Cybersecurity regulations

Vulnerability and incident reporting obligations apply

Art 14: manufacturers must report actively exploited vulnerabilities and severe incidents (24-hour early warning, 72-hour notification) via the single reporting platform. Also covers products placed on the market before 11 Dec 2027 (Art 69(3)).

UK Cyber Security and Resilience BillUnited Kingdom

Passes House of Commons

Report stage and third reading completed in the Commons after carry-over into the new session.

Canada Bill C-8 / CCSPACanada

Royal Assent

Bill C-8 receives Royal Assent (S.C. 2026, c. 9); Telecommunications Act amendments take effect.

Conformity assessment body provisions apply

Chapter IV (Arts 35-51, notification of conformity assessment bodies) applies (Art 71(2)).

SEC Regulation S-PUnited States (Federal)

Smaller entities must comply

Smaller covered institutions (24 months after Federal Register publication) must comply with the amended Regulation S-P.

NYDFS Cybersecurity Regulation (Part 500)New York

Annual compliance notification

Annual certification or acknowledgment covering calendar year 2025 due.

HIPAAUnited States (Federal)

Notice of Privacy Practices updates (Part 2 alignment)

Covered entities must update Notices of Privacy Practices under 45 CFR 164.520 for the 2024 Part 2 (substance use disorder records) changes; this NPP piece survived the Purl vacatur.

Hong Kong Critical Infrastructure Cyber OrdinanceHong Kong

PCICSO comes into operation

Commissioner's Office is established and designation of CIOs begins; obligations apply to designated operators.

2025 amendments take effect

Higher fines, first-violation fines, AI governance provisions and PIPL-alignment duties apply under the 28 Oct 2025 NPCSC Decision.

CCPA / CPRACalifornia

New CCPA regulations take effect

ADMT, risk assessment, cybersecurity audit and updated CCPA regulations become effective; risk assessments required for new high-risk processing.

Australia Cyber Security Act (ransomware reporting)Australia

Ransomware reporting moves to compliance phase

The education-first phase (30 May-31 Dec 2025) ends; Home Affairs moves to a compliance and education approach for missed reports.

SEC Regulation S-PUnited States (Federal)

Larger entities must comply

Larger covered institutions (18 months after Federal Register publication) must have incident response programs, 30-day customer notification, and service-provider oversight in place.

First critical ICT third-party providers designated

The ESAs published the first list of 19 critical ICT third-party providers (including AWS, Google Cloud and Microsoft), which now come under direct EU oversight.

UK Cyber Security and Resilience BillUnited Kingdom

Introduced (Commons first reading)

Bill introduced in the House of Commons.

CMMC 2.0United States (Federal)

DFARS rule effective; Phase 1 begins

CMMC Level 1 and Level 2 self-assessment requirements begin appearing in applicable DoD solicitations and contracts (32 CFR 170.3(e)(1)).

NYDFS Cybersecurity Regulation (Part 500)New York

Universal MFA and asset inventory

500.12 multi-factor authentication for all users and 500.13(a) asset inventory requirements apply.

DOJ Bulk Data RuleUnited States (Federal)

Due diligence, audit and reporting obligations apply

Subpart J (data compliance program, due diligence and audits for restricted transactions) and reporting requirements in 202.1103 and 202.1104 apply.

CCPA / CPRACalifornia

ADMT, risk assessment and cybersecurity audit regulations approved

OAL approves the CCPA Updates, Cybersecurity Audit, Risk Assessment, ADMT and Insurance regulations and files them with the Secretary of State.

TLPT regulatory technical standards enter into force

Commission Delegated Regulation (EU) 2025/1190 (published 18 June 2025) sets criteria for which financial entities must run threat-led penetration testing, plus methodology and tester requirements.

Canada Bill C-8 / CCSPACanada

Bill C-8 introduced

First reading in the House of Commons.

Australia Cyber Security Act (ransomware reporting)Australia

Ransomware payment reporting starts

Reporting business entities must report ransomware/cyber-extortion payments to ASD within 72 hours of payment.

NYDFS Cybersecurity Regulation (Part 500)New York

Vulnerability scans, access privileges, malware controls, Class A monitoring

500.5(a)(2) automated scans, 500.7 access privilege restrictions, 500.14(a)(2) malicious code protection, and 500.14(b) Class A endpoint detection and centralized logging apply.

First registers of information submitted to the ESAs

Competent authorities had to submit financial entities' registers of ICT third-party contractual arrangements (reference date 31 Mar 2025) to the ESAs by 30 Apr 2025. National authorities set earlier deadlines for entities.

Member States establish entity lists

Member States had to establish lists of essential and important entities and notify the Commission of entity numbers (Art 3(3) and (5)). Repeated every two years.

DOJ Bulk Data RuleUnited States (Federal)

Prohibitions and restrictions take effect

Core prohibitions on covered data transactions and security requirements for restricted transactions apply.

HIPAAUnited States (Federal)

Security Rule NPRM comment period closed

Comments closed on the proposed HIPAA Security Rule update (90 FR 898); OCR has not issued a final rule.

Digital infrastructure entities submit registration data

DNS providers, TLD registries, domain registration services, cloud, data centre, CDN, managed (security) service providers, marketplaces, search engines and social networks had to submit registration details to competent authorities (Art 27(2)).

DORA applies

All DORA obligations (ICT risk management, incident reporting, testing, third-party risk, register of information) apply from 17 Jan 2025 (Art 64).

Network Data Regulations take effect

All provisions, including the 10-million-person threshold duties and annual important-data risk assessments, apply.

CCPA / CPRACalifornia

CPI adjustment of thresholds and fines

Revenue threshold rises to $26,625,000 and fines to $2,663 / $7,988 per violation.

HIPAAUnited States (Federal)

Reproductive health privacy compliance date (vacated)

Original compliance date for the reproductive health care privacy provisions, including the attestation requirement; these provisions no longer apply after the June 2025 vacatur.

SEC Cyber Disclosure RulesUnited States (Federal)

Inline XBRL tagging of Item 1.05 disclosures

Form 8-K Item 1.05 and Form 6-K incident disclosures must be tagged in Inline XBRL.

CMMC 2.0United States (Federal)

CMMC Program rule (32 CFR Part 170) effective

The program rule establishing CMMC levels and assessment processes took effect; contract enforcement awaited the DFARS rule.

SEC Cyber Disclosure RulesUnited States (Federal)

Inline XBRL tagging of annual cybersecurity disclosures

Item 106 / Item 16K disclosures must be tagged in Inline XBRL for fiscal years ending on or after this date.

CRA enters into force

Entered into force on the twentieth day after publication in the OJ on 20 Nov 2024 (Art 71(1)).

New PLD enters into force

Directive entered into force on the twentieth day after publication in the OJ on 18 Nov 2024 (Art 23).

Implementing Regulation 2024/2690 enters into force

Commission Implementing Regulation (EU) 2024/2690 (published 18 Oct 2024) sets technical risk-management measures and significant-incident thresholds for DNS, TLD, cloud, data centre, CDN, managed (security) service providers, online marketplaces, search engines, social networks and trust service providers.

NYDFS Cybersecurity Regulation (Part 500)New York

Governance, encryption, IR/BCDR, exemptions

500.4 governance, 500.15 encryption, 500.16 incident response and business continuity plans, and 500.19(a) revised exemptions apply.

National NIS2 measures apply; NIS1 repealed

Member States apply their NIS2 measures from 18 Oct 2024 and Directive (EU) 2016/1148 (NIS1) is repealed (Arts 41(1), 44).

Transposition deadline

Member States had to adopt and publish national transposing measures by 17 Oct 2024 (Art 41(1)).