Leaving your GRC vendor may be about to get cheaper. Taking your audit trail with you is a separate problem. It is the one that decides whether you can actually leave. The EU Data Act takes away the exit fee.
AIFMD II did not arrive in one piece. It arrived in two. The first wave reached the rulebook in April 2026.
Most privacy teams talk about Maryland's cure period as if it were a safety net. It is not a net. It is a door the regulator may choose to open. And the statute already says which violations that door can open for.
Most German goods dealers think money-laundering law is about cash. Take no large cash payments, the reasoning goes, and the Geldwäschegesetz (GwG) has nothing to say to you.
If software already screens your applicants, approves or declines your loans or allocates your shifts, you have about 13 weeks. Not to write a policy.
Your first California cybersecurity audit report is due in April 2028. That date is a distraction. The period the auditor examines opens in about three months.
There is no such thing as a "mid-application" crypto firm in Europe any more. That status existed for eighteen months.
Most Australian entities ran their CPS 230 contract work off renewal dates. Insert the new terms when the agreement comes up, and the problem solves itself.
A vendor hands you a certificate. You need to conclude something about one model, inside one product, making one class of decision about your customers. The certificate will not tell you that.
Sixteen weeks from now a date lands that does not ask you to replace a single algorithm. 31 December 2026 is the EU's first post-quantum checkpoint.
Your client hired you to run their CUI environment. That decision moved your service inside their assessment. Not next to it. Inside it.
In one week, a European reporting duty switches on for software you shipped in 2019 and stopped thinking about in 2021. Most of the Cyber Resilience Act does not apply until December 2027.
Correction (14 September 2026): After this piece was published, Regulation (EU) 2026/1744 (the Digital Omnibus, OJ 24 July 2026, in force 27 July 2026) amended Article 113 of the AI Act and postponed the high-risk applic…
The MFA box on your insurance renewal takes one answer. Your estate has at least three. Push notifications for the service desk. TOTP for finance. Hardware keys for the four people with domain admin.
Adopting AI does not rewrite your control framework. It re-weights it. NIST has now said so with unusual precision.
China's privacy law tells you to audit yourself regularly. It does not tell you how often, who runs it, or what the file has to contain.
The lowest-risk IVDs in Europe are the last products to get a barcode duty on their label. They are also the only products where nobody independent looks at that label before an inspector does.
The regulator with the deepest reach into your most critical vendor will never knock on your door.
The certificate is not the hard part. Phase 2 of the CMMC rollout moves third-party certification from something you plan for into something that gates the award itself.
The EHDS Regulation is in force. Almost none of it applies yet. Article 105 is the reason, and it is not an application date.
Two days ago, the Delete Act stopped being a registration statute. Civil Code § 1798.99.86(c)(1) opens with a date that has now passed: "Beginning August 1, 2026, a data broker shall access the accessible deletion mechan…
On 12 January 2027 the bill for leaving your cloud provider goes to zero. Not reduced. Not capped at cost. Zero.
A CPPA risk assessment is not a document you file away. It is a count an executive swears to.
India's Digital Personal Data Protection Act does not switch on all at once. The statute was passed in 2023. The obligations are written.
The asset inventory is where most compliance programs quietly go stale. Someone exports a spreadsheet before an audit. Columns for system name, owner, data type, maybe a "sensitivity" tag filled in from memory.
Your risk register is the first thing an auditor, a board member, or a plaintiff's counsel will pull apart. And most registers do not survive the second question.
Most third-party risk programs end the same way: a folder of completed questionnaires nobody has scored, filed against vendors nobody has re-assessed since onboarding. The questionnaire got answered.
Most CRA obligations do not bite until 11 December 2027. One does not wait. Article 14 of the Cyber Resilience Act, Regulation (EU) 2024/2847, applies from 11 September 2026. That is roughly seven weeks from today.
The Digital Services Act did something quietly radical. It took risk assessment, which most compliance regimes treat as a document, and attached it to an audit that has to be redone every year at the platform's own expen…
Here is the uncomfortable part most teams discover late: your DORA ICT third-party risk register is not a compliance artifact you file once and forget.
A certificate is not a legal conformity assessment. Say that first, because the market is starting to blur the two.
The question is no longer whether the EU Digital Identity Wallet ships. It is whether your organization can accept one when a user presents it, and whether you are legally obliged to.
When one of your cloud, data-centre, or managed-service providers lands on the European Supervisory Authorities' annual list of critical ICT third-party service providers, the relationship stops being a private commercia…
The EU Data Act, Regulation (EU) 2023/2854, has applied since 12 September 2025. That is not a proposal date or a transposition target.
The transitional window closed on 1 July 2026. Crypto-asset service providers that had been operating across the EU under national regimes have now either secured authorization under MiCA, or they have lost the legal bas…
Phase 1 of the CMMC Program is the point where cybersecurity stops being a clause you scroll past and becomes a gate on the award itself.
Most sustainability teams built their CSRD program the way you build a bridge: survey the ground once, pour the foundations, and assume the terrain will hold. Then the 2025 Omnibus moved the ground.
Most records of processing activities are not records. They are archaeology. A spreadsheet built for a data-mapping exercise two years ago, updated the week before an audit, and otherwise untouched while the actual proce…
The European Health Data Space is not a future regulation you can park. Regulation (EU) 2025/327 was adopted on 11 February 2025 and is already in force. The application dates are fixed.
The Colorado AI Act stopped being a future problem on June 30, 2026. As enacted, SB 24-205 wrote its operative duties to apply "on and after February 1, 2026." A 2025 amendment, SB 25-004, pushed the applicability date t…
Your NYDFS certification is not a form. It is an attestation that the data behind it exists, is current, and could be produced on demand. That distinction is where most covered entities will get caught in 2026.
EMIR did not get rewritten. It got a new gravity well. For more than a decade, the question under the European Market Infrastructure Regulation was binary: is this class of OTC derivative subject to the clearing obligati…
DORA (Regulation (EU) 2022/2554) entered application on 17 January 2025. The first full annual cycle has now run its course. That changes the question for compliance officers.
The algorithm decision is already made. NIST made it for you when it published FIPS 203 in August 2024 and named ML-KEM the standard mechanism for establishing a shared secret key that survives a quantum computer.
India built its privacy law in two layers, and most teams only read the first one. The Digital Personal Data Protection Act, 2023 is the statute.
Most CMMC programs are built to pass a date. The certification assessment is treated as the deliverable.
Correction (14 September 2026): This piece was written against the AI Act's original timeline.
CPS 230 commenced on 1 July 2025. The transitional grace for pre-existing service provider contracts runs out on the earlier of the next renewal date or 1 July 2026. That second date is now weeks away.
A defense contract can now be lost on a number you posted to a government database yourself.
A gatekeeper designation under the EU's Digital Markets Act is not a verdict you serve and move past. It is the start of a compliance relationship that never closes.
DORA entered application on 17 January 2025. A year on, most financial entities have a register of information and a testing programme.
Your legal team signed off on an AI vendor last quarter. Your data science group shipped a model into a customer-facing workflow the quarter before.
The CER Directive has a date on it now, and it is close. By 17 July 2026, every EU member state must finish identifying which organizations on its territory count as critical entities.
There is a category error sitting at the center of most SFDR programs. It is the assumption that the Sustainable Finance Disclosure Regulation asks you to produce documents. It does not.
Most CSRD programmes start in the wrong building. They start in sustainability or corporate communications, with a glossary, a stakeholder survey, and a deck about purpose.
The most expensive misreading of the SEC cybersecurity disclosure rules is also the most common one: that you have four business days from discovering an incident to file. You do not.
For three years, "we are still inside the transitional window" was a defensible answer to a DFS examiner. That answer is gone. The Second Amendment to 23 NYCRR 500 took effect November 1, 2023.
The Texas Data Privacy and Security Act is no longer a future obligation. The Act took effect July 1, 2024, and its last deferred provision, the authorized-agent and universal opt-out mechanism in Section 541.055(e), too…
Your control matrix looks finished. Every line item maps to a Trust Services Criterion. CC6.1 has an owner, CC7.2 has a policy, CC8.1 points at your change process.
If your device runs software, the EU MDR already regulates its cybersecurity. Not as a recommendation, and not in a separate annex you can defer.
Most teams chasing ISO 27001 spend ninety percent of their energy on Annex A. They build a control matrix, argue about whether they need a clear-desk policy, and treat the rest of the standard as a cover sheet.
Most payment firms are doing the regulatory equivalent of packing for a trip whose itinerary hasn't been confirmed.
"Addressable" is the most expensive word in the HIPAA Security Rule, because most teams read it as "optional." It is not optional.
If you sell cloud, managed services, software, or any ICT capability into EU banks, investment firms, payment institutions, or insurers, DORA is already in your contracts.
Here is a question worth asking your compliance team this quarter: which of your obligations under the EU Data Act are currently covered by your data governance program? If the answer is "the Data Act is a privacy thing,…
Most teams reading NIS2 for the first time go looking for a control list and come back frustrated. Article 21 does not hand you 114 controls the way ISO 27001 Annex A does.
Article 28 is the contractual backbone of every controller–processor relationship under GDPR. Here is what the text actually requires, where organisations fall short, and how to close the gap before a supervisory authority does.
Prohibited AI practices have been enforceable since February 2025. GPAI model obligations landed in August 2025. Now the clock is ticking on Article 50 transparency duties - they apply from 2 August 2026. Here is what you must have in place today, and what to build before next summer.
DORA Article 28 turns the register of information from a vendor list into a supervised, always-current record. Here is exactly what it must contain, who maintains it, and what an inspection probes.
The annual audit gives you a photograph of a river. Continuous compliance gives you the water itself. It is time to stop framing snapshots as truth and start treating control posture as the living system it actually is.
The NIS2 Directive's EU-wide transposition deadline passed in October 2024, but member-state implementation is patchy - leaving essential and important entities caught between inconsistent national rules and real enforcement exposure. Here is the plain-language compliance agenda.
Most risk platforms give you a number. Aigis GRC gives you three - and the story behind each one. Here is how the inherent–effectiveness–residual stack works, and why it matters when a regulator or board asks you to show your work.
Running GDPR, SOC 2, ISO 27001, and DORA audits back-to-back shouldn't mean rebuilding your evidence pack four times. A unified control library maps once and satisfies many - here's how to build one that actually holds up.
An illustrative composite - not a specific customer. Running SOC 2 and ISO 27001 as two separate audits burns time, money, and engineering bandwidth a growth-stage fintech rarely has. Here is how a single overlapping evidence cycle could satisfy both.
One email. What changed across 295 instruments, why it matters for teams like yours, and the control to check before your next audit.
Aigis GRC is built by operators who spent years navigating audits and managing risk registers in spreadsheets. Security Insights is where that experience gets written down: analysis grounded in real data from CIS, NIST, DBIR, and regulatory guidance - not opinion.
About Aigis GRCFormer CIO & CISO across FCA-regulated fintech, IoT, and cyber defense. 25 years on the operator side of GDPR, ISO 27001, and financial-services audits.
Systems architect, embedded firmware to cloud-scale AI. Designed the Aigis intelligence engine: regulation ingestion, risk modeling, and compliance automation.
