Search for what any current cybersecurity regulation requires and you will find hundreds of articles stating dates with confidence. A good number of those dates are wrong, not because anyone lied, but because regulations slip and published content rarely gets revisited. An article written in early 2025 describing what was coming that year is still sitting there, still ranking, still being read by someone planning a budget.
So here is a dated account of what is actually in force as of August 2026, what has moved, and what was never a deadline in the first place. It will need updating too. That is rather the point.
DORA, the EU's Digital Operational Resilience Act, has applied to financial entities since 17 January 2025. The supervisory machinery is running. On 18 November 2025 the European Supervisory Authorities designated the first Critical ICT Third-Party Providers, and the published list names 19 firms including Amazon Web Services, Microsoft, Google Cloud, IBM, Oracle, SAP and Equinix. If you are a financial entity in the EU using any of them, that relationship now sits inside a formal oversight regime.
PCI DSS, the payment card industry's data security standard, reached a genuine cliff on 31 March 2025. Of the 64 new requirements introduced in version 4, 51 were future-dated and became effective on that date. They were optional best practice before and are assessed requirements after. Anyone whose last assessment predates April 2025 is facing a materially different standard next time.
NYDFS Part 500, New York's cybersecurity regulation for financial services firms, completed its phase-in on 1 November 2025. The final tranche brought in section 500.12, requiring multi-factor authentication for any individual accessing any information system, subject to a limited exemption for smaller covered entities and to compensating controls approved by the chief information security officer. Section 500.13(a) requires written asset inventory procedures tracking, for each asset, its owner, location, classification or sensitivity, support expiration date and recovery time objectives.
NIS2, the EU's network and information security directive, is in force as a directive. That sentence conceals more than it explains, and it belongs in the next section.
CMMC Phase II was suspended three weeks ago. This is the most recent example and the clearest.
The acquisition rule took effect on 10 November 2025, published in the Federal Register on 10 September 2025, putting the Cybersecurity Maturity Model Certification clause into Department of Defense solicitations. Phase II was due to begin on 10 November 2026, extending third-party certification requirements considerably.
On 13 July 2026 the Department of War announced the immediate suspension of Phase II requirements pending a task force review due within 60 days. Phase I self-assessment obligations and the existing DFARS 252.204-7012 requirements remain in force.
Any defense contractor budgeting against a November 2026 certification deadline on the basis of content written before mid-July is planning for something that is currently suspended.
The HIPAA Security Rule update slipped by more than two years. The proposed rule was published on 6 January 2025 and drew 4,747 public comments. It would have removed the distinction between required and addressable safeguards, mandated encryption of protected health information at rest and in transit, required multi-factor authentication, and required an asset inventory and network map showing how such data moves.
None of that is law. The Unified Agenda now lists final action for July 2027, moved from a previously indicated May 2026, and the rule sits under long-term actions. The 2003 and 2013 rules remain operative. Any content telling you HIPAA now requires encryption is describing a proposal.
CIRCIA has missed its statutory deadline and has slipped twice. The Cyber Incident Reporting for Critical Infrastructure Act required a final rule by 4 October 2025. CISA's Spring 2025 agenda moved it to May 2026. The current agenda now projects September 2026. CISA's own page states that organizations are not required to report under CIRCIA until the effective date of a final rule that does not yet exist. Reporting in the meantime is voluntary.
NIS2 transposition is incomplete nearly two years past its deadline. Member states were required to transpose the directive into national law by 17 October 2024. In November 2024 the Commission sent letters of formal notice to 23 member states. In May 2025 it issued reasoned opinions to 19. On 8 July 2026 it referred Ireland, Spain, France and the Netherlands to the Court of Justice, requesting a lump sum and daily penalties until transposition is complete.
The practical consequence deserves stating plainly. In four large European economies there is currently no fully in-force national NIS2 regime. Organizations there are being sold compliance against a law their own country has not enacted.
Several things widely written about as requirements are proposals, and the distinction matters when allocating a budget.
The UK Cyber Security and Resilience Bill has not received Royal Assent. It passed the Commons on 16 June 2026 and had its second reading in the Lords on 14 July. Committee stage in the Lords is scheduled to begin on 1 September 2026, though forward dates in Parliament are provisional. It is a bill, not an act. When it passes it will extend regulation to managed service providers and data centres, which is the change that matters most for anyone running hosted infrastructure for UK clients. That has not happened yet.
The NIS2 amendment is a proposal. On 20 January 2026 the Commission published COM(2026) 13, which would simplify and harmonize NIS2 and add an obligation on member states to cover post-quantum cryptography migration in their national strategies. Adoption is expected late 2026 at the earliest, more likely 2027, followed by roughly a year for implementation. So the directive is being amended in some countries before it has been implemented in others.
NIST IR 8547 is a draft, and this one catches almost everybody. The widely quoted dates for deprecating current cryptography after 2030 and disallowing it after 2035 come from this document. It was released as an initial public draft on 12 November 2024, comments closed on 10 January 2025, and no final version has been published. Planning against those dates is sensible. Citing them as requirements is not accurate, and a great deal of published content does exactly that.
A reasonable question, given that the enforcement record is thin. The answer is that the powers are real, specific, and already in force. What is missing is a public record of them being used punitively.
Under NIS2, each member state designates a national competent authority. Germany's is the BSI, Italy's the ACN, Belgium's the CCB. Article 32 gives those authorities the power to conduct on-site inspections and off-site supervision, to require independent security audits at the entity's own cost, to run security scans, and to demand evidence that policies have been implemented. Its enforcement powers include binding instructions with deadlines, orders to cease conduct, orders to notify affected customers of a threat, appointment of a monitoring officer, and orders to make the infringement public.
Where those fail, Article 32(5) permits temporary suspension of a certification or authorization, and allows an authority to ask a court to temporarily bar a chief executive or legal representative from holding managerial functions in that organization.
Article 34 sets the fines. For essential entities, member states must provide for administrative fines of a maximum of at least 10 million euros or 2% of total worldwide annual turnover in the preceding financial year, whichever is higher. For important entities the figures are 7 million euros or 1.4%.
Three details about that are usually reported wrongly. The caps apply to infringements of Article 21, the risk management measures, or Article 23, the reporting obligations, not to any NIS2 breach whatsoever. The phrase is "a maximum of at least," which sets a floor on the ceiling each member state must provide, so national law can and sometimes does go higher. And turnover means that of the undertaking the entity belongs to, which is group level rather than entity level.
Under DORA, financial entities are supervised by their existing national competent authorities. Critical ICT third-party providers are supervised directly by an EU Lead Overseer, which can request information, conduct off-site investigations and on-site inspections, and impose periodic penalty payments. Where a provider does not comply with a Lead Overseer recommendation, financial entities' own supervisors can require them to suspend or terminate use of that provider.
As of August 2026, no NIS2 administrative fine has been published by any EU competent authority that can be verified against an official source. No named DORA enforcement action against a financial entity has been published either.
There are four distinct reasons, and they are frequently conflated.
Transposition is genuinely incomplete. NIS2 is a directive, which means it has no direct effect until a member state enacts national law. In Ireland, Spain, France and the Netherlands there is no NIS2 fining power because there is no NIS2 statute. There is nothing to report in those countries because the mechanism does not yet exist.
Supervision started late even where the law exists. Germany's implementing act only entered into force on 6 December 2025, and its registration portal opened in January 2026. The BSI's own published statistics show 17,945 registered entities and 692 incident notifications as of 30 June 2026, and no fines at all. Regulators are building registers and beginning audits, which is the phase before sanctions rather than the absence of them.
Decisions may exist without being published. NIS2 contains no EU-level obligation to publish fines. Making an infringement public is one optional enforcement measure among several. National administrative penalties often go unpublished or appear only in aggregate annual statistics. So an absence of published fines is not proof that no fine has been imposed.
For DORA the inference is stronger. Article 54 requires competent authorities to publish decisions imposing administrative penalties on their official websites, without undue delay, once no longer subject to appeal. Continued silence there is better evidence that no final penalty has been reached.
For context on timing: GDPR became applicable on 25 May 2018, and the first substantial fine, the French data protection authority's 50 million euro penalty against Google, came in January 2019, roughly eight months later. That was a directly applicable regulation, enforced by authorities that already existed and were already staffed, under a regime with a strong publication culture. NIS2 is a directive that four member states have not transposed 22 months past deadline. DORA has been applicable for 19 months. What we are looking at is what an enforcement ramp normally looks like.
A related complaint is that these regulations are vague. Read only the headline instrument and that is a fair impression. The specificity lives one layer below, in implementing acts and technical standards, and it is considerable.
For NIS2, Article 21(2) lists ten categories of measure in general terms. The operational detail for digital infrastructure providers is in Commission Implementing Regulation (EU) 2024/2690, whose annex reads like a controls checklist. It requires, for instance, that security patches be applied within a reasonable time after becoming available and that they be tested before being applied to production systems, and that entities perform regular integrity checks on backup copies.
For DORA, the detail is in Commission Delegated Regulation (EU) 2024/1774. Article 21 requires that access rights be reviewed at least annually for ordinary systems and at least every six months for systems supporting critical or important functions. Article 6 requires a policy covering encryption of data at rest and in transit.
For PCI DSS, the requirements and testing procedures document is the standard itself, and it is granular to the level of specifying that firewall ruleset configuration standards must be defined, implemented and maintained.
For CMMC, 32 CFR Part 170 incorporates the 110 security requirements of NIST SP 800-171 Revision 2 by reference. Note the version: NIST withdrew Revision 2 in favor of Revision 3 in May 2024, but CMMC remains legally anchored to Revision 2, and the Department of War's July 2026 interim position keeps self-assessments on that revision.
If a compliance requirement seems vague, it is usually because you are reading a summary of the directive rather than the implementing act underneath it.
None of the above required specialist knowledge. It required going to the source, and the sources are public.
For EU law, EUR-Lex carries the text of every regulation and directive along with its status. A document reference beginning with COM is a proposal.
For UK legislation, the Parliament bills site shows every stage a bill has passed, with dates. If Royal Assent is absent, it is not law.
For US federal rules, the Unified Agenda records what stage each rulemaking has reached and the date the agency currently projects. Those projections are revised regularly, which is exactly why published articles go stale.
For NIST publications, status appears on the publication page. Anything marked ipd is an initial public draft.
Three questions resolve most claims. Is this in force or proposed? What is the date of the source being cited? And has anyone actually been penalized under it?
Compliance content decays in a particular way. It is written when something is genuinely imminent, it is accurate on the day of publication, and then it stays exactly as it was while the world moves. Nobody is being dishonest. Articles simply do not get revisited, and there is no commercial reason to update a page to say that a deadline has receded.
The result is an accumulated layer of confident, dated, quietly wrong information about what organizations must do. It tends to point in one direction, because the version that overstates urgency is the version somebody had a reason to write.
What follows is not that regulation should be taken less seriously. DORA is in force, PCI's future-dated requirements are now assessed, the supervisory powers are real and specific, and the obligations exist whether or not anyone has yet been fined under them. It is that the date on the article matters as much as the claim in it, and that checking takes about ten minutes.
This article will be out of date too. It says so at the top, with the date it was written, which is the only honest way to publish something like this.
