3 pieces by Grace Adeyemi.
EU Cyber Resilience Act reporting begins September 11, and the U.S. CIRCIA final rule is expected soon. Together with existing SEC, NIS2, DORA and state requirements, many organizations will face several reporting clocks from one incident. How to prepare a single process that meets them all.
Days before the August 2 deadline, the EU’s Digital Omnibus pushed most high-risk AI obligations to late 2027. Organizations that were racing now have room to build the inventory, governance and security controls the obligations assume.
The HHS proposal published January 6 would turn many long-standing ‘addressable’ safeguards into firm requirements. Healthcare organizations and their business associates can use the comment period to build a realistic plan, whatever the final text says.