This list names five cyber security regulations security teams should know in 2026: the NIS2 Directive, the Digital Operational Resilience Act (DORA), the Cyber Resilience Act (CRA), the EU AI Act and the US CIRCIA reporting rule. It is not a ranking. It is selected by one criterion: each measure has an official public-body page that we read for who it covers, what it requires and the dates it states.
How was this list selected, and what does it leave out?
The pages come from three public bodies. The European Commission publishes the NIS2, CRA and AI Act pages, ESMA publishes the DORA page, and the US Cybersecurity and Infrastructure Security Agency (CISA) publishes the CIRCIA page. Other rules and national laws are not covered here. Where a page leaves the 2026 status unclear, we say so.
This is a summary of what those pages say, not legal advice. Check with counsel before deciding how a rule applies to your organization.
1. NIS2: who does it cover, and what changed in 2026?
The Commission page says NIS2 sets a unified legal framework for cybersecurity in 18 critical sectors across the EU. As a rule, medium-sized and large entities in those sectors have to take appropriate cybersecurity risk-management measures and notify national authorities of significant incidents. The page also says NIS2 introduces accountability of top management for non-compliance. See the NIS2 glossary entry.
On dates, the page says NIS2 came into force in January 2023. Member States had until 17 October 2024 to transpose it into national law, and NIS2 repealed NIS1 as from 18 October 2024. In 2026 two items stand out. On 20 January 2026 the Commission proposed targeted amendments to increase legal clarity, which it says will ease compliance for 28,700 companies, including 6,200 micro and small-sized enterprises. On 8 July 2026 it decided to refer Ireland, Spain, France and the Netherlands to the Court of Justice for failing to notify transposition measures. The page does not say whether the amendments have been adopted, so their status is unclear.
2. DORA: what does it ask of financial entities?
The ESMA page describes DORA as an EU regulation that aims to strengthen the ICT security of financial entities and keep the financial sector resilient in a severe digital disruption. It applies to more than 20 different types of financial entities, of which 12 are in the remit of ESMA.
The page groups the requirements into six areas: ICT risk management, ICT third-party risk management, digital operational resilience testing, ICT-related incidents, information sharing, and oversight of critical third-party providers. For the supplier side, see our post on NIS2 and DORA third-party risk management and the DORA glossary entry.
The page says DORA entered into force on 16 January 2023 and will apply as of 17 January 2025. Its wording is in the future tense, but the date it gives has passed. For 2026 it lists two ESAs items: a 2025 report on major ICT-related incidents dated 3 June 2026, and a statement on ICT risks from frontier AI models dated 31 July 2026.
3. Cyber Resilience Act: when do the reporting obligations start?
The Commission page says the CRA introduces mandatory cybersecurity requirements for manufacturers of products with digital elements, covering planning, design, development and maintenance. Manufacturers must also handle vulnerabilities during the lifecycle of their products. Some products may need a third-party assessment by a notified body before sale on the EU market, and compliant products bear the CE marking.
The page gives three dates. The CRA entered into force on 10 December 2024. The main obligations apply from 11 December 2027. Reporting obligations apply as of 11 September 2026, and the page says that from that date manufacturers are required to report actively exploited vulnerabilities and further items that the page text cuts off. On 27 July 2026 the Commission published practical guidance for manufacturers, developers and businesses of all sizes. Our post on the CRA reporting obligations and the 24-hour clock covers the reporting side.
4. EU AI Act: which parts apply in 2026?
The Commission page describes Regulation (EU) 2024/1689 as the first comprehensive legal framework on AI worldwide, with risk-based rules for AI developers and deployers. It defines 4 levels of risk and prohibits nine practices. Obligations for high-risk systems include logging of activity for traceability, human oversight and a high level of robustness, cybersecurity and accuracy.
The page says the Act entered into force on 1 August 2024 and became applicable on 2 August 2026, with exceptions. Prohibited practices and AI literacy obligations applied from 2 February 2025. Governance rules and obligations for general-purpose AI models applied from 2 August 2025. The transparency rules come into effect in August 2026. Prohibition 9, on AI systems that generate non-consensual sexually explicit content, comes into effect in December 2026. From 2 August 2026 the AI Office and Member State authorities are responsible for implementing, supervising and enforcing the Act.
The AI Omnibus, which entered into force on 27 July 2026, moved the high-risk dates. Rules for high-risk areas such as biometrics, critical infrastructure, education, employment, migration, asylum and border control apply from 2 December 2027. Rules for systems integrated into products, such as lifts or toys, apply from 2 August 2028.
5. CIRCIA: is the US incident reporting rule in effect?
The CISA page says the Act requires CISA to develop regulations requiring covered entities to report covered cyber incidents and ransomware payments to CISA. As proposed, incidents would be reported no later than 72 hours after the entity reasonably believes the incident occurred, and ransom payments within 24 hours of payment.
The status is the part to read closely. The page says organizations are not required to submit covered cyber incident or ransom payment reports under CIRCIA until the final rule goes into effect. CISA published the proposed rule on 4 April 2024, with comments open until 3 July 2024, and held four town hall meetings between 15 and 18 June 2026. The page says funding lapses affected its rulemaking work and that CISA continues to work on the final rule. It states no effective date.
Which dates from these pages fall in 2026 and after?
The five pages state these dates.
- 20 Jan 2026NIS2Commission proposes targeted amendments.
- 15 to 18 June 2026CIRCIACISA holds four town hall meetings.
- 8 July 2026NIS2Commission refers four Member States to the Court of Justice.
- 27 July 2026AI Act, CRAAI Omnibus enters into force; Commission publishes CRA guidance.
- 2 Aug 2026AI ActBecomes applicable, with exceptions.
- 11 Sept 2026CRAReporting obligations apply.
- Dec 2026AI ActProhibition 9 comes into effect.
- 2 Dec 2027AI ActHigh-risk rules for areas such as biometrics and employment apply.
- 11 Dec 2027CRAMain obligations apply.
- 2 Aug 2028AI ActRules for high-risk systems integrated into products apply.
The dates suggest some questions to take to counsel and to your legal, risk and compliance and CISO colleagues. Is the organization a medium-sized or large entity in one of the NIS2 sectors? Is it a financial entity under DORA? Does it make products with digital elements, which the CRA covers? Does it develop or deploy AI systems? Is it a CIRCIA covered entity?
Related reading: the incident reporting deadlines, the compliance calendar for 2026 and 2027, DORA in 2026 and the EU AI Act dates.