DORA, NIS2, EU AI Act, SEC Rules — What Every GRC Professional Must Know for 2026
The Regulatory Landscape
If 2025 felt like a regulatory crescendo, 2026 is the year the orchestra starts playing in full force. Regulators are accelerating enforcement, from EU frameworks such as NIS2, DORA, and the AI Act, to new privacy mandates in Australia, India, and Brazil, to US SEC rules .
Key 2026 Regulatory Developments
EU Digital Operational Resilience Act (DORA)
Status: Fully applicable from January 17, 2025
Scope: Financial entities must maintain structured ICT incident records and reporting discipline
Key Requirements:
- ICT risk management framework
- Incident reporting within deadlines
- Digital operational resilience testing
- Third-party risk management
- Information sharing
Why It Matters: DORA ties governance to supplier dependency and strengthens testing and evidence trails, turning paper programs into auditable resilience programs .
NIS2 Directive
Status: Member states completing transposition; enforcement beginning
Scope: Essential and important entities across critical sectors
Key Requirements:
- Risk management measures
- Incident reporting
- Management accountability
- Supply chain security
Expectation: Intensified scrutiny in early 2026 as national laws come online .
EU AI Act
Status: Phased obligations in effect; major checkpoint August 2026
Key Requirements:
- August 2025: Transparency for general-purpose AI and foundation models
- August 2026: High-risk AI systems compliance (HR, credit, medical diagnostics, critical infrastructure)
What's Required for High-Risk AI:
- Risk management system
- Human oversight
- Documentation
- Transparency
- Accuracy, robustness, cybersecurity
Why It Matters: Organizations running HR, credit, medical diagnostics, or critical infrastructure AI must prepare risk management, human oversight, and documentation that withstand regulator review .
US SEC Cyber Disclosure Rules
Status: Normalized requirement
Key Requirements:
- Incident reporting within 4 business days
- Annual governance disclosures
- Materiality determination
Why It Matters: Drives cross-functional alignment between security, finance, and legal. Boards and CISOs must have decision frameworks ready .
Australia Privacy Reforms
Status: Staged applicability, with requirements active now
Key Requirements:
- New statutory torts
- Anti-doxxing offenses
- Enhanced OAIC powers
- Technical and organizational security measures
- Transparency for automated decisions
- Children's Online Privacy Code (24-month runway)
Why It Matters: Governance teams must actively manage staged applicability .
The 90-Day Readiness Roadmap
IBM recommends a 90-day roadmap for regulatory readiness :
|
Timeframe |
Actions |
|
Board and Policy |
Approve unified SGR charter; assign named executive accountability |
|
Controls and Evidence |
Maintain control libraries with test artifacts |
|
AI Readiness |
Complete AI inventories; classify high-risk use cases; draft conformity files |
|
Incident Convergence |
Integrate legal, finance, and security tooling |
|
Cross-Border |
Maintain live register of transfers and mechanisms |
The Global Enforcement Map
Europe: NIS2 enforcement accelerating, DORA in full effect, EU AI Act deadlines approaching
US: SEC rules normalized, state-level AI laws emerging
Canada: Provincial frameworks (Québec Law 25) raising national expectations
Asia: China clarifying outbound data pathways; Singapore maintaining fast-response breach notification (3 days); Australia privacy reforms in effect
Latin America: Brazil ANPD 2026–2027 enforcement map prioritizing data-subject rights, AI, and emerging tech
Conclusion
2026 is the year SGR determines your license to operate across product design, AI deployment, capital markets disclosure, and cross-border data . Organizations that prepare early—building governance that scales, security that proves resilience, and risk models that inform real decisions—will stand apart.
Action Items for Your Organization
- Map applicable regulations to your organization
- Identify compliance gaps
- Establish accountability for regulatory compliance
- Build audit-ready controls
- Prepare for AI Act compliance (August 2026 deadline)
- Align incident reporting across regulations
