# Regulatory news and changes

Controlspan Research Desk · Last updated 28 October 2026

# What should enterprise GRC buyers prioritise?

**Prioritise an accurate obligation register, defensible evidence and changeable workflows—not the largest regulatory content library.** Our buying recommendation is to separate requirements already applicable, future compliance dates, proposals, supervisory guidance, professional standards and suspended implementation milestones before approving platform scope.

The distinction has immediate consequences. **10 November 2026 is the first California SB 253 emissions-reporting deadline, but it is no longer the scheduled launch of CMMC Phase II:** that implementation phase was suspended in July. A platform that treats both dates as active compliance deadlines is starting from the wrong requirements. ([content.govdelivery.com](https://content.govdelivery.com/accounts/CARB/bulletins/42ee5c1?utm_source=openai))

This report concentrates on changes that affect obligation mapping, controls, evidence, third-party risk, audit and reporting. Older changes appear where they remain important to migration or annual assurance. It is not an exhaustive inventory of banking, insurance, healthcare or securities law, and it does not establish applicability to an individual organisation. Legal and compliance specialists should approve those determinations.

### Which upcoming dates need an owner now?

| Date | Change and affected buyers | Recommended action |
|---|---|---|
| **10 November 2026** | First SB 253 emissions submission for in-scope reporting entities; CARB’s initial regulation became effective on 12 October 2026. | Resolve entity scope, submission route, evidence and approval immediately. ([content.govdelivery.com](https://content.govdelivery.com/accounts/CARB/bulletins/42ee5c1?utm_source=openai)) |
| **16 November 2026** | Comment deadline for proposed interagency third-party risk management guidance. This is a consultation date, not a new compliance deadline. | Decide whether to comment; retain a separate proposed-guidance mapping. ([occ.gov](https://www.occ.gov/topics/laws-and-regulations/occ-regulations/proposed-issuances/occ-proposed-issuances-2026.html?utm_source=openai)) |
| **15 December 2026** | IIA Organizational Behavior Topical Requirement becomes effective. | Update applicable assurance-engagement templates and exclusion documentation. ([theiia.org](https://www.theiia.org/en/standards/2024-standards/topical-requirements/organizational-behavior/?utm_source=openai)) |
| **1 January 2027** | California ADMT requirements begin for covered uses making significant decisions. | Complete use-case classification and test the relevant consumer-rights workflows. ([cppa.ca.gov](https://www.cppa.ca.gov/announcements/2025/20250923.html?utm_source=openai)) |
| **1 January 2027** | Colorado’s replacement automated decision-making law takes effect. | Replace obsolete statutory mappings and prepare developer/deployer workflows. ([coag.gov](https://coag.gov/ai/)) |
| **1 January 2027** | Start of the first cybersecurity-audit coverage period for the earliest California audit cohort. | Establish evidence collection before the period starts, rather than waiting for the 2028 report. ([cppa.ca.gov](https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf)) |
| **30 April 2027** | IIA Organizational Resilience Topical Requirement becomes effective. | Incorporate it into the 2027 audit-methodology change plan. ([theiia.org](https://www.theiia.org/en/standards/2024-standards/topical-requirements/organizational-resilience/)) |

**Recommended planning rule:** maintain separate fields for publication, legal effectiveness, compliance, evidence coverage and submission. Do not compress them into one “due date”. The California audit timetable is a particularly useful acceptance test for this distinction.

---

# How do California’s new privacy rules change enterprise GRC requirements?

**Treat cybersecurity audits, privacy risk assessments and automated decision-making as three connected—but separately scoped—workflows.** The California Privacy Protection Agency’s package was approved on 22 September 2025 and became effective on 1 January 2026. It covers these three areas alongside other CCPA updates and insurance-related provisions. ([cppa.ca.gov](https://cppa.ca.gov/regulations/ccpa_updates.html))

### Who needs a scope assessment?

Do not infer applicability from employee count. Article 9’s audit tests include the statutory selling/sharing revenue test, or the CCPA revenue threshold combined with processing-volume thresholds of **250,000 consumers or households’ personal information**, or **50,000 consumers’ sensitive personal information**, in the preceding year. Have counsel apply the exact business, data and exemption provisions. ([cppa.ca.gov](https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf))

The practical requirement is an applicability decision for each relevant processing activity and legal entity—not one organisation-wide “CCPA compliant” flag.

### Which dates are different?

| Workstream | Timing | Buyer implication |
|---|---|---|
| Risk assessments | Compliance began on **1 January 2026**; first assessment-information submissions and attestations are due **1 April 2028**. | A later submission date is not permission to postpone the assessment programme. ([cppa.ca.gov](https://www.cppa.ca.gov/announcements/2025/20250923.html?utm_source=openai)) |
| ADMT | Requirements begin **1 January 2027** for covered significant-decision uses. | Inventory decisions and operationalise rights before launch. ([cppa.ca.gov](https://www.cppa.ca.gov/announcements/2025/20250923.html?utm_source=openai)) |
| Cybersecurity audits | First certifications fall on **1 April 2028**, **1 April 2029** or **1 April 2030**, according to the applicable revenue cohort. | Configure the correct cohort rather than one universal audit deadline. ([cppa.ca.gov](https://www.cppa.ca.gov/announcements/2025/20250923.html?utm_source=openai)) |

For processing subject to assessment, the regulations distinguish assessment **before initiating new processing** from the transition for continuing pre-existing processing, whose assessments must be completed by **31 December 2027**. For the earliest audit cohort—over $100 million in the specified revenue year—the first audit covers **1 January 2027 through 1 January 2028**. ([cppa.ca.gov](https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf))

### What should the platform demonstrate?

**Recommended acceptance test:** give every shortlisted supplier the same synthetic business process and ask it to:

1. Record why the process is—or is not—subject to each of the three workstreams.
2. Separate a processing activity from the technology supporting it.
3. Require assessment approval before a proposed processing change goes live.
4. Preserve the previous assessment when the process changes.
5. Collect evidence against the correct audit period.
6. Distinguish completing an assessment, approving it, submitting information and retaining the submission receipt.

Ask for a demonstration of how the administrator changes a threshold or date without overwriting the historical decision. Price the privacy inventory, assessment workflow, consumer-request integration and audit capability separately. A bundled “California compliance” module should not substitute for that scope breakdown.

---

# What changed in Colorado’s AI law—and which requirements should buyers stop using?

**Colorado’s operative planning baseline is the 2026 replacement legislation, not an unchanged implementation of the original 2024 AI Act.** SB26-189 repealed and reenacted the earlier provisions; the Attorney General identifies **1 January 2027** as the new law’s effective date. The rulemaking page records a formal hearing on **26 October 2026**; the material reviewed does not establish that the implementing rules have been finalised. ([coag.gov](https://coag.gov/ai/))

### Who is affected?

The enacted legislation addresses developers and deployers of covered automated decision-making technology that materially influences consequential decisions. Those decisions include access, eligibility or compensation concerning employment, education, housing, financial or lending services, insurance, healthcare and essential government services. Specified exemptions require separate assessment. ([leg.colorado.gov](https://leg.colorado.gov/bills/sb26-189))

The law includes developer documentation, material-update notifications, consumer notices, correction and human-review rights, and record retention of at least three years. It also provides for a plain-language description following an adverse consequential decision within the specified 30-day period. ([leg.colorado.gov](https://leg.colorado.gov/bills/sb26-189))

### What should change in the GRC implementation programme?

**Recommended action:** create a versioned replacement project rather than editing the title of an old “Colorado AI Act” control set.

- Identify records built from the original legislation or earlier implementation dates.
- Classify each use by its actual decision, population, owner and developer/deployer role.
- Link technical documentation to the deployed version—not merely the supplier’s name.
- Connect adverse-outcome handling to notices, correction requests and meaningful human review.
- Preserve the legal rationale for any exemption or exclusion.
- Track draft implementing rules separately from the enacted statute.

**Demo scenario:** use one technology in both an internal drafting assistant and an employment-screening process. Require the supplier to support different applicability outcomes without duplicating the entire technology record.

For procurement, ask whether notices and review cases can be handled in the existing privacy or case-management system. An enterprise GRC platform should coordinate accountability; it need not become the operational system for every consumer interaction.

---

# What do the completed NYDFS cybersecurity changes mean for platform selection?

**The final November 2025 implementation milestones are already in force; they are now an evidence and exception-management problem.** From **1 November 2025**, the expanded MFA requirement generally covers individuals accessing a covered entity’s information systems, subject to the regulation’s exemptions and approved compensating-control provisions. NYDFS explains the narrower MFA requirements applicable to entities qualifying for the limited exemption. ([dfs.ny.gov](https://www.dfs.ny.gov/system/files/documents/2025/09/multifactor-authentication.pdf?utm_source=openai))

That date also brought the asset-inventory policy and procedure requirements: a complete, accurate and documented inventory, specified asset information, and an update and validation frequency. ([dfs.ny.gov](https://www.dfs.ny.gov/industry_guidance/cybersecurity/implementation_timeline_covered_entities?utm_source=openai))

### Who should act?

Start with whether the organisation is a NYDFS covered entity and which exemptions apply; do not treat every financial-services business as automatically covered. The regulator’s resource centre directs covered entities to Part 500’s requirements. ([dfs.ny.gov](https://www.dfs.ny.gov/industry_guidance/cybersecurity))

### What should buyers require now?

**Recommended ownership model:** let authoritative identity and asset systems supply facts; use GRC to document scope, control ownership, exceptions, review and remediation.

Require a representative demonstration of:

- An application missing from the approved inventory.
- An asset without an accountable owner.
- A user whose access remains after departure.
- An MFA exception linked to the affected system and approving CISO.
- A failed connector that makes evidence stale rather than silently leaving a control green.

NYDFS permits qualifying compensating controls approved in writing by the CISO and reviewed at least annually. The workflow should therefore retain the approval, justification and review history—not just a permanent exception checkbox. ([dfs.ny.gov](https://www.dfs.ny.gov/system/files/documents/2025/09/multifactor-authentication.pdf?utm_source=openai))

For **enterprise GRC software requirements for banks and insurers**, prioritise entity-specific applicability, evidence freshness and exception expiry over a preloaded Part 500 questionnaire.

---

# What must SEC-regulated firms now demonstrate under Regulation S-P?

**Both implementation deadlines have passed: larger entities were due on 3 December 2025 and smaller entities on 3 June 2026.** The amendments cover specified brokers and dealers, funding portals, investment companies, SEC-registered investment advisers and registered transfer agents; they do not apply to every business merely because it operates in financial services. ([sec.gov](https://www.sec.gov/files/rules/final/2024/regulation-s-p-small-entity-compliance-guide.pdf))

The amendments require written incident-response policies and procedures and generally require customer notification as soon as practicable, but no later than **30 days** after the institution becomes aware of the relevant unauthorised access or use, subject to the rule’s investigation and other provisions. They also address service-provider oversight and compliance records. ([sec.gov](https://www.sec.gov/files/rules/final/2024/regulation-s-p-small-entity-compliance-guide.pdf))

### What should the compliance owner do now?

**Recommended action:** sample completed incidents and exercises rather than accepting a policy-upload milestone as implementation evidence.

For each sample, ask the platform to show:

1. The affected institution and information.
2. When the relevant facts became known.
3. Who performed the investigation and notification assessment.
4. The rationale and approval for notifying—or not notifying.
5. The applicable deadline and escalation history.
6. The approved communication and delivery evidence.
7. Linked supplier actions and unresolved remediation.

Do not hard-code every privacy, cyber and supplier incident to the same trigger. Give counsel control over the decision fields and deadline logic, with restricted permissions where appropriate.

**Buying implication:** compare the proposed GRC incident workflow with existing security and privacy case-management systems. Require suppliers to demonstrate integration and decision traceability before adding a duplicate incident module.

---

# How have banking model-risk and third-party-risk expectations changed in 2026?

**Three separate developments matter: revised model-risk guidance, proposed third-party guidance and an updated examination work programme. Do not classify them all as new binding regulations.**

### What changed in model risk management?

On **17 April 2026**, the banking agencies issued revised model-risk guidance. The Federal Reserve’s SR 26-2 supersedes its earlier model-risk guidance and says the revised guidance is expected to be most relevant to banking organisations with more than **$30 billion in total assets**. ([federalreserve.gov](https://www.federalreserve.gov/supervisionreg/srletters/SR2602.htm))

The joint text emphasises proportionality and expressly distinguishes guidance from enforceable standards. It excludes simple arithmetic and deterministic rule-based processes from its model definition, and excludes generative and agentic AI from this guidance’s scope while recognising the need for appropriate governance of tools outside that scope. Certain smaller institutions with significant model exposure may still find it relevant. ([federalreserve.gov](https://www.federalreserve.gov/frrs/guidance/supervisory-guidance-on-model-risk-management.htm?utm_source=openai))

**Recommended GRC changes:**

- Separate the model inventory from a broader AI and analytical-tool inventory.
- Record classification decisions and the authority supporting them.
- Allow validation scope and frequency to reflect approved risk assessments.
- Preserve independent challenge, limitations, use restrictions and monitoring.
- Do not interpret exclusion from this guidance as approval to remove all governance.

**Demo test:** move a tool between classifications and show what changes, who approves it and which other obligations remain attached.

### What is proposed for third-party risk management?

The agencies announced proposed replacement guidance on **11 September 2026**, followed by Federal Register publication on **15 September**. It seeks a proportionate approach to individual third-party relationships rather than treating all relationships as inherently high risk. Comments close on **16 November 2026**. The agencies describe the guidance as non-binding and plan to replace existing guidance when the new version is finalised. ([occ.gov](https://occ.gov/news-issuances/bulletins/2026/bulletin-2026-46.html?utm_source=openai))

**Recommended action:** retain the existing approved methodology while building a separately controlled impact assessment of the proposal.

For **vendor risk management software**, test whether the platform can support:

- Different risk treatment for different services from the same supplier.
- A documented rationale for proportionate due diligence.
- Residual-risk acceptance with accountable approval.
- Reassessment triggered by a material relationship change.
- A change of methodology without destroying earlier assessments.

Avoid signing a large reconfiguration statement of work that assumes the proposed text is final.

### Does the OCC’s September cybersecurity update mandate a new framework?

**No.** The OCC’s **21 September 2026** update changed the Cybersecurity Supervision Work Program’s structure and references to align with the updated NIST CSF. The OCC says it added no procedures, changed no procedures and established no new regulatory expectations; banks are not expected to use the work programme as their own assessment tool. ([occ.gov](https://www.occ.gov/news-issuances/bulletins/2026/bulletin-2026-48.html?trk=public_post_comment-text&utm_source=openai))

Separately, the FFIEC Cybersecurity Assessment Tool was sunset on **31 August 2025**. The FDIC identified alternative government and industry resources rather than prescribing one universal replacement. ([fdic.gov](https://www.fdic.gov/news/financial-institution-letters/2024/sunset-ffiec-cybersecurity-assessment-tool?utm_source=openai))

**Migration recommendation:** retain historical CAT assessments as dated records. Map the chosen successor framework prospectively, documenting incomplete mappings and changed assessment methods instead of presenting old and new scores as automatically comparable.

---

# What should healthcare GRC buyers distinguish between final rules and proposals?

**Treat Part 2 implementation as a current obligation, the HIPAA Security Rule overhaul as proposed, and the newly announced HTI-5 rule as a separate certification-programme change.** These developments should not share one undifferentiated “HIPAA 2026” project.

### What is already required under 42 CFR Part 2?

Compliance with the 2024 Part 2 final rule was required by **16 February 2026**. HHS also launched its civil enforcement programme from that date. Part 2 applies to federally assisted substance-use-disorder programmes, with some requirements also extending to recipients and holders of Part 2 records. ([hhs.gov](https://www.hhs.gov/hipaa/part-2/index.html?utm_source=openai))

The changes include closer alignment with certain HIPAA permissions, breach notification and patient-rights provisions, while retaining particular protections concerning use of records in proceedings against patients. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/regulatory-initiatives/fact-sheet-42-cfr-part-2-final-rule/index.html?utm_source=openai))

**Recommended platform review:** examine whether audit evidence, incident attachments, complaints and investigation records can contain Part 2 information. Test restricted access, redaction, disclosure approvals and evidence reuse using synthetic records—not real patient data.

An enterprise evidence repository should not receive patient-level material simply because it supports an audit. Prefer references or appropriately minimised evidence where that can satisfy the assurance objective.

### Is the strengthened HIPAA Security Rule final?

**No final replacement was established by the official sources reviewed.** HHS continues to describe the overhaul as a proposed rule. The current regulatory-agenda entry places it in long-term actions and lists **July 2027** for final action; that is an agency planning target, not a compliance deadline or guarantee of publication. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/hipaa-security-rule-nprm/index.html?utm_source=openai))

The proposal includes more prescriptive security measures, such as MFA, encryption and compliance-audit provisions. Those proposed changes must remain distinguishable from the Security Rule currently in effect. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/hipaa-security-rule-nprm/factsheet/index.html))

**Recommended procurement approach:** specify adaptable inventories, evidence, testing and remediation now, but place proposal-dependent configuration in an optional phase. Require a change-control mechanism if the final text differs. Do not accept a vendor’s asserted “2026 HIPAA deadline” without the applicable official rule and date.

### What is new in HTI-5?

On **26 October 2026**, HHS announced the HTI-5 final rule, reducing administrative requirements for developers participating in the ONC Health IT Certification Program. The announcement expressly says the proposed information-blocking changes remain under consideration. ([hhs.gov](https://www.hhs.gov/press-room/hhs-finalizes-hti-5-deregulatory-rule.html?utm_source=openai))

**Recommended action:** healthcare technology buyers should request an updated certification and contractual-control impact assessment from affected suppliers. Do not retire privacy, security or AI-assurance controls solely because a certification requirement changes. This research does not establish HTI-5’s provision-level effective and transition dates; confirm those before changing an implementation schedule.

---

# Are CIRCIA reporting requirements now in force?

**The official record reviewed still shows the final rule pending White House review, not an operative final reporting regime.** OIRA received the CIRCIA final-rule submission on **1 October 2026**. Its “Final Rule” stage describes the regulatory review stage; it does not mean that the rule has been published and become effective. ([reginfo.gov](https://www.reginfo.gov/public/do/eoDetails?rrid=1550967))

CISA’s guidance states that organisations are not required to submit incident or ransom-payment reports under CIRCIA until the final rule’s effective date. ([cisa.gov](https://www.cisa.gov/sites/default/files/2023-01/CIRCIA_07.21.2022_Factsheet_FINAL_508%20c.pdf?utm_source=openai))

### What should buyers do without a confirmed final deadline?

**Recommended readiness work:**

- Identify potentially relevant entities, services and incident owners.
- Maintain a shared incident chronology with separately controlled notification decisions.
- Make reporting triggers, deadlines, destinations and report versions configurable.
- Preserve the distinction between a proposed applicability decision and an approved final one.
- Assign a named owner to monitor publication and assess the final text.

Ask suppliers to demonstrate a rule change without code deployment and without altering closed incident records. Do not purchase a fixed-scope “CIRCIA compliance” implementation whose acceptance criteria merely repeat the proposal.

This is not a reason to suspend other applicable incident-reporting workflows. The recommended design is one factual incident record with distinct, legally reviewed reporting obligations—not one universal notification clock.

---

# Is CMMC Phase II still a 10 November 2026 procurement deadline?

**No: the July 2026 suspension changes that planning assumption.** The official CMMC page says Phase II was suspended on **13 July 2026**, while Phase I self-assessment requirements remain in place. The SBA’s Office of Advocacy separately documented the suspension and reform review. ([dodcio.defense.gov](https://dodcio.defense.gov/cmmc/About/?utm_source=openai))

### What should defence suppliers and service providers do now?

**Recommended action:** separate the programme-level implementation pause from the obligations in each solicitation, contract and subcontract. Have the contracting owner verify the actual current requirements and any amendments.

For the GRC programme:

- Preserve existing self-assessment evidence and remediation records.
- Link obligations to the relevant contract, entity and system boundary.
- Mark suspended milestones as suspended—not completed or deleted.
- Keep proposed future requirements separate from applicable requirements.
- Revisit assessment-related services expenditure against the revised programme status.

**Contracting test for a platform supplier:** ask what happens if an external standard or programme date changes after implementation begins. Require pricing and acceptance terms that distinguish reusable control work from abandoned, date-specific configuration.

No replacement Phase II launch date was verified in the official material reviewed. Do not substitute a speculative restart date in the compliance calendar.

---

# What must public companies and diversified groups do about California climate reporting?

**The immediate task is an applicability and submission decision for 10 November 2026—not a broad ESG-platform transformation.** CARB announced OAL approval and effectiveness of its initial regulation on **12 October 2026**, confirming the November reporting deadline. Its programme covers qualifying US-based companies with more than **$1 billion** in annual revenues doing business in California, subject to the applicable definitions and exclusions. ([content.govdelivery.com](https://content.govdelivery.com/accounts/CARB/bulletins/42ee5c1?utm_source=openai))

The first reporting round concerns Scope 1 and Scope 2 emissions. CARB has published submission resources and permits use of its intake platform or email; the platform itself is not mandatory. ([content.govdelivery.com](https://content.govdelivery.com/accounts/CARB/bulletins/427b576?utm_source=openai))

### What should the GRC system hold?

**Recommended minimum evidence pack:**

1. The approved reporting-entity and consolidation decision.
2. The reporting period and organisational boundary.
3. Data sources, calculation ownership and review records.
4. Unresolved data issues and their treatment.
5. Legal review of any applicable first-year relief.
6. The final approved submission and receipt.

Do not require the GRC platform to replace a specialist emissions-calculation system unless that capability has been separately evaluated. Focus the enterprise workflow on accountability, evidence, exceptions and approval.

### Is SB 261 on the same timetable?

**No.** CARB’s current page states that the Ninth Circuit’s **18 November 2025** injunction prevents enforcement of SB 261 during the appeal. CARB says it will not enforce the **1 January 2026** submission deadline and will provide further information after the appeal is resolved. ([ww2.arb.ca.gov](https://ww2.arb.ca.gov/our-work/programs/corporate-ghg-reporting/climate-related-financial-risk?utm_source=openai))

Maintain separate records for SB 253 and SB 261. For SB 261, preserve useful risk work but label the enforcement status accurately. Do not present a paused statutory deadline as an overdue mandatory filing, or infer that the separate SB 253 programme is also paused.

---

# Which IIA standards changes affect audit-management platforms?

**The implementation requirement is engagement-level applicability and evidence, not merely adding new audit-universe labels.** IIA Topical Requirements are mandatory within its professional framework for applicable assurance work; they are recommended rather than mandatory for advisory services. Applicability decisions and the rationale for excluding individual requirements must be documented and retained. ([theiia.org](https://www.theiia.org/en/standards/2024-standards/topical-requirements/))

| Topical Requirement | Effective date | Recommended platform preparation |
|---|---|---|
| Cybersecurity | **5 February 2026** | Check current assurance work programmes and evidence coverage. ([theiia.org](https://www.theiia.org/en/standards/2024-standards/topical-requirements/cybersecurity?utm_source=openai)) |
| Third-Party | **15 September 2026** | Link applicable audit criteria to supplier relationships and testing. ([theiia.org](https://www.theiia.org/en/standards/2024-standards/topical-requirements/third-party/)) |
| Organizational Behavior | **15 December 2026** | Prepare scope, confidentiality and evidence-handling decisions. ([theiia.org](https://www.theiia.org/en/standards/2024-standards/topical-requirements/organizational-behavior/?utm_source=openai)) |
| Organizational Resilience | **30 April 2027** | Update the 2027 methodology and engagement templates. ([theiia.org](https://www.theiia.org/en/standards/2024-standards/topical-requirements/organizational-resilience/)) |

These are professional requirements, not a universal US statute requiring every organisation to audit every topic annually. Their application is risk-based within the professional framework. ([theiia.org](https://www.theiia.org/en/standards/2024-standards/topical-requirements/))

### What should internal audit test in a shared GRC platform?

**Recommended demonstration:** give the supplier an assurance engagement in which only part of a topical requirement applies. Ask it to retain:

- The assessment of every requirement’s applicability.
- The exclusion rationale and reviewer.
- The engagement-specific testing programme.
- Links to supporting evidence and findings.
- Auditor conclusions separately from management’s control assertions.
- The version of the methodology used at the time.

Then ask a management control owner to edit the underlying control record. The historical audit conclusion should remain identifiable and attributable.

For **audit-management software requirements**, insist on controlled methodology updates and reviewer permissions. Reusing evidence is a useful design objective; merging management ownership and independent assurance is not the objective.

---

# What changed in the EU AI Act timetable for US groups with European exposure?

**The high-risk timetable has changed, and a single “August 2026 AI Act deadline” is no longer an adequate implementation plan.** The European Commission states that the AI Omnibus entered into force on **27 July 2026**. The revised dates are **2 December 2027** for Annex III high-risk systems and **2 August 2028** for high-risk systems embedded in regulated products under Annex I. ([digital-strategy.ec.europa.eu](https://digital-strategy.ec.europa.eu/en/news/ai-omnibus-enters-force))

This is not a blanket postponement of the entire AI Act. The official implementation material distinguishes the high-risk dates from other provisions already applicable. ([digital-strategy.ec.europa.eu](https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai?utm_source=openai))

**Recommended action for an exposed US group:** maintain separate jurisdictional classifications against a shared AI-use inventory. Record the provider/deployer role, use case, affected market, classification rationale and applicable obligation version.

Do not copy the EU classification into California or Colorado automatically. Make the platform demonstrate how one technology can support several uses with different legal outcomes.

For AI features inside the GRC platform itself, require source-linked outputs, permission tests and human approval as buyer acceptance criteria. These are recommended assurance controls, not a claim that every GRC assistant falls into a particular statutory AI category.

---

# Which older changes still deserve a migration check?

### Does the DOJ Data Security Program affect third-party and evidence architecture?

**It warrants a separate data-access assessment where the programme’s transaction and data conditions may apply.** DOJ’s programme prohibits or restricts specified transactions giving countries of concern or covered persons access to US government-related data or Americans’ bulk sensitive personal data. It became effective on **8 April 2025**. ([justice.gov](https://www.justice.gov/nsd/data-security))

DOJ’s updated FAQ identifies **6 October 2025** as the start of specified additional due-diligence, audit and reporting obligations. Annual reporting is not a universal requirement for every US business. ([justice.gov](https://justice.gov/nsd/media/1415006/dl))

**Recommended vendor-risk review:** assess data categories, access, ownership and relevant transaction facts—not just the supplier’s headquarters. Include implementation partners, support arrangements and AI subprocessors in the review where relevant. Avoid placing sensitive source material in a GRC repository before the access model is approved.

### Are control libraries carrying obsolete versions?

NIST issued **SP 800-53 Release 5.2.0 on 27 August 2025**, including changes concerning software updates, deployment and integrity, with corresponding assessment-procedure updates. This is a reason to check the actual catalogue and assessment version—not to assume that every customer contract automatically changed. ([csrc.nist.gov](https://csrc.nist.gov/news/2025/nist-releases-revision-to-sp-800-53-controls?utm_source=openai))

The IAF transition deadline for accredited ISO/IEC 27001 certification from the 2013 edition to the 2022 edition was **31 October 2025**. ([iaf.nu](https://iaf.nu/en/changes-in-the-scope-of-the-iaf-mla-during-2024-2025/?utm_source=openai))

**Recommended migration rule:** retain the version associated with historical assessments, certificates and evidence. Add the successor mapping with an approval trail. Never silently relabel a historical assessment as having tested a newer version.

---

# What belongs in an enterprise GRC regulatory-change requirements checklist?

**The following is a recommended buyer specification, not an assertion that every item is legally mandated.** Use it to compare retaining, repairing or replacing the current platform.

| Requirement | Minimum acceptance evidence | Failure to reject |
|---|---|---|
| Authority and version | Original source, provision identifier, publication date, retrieved date and supersession relationship | A framework label without a source or version |
| Legal status | Separate values for applicable, future, proposed, guidance, professional standard, suspended and superseded | A proposal automatically generating mandatory overdue actions |
| Applicability | Entity, activity, data, geography, threshold, exemption rationale and approving owner | One sector-wide applicability switch |
| Date handling | Effective, compliance, coverage-period and submission dates stored separately | One due date used for every milestone |
| Change impact | Before/after comparison linked to affected policies, controls, assessments and open work | A content update overwriting approved mappings |
| Evidence provenance | Source system, collection time, period covered, reviewer and access classification | Successful collection presented as proof of control effectiveness |
| Exceptions | Rationale, approver, conditions, review date and closure evidence | Permanent exceptions without re-evaluation |
| Assurance separation | Distinct management assertions, auditor tests and conclusions | Shared editing that obscures who reached the conclusion |
| Portability | Bulk export of records, relationships, attachments, versions and approval history | A spreadsheet export that loses the audit trail |

### Which scenarios should go into the GRC demonstration script?

Use synthetic data and require the same scenario from every shortlisted supplier:

1. **Changed law:** replace a Colorado requirement while preserving the earlier applicability decision.
2. **Different dates:** configure California’s audit coverage period separately from the report deadline.
3. **Suspended milestone:** pause CMMC Phase II without removing applicable contract obligations.
4. **Restricted evidence:** prevent a general control owner from accessing sensitive healthcare evidence reused by authorised assurance staff.
5. **Failed integration:** show that stale asset or identity evidence triggers review rather than leaving an unexplained green status.
6. **Audit exclusion:** document why one topical requirement does not apply to an engagement.
7. **Exit:** export the entire scenario, including approvals and attachments, into a usable package.

Score what is demonstrated as standard capability, supported configuration, custom development or not demonstrated. Ask the buyer’s intended administrator—not just the supplier’s consultant—to perform one routine change.

---

# How should buyers sequence implementation without creating another transformation programme?

**Our recommendation is to close immediate obligation and evidence gaps first, then implement reusable platform capabilities.** Do not make a new platform’s go-live date the prerequisite for meeting a nearer obligation.

### Immediate triage

- Assign legal, compliance and operational owners to the near-term dates above.
- Identify which dates in the existing register are obsolete, proposed or suspended.
- Obtain an approved applicability decision for each priority item.
- Record a controlled interim process where a platform change cannot be delivered in time.
- Preserve the evidence supporting current decisions before migration.

### Before year-end

- Prepare January 2027 privacy and automated-decision workflows where applicable.
- Establish evidence collection for applicable audit periods starting in January.
- Update internal audit templates for effective topical requirements.
- Test at least one complete workflow, including an exception, failed integration and export.
- Confirm who will maintain regulatory mappings after implementation partners leave.

### During the next procurement or renewal decision

Use the **Requirements Scorecard** to select the first workflow, the **Migration Checklist** to protect history, and the **Demo Script** to make supplier claims testable. The three-year TCO comparison should separately request prices for regulatory content, specialist modules, APIs, sandboxes, implementation, administrator training and update services.

Ask explicitly:

- Who decides whether a regulatory update applies: the buyer, supplier or content provider?
- What is included when a rule is delayed, replaced or withdrawn?
- Can the buyer reject an automated mapping while preserving the proposed mapping and rationale?
- What requires paid professional services?
- Can historical content still be exported after a content subscription ends?
- Who owns ongoing data quality, integrations and testing?

**The purchase decision should follow an evidenced operating model.** If the incumbent can support the required controls and change process with manageable repair work, regulation alone is not a sufficient reason to replace it.

---

# Sources

Official regulators, government records and standard-setting bodies support the regulatory conclusions below. Industry press, job-board and practitioner-media searches were used for discovery, not as legal authority. URLs are provided in code form; the inline citations provide source links.

### California privacy and Colorado automated decision-making

- CPPA, completed rulemaking: `https://cppa.ca.gov/regulations/ccpa_updates.html`
- CPPA, approved regulations: `https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf`
- CPPA, finalisation announcement and staged dates: `https://www.cppa.ca.gov/announcements/2025/20250923.html`
- Colorado Attorney General, current rulemaking and status: `https://coag.gov/ai/`
- Colorado General Assembly, enacted SB26-189: `https://leg.colorado.gov/bills/sb26-189`

### Financial services and banking

- NYDFS, cybersecurity resource centre: `https://www.dfs.ny.gov/cybersecurity`
- NYDFS, implementation timeline: `https://www.dfs.ny.gov/industry_guidance/cybersecurity/implementation_timeline_covered_entities`
- NYDFS, MFA guidance: `https://www.dfs.ny.gov/system/files/documents/2025/09/multifactor-authentication.pdf`
- SEC, Regulation S-P compliance guide: `https://www.sec.gov/files/rules/final/2024/regulation-s-p-small-entity-compliance-guide.pdf`
- Federal Reserve, SR 26-2: `https://www.federalreserve.gov/supervisionreg/srletters/SR2602.htm`
- Federal Reserve, revised joint model-risk guidance: `https://www.federalreserve.gov/frrs/guidance/supervisory-guidance-on-model-risk-management.htm`
- OCC, proposed third-party guidance: `https://occ.gov/news-issuances/bulletins/2026/bulletin-2026-46.html`
- Federal Register, proposed third-party guidance: `https://www.govinfo.gov/content/pkg/FR-2026-09-15/html/2026-18859.htm`
- OCC, consultation dates: `https://www.occ.gov/topics/laws-and-regulations/occ-regulations/proposed-issuances/occ-proposed-issuances-2026.html`
- Agencies, joint third-party announcement: `https://www.occ.gov/news-issuances/news-releases/2026/nr-ia-2026-77.html`
- OCC, Cybersecurity Supervision Work Program update: `https://www.occ.gov/news-issuances/bulletins/2026/bulletin-2026-48.html`
- FDIC, FFIEC CAT sunset: `https://www.fdic.gov/news/financial-institution-letters/2024/sunset-ffiec-cybersecurity-assessment-tool`

### Healthcare

- HHS, Part 2 overview: `https://www.hhs.gov/hipaa/part-2/index.html`
- HHS, Part 2 enforcement announcement: `https://www.hhs.gov/press-room/hhs-announce-civil-enforcement-program-sud-patient-records.html`
- HHS, Part 2 final-rule fact sheet: `https://www.hhs.gov/hipaa/for-professionals/regulatory-initiatives/fact-sheet-42-cfr-part-2-final-rule/index.html`
- HHS, HIPAA Security Rule proposal: `https://www.hhs.gov/hipaa/for-professionals/security/hipaa-security-rule-nprm/index.html`
- HHS, proposal fact sheet: `https://www.hhs.gov/hipaa/for-professionals/security/hipaa-security-rule-nprm/factsheet/index.html`
- HHS, current Security Rule summary: `https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html`
- Regulatory agenda, HIPAA proposal: `https://mobile.reginfo.gov/public/do/eAgendaViewRule?RIN=0945-AA22&pubId=202510`
- HHS, HTI-5 announcement: `https://www.hhs.gov/press-room/hhs-finalizes-hti-5-deregulatory-rule.html`

### Incident reporting, contracting and data access

- OIRA, CIRCIA pending review: `https://www.reginfo.gov/public/do/eoDetails?rrid=1550967`
- CISA, CIRCIA fact sheet: `https://www.cisa.gov/sites/default/files/2023-01/CIRCIA_07.21.2022_Factsheet_FINAL_508%20c.pdf`
- Official CMMC programme status: `https://dodcio.defense.gov/cmmc/About/`
- SBA Office of Advocacy, CMMC reform review: `https://advocacy.sba.gov/2026/07/20/dow-requests-information-for-cmmc-reform-task-force/`
- DOJ, Data Security Program: `https://www.justice.gov/nsd/data-security`
- DOJ, updated programme FAQs: `https://justice.gov/nsd/media/1415006/dl`

### Climate reporting

- CARB, 12 October 2026 approval and deadline notice: `https://content.govdelivery.com/accounts/CARB/bulletins/42ee5c1`
- CARB, reporting resources: `https://content.govdelivery.com/accounts/CARB/bulletins/427b576`
- CARB, SB 261 enforcement status: `https://ww2.arb.ca.gov/our-work/programs/corporate-ghg-reporting/climate-related-financial-risk`

### Professional standards and European AI requirements

- IIA, applicability and topical requirements: `https://www.theiia.org/en/standards/2024-standards/topical-requirements/`
- IIA, cybersecurity: `https://www.theiia.org/en/standards/2024-standards/topical-requirements/cybersecurity`
- IIA, third-party: `https://www.theiia.org/en/standards/2024-standards/topical-requirements/third-party/`
- IIA, organisational behaviour: `https://www.theiia.org/en/standards/2024-standards/topical-requirements/organizational-behavior/`
- IIA, organisational resilience: `https://www.theiia.org/en/standards/2024-standards/topical-requirements/organizational-resilience/`
- European Commission, AI Omnibus entry into force: `https://digital-strategy.ec.europa.eu/en/news/ai-omnibus-enters-force`
- European Commission, AI Act implementation: `https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai`
- NIST, SP 800-53 Release 5.2.0: `https://csrc.nist.gov/news/2025/nist-releases-revision-to-sp-800-53-controls`
- IAF, ISO/IEC 27001 transition: `https://iaf.nu/en/changes-in-the-scope-of-the-iaf-mla-during-2024-2025/`