What's changing in frameworks and regulation, and what recent incidents teach. Every item links to its source.
Regulatory landscape · Jul 27, 2026 · EU
EU AI Act: high-risk deadlines pushed back
The Digital Omnibus on AI, in force since 27 July 2026, moves Annex III high-risk obligations (uses such as hiring, credit and education) from 2 August 2026 to 2 December 2027, and Annex I (AI inside regulated products) to 2 August 2028. Transparency and general-purpose AI obligations keep their original dates.
Reported consistently by several law firms; check the Official Journal text for exact dates.
The Critical Cyber Systems Protection Act received Royal Assent in June 2026. Its core duties, including a cybersecurity program for designated operators in critical sectors, begin once an order brings the Act into force and operators are designated.
The Digital Operational Resilience Act has applied since 17 January 2025: ICT risk management, incident reporting, resilience testing and oversight of critical ICT third-party providers.