Consulting & Engineering in 2026: what changed
The Cyber Resilience Act starts to apply, and ITIL 5 arrives. Cisco, HPE and Microsoft estates, assessed first: supplied and integrated.
What changed this year for infrastructure assessment, requirements and program governance, and what to put in your requirement.¹
Every date comes from the vendor's or publisher's own page. Third-party reports are marked.
1. The Cyber Resilience Act
Its reporting obligations apply from September 11, 2026, and its main obligations from December 11, 2027. It lands on suppliers, so the design puts it to every supplier in a comparison.
Finished NVIDIA GB200 NVL72 racks from the rear, cabled and liquid-cooled: the supplier's product, where the Act's duties land. From NVIDIA's June 2025 film of how the racks are built.
2. ITIL Version 5
ITIL (Version 5) launched in 2026, with ITIL 4 alongside during the transition. The design uses whichever the client has adopted.
Staff at their screens in a live operations room. From Cisco's Norfolk Southern film.
3. Post-quantum deadlines, still a draft
NIST IR 8547 was still an initial public draft on September 27, 2026. Each quantum-vulnerable endpoint is dated against its proposed deadlines: for 112-bit security, deprecated after 2030 and disallowed after 2035.
Microsoft's Majorana 2 quantum chip in its mount. Photo: Microsoft, 2026.
4. Formats and standards
The cryptography inventory is kept in CycloneDX 1.7, adopted as ECMA-424 2nd edition in December 2025. ISO/IEC/IEEE 29148:2018, the standard for writing requirements, is still the current edition.
Engineers talking through the work on a data hall floor.
What this means for a buyer
A requirement written today should name the regulations that reach the supplier, and date every endpoint that a quantum computer could break.
Read the full blueprint, or request a quote for Consulting & Engineering.