Compliance Calendar

Full application

All essential cybersecurity requirements (Annex I) apply to in-scope products.

Reporting obligations begin

Article 14's 24-hour/72-hour/14-day vulnerability and incident reporting clock becomes mandatory.

v4.0 future-dated requirements become mandatory

The subset of v4.0 requirements originally marked as best practice (notably expanded MFA and targeted risk analyses) become fully mandatory.

DORA becomes applicable

DORA applies directly across all EU member states — no national transposition required.

Proposed Security Rule update published (NPRM)

HHS OCR publishes a Notice of Proposed Rulemaking that would make MFA, encryption, and other safeguards mandatory rather than addressable — not yet in force as a final rule.

CMMC 2.0 program rule effective (32 CFR Part 170)

The CMMC 2.0 program rule becomes effective, establishing the three-level model.

Entered into force

Regulation (EU) 2024/2847 enters into force.

Member-state transposition deadline

EU member states were required to have transposed NIS2 into national law by this date — actual local effective dates vary by country.

PCI DSS v3.2.1 retired

Version 3.2.1 is fully retired — v4.0 becomes the only active version.

NIST CSF 2.0 published

NIST publishes CSF 2.0, adding the Govern function and broadening the framework's stated audience beyond critical infrastructure.

ISO/IEC 42001:2023 published

The first international AI management system standard is published.