Security · Infrastructure · Automation · AI
Security · Infrastructure · Automation · AI
The Cyber Resilience Act (CRA) comes into effect on 11 September 2026, mandating manufacturers to report exploited vulnerabilities and severe product-security incidents within specified timeframes. Initial obligations begin immediately, despite broader compliance deadlines in December 2027. Companies must establish effective reporting processes to ensure timely and accurate notifications regarding product security.
Australia’s critical-infrastructure framework combines mandatory risk management and incident reporting with last-resort government powers to act during a serious cyber incident. Australia has expanded the Security of Critical Infrastructure Act in several waves. Major reforms in 2021 and 2022 broadened…
Poland’s amended National Cybersecurity System Act is now in force. Its scale, registration timetable and management duties turn NIS2 into a board-level implementation programme. Poland’s amendment to the National Cybersecurity System Act took effect on 3 April 2026. The Act…
Paraguay’s first comprehensive personal-data law creates a regulator, reaches some overseas processing and gives organisations 24 months from official publication before the regime takes effect. Paraguay’s Law No. 7.593/2025 represents a major change from a privacy landscape previously centred on…
South Korea’s AI Basic Act entered into force on 22 January 2026, combining industrial promotion with obligations for high-impact and generative AI. Europe is not the only jurisdiction turning AI principles into law. South Korea’s Framework Act on the Development…
The EU Data Act, effective from 12 September 2025, grants users rights to access and share data from connected products, aiming to enhance data portability and interoperability. It imposes new requirements on cloud service providers to facilitate easier switching and data extraction, fundamentally altering infrastructure and user access dynamics.
India notified the Digital Personal Data Protection Rules and the Act’s commencement schedule in November 2025. The result is not a single start date but a sequence extending into 2027. India enacted the Digital Personal Data Protection Act in August…
Singapore’s amended Cybersecurity Act expands oversight beyond traditional critical infrastructure and recognises that essential services may depend on virtual systems, cloud providers and data centres. Key provisions of Singapore’s Cybersecurity (Amendment) Act commenced on 31 October 2025. The original Act…
The EU AI Act's phased application reached a significant milestone on 2 August 2026, with new transparency obligations enforced. While high-risk rules have extended deadlines, organisations must remain proactive in governance, ensuring AI literacy and accountability. Compliance should not hinder innovation, as effective inventory management aids both.
The Data (Use and Access) Act 2025 did not sweep away the UK’s privacy framework. It changed how parts of that framework operate—and added complaint, research, digital-verification and smart-data provisions around it. The Act received Royal Assent on 19 June…