#regulation
- Analysis · Oct 27, 2026The Cyber Resilience Act for identity teams: four dates, two roles, one reporting clock already running
The EU Cyber Resilience Act, Regulation (EU) 2024/2847, writes authentication and secure defaults into law for products sold in the EU, and lists identity management, PAM and password managers as important products. Its reporting duty started on 11 September 2026. What it asks of teams that buy identity products and teams that build them, and what to do before December 2027.
- News · Oct 20, 2026ICO reprimands Ogi and Data Cymru after a 12-year-old test account with Password1 let ransomware in
The UK ICO reprimanded Ogi Networks and Data Cymru on October 20 over a November 2024 ransomware attack that entered through a test account named Test2, created in 2012 with the password Password1, and exposed data on 3,300 people, mostly children.
- News · Oct 15, 2026India mandates registered caller name display (CNAP) on 4G and 5G networks from November 1
India's Department of Telecommunications has ordered all access providers to show callers' subscriber-registered names on incoming calls from November 1, 2026, a network-level identity signal aimed at spam and fraud calls.
- Analysis · Aug 29, 2026Every EU member state owes citizens a wallet by December 2026
Regulation (EU) 2024/1183 anchors national EUDI Wallet availability to 24 December 2026. Most coverage treats this as a public sector milestone. The obligations that will surprise people fall on relying parties.
- Analysis · Jun 24, 2026Biometric authentication just became a regulatory frontier
Biometrics are now in nearly every national ID and a growing share of logins, and the law has caught up. BIPA, the EU AI Act, and a wave of US state rules treat biometric identifiers as a special category. Here is what changed and what to do.