Texas and Illinois AI laws take effect
1 Jan 2026
The Texas Responsible AI Governance Act and Illinois’ AI-in-employment law both come into force, adding to US state AI regulation.
Changes to laws and regulations affecting information security, privacy, AI and resilience.
The Texas Responsible AI Governance Act and Illinois’ AI-in-employment law both come into force, adding to US state AI regulation.
Hong Kong’s first cyber security law now requires designated critical infrastructure operators to manage cyber risks and report incidents.
Vietnam’s Personal Data Protection Law No. 91/2025/QH15 takes effect, replacing Decree 13/2023.
The European Commission has renewed its adequacy decisions for the UK, so personal data can continue to flow freely from the EU.
Germany’s NIS2 Implementation Act takes effect, significantly expanding the number of organisations subject to cyber security duties.
Larger US broker-dealers, investment advisers and funds must now have incident response programmes and notify affected customers within 30 days.
India notifies its Digital Personal Data Protection Rules, starting a phased implementation with most obligations applying from May 2027.
The UK Government has introduced legislation to modernise and expand the NIS Regulations.
Taiwan’s amended Personal Data Protection Act establishes an independent commission and strengthens breach reporting.
The DFARS rule implementing CMMC takes effect, allowing US Department of Defense contracts to require CMMC status as a condition of award.
Egypt issues the Executive Regulations to its Personal Data Protection Law, starting a one-year transition.
Singapore’s amended Cybersecurity Act extends oversight to virtual and third-party-owned Critical Information Infrastructure.