Latest updates
New standard releases, regulatory changes, deadlines and certification exam updates worth knowing about.
Last reviewed 19 Oct 2026. Always confirm dates with the official source before relying on them.
Showing all 38 updates, newest first
The GRC Brief: one free monthly digest of the changes that matter. No spam.
Most CRA requirements - secure-by-design requirements for products with digital elements, vulnerability handling and CE marking - apply from 11 December 2027.
Why it matters Software and connected-device makers selling into the EU need security built into products, with evidence.
Obligations for high-risk AI used in areas such as employment, education, credit/essential services, biometrics and critical infrastructure apply from 2 December 2027 (moved from August 2026 by the AI Omnibus).
Why it matters Organisations using AI for hiring, credit or similar decisions must have risk management, data governance, logging and human oversight ready.
Most DPDP Rules - consent notices, security safeguards, breach notification, data principal rights and Significant Data Fiduciary duties - come into force 18 months after the Rules were published in the Gazette (13 Nov 2025), i.e. around mid-May 2027.
Why it matters Every organisation processing digital personal data in India needs its privacy programme operating by this date.
Exact day depends on the Gazette publication date (notification dated 13 Nov 2025; PIB release 14 Nov 2025). A January 2026 media report said MeitY was considering shortening the timeline to 12 months; no such amendment was found in the Gazette as of 19 Oct 2026.
From 15 April 2027 the CISSP exam follows a new outline. Domain 1 becomes 'Security Governance and Risk Management' and weights are rebalanced (e.g., Domain 1 and IAM 13.6%, Asset Security 12%); the CAT format (3 hours, 100-150 items, 700/1000) stays the same.
Why it matters Candidates testing after mid-April 2027 must use study materials updated for the new outline.
The 120 CPE hours per three-year cycle stay, but at least 90 must align with the certification's exam content outline, and up to 30 can come from broader development such as leadership, soft skills, volunteering or mentoring.
Why it matters CISA, CISM and CRISC holders should plan and log CPE against their domains from 2027.
Rule 4 on the registration and obligations of Consent Managers comes into force one year after the Rules were published (around 13 November 2026). Consent Managers must be Indian companies that meet the registration conditions.
Why it matters Platforms planning to act as Consent Managers, and fiduciaries that will rely on them, need to be ready.
From 3 November 2026 the CISM exam uses the updated outline: Governance 18%, Risk Management 20%, Program 33%, Incident Management 29%. It adds enterprise architecture and information security architecture content. Updated prep materials were released on 1 September 2026.
Why it matters Anyone sitting CISM from November 2026 must study the new outline and materials.
ISACA is developing a new Advanced in AI Governance (AAIG) certification. Beta applications close 22 Oct 2026, and selected volunteers (active CGEIT or 6 years of enterprise IT governance oversight experience) pay US$399. They sit a 150-minute exam at PSI test centres between 11 Dec 2026 and 9 Jan 2027. Results arrive when the program officially launches in Q1 2027.
Why it matters It adds an AI governance credential to ISACA's AAIA, AAISM and AAIR lineup, aimed at CGEIT-level governance leaders.
Beta details only; final exam format, domains and pricing not yet published.
The government issued an order under Section 43 making two text fixes to the DPDP Act: Section 9(1) now clearly covers personal data 'of a child or of a person with disability', and Section 10(2)(c)(ii) now says 'data audit' for Significant Data Fiduciaries. It took effect on publication (Gazette dated 6 Oct 2026).
Why it matters It clarifies the scope of guardian consent and the audit duty for Significant Data Fiduciaries.
Since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents affecting their products through ENISA's Single Reporting Platform: early warning within 24 hours, notification within 72 hours, and a final report (14 days after a fix for vulnerabilities, one month for incidents). This applies to products already on the market too.
Why it matters Product security and PSIRT teams now have strict EU reporting clocks.
The AI Act became applicable on 2 August 2026, including transparency rules (for example disclosing chatbots and labelling deepfakes), with the AI Office and national authorities enforcing. High-risk obligations were moved later by the AI Omnibus.
Why it matters Organisations deploying chatbots or generative AI in the EU must meet the transparency duties now.
ISC2 revised the CCSP domains, weights and subdomains from 1 August 2026 (Data Security 20%, Legal/Risk/Compliance 13%, others 16-17%), with explicit AI/ML content. CCSP has used the CAT format (100-150 items, 3 hours) since 1 October 2025.
Why it matters Cloud security candidates must use materials updated for August 2026 and practise adaptive-format questions.
The AI Omnibus amends the AI Act: high-risk rules move to 2 Dec 2027 (Annex III) and 2 Aug 2028 (Annex I), SME simplifications extend to small mid-caps, AI literacy duties are simplified, an EU-level sandbox is added and AI 'nudification' apps are banned.
Why it matters AI compliance roadmaps built on the original 2026 high-risk deadline need to be re-planned.
A new advanced certification for IT risk professionals who already hold a qualifying credential such as CRISC, CISA, CISM or CISSP. It has 90 questions over three domains: AI risk governance and framework integration (37%), AI life cycle risk management (21%) and AI risk program management (42%).
Why it matters It is a natural next step for CRISC-style risk and TPRM professionals moving into AI risk.
CompTIA's first AI-security certification: up to 60 questions in 60 minutes, pass mark 600/900. It covers basic AI concepts (17%), securing AI systems (40%), AI-assisted security (24%) and AI GRC (19%).
Why it matters A hands-on AI security credential that complements governance-focused certifications like AIGP.
IAPP's AIGP exam now follows BoK v2.1 (approved 9 Sep 2025, supersedes 2.0.1). There are four domains: foundations of AI governance, laws/standards/frameworks, governing AI development, and governing AI deployment and use. Each has a minimum and maximum number of questions.
Why it matters AIGP candidates must study from v2.1 materials.
In February and March 2026 the ASB exposed a proposed SSAE on common concepts, examination, review and sustainability engagements, plus amendments to SSAE 18, 19 and 21. Comments closed 30 June 2026. The SOC 2 Trust Services Criteria themselves remain the 2017 TSC with 2022 revised points of focus.
Why it matters SOC 2 reports are performed under the SSAE attestation standards, so service auditors and SOC report users should watch for the final standard.
Exact exposure-draft issue days not confirmed; the date shown is the month.
NIST published a preliminary draft CSF 2.0 Community Profile for AI covering three focus areas: securing AI system components, AI-enabled cyber defence and thwarting AI-enabled attacks. Comments closed 30 January 2026 and working sessions continued in 2026; it is not final yet.
Why it matters Expect this to become the reference for mapping AI security to NIST CSF 2.0.
The Commission proposed a Digital Omnibus (COM(2025) 837) that would change parts of the GDPR, such as clarifying personal data and pseudonymisation, AI training, simpler breach reporting and DPIAs, and a single incident-reporting entry point. It would also move cookie rules into the GDPR framework. As of mid-October 2026 it was still being negotiated and was not law.
Why it matters Privacy teams should follow it but keep complying with the current GDPR.
Negotiation status based on press reports (Agence Europe, Oct 2026); check the Council/Parliament legislative observatory for updates.
India notified the DPDP Rules (G.S.R. 846(E), dated 13 Nov 2025), fully operationalising the DPDP Act, 2023. The Data Protection Board provisions applied immediately, Consent Manager rules after 1 year, and most fiduciary obligations after 18 months. Rights requests must be answered within 90 days, and breaches must be notified to affected individuals.
Why it matters Sets India's privacy compliance clock for every organisation handling personal data of people in India.
The updated CRISC exam was released on 3 November 2025 with the same four domains but new weights: Governance 26%, Risk Assessment 22% (up from 20%), Risk Response and Reporting 32%, and Technology and Security 20% (down from 22%).
Why it matters CRISC candidates must use the 2025 materials.
Under IAF MD 26, every ISO/IEC 27001:2013 certificate had to transition to the 2022 edition by 31 October 2025. Certificates that did not transition are no longer valid.
Why it matters When you review a vendor's ISO certificate (TPRM), it must cite ISO/IEC 27001:2022.
The second edition of ISO/IEC 27701 sets out requirements and guidance for a Privacy Information Management System (PIMS) for PII controllers and processors. It is now an independent management system standard and no longer just an extension of ISO/IEC 27001. The 2019 edition is withdrawn.
Why it matters Organisations can certify privacy management without an ISMS, and existing 27701 holders must plan a transition.
NIST issued Release 5.2.0 of SP 800-53 (with matching 800-53A updates) focused on secure, reliable software updates and patches, in response to Executive Order 14306. It adds controls such as SA-15(13), SA-24 and SI-02(07) and revises others. The SP 800-53B baselines did not change.
Why it matters Control catalogues and GRC tool mappings should be updated to 5.2.0.
A 90-question advanced certification for active CISM or CISSP holders. It covers AI governance and program management (31%), AI risk management (31%) and AI technologies and controls (38%).
Why it matters It gives CISM/CISSP holders a way to show AI security leadership.
Obligations for providers of general-purpose AI models (transparency, copyright and systemic-risk duties) and the governance framework began on 2 August 2025. In July 2025 the Commission published GPAI guidelines, a voluntary Code of Practice and a training-data summary template.
Why it matters Companies building on foundation models should expect provider documentation and pass-through obligations.
This is guidance for assessing how AI systems and their foreseeable uses may affect individuals, groups and society across the life cycle. It complements ISO/IEC 42001, 23894 and 38507.
Why it matters It gives a structured method for the AI impact assessments that ISO/IEC 42001 and AI regulations expect.
ISACA's first advanced AI certification is for active CISA holders and other qualified audit or accounting designations. The exam has 90 questions in 2.5 hours across AI governance and risk (33%), AI operations (46%) and AI auditing tools and techniques (21%).
Why it matters IT auditors can show they can audit AI systems.
NIST replaced its long-standing incident handling guide with Rev. 3, which builds incident response recommendations into cybersecurity risk management using the CSF 2.0 functions rather than a separate life-cycle model.
Why it matters IR plans and playbooks referencing the old Rev. 2 phases should be re-mapped to CSF 2.0.
The requirements that had been best practice became mandatory on 31 March 2025, for example payment-page script management (6.4.3), change/tamper detection on payment pages (11.6.1) and targeted risk analyses. A revised SAQ A also took effect, removing 6.4.3/11.6.1 for eligible merchants and adding a script-attack eligibility criterion.
Why it matters Assessments from April 2025 test these requirements in full.
Bans on unacceptable-risk AI practices (such as social scoring, untargeted facial-image scraping and emotion recognition at work or school) and AI literacy duties applied from 2 February 2025. The Commission issued guidelines on prohibited practices and the AI system definition.
Why it matters Organisations must make sure no banned AI use cases are running in the EU.
The Digital Operational Resilience Act applies to EU financial entities from 17 January 2025. It covers ICT risk management, incident reporting, resilience testing and ICT third-party risk, including registers of information on ICT providers.
Why it matters Banks, insurers and their ICT providers (including cloud and SaaS vendors) face harmonised resilience and TPRM requirements.
HHS proposed the first major update to the HIPAA Security Rule since 2013 (published 6 Jan 2025, 90 FR 898). It would make policies written and regularly tested and align safeguards with modern cybersecurity practice. HHS's regulatory agenda lists final action for July 2027 as a long-term action, and the current rule remains in force.
Why it matters Healthcare organisations and business associates (e.g., health-tech vendors) should gap-assess against the proposal now.
Member States had to transpose the NIS2 Directive into national law by 17 October 2024 and apply it from 18 October. On the same date the Commission adopted Implementing Regulation (EU) 2024/2690 on technical and methodological security requirements for digital-infrastructure and digital-provider entities, which entered into force on 7 November 2024.
Why it matters Essential and important entities in the EU face management accountability, risk measures and 24h/72h incident reporting.
This is a cross-sector companion to AI RMF 1.0. It identifies risks unique to or worsened by generative AI and suggests actions to manage them across the AI life cycle.
Why it matters It is a practical reference for generative AI risk assessments and policies.
This limited revision corrects formatting and clarifies intent, with no new or deleted requirements. Examples include reverting the 30-day patching requirement to critical vulnerabilities only and clarifying MFA where phishing-resistant authentication is used. PCI DSS v4.0 retired on 31 December 2024.
Why it matters v4.0.1 is the only active version, so assessments and SAQs must reference it.
This is the first major update since 2014. It now targets all organisations, not only critical infrastructure, and adds a sixth function, Govern, alongside Identify, Protect, Detect, Respond and Recover. Quick-start guides, implementation examples and a reference tool support it.
Why it matters CSF 2.0 is the common language for board reporting and control mapping, and NIST guides such as SP 800-61r3 now build on it.
This one-page amendment adds to clause 4.1 that the organisation shall determine whether climate change is a relevant issue. A note in 4.2 says interested parties can have climate-related requirements. ISO applied the same text to many management system standards, including ISO 22301:2019/Amd 1:2024 for business continuity.
Why it matters ISMS context analysis and audits now need to show that climate change was considered.