The governance, risk, compliance and cyber news worth knowing this week, summarised in plain language with a note on why it matters and links to the original sources. Reviewed 20 Oct 2026.
EU adopts the AI Omnibus: high-risk AI deadlines pushed back
The EU formally adopted targeted amendments to the AI Act. Obligations for high-risk AI systems listed in Annex III now apply from 2 December 2027 (previously 2 August 2026), and from 2 August 2028 for AI embedded in regulated products. New prohibited practices were added, while AI literacy, existing prohibitions, general-purpose AI rules and transparency duties stay on their original timetable.
Why it matters for GRC: The extra time is for building governance, not pausing it. Keep your AI inventory and risk assessments moving.
First harmonised standard for the AI Act published: EN 18286
The European Commission published the reference to EN 18286:2026, a quality management system standard for AI Act purposes developed by CEN and CENELEC. Providers of high-risk AI systems that implement it get a presumption of conformity with the Article 17 quality management requirements it covers. It is designed to sit on top of existing systems such as ISO/IEC 42001 or ISO 9001.
Why it matters for GRC: If you already run ISO 42001 or ISO 9001, map EN 18286 against it rather than building a separate system.
DORA Q&A: a successful malicious intrusion can't be ruled out just because the system isn't critical
The European Supervisory Authorities published a final Q&A on classifying ICT incidents under DORA. Successful, malicious, unauthorised access to a financial entity's systems has to be assessed on its own merits, even if the affected systems don't support critical functions and even if the attacker came in through an ICT supplier. It does not make every intrusion a major incident; the normal thresholds still apply.
Why it matters for GRC: Review incident triage playbooks and supplier contracts so you get the logs needed to classify vendor-originated intrusions quickly.
Asos breach through a third-party data platform turns out wider than first reported
UK retailer Asos confirmed that attackers accessed a third-party platform, built on Snowflake, that it uses to communicate with customers, and even used the Asos app to send customers a notification. Later reporting said the stolen data included addresses, phone numbers, dates of birth and browsing history, more than was first disclosed. The initial access reportedly came from social engineering of an employee's login.
Why it matters for GRC: A reminder that customer-data platforms run by suppliers are in scope for your third-party risk, and that first disclosures need to be accurate.
Nikkei: stolen credentials used to access a development cloud service
Nikkei Inc. said a cloud service used for system development was accessed with stolen credentials on 7 October, exposing about 1.83 million items of information. Around 150,000 contained identifying details such as names, emails or addresses; no card data was involved. It reported the incident to Japan's Personal Information Protection Commission on 11 October.
Why it matters for GRC: Development and test environments often hold real personal data with weaker controls. Check yours.
ConnectWise Cloud Backup credential compromise reaches customer Microsoft 365 tenants
According to Check Point Research's weekly report, attackers used compromised application credentials in ConnectWise Cloud Backup, a Microsoft 365 backup service used by managed service providers, to sign in to at least 173 organisations, with possible access to email, files and Teams data before access was suspended.
Why it matters for GRC: Backup and MSP tools hold broad, standing access. Include them in privileged access reviews and supplier tiering.
Attacks on connected refrigeration hit French supermarkets
Several French supermarket chains reported cyberattacks on connected refrigeration controllers. Attackers reportedly changed temperature settings, causing fridges to fail, food losses and disruption in stores, with one retailer's losses put above $100,000.
Why it matters for GRC: Operational technology in stores and warehouses belongs in the asset inventory, the risk register and the BCP.
Large October Patch Tuesday and an exploited Ivanti flaw
Check Point reports that Microsoft's October 2026 updates addressed an unusually large number of vulnerabilities, including three zero-days, one an actively exploited Windows Shell flaw. An authentication bypass in Ivanti Connect Secure (CVE-2026-104935) was reported as exploited and added to CISA's Known Exploited Vulnerabilities catalogue.
Why it matters for GRC: Internet-facing remote access appliances should be on the shortest patch SLA you have, with exploited flaws handled as incidents.
UK regulator secures commitments from AI developers and asks about agentic AI
The UK's data protection regulator said it secured commitments from ten large AI model developers on transparency, data rights and safeguards, and opened a call for evidence on agentic AI after incidents where agents reportedly bypassed protections or accessed systems without authorisation.
Why it matters for GRC: If you are piloting AI agents, treat them like any other identity: least privilege, logging and an owner.
CERT-In flags intrusions involving autonomous AI agents
Check Point's weekly report notes that India's CERT-In reported unauthorised access to organisations' systems involving autonomous AI agents, which used exposed credentials, insecure APIs and misconfigured cloud services to pull business information, and went undetected through repeated access.
Why it matters for GRC: Exposed secrets and weak API controls are the entry point either way. Secret scanning and API inventory are worth prioritising.
Summaries are written in my own words from the linked reports. Always check the original source before relying on any detail.
Free monthly newsletter
The GRC Brief newsletter
by Naresh Thalla Mudhiraj
A free monthly digest on governance, risk and compliance: new standards and regulations, exam changes, interview questions and practical templates. No spam, unsubscribe anytime.
Monthlyone issue, no noise
Freealways, no paywall
Plain languagewhat changed, why it matters
Subscribe free
Get the first issue as soon as it's out.
Inside every issue
What you'll get
Short, practical and focused on what GRC, audit and security people actually need to know each month.
Standards & regulations
New and changing rules, from ISO 27001 and ISO 42001 to the EU AI Act, NIS2, DORA, DPDP and other regional requirements, explained in plain language with what to do next.
Exam & certification changes
Outline updates, new domains and dates for CISA, CISM, CRISC, CISSP, ISO lead auditor and AI governance certifications, plus study tips.
Interview & scenario questions
Fresh questions with model answers, including real-world scenarios like “your auditor finds X, what do you do?”
Practical templates
Free, ready-to-use templates and checklists such as risk registers, audit checklists and vendor questionnaires, as they are released.
Archive
Past issues
First issue coming soon
Each issue will be published here so you can read and share it. Subscribe to get the first one in your inbox.