Afghanistan: Cybersecurity

The EU's Cyber Resilience Act introduces mandatory vulnerability and incident reporting obligations for manufacturers of digital products starting 11 September 2026, well before the broader regulatory framework takes effect. Manufacturers must navigate tight reporting deadlines, determine when they become "aware" of security events, and establish governance structures to comply with 24-hour early warnings and subsequent detailed notifications through a platform that is not yet operational.

Starting September 11, 2026, manufacturers of digital products in the EU must report cybersecurity vulnerabilities and incidents within strict 24-hour and 72-hour deadlines under the new Cyber Resilience Act. Companies face penalties up to €15 million or 2.5% of global turnover for non-compliance, requiring immediate preparation of incident response procedures and assessment of product portfolios to meet these unprecedented product-focused cybersecurity obligations.

European financial regulators have issued new guidance on managing ICT risks from frontier AI models under DORA, setting expectations that will reshape how financial entities assess their technology providers. The statement from the European Supervisory Authorities outlines three core risk mitigation strategies—prevention, detection, and management—that will drive increasingly detailed scrutiny of AI service providers' cybersecurity, governance, and operational resilience. ICT service providers,