Weekly Briefs

What changed in regulation this week, whether it binds you, and when it lands.

A Monday briefing for in-house legal, risk and compliance teams. regSpace scans 23 sectors every week. Each development becomes a short brief: labelled, dated and linked to its source.

Start reading free See plans

Free to read. Professional is £29 a month, cancel any time.

Weekly Briefs

Issue 21 · Week of 12 October 2026

97
New: 65
Binding: 64
Provisional: 90
Signal

BindingUK

First UK directors convicted over ID verification; the 17 November transition deadline is five weeks away

Three directors were fined, one for failing to stop an unverified co-director from acting. Every existing director and PSC in scope must verify by the end of the transition.

Binding
Thailand revises its repair station rule, TCAR AIR Part-145, with a revision dated 5 August
Binding
FinCEN withdraws its unhosted-wallet reporting proposal and its crypto mixing rule
Binding
The US sanctions 17 tankers in what Treasury calls the remnants of Iran's shadow fleet
Binding
The UK adds about 38 Russia sanctions entries, including missile and drone suppliers and 12 tankers

219 briefs in this issue. Read it free

23
sectors scanned: 14
jurisdictions this week: 219
briefs this week: 189
dates on the horizon: 37
open consultations: 66
enforcement actions tracked

Inside a brief

Every brief answers the same questions.

This is a real brief from issue 17, shown in full. Free readers see the label, what changed and the dates. Professional opens the rest.

1
Does it bind you? Free
A label on every brief.
2
What changed? Free
The development in plain words, with the body behind it.
3
When does it land? Free
Effective dates, deadlines and consultation closes.
4
Why does it matter? Professional
What it means for a business in scope.
5
Who should act, and how? Professional
The owners, and the first steps to take.
6
Where does it come from? Professional
The primary documents, linked.

BindingEUCybersecurity

EU Cyber Resilience Act reporting is live: exploited flaws and severe incidents need a 24-hour early warning

From 11 September manufacturers of connected products sold in the EU report through ENISA's new Single Reporting Platform, on a 24-hour, 72-hour and final-report clock.

What changed

The vulnerability and incident reporting obligations in Article 14 of the Cyber Resilience Act (Regulation (EU) 2024/2847) became mandatory on 11 September 2026, and ENISA launched the Single Reporting Platform the same day. Manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents affecting product security: an early warning within 24 hours of becoming aware, a notification within 72 hours, and a final report within 14 days of a corrective measure being available for exploited vulnerabilities, or within one month of the notification for severe incidents. One notification reaches both ENISA and the coordinating CSIRT of the manufacturer's main establishment. ENISA says the platform is at initial operating capability and will expand over the coming months.

Key dates

11 Sep 2026: Reporting live
11 Dec 2027: Rest of CRA applies

Professional

Why it matters

The clock runs from awareness whether or not a manufacturer has onboarded, and fines reach EUR 15m or 2.5% of worldwide annual turnover. The rest of the CRA, including essential requirements and conformity assessment, applies from 11 December 2027. A single incident can now trigger CRA, GDPR Article 33, NIS2 and DORA reports in parallel, and an operator that sells own-brand connected products is itself a manufacturer.

Who should act

Manufacturers, importers and own-brand sellers of hardware or software with digital elements sold in the EU, including connected consumer goods and transport technology.

What to do now

Create an EU Login account and register on the Single Reporting Platform, naming the coordinating CSIRT.
Name trained people who can file a 24-hour early warning by hand, with out-of-hours escalation.
Rehearse the detect-to-report path and reconcile it with GDPR, NIS2 and DORA reporting.

Sources

Three labels

You know what to do with a brief before you read it.

Binding65 this week

Act on these.

In force or final.

Provisional64 this week

Plan for these.

Proposed, consulted on or awaiting a decision.

Signal90 this week

Watch these.

Guidance, enforcement mood or a supervisory steer.

What you get

Built for the way in-house teams work.

Read the edition, cut it to what you answer for, and keep the dates in front of you.

Free
This week's edition
The lead story, a one-minute read and every brief, grouped by sector.
Free for this week
Search
Search by regulator, company or instrument. Professional searches every edition since issue 1.
Free
Topic and country pages
A running page for each topic, sector and jurisdiction.
Free for 7 days ahead
Horizon
Every effective date and deadline ahead. Professional syncs it to your calendar.
Free for 7 days ahead
Consultations
Every open consultation, soonest to close first.
Professional
My desk
Pick a topic, or your own sectors and jurisdictions. Save views and switch between them.
Professional
The Monday email
The edition in your inbox, cut to your desk.
Professional
Alerts when dates move
Follow a brief and we tell you when a deadline shifts.
Professional
Enforcement tracker
Who was fined, by whom, and how much, across every edition.
Professional
Quarterly board pack
A quarter for any topic, ready to print for the board or risk committee.

Coverage

23 sectors in 10 topics.

Briefs so far have come from 14 jurisdictions, with the UK, the EU and the US every week.

Australia
Brazil
Canada
European Union
India
International
Israel
Japan
New Zealand
Singapore
Thailand
UAE
United Kingdom
United States

ESG and sustainability
Sustainability reporting, supply-chain due diligence, green claims and climate disclosure.
Corporate governance
Governance codes, company law, directors' duties, audit and listing rules.
Financial crime and sanctions
Bribery, fraud, whistleblowing, sanctions, trade controls and the enforcement that follows.
Privacy, data and AI
Data protection, privacy and AI rules, and how regulators are enforcing them.
Cyber and online safety
Cyber resilience and incident reporting, online safety and platform regulation.
People and employment
Employment law, pay transparency, workplace technology and automated decisions about people.
Consumers and marketing
Consumer protection, pricing, subscriptions, reviews and advertising rules.
Financial services and payments
Markets and conduct rules, payments and open banking.
Digital assets and crypto
Crypto-asset licensing, stablecoins, MiCA, tokenisation, the travel rule and crypto enforcement.
Transport and space
Aviation, rail and space safety and operations.

How it is made

Scanned, checked and written every Monday.

Weekly Briefs is produced with regSpace, our regulatory change platform, and published by Rated Counsel.

01
Scan
Early on Monday, regSpace reads regulators, legislatures, courts and official journals in every sector.
02
Check
A separate pass checks each finding against its source again, and corrects what does not hold up.
03
Write
Each development becomes one brief with a label, its dates and its sources. Continuing stories keep one page.
04
Publish
The edition goes live on Monday morning, UK time. Professional readers get it by email.