Tracker
Regulation tracker
The rules that change what IT teams have to do about security, backups, data and cyber insurance, in one place: what each one is, where it stands and the next date that matters. Every row links to the official source. We check those sources every day; when one changes, the row is marked until we have read the change and updated it.
Last change 28 October 2026. Status text is written from the official source on the date shown in the row's link; Bill rows come straight from the UK Parliament bills record.
Recently moved
Nothing has moved since we started checking.
Next key dates
- 2 November 2026: Cyber Security and Resilience Bill, Next sitting
- 18 March 2027: FCA operational resilience and incident reporting, Incident and third party reporting rules come into force
- 2 December 2027: AI Act (2024/1689), High-risk rules for biometrics, critical infrastructure, education, employment and similar uses apply (product-embedded systems follow on 2 August 2028)
- 11 December 2027: Cyber Resilience Act (2024/2847), Main obligations apply
United Kingdom
| Rule | Where it stands | Next key date | Official source |
|---|---|---|---|
| Cyber Security and Resilience Bill Security | Not yet law. The Bill is at third reading in the House of Lords. It is scheduled for 2 November 2026. | Next sitting: 2 November 2026 | Our tracker page · GOV.UK Bill collection · Our guide |
| Ransomware payment ban and incident reporting proposals Security, Cyber insurance | Proposals. The Home Office consultation ran from 13 January to 8 April 2025 and the government response was published on 22 July 2025. It covers a targeted payment ban for public sector bodies and regulated critical national infrastructure, a payment prevention regime for everyone else and mandatory incident reporting, and says the measures are still being developed with industry. | No Bill introduced yet | GOV.UK consultation and government response · Our guide |
| Cyber Extortion and Ransomware (Reporting) BillA private member's bill (Bradley Thomas MP); most private members' bills do not become law. Security | Not yet law. The Bill is at second reading in the House of Commons. | Next stage not yet scheduled | UK Parliament Bill page · Our guide |
| Data (Use and Access) Act 2025 Data protection | Law. Royal Assent on 19 June 2025; commenced in stages by regulations. Most of the data protection and privacy changes came into force on 5 February 2026, and the Information Commission replaced the Information Commissioner's office from 30 September 2026. | Remaining provisions, including the data subject complaints process (section 103), commence by further regulations | GOV.UK commencement plans · The Act on legislation.gov.uk · Our guide |
| Product security regime (PSTI Act 2022 and 2023 Regulations) Hardware and gadgets | In force since 29 April 2024 for manufacturers, importers and distributors of consumer connectable products, including publishing the minimum security update period, enforced by the Office for Product Safety and Standards. | No dated change announced | GOV.UK product security regime |
| FCA operational resilience and incident reporting Finance, Backup and recovery | In force. The operational resilience rules applied from 31 March 2022 and firms had until 31 March 2025 to show they can stay within impact tolerances. On 18 March 2026 the FCA published final rules (PS26/2) on reporting operational incidents and material third party arrangements. | Incident and third party reporting rules come into force: 18 March 2027 | FCA operational resilience · Our guide |
European Union
| Rule | Where it stands | Next key date | Official source |
|---|---|---|---|
| NIS2 Directive (2022/2555) Security | In force. Member states had until 17 October 2024 to transpose it into national law and it replaced NIS1 from 18 October 2024. On 20 January 2026 the Commission proposed targeted amendments as part of a new cybersecurity package. | The proposed amendments go through the European Parliament and Council | European Commission NIS2 page · Our guide |
| Digital Operational Resilience Act (DORA, 2022/2554) Finance, Backup and recovery | Applies since 17 January 2025 to banks, insurers, investment firms and other financial entities and their ICT third-party providers. | No dated change announced | EIOPA DORA page · Our guide |
| Cyber Resilience Act (2024/2847) Hardware and software products | In force since 10 December 2024. From 11 September 2026 manufacturers must report actively exploited vulnerabilities and severe incidents. The Commission published practical guidance on 27 July 2026. | Main obligations apply: 11 December 2027 | European Commission CRA page |
| AI Act (2024/1689) AI | In force. The general-purpose AI rules applied from August 2025 and the transparency rules from August 2026. The AI Omnibus, in force since 27 July 2026, reset the timetable for high-risk systems. | High-risk rules for biometrics, critical infrastructure, education, employment and similar uses apply (product-embedded systems follow on 2 August 2028): 2 December 2027 | European Commission AI Act page |
| Data Act (2023/2854) Cloud and backup | Applies since 12 September 2025, including the rules that let customers switch between cloud and data-processing providers. | No dated change announced | European Commission Data Act page |
United States
| Rule | Where it stands | Next key date | Official source |
|---|---|---|---|
| CIRCIA cyber incident reporting rule (CISA) Security | Proposed. CISA published the proposed rule on 4 April 2024 and says it continues to work on the final rule; it held town hall meetings in June 2026 and the rule is listed at the final rule stage in DHS's August 2026 regulatory agenda. Reporting is not required until the final rule takes effect. | Final rule | CISA CIRCIA page · Federal Register documents · Our guide |
| SEC cybersecurity disclosure rules Security, Finance | In force. Adopted on 26 July 2023: material incidents on Form 8-K from 18 December 2023, and annual risk management and governance disclosure for fiscal years ending on or after 15 December 2023. | No dated change announced | SEC press release |
| HIPAA Security Rule update (HHS) Security, Healthcare | Proposed. HHS published the proposed rule to strengthen the cybersecurity of electronic protected health information on 6 January 2025 (90 FR 898). HHS's later rulemaking in July 2026 says it has not been finalised. | Final rule | Federal Register documents |
Cyber insurance
| Rule | Where it stands | Next key date | Official source |
|---|---|---|---|
| PRA cyber insurance underwriting risk (SS4/17) Cyber insurance | In force. The PRA's expectations for insurers on non-affirmative (silent) cyber risk, cyber risk strategy and risk appetite; the current version was published on 15 November 2024 and took effect on 31 December 2024. | No dated change announced | Bank of England SS4/17 |
Get told when a rule moves. The Future Brief, our free weekly email on backup, recovery and security, lists the rules that moved each week.
How this page works
- UK Bills are read from the UK Parliament bills API each morning, so their stage and next sitting are always current. The Cyber Security and Resilience Bill tracker has every stage and document.
- Other rules are checked against the official page listed in the row. A change marks the row "under review" until a person has read it and rewritten the status.
- This is a summary for IT and operations teams, not legal advice. Dates come from the sources linked; check them before you rely on them.
Bill data contains Parliamentary information licensed under the Open Parliament Licence v3.0.