This tracker lists the AI rules, standards and official guidance we think security, IT and compliance teams most need to follow. It is deliberately short and every row links to the primary source. If we could not confirm a date from an official or primary page, it is not here.
Last reviewed: 31 October 2026. Dates move. Check the linked source before you rely on one, and tell us if something is out of date at mike.ade@pyralink.co.uk.
Not legal advice. A tracker is a pointer, not an interpretation of how a rule applies to you. Take advice from a qualified adviser on your obligations.
Coming up
| Date | What | Why it matters | Source |
|---|---|---|---|
| Monday 2 November 2026 | Third reading of the Cyber Security and Resilience (Network and Information Systems) Bill in the House of Lords (as scheduled on the Parliament page of 30 October 2026) | The Bill covers essential services and new sectors, incident reporting duties and government powers to direct organisations for national security. Watch for the final wording | UK Parliament |
| 20 November 2026 | ICO call for evidence on agentic AI closes (opened 8 October 2026) | The ICO says it will shape future guidance and its forthcoming statutory code on AI and automated decision-making. Organisations using AI agents with personal data can respond | ICO, Freshfields summary |
| 2 December 2026 | EU AI Act: a new prohibition (non-consensual sexual deepfakes and child sexual abuse material) and the transitional deadline for the Article 50(2) transparency obligation, as listed on the Commission's timeline | Marks a milestone for synthetic content rules, following the 2 August 2026 date from which most of the Act applies | AI Act Service Desk timeline |
| 2 August 2027 | EU AI Act: at least one AI regulatory sandbox per Member State, as listed on the Service Desk timeline | Relevant to organisations wanting supervised testing routes | AI Act Service Desk timeline |
| 2 December 2027 | EU AI Act: rules for high-risk AI systems listed in Annex III | Covers areas such as employment, education and essential services. Check the Annex to see whether your use is in scope | AI Act Service Desk timeline |
| 2 August 2028 | EU AI Act: rules for high-risk AI systems covered by Annex I (products under EU product safety law) | Mainly relevant to makers of regulated products with AI components | AI Act Service Desk timeline |
Already happened: UK
| Date | What | Why it matters | Source |
|---|---|---|---|
| 27 November 2023 | NCSC publishes the Guidelines for secure AI system development (version 1.0) | Four areas: secure design, secure development, secure deployment, secure operation and maintenance | NCSC |
| 2025 | UK government publishes the AI Cyber Security Code of Practice and an implementation guide | Baseline security principles for AI systems. DSIT said it would submit it to ETSI as the basis for a global standard | GOV.UK |
| 7 May 2025 | NCSC publishes its assessment of the impact of AI on the cyber threat to 2027 | Expects AI to almost certainly shorten the time between vulnerability disclosure and exploitation; warns of a growing digital divide | NCSC |
| 14 January 2026 | ETSI announces EN 304 223, baseline cyber security requirements for AI models and systems | A European standard built on the UK work | ETSI press release |
| 15 May 2026 | NCSC blog: Thinking carefully before adopting agentic AI | Practical caution on moving to AI agents | NCSC |
| 20 August 2026 | NCSC blog: Managing the cyber risk of agentic AI | Threat modelling, oversight, sandboxing, agent identity, short-lived credentials, logs, emergency shutdown | NCSC |
| 8 October 2026 | ICO opens a call for evidence on agentic AI | Six themes, including security, transparency, accountability, automated decision-making and lawful basis | ICO, Freshfields summary |
| 12 October 2026 | UK government announcement on stepping up national defences against AI risks | Says frontier AI is being used to strengthen government cyber defences; says it will consider strengthening the Cyber Security and Resilience Bill for AI risks, and work with the NCSC and AI Security Institute on incident response for AI-agent incidents | GOV.UK |
| 20 October 2026 | NCSC blog: a new AI chapter in the NCSC research problem book | Signals where the NCSC wants more research | NCSC |
The ICO's guidance page on AI and data protection says it is under review following the Data (Use and Access) Act. Check the ICO's AI guidance pages for the current position before you rely on older versions.
Already happened: EU
| Date | What | Why it matters | Source |
|---|---|---|---|
| 1 August 2024 | The AI Act (Regulation (EU) 2024/1689) enters into force | The first comprehensive AI law. Risk-based, with obligations for providers and deployers | Official text (EUR-Lex), Commission overview |
| 2 February 2025 | Prohibited AI practices and AI literacy provisions begin to apply | Staff AI literacy is now an expectation for providers and deployers in scope | AI Act Service Desk timeline |
| 2 August 2025 | Obligations for general-purpose AI models and the governance framework begin to apply | Affects providers of general-purpose models | AI Act Service Desk timeline |
| 19 November 2025 | Commission proposes a AI omnibus | A package of changes to the AI Act timeline and rules | AI Act Service Desk timeline |
| 7 May 2026 | Political agreement on the AI omnibus (per the Service Desk timeline) | Settled the content that later entered into force | AI Act Service Desk timeline |
| 27 July 2026 | The AI omnibus enters into force (per the Service Desk timeline) | Check the timeline page for what changed | AI Act Service Desk timeline |
| 2 August 2026 | Article 50 transparency rules, enforcement and most remaining rules begin to apply (per the Service Desk timeline) | Includes transparency duties for AI interaction and synthetic content | AI Act Service Desk timeline |
The Commission's own pages and the Service Desk timeline do not always agree on every date, and the omnibus has changed some. We have used the Service Desk timeline throughout, so check it first.
Already happened: standards and international guidance
| Date | What | Why it matters | Source |
|---|---|---|---|
| 26 January 2023 | NIST releases AI Risk Management Framework 1.0 | A widely used voluntary framework: govern, map, measure, manage | NIST |
| December 2023 | ISO/IEC 42001:2023 published (AI management systems) | A management system standard that organisations can be independently assessed against. The standard itself is a paid document | ISO |
| 26 July 2024 | NIST publishes AI 600-1, the Generative AI Profile | A companion to the AI RMF for generative AI risks | NIST |
| 16 December 2025 | NIST publishes the preliminary draft of IR 8596, the Cyber AI Profile (comments closed 30 January 2026) | Maps AI-related cyber risk onto the NIST Cybersecurity Framework 2.0. A draft; not final | NIST CSRC |
| 7 April 2026 | NIST publishes a concept note for a critical-infrastructure AI RMF profile | An early-stage development | NIST |
| 1 May 2026 | CISA and international partners publish the guide Careful Adoption of Agentic AI Services | Advises avoiding broad access, starting with low-risk uses, and including agents in your security model | CISA |
NIST says AI RMF 1.0 is being revised as part of the White House AI Action Plan. Check the NIST page for the current version.
Living references (no single date)
- OWASP Top 10 for LLM Applications: the most widely used list of LLM application risks. See our staff guide.
- MITRE ATLAS: a knowledge base of adversary tactics and techniques against AI-enabled systems, with case studies and mitigations.
How we keep this up to date
We update the tracker when an official source changes or when a new item meets our test: it is from a primary source, it has a date we can confirm, and it matters to organisations adopting AI. If we cannot confirm a date, we leave it out. Corrections are welcome.
Sources
Every row above links to its primary source. The main ones are the AI Act Service Desk timeline, the UK Parliament Bill page, the NCSC, GOV.UK, the ICO and NIST.
Get one practical fix every Monday
Pyralink™ Prove It is a free weekly email on cloud and AI security, with a link for every claim.
Subscribe by email