 2028, and adds two prohibited practices from December 2026. https://grcide.com/radar#cra-commission-guidance https://grcide.com/radar#cra-commission-guidance Mon, 27 Jul 2026 00:00:00 +0000 C(2026) 5252 and its annex set out how the Commission reads scope, substantial modification, support periods and the reporting duties. https://grcide.com/radar#ai-act-transparency-code https://grcide.com/radar#ai-act-transparency-code Mon, 20 Jul 2026 00:00:00 +0000 The Code of Practice on Transparency of AI-generated Content closed on 10 June 2026, and the Commission's Article 50 guidelines followed on 20 July 2026. https://grcide.com/radar#japan-appi-2026-amendment https://grcide.com/radar#japan-appi-2026-amendment Fri, 17 Jul 2026 00:00:00 +0000 Promulgated 17 July 2026, the amending act adds a surcharge regime; one tranche is in force from 17 January 2027 and the rest await a Cabinet Order. https://grcide.com/radar#china-anthropomorphic-ai-services https://grcide.com/radar#china-anthropomorphic-ai-services Wed, 15 Jul 2026 00:00:00 +0000 Order No. 21 reaches AI that sustains emotional interaction, with a security assessment at a million registered users and algorithm filing verified each year. https://grcide.com/radar#cer-directive-swedish-bill https://grcide.com/radar#cer-directive-swedish-bill Tue, 14 Jul 2026 00:00:00 +0000 Sweden's bill implementing the critical entities resilience directive was laid before the Riksdag on 14 July 2026, proposing effect from 1 January 2027. https://grcide.com/radar#iso-27000-19011-2026 https://grcide.com/radar#iso-27000-19011-2026 Fri, 03 Jul 2026 00:00:00 +0000 ISO/IEC 27000:2026 was published on 3 July 2026 and ISO 19011:2026 in May 2026, withdrawing the editions an older audit file cites. https://grcide.com/radar#china-cybersecurity-label https://grcide.com/radar#china-cybersecurity-label Wed, 01 Jul 2026 00:00:00 +0000 A voluntary three-star label rates a connected product's security, filed with a designated body and scannable to the test report and conformity declaration. https://grcide.com/radar#china-pi-audit-standard https://grcide.com/radar#china-pi-audit-standard Wed, 01 Jul 2026 00:00:00 +0000 GB/T 46903-2025 took effect on 1 July 2026, giving the compliance audit already required of large processors a published national method. https://grcide.com/radar#china-nfra-ai-banking-insurance-guidance https://grcide.com/radar#china-nfra-ai-banking-insurance-guidance Thu, 18 Jun 2026 00:00:00 +0000 Thirty-two items put AI in banks and insurers under a board committee, a graded application inventory, and risk committee approval for high-risk uses. https://grcide.com/radar#cra-reporting-obligations https://grcide.com/radar#cra-reporting-obligations Thu, 11 Jun 2026 00:00:00 +0000 Article 14 applies from 11 September 2026, ahead of full application on 11 December 2027, and it reaches products already placed on the market. https://grcide.com/radar#nist-ransomware-profile https://grcide.com/radar#nist-ransomware-profile Thu, 11 Jun 2026 00:00:00 +0000 NIST IR 8374 Revision 1 was published in June 2026 and supersedes the 2022 ransomware profile, which predates the six-Function Core. https://grcide.com/radar#un-r156-amendments-2026 https://grcide.com/radar#un-r156-amendments-2026 Thu, 04 Jun 2026 00:00:00 +0000 In force since 22 January 2021; amended by ECE/TRANS/WP.29/2025/142, binding on applying Contracting Parties from 4 June 2026 per the UN depositary record. https://grcide.com/radar#china-ai-agents-implementation-opinion https://grcide.com/radar#china-ai-agents-implementation-opinion Fri, 08 May 2026 00:00:00 +0000 Thirty-eight tasks for AI agents: a registration platform carrying digital identity, a permission boundary, anomaly tooling and graded sector treatment. https://grcide.com/radar#edpb-europrivacy-transfer-seal https://grcide.com/radar#edpb-europrivacy-transfer-seal Wed, 15 Apr 2026 00:00:00 +0000 Two opinions adopted on 15 April 2026 approve an updated European Data Protection Seal and, separately, one usable as an Article 46(2)(f) transfer tool. https://grcide.com/radar#korea-pipa-2026-amendment https://grcide.com/radar#korea-pipa-2026-amendment Tue, 10 Mar 2026 00:00:00 +0000 Act No. 21445, promulgated 10 March 2026, is in force from 11 September 2026, with a ten per cent turnover tier and a board resolution for the privacy officer. https://grcide.com/radar#china-automotive-data-export-guidance https://grcide.com/radar#china-automotive-data-export-guidance Fri, 30 Jan 2026 00:00:00 +0000 Eight departments set nine export exemptions for automotive data, scenario rules for judging important data, and three-year tamper-proof log retention. https://grcide.com/radar#nis2-swedish-cybersecurity-act https://grcide.com/radar#nis2-swedish-cybersecurity-act Thu, 15 Jan 2026 00:00:00 +0000 Cybersäkerhetslag (2025:1506) entered into force on 15 January 2026, fifteen months after the directive's transposition date of 17 October 2024. https://grcide.com/radar#china-cybersecurity-law-amendment https://grcide.com/radar#china-cybersecurity-law-amendment Thu, 01 Jan 2026 00:00:00 +0000 Presidential Order No. 61 adds an artificial intelligence article to the Cybersecurity Law and sets the top penalty on an operator at ten million yuan. https://grcide.com/radar#gb-44495-44496-in-force https://grcide.com/radar#gb-44495-44496-in-force Thu, 01 Jan 2026 00:00:00 +0000 China's mandatory vehicle cybersecurity and software-update standards moved from issued to in force on 1 January 2026, seventeen months after publication. https://grcide.com/radar#vietnam-pdpl-decree-356 https://grcide.com/radar#vietnam-pdpl-decree-356 Wed, 31 Dec 2025 00:00:00 +0000 Issued on 31 December 2025 and in force the next day, the decree sets the dossier forms, widens the transfer exemptions and repeals Decree 13/2023. https://grcide.com/radar#india-dpdp-rules-2025 https://grcide.com/radar#india-dpdp-rules-2025 Thu, 13 Nov 2025 00:00:00 +0000 G.S.R. 846(E) splits commencement three ways: part on publication, consent managers a year on, and the working obligations eighteen months on. https://grcide.com/radar#iso-27001-2022-transition-closed https://grcide.com/radar#iso-27001-2022-transition-closed Fri, 31 Oct 2025 00:00:00 +0000 The accredited transition period set by IAF MD 26 ended on 31 October 2025; certificates naming the 2013 edition expire or are withdrawn. https://grcide.com/radar#china-pi-export-certification https://grcide.com/radar#china-pi-export-certification Tue, 14 Oct 2025 00:00:00 +0000 Order No. 20 gives the certification route its own rules: who may use it, a three-year certificate, and a bar on splitting volumes to dodge the assessment. https://grcide.com/radar#california-ccpa-audit-admt-regulations https://grcide.com/radar#california-ccpa-audit-admt-regulations Mon, 22 Sep 2025 00:00:00 +0000 Approved on 22 September 2025 and effective 1 January 2026, the package dates ADMT compliance at 2027, first audit reports at 2028 and later. https://grcide.com/radar#iso-42006-certification-route https://grcide.com/radar#iso-42006-certification-route Mon, 07 Jul 2025 00:00:00 +0000 The requirements standard for bodies auditing AI management systems was published on 7 July 2025, alongside the impact-assessment standard of May 2025. https://grcide.com/radar#dora-subcontracting-rts https://grcide.com/radar#dora-subcontracting-rts Wed, 02 Jul 2025 00:00:00 +0000 Delegated Regulation (EU) 2025/532 sets what a financial entity must determine before ICT services supporting critical or important functions are subcontracted. https://grcide.com/radar#vietnam-personal-data-protection-law https://grcide.com/radar#vietnam-personal-data-protection-law Thu, 26 Jun 2025 00:00:00 +0000 Law No. 91/2025/QH15, passed on 26 June 2025, took effect on 1 January 2026 and caps cross-border transfer fines at five per cent of turnover. https://grcide.com/radar#un-r155-supplement-3 https://grcide.com/radar#un-r155-supplement-3 Fri, 10 Jan 2025 00:00:00 +0000 The consolidated R155 text republished in the Official Journal as 2025/5 incorporates all valid text up to Supplement 3 to the original version. https://grcide.com/radar#chile-ley-21719 https://grcide.com/radar#chile-ley-21719 Fri, 13 Dec 2024 00:00:00 +0000 Published on 13 December 2024, the law rewrites Chile's data protection regime and creates a supervisory agency, in force from 1 December 2026. https://grcide.com/radar#nist-csf-2-0 https://grcide.com/radar#nist-csf-2-0 Mon, 26 Feb 2024 00:00:00 +0000 The Cybersecurity Framework 2.0 was published on 26 February 2024 as NIST CSWP 29, with Govern at the centre of a six-Function Core. https://grcide.com/radar#eu-data-act-switching-charges https://grcide.com/radar#eu-data-act-switching-charges Wed, 13 Dec 2023 00:00:00 +0000 Article 29 bars any switching charge for cloud and other data processing services from 12 January 2027, and already caps the reduced charges allowed until then.