From Compliance to Evidence of Professional Practice

EU Cyber Resilience Act reporting requirements became operational on September 11, 2026, requiring manufacturers of products with digital elements to report actively exploited vulnerabilities and severe incidents within 24 hours of awareness. New York DFS issued detailed guidance on cybersecurity risk assessment documentation and traceability under 23 NYCRR Part 500. The UK House of Lords debated a competence mandate amendment to the Cyber Security and Resilience Bill, which was withdrawn after Government declined to place the UK Cyber Security Council on a statutory footing. Insurance provider Coalition announced enhanced AI-related coverage endorsements addressing output-related exposures and upcoming AI regulatory liability products.

Taken together, these developments show cybersecurity gradually moving from a control-centered discipline toward an environment in which competence, evidence, professional judgment, decision authority, documentation, and accountability increasingly matter. Regulators are no longer simply asking whether an organization has a risk assessment — they are asking how the risk was identified, what evidence supported the assessment, who accepted residual risk, and whether the decision was documented. This resembles the evidentiary characteristics of a professional standard of care.

EII should treat regulatory reporting as part of the emerging evidence architecture of professional practice. The Institute should continue developing the distinction between technical evidence and professional judgment, preserve the chain between enterprise condition and outcome, and examine whether demonstrable adherence to a recognized professional standard of practice reduces uncertainty surrounding cybersecurity, Enterprise Intelligence, and AI professional risk. The objective is not to make the CISO responsible for everything, but to establish what responsible professional practice looks like — Distributed Accountability.

EII will continue monitoring the implementation and first enforcement activity under the Cyber Resilience Act, New York DFS examinations applying its new risk-assessment guidance, the next stage of the UK Cyber Security and Resilience Bill and its expected consultation on professional standards, emerging CISO-specific liability cases, professional-liability and cyber-insurance underwriting practices, and regulatory treatment of human judgment as AI assumes greater decision-making authority.