Last reviewed: 22 October 2026
A short, plain-language list of the changes most likely to affect a small or medium organisation. Each item says whether it is law today or only proposed. This page is reviewed by hand, so check the date above, and follow the official sources for anything you rely on.
Manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents under the Cyber Resilience Act from 11 September 2026: an early warning within 24 hours, then a fuller notification. Most other obligations arrive on 11 December 2027. Official text
The directive had to be written into national law by 17 October 2024, and most EU countries have missed or only partly met that date. Where your country stands varies, so your obligations and deadlines depend on its law. Check your national authority rather than assuming the directive's text is the whole picture. Official text
In late 2025 the European Commission proposed changes to several digital laws, including the GDPR. Among the ideas reported is a longer deadline for breach notification and a narrower definition of personal data. These are proposals in the legislative process, and data protection authorities have raised concerns. Until the law actually changes, the 72-hour breach deadline in Article 33 still applies. Current GDPR text
Certificates to the 2013 edition stopped being valid after the transition period ended on 31 October 2025. A 2024 amendment added a requirement to consider whether climate change is relevant to your information security management system. If you are certified or planning to be, you should be working to the 2022 edition.
Information only, not legal advice. External links open the official EU legal texts on EUR-Lex.