Only 10% Could Report a Breach in 24 Hours (09/26/2026)

The number worth sitting with today is 38. That is the share of compliance and security professionals who told VinciWorks they would meet a 24 hour breach reporting deadline in theory but had never tested whether they could. A reporting obligation you have never rehearsed is one you will be meeting for the first time during the worst day of your year, with the clock already running. The UK bill that would impose it is still moving through Parliament, which makes now the cheap time to find out.

Top Compliance Alerts

1. Only 10% Confident They Could Meet UK Breach Reporting Deadlines

The UK Cyber Security and Resilience Bill, now in House of Lords committee, would require an initial notification to the regulator within 24 hours and a full report within 72 hours. In a VinciWorks survey of 156 IT, compliance, and security professionals, only 10% were confident they could meet those deadlines, and 38% said they would meet them in theory but had never tested the process, per Corporate Compliance Insights. The same roundup reports a Drata survey of 309 practitioners in the US, UK, and Canada in which 87% said they do not assess all of their third parties.

Operator Note: Run a timed tabletop against the 24 hour mark before any regulator asks you to. The usual sticking point is finding out who is authorized to send the notice and which facts they are allowed to state, long before the drafting becomes the problem.

2. China Drafts Its First Cross-Border Corruption Law

On August 28, China’s National People’s Congress Standing Committee released a draft Anti-Cross-Border Corruption Law, which would be China’s first law of its kind, per JD Supra. Multinationals with operations in China may soon face a third major anti-bribery regime alongside the FCPA and the UK Bribery Act, with its own definitions and enforcement priorities.

3. EmpCo Turns Greenwashing Into a Compliance Risk

The EU’s Empowering Consumers for the Green Transition rules make seemingly innocuous environmental wording a source of fines, moving greenwashing from a reputational problem to a regulatory one, per Corporate Compliance Insights. Marketing claims such as generic sustainability language now need the same substantiation file that a product safety claim would.

4. Two Executive Sentencings in One Week

DOJ announced sentencings for a failed bank CEO’s fraud and sanctions evasion scheme and a former oil trader’s foreign bribery scheme within a day of each other, per JD Supra. Both cases put individual executives in the frame, which is where enforcement pressure has been moving for some time.

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization’s security posture? Take our free Human Attack Surface Score assessment.