Regulatory Intelligence
Live Regulatory Landscape
Comprehensive monitoring of EU, UK, Ireland, USA, and international cybersecurity, AI, and data protection enforcement - mapped to institutional doctrine response.
🇪🇺 European Union — Cyber, AI & Data Protection
— frameworks shown
EU cyber and digital regulation operates as a single horizontal stack. DORA, NIS2 and the Cyber Resilience Act form the security core; GDPR, DSA, DMA and the EU AI Act extend into data, market, and AI accountability. Enforcement is layered — national Competent Authorities under ENISA coordination, with ESAs for finance and the EU AI Office for frontier AI.
EU Cybersecurity Regulations
| Regulation | Status | Key Deadline | Scope & Key Requirements | Enforcement Authority | Doctrine Response |
|---|---|---|---|---|---|
| DORA EU 2022/2554 | In Force | 17 Jan 2025 — Active enforcement. Register of Information submitted Q1 2026; on-site ICT risk inspections underway; first compulsion payments issued. Only 50% of entities reached full compliance by end-2025 (Deloitte). | Financial sector ICT resilience. Firms must withstand, respond to, and recover from ICT disruptions. Strict 4-hour incident reporting for major incidents. | EBA / EIOPA / ESMA | Evidence Chain Model™ + Recoverability Mandate™ |
| NIS2 Directive EU 2022/2555 | Transposition | 17 Oct 2024 — 14 of 27 EU member states now transposed as of Apr 2026; 13 states still subject to EC infringement proceedings. EC proposed targeted NIS2 amendments 20 Jan 2026 to simplify compliance for 28,700 companies including 6,200 SMEs; EU Digital Omnibus trilogue 28 Apr 2026 expected to formalise extensions. First administrative penalties issued Q1 2026; first audits due 30 Jun 2026. Fines up to €10M or 2% global turnover (Skadden/EC, Apr 2026). | Replaces NIS1. Mandatory cybersecurity requirements for essential sectors (energy, health, finance, transport) and digital services. Mandates strict risk management, governance, and incident reporting. Art. 20 imposes personal liability on directors. | National CAs + ENISA | Decision Rights Architecture™ + Board-Survivable Cyber Architecture™ |
| EU AI Act EU 2024/1689 | Phased Rollout | 2 Aug 2026 — Most remaining provisions apply. EU Digital Omnibus proposes extending stand-alone high-risk AI systems to Dec 2027, embedded systems to Aug 2028. AI sandboxes due by Aug 2026 (may be delayed to Dec 2027). Watermarking deadline may shift to Feb 2027. Council agreed streamlining position Mar 2026; political trilogue scheduled 28 Apr 2026 — agreement expected before European Parliament recess (Addleshaw Goddard/A&O Shearman, Apr 2026). | Risk-based AI classification: Prohibited (social scoring, cognitive manipulation), High-Risk (critical infrastructure, employment, law enforcement), Limited Risk (transparency rules for chatbots/deepfakes), Minimal Risk. GPAI models must comply with transparency and copyright obligations. Penalties: up to 7% global annual turnover for high-risk violations. | National Market Surveillance + EU AI Office | AI Accountability Stack™ |
| Cyber Resilience Act EU 2024/2847 | Phased Rollout | 11 Sep 2026 — Vulnerability reporting obligations begin; 11 Dec 2027 — Full application | Manufacturers of products with digital elements must meet high-security standards throughout product lifecycle. Mandates "security by design," automatic updates, and vulnerability handling obligations. Conformity assessment bodies begin notifying 11 Jun 2026. Commission first standardisation deliverables expected Q3 2026. Non-compliant products face serious penalties across all 27 member states from Dec 2027 (Hogan Lovells/Keysight, Apr 2026). | National Market Surveillance Authorities | Evidence Chain Model™ + Contract Control Matrix™ |
| EU Cybersecurity Act EU 2019/881 + 2026 Revision | Revision Proposed | 20 Jan 2026 — COM(2026)11 published; EDPB-EDPS Joint Opinion 4/2026 (Apr 2026) supports proposal while raising data-protection concerns; in EU legislative procedure — trilogue political agreement targeted early 2027 | Strengthened ENISA and established EU-wide ICT certification framework. COM(2026)11 published 20 Jan 2026: adds managed security services to certification, significantly expands ENISA's operational support role (€341M budget 2028–2034), and addresses ICT supply-chain security as a strategic risk. | ENISA + National Certification Authorities | Evidence Chain Model™ |
| Cyber Solidarity Act EU 2025 | Implementation | In force 4 Feb 2025 — €36M Cybersecurity Reserve launched; cross-border SOC hubs deploying | Establishes EU-wide Security Operations Centre network for active threat detection. Creates Cyber Emergency Mechanism and €36M Cybersecurity Reserve for cross-border incident response. ENISA Single Reporting Platform launching September 2026. | ENISA + National SOCs | Recoverability Mandate™ |
| eIDAS2 EU Digital Identity Regulation | Implementation | Dec 2026 — All 27 Member States must provide EU Digital Identity Wallets | Provides secure, trustworthy digital identity solutions across Europe. Member states must offer EU Digital Identity Wallets to all citizens and residents. Pilot programmes expanding; technical specifications and implementing regulations finalised. | National Supervisory Bodies | Decision Rights Architecture™ |
| ISO 42001 | Published | Certification available now | International standard for AI management systems. Provides framework for establishing, implementing, and improving AI governance within organisations. | Accredited Certification Bodies | AI Accountability Stack™ (aligned) |
EU Data Protection & Digital Markets
| Regulation | Status | Key Requirements | Enforcement Authority | Doctrine Response |
|---|---|---|---|---|
| GDPR EU 2016/679 | In Force | Data protection by design and by default. 72-hour breach notification. DPIAs mandatory for high-risk processing. Cross-border transfer safeguards (SCCs, adequacy decisions). Fines up to 4% of global turnover. Total EU enforcement exceeds €7.1B; Irish DPC has issued €4.04B. 2026 Coordinated Enforcement Framework focuses on transparency obligations. | National DPAs (CNIL, ICO, BfDI) | Evidence Chain Model™ + Board-Survivable Cyber Architecture™ |
| ePrivacy Directive 2002/58/EC | In Force | Regulates cookies, electronic marketing, email spam, and privacy of electronic communications. Awaiting ePrivacy Regulation replacement. | National DPAs | Contract Control Matrix™ |
| Digital Markets Act DMA | In Force | Designates gatekeepers (Meta, Alphabet, Apple, etc.) — mandates interoperability, prohibits self-preferencing, prevents combining user data across services without consent. | European Commission (DG COMP) | Decision Rights Architecture™ |
| Digital Services Act DSA | In Force | Strict risk assessment and independent audits for VLOPs (45M+ EU users). Faster removal of illegal content. Algorithmic transparency obligations. | European Commission + National Digital Services Coordinators | AI Accountability Stack™ |
| EU Digital Omnibus Package COM(2025) Nov 2025 — Simplification Reform | Proposed | Proposed by EC 19 Nov 2025; in trilogue (Council agreed streamlining position Mar 2026; political trilogue scheduled 28 Apr 2026). Proposes targeted GDPR amendments for harmonisation and compliance simplification; extends AI Act high-risk system deadlines by up to 16 months (stand-alone systems to Dec 2027, embedded to Aug 2028); introduces single notification portal for data breach reporting across multiple regimes. Affects ~28,700 companies including 6,200 SMEs (EC / digital-strategy.ec.europa.eu, Nov 2025). | European Commission + European Parliament + Council | Evidence Chain Model™ + AI Accountability Stack™ |
🇬🇧 United Kingdom — Post-Brexit Regulatory Stack
— frameworks shown
The UK has shifted from "EU-lite" to a distinct "pro-innovation" regulatory environment — sector regulators (ICO, FCA, Ofcom, NCSC) apply principles within their own domains rather than a single horizontal AI Act. UK Data Adequacy with the EU was renewed in December 2025 through 2031, preserving cross-border data flows.
UK Cybersecurity & Data Protection
| Regulation | Status | Key Requirements | Enforcement Authority | Doctrine Response |
|---|---|---|---|---|
| UK FCA PS21/3 Operational Resilience | In Force | Financial firms must identify important business services, set impact tolerances, and test ability to remain within tolerances under severe-but-plausible scenarios. Full compliance 31 Mar 2025. | FCA / PRA | Recoverability Mandate™ + Decision Rights Architecture™ |
| UK GDPR + DPA 2018 | In Force | Appropriate technical and organisational security measures. 72-hour breach reporting to ICO. DPA 2018 supplements UK GDPR for law enforcement and intelligence processing. | ICO | Evidence Chain Model™ + Board-Survivable Cyber Architecture™ |
| NIS Regulations 2018 | In Force | Operators of essential services (energy, health, transport) and digital service providers must implement robust security measures and report incidents. | Sector-specific CAs (Ofcom, Ofgem, ICO) | Recoverability Mandate™ |
| NCSC CAF Cyber Assessment Framework | In Force | UK national framework for assessing cyber security of operators of essential services and critical national infrastructure. Four objectives: Managing Security Risk (A), Protecting Against Cyber Attack (B), Detecting Cyber Security Events (C), Minimising Impact of Incidents (D). 14 security principles assessed via NCSC-led or sector CA-led assessments. | NCSC / Sector CAs (Ofgem, Ofcom, CAA, NHSE) | Decision Rights Architecture™ + Board-Survivable Cyber Architecture™ |
| GovAssure UK Government Cyber Assurance Scheme | In Force | Cabinet Office cross-government cyber assurance programme requiring all UK government departments and arm's-length bodies (ALBs) to complete an annual self-assessment against the NCSC Cyber Assessment Framework (CAF). Departments score across all 14 CAF security principles; results reported to Cabinet Office. GovAssure replaces legacy HMG Security Policy Framework cyber elements and aligns with the National Cyber Strategy 2022–2030. From 2024, outcomes feed into HM Treasury-level departmental risk ratings and inform cross-government security investment decisions. | Cabinet Office / NCSC | Board-Survivable Cyber Architecture™ + Decision Rights Architecture™ |
| ECAF Electricity Cyber Assessment Framework (Ofgem) | In Force | Ofgem-enforced cyber assessment framework for UK electricity sector operators of essential services — generation, transmission, distribution, and supply licensees. Applies CAF 14 security principles to IT/OT convergence environments. Profile-based assessment: Ofgem issues improvement plans where gaps are identified. Non-compliance reportable under NIS Regulations 2018. | Ofgem | Control Collapse Model™ + Recoverability Mandate™ |
| Cyber Security & Resilience Bill 2025 | In Progress | Expands NIS Regulations scope to more digital services and supply chains. Tightens incident reporting rules. Increases fines and enhances regulator enforcement powers. Introduced 12 Nov 2025 (House of Commons); completed committee stage; now at report stage. DSIT published Policy Statement of Intent 1 Apr 2026, incorporating lessons from EU NIS2 and international partner consultations. Bill updated 14 Apr 2026 (parliament.uk). Expected to receive Royal Assent in 2026 (Commons Library, Apr 2026; DSIT Policy Statement, 1 Apr 2026). | DSIT / Sector CAs | Decision Rights Architecture™ + Recoverability Mandate™ |
| Product Security Act 2022 PSTI Act | In Force | Security requirements for consumer-connectable products — bans default passwords, mandates vulnerability disclosure, requires minimum security update periods. Non-compliance: fines up to £10M or 4% global turnover, plus £20,000/day for ongoing contraventions (OPSS, 2024). | OPSS | Contract Control Matrix™ |
| Telecoms Security Act 2021 | In Force | Stricter security duties on public telecom providers. Supply chain security requirements for network equipment and services. | Ofcom | Contract Control Matrix™ |
| Computer Misuse Act 1990 | In Force | Criminal offences for unauthorised access to computer material, unauthorised modification, and making/supplying tools for computer misuse. | CPS / NCA | Board-Survivable Cyber Architecture™ |
| Data (Use and Access) Act 2025 | Phased Commencement | Royal Assent 19 Jun 2025. Provisions being brought into force through a series of commencement SIs: No. 5 (SI 2026/31) — intimate image offences, 6 Feb 2026; No. 6 (SI 2026/82) — data protection and privacy provisions (Part 5), 5 Feb 2026; No. 8 (SI 2026/317) — further provisions, 31 Mar 2026. Reforms data protection to simplify compliance for research and AI; clarifies international transfer mechanisms post-Brexit (legislation.gov.uk, SIs 2026/31, 2026/82, 2026/317). | ICO | AI Accountability Stack™ |
| AI Regulation Bill 2025 Private Members' Bill | Proposed | Bill [HL] completed all House of Lords stages (1st reading to 3rd reading); now in House of Commons (2026) for initial stages. Proposes central AI Authority with mandatory registration and reporting for high-risk AI models. Government maintains voluntary sector-led approach; enactment not guaranteed (bills.parliament.uk/bills/3942). | Proposed AI Authority | AI Accountability Stack™ |
🇬🇧 UK Digital & AI Regulation Matrix (2026)
The UK has shifted from "EU-lite" to a distinct "pro-innovation" regulatory environment — avoiding one-size-fits-all legislation in favour of giving specific powers to existing sector regulators. Despite 2026 reforms, the UK maintains Data Adequacy with the EU (renewed December 2025 until 2031), allowing cross-border data flows without additional safeguards.
| Regulatory Area | Primary UK Legislation | Lead Regulator | 2026 Status & Key Requirements | Doctrine Response |
|---|---|---|---|---|
| Data Protection | Data (Use and Access) Act 2026 (DUAA) | ICO | Active. Streamlines GDPR; allows "opt-out" for analytics cookies and provides broader consent for scientific research. | Evidence Chain Model™ |
| Artificial Intelligence | Sectoral Principles (Non-statutory) | Distributed (ICO, FCA, CMA) | Active. No single "AI Act." Regulators apply five principles (Safety, Fairness, Transparency, Accountability, Contestability) within their own industries. | AI Accountability Stack™ |
| Cybersecurity | Cyber Security & Resilience Bill 2026 | NCSC | Enforced. Extends NIS1 to include data centres and Managed Service Providers. Mandatory 24-hour incident reporting. | Recoverability Mandate™ + Decision Rights Architecture™ |
| IoT / Smart Tech | PSTI Act 2022 | OPSS | Strict Enforcement. Bans universal default passwords. Mandatory "Security Update" period labels on consumer products. | Contract Control Matrix™ |
| Online Safety | Online Safety Act 2023 | Ofcom | Active enforcement. CSEA reporting duty in force 7 Apr 2026. Ofcom orders 40+ services to revise risk assessments. 77 of top 100 pornography services now have age assurance. Categorisation register delayed to Jul 2026. Technology notices guidance due Apr 2026. | Decision Rights Architecture™ |
| Digital Markets | DMCC Act 2024 | CMA (DMU) | Active. Targets "Strategic Market Status" firms to prevent anti-competitive behaviour in mobile ecosystems and search. | Contract Control Matrix™ |
UK vs Ireland/EU — Critical Regulatory Differences (2026)
| Feature | United Kingdom (2026) | Ireland / EU (2026) |
|---|---|---|
| AI Oversight | Sector-led: No new laws; existing regulators (FCA, ICO) adapt principles to their domains. | Centralised: The EU AI Act provides a single, horizontal law for all sectors. |
| Cookie Consent | Less Strict: Moving toward "Opt-out" for non-intrusive tracking. | Strict: "Reject All" buttons must be as prominent as "Accept All." |
| Cyber Liability | Supply Chain Focus: Targets providers like data centres and IT managed services. | Board Liability: Personal legal liability for CEOs/Boards under NIS2 Art. 20. |
| Automated Decisions | Flexible: Broadens "lawful bases" for AI-driven decision making. | Restricted: Users have a strong "Right to Explanation" and human intervention. |
| Data Adequacy | Maintained & Renewed: Adequacy renewed December 2025 until 2031 — data flows from Dublin to London without extra paperwork. | Standard: GDPR adequacy decisions and SCCs govern cross-border transfers. |
April 2026
PSTI Enforcement
Retailers and importers face massive fines if selling smart devices with default passwords or missing security update information.
May 2026
Online Safety — Hash Matching
Ofcom's final codes take effect, requiring platforms to proactively block non-consensual intimate imagery.
August 2026
AI Safety Institute Testing
UK AI Safety Institute begins mandatory pre-deployment testing for "frontier" AI models developed or significantly deployed within the UK.
🇮🇪 Ireland — EU "One-Stop-Shop" Jurisdiction
— frameworks shown
Ireland's regulatory environment has transitioned from high-level EU directives to specific, enforceable Irish statutes. Ireland holds a unique "Single Point of Contact" role for many multinational tech firms — Irish regulators often act as lead enforcer for the entire EU under the "One-Stop-Shop" mechanism.
🇮🇪 Ireland Digital Regulation Matrix (2026)
Ireland's regulatory environment has transitioned from high-level EU directives to specific, enforceable Irish statutes. Ireland holds a unique "Single Point of Contact" role for many multinational tech firms — Irish regulators often act as lead enforcer for the entire EU under the "One-Stop-Shop" mechanism.
| Regulatory Area | Key Irish Legislation | Primary Oversight Body | 2026 Status & Key Focus | Doctrine Response |
|---|---|---|---|---|
| Data Protection | Data Protection Act 2018 (Revised 2026) | Data Protection Commission (DPC) | Active. Enhanced focus on "Dark Patterns" in UI/UX and mandatory "Right to be Forgotten" for children's data. | Evidence Chain Model™ + Board-Survivable Cyber Architecture™ |
| Cybersecurity | National Cyber Security Bill 2024/26 | National Cyber Security Centre (NCSC) | Pre-enactment (NIS2). National Cyber Security Bill at advanced legislative stage — included as "priority" legislation in Government Programme Autumn 2025. NCSC expects enactment by end of 2026; introduces self-registration requirement (tentative July 2026 launch; 3-month window for entities to register). Places the NCSC on a statutory footing; introduces personal liability for Board members regarding cyber negligence. EC formal notice issued for failure to transpose by Oct 2024 deadline; referral to CJEU remains possible (Bird & Bird/NCSC/Enactia, Apr 2026). | Decision Rights Architecture™ + Board-Survivable Cyber Architecture™ |
| Artificial Intelligence | Regulation of AI Bill 2026 | AI Office of Ireland (Oifig IS) | Transitional (targeting 1 Aug 2026 statutory establishment). General Scheme of AI Bill 2026 published Feb 2026; Oifig IS currently operating on an administrative basis coordinating AI Act enforcement across existing sector regulators (Central Bank, DPC, etc.). | AI Accountability Stack™ |
| Data Sharing / IoT | Data Bill 2025/26 | CCPC & ComReg | Implementation. Transposes the EU Data Act; ensures users can access and move data generated by connected devices (IoT). | Contract Control Matrix™ |
| Online Safety | Online Safety & Media Regulation Act | Coimisiún na Meán | Active. Governs harmful content on social media and video platforms; can issue fines up to €20m or 10% of turnover. | Decision Rights Architecture™ |
| Digital Services | Digital Services Act 2024 (Revised 2026) | Coimisiún na Meán | Active. Regulates online marketplaces and intermediaries to prevent illegal content and ensure transparency in advertising. | AI Accountability Stack™ |
Critical Threshold
Cyber Incident: 24 Hours
Under the 2026 Cyber Security Bill (NIS2), "Essential" and "Important" entities must provide an early warning to the NCSC within 24 hours of a significant incident.
Critical Threshold
AI Fines: Up to €35m / 7%
The AI Bill introduces penalties up to €35m or 7% of global turnover for prohibited AI practices. Dual-supervision applies when AI processes personal data (DPC + AI Office).
Critical Threshold
AI High-Risk Registry
Providers of high-risk AI systems (recruitment, credit scoring) must register in the National AI Register managed by Oifig IS before deployment.
🇺🇸 United States — Federal, Sector & State Layers
— frameworks shown
The US operates a multi-layered regulatory stack: federal cyber rules (CIRCIA, CMMC, SEC, HIPAA), sector regulators (FTC, HHS OCR, NYDFS, TSA, CISA), and an expanding patchwork of state AI and privacy laws. EO 14179 (Jan 2025) rescinded the Biden AI EO and shifted federal AI policy toward deregulation, but state-level AI statutes (Colorado, Texas, California) and sector rules remain in force.
🇺🇸 US Cybersecurity, Healthcare & AI Regulation Matrix (2026)
The US operates a multi-layered regulatory stack: federal cyber rules (CIRCIA, CMMC, SEC, HIPAA), sector regulators (FTC, HHS OCR, NYDFS, TSA, CISA), and an expanding patchwork of state AI and privacy laws. EO 14179 (Jan 2025) rescinded the Biden AI EO and shifted federal AI policy toward deregulation, but state-level AI statutes (Colorado, Texas, California) and sector rules remain in force. UK and EU firms with US operations, US-person data, or federal contracts are typically in scope.
| Regulation | Status | Key Requirements | Enforcement Authority | Doctrine Response |
|---|---|---|---|---|
| SEC Cyber Rules US — Global Impact | In Force | Material cyber incident disclosure within 4 business days. Annual reporting of cyber risk management, strategy, and governance. Board-level oversight requirements. | SEC / DOJ | Board-Survivable Cyber Architecture™ |
| US Data Security Rule 28 CFR Part 202 — Global Impact | In Force | Implements Executive Order 14117. Prohibits and restricts US persons from engaging in covered data transactions that give "countries of concern" (China, Russia, Iran, North Korea, Cuba, Venezuela) or covered persons access to bulk US sensitive personal data (genomic, biometric, health, geolocation, financial, personal identifiers) and US government-related data. Effective 8 Apr 2025; full compliance (due diligence, audit, reporting) required from 6 Oct 2025. Extraterritorial reach — UK/EU firms with US operations or US-person data in scope. Civil penalties up to ~$377K per violation or 2× transaction value; criminal penalties up to $1M and 20 years imprisonment (DOJ NSD, 2025). | DOJ National Security Division | Contract Control Matrix™ + Evidence Chain Model™ |
| HIPAA Security Rule 45 CFR Part 164 subpart C | In Force | Covered entities and business associates must implement administrative, physical, and technical safeguards for ePHI. Risk analysis, access controls, audit logs, encryption "where reasonable and appropriate." Breaches affecting 500+ individuals reportable to HHS OCR within 60 days. Civil penalties up to $2.13M per violation category per year (2025 adjusted). | HHS Office for Civil Rights (OCR) | Evidence Chain Model™ + Board-Survivable Cyber Architecture™ |
| HIPAA Security Rule NPRM Proposed Amendment 2025 | Proposed | HHS OCR Notice of Proposed Rulemaking published 6 Jan 2025. Removes "addressable" vs "required" distinction — all implementation specifications become mandatory. Adds explicit MFA, encryption (at-rest and in-transit), asset inventory, network segmentation, annual compliance audits, and 72-hour incident restoration requirements. Final rule expected 2026 post-comment-review. | HHS OCR | Recoverability Mandate™ + Evidence Chain Model™ |
| HIPAA Privacy Rule + HITECH | In Force | Governs use and disclosure of Protected Health Information. HITECH Act (2009) expanded HIPAA, introduced breach notification, and increased penalties. 2024 Reproductive Health amendment restricts disclosure of reproductive health data for criminal investigations (effective 25 Dec 2024). | HHS OCR / State AGs | Contract Control Matrix™ |
| CIRCIA Cyber Incident Reporting for Critical Infrastructure Act 2022 | Rulemaking Pending | The Act (2022) is in force; CISA implementing regulations (final rule) delayed to May 2026+. Core proposed obligations: 72h reporting for significant cyber incidents; 24h for ransomware payments; covers 16 critical infrastructure sectors. Non-compliance triggers CISA subpoena authority and DOJ referral. DHS appropriations lapse in March–April 2026 caused postponement of scheduled CIRCIA town hall meetings, likely pushing final rule beyond May 2026 (CISA NPRM; CyberScoop / Davis Wright Tremaine, 2025–2026). | CISA | Recoverability Mandate™ + Decision Rights Architecture™ |
| CMMC 2.0 32 CFR Part 170 / 48 CFR (DFARS) | In Force | Cybersecurity Maturity Model Certification — mandatory for ~300,000 Defense Industrial Base contractors. Three-tier model (Level 1 Foundational → Level 3 Expert) mapped to NIST SP 800-171 / 800-172. Final DFARS clause 252.204-7021 phased in through contracts from late 2025 onward; C3PAO third-party assessment required at Levels 2 and 3. | DoD CIO / DCMA / C3PAOs | Contract Control Matrix™ + Board-Survivable Cyber Architecture™ |
| NYDFS Cybersecurity Regulation 23 NYCRR Part 500 (Amendment 2) | In Force | New York Department of Financial Services rule for covered financial entities. Amendment 2 (Nov 2023) phased-in through Nov 2025: CISO annual report to board, MFA on all remote access and privileged accounts, endpoint detection & response, documented incident response plan, 72-hour notification of cybersecurity events, annual certification by senior officer or board. | NYDFS | Decision Rights Architecture™ + Evidence Chain Model™ |
| FTC Safeguards Rule 16 CFR Part 314 (GLBA) | In Force | Non-bank financial institutions must implement written information security program with designated Qualified Individual, risk assessment, access controls, encryption, MFA, continuous monitoring, annual penetration testing, incident response plan, and board reporting. 2023 amendment added 30-day breach notification to FTC for events affecting 500+ consumers. | FTC | Contract Control Matrix™ + Evidence Chain Model™ |
| SOX (Sarbanes-Oxley Act) 15 U.S.C. § 7201 — IT Audit & Financial Controls | In Force | Sarbanes-Oxley Act 2002 imposes IT general controls (ITGC) and application controls requirements on public companies and their subsidiaries with US listings. Section 302 (CEO/CFO quarterly certifications) and Section 404 (annual management & auditor attestation of internal controls over financial reporting) drive significant information security obligations: access controls, change management, segregation of duties, audit logging, and vulnerability management. SOX PCAOB AS 2201 sets external auditor standards for ICFR. SOC 1 Type II (formerly SAS 70) reports are the primary third-party assurance mechanism for service organisations in scope. Financial institutions and global companies with NYSE/NASDAQ listings are in scope regardless of HQ jurisdiction. | SEC / PCAOB | Audit-Proof by Design™ + Decision Rights Architecture™ |
| FedRAMP 40 U.S.C. § 11331 / OMB M-24-15 | In Force | Federal Risk and Authorization Management Program. Cloud services used by federal agencies must achieve authorization (Low / Moderate / High / Li-SaaS) against NIST SP 800-53 controls. 2024 modernization (FedRAMP 20x) introduces continuous ATO model. Agencies must obtain authorization before procurement. | GSA FedRAMP PMO / JAB | Contract Control Matrix™ |
| NIST CSF 2.0 + AI RMF 1.0 | Reference | NIST Cybersecurity Framework 2.0 (Feb 2024) adds Govern function; widely referenced by regulators (SEC, FTC, HHS, DoD). NIST AI Risk Management Framework 1.0 (Jan 2023) + Generative AI Profile (Jul 2024) provide voluntary structure for AI governance adopted by federal agencies under OMB M-24-10. | NIST (voluntary) / adopted by sector regulators | AI Accountability Stack™ + Decision Rights Architecture™ |
| EO 14144 Strengthening & Promoting Innovation in the Nation's Cybersecurity (Jan 2025) | In Force | Final Biden cyber EO signed 16 Jan 2025. Mandates secure software development attestations for federal vendors, post-quantum cryptography transition milestones, software bill of materials (SBOM), and AI cyber-defence research. Partially modified by Trump EO 14306 (Jun 2025) but core secure-software and PQC provisions remain. | OMB / CISA / NIST | Contract Control Matrix™ |
| EO 14179 Removing Barriers to American Leadership in AI (Jan 2025) | In Force | Rescinded Biden EO 14110 (Oct 2023). Directs federal agencies to review and remove AI-related regulations deemed to impede innovation. OMB M-25-21 and M-25-22 (Apr 2025) revised federal AI use policy. Does not remove statutory AI obligations or state AI laws; voluntary NIST AI RMF guidance remains. | OMB / OSTP | AI Accountability Stack™ |
| Colorado AI Act SB 24-205 — first comprehensive state AI law | Effective 30 Jun 2026 | Imposes duty of reasonable care on developers and deployers of "high-risk AI systems" (consequential decisions in employment, education, finance, healthcare, housing, insurance, legal services) to prevent algorithmic discrimination. Requires impact assessments, risk management program, annual AG filing, and consumer disclosure & appeal rights. Enforced by Colorado AG. Note: Implementation delayed from 1 Feb 2026 to 30 Jun 2026 by SB 25B-004, signed 28 Aug 2025; Colorado legislature actively considering further substantive amendments before the June 2026 effective date (Colorado General Assembly, SB25B-004, Aug 2025). | Colorado Attorney General | AI Accountability Stack™ + Evidence Chain Model™ |
| Texas Responsible AI Governance Act TRAIGA — HB 149 | In Force | In force since 1 Jan 2026. Prohibits AI systems intentionally developed for unlawful discrimination, social scoring, or manipulating human behaviour to cause harm. Governmental use restrictions on biometric ID and emotion recognition. Creates Texas AI Council. Enforced by Texas AG with civil penalties up to $200,000 per violation and 60-day cure period (Texas HB 149 / TRAIGA, eff. 1 Jan 2026). | Texas Attorney General | AI Accountability Stack™ |
| California AI Statutes SB 942 Transparency · SB 53 Frontier AI · AB 2013 | In Force | SB 942 California AI Transparency Act (effective 1 Jan 2026) requires AI-generated content disclosure and provenance tools for large AI platforms. SB 53 Transparency in Frontier Artificial Intelligence Act (signed Sep 2025) mandates safety framework publication and critical-safety-incident reporting for frontier model developers. AB 2013 training-data transparency effective Jan 2026. | California AG / CPPA | AI Accountability Stack™ |
| NYC Local Law 144 AEDT — Automated Employment Decision Tools | In Force | Employers using automated decision tools for hiring or promotion of NYC-based candidates must conduct annual independent bias audit, publish summary of results, and provide candidate notice at least 10 business days before use. Civil penalties up to $1,500 per violation per day. | NYC Department of Consumer & Worker Protection | AI Accountability Stack™ |
| CCPA / CPRA California Consumer Privacy Act as amended by CPRA | In Force | Rights of access, deletion, correction, portability, opt-out of sale/sharing, and limit-use of sensitive personal information for California residents. CPPA regulations on automated decision-making technology (ADMT), risk assessments, and cyber audits finalised 2025. Civil penalties up to $7,500 per intentional violation plus statutory damages for breaches. | California Privacy Protection Agency (CPPA) / CA AG | Evidence Chain Model™ + Contract Control Matrix™ |
| State Comprehensive Privacy Laws 20+ states — VCDPA, CPA, CTDPA, UCPA, OCPA, TIPA, DPDPA, ICDPA, TDPSA, MCDPA, NHCDPA, NJDPA, MCDPA, INCDPA, KCDPA, RIDPA, MNCDPA, MDPA, etc. | Patchwork — In Force | As of 2026, 20+ states have enacted comprehensive consumer privacy laws with broadly similar rights (access, delete, correct, opt-out of targeted advertising, sale, profiling). Sensitive-data opt-in in most. Global Privacy Control signal recognition mandatory in several (CA, CO, CT, TX). Each state AG enforces; no federal preemption. | State Attorneys General | Contract Control Matrix™ |
| TSA Security Directives Pipeline SD-02 · Rail · Aviation | In Force | Post-Colonial Pipeline. Pipeline Security Directive 2021-02 (revised 2024) mandates TSA-approved cybersecurity implementation plans, annual assessments, and 24-hour incident reporting to CISA. Parallel directives for passenger/freight rail and aviation operators of TSA-regulated critical infrastructure. | TSA / CISA | Recoverability Mandate™ + Decision Rights Architecture™ |
| FISMA + FedRAMP SI-Cyber 44 U.S.C. §§ 3551–3558 | In Force | Federal Information Security Modernization Act — requires federal agencies and contractors operating federal information systems to implement NIST SP 800-53 controls, annual independent assessments, and continuous monitoring reported through CISA CDM programme. | OMB / CISA / Agency CIO | Evidence Chain Model™ |
Critical Threshold
CIRCIA: 24h / 72h
Critical infrastructure entities must report ransomware payments within 24 hours and substantial cyber incidents within 72 hours to CISA — fastest US federal reporting clock.
Critical Threshold
HIPAA: $2.13M per Category
2025 adjusted penalties — HHS OCR can impose up to $2.13M per violation category per calendar year for wilful neglect, plus state AG and private-action exposure post-HITECH.
Critical Threshold
State AI Laws Live Feb 2026
Colorado AI Act (1 Feb 2026) and Texas TRAIGA (1 Jan 2026) activate the first comprehensive US state AI compliance regimes — impact assessments, risk programs, and AG notification required before deployment of high-risk AI systems.
🌐 Cross Border — Transfers, Safe Harbour, Shared Themes
— frameworks shown
The transatlantic transfer regime sits on the EU-US Data Privacy Framework (with UK and Swiss extensions), standard contractual clauses, and binding corporate rules — backed by US statutory safe-harbours under HIPAA, COPPA, FERPA and GLBA. This panel aggregates the cross-border mechanisms and cross-regulatory themes that apply regardless of home jurisdiction.
🔐 US Data Protection & Safe Harbour / Cross-Border Transfer Frameworks
Since the CJEU struck down Safe Harbour (Schrems I, 2015) and Privacy Shield (Schrems II, 2020), the transatlantic transfer regime has been rebuilt on the EU-US Data Privacy Framework, with a UK extension and a Swiss extension. US federal and sector rules provide additional de-identification and lawful-basis "safe harbours" that often operate alongside the DPF. Any UK/EU controller transferring personal data to the US should confirm which mechanism is current and retain TIA (Transfer Impact Assessment) evidence.
| Framework / Rule | Status | Scope & Key Provisions | Authority | Doctrine Response |
|---|---|---|---|---|
| EU-US Data Privacy Framework DPF — Adequacy Decision (EU) 2023/1795 | In Force | European Commission adequacy decision adopted 10 Jul 2023, permitting personal data transfers to self-certified US organisations without SCCs or BCRs. Certification administered by US Department of Commerce; enforceable by FTC or DoT. Underpinned by EO 14086 signals-intelligence safeguards and the new Data Protection Review Court (DPRC). First periodic review completed Oct 2024; second review due 2027. | European Commission · US DoC · FTC · DPRC | Contract Control Matrix™ + Evidence Chain Model™ |
| UK Extension to EU-US DPF UK-US "Data Bridge" | In Force | Data Protection (Adequacy) (United States of America) Regulations 2023 — in force 12 Oct 2023. Permits transfers of UK personal data to US organisations that have additionally self-certified to the UK Extension of the DPF. Requires specific categories (journalistic, HR, sensitive) to be flagged at certification; ICO retains supervisory jurisdiction for UK data subjects. | UK DSIT · ICO · US DoC | Contract Control Matrix™ |
| Swiss-US Data Privacy Framework | In Force | Swiss FDPIC recognition of US DPF for transfers under the Federal Act on Data Protection (nFADP). Active since 15 Sep 2024. Self-certification adds a Swiss annex to the US DoC DPF programme; FDPIC supervisory role preserved. | Swiss FDPIC · US DoC | Contract Control Matrix™ |
| EO 14086 + DPRC Signals Intelligence Safeguards (Oct 2022) | In Force | Executive Order "Enhancing Safeguards for United States Signals Intelligence Activities" — legal backbone of the DPF. Limits bulk collection to defined national-security purposes, imposes necessity/proportionality tests, and establishes the Data Protection Review Court as binding redress for EU/UK/Swiss data subjects. Retained under the 2025 administration. | ODNI · DoJ · DPRC | Evidence Chain Model™ |
| Standard Contractual Clauses EU SCCs 2021/914 · UK IDTA / Addendum | In Force | Alternative GDPR/UK GDPR lawful-transfer mechanism when DPF self-certification is not available. Requires documented Transfer Impact Assessment (TIA) under Schrems II — assessing US surveillance exposure and supplementary measures (encryption, pseudonymisation, contractual controls). UK IDTA or International Data Transfer Addendum used for UK-origin data. | Data exporter (accountability) · EDPB · ICO | Contract Control Matrix™ + Evidence Chain Model™ |
| Binding Corporate Rules BCRs — GDPR Art. 47 | In Force | Intra-group transfer mechanism for multinationals with US affiliates. Requires lead DPA approval, binding internal policies, third-party beneficiary rights, and ongoing audit. EDPB Recommendations 1/2022 set updated requirements; ICO operates parallel UK BCR approval route. | Lead EU DPA · ICO · EDPB | Decision Rights Architecture™ + Contract Control Matrix™ |
| HIPAA De-Identification "Safe Harbor" 45 CFR § 164.514(b)(2) | In Force | Two HIPAA-recognised de-identification methods: Expert Determination and Safe Harbor. Safe Harbor requires removal of 18 specified identifiers (names, geographic subdivisions smaller than state, dates more granular than year for ages <90, contact details, SSNs, device IDs, biometrics, etc.) and no actual knowledge that remaining data could identify an individual. De-identified data falls outside HIPAA restrictions. | HHS OCR | Evidence Chain Model™ |
| COPPA Safe Harbor Programs 16 CFR § 312.11 | In Force | FTC-approved self-regulatory safe harbours for the Children's Online Privacy Protection Act (operators of sites/apps directed at children under 13). Participation in an approved program (e.g. kidSAFE, PRIVO, TRUSTe/TrustArc, ESRB) shifts primary enforcement to the program with annual audits and FTC oversight. 2025 COPPA Rule update strengthens parental-consent and data-minimisation obligations. | FTC (oversight) · Approved SRO programs | Contract Control Matrix™ |
| FERPA 20 U.S.C. § 1232g · 34 CFR Part 99 | In Force | Family Educational Rights and Privacy Act — protects student education records at institutions receiving US Department of Education funds. Restricts disclosure without parental / eligible-student consent; includes a school-official exception that many EdTech vendors rely on (contractual FERPA safe-harbour language). 2024 NPRM proposes expanded rights and tighter EdTech vendor controls. | US Department of Education — SPPO | Contract Control Matrix™ |
| GLBA Privacy Rule Regulation P — 12 CFR Part 1016 | In Force | Gramm-Leach-Bliley Act privacy rule. Financial institutions must provide initial and annual privacy notices, offer opt-out of non-affiliate data sharing, and comply with reuse/redisclosure limits. Operates alongside FTC Safeguards Rule (security) to form the US financial privacy stack. | CFPB · FTC · Federal banking agencies | Contract Control Matrix™ |
| APEC Cross-Border Privacy Rules CBPR / Global CBPR Forum | In Force | Voluntary certification for transfers across APEC / Global CBPR Forum economies (US, Japan, Korea, Singapore, Canada, Australia, Taiwan, Philippines, UK associate participation). US administered by FTC-recognised Accountability Agents (e.g. TrustArc, Schellman). Provides a parallel safe-harbour style framework for non-EU international transfers. | Global CBPR Forum · FTC · Accountability Agents | Contract Control Matrix™ |
| DPF Active Monitoring Schrems III Risk | Monitoring | NOYB/Schrems has signalled a third challenge to the EU-US DPF on the grounds that EO 14086 still permits bulk collection and DPRC independence concerns. Case pending before CJEU would, if successful, again invalidate transatlantic transfers under the DPF. Firms relying solely on DPF self-certification should maintain SCC/TIA fall-back posture. | CJEU (pending) · EDPB · noyb | Contract Control Matrix™ + Evidence Chain Model™ |
Critical Threshold
DPF Self-Certification Renewal
DPF participants must re-certify annually with the US Department of Commerce. Lapsed certification immediately invalidates the adequacy basis — data exporters must fall back to SCCs+TIA or suspend transfers.
Critical Threshold
HIPAA Safe Harbor — 18 Identifiers
A single retained identifier (even ZIP3 in low-population regions, or a date of service more granular than year) defeats the Safe Harbor — Expert Determination becomes the only remaining de-identification route.
Critical Threshold
Schrems III Watch
Firms transferring EU/UK data to the US should maintain SCC+TIA as a parallel fallback. A CJEU challenge to the DPF could again suspend the adequacy path on short notice, as happened in 2015 and 2020.
🏛 International Enterprise Audit & Risk Management Standards
These frameworks are not jurisdiction-specific regulations but internationally adopted enterprise standards — referenced by procurement teams, enterprise buyers, regulators, and assurance providers across financial services, healthcare, cloud, and critical infrastructure sectors. Demonstrating alignment with or certification against these standards is a core enterprise readiness signal for vendor due diligence and regulated sector deployment.
| Standard / Framework | Status | Scope & Key Requirements | Authority / Body | Doctrine Response |
|---|---|---|---|---|
| ISO 27005:2022 Information Security Risk Management | Current Edition | ISO/IEC 27005:2022 provides guidelines for information security risk management aligned with ISO 27001. Third edition (2022) introduces a risk-treatment-process loop aligned to ISO 31000, replaces the legacy asset-threat-vulnerability paradigm with a scenario-based approach, and integrates directly with ISO 27001:2022 Annex A controls. Covers risk identification, analysis, evaluation, treatment, monitoring, and review. Mandatory reference for ISO 27001 certification audits — ISMS risk assessment methodology must align with 27005 principles. Required reading for any organisation undergoing ISO 27001 Lead Auditor or Lead Implementer assessment. | ISO / IEC JTC 1/SC 27 | Decision Rights Architecture™ + Evidence Chain Model™ |
| SOC 2 Type 2 AICPA Trust Services Criteria — AT-C Section 205 | Active Standard | AICPA System and Organisation Controls (SOC) 2 Type 2 is the primary enterprise assurance report for technology service providers and SaaS companies handling customer data. Evaluates design and operating effectiveness of controls across five Trust Services Criteria: Security (mandatory), Availability, Processing Integrity, Confidentiality, and Privacy. Type 2 covers a minimum 6-month observation period (typically 12 months). Widely required by enterprise procurement, financial services buyers, and US federal contractors. SOC 2 + ISO 27001 dual-certification is increasingly the baseline expectation for regulated sector cloud deployment. The 2022 AICPA SOC for Cybersecurity supplement adds threat-intelligence and supply-chain controls aligned with NIST CSF 2.0. | AICPA / Licensed CPA Firms | Contract Control Matrix™ + Evidence Chain Model™ |
| Basel II / Basel III BCBS Operational Risk & Capital Frameworks | In Force (Basel III fully effective Jan 2025) | Basel Committee on Banking Supervision (BCBS) frameworks governing capital adequacy and operational risk management for internationally active banks. Basel II introduced the three-pillar framework (minimum capital, supervisory review, market discipline) and the Advanced Measurement Approach (AMA) for operational risk. Basel III (2010–2017, phased in through Jan 2025) strengthened capital buffers, introduced liquidity ratios (LCR, NSFR), leverage ratio, and the Standardised Approach for Counterparty Credit Risk. Operational risk — including cyber and technology risk — is now captured under the Standardised Measurement Approach (SMA). EBA Guidelines on ICT and Security Risk Management (2019) and the 2023 EBA Outsourcing Guidelines operationalise Basel III operational risk requirements for EU banks. Directly relevant to AI governance platforms deployed into financial services: model risk, vendor risk, and operational resilience requirements flow from Basel capital frameworks. | BCBS / EBA / PRA / FRB / OCC | Sovereign Banking Protocol™ + Decision Rights Architecture™ |
Cross-Regulatory Focus Areas
Incident Reporting
Strict timelines across all frameworks: 4 hours (DORA/financial), 24 hours (NIS2 early warning), 72 hours (GDPR breach notification). Non-compliance triggers personal liability for directors.
Supply Chain Security
DORA, NIS2, CRA, and the Telecoms Security Act all emphasise securing the entire ICT supply chain. Third-party risk management is now a regulatory requirement, not a best practice.
Active Surveillance
The EU Cyber Solidarity Act establishes SOC networks for cross-border threat detection. Combined with ENISA strengthening under the revised CSA, the EU is building active defence capability.
🇨🇭 Switzerland — National Cyber, Data & AI Regulation
— frameworks shown
Switzerland operates outside the EU but maintains alignment with EU data-protection via adequacy. The revised Federal Act on Data Protection (revFADP/nFADP) entered into force 1 Sep 2023, and the Information Security Act (ISA) built a federal cyber baseline. FINMA governs financial-sector operational risk; NCSC Switzerland is the national CERT.
| Regulation | Status | Key Requirements | Enforcement Authority | Doctrine Response |
|---|---|---|---|---|
| revFADP / nFADP Federal Act on Data Protection | In Force | Revised Federal Data Protection Act in force 1 Sep 2023. Modernises Swiss data law to broadly match GDPR: extended definitions, DPIA obligation, 72h breach notification to FDPIC, new right to data portability. Penal fines up to CHF 250,000 on responsible individuals (not corporate entities). | FDPIC + Cantonal DPAs | Evidence Chain Model™ |
| Information Security Act ISG / LSI | In Force | Federal Information Security Act entered into force 1 Jan 2024. Applies to Confederation, cantons (where using federal info), and operators of critical infrastructure. Mandatory incident reporting to NCSC Switzerland within 24h, federal information-classification regime, and personnel security vetting. | NCSC Switzerland + Chancellery | Recoverability Mandate™ |
| FINMA Circular 2023/1 Operational Risks & Resilience | In Force | FINMA's supervisory circular on operational risks and resilience — in force 1 Jan 2024 for banks and insurers. Requires critical business-function mapping, tolerance for disruption, testing via severe-but-plausible scenarios, and third-party ICT dependency register (aligned with DORA). | FINMA | Recoverability Mandate™ + Evidence Chain Model™ |
| Cyber Reporting Duty Art. 74a ISA | In Force | In force 1 Apr 2024 — critical-infrastructure operators must report cyber attacks to NCSC Switzerland within 24h of detection. Initial reporting scope covers financial, energy, transport, health, telecom sectors; administrative fines up to CHF 100,000 for breach of reporting duty. | NCSC Switzerland | Decision Rights Architecture™ |
| Swiss-US DPF Swiss Data Privacy Framework | In Force | Swiss FDPIC recognition of US DPF (since 15 Sep 2024) — permits transfers of Swiss personal data to self-certified US entities under the Swiss Annex of the DPF, preserving data-subject redress via DPRC. | FDPIC + US DoC | Contract Control Matrix™ |
🇨🇦 Canada — National Cyber, Data & AI Regulation
— frameworks shown
Canada's federal regime rests on PIPEDA for the private sector, alongside provincial statutes (notably Quebec's Law 25). Bill C-27 (Digital Charter Implementation Act) was reintroduced in 2025 and remains pending; it bundles a new privacy law (CPPA), an AI law (AIDA), and a tribunal. Bill C-26 adds a critical-cyber-systems framework for federally regulated sectors.
| Regulation | Status | Key Requirements | Enforcement Authority | Doctrine Response |
|---|---|---|---|---|
| PIPEDA Personal Information Protection and Electronic Documents Act | In Force | Federal private-sector privacy law. Consent-based collection/use/disclosure of personal information in commercial activities. Mandatory breach-of-security-safeguards notification to OPC and affected individuals where real risk of significant harm. Fines up to CAD 100,000 per violation (pre-CPPA framework). | Office of the Privacy Commissioner (OPC) | Evidence Chain Model™ |
| Quebec Law 25 An Act to Modernize Legislative Provisions | In Force | Three-phase rollout: Sep 2022 (privacy officer, breach notification), Sep 2023 (consent, transparency, rights), Sep 2024 (portability). Strictest Canadian privacy regime — GDPR-adjacent. Fines up to CAD 25M or 4% global turnover. Mandatory Privacy Impact Assessments for cross-border transfers. | Commission d'accès à l'information (CAI) | Evidence Chain Model™ + Contract Control Matrix™ |
| Bill C-27 / CPPA Consumer Privacy Protection Act (lapsed — replacement expected) | Lapsed / Expected | Bill C-27 (Digital Charter Implementation Act) lapsed on the Order Paper when Parliament was prorogued January 2025 before receiving Royal Assent. The Liberal government, re-elected April 2025, has signalled intent to introduce a replacement federal private-sector privacy statute in 2026. As of April 2026, no replacement bill has been formally tabled; Privacy Commissioner testified to INDU Committee on expected legislation (priv.gc.ca / IAPP, Jan–Apr 2026). Canada remains governed by PIPEDA (2000) at the federal level pending new legislation. | OPC (current); Privacy Tribunal (proposed) | Evidence Chain Model™ |
| Bill C-27 / AIDA Artificial Intelligence and Data Act (lapsed) | Lapsed | AIDA (Part 3 of Bill C-27) lapsed when Parliament was prorogued January 2025. Canada has no federal AI law in force as of April 2026. The re-elected Liberal government has signalled that AI regulation will now proceed as a separate initiative from privacy reform, allowing more focused policy development. No replacement AI bill has been tabled as of April 2026 (IAPP Canada, 2025; Osler, 2026). | ISED (planned AI Commissioner — not established) | AI Accountability Stack™ |
| Bill C-8 / CCSPA Critical Cyber Systems Protection Act (reintroduced as C-8) | Passed Commons / In Senate | Originally Bill C-26 (died on Order Paper Jan 2025). Reintroduced as Bill C-8 by the Minister of Public Safety, 18 Jun 2025. Passed Third Reading in the House of Commons 26 Mar 2026 (following Speaker's ruling removing prior-judicial-authorisation provisions and committee amendments adding encryption protections); received First Reading in the Senate 26 Mar 2026. Senate Second Reading and committee referral expected imminently. Creates regulatory regime for "designated operators" in federally regulated critical sectors (finance, energy/pipelines, telecom, transport). Mandatory cybersecurity programs, supply-chain risk management, 72h incident reporting to CSE-CCCS. Penalties up to CAD 15M; personal officer liability. Includes 5-year mandatory ministerial review post-Royal Assent (Fasken / parl.ca C-8 45-1, Apr 2026). | Governor in Council + CSE / CCCS | Recoverability Mandate™ |
| OSFI B-13 Technology and Cyber Risk Management | In Force | Office of the Superintendent of Financial Institutions guideline for federally regulated financial institutions. In force 1 Jan 2024 — governance, risk management, cyber incident reporting within 24h of determination of reportable incident, third-party technology risk. | OSFI | Evidence Chain Model™ |
No regulations match your search in this jurisdiction.
Try clearing filters or switching to another jurisdiction tab.
Last updated: 19 April 2026 · Sources: EUR-Lex, European Commission, FCA, PRA, ICO, SEC, ENISA, UK Parliament, DPC, NCSC Ireland, Oifig IS, Ofcom, CMA, OPSS, HHS OCR, CISA, FTC, NIST, NYDFS, CPPA, US DoC
Live Status
Regulatory Enforcement Countdown
Real-time tracking of critical compliance deadlines. These timers update live — when they reach zero, enforcement begins.
Critical Deadline
EU AI Act — Full Application
---Days
--Hours
--Min
--Sec
EU 2024/1689 Art. 113 — High-risk AI obligations enforceable
Active Enforcement
DORA — Supervisory Reviews
LIVEStatus
---Days Active
EU 2022/2554 — In force since 17 January 2025
Imminent
EU Digital Omnibus Trilogue
---Days
--Hours
--Min
--Sec
Political agreement expected — proposes extending AI Act high-risk deadlines + GDPR simplification + single breach notification portal
Monitoring
NIS2 — Transposition Status
13States Non-Transposed
---Days Overdue
EU 2022/2555 — Deadline was 17 October 2024 · 13 of 27 states yet to transpose; EC infringement proceedings ongoing · First audits due 30 June 2026 · First penalties issued Q1 2026 · Digital Omnibus trilogue 28 Apr 2026
Self-Assessment
Governance Readiness Score
Evaluate your organisation's cyber governance maturity in 60 seconds. This diagnostic maps your current posture against DORA, NIS2, and EU AI Act enforcement requirements.
1. Does your board receive structured cyber risk reports at least quarterly?
2. Do you have documented Decision Rights for cyber incident escalation?
3. Can you produce an evidence chain for any control within 24 hours?
4. Have you stress-tested your operational resilience under a severe-but-plausible scenario?
5. Do you have AI governance controls mapped to EU AI Act requirements?
6. Are your third-party/outsourcing contracts governed by enforceable cyber controls?
Compliance is a commercial weapon for those who understand it and an extinction event for those who do not.
DORA. NIS2. EU AI Act. CRA. The organisations that move first set the enforcement standard for everyone else.