What's coming but not yet binding — proposed rules, enacted-but-not-in-force rules, and phase-in deadlines. Forward-looking dates move; confirm against the primary source before acting.
Proposed rules, enacted-but-not-in-force rules, phase-in deadlines and open comment windows, sorted by date. Day counts run from 5 Oct 2026, the date this page was built. A proposal whose comment period has closed has no date until a final rule is published; one that has since been finalized is in the in-force rulebook, not here.
| Date | When | In | Regulator | Rule / milestone | Type |
|---|---|---|---|---|---|
| 2026-12-31 | in 87 days | UK | UK_NIS | UK Cyber Security and Resilience Bill — expansion of the NIS regime FORTHCOMING (proposed): the most significant reform of the UK NIS regime since 2018. Broadens scope to data centres and managed service providers, tightens incident reporting (notify within 24h, full report within 72h), and expands… | Proposed |
| 2027-12-11 | in 432 days | EU | EU_CRA | Regulation (EU) 2024/2847 — Cyber Resilience Act (products with digital elements) Main obligations apply — secure-by-design, conformity assessment, CE marking. | Phase-in |
| No date yet | — | US | FCC | Resilient Networks; Disruptions to Communications; Disruptions to Communications Proposed rule (NPRM), comments closed 2021-12-06. A later final order in the same docket (FR 2022-19745, 2022-09-30) may have resolved it — check before relying on this entry. | Proposed |
| No date yet | — | US | FCC | The Uniendo a Puerto Rico Fund and the Connect USVI Fund, Connect America Fund Proposed rule (NPRM), comments closed 2022-12-09. A later final order in the same docket (FR 2023-09089, 2023-05-05) may have resolved it — check before relying on this entry. | Proposed |
| No date yet | — | US | FCC | Emergency Alert System; Wireless Emergency Alerts; Protecting the Nation's Communications Systems From Cybersecurity Threats Proposed rule (NPRM), comments closed 2022-12-23. A later final order in the same docket (FR 2026-15601, 2026-07-31) may have resolved it — check before relying on this entry. | Proposed |
| No date yet | — | US | CISA | Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) Reporting Requirements Proposed rule (NPRM). Comments closed 2024-06-03; no final rule yet. | Proposed |
| No date yet | — | US | FCC | Amendments to Resilient Networks Disruptions to Communications; New Considerations Concerning Disruptions to Communications Proposed rule (NPRM), comments closed 2024-04-29. A later final order in the same docket (FR 2025-17899, 2025-09-16) may have resolved it — check before relying on this entry. | Proposed |
| No date yet | — | US | TSA | Enhancing Surface Cyber Risk Management Proposed rule (NPRM). Comments closed 2025-02-05; no final rule yet. | Proposed |
| No date yet | — | UK | UK_TELECOM | Revised UK Telecommunications Security Code of Practice (draft 2026) Last expected milestone (2026-06-30) has passed; status being re-checked. FORTHCOMING (proposed): a draft revision of the 2022 Telecommunications Security Code of Practice, published June 2026, updating the technical guidance public telecoms providers follow to meet their duties under the Telecommunications… | Proposed |
Knowing which rules bind you is step one. WSquare Advisory builds the operating capability behind compliance — the continuity, third-party, and recovery disciplines these regimes expect. If that's your challenge, let's talk.
Start with an Operating Survey · $5,000 →Not sure it is the right moment? Take the five-minute check first.