Threat & regulation tracker
Deadlines worth a place in your plan. A running tracker of the cyber and AI regulations that actually affect UK and EU organisations. Click any entry for who it affects, the dates that matter, and how we’d help you get ready.
Last reviewed 6 October 2026 .
DORA Financial services In force · In force since Jan 2025 Binding ICT risk and operational-resilience requirements for EU financial entities and their critical ICT third parties. FCA, PRA and Bank of England incident and third-party reporting UK · Financial services Upcoming · March 2027 One reporting regime across the three UK regulators for operational incidents and material third-party arrangements. Published March 2026, in force 18 March 2027. EU AI Act: GPAI & first obligations AI In force · In force since Aug 2025 Prohibited-practice bans and AI-literacy duties have applied since February 2025; general-purpose AI rules, governance bodies and penalties since August 2025. EU AI Act: transparency & high-risk AI Phased · Transparency since Aug 2026, high-risk Dec 2027 Transparency duties have applied since August 2026; high-risk obligations for standalone systems now apply from December 2027 under the Digital Omnibus adopted in June 2026. UK organisations serving EU users can be in scope. EU Cyber Resilience Act (CRA) Product security Phased · Reporting since Sept 2026, full Dec 2027 Security-by-design and vulnerability-handling duties for makers of products with digital elements. Incident and vulnerability reporting has applied since September 2026; full obligations from December 2027. NIS2 Cross-sector Phased · In national law in most member states Expands baseline cybersecurity and incident-reporting duties to far more sectors, via member-state law, now in place in most EU countries. UK companies with EU operations may inherit obligations. UK Cyber Security and Resilience Bill UK · Cross-sector Upcoming · In the House of Lords The UK’s NIS2-equivalent, not yet law: it passed the Commons in June 2026 and is now in the Lords. It extends incident-reporting and baseline security duties to more sectors, including managed-service providers and data centres. PCI DSS 4.0.1 Card data In force · In force since March 2025 The card-data security standard’s future-dated v4 requirements are now mandatory for any organisation that stores, processes or transmits payment-card data. ISO 42001 AI In force · Available now The AI Management System standard, increasingly expected by procurement as evidence of responsible AI governance. This tracker is a general guide, not legal advice. Dates and scope can change as laws are finalised and transposed; check the official source for the detail that applies to you.
Not sure which of these apply to you? Bring your situation to a 30-minute call with a senior advisor. We’ll tell you honestly what’s in scope and the shortest credible route to ready.
Book a call