Upcoming Dates
Key dates for the vulnerability disclosure and security research community: policy comment deadlines, regulations, CFPs, and international developments.
A continually updated reference for the vulnerability disclosure and security research community. Dates are organized by category and updated weekly alongside Policy Pulse.
Last updated: October 17, 2026
Never miss a date:
📅 Subscribe in your calendar app - an auto-updating feed of every dated entry below (also available as a direct .ics link).
✉️ Prefer email? Subscribe to Upcoming Dates Weekly for a weekly digest of this page - opt-in, separate from the main blog.
Policy Comment Deadlines
Oct 30, 2026 - NIST Draft CSWP 36G: False Base Station Security (5G) - comment period closes
NIST's National Cybersecurity Center of Excellence published a draft white paper evaluating how inexpensive off-the-shelf hardware lets attackers impersonate legitimate 5G base stations to intercept, track, or degrade service, and is taking public comment on six tested attack scenarios and device-level mitigations. NIST CSRC
Nov 2, 2026 - NIST IR 8623 (Initial Public Draft): CSF 2.0 Community Profile for Federal Agency Open RAN Deployment - comment period closes
Draft profile that helps federal agencies fold Open Radio Access Network (O-RAN) deployments into their cybersecurity risk management by mapping O-RAN ALLIANCE security specifications to CSF 2.0 outcomes: a security baseline for a 5G attack surface researchers increasingly test. NIST CSRC
Nov 30, 2026 - NIST SP 800-82 Rev. 4 (Initial Public Draft): Guide to Operational Technology (OT) Security - comment period closes
Draft update to NIST's flagship OT/ICS security guide (industrial control systems, building automation, water, rail/maritime), aligned to CSF 2.0: relevant to the critical-infrastructure vulnerability research community. NIST CSRC
Dec 7, 2026 - NIST SP 800-185 Rev. 1 (Initial Public Draft): SHA-3 Derived Functions - comment period closes
Draft revision of the SHA-3 derived-functions standard (cSHAKE, KMAC, TupleHash, ParallelHash) adding streaming extendable-output interfaces: relevant to researchers who test cryptographic implementations. NIST CSRC
Dec 16, 2026 - UK DSIT Software Security Code of Practice: Evaluation Survey
Six-month call for evidence on the UK's voluntary Software Security Code (vulnerability disclosure + reporting expectations on software vendors). gov.uk consultation
Right to Repair
Right to repair and good-faith security research share the same legal battleground: the DMCA §1201 anti-circumvention regime and the fight over firmware locks, parts-pairing, and access to diagnostic tools. Wins for repairers routinely widen the space for researchers, and vice versa.
Dec 31, 2026 - John Deere FTC/state right-to-repair settlement: offline diagnostic/repair-tool deadline
By this date Deere must make PIPS (product improvement programs), machine-health insights, DTAC Solutions access, fluid sampling, and an offline diagnostic/reprogramming mode available under the FTC and five-state (IL, AZ, MI, MN, WI) settlement announced Jul 8, 2026, with 10 years of FTC supervision: a concrete embedded-firmware access milestone distinct from Deere's separate $99M private class-action settlement from April 2026. FTC press release
Jul 1, 2027 - Kansas HB 2700 (Digital Right-to-Repair Act) takes effect
Requires OEMs to make documentation, parts, and tools available to independent repair providers and owners of digital electronic equipment sold in Kansas on fair and reasonable terms, enforced by the Attorney General: another firmware-access-adjacent right-to-repair law widening the space security researchers also rely on. Kansas Legislature - HB 2700 enrolled
Jul 1, 2027 - Oregon SB 1596 Right to Repair (parts-pairing ban) enforcement begins
Oregon's first-in-the-nation ban on "parts pairing" (software serialization that blocks replacement components) took effect Jan 1, 2025; Attorney General civil enforcement (up to $1,000/day per violation) begins on this date: directly constraining the firmware-level lockouts researchers and repairers otherwise have to circumvent. H2 Compliance
Regulations Coming Into Effect
Oct 22, 2026 - OMB M-26-15: federal agency post-quantum cryptography migration plans due
Agencies must submit a PQC Migration Plan to OMB and the Office of the National Cyber Director within 120 days of the memorandum's Jun 24, 2026 date, implementing the migration directive in EO 14412 (see the Dec 31, 2030 entry below). OMB M-26-15
Oct-Nov 2026 - UK Online Safety Act: first categorised-service transparency deadlines
Category 1/2A services (Facebook, Instagram, Snapchat, TikTok among them) must supply updated illegal-content and children's risk-assessment records to Ofcom by October 2026, then publish summaries of those findings by November 2026; first full transparency reports follow in summer 2027 under Ofcom's finalized reporting guidance. Ofcom implementation timetable
Sep 11-Nov 2026 - ETSI CRA Product Standards: Public Enquiry Window
ETSI launched the formal public-enquiry phase on Aug 13, 2026 for its 17 vertical draft CRA standards; comment deadlines run mid-September through mid-November 2026 depending on product vertical, with finalized versions expected by December 2026 - these are the standards that will give manufacturers a presumption of conformity for each product category. ETSI newsroom
Dec 31, 2026 - EU CRA Harmonised Standards: Type C Drafting Deadline (moved from Oct 30)
The Commission's draft amendment to standardisation mandate M/606 has been adopted: the Type C (product-category) harmonised-standards drafting deadline is now confirmed at Dec 31, 2026, two months later than the originally scheduled Oct 30 date. This is a drafting deadline for the standards bodies, not the point at which manufacturers get Article 27 presumption-of-conformity benefit. cyberresilienceact.eu
TBD (delivered Sep 11, 2026; public release date unannounced) - CMMC Reform Task Force Report
The Task Force delivered its recommendations to the Department of War CIO on Sep 11, 2026 at the end of its 60-day review, but as of Oct 4, 2026 the report remains unpublished; whether and when it becomes public is the Department's discretion, and no Phase 2 restart date has been set. InsideGovernmentContracts
Nov 10, 2026 - CMMC 2.0 Phase 2: Mandatory Third-Party Certification - SUSPENDED
DoD suspended Phase 2 on Jul 13, 2026 (memo 26-P-1023); on Sep 3, 2026 DoD issued a class deviation directing contracting officers to strip CMMC third-party-assessment requirements under the Revolutionary FAR Overhaul instead of the Nov 2025 final CMMC rule. The Reform Task Force report (see entry above) has not yet been made public, and officials have not ruled out ending the program. Phase 1 self-attestation and DFARS 252.204-7012/NIST SP 800-171 obligations remain live. Nextgov/FCW
Nov 2026 (exact date not yet published) - New York RAISE Act: AI developer registration opens
Precursor step to the Jan 1, 2027 compliance date below: starting in November 2026, NY's new DIGIT office (housed at DFS) will direct large frontier AI developers to register with the state ahead of the Jan 1, 2027 safety-framework and incident-reporting requirements; no specific calendar date has been published yet. Governor Hochul: AI Safety next steps
Nov 16, 2026 - California AI oversight executive order: recommendations on frontier-AI safety laws due
Following Governor Newsom's Sep 9 signing of SB 813 (independent AI verification organizations) and AB 1405 (AI auditor registry), his Sep 18 executive order gives state officials and outside experts until this date to recommend changes to California's AI safety laws, such as periodic audits of frontier developers' safety frameworks by independent verification organizations; application rules for verification organizations are due by May 2027. StateScoop
Dec 2, 2026 - EU AI Act: Article 50(2) Watermarking Grace Period Closes
Systems placed on the market before August 2, 2026 that generate synthetic audio, image, video, or text content must comply with Article 50(2) watermarking/provenance-marking requirements by this date: the final grace provision from the Digital Omnibus. EU AI Act timeline
Dec 7, 2026 - CISA BOD 26-04: risk-based remediation (Phase III)
Under the new SSVC risk-tiered model, FCEB agencies must remediate vulnerabilities per the directive's risk table; non-CDM agencies report status every 7 days: the operational replacement for the old fixed KEV remediation timelines. CISA BOD 26-04
Dec 9, 2026 - EU Product Liability Directive: Applies to Digital Products
The revised EU PLD (2024/2853) applies to products placed on the market after this date: for the first time, standalone software and digital elements are explicitly "products," and failure to provide security updates can constitute a defect, directly raising the legal stakes of slow patch cycles and inadequate disclosure handling. EU Official Journal
Dec 10, 2026 - Australia Privacy Act: Automated Decision-Making Transparency
New APP 1 obligations from the Privacy and Other Legislation Amendment Act 2024 take effect: Australian entities must disclose in privacy policies how personal information is used in automated decisions that could significantly affect individuals' rights, a transparency requirement touching AI systems that process personal data during security assessments. OAIC intends to release ADM Transparency guidance by September 2026, ahead of this date. OAIC guidance
Dec 11, 2026 - Cybersecurity Information Sharing Act of 2015 (CISA 2015): next sunset deadline
The Sep 30, 2026 cliff was averted when Congress passed and President Trump signed H.R. 6500 (the Continuing Appropriations and Extensions Act, 2027, Sep 2, 2026), a stopgap funding bill that pushed CISA 2015's liability-protection and antitrust-safe-harbor sunset to this date; the separate 10-year reauthorization (through 2036) remains stalled in the Senate (see the Pending/TBD section below). Defense One
Dec 19, 2026 - EO 14412: 180-day deadlines (contractor PQC/FIPS proposed rule, NIST module-validation reform)
Within 180 days of the Jun 22 order, the FAR Council must publish a proposed rule requiring covered contractors to comply by Dec 31, 2030 with NIST FIPS including post-quantum algorithms, NIST must revise the Cryptographic Module Validation Program to accelerate validations and start a PQC pilot, and NSA must file its first National Security Systems migration report: of interest to researchers who test cryptographic implementations. EO 14412
Dec 24, 2026 - EU eIDAS 2.0: Digital Identity Wallets Deployment Deadline
All 27 EU member states must make at least one certified European Digital Identity Wallet available to citizens and businesses, 24 months after implementing acts entered into force Dec 4, 2024; voluntary and free, creating new authentication infrastructure with identity-verification implications for cross-border security research. eIDAS 2.0 timeline
Dec 31, 2026 - Austria NISG 2026: NIS2 Entity Registration Deadline
Austria's Network and Information System Security Act 2026 (NISG 2026), transposing NIS2, took effect Oct 1, 2026, bringing roughly 4,000 companies across 18 sectors under new cybersecurity obligations and establishing a Federal Office for Cybersecurity (Bundesamt für Cybersicherheit); affected entities must register with the new office by this date. Compliance-Kit.eu
Expected by end of 2026 (sent to OMB Oct 2, 2026) - CIRCIA Final Rule
CISA submitted its final CIRCIA incident-reporting rule to OMB/OIRA for interagency review on Oct 2, 2026 after missing its September target; the May 26, 2026 Federal Register notice had scheduled town-hall meetings (held Jun 15-18, 2026, drawing 1,200+ stakeholders) to narrow the scope and burden of the April 2024 NPRM, and publication is now expected before year-end; the 18-month effective-date clock begins only once it publishes. GovInfoSecurity
Est. April 2027 (slipped from "end of 2026") - FAR Part 40 Cybersecurity/CUI Rule
The re-proposed FAR Part 40 rule ("Revolutionary FAR Overhaul," comment period closed Jul 23, 2026 with 96 comments) would consolidate and standardize cybersecurity and CUI-handling requirements for federal contractors and unclassified information systems; the government's Fall 2026 Unified Agenda now lists an estimated final-rule publication date of April 2027, not end of 2026 as previously tracked. InsideGovernmentContracts
Jan 1, 2027 - NSA CNSA 2.0: National Security Systems procurement gate
New National Security Systems acquisitions must support NSA's post-quantum Commercial National Security Algorithm Suite 2.0 (ML-KEM-1024, ML-DSA-87) by default from this date; the most sensitive categories (firmware/code signing via LMS/XMSS, networking equipment) carry a harder exclusive-use deadline of 2030, running alongside the broader federal High Value Asset migration under EO 14412 below. NSA CNSA 2.0 advisory
Jan 1, 2027 - New York RAISE Act
Frontier-model developers (>$500M revenue, >10^26 FLOPs, >$100M compute) must publish safety frameworks pre-deployment and report safety incidents to NY DFS within 72h: first US state-level AI safety-incident reporting channel. Wiley alert
Jan 1, 2027 - Colorado SB 189 (repeal-and-replace of the Colorado AI Act)
Signed May 14, 2026, SB 189 scraps the original Colorado AI Act (whose June 30, 2026 effective date is now defunct) and replaces it with a narrower ADMT transparency/disclosure framework for automated decision systems. CO SB26-189
Jan 1, 2027 - Illinois SB 315 (AI Safety Measures Act)
Signed by Governor Pritzker Jul 6, 2026: first US law mandating annual independent third-party AI safety audits of frontier developers, plus AI critical-safety-incident reporting and whistleblower protections (audit/transparency reporting phases in Jan 1, 2028). Confirmed the enacted text still carries no security-research or vulnerability-disclosure carve-out. Governor's office
Jan 1, 2027 - Louisiana Data Privacy Act (LDPA)
22nd US comprehensive state privacy law: covered businesses must honor consumer access/correction/deletion rights and run data-protection assessments for higher-risk processing, with a 30-day AG cure period through Jul 31, 2027. WilmerHale
Jan 1, 2027 - Delaware HB 380 (Delaware Personal Data Privacy Act amendment) takes effect
Signed Sep 2, 2026: lowers DPDPA applicability thresholds (35,000 to 10,000 consumers; 10,000 to 5,000 for data-sale-revenue businesses) and adds third-party diligence and sensitive-data-sale restrictions, widening the population of businesses now covered by state comprehensive privacy law. IAPP
Jan 1, 2027 - California CPPA Automated Decision-Making Technology (ADMT) Regulations
Businesses using ADMT to make "significant decisions" about California consumers (employment, housing, credit, insurance, healthcare, education) must provide pre-use notice, an opt-out right, and access/appeal mechanisms from this date. California Privacy Protection Agency
Jan 1, 2027 - Oklahoma Consumer Data Privacy Act (OCDPA) Takes Effect
Oklahoma's first comprehensive consumer privacy law (SB 546, signed Mar 20, 2026) applies in full from day one with no phased rollout, covering businesses processing data on 100,000+ Oklahoma consumers annually (or 25,000+ where data sales exceed 50% of revenue). Hunton Andrews Kurth
Jan 4, 2027 - US Cyber Trust Mark: federal IoT procurement requirement
Under Executive Order 14306, the FAR Council must amend federal acquisition rules so that vendors selling consumer IoT products to the federal government are required to carry US Cyber Trust Mark labeling by this date, excluding unlabeled devices from federal procurement. EO 14306
Mar 19, 2027 - EO 14412: FAR proposed rule on contractor vulnerability disclosure programs
Within 270 days of the Jun 22, 2026 order, the FAR Council must publish a proposed rule amending FAR requirements and contract clauses so covered contractors implement vulnerability disclosure policies consistent with NIST guidelines, with VDPs that incorporate reports of cryptographic vulnerabilities (including a lack of encryption and use of non-FIPS-approved algorithms): a second federal path to contractor VDP mandates alongside the FY27 NDAA provision. EO 14412
Mar 31, 2027 - Australia Scams Prevention Framework: Banking/Telco/Platform Codes Enforceable
The SPF's sector-specific codes for banks, telcos, and digital platforms become mandatory and civil-penalty-backed (up to $50M per contravention) from this date, following the framework's Sep 1, 2026 AFCA-membership commencement. Ashurst
May 1, 2027 - Alabama Personal Data Protection Act takes effect
Signed Apr 16, 2026 (21st comprehensive state privacy law): covered businesses (25,000+ AL consumers, or 25%+ of gross revenue from data sales) must honor consumer access/correction/deletion rights, with AG-exclusive enforcement and a non-sunsetting 45-day cure period. DLA Piper
Jul 1, 2027 - California SB 1119 ("Adam's Law"): AI companion chatbot safety requirements take effect
Signed by Governor Newsom Sep 10, 2026 (Ch. 190, Statutes of 2026): core operative requirements for AI companion chatbots take effect on this date, including crisis-response protocols for self-harm/suicidal ideation, default session limits, persistent-memory/push-notification opt-outs, and prohibited chatbot behaviors toward minors. Recording Law: California SB 1119
Jul 2027 (target) - HHS HIPAA Security Rule update: final rule on Long-Term Actions agenda
HHS's overhaul of the HIPAA Security Rule (mandatory MFA, encryption at rest/in transit, network segmentation, annual pentesting) has moved to HHS's Long-Term Actions regulatory agenda, with July 2027 as its anticipated, non-binding, timeframe for final action. Clark Hill
Dec 11, 2027 - EU CRA: main obligations apply
The core CRA requirements take effect (secure-by-design, CE marking, SBOMs, mandatory vulnerability handling and security updates across the support period); non-compliant connected products cannot be placed on the EU market after this date. EC CRA implementation
Dec 31, 2030 - EO 14412: Federal post-quantum cryptography migration (key establishment)
Under Executive Order 14412 ("Securing the Nation Against Advanced Cryptographic Attacks"), federal High Value Assets must migrate to post-quantum cryptography for key establishment by this date (digital signatures follow by Dec 31, 2031), with a companion procurement rule pulling federal contractors onto the same clock: years of rushed PQC library swaps will generate a fresh class of cryptographic-implementation bugs entering VDP intake. Federal Register
Conferences, CFPs, and Events
Oct 19-22, 2026 - ETSI Security Conference 2026 (20th edition)
ETSI premises, Sophia Antipolis, France; standards-body security conference with Cyber Resilience Act implementation and AI-security content relevant to product-security and disclosure policy; registration is reported closed at capacity. ETSI
Oct 20-23, 2026 - Hack.lu 2026 (20th edition)
Parc Hotel Alvisse, Luxembourg; long-running European community security-research conference co-located with the CTI Summit (CFP closed May 31). On Oct 20, Tim Philipp Schäfers presents "When Responsible Disclosure Becomes a Criminal Investigation", on how a credited report to GovCERT.LU still led to a criminal case against him. Hack.lu · Talk
Oct 21-22, 2026 - FIRST Regional Symposium, Latin America & Caribbean (Mendoza, Argentina)
Free FIRST regional symposium co-located with LACNIC 46/LACNOG 2026, hosted by LACNIC/LACNOG/CERT.br-NIC.br; hybrid with ES-EN interpretation; requires separate LACNIC 46 registration. Event page
Oct 27-29, 2026 - [un]prompted II
San Francisco; the second edition of the AI security practitioner conference; in-person and online tickets on sale. Event site
Oct 28, 2026 - NIST NCCoE webinar: DevSecOps and the Impact of Agentic SI
Free online webinar, 1:00 to 3:00 pm EDT, capped at 500 seats, on the NCCoE DevSecOps project's Build 3 and how agentic AI changes secure software development. NIST
Oct 29, 2026 - BSides Oslo 2026
Vulkan Arena, Oslo, Norway; Nordic community security conference. Event
Oct 30-31, 2026 - BSides NoVA 2026
George Mason University, Arlington, VA; 10th year, red/blue/threat-intel tracks; CFP closed Sep 1. BSides NoVA
Nov 2-6, 2026 - OWASP Global AppSec USA 2026
OWASP's flagship US application-security conference, Hyatt Regency San Francisco; training Nov 2-4, main conference Nov 5-6; CFP already closed. Registration page
Nov 4-5, 2026 - ENISA European Cybersecurity Skills Conference
Larnaca, Cyprus; EU policy on cyber workforce, certification, and disclosure ecosystem, touches NIS2 / CRA implementation. Event page
Nov 5-6, 2026 - Nullcon Berlin 2026
The Westin Grand, Berlin; security-research and vulnerability-discovery conference; registration open. Nullcon Berlin
Nov 5-6, 2026 - FIRST Regional Symposium for Asia Pacific & Joint APCERT AGM (Busan, South Korea)
FIRST's APAC symposium co-run with the APCERT Annual General Meeting at Lotte Hotel Busan; Nov 4 closed APCERT session, Nov 5 open FIRST symposium, Nov 6 training. Event page
Nov 7-9, 2026 - BSides Munich 2026
Hochschule München (workshops Nov 7) and The Westin Grand Munich (main conference Nov 9); 10th edition. Event
Nov 12-13, 2026 - CyberwarCon 2026
Arlington, VA; nation-state threat-landscape conference (cyber espionage, destructive attacks, influence/disinformation operations) that regularly draws policy-side attendees alongside threat-intel researchers. CyberwarCon
Nov 13-14, 2026 - GreHack 2026
Grenoble, France; long-running French community security-research conference; CFP closed Sep 14. GreHack
Nov 15-19, 2026 - 33rd ACM CCS 2026
World Forum, The Hague, NL; top-tier academic security conference co-located with European cyber-policy infrastructure. Conference page
Nov 15-20, 2026 - Objective by the Sea v9.0
Maui, Hawaii; trainings Nov 15-17, talks Nov 18-20; premier Apple/macOS-security conference (Objective-See Foundation). Objective by the Sea
Nov 16-20, 2026 - Hardwear.io Netherlands 2026
Amsterdam Marriott Hotel; three days training plus two days conference plus HardPwn CTF: hardware and embedded security community hub for Europe. Event
Nov 17, 2026 - IEEE S&P 2027 Cycle 2 paper deadline
48th IEEE Symposium on Security & Privacy (Montreal, May 2027); abstracts due Nov 10, papers Nov 17: top-tier venue for VDP/exploitation/policy research. CFP
Nov 17-18, 2026 - CODE BLUE 2026
Bellesalle Takadanobaba, Tokyo; Japan's flagship international security conference: APAC voice in vulnerability research / disclosure norms. Conference page
Nov 17-18, 2026 - Billington Critical Infrastructure CyberSecurity Summit (inaugural)
Henry B. Gonzalez Convention Center, San Antonio, TX; new Billington property unifying energy, communications, transportation, and water-sector cyber policy, targeting CISA, FBI, and state/local cyber leaders; complimentary registration for verified .gov/.mil/.us attendees. Event page
Nov 18, 2026 - Aspen Cyber Summit
Capital Turnaround, Washington DC; US public-private cyber-policy convening with senior CISA / DOJ / Hill engagement. Event page
Nov 19-20, 2026 - DefCamp 2026
Bucharest, Romania; 16th edition of CEE's largest security conference: 2,000+ experts from 50+ countries. Event
Nov 20, 2026 - IEEE EuroS&P 2027 paper submission deadline
Call for papers for the next European Symposium on Security and Privacy, to be held in Lisbon, Portugal (conference dates not yet published). Call for Papers
Nov 30, 2026 - PETS 2027 / PoPETs Issue 3 submission deadline
Quarterly journal-style submission deadline for Proceedings on Privacy Enhancing Technologies, feeding the Privacy Enhancing Technologies Symposium (conference itself Jul 19-24, 2027, Delft, NL): top academic venue for privacy-research with recurring legal/policy content adjacent to disclosure practice. PETS CFP
Dec 1-3, 2026 - Black Hat MEA 2026
Riyadh Exhibition and Convention Centre, Malham, Saudi Arabia; Black Hat's Middle East and Africa edition, relevant to Gulf-region cyber-policy and disclosure norms. Black Hat MEA
Dec 7-10, 2026 - Black Hat Europe 2026
ExCeL London; EU industry policy + technical track converge here: closest European peer to Black Hat USA for the disclosure community. Event page
Dec 7-11, 2026 - ACSAC 2026 (42nd Annual Computer Security Applications Conference)
Los Angeles, California; peer-reviewed papers, talks, panels, and workshops. Event page
Dec 12, 2026 - BSides London 2026
Novotel London West; long-running UK community con with a strong rookie-track pipeline into the research community. BSides London
Dec 14-18, 2026 - Internet Governance Forum (IGF) 2026
21st annual IGF meeting, hybrid format, Nairobi, Kenya; theme "Governing the Internet in the Age of Intelligence." Event page
Dec 27-30, 2026 - 40C3 Chaos Communication Congress
Hamburg Messe, Hamburg; anchor European hacker congress: longstanding free-software, civil-liberties, and disclosure-ethics venue. Event page
Jan 6, 2027 - CyCon 2027 "Unified Response" full-paper submission due
Second stage of NATO CCDCOE's call for the 19th International Conference on Cyber Conflict (Tallinn, May 25-28, 2027), following the Sep 23 abstract deadline. Submit
Jan 26, 2027 - USENIX Security '27 Cycle 2 paper deadline
36th USENIX Security Symposium (Aug 11-13, 2027, Denver); top-tier academic venue for vulnerability and disclosure research. USENIX CFP
Feb 8-11, 2027 - S4x27
Tampa, Florida; flagship ICS/OT security conference with a heavy policy/government track (CISA and other officials regularly speak); CFP window already closed, ticket sales open. S4 Events
Feb 12-14, 2027 - Munich Security Conference 2027
Bayerischer Hof, Munich; major international security/foreign-policy summit with a significant cyber-policy track, comparable in kind to the Aspen Cyber Summit already on this list. Event page
Mar 2-4, 2027 - FIRST Technical Colloquium (Amsterdam, Netherlands)
Free in-person FIRST TC hosted by Human Security at MEERVAART; one training day plus two days of talks focused on AI in attack and defense; CFP active, registration open (fills quickly). FIRST TC Amsterdam
Mar 9-11, 2027 - INCYBER Forum Europe 2027
Major European government-industry cybersecurity forum, Lille Grand Palais, France, held under French presidential patronage. Event page
Mar 17-19, 2027 - Billington State and Local CyberSecurity Summit (4th Annual)
National Harbor, MD (Gaylord National Resort); government cybersecurity summit convening federal, state, local, and tribal officials with industry; sibling event to the flagship Billington CyberSecurity Summit and the new Billington Critical Infrastructure Summit above. Event page
Mar 22-26, 2027 - NDSS Symposium 2027
Seoul, Republic of Korea; top-tier network and distributed-system security symposium with co-located workshops. NDSS 2027
Mar 30-Apr 2, 2027 - CVE/FIRST VulnCon 2027 & Annual CNA Summit
Scottsdale, Arizona; annual vulnerability coordination conference co-hosted by CVE Program and FIRST: directly relevant to the CVE ecosystem, CNA coordination, and vulnerability disclosure practitioners; speaker CFS not yet open (expect late 2026); Program Committee volunteer interest due Oct 6, 2026. FIRST
Apr 21-23, 2027 - FIRST Cyber Threat Intelligence Conference 2027
Mercure Hotel MOA, Berlin; FIRST's threat-intelligence conference, with the call for speakers and workshops listed as opening in September 2026. FIRST CTI 2027
May 11-13, 2027 - CYBERUK 2027
Liverpool Experience Campus; the UK NCSC's flagship government-and-industry cyber security event. CYBERUK
May 14-16, 2027 - CackalackyCon 2027
DoubleTree RTP, Durham, NC; southeastern US community hacker conference, dates confirmed by the organizers. CackalackyCon
Jun 13-18, 2027 - FIRST Annual Conference 2027
Bangkok, Thailand; FIRST's global annual conference for incident response and security teams: premier CERT/CSIRT coordination venue; CFP not yet open. FIRST
TBD - Pall Mall Process: next conference not yet announced
No date for a next plenary has been published on GOV.UK; prior conferences were London (Feb 2024) and Paris (Apr 2025), where the Code of Practice for States was agreed, now listing 27 supporting states including the US and UK. A "Nov 10-11, Paris" date circulating in secondary coverage remains uncorroborated on any official source; treat as TBD. Pall Mall Declaration
International Developments
Oct 30, 2026 - ENISA NIS360 (2027 edition) survey response deadline
National authorities and NIS2 high-criticality entities have until this date to respond to ENISA's next sector maturity/criticality assessment survey, shaping the evidence base behind future NIS2 sector-criticality decisions. ENISA
Nov 9-27, 2026 - ITU Plenipotentiary Conference 2026 (PP-26)
Doha, Qatar; ITU's quadrennial top governance conference attended by all 194 member states: sets the Union's strategic plan, elects leadership, and will address AI security, cybersecurity mandates, and emerging technology governance. ITU PP-26
Nov 13, 2026 - India DPDP Rules: Consent Manager Framework Becomes Operational
Phase 2 of India's Digital Personal Data Protection Rules 2025 (notified November 13, 2025) activates: consent-manager registration and operation under the DPDPA becomes functional; core data fiduciary compliance (Phase 3) follows May 13, 2027; relevant for security researchers handling Indian personal data. IAPP
Dec 2, 2026 - Australia: PJCIS Statutory Review of SOCI Act Must Commence
The Parliamentary Joint Committee on Intelligence and Security must begin its statutory review of the Security of Critical Infrastructure Act no later than this date: will assess the effectiveness of Australia's critical infrastructure regime including cyber incident obligations. Ashurst
Dec 7-11, 2026 - UN Global Mechanism on ICT Security: Dedicated Thematic Groups
New York; first working-level meetings of the permanent UN cyber mechanism's Dedicated Thematic Groups: where the technical detail behind state-level cyber-norm and vulnerability-equities discussions is worked out. Process tracker
Dec 11, 2026 - EU CRA: target for sufficient notified bodies
Member States are to ensure enough notified bodies exist to perform CRA conformity assessments, avoiding market-entry bottlenecks ahead of the main obligations; zero notified bodies had been designated in NANDO as of late September 2026, putting this target at real risk. EC CRA implementation
Dec 31, 2026 - UN Cybercrime Convention (Hanoi) closes for signature
The Convention remains open for signature at UN Headquarters in New York through this date; as of late Sep 2026 it has 91 signatories (India and Indonesia joined that week) but still only 3 ratifications of the 40 required for entry into force (Qatar, Azerbaijan, Viet Nam). Articles 6-10 risk criminalizing unauthorized-access research without sufficient safeguards, and slow ratification keeps the advocacy window open. UN Office of Legal Affairs
Oct 26, 2026 - UK Cyber Security and Resilience Bill: Lords Report Stage
Lords Committee Stage concluded Sep 7, 2026 with only 5 of 193 tabled amendments agreed (all government); Report Stage - the main remaining opportunity for substantive amendment votes, covering vendor-restriction "direction powers" over risky technology suppliers and delegated-powers scope - is now dated for Oct 26, 2026, with Royal Assent expected late 2026 into spring 2027 and phased implementation via secondary legislation running through 2028. The incident-reporting duty was broadened in Committee so regulated entities must assess whether any data relating to the service was compromised, not just user data, which widens the reporting trigger relevant to coordinated vulnerability disclosure and pentest findings. A standalone Computer Misuse Act statutory-defence reform is confirmed NOT part of this bill - see the entry below. Tabled for Report: a Baroness Harding of Winscombe clause requiring frontier AI developers to notify affected regulated entities within 24 hours when a model gains unauthorised access to their systems, and a Lord Clement-Jones clause requiring a review (not enactment) of a Computer Misuse Act defence for good-faith security researchers. UK Parliament Bill Tracker · Harding amendment · Clement-Jones amendment
Jun 10, 2027 - Australia SOCI: Enhanced CIRMP first grace period ends
The Enhanced CIRMP Rules (LIN 26/075, commenced Jun 10, 2026) give responsible entities in the covered high-risk asset classes 12 months, to Jun 10, 2027, to meet the uplifted s 6A, s 8A(2), and s 9A(2) obligations - including FOCI (foreign ownership/control/influence) assessments, offshore access controls, and core cyber-security risk management - and 24 months, to Jun 10, 2028, for the remaining requirements: longer than the grace periods in the exposure draft. Corrs analysis
Budapest Convention Protocol II - Still Stuck at 4 of 5 Ratifications
Full ratifier list is Serbia, Japan, Hungary (Feb 2026), and Costa Rica (15 Apr 2026); no fifth ratification has landed in the six months since, so the Protocol's expedited e-evidence and direct service-provider cooperation tools stay dormant - a single additional ratification would trigger entry into force. Council of Europe
H2 2026 - UK CMA Statutory Defence: Promised Bill Already Passed Without It
The National Security (State Threats) Act 2026 received Royal Assent in July with no Computer Misuse Act provisions; on Sep 7, 2026 the Lords saw a renewed statutory-defence review amendment (Lord Clement-Jones, to the Cyber Security and Resilience Bill) rejected/withdrawn after the minister called reform "a priority" to come "as soon as parliamentary time allows" - no bill or date now named. Computer Weekly
H2 2026 - Australia SOCI: Ministerial Directions Powers Still in Consultation
Consultation on the proposed reforms (new conditions power, vendor-risk directions power, penalties up to $3.3M) closed May 1, 2026 with no bill yet introduced to Parliament as of October 2026 - a separate track from the enhanced CIRMP Rules, which already commenced Jun 10, 2026. Department of Home Affairs
Jul 8, 2026 (referred) - NIS2: Ireland, Spain, France and Netherlands Already at the CJEU
The Commission referred all four states to the Court of Justice on Jul 8, 2026 (cases INFR(2024)0279/0270/0274/0288) seeking lump-sum and daily penalties for failing to transpose NIS2; the Netherlands leg resolved when its Cyberbeveiligingswet entered into force Aug 15, 2026. Spain expects transposition in late 2026; France and Ireland have given no firm date. European Commission
Nov 2026 (expected) - Pall Mall Process industry guidelines finalization
Following the 2025 Code of Practice for States, the UK/France-led process negotiated Industry Guidelines for Commercial Cyber Intrusion Capabilities from August through October 2026, with finalization expected in November; a 30-plus-organization joint civil-society submission on the draft guidelines was published Sep 17, 2026. Amnesty International Security Lab
Jun 15, 2026 (enacted) - Canada's CCSPA: Law Since June, Still Zero Designated Operators
Bill C-8 received Royal Assent Jun 15, 2026 (Statutes of Canada 2026, c.9) and is now law; the Telecommunications Act security amendments took effect immediately. As of September 2026 Schedule 2 (designated-operator classes) under the Critical Cyber Systems Protection Act remains empty and Part 2 awaits a Governor-in-Council commencement order, so no organization yet carries CCSPA obligations; designated operators will get 90 days from designation to stand up cybersecurity programs once designations are made. Digital Policy Alert
Pending / TBD (2026)
H2 2026 (interim patch to Dec 11, 2026) - CISA 2015 Ten-Year Reauthorization (WIMWIG Act): Still Stalled in Senate
The WIMWIG Act's 10-year CISA 2015 reauthorization (through 2036), folded into the House-passed FY27 NDAA (H.R. 8800, Jul 22, 2026), remains blocked: the Senate companion S. 4784 has not advanced past its Jul 14, 2026 failed cloture vote (50-46), with no further floor action recorded since the Senate's Sep 14 return from recess. A Sep 2, 2026 continuing resolution (H.R. 6500) separately patched the near-term sunset through Dec 11, 2026 (see Regulations Coming Into Effect), but the durable 10-year fix is still stuck behind Sen. Rand Paul's objection over unrelated disinformation-related conditions. Federal News Network
H2 2026 - H.R. 872 / S. 1899 (Federal Contractor Cybersecurity Vulnerability Reduction Act)
H.R. 872 passed the House (Mar 2025) and is with the Senate (companion S. 1899, no committee action yet); would mandate FAR-level VDPs (NIST / ISO 29147 & 30111) for federal contractors, likely to ride the FY27 NDAA, which now carries closely related language of its own (see above); single largest VDP expansion since BOD 20-01. H.R. 872
H2 2026 - FY27 NDAA (H.R. 8800): Title XV cyber provisions
The House passed H.R. 8800 on Jul 22, 2026 (216-212), carrying the WIMWIG Act's 10-year CISA 2015 reauthorization (through 2036, the long-term fix now that the near-term Sep 30 sunset was separately averted via a Dec 11 stopgap CR) plus Rep. Nancy Mace's Federal Contractor Cybersecurity Vulnerability Reduction Act provision mandating VDPs for civilian and defense contractors alike. The Senate companion (S. 4784) has failed cloture on the motion to proceed twice, most recently 50-46 on Jul 14, 2026, and no further procedural steps have been recorded since the Senate's Sep 14 return from recess amid an unrelated Iran-war-powers and topline-spending dispute: no conference yet, no floor date set. The Record
H2 2026 - FRONTIER Act (H.R. 9925, Obernolte-Trahan): committee action
The formal bill from the "Great American AI Act" discussion draft, introduced Jul 23, 2026 with bipartisan co-sponsors: transparency reports, risk-management frameworks, critical-safety-incident reporting, and mandatory third-party independent evaluation of frontier models (the AI analogue of VDP infrastructure), plus contested state-preemption language; still sits at committee referral (Energy & Commerce plus Science, Space & Technology) with no markup scheduled. Sponsor release
H2 2026 - H.R. 10671 (Gottheimer): CISA Vulnerability Warning Program Reauthorization
Introduced Oct 1, 2026 by Rep. Josh Gottheimer with Reps. Bacon, Nunn, Scholten, and Landsman to amend the Cyber Incident Reporting for Critical Infrastructure Act of 2022 and reauthorize CISA's program issuing pre-ransomware and vulnerability warnings to critical-infrastructure entities; referred to House Homeland Security the same day, no hearing scheduled yet. GovInfo bill status
TBD - S. 5061 Secure A.I. Development Act of 2026 (Sen. Warner): referred to Senate Commerce
Introduced Jul 21, 2026 and referred to the Committee on Commerce, Science, and Transportation, with no hearing or markup found as of Oct 4, 2026; among other provisions it would direct NIST to develop a strategic plan for reforming the National Vulnerability Database in light of the surge in vulnerabilities identified by AI systems. Bill text
2026 - Michigan HB 4668: state frontier-AI "critical risk" bill without a security-research carve-out
Defines "critical risk" with a catastrophic-scale numeric threshold (death of or serious injury to more than 100 people, or more than $1B in property damage) from a foundation model's development, storage, or deployment, with no exclusion for authorized or good-faith security research, and remains stalled in House Communications and Technology committee (last action Mar 19, 2026). Illinois SB 315, which raised the same concern, has since been enacted with a concrete Jan 1, 2027 effective date (see Regulations Coming Into Effect above) and is tracked there instead. No reviewed state frontier-AI bill contains an express safe harbor for independent AI-enabled good-faith research. Michigan HB 4668
H2 2026 - Australia Privacy Act Tranche 2: Exposure Draft Consultation Closed, Bill Not Yet Introduced
The Attorney-General's Department released the exposure draft Privacy Amendment (Personal Data Protection) Bill 2026 on Aug 31, 2026; public submissions closed Sep 18, 2026, and as of Oct 4, 2026 the Bill has not been formally introduced to Parliament, though government has signaled intent to introduce before year-end. Key provisions: 72-hour OAIC breach notification, a right-to-erasure for large platforms, and expanded "sensitive information" categories (genomic, biometric, precise geolocation) - all bearing on organisations that receive and process researcher reports. AGD consultation
H2 2026 - California SB 53: Transparency in Frontier AI Act enforcement build-out
In force from Jan 1, 2026; first annual transparency reports due 2026; Cal OES critical-incident-reporting infrastructure stands up across H2, with the first anonymized annual summary of reported frontier-AI "critical safety incidents" (15-day / 24-hour reporting windows) due Jan 1, 2027: creates a researcher/employee disclosure channel distinct from CFAA. CA SB 53
2026 - EU AI Act Annex III High-Risk Systems: compliance deferred to Dec 2, 2027
The Digital Omnibus is now law (Regulation (EU) 2026/1744, published in the Official Journal Jul 24, 2026, in force Jul 27): compliance for standalone Annex III high-risk AI systems (recruitment, credit scoring, law enforcement, education, border control) moves from the original Aug 2, 2026 statutory date to Dec 2, 2027; Annex I embedded high-risk systems move further to Aug 2, 2028; Article 50 transparency obligations were NOT deferred. Gibson Dunn
This page is maintained by disclose.io as a community resource. Have a date we should add? Reply to any Policy Pulse issue or reach out on Twitter/X.