Last reviewed 11 November 2026. First published 15 September 2026.
Search for what any current cybersecurity regulation requires and you will find hundreds of articles stating dates with confidence. A good number of those dates are wrong, not because anyone lied, but because compliance deadlines slip and published content rarely gets revisited. An article written in early 2025 describing what was coming that year is still sitting there, still ranking, still being read by someone planning a budget.
So here is a dated account of what is actually in force as of November 2026, what has moved, and what was never a deadline in the first place. We first published it in September. In the eight weeks since, one draft has become final, the first fines have appeared, and one widely quoted deadline has passed without anything happening. It will need updating again. That is rather the point.
Where every deadline stands today
| Regulation | Status on 11 November 2026 | Key date | Source |
|---|---|---|---|
| DORA | In force | Applies since 17 January 2025 | EIOPA |
| PCI DSS v4.0.1 | In force | Future-dated requirements assessed since 31 March 2025 | PCI SSC |
| NYDFS Part 500 | In force | Phase-in complete on 1 November 2025 | NYDFS |
| NIS2 | In force as a directive, national law in 24 of 27 states | Transposition was due 17 October 2024 | European Commission |
| NIST IR 8547 | Final (a draft until last month) | Published 27 October 2026 | NIST |
| CMMC Phase II | Suspended | Was 10 November 2026, no new date | Department of War |
| EU AI Act, high-risk rules | Moved | 2 December 2027 (was 2 August 2026) | EUR-Lex |
| HIPAA Security Rule update | Proposal | Final action projected for July 2027 | Unified Agenda |
| CIRCIA reporting rule | Under review at the White House | Sent 1 October 2026, not yet published | Unified Agenda |
| UK Cyber Security and Resilience Bill | A bill, not law | Back in the Commons since 2 November 2026 | UK Parliament |
| NIS2 amendment, COM(2026) 13 | Proposal | Adoption not expected before the end of 2026 | EUR-Lex |
What is in force as of November 2026
DORA, the EU's Digital Operational Resilience Act, has applied to financial entities since 17 January 2025. The supervisory machinery is running. On 18 November 2025 the European Supervisory Authorities designated the first Critical ICT Third-Party Providers, and the published list names 19 firms including Amazon Web Services, Microsoft, Google Cloud, IBM, Oracle, SAP and Equinix. If you are a financial entity in the EU using any of them, that relationship now sits inside a formal oversight regime.
PCI DSS, the payment card industry's data security standard, now at version 4.0.1, reached a genuine cliff on 31 March 2025. Of the 64 new requirements introduced in version 4, 51 were future-dated and became effective on that date. They were optional best practice before and are assessed requirements after. Anyone whose last assessment predates April 2025 is facing a materially different standard next time.
NYDFS Part 500, New York's cybersecurity regulation for financial services firms, completed its phase-in on 1 November 2025. The final tranche brought in section 500.12, requiring multi-factor authentication for any individual accessing any information system, subject to a limited exemption for smaller covered entities and to compensating controls approved by the chief information security officer. Section 500.13(a) requires written asset inventory procedures tracking, for each asset, its owner, location, classification or sensitivity, support expiration date and recovery time objectives.
NIS2, the EU's network and information security directive, is in force as a directive. That sentence conceals more than it explains, and it belongs in the next section.
What these regimes ask of a file server in particular is covered in our companion article, Secure File Transfer Is a Compliance Requirement.
Compliance deadlines that moved in 2026
CMMC Phase II did not start on 10 November 2026. That date sat on defense contractors' calendars for two years, and it passed this week with nothing taking effect. It is the most recent example and the clearest.
The acquisition rule took effect on 10 November 2025, published in the Federal Register on 10 September 2025, putting the Cybersecurity Maturity Model Certification clause into Department of Defense solicitations. Phase II was due to begin exactly one year later, making third-party certification a condition of award for contracts involving controlled unclassified information.
On 13 July 2026 the Department of War announced the immediate suspension of Phase II, and of every later milestone, pending a task force review due within 60 days. The task force reported to the department's Chief Information Officer in mid September. Its recommendations have not been published, and at the time of this review no replacement date has been announced. Phase I self-assessment obligations and the existing DFARS 252.204-7012 requirements remain in force.
Any defense contractor still budgeting against a November 2026 certification deadline is planning for something that is suspended. Anyone treating the suspension as a cancellation is making the opposite mistake, because the underlying security requirements have not changed.
The HIPAA Security Rule update has slipped by 14 months and is still a proposal. The proposed rule was published on 6 January 2025 and drew 4,747 public comments. It would remove the distinction between required and addressable safeguards, mandate encryption of protected health information at rest and in transit, require multi-factor authentication, and require an asset inventory and network map showing how such data moves.
None of that is law. The Unified Agenda now lists final action for July 2027, moved from a previously indicated May 2026, and the rule sits under long-term actions. The existing Security Rule, as issued in 2003 and amended in 2013, remains operative. Any content telling you HIPAA now requires encryption is describing a proposal.
CIRCIA has missed three target dates and is now one step from publication. The Cyber Incident Reporting for Critical Infrastructure Act required a final rule by 4 October 2025. CISA's agenda moved that to May 2026, then to September 2026, and September passed as well. On 1 October 2026 CISA sent the final rule to the White House for regulatory review, where it is still pending.
A rule under review is closer than this one has ever been, and it is still not a rule. CISA's own page states that organizations are not required to report under CIRCIA until the effective date of a final rule. Reporting in the meantime is voluntary.
NIS2 transposition is still incomplete more than two years past its deadline. Member states were required to transpose the directive into national law by 17 October 2024. In November 2024 the Commission sent letters of formal notice to 23 member states. In May 2025 it issued reasoned opinions to 19. On 8 July 2026 it referred Ireland, Spain, France and the Netherlands to the Court of Justice, requesting a lump sum and daily penalties until transposition is complete.
Since then the map has changed. The Dutch Cyberbeveiligingswet entered into force on 15 August 2026, and Austria's NISG 2026 followed on 1 October. By the count of independent trackers, 24 of 27 member states now have a national NIS2 law in force. France, Ireland and Spain do not.
The practical consequence deserves stating plainly. In three European countries, two of them among the EU's largest economies, there is currently no in-force national NIS2 regime. Organizations there are being sold compliance against a law their own country has not enacted.
The EU AI Act's high-risk obligations moved by 16 months. The obligations for high-risk AI systems listed in Annex III were due to apply from 2 August 2026. Regulation (EU) 2026/1744, the Digital Omnibus on AI, was published in the Official Journal on 24 July 2026 and entered into force three days later, less than a week before that date. Annex III obligations now apply from 2 December 2027, and those for AI embedded in regulated products from 2 August 2028.
The prohibitions and the general-purpose model obligations that were already in force did not move. But anything published before late July that tells you high-risk AI compliance was due in August 2026 was right when written and is wrong now.
NIST IR 8547 moved in the other direction, from draft to final. In the first version of this article it was our example of a draft being cited as a requirement. The widely quoted dates for deprecating current public-key cryptography after 2030 and disallowing it after 2035 came from an initial public draft released on 12 November 2024. On 27 October 2026 NIST published the final version.
Both dates survived, and the final text is stricter than the draft. It deprecates quantum-vulnerable algorithms at every approved key size after 2030, where the draft had left the stronger ones alone until 2035. It is now accurate to cite those dates as NIST's position. It is still not accurate to call them a legal requirement for everyone. The report binds US federal systems through the policies that reference it, and reaches everyone else through procurement terms and vendor roadmaps. What that means for file transfer is the subject of Post-Quantum SFTP: The Ten-Year Problem.
What is not law at all
Several things widely written about as requirements are proposals, and the distinction matters when allocating a budget.
The UK Cyber Security and Resilience Bill has not received Royal Assent. It passed the Commons on 16 June 2026 and completed its Lords stages with Third Reading on 2 November. Because peers amended it, the Bill is now back in the Commons for consideration of those amendments, which is the last step before Royal Assent. Forward dates in Parliament are provisional, and none has been set.
It is a bill, not an act. When it passes it will extend regulation to managed service providers and data centres, which is the change that matters most for anyone running hosted infrastructure for UK clients. Much of the operational detail will then arrive through secondary legislation. None of that has happened yet.
The NIS2 amendment is a proposal. On 20 January 2026 the Commission published COM(2026) 13, which would simplify and harmonize NIS2 and add an obligation on member states to cover post-quantum cryptography migration in their national strategies. Parliament and Council are still forming their positions, and negotiations between them have not begun. Adoption is not expected before the end of 2026, more likely 2027, followed by a year for member states to implement it.
So the directive is being amended before three countries have implemented the original.
Quick check
In force, moved, or not law yet?
Before we go on, see how much stuck. Pick a status for each claim.
HIPAA requires encryption of health data at rest and in transit.
Correct. Not quite. This comes from a proposed rule published in January 2025. Final action is projected for July 2027.
CMMC Phase II certification starts on 10 November 2026.
Correct. Not quite. Phase II was suspended on 13 July 2026, and no new date has been set.
The future-dated PCI DSS v4 requirements are assessed today.
Correct. Not quite. The 51 future-dated requirements became effective on 31 March 2025.
Critical infrastructure operators must report cyber incidents to CISA within 72 hours under CIRCIA.
Correct. Not quite. The final rule is still under White House review. Until it takes effect, reporting is voluntary.
EU AI Act obligations for high-risk systems apply from 2 August 2026.
Correct. Not quite. A July 2026 amendment moved this to 2 December 2027.
Do these regimes actually have teeth?
A reasonable question, given that the enforcement record is thin. The answer is that the powers are real, specific, and already in force. What is still small is the public record of them being used punitively.
Under NIS2, each member state designates a national competent authority. Germany's is the BSI, Italy's the ACN, Belgium's the CCB. Article 32 gives those authorities the power to conduct on-site inspections and off-site supervision, to require independent security audits at the entity's own cost, to run security scans, and to demand evidence that policies have been implemented. Its enforcement powers include binding instructions with deadlines, orders to cease conduct, orders to notify affected customers of a threat, appointment of a monitoring officer, and orders to make the infringement public.
Where those fail, Article 32(5) permits temporary suspension of a certification or authorization, and allows an authority to ask a court to temporarily bar a chief executive or legal representative from holding managerial functions in that organization.
Article 34 sets the fines. For essential entities, member states must provide for administrative fines of a maximum of at least 10 million euros or 2% of total worldwide annual turnover in the preceding financial year, whichever is higher. For important entities the figures are 7 million euros or 1.4%.
Three details about that are usually reported wrongly. The caps apply to infringements of Article 21, the risk management measures, or Article 23, the reporting obligations, not to any NIS2 breach whatsoever. The phrase is "a maximum of at least," which sets a floor on the ceiling each member state must provide, so national law can and sometimes does go higher. And turnover means that of the undertaking the entity belongs to, which is group level and not entity level.
Under DORA, financial entities are supervised by their existing national competent authorities. Critical ICT third-party providers are supervised directly by an EU Lead Overseer, which can request information, conduct off-site investigations and on-site inspections, and impose periodic penalty payments. Where a provider does not comply with a Lead Overseer recommendation, financial entities' own supervisors can require them to suspend or terminate use of that provider.
Has anyone been fined under NIS2 or DORA?
Yes, as of this review, though only just. The first version of this article said that no NIS2 fine and no named DORA enforcement action could be verified against an official source. Both statements needed correcting, and the first examples are instructive.
The first DORA fine we can verify came from Austria. On 14 July 2026 the Financial Market Authority announced a fine of 42,000 euros on Western Union International Bank GmbH for repeatedly late incident reports under Article 19(4). That announcement predates our first version, which missed it. It is corrected here.
The first NIS2 fine we can verify came from Romania. On 29 September 2026 the national cybersecurity directorate, DNSC, fined a central public administration body 50,000 lei, roughly 10,000 euros, for missing the deadline to notify the authority that it fell within scope.
Both fines are small. Both punish a missed administrative deadline, not a security failure. Lists of larger "first NIS2 fines" circulate online, but we could not trace them to an official decision and have left them out. That the record is this thin has four distinct causes, and they are frequently conflated.
Transposition is still incomplete. NIS2 is a directive, which means it has no direct effect until a member state enacts national law. In France, Ireland and Spain there is no NIS2 fining power because there is no NIS2 statute. There is nothing to report in those countries because the mechanism does not yet exist.
Supervision started late even where the law exists. Germany's implementing act only entered into force on 6 December 2025, and its registration portal opened in January 2026. The BSI's own published statistics show 20,141 registered entities and 1,272 initial incident notifications as of 30 September 2026, and report no fines. Regulators are building registers and beginning audits, which is the phase before sanctions and not the absence of them.
Decisions may exist without being published. NIS2 contains no EU-level obligation to publish fines. Making an infringement public is one optional enforcement measure among several. National administrative penalties often go unpublished or appear only in aggregate annual statistics. So a short list of published fines is not proof that few have been imposed.
For DORA the inference is stronger. Article 54 requires competent authorities to publish decisions imposing administrative penalties on their official websites, without undue delay, once no longer subject to appeal. The Austrian decision surfaced exactly that way. Continued silence elsewhere is better evidence that few final penalties have been reached.
For context on timing, GDPR became applicable on 25 May 2018, and the first substantial fine, the French data protection authority's 50 million euro penalty against Google, came in January 2019, roughly eight months later. That was a directly applicable regulation, enforced by authorities that already existed and were already staffed, under a regime with a strong publication culture.
NIS2 is a directive that three member states have still not transposed 25 months past the deadline. DORA has been applicable for nearly 22 months and produced its first published fine after 18. What we are looking at is what an enforcement ramp normally looks like.
Where the actual requirements live
A related complaint is that these regulations are vague. Read only the headline instrument and that is a fair impression. The specificity lives one layer below, in implementing acts and technical standards, and it is considerable.
For NIS2, Article 21(2) lists ten categories of measure in general terms. The operational detail for digital infrastructure providers is in Commission Implementing Regulation (EU) 2024/2690, whose annex reads like a controls checklist. It requires, for instance, that security patches be applied within a reasonable time after becoming available and that they be tested before being applied to production systems, and that entities perform regular integrity checks on backup copies.
For DORA, the detail is in Commission Delegated Regulation (EU) 2024/1774. Article 21 requires that access rights be reviewed at least annually for ordinary systems and at least every six months for systems supporting critical or important functions. Article 6 requires a policy covering encryption of data at rest and in transit.
For PCI DSS, the requirements and testing procedures document is the standard itself, and it is granular to the level of specifying that firewall ruleset configuration standards must be defined, implemented and maintained.
For CMMC, 32 CFR Part 170 incorporates the 110 security requirements of NIST SP 800-171 Revision 2 by reference. Note the version. NIST withdrew Revision 2 in favor of Revision 3 in May 2024, but CMMC remains legally anchored to Revision 2, and the Department of War's July 2026 interim position keeps self-assessments on that revision.
If a compliance requirement seems vague, it is usually because you are reading a summary of the directive and not the implementing act underneath it.
What these rules mean for secure file transfer
Most of these regimes never mention SFTP. Their requirements land on it anyway, because a file transfer server is where partner accounts, encryption settings and audit evidence all meet.
Take the examples above. Access reviews every six or twelve months include every partner account on your file server, including the ones nobody has used since the project ended. An encryption policy for data in transit is, in practice, the list of protocols, ciphers and key exchange algorithms that server will accept. Multi-factor authentication "for any individual accessing any information system" covers its admin console too. And the first thing any supervisor asks for is evidence, which means audit logs you can show have not been altered.
This is the part of compliance we build for. Syncplify Server! is a self-hosted SFTP, FTPS and HTTPS server with granular permissions per user and per folder, sign-in through your identity provider with OIDC, passkeys and two-factor authentication, and cryptographically signed, tamper-evident audit logs. It already negotiates hybrid post-quantum key exchange (ML-KEM-768 with X25519), and ML-KEM-768 is the parameter set the final NIST IR 8547 recommends as the default.
No file server makes an organization compliant by itself, and we would be wary of any vendor who says otherwise. What the right one does is make the file transfer layer the part of the audit you do not have to explain. Our compliance page covers the detail. If you would rather not run a server at all, SFTP.cloud is our hosted SFTP service, and your files stay in storage you control.
How to check any compliance deadline yourself
None of the above required specialist knowledge. It required going to the source, and the sources are public.
For EU law, EUR-Lex carries the text of every regulation and directive along with its status. A document reference beginning with COM is a proposal.
For UK legislation, the Parliament bills site shows every stage a bill has passed, with dates. If Royal Assent is absent, it is not law.
For US federal rules, the Unified Agenda records what stage each rulemaking has reached and the date the agency currently projects. Those projections are revised regularly, which is exactly why published articles go stale. A rule listed as under review has not been published.
For NIST publications, status appears on the publication page. Anything marked ipd is an initial public draft.
Worth checking today
Three questions resolve most claims.
1Is this in force, or proposed?
2What is the date of the source being cited?
3Has anyone actually been penalized under it?
A closing thought
Compliance content decays in a particular way. It is written when something is genuinely imminent, it is accurate on the day of publication, and then it stays exactly as it was while the world moves. Nobody is being dishonest. Articles simply do not get revisited, and there is no commercial reason to update a page to say that a deadline has receded.
The result is an accumulated layer of confident, dated, quietly wrong information about what organizations must do. It tends to point in one direction, because the version that overstates urgency is the version somebody had a reason to write.
What follows is not that regulation should be taken less seriously. DORA is in force, PCI's future-dated requirements are now assessed, the supervisory powers are real and specific, and the first fines have been published. It is that the date on the article matters as much as the claim in it, and that checking takes about ten minutes.
This article went out of date too. Eight weeks after it was first published, several of its statements needed correcting, and they are corrected above. It carries the date it was last reviewed at the top, which is the only honest way to publish something like this.
Questions we hear often
-
No. It is still a proposed rule, published on 6 January 2025. The Unified Agenda projects final action for July 2027. Until a final rule is published and takes effect, the existing Security Rule applies, including its distinction between required and addressable safeguards.
-
There is no date. Phase II was due on 10 November 2026 and was suspended on 13 July 2026, together with every later milestone. The task force review has not been published. Phase I self-assessments and DFARS 252.204-7012 still apply.
-
No. CISA sent the final rule to the White House for review on 1 October 2026, and it has not been published. Reporting under CIRCIA becomes mandatory only on the effective date that the final rule sets. Until then it is voluntary.
-
As of early November 2026, France, Ireland and Spain have no national NIS2 law in force. The Netherlands (15 August 2026) and Austria (1 October 2026) were the most recent to bring one into force. The transposition deadline was 17 October 2024.
-
Yes, since 27 October 2026. It deprecates quantum-vulnerable public-key algorithms after 2030 and disallows them after 2035. It binds US federal systems through the policies that reference it. For everyone else it is guidance, though vendors and buyers increasingly plan around it.
-
Yes, in small amounts. Austria's FMA fined a bank 42,000 euros under DORA in July 2026 for late incident reports. Romania's DNSC issued a 50,000 lei NIS2 fine in September 2026 for a late registration notice. No fine near the statutory maximums has been published.