Regulation
In-depth guides and analysis on regulation from the Safeguard engineering team.
20 articles
UK CSR Bill: Relevant MSPs and Data Centres Brought Into Scope
The UK Cyber Security and Resilience Bill introduced on 12 November 2025 expands the NIS regime to 900-1,100 managed service providers and large data centres.
CRA Harmonised Standards: Inside CEN-CENELEC JTC 13 and Standardisation Request M/606
Standardisation Request M/606 was accepted in April 2025 with 41 harmonised standards to deliver by Q3 2026 to underpin CRA presumption of conformity.
CRA Open Source Software Stewards: Article 24's Light-Touch Regime
The CRA's open-source software steward concept under Article 24 creates a distinct, lighter set of obligations for foundations and non-profits supporting commercial OSS.
CIRCIA Final Rule Slips to May 2026: What Changes
CISA pushed the CIRCIA final rule deadline from October 2025 to May 2026, citing 24,000 public comments and harmonization work with other federal cyber reporting frameworks.
EU AI Act Article 5: Prohibited Practices Now Enforceable
Article 5 of the EU AI Act became enforceable on 2 August 2025, with administrative fines up to €35 million or 7% of worldwide turnover for prohibited AI practices.
EUCC: First Certificates Issued Six Weeks After Scheme Launch
ANSSI issued the first two EUCC certificates in April 2025, just six weeks after the European Common Criteria-based cybersecurity certification scheme entered into force on 27 February 2025.
DORA Subcontracting RTS: Inside Commission Delegated Regulation 2025/532
The DORA subcontracting RTS adopted on 24 March 2025 governs how ICT third-party providers may subcontract critical or important functions, in force from 22 July 2025.
DORA TLPT RTS: What the Threat-Led Penetration Testing Standard Requires
The Commission published the DORA TLPT RTS on 18 June 2025 with direct effect from 8 July 2025. Tests are mandated every three years, aligned to TIBER-EU methodology.
FTC Safeguards Rule: The 30-Day Notification Window in Effect
Since May 13, 2024, non-banking financial institutions must notify the FTC within 30 days of a notification event affecting 500 or more consumers.
EU AI Act Article 73: Serious Incident Reporting from August 2026
Article 73 of the AI Act requires high-risk AI providers to report serious incidents within 15 days, with shorter clocks of 2 days for critical infrastructure and 10 days for death.
France's NIS2 Transposition: Inside the Resilience Bill
France's Senate passed the Resilience bill on 12 March 2025 — the omnibus law transposing NIS2 and CER — after the Commission's reasoned opinion of 7 May 2025 escalated infringement proceedings.
FAR CUI Proposed Rule: An 8-Hour Clock and a Government-Wide Standard
The January 15, 2025 FAR CUI rule extends NIST SP 800-171 to every federal contractor and adds an 8-hour incident reporting clock for non-federal facilities.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.