news

Anthropic restored global access to Claude Fable 5 on July 1, 2026, ending an 18-day suspension triggered by U.S. export controls over a reported jailbreak discovered during Amazon security testing. Although the restrictions were lifted, the incident exposed unresolved questions about government oversight of frontier AI models, export-control authority, enterprise AI governance, and the responsibilities…

The Pentagon suspended the CMMC Phase 2 certification rollout on July 13, 2026, delaying mandatory third-party assessments for defense contractors. The decision paused planned Level 2 C3PAO assessments, Level 3 government assessments, and later implementation milestones while a CMMC Reform Task Force reviewed program costs, assessment capacity, and possible structural changes. A September 3, 2026…

DORA has changed cybersecurity and technology-risk duties for EU financial firms from fragmented national obligations into a binding EU-wide operational resilience regime, with banks, insurers, payment firms, investment firms, and major ICT suppliers now facing stricter governance, incident reporting, testing, and third-party risk rules. The latest confirmed update came on June 3, 2026, when the…

The EU AI Act became broadly applicable on August 2, 2026, bringing Article 50 transparency requirements and stronger regulatory enforcement into effect. The European Commission’s AI Office and national authorities can now enforce applicable provisions, while general-purpose AI model requirements that started in 2025 have entered their full Commission enforcement phase.The regulatory timetable changed shortly…

The EU AI Act is driving interest in ISO/IEC 42001 certification as companies search for a practical way to document AI governance before enforcement and customer reviews intensify. The standard does not replace the AI Act, but it gives providers, deployers and vendors an auditable management system for AI risk, oversight, documentation, monitoring and accountability.Why…

HITRUST CSF v11.8.0 has added new compliance and AI risk mappings to a widely used security assurance framework, giving healthcare, technology, financial services, and vendor-risk teams a newer reference point for continuous monitoring, privacy, PCI, SOC 2, state law, and large language model risks. The latest confirmed action came on May 8, 2026, when HITRUST…

PCI SSC’s statement that awareness training may help satisfy PCI DSS Requirement 12.6 has put employee education back into focus for merchants and service providers preparing PCI DSS v4.0.1 assessments. The issue is no longer whether staff receive a generic annual module. Assessors now look for a formal, updated, documented security awareness program tied to…

NYDFS has moved its cybersecurity regulation into a tougher compliance and enforcement phase, with final Second Amendment duties now active and recent settlements showing that weak incident reporting, access controls, vendor oversight, and data retention can trigger penalties. The latest official update came on May 21, 2026, when NYDFS issued threat-environment guidance for regulated entities.What…

Organizations are moving from informal AI policies to formal Artificial Intelligence Management Systems as ISO/IEC 42001 turns AI governance into an auditable business process. The shift accelerated after ISO published ISO/IEC 42001:2023 in December 2023, the EU AI Act entered force in 2024, and major AI and cloud vendors began publishing third-party certifications for AI…

The EU Cyber Resilience Act will force manufacturers of software and connected products to report actively exploited vulnerabilities and severe product security incidents from September 11, 2026, creating the first binding EU-wide cyber reporting duty for digital products before the broader product security rules apply on December 11, 2027. The latest official Commission update, posted…