As of August 1, 2026, under the Delete Request and Opt-Out (DROP) regulations, data brokers need to permanently delete from their records the PI of a half million Californians. Failure to do so carries a penalty of $200 per user per day. CalPrivacy punctuated this landmark mandate in privacy protection with three enforcement actions within a month against unregistered brokers for non-DROP violations, while citing DROP obligations at the end of each order.

Together, the new settlements highlight CalPrivacy’s broad interpretation of who counts as a regulated data broker, transparency and data minimization obligations, and how the enforcer can stack laws in actions against brokers. The settlements also serve as a final warning to “the unregistered data brokers that they have this window in which they still can wake up and register before they get the $60‑million fine,” In-House Privacy founder Ben Isaacson told the Cybersecurity and AI Law Report.

While brokers continue to grapple with DROP requirements, California has already moved to accelerate compliance deadlines. In a law passed on September 1, 2026, legislators upended the situation for all brokers, shortening their DROP compliance cycle from 45 days to 30 days, starting in 2027. CalPrivacy endorsed the change, noting that the longer brokers store PI, “the longer it is available for a data breach or other possible misuse. A 30‑day timeline is respectful of a consumer’s request and also reasonable for business.”

This article examines the settlements, challenges of satisfying DROP requirements, and enforcement to watch, and offers practical DROP compliance steps, with comments from Isaacson and experts at Barnes & Thornburg, Davis & Gilbert, Fenwick, InfoLawGroup and In-House Privacy. It also discusses an industry letter to CalPrivacy, authored by Isaacson, seeking limited enforcement of DROP violations for a year because of 17 different implementation issues.

See “Lessons From the Trenches on How Data Brokers Can Manage Consumer Rights Requests” (Jan. 7, 2026).

Cases Highlight Focus on Opt-Outs and Adtech Providers

CalPrivacy’s August and September settlements with LocateSmarter, Cybba and SalesIntel Research reinforced its scrutiny of adtech companies and its continuing focus on both opt-out practices and disclosure obligations.

CalPrivacy fined all three companies for not registering in the state as a broker under the Delete Act, and each agreed to satisfy requirements under DROP, which has 500,000 enrolled residents, CalPrivacy announced on August 25, 2026.

CalPrivacy Again Targets Opt-Out Friction

The case against people-search site LocateSmarter is CalPrivacy’s first to pair Delete Act and CCPA violations. The regulator fined the company $116,490 for requiring residents to provide their last four digits of their Social Security number before processing the requests to opt out of sale and sharing, a violation of the CCPA’s provisions on data minimization. LocateSmarter was at least the fourth CalPrivacy case addressing opt-out friction, Barnes & Thornburg partner Brian McGinnis told the Cybersecurity and AI Law Report.

LocateSmarter’s CCPA violation for demanding excess information before granting an opt-out reflects that data minimization is a priority for state privacy enforcers and companies still have trouble with it, McGinnis noted. For example, businesses understandably would like to route all consumer opt-out requests through “one form that complies with all U.S. and international laws, to make it as easy and friction-free [as possible], at least on themselves if not on the user,” he said. This approach is no longer acceptable, though.

Companies like LocateSmarter may sincerely want to be precise and to limit friction with opt-outs, InfoLawGroup partner Lael Bellamy told Cybersecurity and AI Law Report. A company “may have asked for the last four of the Social Security number legitimately thinking it would have to differentiate between individuals with the same or similar names,” she said. “In this case, asking up front, before an issue surfaces, is not okay under the CCPA.”

In addition to issues with the technicalities of processing requests, companies struggle with ensuring employees are properly informed. “The employees that set up the opt-out processes might not be conscious of the data minimization and verification” standards for different types of requests, Fenwick attorney Brent Tuttle told the Cybersecurity and AI Law Report.

Treatment of Adtech Providers As Brokers

The two other companies that settled for not registering under DROP – Cybba for $52,400 and SalesIntel for $36,400 – were adtech companies, which signals CalPrivacy’s readiness to treat niche providers of audience intelligence, lead generation and profiling services as brokers. “Enforcement has come down the line to smaller companies that most people haven’t really heard of or had any interaction with,” McGinnis noted.

The SalesIntel press release explicitly warns adtech operators that their services may make them brokers.

These actions warn of CCPA risks and the strict broker definition but are not “DROP-everything” eye openers. “We are sitting on the edge of our seats waiting for a real enforcement action post-August 1 that would be for a failure to comply properly with DROP,” Davis & Gilbert partner Gary Kibel told the Cybersecurity and AI Law Report.

See “CPPA’s Tractor Supply Decision Offers Lessons As Enforcement Focus Moves From Education to Deterrence” (Oct. 22, 2025).

Implications of the Broad Broker Definition

CalPrivacy changed the definition of a data broker in the Delete Act regulations (Regulations) issued in December 2025, newly exposing adtech and media companies to a need to register, experts agreed.

More Companies Qualify As Data Brokers

The Regulations clarified that companies are brokers if they append third-party information to data that they collect directly from consumers, also known as first-party data, and then share that mix of personal data with other parties.

The Regulations also narrowed the circumstances in which a business has a “direct relationship” with a consumer, limiting that concept to interactions the consumer intends to have with the business. As a result, companies can no longer rely as readily on incidental or indirect consumer interactions to avoid data broker status.

More Industries Face Broker Regulations

The expanded definitions could affect many participants in the ad ecosystem and standard secondary uses of data, experts said. Large publishers that combine first-party data on consumers with acquired data from third parties also may need to register or make changes.

“Before the amendments introduced by the Regulations, the common view was that a business could fall entirely outside the scope of the Delete Act as long as it had any first-party relationships,” Kibel observed. Now companies are reevaluating their first-party datasets to see whether that consumer data was collected through some other relationship or source, he said.

CalPrivacy enforcement targets “might include some of the biggest media companies in the country,” Isaacson underlined. These familiar name brands, eager to avoid the data broker label, now may need to reduce their longstanding audience enrichment practices and forgo revenue-generating partnerships related to advertising, he said.

The expanded broker definition also reaches beyond adtech and media, potentially affecting companies across industries that derive revenue from their data. “AI really has an insatiable hunger for data,” and publicly available data scraped from the web no longer suffices, McGinnis observed. Data purchasers now seek distinctive proprietary databases for training AI applications and tailored models – and are forging deals across many sectors. “There’s so much value wrapped up in the data that companies collect through the provision of their service,” either about users or records of how people use a product, he said.

As the value of proprietary data rises, the tech sector is finding new ways to commercialize it. Some technology companies have added subscriptions or fee access to datasets, Fenwick partner Ana Razmazma reported. “They may have a database of contacts where they use third-party sources to help gather that information. And they’re selling a subscription to that repository” of aggregated data, she told the Cybersecurity and AI Law Report.

See “Loyal to a Fault? Customer Loyalty Programs in the Age of Comprehensive Privacy Laws” (Oct. 9, 2024).

Responses to Expanded Risk of Qualifying As Broker

To assess broker status, companies in these gray zones should inventory their personal data inflows and outflows, identify any purchased and licensed data they have obtained, and determine “if they charge for access” to their own collections, Razmazma advised.

Companies should be looking for any stream of personal data enriched or appended to another dataset, McGinnis stressed. They also should review contracts and privacy notices to confirm what rights and restrictions attach to any information in motion, he advised.

Ad-world companies that collect directly from consumers but also process others’ data must protect their mixed business model by “having the appropriate contracts in place to indicate that they are a service provider both on paper and in practice. The CCPA requires specific language in contracts with both service providers and third parties,” Kibel urged.

Tech companies have been adjusting their practices to avoid broker registration. “Instead of charging for a database on a subscription basis, they may bundle that database with some other offering that does not involve a pure sale,” Razmazma said.

De-identification has become a major theme with the rise of AI training, Razmazma continued. Companies training AI, unlike advertisers, often do not need to know a person’s identity. “I am seeing brokers become very good at de-identifying data” for AI use. They also have been offering de-identification services to help others avoid PI sales, she shared.

See “Data Clean Rooms and De-Identified Data Are Among Concerns in Navigating State Privacy Laws” (Apr. 9, 2025).

Action Steps and Challenges With DROP’s Arrival

The engineering and procedural demands of complying with DROP’s requirements, particularly the need to download Californians’ requests every 45 days, currently, will require affected companies to undertake a large-scale, layered compliance project. Experts highlighted the following priorities.

See “Touring California’s New Dashboard for Permanent Erasure of Personal Information” (Nov. 12, 2025).

Build Infrastructure and Boost Privacy Engineering

DROP compliance requires recurring ingestion of request lists, identity matching, data deletion and the capability to suppress requestees’ data. Further tasks include tracking responses to requests, downstream communications of the deletions and reporting metrics. “One hundred percent of the time a new process has to be put in place,” Tuttle reported.

Matching DROP requests against broker records can be difficult because CalPrivacy’s data elements may not align with the information that brokers maintain, experts explained. Prior privacy protection steps may create obstacles. For example, “companies have removed identifiers on purpose to comply with data minimization requirements,” Bellamy noted.

The broker’s obligation “to individually mark how it responded to these half million requests appears to be a significant engineering undertaking” by itself, Tuttle highlighted.

Beyond building a new technical apparatus, brokers’ DROP managers must establish procedures to sustain compliance over time. When assigning clear responsibilities to people, the team must ensure it conforms with the current 45‑day cycle, McGinnis advised.

See “Checklist for Conducting Technical Privacy Reviews” (Dec. 4, 2024).

Tackle the Challenges of Suppressing Personal Data

Some brokers underestimated the ongoing obligation to block reacquisition of DROP enrollees’ PI, Tuttle reported. Brokers must maintain a permanent suppression capability.

A related concern is that systems underpinning adtech and real-time bidding environments often were not designed to host batch deletion workflows, Isaacson pointed out.

See our four-part series on tracking technologies: “Privacy Regulation, Enforcement and Risk” (Jan. 17, 2024), “A Deep Dive on What They Are and How They Work” (Jan. 31, 2024), “A 360‑Degree Governance Plan” (Feb. 21, 2024), and “Compliance Challenges and Solutions” (Apr. 17, 2024).

Govern Downstream Deletions

Brokers must pass DROP deletion requests downstream, but many struggle with that requirement because they do not centralize their data and cannot easily identify where deletion instructions must be forwarded, Tuttle said. “A pain point that multiple clients have flagged is that, once we figure out what we need to do, how do we action that with multiple cloud providers,” he reported.

Downstream companies also often have immature privacy programs, creating risk on both sides of the transaction, McGinnis observed. “Doing a good job of diligence on your partners on the front end of those data transfer deals is important to” satisfy obligations to pass along deletion requests, he stressed.

See “Why Companies Unintentionally Fail to Honor Opt-Outs” (Aug. 16, 2023).

Ensure Thorough Compliance Records Are Kept

Written governance is one of the most overlooked compliance controls, “the very unsexy part of this,” McGinnis noted. Organizations frequently maintain compliance processes informally. As enforcement actions demonstrate, regulators target organizations that cannot produce documentary evidence of privacy measures, he observed.

Pursue Board Buy-In

“When the GDPR came out, the way to get internal buy-in for compliance was to refer to the potential fine of up to four percent of annual global turnover,” Razmazma recalled.

California’s per-user penalties currently add up to $1 million per day, which may persuade executives that it would be a sizable savings to allocate sufficient funds for the engineering, automation and operational investment that DROP likely requires.

Brokers Raise Questions About DROP Enforcement

Isaacson’s firm submitted a letter to CalPrivacy detailing almost 20 operational hurdles, technical bugs and legal uncertainties hindering DROP compliance. The letter was assembled through discussions with clients and industry groups, Isaacson said. It requested that CalPrivacy adopt a yearlong transitional enforcement period that granted a reprieve to brokers that take good-faith steps to fully comply as the agency addresses rollout issues.

“I don’t have a lot of expectation that CalPrivacy will address any of the bigger-picture points that I raised that aren’t in the current regulations,” Isaacson said.

The agency acknowledged Isaacson’s letter during its August 2026 board meeting, stating that it is considering the letter’s points. CalPrivacy’s brief written response to Isaacson said that it had no statutory right to grant an enforcement reprieve but considers all facts in each potential enforcement action, he shared.

CalPrivacy has, however, already punished brokers despite their good-faith efforts. In June 2026, CalPrivacy fined WINR Data, Clarivate and Decision Resources even though all three companies registered on time and voluntarily informed the agency of an error in their submissions. The fines were all under $13,000.

There is likely more to come. On September 3, 2026, a CalPrivacy enforcement advisory warned brokers that mistakes on their registration documents will cost them $200 for each day the incorrect information appears in the registry.

Potential Enforcement Priorities

CalPrivacy is likely to investigate brokers reporting a low number of matched records or completed deletions, Isaacson predicted. Many brokers are struggling to match DROP requests to their records because of differences in data types, data retention periods or other processing issues, he noted. One significant obstacle is that many brokers do not maintain dates of birth, a key identifier for matching records, he said. At the same time, DROP does not provide postal addresses, which the data broker industry commonly uses to geofence California residents from the rest of the country. CalPrivacy should add postal addresses to DROP, he argued, because they would improve matching accuracy and help brokers identify California residents.

Another likely enforcement priority is transparency, as it was an overwhelming broker failure before DROP implementation. A June 2026 Stanford study found only nine percent of brokers fully met disclosure requirements. Yet, brokers have requested guidance for multiple transparency issues. DROP, the Delete Act and the CCPA each require reporting of different data points that do not fit together cleanly, Isaacson noted. With 12 DROP cycles annually, brokers undoubtedly will need to correct their earlier reports, but any standards for such revisions remain unclear and deserve guidance, he cautioned.

See “CalPrivacy Director Discusses New Audits Division and Other 2026 Actions to Come” (Mar. 4, 2026).

A Legal Challenge in 2027?

CalPrivacy must address how DROP requesters verify their California residency. It is both a practical gap and a fundamental legal issue to watch, Isaacson contended. Practically, brokers have identified a portion of DROP participants who have moved, based on postal address records, he noted. According to the U.S. Census Bureau, between two and three percent of the U.S. population annually moves out of state.

DROP’s validation of residency enabled the Delete Act to comply with the U.S. Constitution’s interstate commerce clause, Isaacson posited. His view is that “if consumers do not re-verify California residency on January 1, it becomes a constitutional law question” that opens the Delete Act to a legal challenge. CalPrivacy has not alerted consumers in public statements or regulations of their need to re-verify their California residency. “That seems very important to me as we get to 90 days out” for CalPrivacy to defend the grounds for DROP and maintain the pioneering portal’s momentum, he said. CalPrivacy did not respond to questions about residency before publication.

To provide clarity on a law that will soon reshape how software and connected products are designed, maintained and sold in the E.U., the European Commission (EC) issued guidance (Guidance) on July 27, 2026, on the Cyber Resilience Act (CRA). With the CRA’s reporting obligations taking effect on September 11, 2026, and full compliance required by December 2027, in-house lawyers and compliance professionals must prepare to implement governance, documentation and reporting processes that can withstand both regulatory scrutiny and potential market-access challenges. With commentary from experts at Akin, Alston & Bird and Hogan Lovells Cadwalader, this article provides insights and compliance advice regarding key elements of the Guidance.

See “What International Companies Should Do to Comply With the E.U. Cyber Resilience Act” (Jan. 28, 2026).

Guidance Intent and Significance

The CRA sets out mandatory “secure-by-design-and-by-default” requirements for products with digital elements, to improve cybersecurity throughout a product’s lifecycle. It applies to E.U. as well as non-E.U. companies that place digital products in the E.U. market through importers, distributors or authorized representatives. Products that fail to meet certain terms of the CRA can be fined or denied entry to the E.U. market.

Answers to Common Questions

The EC issued the 83‑page Guidance to help companies understand the CRA. It answers “the questions stakeholders have been asking most,” according to an EC press release, including:

• when certain products fall within the scope of the CRA, such as remote data processing solutions and free and open-source software;
• what constitutes a “substantial modification”;
• how support periods should be understood and applied;
• how to meet reporting obligations; and
• how to meet risk assessment and due diligence requirements.

“Particular attention has been paid to microenterprises and small and medium-sized enterprises (SMEs), with 67 practical examples, a range of use cases, flowcharts and graphs, ensuring that the path to compliance is clear and proportionate, without unnecessary administrative burden,” the EC press release states.

The CRA’s incident and vulnerability provisions will be effective on September 11, 2026, and the CRA is fully applicable on December 11, 2027.

The EC’s FAQ document provides more help in interpreting the CRA.

Legal Significance

While the Guidance offers important insight into how the EC views the CRA, it is not legally binding and the Court of Justice of the E.U. retains the final say on interpretation, Jenny Arlington, senior counsel at Akin, told the Cybersecurity and AI Law Report. Some aspects of the Guidance or the CRA's interpretation may be challenged in the courts, by parties claiming, “this could not have been what the legislator intended,” she predicted.

Rather than breaking new ground, the Guidance “mostly confirms existing interpretations” of the CRA and may disappoint companies that had hoped for more business-friendly positions, Arlington observed.

Although the Guidance largely reinforces existing interpretations of the CRA, it also repeatedly emphasizes compliance obligations should be applied through a risk-based and proportionate lens, Wim Nauwelaerts, a partner at Alston & Bird, told the Cybersecurity and AI Law Report.

Further Guidance Expected

The EC, according to reports, is expected to release further CRA guidance in the coming months on topics including:

• harmonized technical standards;
• software bill of materials formats;
• single reporting platform integration;
• SME toolkits; and
• conformity assessment procedures.

See “Cybersecurity Obligations in E.U.’s Digital Laws: AI Act, CRA and NIS2” (Sep. 4, 2024).

Clarification on CRA Scope

The Guidance clarifies that the CRA applies to products with digital elements, including remote data processing solutions integral to a product’s functionality, but generally excludes standalone services and purely non-commercial open-source software unless they fall within specific categories.

Mobile Apps

Companies that produce or provide mobile apps for E.U. consumers are in scope, but many of them may not be considering the effects of the CRA as much as they should, Arlington observed. In determining whether they fall within scope, she advised, companies should avoid making overly rigid assumptions because even E.U. law experts “do not have a clear picture of how all these new, groundbreaking obligations will pan out.”

Software

The Guidance provides useful clarification that software executed or provided purely remotely, such as through a browser-based application, generally falls outside the CRA’s scope, Nauwelaerts said. “That is good news [for] providers of software as a service and similar type of offerings based on browser access.”

At the same time, many software companies may be surprised to learn that the CRA’s reach is broader than previously assumed. Before the Guidance was issued, there was a widespread misconception that the law only applied to connected hardware devices, similar products covered by the Data Act. The Guidance makes clear that software can also fall within scope, while emphasizing that not all software is automatically subject to the CRA.

Back-End Infrastructure

Whether back-end infrastructure that supports digital products qualifies as a remote data processing solution remains an open question, particularly given the heavy reliance on cloud services, APIs and other back-end systems to support products such as mobile applications, Dan Whitehead, a partner at Hogan Lovells Cadwalader, told the Cybersecurity and AI Law Report. “That is a complicated question.”

That distinction could have significant implications for mobile apps, which often depend on extensive supporting infrastructure. As a result, once an app falls within the CRA’s scope, substantial portions of the systems that support it may also be covered, Whitehead said.

Distinction on Substantial Modification of Hardware Versus Software

The Guidance provides important clarification on the concept of “substantial modification,” which determines when products already on the market may become subject to the CRA. A substantial modification occurs when a change to a product with digital elements, including software, affects compliance with the CRA’s essential cybersecurity requirements or alters its intended purpose, the Guidance provides.

The Guidance’s treatment of substantial modifications is especially significant for software, Whitehead said. After December 11, 2027, products already on the market generally become subject to the CRA only if they have undergone substantial modification, he explained. While hardware is typically treated as newly placed on the market when it enters the E.U., software is considered to remain on the market from the date that it is first made available. Consequently, software will generally fall within the CRA’s scope after that date only if it has been substantially modified, he elaborated.

The Guidance’s clarification around substantial modifications is “very important and useful” because when a company makes a substantial modification to its product, it may need to revisit its compliance protocols, Nauwelaerts said. Not every substantial modification triggers that result, however. For example, the Guidance indicates that pure security updates generally do not. It also clarifies that a company that substantially modifies another manufacturer’s product assumes manufacturer obligations and must overhaul compliance relating to that product. The E.U. AI Act has similar provisions.

Companies should have governance processes tied to the requirements of the CRA to identify and red-flag substantial modifications, Nauwelaerts recommended. This is particularly important regarding software, which is updated frequently, with different updates having different degrees of substantiality.

See “Recent Developments and Upcoming Obligations Under the E.U. AI Act” (Feb. 4, 2026).

Greater Certainty on Support Periods

The Guidance provides important details on support periods, which are the periods during which manufacturers must provide security updates and address vulnerabilities in products with digital elements. According to the Guidance, support periods should be based on the length of time the product is expected to remain in use, considering its nature, intended purpose and reasonable user expectations.

The minimum support period is five years, unless the life of the product is shorter, and this comes with an obligation to monitor for vulnerabilities and to patch them, Arlington noted.

The Guidance provides greater certainty around support periods, but companies still must consider how the end of support may affect relationships with customers, Nauwelaerts said. Companies should make sure that their customers are not uncomfortable with the lack of support after a certain period.

More Direction on Reporting Obligations

The Guidance clarifies that manufacturers must report actively exploited vulnerabilities and severe incidents within the applicable CRA timelines: early warning within 24 hours and full notification within 72 hours. It also provides important details about when the reporting clock starts and how companies should interpret key reporting concepts.

As of September 11, 2026, products with digital elements in the E.U. must monitor for and report actively exploited vulnerabilities and severe cyber incidents, which will require systems and compliance procedures, Arlington said. This deadline “is on the minds of a lot of the companies that we are advising [and] is quite important.”

The CRA’s rules on reporting obligations do not have an end date, and the Guidance confirms that they continue indefinitely, according to Arlington.

Materiality Threshold?

There are remaining questions around whether there is a materiality threshold for vulnerabilities, Whitehead said. With the sharp rise in the capabilities of frontier AI models to detect, identify and exploit vulnerabilities in software, and the fact that software inherently has vulnerabilities in it more often than not, the volume of vulnerabilities that are going to be identified and exploited increases exponentially. “Therefore, the question is, if one has an exploited vulnerability which does not cause any damage or disruption . . . does that still constitute a reportable event? If so, how are regulators going to handle that volume of reports?”

Timing Issues

The Guidance indicates that the 24-hour reporting period is triggered only when a company knows both that a vulnerability exists and that it has been actively exploited, which may occur some time after the vulnerability itself has been discovered, Whitehead noted. “The practical effect is that it provides organizations time to validate the findings of any kind of investigation they undertake in relation to a cybersecurity incident, to identify whether there truly has been an active exploitation of vulnerability, before they are on the clock and required to report,” he said.

It is helpful that the Guidance bases its reporting obligations on the familiar GDPR concept of “becoming aware” of an incident, Nauwelaerts said. As such, existing GDPR guidance may help companies interpret the CRA reporting requirements, he suggested. The CRA reporting timeline of 24 hours is shorter than that of the GDPR, but with the CRA, “the good news is that there is a single reporting platform that we still do not have for the GDPR. That is going to make it easier to meet those very tight reporting deadlines under the CRA,” he said.

Problems may arise from the Guidance’s suggestion that a customer report can start the manufacturer’s reporting clock, Nauwelaerts posited. In practice, however, companies frequently receive false alarms and usually do not consider themselves aware of an issue until they have confirmed it. Companies “will probably need to see case law in the future to bring more clarity on that,” unless the EC provides further guidance in the future, he said.

Need to Update Plans

Cloud services and cybersecurity providers are typically not used to telling regulators about vulnerabilities, as the CRA requires, Rita Heimes, senior counsel at Akin, told the Cybersecurity and AI Law Report. “It is a very awkward concept for them to need to report vulnerabilities to a government when they would normally maybe send out a patch but not talk about it beyond that. There will be some surprises,” she predicted.

Accordingly, companies need to update their incident response and reporting plans, playbooks and policies to align with the Guidance, “because the CRA’s reporting obligations are quite different from personal data breach notification obligations and a lot of other cybersecurity obligations seen globally at the moment,” Whitehead advised.

Many companies have incident response plans “built for information security incidents or operational security incidents, not necessarily built for product security incidents,” Heimes observed. Tweaking those plans “to conform to a product security compliance responsibility should not be a giant lift.” However, “it will take some time to right-size their program to the new requirements and also to train people who are not typically in the business of incident response because they are product and sales and customer service people,” rather than CISOs and cybersecurity professionals, she explained. Thus, the work should start now, she advised.

Further Detail on Risk Assessment and Due Diligence Requirements

The Guidance provides additional details about how manufacturers should satisfy the CRA’s risk assessment and due diligence requirements, including the need to maintain documentation of the risk assessment throughout a product’s lifecycle and to conduct ongoing due diligence regarding cybersecurity risks.

A due diligence questionnaire for suppliers is “a must,” Arlington advised. A company’s vendor management and cybersecurity teams should work together to verify suppliers’ responses. Where concerns arise, follow-up discussions with the supplier or an inspection may be appropriate, she added.

See “New E.U. Directive Expands Scope of Due Diligence” (May 15, 2024).

Enforcement Forecast

Drawing on the rollout of other E.U. digital regulations, there likely will not be significant enforcement during the first few months after the CRA takes effect, Whitehead predicted. This is not really a “grace period” because regulators need to get up to speed and build the resources needed to investigate under these regulations. “They are some way from major investigations in this area, although that may change given the speed at which cybersecurity incidents are occurring,” he said.

Compliance Tips

In many companies, the pressure to comply with the CRA is coming not from legal teams warning about fines, but from sales and finance teams concerned that unprepared products may not reach customers in Europe, Heimes observed. The CRA compliance deadlines will “hit people sooner than they realize.” There may be a lot of last-minute scrambling, she predicted.

Before making changes to comply with the CRA, companies should look first at their processes for complying with other laws, such as the GDPR, “to see to what extent they can reuse a lot of those processes that they have established instead of reinventing the wheel completely,” Nauwelaerts suggested.

First Steps

The first step companies should take toward CRA compliance is to conduct an inventory of their products that are in any way connected with the E.U., Arlington advised. The second priority is to implement processes to monitor actively exploited vulnerabilities and severe incidents and report them to the appropriate regulator. The third, she continued, is meeting the CRA’s essential cybersecurity requirements, including identifying and addressing vulnerabilities needed to obtain CE marking. Companies must determine whether they can achieve compliance in-house or need a third-party conformity assessment to determine if a product qualifies for CE marking, she said.

Meeting the CRA’s vulnerability testing and security-by-design requirements will take longer than many companies expect, Heimes warned.

Gap Assessment

Companies also should prioritize performing some kind of gap assessment, comparing their existing security measures and remote data processing solutions against the baseline CRA requirements, Whitehead advised.

Documentation

Although there is no explicit requirement under the CRA, it is a good idea for companies to keep a log of the specific products that they consider to be in scope of the CRA, Whitehead recommended. The log should, for example, identify which parts of a company’s cloud or back-end infrastructure fall within the CRA’s scope because they meet the definition of a remote data processing solution and which do not.

Whatever position a company takes on a CRA-related issue, it should always be able to demonstrate to a regulator why it took that position, Nauwelaerts emphasized. “Documentation is going to be key,” just as it is under the GDPR, the AI Act and the Data Act, he said. Companies should ensure not just documentation at the point of initial compliance, but continuous updated documentation of their compliance efforts, especially when there are changes that could potentially have an impact on the overall cybersecurity risk of products, he advised.

Keeping documentation up to date is not easy, Nauwelaerts continued. Companies often develop well-documented compliance frameworks for requirements such as those under the GDPR but fail to update them regularly. The CRA will present similar challenges, except that ongoing updates will be even more important and potentially more costly, he cautioned.

Training

Companies will have to undertake “awareness training, particularly for employees involved in managing vulnerabilities and security incidents, so they understand the expanded range of issues that could be reportable to regulators,” Whitehead said. “Ensuring that information security, product and IT teams, as well as other relevant stakeholders, understand these requirements will be important.”

See “What the E.U. Data Act Means for IoT Businesses Operating in Europe” (Apr. 15, 2026).

AI governance is becoming a core compliance function for investment advisers, with new survey data showing AI now far outpaces all other compliance concerns. The 2026 Investment Management Compliance Testing Report (Report) reveals that firms are increasing compliance testing around AI, cybersecurity and privacy more than any other areas, while also advancing AI governance through policies, approved-tool inventories and employee training.

The Report also sheds light on how advisers are addressing cybersecurity resilience, amended Regulation S‑P (Reg S‑P) requirements, compliance programs and resources, and third-party risk. This article discusses the key findings in the Report, with additional commentary from Aaron Pinnick, senior manager of thought leadership at ACA Group, a co-sponsor of the Report’s study. Other co-sponsors included the Investment Adviser Association (IAA) and Yuter Compliance Consulting (YCC).

See “ACA Study Finds Widespread, but Limited, Implementation of AI” (Jun. 24, 2026).

Respondent Demographics

This year’s Report is based on an online survey conducted in April and May 2026. It included compliance professionals from 411 investment advisers drawn from IAA members, ACA clients and YCC contacts.

About one-quarter of respondents have up to $1 billion in assets under management (AUM). More than one-third have between $1 billion and $10 billion. The remaining respondents have more than $10 billion in AUM, including 17% with more than $50 billion. Just over half of respondents have up to 50 full- and part-time employees, including 39% with between 11 and 50 employees. The rest have more than 50, including 28% with between 51 and 250 and 16% with more than 250.

Fifty-eight percent of respondents advise private funds, most commonly private equity funds (34%), long-only funds (32%), hedge funds (30%) and/or credit funds (24%). More than half of respondents also advise institutional clients (56%) and/or high-net-worth individuals (54%). More than one-third advise pension assets (38%), registered investment companies (37%) and/or retail investors, primarily those with accounts of less than $1 million (34%). Additionally, 24% advise family offices.

AI Is the Top Compliance Priority

The overwhelming majority of respondents (85%) identified AI as the “hottest” compliance topic this year, up from 57% in 2025, when it was also the top concern. More than one-third of respondents placed cybersecurity (37%) and/or privacy and Reg S‑P (35%) among the hottest compliance topics by a considerable margin. The next seven of the ten “hottest” topics included:

• advertising/marketing – 19%;
• prediction markets – 14%;
• vendor due diligence – 10%;
• digital assets – 9%;
• conflicts of interest – 9%;
• alternative investments for retail investors – 8%; and
• valuation – 7%.

Focus of SEC Exams

“SEC exams are still focused on areas that are of particular importance to private funds,” Pinnick told the Cybersecurity and AI Law Report. Respondents identified the following as the five most common focus areas of exams that took place closest to the study period:

• advertising/marketing (57%);
• books and records (53%);
• conflicts of interest (53%);
• fee calculation and billing (48%); and
• valuation (35%).

Compliance Programs

Testing

Respondents were asked whether their compliance testing in 47 areas had increased, decreased or remained the same year over year, explained Pinnick. AI, cybersecurity and privacy were the only three areas where more than half of respondents said they had increased testing. “For all other areas, the majority of firms reported no change in testing levels,” he said.

“In 2026, 72% of firms had increased their compliance testing around AI, 58% were increasing compliance testing around cybersecurity, and 57% were increasing compliance testing around privacy/Reg S‑P,” noted Pinnick. “These increases in compliance testing align broadly with new and evolving risks and compliance obligations facing firms. It is good to see firms increasing their compliance testing in these areas.”

On the other hand, just 32% of respondents said they increased testing of electronic communications surveillance, versus 61% that did so in 2025. Most of the rest (64%) made no change, and just 4% decreased testing. “This change is, at least in part, driven by the SEC’s shift in focus in 2026, as well as the fact that firms likely feel that their compliance testing around this topic has generally reached a level and maturity that aligns with regulatory expectations,” said Pinnick.

See “Risk and Compliance Survey Highlights the Role of Compliance in AI Governance” (Oct. 29, 2025).

Program Resources

Dual-Hatted CCOs

Forty percent of respondents said their CCOs do not have other positions within their organizations. The most common additional roles for CCOs include COO (19%), GC (17%), and CFO (12%). Just 2% have an outsourced CCO.

See “To Work Effectively, CCOs Need Authority, Autonomy and Information” (Nov. 13, 2024).

Budgets

About three-quarters of respondents said their firms spend between $100,000 and $2 million annually on their compliance departments, including 42% that spend between $100,000 and $500,000, and 34% that spend between $500,000 and $2 million. Just 12% said they spend less than $100,000. The remaining 12% spend at least $2 million.

See “Making the Case for Increased Privacy Budgets Using Data and Diplomacy” (May 8, 2019).

Staffing

More than two-thirds of respondents said their compliance departments (including the CCO) have between one and five staff members, including 45% with from two to five. The remaining 21% have at least six compliance staff members, including 6% with more than 20.

Considering the SEC’s stated goal of easing regulatory burdens, and what many perceive to be less aggressive enforcement, firms might have been expected to cut compliance resources. Nevertheless, staffing and budgets remained relatively stable, according to the Report.

“Based on our past data, we don’t tend to see a direct correlation between shifts in the SEC and compliance resourcing levels. . . . Ultimately, I believe the 2026 survey points to an expanding mandate for compliance leaders and their programs, despite what may be perceived to be a less aggressive SEC,” noted Pinnick. “[C]ompliance programs still have a good deal of new work in 2026 – complying with the amendments to Reg S‑P and managing the risks of AI adoption are two easy examples.” Additionally, firms that operate internationally may have compliance obligations associated with the E.U. Digital Operational Resilience Act, AI Act and other regulations, all of which require compliance resources.

See “Statistics on Privacy Staffing, Budgets and Compliance Culture” (Apr. 2, 2025).

AI Adoption and Governance

Widespread Use

Four-fifths of respondents have formally adopted AI tools, with 70% restricting those tools to internal use cases. Most of the rest (18%) are exploring AI tools but have not formally adopted them. Just 2% have banned or significantly restricted AI tools.

Robust Governance

Virtually all respondents have either established policies and procedures governing employees’ use of AI (86%) or are developing them (10%). Nearly as many maintain an inventory of approved AI tools (86%) or are creating them (8%). Additionally, 72% have updated training to encompass AI issues, and another 19% are in the process of updating their training.

Over half of respondents either have an AI governance committee (59%) or are developing one (10%). “The majority of firms have focused on establishing the policies and procedures to govern AI use by employees, building governance structures around AI tools and adoption, creating inventories of AI tools in use at the firm and training employees on the safe usage of AI,” observed Pinnick. “These findings suggest firms are prioritizing risks associated with shadow AI, as well as information security and privacy risks arising from AI tools,” he said.

Further reflecting the emphasis on AI governance, almost three-quarters (72%) of respondents have increased compliance testing.

“The next steps for firms as they continue to evolve in their use of AI and their risk management around those tools will be to formalize human oversight of AI outputs and tools, and to ensure that AI tools have formal processes for ongoing testing and validation,” continued Pinnick. “These steps can help firms minimize common AI risks like hallucinations and model drift.”

See “A Baker’s Dozen AI Governance Resolutions for 2026” (Jan. 7, 2026).

Business Continuity Planning

Most respondents review (88%) and/or update (81%) their business continuity plans (BCPs) at least annually. Testing, however, is somewhat less common, with just 77% testing at least annually. Notably, 13% do not test their BCP at all or have no formal testing cadence.

“Firms that do not test their BCP have a clear opportunity to improve organizational resilience. BCP testing can help ensure that the firm’s plans work in practice, identify blind spots and serve as an opportunity to remind key individuals about their role in the BCP,” advised Pinnick. “While the survey does not evaluate the effectiveness of firms’ business continuity programs, regular testing is generally recognized as an important component of organizational resilience.”

The most common scenarios respondents test include cybersecurity incidents (62%), critical vendor/service outages (48%) and/or facility inaccessibility (46%). Fewer test unauthorized access or use of customer data (31%) or unavailability of key persons (19%).

See “Business Continuity Plans, Budgets and More: Hot Compliance Topics for Investment Advisers” (Sep. 2, 2020).

Amended Reg S‑P

Respondents were also asked about their efforts to comply with the SEC’s June 2024 amendments to Reg S‑P, which broadened the scope of covered information and imposed new requirements for written incident response policies and procedures compliance documentation. The compliance dates for larger and smaller firms were, respectively, December 3, 2025, and June 3, 2026. A majority of respondents had amended their privacy policies and procedures (83%) and/or formalized their incident response plans (53%). Between 27% and 35% did some or all the following:

• updated books and records and data retention policies;
• created data maps;
• required vendors to agree to notify them of incidents;
• documented compliance with vendor-related requirements;
• conducted due diligence on vendor breach notification procedures; and/or
• conducted training.

Respondents’ top challenges in implementing amended Reg S‑P were associated with:

• Incident Notification: securing confirmation that vendors would provide notice of breaches within 72 hours (67%) and reaching agreements with clients’ custodians on incident notifications (16%);
• Third-Party Oversight: negotiating arrangements (48%) and agreeing on plans (20%) with third parties; and
• Data Management: mapping data fully (39%), documenting it (24%) and identifying sensitive customer information (22%).

“Survey respondents felt that the third-party oversight and incident notification requirements of the amendments were the most challenging to comply with,” noted Pinnick. “However, just because firms reported these areas as challenging does not mean that firms are unable to meet those expectations,” or that they did not achieve compliance, he said.

See “What to Know About the Sleeping Giant That Is the SEC’s Amended Reg S‑P” (Dec. 10, 2025); and “Small Firms Must Be Ready to Comply With Amended Regulation S‑P” (Apr. 29, 2026).

Third-Party Risk

Managing risks associated with vendors and other third parties is a perennial concern for investment advisers, according to the Report. In that regard, respondents indicated that, in the past year, they had changed their risk management programs in the following areas:

• Governance: updating policies and procedures (69%), introducing or updating vendor risk-tiering (58%), clarifying internal accountability for vendor oversight (49%) and/or improving internal tracking (31%);
• Due Diligence: expanding due diligence on key service providers (54%), and/or implementing or enhancing vendor risk reviews (27%); and
• Contracting: updating standard contract language (34%), reviewing or renegotiating contracts with key service providers (32%), and/or obtaining affirmative commitments (22%) or negative consent (14%) for Reg S‑P notification requirements.

“One area where firms can continue to mature and grow is their oversight of” the use of AI tools and technologies by the third parties with whom they do business, according to Pinnick. “Currently, only 30% of respondents report having established policies and procedures to govern AI use by third parties.” Thus, “firms should be sure to assess AI use by their vendors – especially those that have access to the firm’s client data – and establish policies and procedures to govern how third parties use AI tools to complete work for the firm,” he advised.

See “Contracting With Vendors to Mitigate Third-Party AI Risk” (Feb. 18, 2026).

Other Compliance Areas

The study also included what the Report calls a “lightning round” designed to identify trends in compliance areas including, for example, marketing and performance, gifts and entertainment, prediction markets, social media and fiduciary duty. The responses concerning prediction markets and social media were the most notable, according to the Report.

Controls Concerning Prediction Markets

Because prediction markets enable individuals to bet on a wide range of outcomes – including stock movements and other financial outcomes – they could increase risk of insider trading and money laundering, notes the Report. Nevertheless, most respondents (56%) have not made, and are not planning, any changes to their code of ethics or policies to address such markets. One-quarter are planning updates in the near future. “Many firms appear to be waiting for greater regulatory clarity before changing policies or relying on existing restrictions,” observes the Report.

Social Media Controls

Just over half of respondents conduct periodic training on their social media policies. More than one-third require annual attestations of compliance with such policies. The most common policies and controls for social media include:

• requiring preclearance of (47%) or prohibiting (39%) all posts concerning advisory services and for adding text to approved posts (29%);
• permitting reposting of approved corporate posts (45%);
• periodically sampling (37%) or reviewing all (22%) social media activity;
• limiting posting to LinkedIn (34%);
• exempting “business card” information from preclearance (33%); and
• preserving all corporate page activity (32%) and/or social media posts (30%).

See “Navigating Evolving Social Media Risks” (Nov. 30, 2022).