GRC
Compliance
Laws, frameworks and deadlines in plain English: what changed, who it affects, what to do now.
New and changing regulationsFramework updates (NIST, ISO 27001, PCI DSS, SOC 2)Incident-reporting deadlinesEvidence and audit readiness
CIRCIA: prepare for 72-hour incident reporting
CISA's final CIRCIA rule was slated for September 2026 in the Unified Agenda. When it takes effect, covered critical-infrastructure entities must report covered incidents within 72 hours and ransom payments within 24 hours. Check the Federal Register for publication status and the effective date.
Do this now: Decide whether each legal entity is covered, and build one notification matrix that runs CIRCIA, SEC, HIPAA and state clocks side by side.
EU AI Act: high-risk deadlines pushed back
Under the Digital Omnibus deal, high-risk obligations for stand-alone (Annex III) systems move to December 2, 2027, and for AI inside regulated products (Annex I) to August 2, 2028. The Parliament approved it in June; confirm final Council adoption and Official Journal publication.
Do this now: Use the extra time to finish your AI inventory and risk classification instead of pausing the program.
Map this month's patches to your controls
Exploited vulnerabilities on the CISA KEV list are a clean piece of audit evidence: they show whether your patch-management control actually works on deadline.
Do this now: Record the date each KEV item from this issue was patched. That timeline is ready-made evidence for SOC 2, ISO 27001 and PCI DSS reviews.