| Cybersecurity Maturity Model Certification (CMMC)↗ (opens in a new tab) | - A Defense Department supplier
- Holding controlled unclassified information
| Partly suspendedSelf-assessments have appeared in new contracts since Nov 10, 2025. Third-party assessments, due from Nov 10, 2026, were suspended on Jul 13, 2026, pending a review. | Know where controlled unclassified information lives, analytics and AI included. DFARS 252.204-7012 and NIST SP 800-171 still apply to every system that holds it. |
|---|
| FDA Food Traceability Rule (FSMA section 204)↗ (opens in a new tab) | - Making, packing or holding foods on the Food Traceability List
| Enforcement deferredThe compliance date was Jan 20, 2026; Congress has directed FDA not to enforce the rule before Jul 20, 2028. | Key data elements for each critical tracking event, tied to a traceability lot code, and records to FDA within 24 hours of a request, as a sortable spreadsheet during an outbreak or recall. |
|---|
| FDA Quality Management System Regulation (21 CFR 820)↗ (opens in a new tab) | | Applies nowEffective Feb 2, 2026. It replaces the Quality System Regulation and incorporates ISO 13485:2016. | FDA can now inspect management review, quality audit and supplier audit reports, and ISO 13485 requires software used in the quality system, AI tools included, to be validated for its use. |
|---|
| Uyghur Forced Labor Prevention Act↗ (opens in a new tab) | - An importer into the United States
| Applies nowThe presumption has applied since Jun 21, 2022. | Goods made wholly or partly in Xinjiang, or by listed entities, are presumed made with forced labor. Rebutting that takes clear and convincing evidence: supply chain tracing back to raw materials, and complete answers to CBP’s requests. |
|---|
| ITAR: encrypted technical data (22 CFR 120.54)↗ (opens in a new tab) | - Making defense articles
- Holding their technical data
| Applies nowSince Mar 25, 2020. | Unclassified technical data sent or stored with end-to-end encryption, to FIPS 140-2 or equivalent strength, is not an export, provided it is not sent to or stored in a proscribed country and no third party holds the means to decrypt it. It decides where drawings and models may sit, and which AI tools may read them. |
|---|
| NERC CIP standards, now with internal network monitoring (CIP-015-1)↗ (opens in a new tab) | - A registered entity on the bulk power system
| Applies nowMandatory and enforced. FERC approved CIP-015-1 in Order No. 907 (Jun 26, 2025; effective Sep 2, 2025); compliance phases in under NERC’s implementation plan. | BES Cyber Systems are categorized by impact and kept inside electronic security perimeters, with access control, logging and now monitoring of the traffic inside them. Analytics or AI that reaches those systems sits inside the same rules. |
|---|
| America’s Water Infrastructure Act, section 2013↗ (opens in a new tab) | - A community water system serving more than 3,300 people
| Applies nowSecond round under way: assessments certified by Mar 31, 2025, Dec 31, 2025 or Jun 30, 2026, depending on size, and response plans six months later. | The risk and resilience assessment covers electronic, computer and automated systems and their security, monitoring practices, and operation and maintenance, and is reviewed and recertified to EPA every five years. |
|---|
| Illinois Biometric Information Privacy Act↗ (opens in a new tab) | - Running an Illinois site
- Using fingerprint, hand or face time clocks
| Applies nowSince 2008; amended Aug 2, 2024. | A public retention and destruction policy, written notice and a written release before any scan, and destruction once the purpose is met or within three years of the last interaction. An electronic signature now counts as a release, and repeated scans of one person by the same method count as one violation. |
|---|