What's changing in frameworks and regulation, and what recent incidents teach. Every item links to its source.
Regulatory landscape · Jul 27, 2026 · EU
EU AI Act: high-risk deadlines pushed back
The Digital Omnibus on AI, in force since 27 July 2026, moves Annex III high-risk obligations (uses such as hiring, credit and education) from 2 August 2026 to 2 December 2027, and Annex I (AI inside regulated products) to 2 August 2028. Transparency and general-purpose AI obligations keep their original dates.
Reported consistently by several law firms; check the Official Journal text for exact dates.
The Critical Cyber Systems Protection Act received Royal Assent in June 2026. Its core duties, including a cybersecurity program for designated operators in critical sectors, begin once an order brings the Act into force and operators are designated.
The three-year transition to ISO/IEC 27001:2022 ended on 31 October 2025. Certification is now against the 2022 edition and its reorganized Annex A of 93 controls.
The Digital Operational Resilience Act has applied since 17 January 2025: ICT risk management, incident reporting, resilience testing and oversight of critical ICT third-party providers.
CSF 2.0 added Govern as a sixth function, alongside Identify, Protect, Detect, Respond and Recover, covering cyber risk strategy, roles and supply-chain risk. NIST continues to publish quick-start guides and mappings for it.
The first certifiable management-system standard for AI, now a common anchor for AI governance programs alongside the NIST AI RMF and EU AI Act readiness.