What's coming but not yet binding — proposed rules, enacted-but-not-in-force rules, and phase-in deadlines. Forward-looking dates move; confirm against the primary source before acting.
Proposed rules, enacted-but-not-in-force rules, phase-in deadlines and open comment windows, sorted by date. Day counts run from 5 Oct 2026, the date this page was built. A proposal whose comment period has closed has no date until a final rule is published; one that has since been finalized is in the in-force rulebook, not here.
| Date | When | In | Regulator | Rule / milestone | Type |
|---|---|---|---|---|---|
| 2026-12-31 | in 87 days | UK | UK_NHS | UK Cyber Security and Resilience Bill — health/NHS as operators of essential services FORTHCOMING (proposed): the UK Cyber Security and Resilience Bill reforms the NIS regime and reaches the health sector — NHS trusts and health providers already designated as operators of essential services face expanded scope and tighter… | Proposed |
| 2027-01-03 | in 90 days | US | HHS_OCR | S.3315 — Health Care Cybersecurity and Resiliency Act of 2026 (HIPAA cyber mandates) FORTHCOMING (proposed): federal legislation, sponsored by Sen. Cassidy (HELP chair) and Sen. Warner, that would amend HIPAA to impose MINIMUM cybersecurity requirements on covered entities and business associates — multi-factor… | Proposed |
| 2027-03-26 | in 172 days | EU | EU_EHDS | Regulation (EU) 2025/327 — European Health Data Space (EHDS) General application — EHR-system requirements, secure processing environments begin to apply. | Phase-in |
| 2029-03-26 | in 903 days | EU | EU_EHDS | Regulation (EU) 2025/327 — European Health Data Space (EHDS) Priority health-data exchange (patient summaries, ePrescriptions) + most secondary-use rules apply. | Phase-in |
| No date yet | — | US | HHS_OCR | HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information Proposed rule (NPRM). Comments closed 2025-03-07; no final rule yet. | Proposed |
Knowing which rules bind you is step one. WSquare Advisory builds the operating capability behind compliance — the continuity, third-party, and recovery disciplines these regimes expect. If that's your challenge, let's talk.
Start with an Operating Survey · $5,000 →Not sure it is the right moment? Take the five-minute check first.