Upcoming Dates

A continually updated reference for the vulnerability disclosure and security research community. Dates are organized by category and updated weekly alongside Policy Pulse.

Last updated: August 16, 2026

Never miss a date:

📅 Subscribe in your calendar app — an auto-updating feed of every dated entry below (also available as a direct .ics link).

✉️ Prefer email? Subscribe to Upcoming Dates Weekly for a weekly digest of this page — opt-in, separate from the main blog.

---

Policy Comment Deadlines

Aug 24, 2026 — NIST SP 800-213 Rev. 1: IoT Product Cybersecurity Guidelines — comment period closes
Draft federal guidance reframing IoT security requirements from "devices" to "products" — relevant to IoT security researchers and VDP programs at vendors selling into the U.S. government. NIST CSRC

Aug 28, 2026 — Latvia: National Cyber Security Law researcher safe-harbor amendment — public consultation closes
Latvia's Ministry of Defence is consulting on amendments (draft 26-TA-1830) giving security researchers an express statutory permission to probe regulated entities' systems; the operative text conditions protection on system outcomes rather than researcher intent, and the Ministry has explicitly invited researcher comment. TAP portal

Sep 8, 2026 — NIST SP 800-209 Rev. 1: Security Guidelines for Storage Infrastructure — comment period closes
Initial public draft (released Jul 22, 2026) of baseline security recommendations for storage systems and software-defined storage — same product-security family as the SP 800-213/800-219 drafts. NIST CSRC

Sep 13, 2026 — ENISA: draft EU Managed Security Services (EUMSS) certification scheme consultation closes
First EU-wide certification scheme under the Cybersecurity Act for managed security services — incident response, security testing, and audits — shaping how security-research and testing providers get certified across the EU; launched Jul 24, 2026. ENISA

Sep 25, 2026 — NIST SP 800-239 (Initial Public Draft): AI Data Center Security Analysis
Draft guidance analyzing security gaps between AI data center infrastructure and traditional HPC environments — relevant given the growing volume of AI-infrastructure vulnerability disclosures. NIST CSRC

Sep 25, 2026 — FCC Second FNPRM: Submarine Cable Landing License cybersecurity rules
Seeks comment on further cybersecurity requirements for submarine cable infrastructure, including cyber/physical risk-management plans and foreign-adversary equipment reporting — critical-infrastructure security regulation with disclosure-adjacent reporting duties. Federal Register

Oct 13, 2026 — NIST RFI: Modernizing the National Vulnerability Database (NVD) in the Age of AI
NIST is soliciting stakeholder input (regulations.gov docket NIST-2026-0100) on priorities and challenges for modernizing the NVD as CVE enrichment and machine-consumable vulnerability data increasingly involve AI — directly touches the CVE-enrichment and backlog concerns the VDP community deals with daily. Federal Register

Dec 16, 2026 — UK DSIT Software Security Code of Practice: Evaluation Survey
Six-month call for evidence on the UK's voluntary Software Security Code (vulnerability disclosure + reporting expectations on software vendors). gov.uk consultation

---

Right to Repair

Right to repair and good-faith security research share the same legal battleground: the DMCA §1201 anti-circumvention regime and the fight over firmware locks, parts-pairing, and access to diagnostic tools. Wins for repairers routinely widen the space for researchers, and vice versa.

Aug 24, 2026 — DMCA §1201 Tenth Triennial Rulemaking: exemption petition deadline
Deadline to petition the Copyright Office for new or renewed circumvention exemptions — covers BOTH the diagnosis/maintenance/repair classes and the good-faith security-research exemption (same proceeding), for the 2027–2030 term. Federal Register notice

Sep 1, 2026 — Texas HB 2963 consumer-electronics Right to Repair takes effect
Texas's law requiring manufacturers to provide parts, tools, and documentation for electronics over $50 goes live — expanding the patchwork that legitimizes independent repair of firmware-bearing devices. H2 Compliance

Sep 28, 2026 — DMCA §1201 Tenth Triennial: comments on renewal petitions due
Written comments responding to renewal petitions (including the repair and security-research exemption classes) are due in the Copyright Office's tenth anti-circumvention rulemaking. Copyright Office NewsNet 1088

Dec 31, 2026 — John Deere $99M settlement: offline diagnostic/repair-tool deadline
By this date Deere must let owners and independent repairers run reprogramming and diagnostics in offline mode and access the same tooling as its Dealer Technical Assistance Center — a concrete embedded-firmware access milestone from the April 2026 right-to-repair settlement. The Register

Jul 1, 2027 — Oregon SB 1596 Right to Repair (parts-pairing ban) enforcement begins
Oregon's first-in-the-nation ban on "parts pairing" (software serialization that blocks replacement components) took effect Jan 1, 2025; Attorney General civil enforcement (up to $1,000/day per violation) begins on this date — directly constraining the firmware-level lockouts researchers and repairers otherwise have to circumvent. H2 Compliance

---

Regulations Coming Into Effect

Sep 11, 2026 — EU CRA Article 14: Vulnerability reporting obligations enter into application
Manufacturers of products with digital elements must report actively-exploited vulnerabilities (24h early warning, 72h notification, 14-day final report) via the ENISA Single Reporting Platform — the first global mandatory exploited-vuln reporting clock; ENISA says the SRP will be operational by this date but launching as manual web forms (no API), after registration/training dry-runs through June. EU CRA reporting

Sep 30, 2026 — Cybersecurity Information Sharing Act of 2015 (CISA 2015) sunset
Liability protections and antitrust safe harbor for cyber threat-indicator sharing expire absent action — the House passed a 10-year reauthorization (through 2036) inside its FY27 NDAA on Jul 22, 2026 (216-212), but the Senate NDAA has no matching provision, so the fix must survive a Senate floor amendment or conference before the deadline. The Record

Oct 1, 2026 — Connecticut SB 5 (AI Transparency, Safety, and Consumer Protection Act)
Bans on AI-enabled discrimination, deepfakes, biometric scraping; mandatory provenance metadata on GPAI outputs >1M MAU — another formal pathway for AI-generated-content authenticity and discriminatory-AI bug reports. CT SB 5

Oct 3-4, 2026 — Australia telecommunications cyber-maturity Level 1 (TSRMP Rules)
Carriers and relevant carriage service providers must reach cyber-maturity indicator Level 1 (Essential Eight, C2M2, or AESCSF Core) under the Telecommunications Security and Risk Management Program (Level 2 for carriers follows Oct 3, 2027). Allens analysis

Oct 31, 2026 — EU CRA harmonised-standards drafting deadlines (pushed back two months)
The Commission's revised Standardisation Request M/606 sets CEN/CENELEC/ETSI's deadline for Type A/B (vulnerability-handling and reporting) harmonised standards, which carry the "presumption of conformity" manufacturers need ahead of the Dec 2027 main-obligations date; Type C (product-category) standards follow Dec 31, 2026. cyberresilienceact.eu

Nov 10, 2026 — CMMC 2.0 Phase 2: Mandatory Third-Party Certification
DoD contractors handling Controlled Unclassified Information must hold Level 2 CMMC certification from an accredited C3PAO as a condition of contract award — self-attestation is no longer sufficient; approximately 80,000 contractors affected, reshaping how the DIB approaches VDP and vulnerability management. DoD CMMC

Dec 2, 2026 — EU AI Act: Article 50(2) Watermarking Grace Period Closes
Systems placed on the market before August 2, 2026 that generate synthetic audio, image, video, or text content must comply with Article 50(2) watermarking/provenance-marking requirements by this date — the final grace provision from the Digital Omnibus. EU AI Act timeline

Dec 7, 2026 — CISA BOD 26-04: risk-based remediation (Phase III)
Under the new SSVC risk-tiered model, FCEB agencies must remediate vulnerabilities per the directive's risk table; non-CDM agencies report status every 7 days — the operational replacement for the old fixed KEV remediation timelines. CISA BOD 26-04

Dec 9, 2026 — EU Product Liability Directive: Applies to Digital Products
The revised EU PLD (2024/2853) applies to products placed on the market after this date — for the first time, standalone software and digital elements are explicitly "products," and failure to provide security updates can constitute a defect, directly raising the legal stakes of slow patch cycles and inadequate disclosure handling. EU Official Journal

Dec 10, 2026 — Australia Privacy Act: Automated Decision-Making Transparency
New APP 1 obligations from the Privacy and Other Legislation Amendment Act 2024 take effect: Australian entities must disclose in privacy policies how personal information is used in automated decisions that could significantly affect individuals' rights — a transparency requirement touching AI systems that process personal data during security assessments. OAIC intends to release ADM Transparency guidance by September 2026, ahead of this date. OAIC guidance

Dec 24, 2026 — EU eIDAS 2.0: Digital Identity Wallets Deployment Deadline
All 27 EU member states must make at least one certified European Digital Identity Wallet available to citizens and businesses — 24 months after implementing acts entered into force Dec 4, 2024; voluntary and free, creating new authentication infrastructure with identity-verification implications for cross-border security research. eIDAS 2.0 timeline

Sep 2026 (target) — CIRCIA Final Rule publication — DELAYED, rulemaking reopened
CISA missed its statutory deadline and reopened the rulemaking: a May 26, 2026 Federal Register notice scheduled town-hall meetings (held Jun 15-18, 2026, drawing 1,200+ stakeholders) to narrow the scope and burden of the April 2024 NPRM before finalizing; CISA's Unified Agenda now targets September 2026, though no final-rule publication date is formally announced and the 18-month effective-date clock will begin on eventual publication. Federal News Network

Sep 2026 (target) — FAR cybersecurity rules for federal contractors
Two Federal Acquisition Regulation rules are slated for finalization: one standardizing cybersecurity requirements for unclassified federal information systems, one mandating cyber-threat and incident reporting/information sharing by contractors — contractor-side reporting duties parallel to CIRCIA. Federal News Network

Jan 1, 2027 — New York RAISE Act
Frontier-model developers (>$500M revenue, >10^26 FLOPs, >$100M compute) must publish safety frameworks pre-deployment and report safety incidents to NY DFS within 72h — first US state-level AI safety-incident reporting channel. Wiley alert

Jan 1, 2027 — Colorado SB 189 (repeal-and-replace of the Colorado AI Act)
Signed May 14, 2026, SB 189 scraps the original Colorado AI Act (whose June 30, 2026 effective date is now defunct) and replaces it with a narrower ADMT transparency/disclosure framework for automated decision systems. CO SB26-189

Jan 1, 2027 — Illinois SB 315 (AI Safety Measures Act)
Signed by Governor Pritzker Jul 6, 2026 — first US law mandating annual independent third-party AI safety audits of frontier developers, plus AI critical-safety-incident reporting and whistleblower protections (audit/transparency reporting phases in Jan 1, 2028). Governor's office

Jan 1, 2027 — Louisiana Data Privacy Act (LDPA)
22nd US comprehensive state privacy law: covered businesses must honor consumer access/correction/deletion rights and run data-protection assessments for higher-risk processing, with a 30-day AG cure period through Jul 31, 2027. WilmerHale

Dec 11, 2027 — EU CRA: main obligations apply
The core CRA requirements take effect — secure-by-design, CE marking, SBOMs, mandatory vulnerability handling and security updates across the support period; non-compliant connected products cannot be placed on the EU market after this date. EC CRA implementation

Dec 31, 2030 — EO 14412: Federal post-quantum cryptography migration (key establishment)
Under Executive Order 14412 ("Securing the Nation Against Advanced Cryptographic Attacks"), federal High Value Assets must migrate to post-quantum cryptography for key establishment by this date (digital signatures follow by Dec 31, 2031), with a companion procurement rule pulling federal contractors onto the same clock — years of rushed PQC library swaps will generate a fresh class of cryptographic-implementation bugs entering VDP intake. Federal Register

---

Conferences, CFPs, and Events

Aug 19, 2026 — NDSS 2027 Fall Cycle CFP closes
Event March 22-26 2027, Seoul; top-tier network and system security venue for VDP-adjacent research. CFP

Aug 25, 2026 — USENIX Security '27 Cycle 1 paper submission deadline
Event Aug 11-13 2027, Denver (abstract registration Aug 18) — primary academic venue for vulnerability research and disclosure case studies. Conference page

Aug 30, 2026 — DefCamp 2026 CFP Wave 2 closes
16th edition of CEE's largest security conference, Nov 19-20 in Bucharest; Wave 3 (final) closes Oct 15; topics include AI threats, supply chain, and threat modeling. Submit

Aug 31, 2026 — Council of Europe Octopus Conference 2026 registration closes
Registration deadline for the Octopus Conference on cybercrime cooperation (event Oct 14-16, Strasbourg) — key Budapest Convention community venue. Register

Sep 8-10, 2026 — Billington CyberSecurity Summit 2026
17th annual flagship US government-cybersecurity-leader gathering, Walter E. Washington Convention Center, Washington DC; complimentary registration for government/military attendees — key venue for federal cyber-policy convening. Register

Sep 10, 2026 — BSides Belfast 2026
Eighth Northern Ireland BSides event, 600-700 expected attendees across 2+ tracks; CFP already closed but general tickets released Jul 14. Tickets/Info

Sep 15, 2026 — RSAC 2027 Call for Submissions opens
San Francisco event Apr 5-8, 2027 (Moscone Center); submissions open on this date per RSAC's own conference site. Submissions page

Sep 16-19, 2026 — LABScon 2026
Omni Scottsdale Resort, Scottsdale, AZ; invite-heavy threat-research event convening the top end of the vulnerability and threat-intel research community (CFP closed Jun 19). LABScon

Sep 17, 2026 — BSides St. John's 2026
Holiday Inn Conference Centre, St. John's, Newfoundland and Labrador, Canada; CFP still open on the event site (no separate CFP deadline published — check site directly). Event info / CFP

Sep 23, 2026 — CyCon 2027 "Unified Response" Call for Papers closes
NATO CCDCOE's 19th International Conference on Cyber Conflict (event May 25-28, 2027, Tallinn, Estonia); explicitly invites technical, legal, strategic, and policy-angle papers on cyber conflict and critical infrastructure. Submit

Sep 30, 2026 — BSides London 2026 CFP closes
All calls (presentations, rookie talks, workshops) close 23:59; conference Dec 12, 2026 at Novotel London West. BSides London

Oct 7-9, 2026 — Wild West Hackin' Fest Deadwood 2026
Deadwood, South Dakota, 15th edition; pre-con training Oct 6-7 — community security conference with strong offensive and defensive research content. WWHF

Oct 9-10, 2026 — c0c0n 2026
Grand Hyatt Kochi, Kerala, India; 19th year — strong APAC voice in vulnerability research and disclosure practice; registration open through Sep 30 (talk CFP closed May 10). Register

Oct 14-16, 2026 — AISA CyberCon Melbourne
Melbourne Convention & Exhibition Centre; Australia's largest cybersecurity conference — principal policy + practitioner stage for ANZ. Register

Oct 14-16, 2026 — Council of Europe Octopus Conference 2026
Council of Europe headquarters, Strasbourg; global cybercrime-cooperation conference anchoring the Budapest Convention community — directly relevant to international computer crime law and security research protections. Event page

Oct 15, 2026 — DefCamp 2026 CFP Wave 3 closes (final)
Final submission wave for DefCamp 2026, Nov 19-20 Bucharest. Submit

Oct 20-23, 2026 — Hack.lu 2026 (20th edition)
Parc Hotel Alvisse, Luxembourg; long-running European community security-research conference co-located with the CTI Summit (CFP closed May 31). Hack.lu

Oct 29, 2026 — BSides Oslo 2026
Vulkan Arena, Oslo, Norway; Nordic community security conference. Event

Nov 4-5, 2026 — ENISA European Cybersecurity Skills Conference
Larnaca, Cyprus; EU policy on cyber workforce, certification, and disclosure ecosystem — touches NIS2 / CRA implementation. Event page

Nov 7-9, 2026 — BSides Munich 2026
Hochschule München (workshops Nov 7) and The Westin Grand Munich (main conference Nov 9); 10th edition. Event

Nov 12-13, 2026 — CyberwarCon 2026
Arlington, VA; nation-state threat-landscape conference (cyber espionage, destructive attacks, influence/disinformation operations) that regularly draws policy-side attendees alongside threat-intel researchers. CyberwarCon

Nov 15-19, 2026 — 33rd ACM CCS 2026
World Forum, The Hague, NL; top-tier academic security conference co-located with European cyber-policy infrastructure. Conference page

Nov 16-20, 2026 — Hardwear.io Netherlands 2026
Amsterdam Marriott Hotel; three days training plus two days conference plus HardPwn CTF — hardware and embedded security community hub for Europe. Event

Nov 17, 2026 — IEEE S&P 2027 Cycle 2 paper deadline
48th IEEE Symposium on Security & Privacy (Montreal, May 2027); abstracts due Nov 10, papers Nov 17 — top-tier venue for VDP/exploitation/policy research. CFP

Nov 17-18, 2026 — CODE BLUE 2026
Bellesalle Takadanobaba, Tokyo; Japan's flagship international security conference — APAC voice in vulnerability research / disclosure norms. Conference page

Nov 18, 2026 — Aspen Cyber Summit
Capital Turnaround, Washington DC; US public-private cyber-policy convening with senior CISA / DOJ / Hill engagement. Event page

Nov 19-20, 2026 — DefCamp 2026
Bucharest, Romania; 16th edition of CEE's largest security conference — 2,000+ experts from 50+ countries. Event

Dec 7-10, 2026 — Black Hat Europe 2026
ExCeL London; EU industry policy + technical track converge here — closest European peer to Black Hat USA for the disclosure community. Event page

Dec 12, 2026 — BSides London 2026
Novotel London West; long-running UK community con with a strong rookie-track pipeline into the research community. BSides London

Dec 27-30, 2026 — 40C3 Chaos Communication Congress
Hamburg Messe, Hamburg; anchor European hacker congress — longstanding free-software, civil-liberties, and disclosure-ethics venue. Event page

Feb 12-14, 2027 — Munich Security Conference 2027
Bayerischer Hof, Munich; major international security/foreign-policy summit with a significant cyber-policy track — comparable in kind to the Aspen Cyber Summit already on this list. Event page

Mar 30-Apr 2, 2027 — CVE/FIRST VulnCon 2027 & Annual CNA Summit
Scottsdale, Arizona; annual vulnerability coordination conference co-hosted by CVE Program and FIRST — directly relevant to the CVE ecosystem, CNA coordination, and vulnerability disclosure practitioners; CFS not yet open (expect late 2026). FIRST

May 14-16, 2027 — CackalackyCon 2027
DoubleTree RTP, Durham, NC; southeastern US community hacker conference, dates confirmed by the organizers. CackalackyCon

Jun 13-18, 2027 — FIRST Annual Conference 2027
Bangkok, Thailand; FIRST's global annual conference for incident response and security teams — premier CERT/CSIRT coordination venue; CFP not yet open. FIRST

TBD — Pall Mall Process: next conference not yet announced
No date for a next plenary has been published on GOV.UK; prior conferences were London (Feb 2024) and Paris (Apr 2025), where the Code of Practice for States was agreed — now listing 27 supporting states including the US and UK. A "Nov 10-11, Paris" date circulating in secondary coverage remains uncorroborated on any official source; treat as TBD. Pall Mall Declaration

---

International Developments

Aug 18, 2026 — EU e-Evidence Regulation becomes directly applicable
Regulation (EU) 2023/1543 takes effect across the EU (excluding Denmark), enabling cross-border European Production and Preservation Orders (EPOC/EPOC-PR) that compel service providers to hand over electronic evidence directly to another member state's authorities — a structural shift in how cross-border security-research and disclosure investigations can be compelled to produce data. Potomac Law

Sep 1, 2026 — UK Cyber Security and Resilience Bill: House of Lords Committee stage begins
Line-by-line Lords scrutiny of the NIS2-style bill (MSPs and data centres brought into scope) starts — the stage where the Computer Misuse Act review amendment pushed in Commons committee gets another run. Bill stages

Sep 28, 2026 — CIRMP Annual Reports due under Australia's SOCI Act
Responsible Entities must submit a board-approved Critical Infrastructure Risk Management Program annual report via the CISC online form within 90 days of FY end (30 June) — locked-in annual cadence for critical-infrastructure cyber risk management programs. CISC online form

Oct 12-15, 2026 — Singapore International Cyber Week (SICW) 2026
Singapore; APAC's premier cybersecurity policy event — ministerial roundtables, GFCE Southeast Asia regional meeting, and GovWare 2026; historically the window for Counter Ransomware Initiative summit announcements. SICW

Nov 9-27, 2026 — ITU Plenipotentiary Conference 2026 (PP-26)
Doha, Qatar; ITU's quadrennial top governance conference attended by all 194 member states — sets the Union's strategic plan, elects leadership, and will address AI security, cybersecurity mandates, and emerging technology governance. ITU PP-26

Nov 13, 2026 — India DPDP Rules: Consent Manager Framework Becomes Operational
Phase 2 of India's Digital Personal Data Protection Rules 2025 (notified November 13, 2025) activates — consent-manager registration and operation under the DPDPA becomes functional; core data fiduciary compliance (Phase 3) follows May 13, 2027; relevant for security researchers handling Indian personal data. IAPP

Dec 2, 2026 — Australia: PJCIS Statutory Review of SOCI Act Must Commence
The Parliamentary Joint Committee on Intelligence and Security must begin its statutory review of the Security of Critical Infrastructure Act no later than this date — will assess the effectiveness of Australia's critical infrastructure regime including cyber incident obligations. Ashurst

Dec 7-11, 2026 — UN Global Mechanism on ICT Security: Dedicated Thematic Groups
New York; first working-level meetings of the permanent UN cyber mechanism's Dedicated Thematic Groups — where the technical detail behind state-level cyber-norm and vulnerability-equities discussions is worked out. Process tracker

Dec 10, 2026 — Australia SOCI: Enhanced CIRMP All-Hazards Compliance
Six-month grace period for the Enhanced Critical Infrastructure Risk Management Program Rules (F2026L00701, commenced June 10, 2026) expires — requiring all-hazards material-risk compliance across nine high-risk asset classes including cyber hazards. cyberassure

Dec 11, 2026 — EU CRA: target for sufficient notified bodies
Member States are to ensure enough notified bodies exist to perform CRA conformity assessments, avoiding market-entry bottlenecks ahead of the main obligations. EC CRA implementation

Dec 31, 2026 — UN Cybercrime Convention (Hanoi) closes for signature
40 ratifications required for entry into force; only 3 deposited so far (Qatar, Azerbaijan, Viet Nam) against ~76 signatories — Articles 6-10 risk criminalizing unauthorized-access research without sufficient safeguards, and slow ratification keeps the advocacy window open. UNODC convention page

Budapest Convention Protocol II — 5th Ratification Watch
Protocol II (CETS 224) requires 5 ratifications to enter into force; currently at 4 (Hungary, Costa Rica among the most recent) — a single additional ratification triggers entry into force, enabling cross-border law enforcement access to stored electronic evidence with direct implications for international CVD investigations. Council of Europe

H2 2026 — UK Computer Misuse Act statutory defence: expected via National Security Bill
The Crime and Policing Act 2026 received Royal Assent Apr 29, 2026 without a CMA statutory defence; a new National Security Bill (announced in the King's Speech May 13, 2026) is the named vehicle — bill not yet introduced to Parliament as of this writing; proposed defence is narrowly scoped (~300 UK Cyber Security Council chartered professionals). Computer Weekly

H2 2026 — Australia SOCI Act: Ministerial Directions Powers + Enhanced CIRMP Rules finalisation
Post-Slay-Review consultation closed May 1, 2026; the package expands sectoral scope and adds broader ministerial directions powers, but no implementation timeframe has yet been proposed. Home Affairs consultation

Q4 2026 — Final NIS2 transposition (Ireland and France outstanding) — Commission escalates to the CJEU
In early July 2026 the Commission referred France, Ireland, Spain, and the Netherlands to the Court of Justice, seeking lump-sum plus daily fines until full transposition; the Netherlands leg resolved when its Cyberbeveiligingswet entered into force Aug 15, 2026. France's Resilience bill slipped off the July extraordinary session to a September National Assembly vote (the anti-backdoor Article 16 bis is the sticking point) and Ireland's National Cyber Security Bill is in committee with transposition expected by end-2026. The Record

Late 2026 — UK Cyber Security and Resilience Bill: Royal Assent
Following the Jul 14, 2026 Lords Second Reading and the Sep 1 Committee stage, the Bill is expected to receive Royal Assent later this year; phased implementation via secondary legislation runs through 2028 — expands NIS scope to MSPs and data centres. Bill stages

Late 2026 — EU Cybersecurity Reserve operational under Cyber Solidarity Act
ENISA-operated €36M reserve of trusted incident-response providers; formal stand-up targeted end-2025 but provider onboarding and operational ramp has extended into 2026. ENISA Cybersecurity Reserve

Late 2026 (unconfirmed) — Counter Ransomware Initiative 6th Summit
5th Summit held in Singapore Oct 2025; 6th summit host and date not yet announced — historically annual at Oct/Nov, likely co-located with SICW 2026 (Oct 12-15, Singapore). CRI

Oct 2026 + ~Nov 2026 (targets) — Japan Active Cyber Defence Law: core provisions in force
Core incident-notification/reporting provisions for designated critical infrastructure target Oct 2026, with the incident-reporting obligation around Nov 2026 — the first hard compliance phase ahead of full effect in 2027 (government countermeasure powers ~Nov 2027). Baker McKenzie analysis

TBD — Pall Mall Process industry guidelines: consultation closed, no published deadline
The UK/France consultation on good practice for the commercial cyber intrusion industry closed Jan 16, 2026; the complementary industry guidelines it feeds have not been published, and GOV.UK carries no new comment window, negotiation timetable, or launch date. gov.uk consultation

TBD (designation dates not yet set) — Canada: Critical Cyber Systems Protection Act (Bill C-8) coming into force
Royal Assent received Jun 16, 2026 (telecom-related amendments took immediate effect); substantive obligations for designated critical-infrastructure operators phase in gradually via future Governor-in-Council regulations and designations — designated operators get 90 days from designation to stand up cybersecurity programs, but no designation dates are set yet. Revives the reform previously known as Bill C-26, which died on the order paper in early 2025. The Deep Dive

---

Pending / TBD (2026)

Oct-Nov 2026 — UK Online Safety Act: first categorised-service transparency deadlines
Ofcom published its Register of Categorised Services on Jul 10, 2026 (Facebook, Instagram, Snapchat, TikTok among Category 1); Category 1/2A services must supply their latest illegal-content and children's risk-assessment records to Ofcom by Oct 2026 and publish summaries by Nov 2026 — shaping transparency and reporting expectations for designated platforms. Ofcom register

Sep 30, 2026 — CISA 2015 reauthorization: Senate action needed
The 10-year extension passed the House inside the FY27 NDAA (Jul 22, 2026) rather than as standalone H.R. 5079, but the Senate NDAA draft has no matching provision; a Jul 14 cloture vote failed 50-46 and Majority Leader Thune's motion to reconsider remains unexecuted. The Senate is in recess until Sep 14, 2026 — leaving roughly two weeks of session to resolve the NDAA impasse (Sen. Paul a known blocker) or land a conference-inclusion fix before the Sep 30 sunset of the core federal liability/info-sharing framework underpinning coordinated disclosure. The Record

H2 2026 — H.R. 872 / S. 1899 (Federal Contractor Cybersecurity Vulnerability Reduction Act)
H.R. 872 passed the House (Mar 2025) and is with the Senate (companion S. 1899, no committee action yet); would mandate FAR-level VDPs (NIST / ISO 29147 & 30111) for federal contractors — likely to ride the FY27 NDAA; single largest VDP expansion since BOD 20-01. H.R. 872

H2 2026 — FY27 NDAA (H.R. 8800): Title XV cyber provisions
The House passed H.R. 8800 on Jul 22, 2026 (216-212), carrying the CISA 2015 extension; the Senate NDAA heads to its own floor vote then conference in the fall — historically the highest-leverage federal vehicle for VDP-related amendments and DoD/DIB-VDP expansion. H.R. 8800

H2 2026 — Active Cyber Defense Certainty Act (ACDC)
Reintroduced May 18, 2026 with 15 bipartisan co-sponsors (Graves/Gottheimer); referred to House Judiciary, no markup scheduled — most significant CFAA amendment proposal in years, creating a "hack back" carve-out with FBI pre-notification and direct implications for the boundary between defensive research and unauthorized access. Sponsor release

H2 2026 — FRONTIER Act (H.R. 9925, Obernolte–Trahan): committee action
The formal bill from the "Great American AI Act" discussion draft, introduced Jul 23, 2026 with bipartisan co-sponsors: transparency reports, risk-management frameworks, critical-safety-incident reporting, and mandatory third-party independent evaluation of frontier models (the AI analogue of VDP infrastructure), plus contested state-preemption language — House Energy & Commerce Chairman Guthrie has been noncommittal on scheduling a hearing/markup. Sponsor release

H2 2026 — Australia Privacy Act Tranche 2 exposure draft expected
AG confirmed Tranche 2 is progressing (fair-and-reasonable test, GDPR-style individual rights) — a privacy-tort cause of action would change the legal risk calculus for researchers handling personal data during disclosure. Privacy Act review

H2 2026 — California SB 53: Transparency in Frontier AI Act enforcement build-out
In force from Jan 1, 2026; first annual transparency reports due 2026; Cal OES critical-incident-reporting infrastructure stands up across H2 — creates a researcher/employee disclosure channel distinct from CFAA. CA SB 53

2026 — EU AI Act Annex III High-Risk Systems: compliance deferred to Dec 2, 2027
The Digital Omnibus is now law (Regulation (EU) 2026/1744, published in the Official Journal Jul 24, 2026, in force Jul 27): compliance for standalone Annex III high-risk AI systems (recruitment, credit scoring, law enforcement, education, border control) moves from the original Aug 2, 2026 statutory date to Dec 2, 2027; Annex I embedded high-risk systems move further to Aug 2, 2028; Article 50 transparency obligations were NOT deferred. Gibson Dunn

---

This page is maintained by disclose.io as a community resource. Have a date we should add? Reply to any Policy Pulse issue or reach out on Twitter/X.