Resources · Regulatory watch: North America
Compliance regulations USA 2026: where US and Canadian rules stand now
Twelve US and Canadian rules, their status in September 2026 and a page for each.
Where things stand
US and Canadian rules are moving on different clocks.
The FDA QMSR and California’s new CCPA regulations are in force. CMMC Phase 2 is suspended, and the proposed HIPAA Security Rule update has no final rule.
Most are regulations or frameworks with no certificate; regulators, customers and auditors judge your evidence. A Sterling consultant builds that evidence with your team, and Sustain™ keeps it current.
Regulations and frameworks
Twelve US and Canadian rules, each with its current status
Start with the rule your customers ask about.
- HIPAA Compliance Consulting in 60+ CountriesThe 2025 Security Rule proposal is not final; the current rule remains in effect.
- SOC 2 Readiness and Attestation Support in 60+ CountriesReports use the 2017 Trust Services Criteria with 2022 points of focus.
- CMMC 2.0 Certification Consulting for Defence SuppliersPhase 2 suspended on 13 July 2026; Phase 1 self-assessments still apply.
- NIST SP 800-171 Compliance Consulting in 60+ CountriesRev. 3 superseded Rev. 2 in May 2024, but Rev. 2 is enforced while CMMC is paused.
- NIST CSF 2.0 Implementation Consulting in 60+ CountriesVersion 2.0 remains current and voluntary; no newer version is announced.
- FedRAMP Compliance and Requirements: Authorization ConsultingThe Consolidated Rules for 2026 become mandatory for all stakeholders on 1 January 2027.
- FDA QMSR Compliance Consulting (21 CFR Part 820)In force since 2 February 2026, incorporating ISO 13485:2016 by reference.
- CCPA Compliance and Requirements: CPRA, Audits and ADMT RulesNew regulations took effect on 1 January 2026; ADMT duties apply from 1 January 2027.
- US State Privacy Laws Compliance and Requirements: One ProgrammeVirginia, Colorado, Connecticut, Texas and Oregon laws are all in force.
- GLBA Compliance and Requirements: Privacy Rule and FTC Safeguards RuleFTC notification for events affecting 500 or more consumers has applied since 13 May 2024.
- PIPEDA Compliance and Requirements: Canada’s Business Privacy LawCanada’s federal private-sector privacy law, last amended on 4 March 2025.
- NERC CIP Compliance and Requirements: Grid Security You Can ProveCIP-012-2 took effect on 1 July 2026; revised CIP standards follow on 1 July 2028.
Status lines reflect each page at its last update. The full list of US and Canadian pages is in the menu.
- 60+countries where Sterling has delivered certification
- 21countries with a Sterling office, eight regions, one coordinated team
- 2003the year the group began implementing ISO management systems; the same method, refined, since
- 8,100+client engagements across the group, from single-site SMEs to multinationals
FAQs
Compliance regulations USA 2026: common questions
Each page has the detail.
Which US compliance rules changed in 2026?
New CCPA regulations (1 January), the FDA QMSR (2 February) and NERC CIP-012-2 (1 July) took effect; CMMC Phase 2 was suspended on 13 July.
Is there a certificate for HIPAA, CCPA or NIST compliance?
No. Regulators, customers and auditors judge compliance; SOC 2 ends in a CPA firm’s report. Sterling does not certify or assess; it prepares the programme and evidence.
Can a US or Canadian rule apply to a company based elsewhere?
Often. CMMC has no location-based exception, and PIPEDA covers handling that crosses national borders.
Talk to a consultant
Know where each rule you face stands, and what it asks of you next.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice