Transatlantic cyber incident-reporting regimes set 24–72 hour cadence

CISA is expected to finalize CIRCIA rules in September 2026, mandating 72-hour reporting for substantial incidents and 24-hour reporting for ransomware payments across more than 300,000 U.S. entities. The EU’s CRA Article 14 took effect on September 11, 2026, imposing 24-hour early warnings, 72-hour notifications, and final reports via the Single Reporting Platform, with significant penalties for non-compliance.