EU/Property Sector 4 May 2026: EDPB CEF 2026 coordinated enforcement — GDPR transparency obligations audited by 25 DPAs; real estate and property management firms included in cross-sector scope; DORA: financial entities in property/mortgage sector — BaFin ICT risk inspections Q1/Q2 2026; EU AI Act: property valuation and tenant-screening AI systems may qualify as high-risk under Annex III — conformity assessment deadline 2 Aug 2026; NIS2: property management platforms with digital infrastructure above thresholds now in scope; CISA/NCSC advisory: SOHO router/IoT device exploitation — estate agents and SMEs particularly exposed; CNIL France €42M FREE Mobile fine Jan 2026 — Art.32 security obligations now actively enforced; EU Digital Omnibus: proposes NIS2 compliance simplification for 28,700+ smaller entities (EDPB/EC/ANSSI/CNIL/CISA/NCSC, 4 May 2026) EU Estates 1 May 2026: DORA extended supplier chain obligations affect PropTech/estate management ICT providers — EBA/ENISA joint examination on 19-CTPP register underway; NIS2 audit deadline 30 Jun 2026 — building automation systems and smart-building controllers now in scope; EDPB CEF 2026 transparency sweep includes real-estate platforms with behavioural profiling; CISA/NCSC China-nexus botnet advisory relevant to OT/BMS environments. (EBA/ENISA/EDPB/CISA/NCSC, 1 May 2026) EU estates PM update 30 Apr 2026: EDPB Guidelines 2/2026 on smart-building biometric access — 6-week consultation window closes 11 June 2026; property-sector operators with facial-recognition entry systems or biometric time-attendance must submit responses and begin DPIAs now. CRA vulnerability reporting obligations confirmed 11 Sep 2026 — HVAC, BMS, smart-lock, and access-control vendors have 134 days to establish PSIRT contact and assess in-scope product status. eIDAS2 EU Digital Identity Wallets: December 2026 go-live confirmed — LP, fund-administration, and property-management platforms must model NIS2/DORA identity-intersection risk and update KYC/AML workflows. EDPB-EDPS Joint Opinion 4/2026: single EU data-breach notification entry point proposed — asset management and fund-administration operators would benefit from reduced cross-border reporting complexity (EDPB/EC/ENISA, 30 Apr 2026) EU estates Thursday 30 Apr 2026: EDPB Guidelines 2/2026 on smart-building biometric access — 6-week consultation closes 11 June 2026; property-sector operators advised to submit before end May. CRA vulnerability reporting obligations confirmed 11 Sep 2026 — HVAC/BMS/smart-lock vendors have 134 days to assess in-scope product status and establish PSIRT contact. EU AI Act Digital Omnibus legal scrubbing complete — journal publication target June 2026; Annex III high-risk AI deadline confirmed 2 Dec 2027 — building-management AI using biometric or automated decisions must begin compliance audits now. EDPB-EDPS Joint Opinion 4/2026 on Cybersecurity Act 2: single-entry point for data-breach notification proposed — affects asset management and fund-administration operators. eIDAS2 digital identity wallets go-live December 2026 — LP/fund-admin identity verification workflows need assessment (EDPB/EC/ENISA, 30 Apr 2026) EU estates Monday open 27 Apr 2026: EDPB Guidelines 2/2026 on smart-building biometric access — 6-week public consultation now OPEN; AI Act Digital Omnibus 2nd political trilogue TOMORROW (28 Apr) with NIS2 targeted amendments on same agenda — property-sector operators in scope as essential-entity candidates monitoring outcome; LP data-room quarterly attestation cycle opens this week — DORA-equivalence cryptographic controls now expected by EU-domiciled fund administrators; CJEU C-446/25 (landlord data retention) advocate-general opinion scheduled Q3 2026; CRA vulnerability reporting obligations confirmed 11 Sep 2026 — HVAC/BMS vendors must assess in-scope product status now (EDPB/EC/CJEU/ENISA, 27 Apr 2026) EU estates close 24 Apr 2026: EDPB Guidelines 2/2026 on smart-building biometric access — draft open for 6-week consultation; ENISA Thursday briefing confirms physical-cyber convergence in critical-infrastructure directive scope — HVAC/BMS vendors now in NIS2 essential-service supply chain; CJEU C-446/25 on landlord data retention periods listed for H2 2026 (EDPB/ENISA/CJEU, 24 Apr 2026) Estates & Property Thursday 23 Apr 2026 — NIS2 commercial property operator scoping guidance expected from EC Q2 2026 following Digital Omnibus trilogue (T-5); ICO precedent on property-tech data-room breach disclosure continues to harden in UK enforcement trajectory; LP quarterly data-room security attestation cycle opens this week with DORA-equivalence controls now expected for EU-domiciled fund administrators; quantum-safe transition cryptographic inventory T-9 months for long-lease archives (CNSA 2.0 / NCSC 2031 migration horizon); CYBERUK 2026 real-estate roundtable Day 3 (EC/ICO/NCSC/CNSA, 23 Apr 2026) EU/EMEA 22 Apr 2026: EDPB plenary IN SESSION — binding decisions on DPC AI-training Art. 60 cluster + dark-pattern/Art. 25 guidance adoption expected this afternoon; ENISA CRA single reporting portal technical workshop live with MS readiness now 73% (+2 since Mon); EBA DORA quarterly oversight review T-1 with register at 25 providers (EDPB/ENISA/EBA, 22 Apr 2026) EU 21 Apr 2026: EDPB finalises 22 Apr plenary agenda with draft binding decision on cross-border health-platform Art. 60 case; ENISA CRA single reporting portal benchmark up to 73%; EBA critical ICT TPP register grows to 25; EC pre-trilogue technical meeting Wednesday ahead of 28 Apr trilogue (EDPB/ENISA/EBA/EC, 21 Apr 2026) EU EDPB 20 Apr 2026: 22 Apr plenary agenda includes two Art. 60 binding decisions and dark-pattern/Art. 25 privacy-by-design guidance EU ENISA 20 Apr 2026: CRA single reporting portal technical readiness benchmark at 71% across member states; 8 still behind schedule EU EBA 20 Apr 2026: DORA critical ICT third-party designation register grows to 23 providers (from 19 in March) — concentration oversight active EU AI Act 20 Apr 2026: Digital Omnibus political trilogue confirmed for 28 Apr — amendment list circulated among Council, Parliament, and Commission delegations DORA: In force 17 Jan 2025 — Active enforcement: on-site ICT risk inspections and third-party oversight reviews underway (ESAs, 2026) NIS2: First audits due 30 Jun 2026 — Q1 2026 penalties issued in EU; 14 of 27 EU states now transposed; EU Digital Omnibus trilogue scheduled 28 Apr 2026 — proposes deadline extensions and compliance simplifications for 28,700 companies; Ireland NIS2 Bill H1 2026 amid EC infringement proceedings (Skadden/EC, Apr 2026) EU AI Act: High-risk AI obligations deadline 2 Aug 2026 — EU Digital Omnibus proposes delay to Dec 2027; CRA vulnerability reporting starts 11 Sep 2026 (EC/Hogan Lovells, Apr 2026) Global Breach Cost: $4.44M average — 241 days to detect & contain; AI-augmented attack surface expanding (IBM/Ponemon, 2026) CISO Personal Liability: NIS2 Art.20 + SEC/DOJ precedent — Director accountability now statutory in EU (2025–2026) Ransomware: Q1 2026: 2,165 victims (+18.5% annualised); March 2026: 808 victims; week 11–17 Apr: 185 incidents — Apr 13 saw 46 new victims in 24 hours; Qilin/DragonForce drive 21% of weekly volume; 7,500+ on leak sites 2025 (+58% YoY); attacks 4× faster; 80% AI-enabled; 87.6% double extortion (BlackFog/BreachSense/Unit42/Emsisoft/Ransom-DB, Apr 2026) Geopolitical CNI: CISA AA26-097a (7 Apr 2026) — Iranian-affiliated APT targeting internet-exposed PLCs in US water/wastewater and CNI sectors; 75+ Unitronics HMI devices compromised. Iran-linked Handala claimed attack on Stryker Corp (11 Mar 2026) disrupting manufacturing and shipping. Volt Typhoon maintains 5+ yr persistence across US energy/water/transport CNI (CISA/FBI/Palo Alto, Apr 2026) Supply Chain: 1,700+ malicious packages across npm/PyPI/Go/Rust (North Korea); kube-health-tools Kubernetes tunnel implant campaign active Apr 2026; Axios/TeamPCP hit 60+ packages — CISA KEV Fortinet CVE-2026-35616 (Datadog/Zscaler/CISA, Apr 2026) UK Online Safety Act: full enforcement 2026 — UK CS&R Bill expanding NIS Regulations to digital supply chains; PSTI Act fines up to £10M or 4% turnover for non-compliant IoT (Ofcom/DSIT, Apr 2026) Patch Tuesday Apr 2026: 167 vulns patched — CVE-2026-32201 SharePoint zero-day actively exploited; Cisco 4 critical flaws in Identity Services & Webex enabling code execution (Microsoft/Cisco, 19 Apr 2026) Data Breaches Apr 2026: ShinyHunters leak 78.6M Rockstar Games records via Snowflake auth tokens; 13.5M McGraw Hill accounts stolen via Salesforce breach (Integrity360/SharkStriker, Apr 2026) Insider & NHI Risk: $19.5M avg per org (+123% since 2018); Thales 2026: 61% cite AI as #1 data risk; 47% sensitive cloud data unencrypted; SpyCloud 2026: 65.7B identity records recaptured (+23% YoY), 18.1M exposed API keys; IBM X-Force: 300,000+ ChatGPT credentials exposed (Proofpoint/IBM/Thales/SpyCloud, Apr 2026) NCSC UK (7 Apr 2026): APT28 / Russian GRU exploiting compromised internet routers for DNS hijacking — intercepting credentials, tokens, and email traffic across UK personal networks; immediate router patching and credential rotation advised (NCSC, Apr 2026) Belgium NIS2 Audit Window OPEN (18 Apr 2026) — first EU member state to hit hard NIS2 conformity assessment deadline; essential entities now require BELAC-accredited Conformity Assessment Body sign-off (CCB Belgium, Apr 2026) GDPR Enforcement: CNIL fines Free Mobile €27M for failing to protect 24M subscriber contracts (Oct 2024 breach); UK ICO fines Reddit £14M for child safety/age-check failures — regulators applying upper Article 83 range to systemic failings (CNIL/ICO, Apr 2026) Live Breaches Wk of 14–19 Apr: Basic-Fit (200K NL members + 1M bank details exposed); Booking.com customer reservation data breach notified 12 Apr; Zerion crypto wallet device compromise — ~$100K stolen 16 Apr (BreachSense/SharkStriker, Apr 2026) ENISA 2026 Risk Landscape Report (Apr 2026): availability/DDoS and ransomware top operational threat categories; threat-actor convergence accelerating — same vulnerability chains active across financially and ideologically motivated campaigns (ENISA, Apr 2026) France: CNIL maintient une cadence de sanctions élevée — €27M Free Mobile + €15M Free (Jan 2026), €5M France Travail (Jan 2026), €325M Google (Sep 2025); ANSSI accélère la transposition NIS2 française et la préparation des entités essentielles aux audits 2026 — fenêtre belge ouverte le 18 avril 2026 sert de référence opérationnelle (CNIL / ANSSI / CCB Belgique, avr. 2026) 900 Peer-reviewed governance frameworks · Retained across Tier-1 boards · Contract-winning evidence chains
EU estates PM update 30 Apr 2026: EDPB Guidelines 2/2026 on smart-building biometric access — 6-week consultation window closes 11 June 2026; property-sector operators with facial-recognition entry systems or biometric time-attendance must submit responses and begin DPIAs now. CRA vulnerability reporting obligations confirmed 11 Sep 2026 — HVAC, BMS, smart-lock, and access-control vendors have 134 days to establish PSIRT contact and assess in-scope product status. eIDAS2 EU Digital Identity Wallets: December 2026 go-live confirmed — LP, fund-administration, and property-management platforms must model NIS2/DORA identity-intersection risk and update KYC/AML workflows. EDPB-EDPS Joint Opinion 4/2026: single EU data-breach notification entry point proposed — asset management and fund-administration operators would benefit from reduced cross-border reporting complexity (EDPB/EC/ENISA, 30 Apr 2026) EU estates close 24 Apr 2026: EDPB Guidelines 2/2026 on smart-building biometric access — draft open for 6-week consultation; ENISA Thursday briefing confirms physical-cyber convergence in critical-infrastructure directive scope — HVAC/BMS vendors now in NIS2 essential-service supply chain; CJEU C-446/25 on landlord data retention periods listed for H2 2026 (EDPB/ENISA/CJEU, 24 Apr 2026) Estates & Property Thursday 23 Apr 2026 — NIS2 commercial property operator scoping guidance expected from EC Q2 2026 following Digital Omnibus trilogue (T-5); ICO precedent on property-tech data-room breach disclosure continues to harden in UK enforcement trajectory; LP quarterly data-room security attestation cycle opens this week with DORA-equivalence controls now expected for EU-domiciled fund administrators; quantum-safe transition cryptographic inventory T-9 months for long-lease archives (CNSA 2.0 / NCSC 2031 migration horizon); CYBERUK 2026 real-estate roundtable Day 3 (EC/ICO/NCSC/CNSA, 23 Apr 2026) EU/EMEA 22 Apr 2026: EDPB plenary IN SESSION — binding decisions on DPC AI-training Art. 60 cluster + dark-pattern/Art. 25 guidance adoption expected this afternoon; ENISA CRA single reporting portal technical workshop live with MS readiness now 73% (+2 since Mon); EBA DORA quarterly oversight review T-1 with register at 25 providers (EDPB/ENISA/EBA, 22 Apr 2026) EU 21 Apr 2026: EDPB finalises 22 Apr plenary agenda with draft binding decision on cross-border health-platform Art. 60 case; ENISA CRA single reporting portal benchmark up to 73%; EBA critical ICT TPP register grows to 25; EC pre-trilogue technical meeting Wednesday ahead of 28 Apr trilogue (EDPB/ENISA/EBA/EC, 21 Apr 2026) DORA: In force 17 Jan 2025 — Active enforcement: on-site ICT risk inspections and third-party oversight reviews underway (ESAs, 2026) NIS2: First audits due 30 Jun 2026 — Q1 2026 penalties issued in EU; 14 of 27 EU states now transposed; EU Digital Omnibus trilogue scheduled 28 Apr 2026 — proposes deadline extensions and compliance simplifications for 28,700 companies; Ireland NIS2 Bill H1 2026 amid EC infringement proceedings (Skadden/EC, Apr 2026) EU AI Act: High-risk AI obligations deadline 2 Aug 2026 — EU Digital Omnibus proposes delay to Dec 2027; CRA vulnerability reporting starts 11 Sep 2026 (EC/Hogan Lovells, Apr 2026) Global Breach Cost: $4.44M average — 241 days to detect & contain; AI-augmented attack surface expanding (IBM/Ponemon, 2026) CISO Personal Liability: NIS2 Art.20 + SEC/DOJ precedent — Director accountability now statutory in EU (2025–2026) Ransomware: Q1 2026: 2,165 victims (+18.5% annualised); March 2026: 808 victims; week 11–17 Apr: 185 incidents — Apr 13 saw 46 new victims in 24 hours; Qilin/DragonForce drive 21% of weekly volume; 7,500+ on leak sites 2025 (+58% YoY); attacks 4× faster; 80% AI-enabled; 87.6% double extortion (BlackFog/BreachSense/Unit42/Emsisoft/Ransom-DB, Apr 2026) Geopolitical CNI: CISA AA26-097a (7 Apr 2026) — Iranian-affiliated APT targeting internet-exposed PLCs in US water/wastewater and CNI sectors; 75+ Unitronics HMI devices compromised. Volt Typhoon maintains 5+ yr persistence across US energy/water/transport CNI (CISA/FBI/Palo Alto, Apr 2026) Supply Chain: 1,700+ malicious packages across npm/PyPI/Go/Rust (North Korea); kube-health-tools Kubernetes tunnel implant campaign active Apr 2026 (Datadog/Zscaler/CISA, Apr 2026) UK Online Safety Act: full enforcement 2026 — UK CS&R Bill expanding NIS Regulations to digital supply chains (Ofcom/DSIT, Apr 2026) Patch Tuesday Apr 2026: 167 vulns patched — CVE-2026-32201 SharePoint zero-day actively exploited (Microsoft/Cisco, 19 Apr 2026) Data Breaches Apr 2026: ShinyHunters leak 78.6M Rockstar Games records; 13.5M McGraw Hill accounts stolen (Integrity360/SharkStriker, Apr 2026) Insider & NHI Risk: $19.5M avg per org (+123% since 2018); Thales 2026: 61% cite AI as #1 data risk (Proofpoint/IBM/Thales/SpyCloud, Apr 2026) NCSC UK (7 Apr 2026): APT28 / Russian GRU exploiting compromised internet routers for DNS hijacking — intercepting credentials, tokens, and email traffic across UK personal networks; immediate router patching and credential rotation advised (NCSC, Apr 2026) Belgium NIS2 Audit Window OPEN (18 Apr 2026) — first EU member state to hit hard NIS2 conformity assessment deadline; essential entities now require BELAC-accredited Conformity Assessment Body sign-off (CCB Belgium, Apr 2026) GDPR Enforcement: CNIL fines Free Mobile €27M for failing to protect 24M subscriber contracts (Oct 2024 breach); UK ICO fines Reddit £14M for child safety/age-check failures — regulators applying upper Article 83 range to systemic failings (CNIL/ICO, Apr 2026) Live Breaches Wk of 14–19 Apr: Basic-Fit (200K NL members + 1M bank details exposed); Booking.com customer reservation data breach notified 12 Apr; Zerion crypto wallet device compromise — ~$100K stolen 16 Apr (BreachSense/SharkStriker, Apr 2026) ENISA 2026 Risk Landscape Report (Apr 2026): availability/DDoS and ransomware top operational threat categories; threat-actor convergence accelerating — same vulnerability chains active across financially and ideologically motivated campaigns (ENISA, Apr 2026) France: CNIL maintient une cadence de sanctions élevée — €27M Free Mobile + €15M Free (Jan 2026), €5M France Travail (Jan 2026), €325M Google (Sep 2025); ANSSI accélère la transposition NIS2 française et la préparation des entités essentielles aux audits 2026 — fenêtre belge ouverte le 18 avril 2026 sert de référence opérationnelle (CNIL / ANSSI / CCB Belgique, avr. 2026) 900 Peer-reviewed governance frameworks · Retained across Tier-1 boards · Contract-winning evidence chains