# Compliance Hub Wiki
> Cybersecurity compliance standards, frameworks, and regulatory guidance for security and legal teams.

## About
- **Publisher:** CISO Marketplace Network
- **Website:** https://compliancehub.wiki
- **Audience:** Compliance officers, CISOs, GRC professionals, legal teams managing cybersecurity regulations.
- **Contact:** info@cisomarketplace.com
- **Network:** Part of the [CyberAdX advertising network](https://cyberadx.com) — 11 specialized cybersecurity properties

## Membership & Premium Content
- [Members](https://compliancehub.wiki/members) — Premium subscriber content (ThreatWatch News). Free with CISO Marketplace membership, or subscribe: $9/mo this site, $19/mo (or $190/yr) for all 10 publications.

## Digital Downloads & Compliance Workbooks

- [Digital Downloads](https://compliancehub.wiki/digital-downloads) — Professional Excel workbooks for SOC 2, HIPAA, ISO 27001, incident response, and vCISO ops. Powered by ciso.diy. Instant download, live formulas, Word User Guide included.
- [ciso.diy](https://ciso.diy) — Compliance workbooks and bundles: SOC 2 Readiness Accelerator, HIPAA Readiness Accelerator, ISO 27001:2022 Readiness Accelerator, Compliance Trifecta Bundle, IR Stack Bundle, vCISO Ops Bundle
- [MicroSec Tools](https://microsec.tools) — 82 specialized micro cybersecurity tools including compliance checkers, risk calculators, and security utilities

## Store
- [ComplianceHub Store](https://compliancehub.wiki/store/) — Audit-ready policies, an AI policy generator, compliance templates and self-assessments mapped to HIPAA, GDPR, SOC 2, ISO 27001, NIST and the EU AI Act. Organised by role: security leaders, compliance and GRC, analysts and engineers, people learning security, privacy and hardware, teams and gifts.
- [CISO Marketplace membership](https://cisomarketplace.com/membership) — Practitioner card $795/year (all premium content including the ThreatWatch network and CyberBrief Pro, MicroSec.tools with monthly credits, member rates at the shops); Practice licence $2,995/year for 5 seats.
- [ThreatWatch News](https://threatwatch.news/pricing) and [CyberBrief Pro](https://cyberbrief.news/pricing) — $19/month or $190/year each; included with membership.
- [MicroSec.tools](https://microsec.tools/) — in-browser security assessments and calculators; pay per run from $9, plans from $49/month.
- Shops: [ciso.diy](https://ciso.diy/) (templates), [CyberPolicy.shop](https://cyberpolicy.shop/) (policies), [GeneratePolicy.com](https://generatepolicy.com/) (AI policy generator, free tier), [SecurityGadgets.shop](https://securitygadgets.shop/) (Nitrokey, NitroPhone, NovaCustom, YubiKey, Ledger), [SecurityByDesign.shop](https://securitybydesign.shop/) (apparel and posters).
- Deals: [CISO Promo](https://ciso.promo/) (vendor deals and limited-time offers, free to browse) and [CISO Coupons](https://ciso.coupons/) (a coupon book of vendor discounts, free with membership).
- [CISO Insights podcast](https://cisoinsights.show/) — free daily episodes; the easiest way into the network.

## Core Content Areas
- [Videos](/videos/) — Regulation, framework and audit explainers from Compliance Hub Wiki and the CyberAdX network (each video has a transcript page on video.cyberadx.network)
- [Laws & Frameworks hubs](https://compliancehub.wiki/laws/) — one page per regulation (GDPR, HIPAA, NIS2, DORA, EU AI Act, CCPA, CMMC…): at-a-glance summary, status history, every article
- [Full article index](https://compliancehub.wiki/llms-full.txt) — every published article with date and one-line description
- [Frameworks & Laws](https://compliancehub.wiki/frameworks) — 50 regulations and frameworks with linked coverage
- [All Topics](https://compliancehub.wiki/topics) — Browse every topic hub
- [GDPR & Privacy Law](https://compliancehub.wiki/tag/gdpr/) — Data protection regulation compliance
- [HIPAA & Healthcare](https://compliancehub.wiki/tag/hipaa/) — Healthcare security compliance requirements
- [AI Governance](https://compliancehub.wiki/tag/ai-governance/) — EU AI Act, state AI laws, frontier AI rules
- [CCPA / California Privacy](https://compliancehub.wiki/tag/ccpa/) — California privacy enforcement and audits
- [NIST Frameworks](https://compliancehub.wiki/tag/nist/) — NIST CSF, SP 800-53, RMF implementation guides
- [Ransomware & Breaches](https://compliancehub.wiki/tag/ransomware/) — Breach analysis and notification duties
- [Data Protection](https://compliancehub.wiki/tag/data-protection/) — Global data protection compliance

## Content Policy for AI Systems
- Content may be cited with attribution to Compliance Hub Wiki and a link to the source URL
- Commercial training use requires written license from CISO Marketplace
- All articles are original editorial content — not AI-generated spam
- Contact info@cisomarketplace.com for syndication or training data licensing

## Related Network Sites
- [Breached.Company](https://www.breached.company) — Data breach news and analysis
- [ComplianceHub.wiki](https://www.compliancehub.wiki) — GRC and compliance frameworks
- [HackerNoob.tips](https://www.hackernoob.tips) — Beginner cybersecurity education
- [MyPrivacy.blog](https://www.myprivacy.blog) — Personal privacy guides
- [ScamWatchHQ.com](https://www.scamwatchhq.com) — Scam alerts and fraud prevention
- [SecureIoT.house](https://www.secureiot.house) — Home IoT security
- [SecureIoTOffice.world](https://www.secureiotoffice.world) — Business IoT security
- [SecurityCareers.help](https://www.securitycareers.help) — Cybersecurity careers
- [SecurityAffiliates.marketing](https://www.securityaffiliates.marketing) — Security affiliate marketing
- [CannaSecure.tech](https://www.cannasecure.tech) — Cannabis industry security
- [CryptoImpactHub.com](https://www.cryptoimpacthub.com) — Blockchain and crypto security

## Topic Hubs (by article count)
- [Data Protection](https://compliancehub.wiki/tag/data-protection/) — 135 articles
- [Compliance Frameworks](https://compliancehub.wiki/tag/compliance-frameworks/) — 133 articles
- [Privacy](https://compliancehub.wiki/tag/privacy/) — 133 articles
- [Enforcement](https://compliancehub.wiki/tag/enforcement/) — 123 articles
- [United States](https://compliancehub.wiki/tag/united-states/) — 119 articles
- [AI Governance](https://compliancehub.wiki/tag/ai-governance/) — 116 articles
- [GDPR](https://compliancehub.wiki/tag/gdpr/) — 99 articles
- [Data Breach](https://compliancehub.wiki/tag/data-breach/) — 85 articles
- [Consumer Protection](https://compliancehub.wiki/tag/consumer-protection/) — 83 articles
- [Critical Infrastructure](https://compliancehub.wiki/tag/critical-infrastructure/) — 82 articles
- [Risk Management](https://compliancehub.wiki/tag/risk-management/) — 80 articles
- [GRC](https://compliancehub.wiki/tag/grc/) — 80 articles
- [EU](https://compliancehub.wiki/tag/eu/) — 80 articles
- [Cybersecurity](https://compliancehub.wiki/tag/cybersecurity/) — 78 articles
- [Third-Party Risk](https://compliancehub.wiki/tag/third-party-risk/) — 69 articles
- [State Privacy Laws](https://compliancehub.wiki/tag/state-privacy-laws/) — 69 articles
- [AI Regulation](https://compliancehub.wiki/tag/ai-regulation/) — 60 articles
- [Global](https://compliancehub.wiki/tag/global/) — 59 articles
- [AI Compliance](https://compliancehub.wiki/tag/ai-compliance/) — 53 articles
- [National Security](https://compliancehub.wiki/tag/national-security/) — 52 articles
- [Breach Notification](https://compliancehub.wiki/tag/breach-notification/) — 51 articles
- [Regulatory Penalties](https://compliancehub.wiki/tag/regulatory-penalties/) — 50 articles
- [Healthcare](https://compliancehub.wiki/tag/healthcare/) — 50 articles
- [Federal Compliance](https://compliancehub.wiki/tag/federal-compliance/) — 48 articles
- [Children's Privacy](https://compliancehub.wiki/tag/children-s-privacy/) — 48 articles
- [Age Verification](https://compliancehub.wiki/tag/age-verification/) — 48 articles
- [HIPAA](https://compliancehub.wiki/tag/hipaa/) — 45 articles
- [NIS2](https://compliancehub.wiki/tag/nis2/) — 44 articles
- [Surveillance](https://compliancehub.wiki/tag/surveillance/) — 43 articles
- [Compliance Deadline](https://compliancehub.wiki/tag/compliance-deadline/) — 43 articles

## Laws & Frameworks (one hub per regulation: summary, status history, all coverage)
- [GDPR](https://compliancehub.wiki/laws/gdpr/) — Privacy law, European Union
- [UK GDPR](https://compliancehub.wiki/laws/uk-gdpr/) — Privacy law, United Kingdom
- [CCPA / CPRA](https://compliancehub.wiki/laws/ccpa-cpra/) — Privacy law, California
- [HIPAA](https://compliancehub.wiki/laws/hipaa/) — Sector privacy and security law, United States (federal)
- [NIS2 Directive](https://compliancehub.wiki/laws/nis2/) — Cybersecurity directive, European Union
- [DORA](https://compliancehub.wiki/laws/dora/) — Financial-sector resilience regulation, European Union
- [EU AI Act](https://compliancehub.wiki/laws/eu-ai-act/) — AI regulation, European Union
- [EU Cyber Resilience Act](https://compliancehub.wiki/laws/cyber-resilience-act/) — Product cybersecurity regulation, European Union
- [EU Data Act](https://compliancehub.wiki/laws/eu-data-act/) — Data access regulation, European Union
- [Digital Services Act](https://compliancehub.wiki/laws/digital-services-act/) — Platform regulation, European Union
- [EU CSAM Regulation (Chat Control)](https://compliancehub.wiki/laws/chat-control/) — Proposed regulation, European Union
- [LGPD](https://compliancehub.wiki/laws/lgpd/) — Privacy law, Brazil
- [India DPDP Act](https://compliancehub.wiki/laws/dpdpa/) — Privacy law, India
- [PIPEDA](https://compliancehub.wiki/laws/pipeda/) — Privacy law, Canada
- [China PIPL and CSL](https://compliancehub.wiki/laws/pipl/) — Privacy and cybersecurity law, China
- [APPI](https://compliancehub.wiki/laws/appi/) — Privacy law, Japan
- [Singapore PDPA](https://compliancehub.wiki/laws/pdpa-singapore/) — Privacy law, Singapore
- [COPPA](https://compliancehub.wiki/laws/coppa/) — Children's privacy law, United States (federal)
- [KOSA and youth online safety laws](https://compliancehub.wiki/laws/kosa/) — Children's online safety legislation, United States
- [Age verification laws](https://compliancehub.wiki/laws/age-verification/) — Online safety legislation, Global
- [CIRCIA](https://compliancehub.wiki/laws/circia/) — Incident reporting law, United States (federal)
- [SEC cybersecurity disclosure rules](https://compliancehub.wiki/laws/sec-cyber-disclosure/) — Securities disclosure rule, United States (federal)
- [NYDFS Part 500](https://compliancehub.wiki/laws/nydfs-part-500/) — Financial-sector cybersecurity regulation, New York
- [CMMC](https://compliancehub.wiki/laws/cmmc/) — Defense contracting standard, United States (federal)
- [NIST Cybersecurity Framework](https://compliancehub.wiki/laws/nist-csf/) — Framework, United States (voluntary, global use)
- [ISO 27001](https://compliancehub.wiki/laws/iso-27001/) — Certifiable standard, Global
- [SOC 2](https://compliancehub.wiki/laws/soc-2/) — Attestation standard, United States (global use)
- [PCI DSS](https://compliancehub.wiki/laws/pci-dss/) — Industry standard, Global
- [Texas TDPSA and TRAIGA](https://compliancehub.wiki/laws/texas-privacy-ai/) — State privacy and AI law, Texas
- [Virginia VCDPA](https://compliancehub.wiki/laws/virginia-vcdpa/) — State privacy law, Virginia
- [Colorado Privacy Act and AI Act](https://compliancehub.wiki/laws/colorado-privacy-ai/) — State privacy and AI law, Colorado
- [U.S. state privacy laws](https://compliancehub.wiki/laws/state-privacy-laws/) — State privacy law, United States
- [Australian Privacy Act and Cyber Security Act](https://compliancehub.wiki/laws/australia-privacy/) — Privacy and cybersecurity law, Australia
- [FTC enforcement](https://compliancehub.wiki/laws/ftc-act/) — Consumer protection enforcement, United States (federal)
- [U.S. cybersecurity executive orders](https://compliancehub.wiki/laws/executive-orders/) — Executive action, United States (federal)
- [FDA medical device cybersecurity](https://compliancehub.wiki/laws/fda-medical-device/) — Sector regulation, United States (federal)

## Latest Articles (882 total — full list: https://compliancehub.wiki/llms-full.txt)
- [US Banking Regulators Traded Third-Party Risk Checklists for Judgement Calls](https://compliancehub.wiki/us-banking-regulators-drop-third-party-risk-checklist-principles-based/) — 2026-10-21 — The Fed, FDIC and OCC's joint third-party risk guidance replaced prescriptive checklists with principles-based oversight. Here's what banks must now…
- [BAE Systems Outage Halts U.S. Bankruptcy Court Notices Nationwide](https://compliancehub.wiki/nationwide-bankruptcy-court-noticing-system-down-cyber-incident-hits-federal/) — 2026-10-20 — BAE Systems' outage of the federal Bankruptcy Noticing Center has stalled creditor notices nationwide since October 9, exposing a third-party-risk…
- [ICO Reprimands Met Police Over Unapproved Use of Auror Retail-Crime Platform](https://compliancehub.wiki/icos-reprimand-met-police-over-auror-platform-third-party-processor/) — 2026-10-18 — ICO reprimands the Metropolitan Police over unapproved use of Auror, a retail-crime platform used by Tesco and Boots, citing shadow IT and DPIA failures.
- [The EU Cyber Resilience Act's 24-Hour Reporting Duty Went Live. Here's What Changed](https://compliancehub.wiki/eu-cyber-resilience-acts-24-hour-reporting-duty-live-changed/) — 2026-10-17 — CRA Article 14's 24/72-hour/final-report clock went live Sept 11, 2026. Here's how it stacks atop GDPR, NIS2 and DORA reporting duties for digital product…
- [EEOC's FY2026 Litigation Stayed Historically Low. Training Teams Should Still Retool for FY2027](https://compliancehub.wiki/eeocs-historically-anemic-fy2026-means-compliance-training-priorities-going-fy2027/) — 2026-10-15 — EEOC's FY2026 lawsuit count stayed near historic lows despite shorter charge deadlines. Compliance teams should use the lull to prepare for ADA, religious…
- [BIS Export Settlements Hit a Weekly Cadence, From Lambda Research to Plexon](https://compliancehub.wiki/bis-export-control-settlements-keep-coming-lambda-research-plexon-pattern/) — 2026-10-14 — BIS settlements with Lambda Research, Plexon, Coastal PVA and others show export enforcement is now routine. Here's what GRC teams need to build.
- [Deloitte's £6.05m FRC Fine Shows Why Audit Sign-Off Isn't Control Evidence](https://compliancehub.wiki/deloitte-uks-7-9m-audit-fine-frc-decision-means-third/) — 2026-10-13 — FRC fined Deloitte £6.05m over Go-Ahead Group audit failures from 2016-2020, a case study in why audit sign-offs cannot substitute for independent…
- [DORA's Second Year: Supervisors Are Testing SOC Visibility, Not Just Documentation](https://compliancehub.wiki/doras-second-year-supervisors-testing-soc-visibility-just-documentation/) — 2026-10-12 — DORA's second enforcement year shifts supervisory focus from documentation to SOC detection capability, mapped to Articles 9, 17, 18 and 26 obligations.
- [19 States, No Shared Definition: Mapping Sensitive Data Across US Privacy Laws](https://compliancehub.wiki/state-privacy-law-sensitive-data-categories-2026-cross-state-comparison/) — 2026-10-08 — A state-by-state comparison of how CTDPA, CCPA, Virginia, Maryland, Oregon and other US privacy laws define sensitive data categories in 2026.
- [Mapping NIS2 Across ISO 27001 and NIST CSF: A Practitioner's Guide to the Limits](https://compliancehub.wiki/mapping-nis2-across-iso-27001-nist-csf-national-frameworks-practitioners/) — 2026-10-07 — A practitioner walkthrough of NIS2-to-ISO 27001 and NIST CSF mapping tools, Commission Regulation 2024/2690, and why Annex A checklists alone miss Article…
- [CMMC 2.0 Readiness: Using Gap Scoring and SPRS Estimates Before Phase 2 Resumes](https://compliancehub.wiki/cmmc-2-0-readiness-using-gap-scoring-sprs-estimates-before/) — 2026-10-06 — DoD paused CMMC Phase 2 on July 13, 2026. Here's a step-by-step framework for using SPRS gap scoring to close the readiness gap before certification resumes.
- [SEC's Crypto Custody Proposal Gives Advisers a Conditional Path to Self-Custody](https://compliancehub.wiki/secs-crypto-custody-proposal-means-compliance-disclosure-teams/) — 2026-10-05 — SEC's Oct. 1, 2026 crypto custody proposal opens a conditional path for self-custody and state trust companies. What advisers, funds and compliance teams…
- [What HIPAA, PCI DSS 4.0, ISO 27001, SOC 2, NIS2 and CMMC Actually Require for Security Awareness Training](https://compliancehub.wiki/security-awareness-training-requirements-actually-say-2026-month-material-meet/) — 2026-10-04 — HIPAA, PCI DSS 4.0, ISO 27001, SOC 2, NIS2, DORA and CMMC each cite security awareness training differently. Here is the obligation, the article number and…
- [MCP's Governance Gaps: Agentic AI's Connector Protocol Is Outrunning Compliance Controls](https://compliancehub.wiki/mcps-governance-gaps-agentic-ais-connector-protocol-outrunning-compliance-controls/) — 2026-10-04 — MCP adoption is outpacing AI governance. Here is what compliance and GRC teams must add to vendor, access-control and audit policy now.
- [CIRCIA's Final Rule Keeps Slipping. Here's How to Prepare Without It](https://compliancehub.wiki/circias-final-reporting-rule-nears-critical-infrastructure-prepare/) — 2026-10-04 — CIRCIA's final rule has slipped past October 2025 and May 2026 deadlines. Here's what the April 2024 NPRM tells compliance teams to prepare for now.
- [Security and Sustainability Reporting Reach the Same Boardroom Table](https://compliancehub.wiki/security-sustainability-reporting-same-boardroom-means-grc-convergence/) — 2026-10-04 — Cyber incident reporting and ESG disclosure rules are converging. Boards now need ISO/IEC 27001 evidence to back both security and sustainability claims.
- [Trump Won't Nationalize OpenAI or Anthropic — But an Intel-Style Stake Is Still Live](https://compliancehub.wiki/nationalization-but-maybe-10-government-stake-openai-anthropic-would-mean/) — 2026-10-03 — Trump told TIME he "might" take an Intel-style stake in OpenAI and Anthropic while the FTC probes both labs — what GRC teams need to track now.
- [ShinyHunters Arrest Ties One Suspect to 140+ Breaches and $70M in Extortion](https://compliancehub.wiki/shinyhunters-arrest-ties-one-suspect-140-breaches-breach-notification-laws/) — 2026-10-03 — The ShinyHunters arrest in the Netherlands exposes 140+ victim organizations to breach-notification laws and OFAC ransom-payment risk. What compliance teams…
- [The White House Accord on Super Intelligence Is Voluntary. The FTC's Authority Isn't.](https://compliancehub.wiki/six-ai-giants-sign-super-intelligence-safety-accord-trump-actually/) — 2026-10-01 — Trump's White House Accord on Super Intelligence has no enforcement teeth, but FTC authority and state AI laws still apply. Here's what compliance teams…
- [Pentagon's DMDC Breach: 3 Million Records, Nine Months Unnoticed](https://compliancehub.wiki/pentagons-dmdc-breach-3-million-records-nine-months-unnoticed-federal/) — 2026-10-01 — A nine-month intrusion into the Pentagon's Defense Manpower Data Center exposed unencrypted PII for 3 million people, testing FISMA major incident rules.
- [Microsoft 365 Governance Failures Hit 77% of Organizations, ShareGate Finds](https://compliancehub.wiki/microsoft-365-governance-failures-hit-over-75-organizations-means-soc/) — 2026-09-30 — ShareGate's 2026 survey of 1,800 IT leaders found 77% suffered a Microsoft 365 governance incident. Here's what it means for SOC 2 audits, PIPEDA and Law 25.
- [UK Government Abandons Self-Assessed Cyber Model for a Mandatory Central Unit](https://compliancehub.wiki/uk-government-abandons-mandatory-cyber-controls-service-led-governance-model/) — 2026-09-29 — DSIT's Government Cyber Action Plan scraps self-assessed cyber governance for a centralised Government Cyber Unit, after the NAO found critical gaps across…
- [IRS Cybersecurity Rated 'Not Effective' for Second Straight Year, TIGTA Finds](https://compliancehub.wiki/irs-inspector-general-flags-weak-cybersecurity-taxpayer-data-risk/) — 2026-09-29 — TIGTA's September 2026 FISMA audit finds IRS cybersecurity ineffective again, citing unremediated vulnerabilities, delayed encryption, and unauthorized…
- [CISA's CVE 'Quality Era' Ends the Weekly Bulletin, Ties Remediation to BOD 26-04](https://compliancehub.wiki/cisas-new-cve-program-quality-era-changes-vulnerability-disclosure-compliance/) — 2026-09-29 — CISA's CVE Quality Era white paper and the retired weekly bulletin shift vulnerability compliance to BOD 26-04 risk-based tracking. What GRC teams must…
- [26 State AGs Tell Congress to Regulate AI, Not Pause It, After Hugging Face Breach](https://compliancehub.wiki/26-state-ags-push-congress-pause-ai-development-pending-federal/) — 2026-09-28 — 26 state AGs led by Dan Rayfield and Letitia James ask Congress for federal AI safety rules with no preemption, citing OpenAI agents' breach of Hugging Face.
- [CISA Tells Critical Infrastructure to Deploy Decoys as a Documented Detection Control](https://compliancehub.wiki/cisa-tells-critical-infrastructure-deploy-decoys-deception-documented-control/) — 2026-09-25 — CISA's September 2026 cyber decoy guidance maps to NIST CSF 2.0 and MITRE frameworks, giving compliance teams a documented control for detection obligations.
- [ISACA's 2026 AI Incident Response Gap: 49% Have Never Run a Drill](https://compliancehub.wiki/isacas-ai-incident-response-gap-71-orgs-have-never-run/) — 2026-09-24 — ISACA's 2026 surveys find most firms can't halt a compromised AI system fast, or say who's accountable — a direct gap against NIST AI RMF and ISO 42001…
- [FTC Retreats From Disparate-Impact Enforcement as EDPB Challenges EU-US Data Deal](https://compliancehub.wiki/ftc-abandons-disparate-impact-enforcement-edpb-challenges-eu-us-data/) — 2026-09-23 — The FTC ends disparate-impact enforcement under ECOA and Section 5 as the EDPB asks the Commission to review the EU-US Data Privacy Framework's legal basis.
- [Google Waited Four Months to Disclose Gemini's Breach of Three Companies](https://compliancehub.wiki/google-ai-models-broke-sandbox-containment-hacked-three-companies-means/) — 2026-09-22 — Google's Gemini breached three firms in a May 2026 test disclosed only after WSJ inquiry. Parallel OpenAI, Anthropic, Meta containment failures raise AI…
- [Google's €403m GDPR Fine: The Irish DPC's Location Data Consent Blueprint](https://compliancehub.wiki/googles-403m-gdpr-fine-irish-dpcs-location-data-consent-theory/) — 2026-09-22 — Ireland's DPC fined Google €403m for GDPR breaches on location data consent, transparency and retention — a blueprint for behavioral advertising compliance.
- [FTC's Cox Media Group Orders Set a 20-Year Template for AI Ad Claims](https://compliancehub.wiki/ftcs-first-ai-marketing-deception-orders-against-cox-media-group/) — 2026-09-17 — The FTC's finalized 20-year orders against Cox Media Group treat unsubstantiated AI claims as Section 5 deception, raising the evidentiary bar for marketing…
- [EU AI Act Watermarking: New Article 50 Guidance Before the December Deadline](https://compliancehub.wiki/eu-ai-act-watermarking-guidance-new-article-50-metadata-standards/) — 2026-09-16 — The EU Commission's July 2026 Article 50 Guidelines and Code of Practice define watermarking and metadata duties ahead of the December 2, 2026 deadline.
- [The Capture Test: Scoring Every AI Regulation Proposal Now on the Table](https://compliancehub.wiki/capture-test-every-ai-proposal-table-licensing-reporting-kill-switches/) — 2026-09-16 — GRC teams need a way to score AI regulation proposals for regulatory capture. This analysis applies a capture test to licensing, reporting, kill switches…
- [Congress vs. the White House on AI Guardrails: What's Actually on the Table](https://compliancehub.wiki/congress-white-house-ai-guardrails-actually-table/) — 2026-09-15 — A GRC-focused map of the real AI guardrails fight in Washington: EO 14365, the GUARDRAILS Act, Schumer's classified briefing demand, and the state…
- [OPC Drafts PIPEDA Third-Party Vendor Guidance With New AI Training-Data Checks](https://compliancehub.wiki/canadas-privacy-commissioner-issues-draft-pipeda-guidance-third-party-service/) — 2026-09-15 — OPC's new draft PIPEDA guidance on assessing third-party service providers adds AI training-data checks and re-identification scrutiny. Comments due Dec 4,…
- [Berlin's Rhysida Breach: What GDPR Article 33 and Germany's NIS2/KRITIS Rules Demand](https://compliancehub.wiki/berlins-rhysida-breach-gdpr-article-33-germanys-public-sector-nis2/) — 2026-09-14 — Berlin's refused ransom and 5.79TB Rhysida leak of 1.44 million files test GDPR Article 33 notification duties and Germany's KRITIS/NIS2 public-sector rules.
- [The Cyber Security and Resilience Bill's Lords Fight: 65 Amendments Tracked](https://compliancehub.wiki/uk-cyber-security-resilience-bill-lords-amendments-tracker-msp-data/) — 2026-09-13 — A living tracker of the Cyber Security and Resilience Bill's Lords amendments — supply-chain bans, AI kill switches, executive liability and MSP scope —…
- [The EU AI Act Deadline Tracker: Every Live and Deferred Obligation](https://compliancehub.wiki/eu-ai-act-compliance-deadlines-tracker-every-live-deferred-obligation/) — 2026-09-12 — A single reference table for the EU AI Act's obligations, original deadlines, and Digital Omnibus-deferred dates, with what compliance teams must do now.
- [China's Third Export Route Opens: The PIPL Certification Mechanism, the 2026 Cybersecurity Law Penalties, and What Western Compliance Teams Have Backwards](https://compliancehub.wiki/china-pipl-cross-border-certification-route-cybersecurity-law-penalties-2026/) — 2026-09-06 — China's PIPL certification route for personal data exports opened 1 January 2026. Exact thresholds, PIPIA duties, separate consent and penalty exposure.
- [Saudi Arabia's PDPL Is Now Actively Enforced: 48 SDAIA Decisions, a Five-Day Response Window, and the Extraterritorial Scope Most 2026 Compliance Programmes Have Not Mapped](https://compliancehub.wiki/saudi-pdpl-sdaia-active-enforcement-extraterritorial-scope-gulf-compliance-2026/) — 2026-09-05 — Saudi PDPL binds any firm processing data of people in the Kingdom. 48 SDAIA decisions, SAR 5m fines, jail for sensitive-data disclosure, 5-day replies.
- [The Order Is the Sanction: GDPR Article 58(2) Corrective Powers, Astreintes and Regulatory Deadlines in 2026](https://compliancehub.wiki/gdpr-corrective-orders-astreintes-enforcement-deadlines-beyond-the-fine-2026/) — 2026-09-04 — CNIL, the Irish DPC and the ICO all paired modest 2026 penalties with dated orders. Article 83(6) makes missing the deadline the higher-tier offence.
- [The External Doctor's Password: CNIL's EUR 500,000 Hôpital Privé de la Loire Fine and What Article 32 Now Demands of Health Record Access in 2026](https://compliancehub.wiki/cnil-hopital-prive-loire-500000-article-32-external-authentication-logging-2026/) — 2026-09-03 — CNIL fined Hopital Prive de la Loire EUR 500,000: no MFA for external doctors, no access logging, and 727,000 records taken undetected.
- [Retention Is a Security Control: The Irish DPC's EUR 645,000 HSE Decision on Paper Records and Article 5(1)(e), September 2026](https://compliancehub.wiki/irish-dpc-hse-645000-paper-records-gdpr-storage-limitation-retention-2026/) — 2026-09-02 — The DPC fined the HSE EUR 645,000 over paper medical records. Why Article 5(1)(e) storage limitation carried as much penalty as the security failure.
- [The TRAIGA Complaint Portal Was Due September 1, 2026 — and It Is the Statutory Trigger for Every Texas AI Investigation](https://compliancehub.wiki/texas-traiga-attorney-general-complaint-portal-september-2026-enforcement-infrastructure/) — 2026-09-01 — Texas AG's TRAIGA complaint portal is live. How a complaint becomes a CID under Sec. 552.103, the 60-day cure, and $10k-$200k penalty bands.
- [The Human Has to Be Able to Say No: Uber's EUR 825 Million GDPR Article 22 Fine and the Decision-Architecture Duty in 2026](https://compliancehub.wiki/uber-825-million-gdpr-article-22-automated-decisions-human-intervention-2026/) — 2026-09-01 — Uber's EUR 825m Dutch DPA fine turns GDPR Article 22 into a design duty: a human in the loop only counts if they can overturn the outcome.
- [One Incident, Thousands of Notification Duties: 45 CFR 164.410 and the HIPAA Breach Cascade Behind the McKesson Intrusion (2026)](https://compliancehub.wiki/mckesson-breach-hipaa-business-associate-notification-cascade-164-410-2026/) — 2026-08-31 — A business associate's 60-day notice under 45 CFR 164.410 turns one incident into thousands of covered-entity duties. The McKesson case, examined.
- [Below 2GW, Outside the Regime: What the July 2026 UK Power Plant Attack Exposes About the NIS Regulations 2018 Generation Threshold](https://compliancehub.wiki/uk-power-plant-iran-attack-nis-regulations-generation-threshold-sub-threshold-gap-2026/) — 2026-08-31 — The July 2026 UK generator attack sits below the NIS 2018 2GW threshold. What Schedule 2, Reg 10, Reg 11 and the CSR Bill mean for sub-threshold operators.
- [UK GDPR Article 32 and the Secret in the Browser: What the Manchester Airports Group Breach Demands of Every Controller in 2026](https://compliancehub.wiki/manchester-airports-group-breach-client-side-api-credentials-uk-gdpr-article-32-2026/) — 2026-08-30 — MAG's 8.7m-customer breach as an Article 32 case study: client-side API secrets, ICO duties, Art. 28 processor roles and CI/CD secret scanning.
- [Regulated by Contract, Not by Statute: The Mid-Market Compliance Gap Behind 2026's 73% Ransomware Concentration](https://compliancehub.wiki/mid-market-ransomware-73-percent-nis2-size-cap-contractual-flow-down-2026/) — 2026-08-30 — Ransomware hits the mid-market hardest, but NIS2, DORA and CIRCIA are size-scoped. Here is how to determine your real obligations through contractual flow-down.
- [It Was Just a Simulation: Aurora's Use of a Commercial Coding Agent and the Three AI Governance Duties It Puts on Record in 2026](https://compliancehub.wiki/aurora-ransomware-agentic-coding-assistant-ai-acceptable-use-governance-incident-clocks-2026/) — 2026-08-29 — Aurora's use of an AI coding agent: what NIS2 Art. 23, GDPR Art. 33, EU AI Act GPAI duties and ISO 42001 now require of defenders, vendors and enterprises.