Cybersecurity regulatory watch: CRA, NIS2, DORA, AI Act, HDS, ISO 27001 and GDPR.
What changed, who it affects and what to do, in a few lines. Updated every week by an ISO 27001 and HDS certification auditor, from official sources. Get it straight into Slack, Teams or your RSS reader.
French law still pendingAssembly debate postponed on 6 October 2026.
HDS
New rules in forceEEA-only storage since 27 September 2026.
AI Act
High-risk rules delayedTo 2 December 2027 (Annex III).
GDPR
Reform under negotiationCurrent rules still apply.
Dashboard
The status of each regulation, at a glance.
CRA · Regulation (EU) 2024/2847In force
Cyber Resilience Act
Cybersecurity requirements for products with digital elements (hardware and software) sold in the EU.
Who
Manufacturers, importers and distributors, including software vendors.
Since
11 Sept 2026: reporting of actively exploited vulnerabilities and severe incidents.
Next
11 Dec 2027: all requirements apply (secure design, CE marking).
To doA vulnerability handling process that can notify within 24 hours, and an inventory of the products in scope.
NIS2 · Directive (EU) 2022/2555French law pending
NIS2 Directive
Cyber risk management measures and incident reporting for essential and important entities in 18 sectors.
Who
Medium and large companies in the listed sectors, and some smaller ones.
France
Resilience bill passed by the Senate, not yet voted by the National Assembly.
Next
Enactment, then decrees and the ANSSI framework.
To doCheck whether you are in scope on ANSSI's MesServicesCyber. An ISO 27001 certification covers much of the Article 21 measures.
DORA · Regulation (EU) 2022/2554In force
Digital Operational Resilience Act
Digital operational resilience for the financial sector and oversight of ICT providers.
Who
Financial entities, and their ICT providers through contracts.
Since
17 Jan 2025. The register of information on ICT contracts is filed every year.
Next
First threat-led penetration tests (TLPT) by 17 Jan 2028 for designated entities.
To doIf you supply financial firms: be ready to provide security evidence, audit rights and exit plans.
AI Act · Regulation (EU) 2024/1689Deadlines delayed
EU AI Act
Rules based on the risk level of AI systems, from prohibitions to transparency duties.
Who
Providers and deployers of AI systems used in the EU.
Since
2 Aug 2026: transparency obligations (Article 50).
Next
2 Dec 2027: Annex III high-risk systems. 2 Aug 2028: Annex I.
To doInventory your AI uses and their risk level. ISO/IEC 42001 gives a recognised management framework.
HDS · French Public Health CodeIn force
Health data hosting (HDS)
Mandatory certification to host health data on behalf of others in France.
Who
Hosting providers, health SaaS vendors and their hosting subcontractors.
Since
16 May 2026: HDS v2.0 framework for all certified hosts. 27 Sept 2026: EEA-only storage and transfer transparency.
To doUpdate your contracts and publish the map of transfers outside the EEA. Our HDS support
ISO/IEC 27001 · 27701Stable
ISO 27001 and ISO 27701
Management system standards for information security (ISMS) and privacy.
27001
2022 version, with the 2024 climate change amendment (clauses 4.1 and 4.2).
27701
2025 edition published in October 2025: a standalone standard, certifiable without ISO 27001.
To doCheck that your context analysis covers climate. For 27701, ask your certification body for its transition timeline. Our ISO 27001 support
GDPR · Regulation (EU) 2016/679Reform pending
GDPR and the Digital Omnibus
The Commission proposes to amend the GDPR and move the cookie rules into it (Digital Omnibus, Nov 2025).
Status
First reading in Parliament, no Council mandate so far.
Meanwhile
The GDPR and the current cookie rules apply unchanged.
To doDo not redesign anything based on the draft. Keep your records, DPIAs and consent management up to date.
Latest updates
What changed recently.
NIS2
NIS2: the French Resilience bill is postponed again at the National Assembly
The bill transposing NIS2 (along with the CER directive and the directive accompanying DORA) was due for debate on 7 and 9 October. The Conference of Presidents removed it from the agenda on 6 October. No new date is set; the rapporteur hopes to reschedule it within two to three weeks. The Senate passed it at first reading on 12 March 2025.
What it means: NIS2 obligations do not yet legally apply in France. The EU transposition deadline (17 October 2024) has passed and the Commission has opened infringement proceedings. Entities in scope should prepare now: ANSSI plans a gradual ramp-up, but some obligations such as incident reporting are expected to apply soon after enactment.
HDS: EEA-only storage and transparency on transfers now apply
The main obligations of French decree no. 2026-209 of 24 March 2026 apply since 27 September 2026. Hosted health data must be stored only in an EU or EEA country. Remote access from a third country remains possible with an adequacy decision or appropriate safeguards (GDPR Articles 45 and 46).
What it means: contracts must list the foreign laws the host or its subcontractors are subject to, the risks and the measures taken. Hosts must publish a map of transfers and access from outside the EEA. Health SaaS vendors should check their own subcontracting chain.
Source: decree no. 2026-209 of 24 March 2026 (Journal officiel, 26 March 2026). See our HDS support
GDPR
GDPR: the Digital Omnibus reform remains stuck
The data part of the Digital Omnibus, proposed on 19 November 2025, would amend the GDPR and move the cookie rules from the ePrivacy Directive into the GDPR. In Parliament, over 1,750 amendments were tabled in committee. In the Council, a vote on a negotiating mandate was cancelled for lack of agreement. Trilogues have not started.
What it means: nothing for now. Adoption is not expected before late 2026 at the earliest, and the text may still change substantially.
CRA: vulnerability and incident reporting is now mandatory
Since 11 September 2026, manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents through ENISA's Single Reporting Platform, launched the same day. Deadlines: early warning within 24 hours, notification within 72 hours, final report within 14 days after a fix is available (vulnerabilities) or within one month (incidents).
What it means: the duty also covers products placed on the market before December 2027. Software vendors need vulnerability monitoring, fast triage and a notification workflow. The other CRA requirements apply from 11 December 2027.
AI Act: the Digital Omnibus on AI delays high-risk obligations
Regulation (EU) 2026/1744 entered into force on 27 July 2026. Obligations for Annex III high-risk AI systems (recruitment, credit and others) move from 2 August 2026 to 2 December 2027, and those for Annex I regulated products to 2 August 2028. Article 50 transparency obligations apply since 2 August 2026, with until 2 December 2026 for marking content generated by systems already on the market.
What it means: more time for high-risk systems, but not for transparency. HR and fintech companies using AI in hiring or credit decisions should use the delay to map their systems.
We only email you if you tick the box, and only about this. Unsubscribe anytime by emailing info@cyberbitsconsulting.com.
FAQ
Questions about the watch
Which regulations do you cover?
The Cyber Resilience Act (CRA), NIS2 and its French transposition, DORA, the EU AI Act, HDS certification, the ISO 27001 and ISO 27701 standards, and the GDPR. Other texts are added when they affect our clients.
Do I need to sign up?
No. The RSS feed is open to everyone. Signing up is optional and only used to email you before major deadlines.
How often is it updated?
The dashboard is reviewed every week. A new entry is published only when a text, a date or an official position changes.
How do I add it to Slack?
Copy the feed link in the "Subscribe" section, then type in the channel of your choice: /feed subscribe followed by the link. Each new entry will be posted there automatically.
And in Microsoft Teams?
Create a Power Automate flow "When a feed item is published", with the feed link, that posts a message to your channel.
Is it free?
Yes. If you want to know what a change means for your ISMS or your certification, you can book a free 30-minute call.
Does a change affect you?
30 minutes, free, no commitment. We look at what it changes for your ISMS, your ISO 27001 or HDS certification and your next audits.
