115+ Cybersecurity Compliance Statistics for 2026: Breach Costs, GDPR and HIPAA Fines, Framework Adoption and AI

Cybersecurity compliance statistics for 2026 show what non-compliance costs, what regulators enforce and how far programs still have to go. Non-compliance with regulations added $201,112 to the average cost of a breach in 2026 (1). EU and European Economic Area (EEA) data protection authorities issued €1,145,760,374 in General Data Protection Regulation (GDPR) fines in 2025 (2). In the United States, the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) initiated no HIPAA audits in 2024 "due to a lack of financial resources" (3).

The compliance facts below are for compliance leads, chief information security officers (CISOs) and founders preparing for SOC 2, ISO 27001, HIPAA, the Payment Card Industry Data Security Standard (PCI DSS), Cybersecurity Maturity Model Certification (CMMC) or GDPR. Each figure links to the report or regulator that published it.

Top cybersecurity compliance stats for 2026

• The average data breach cost a record $4.99 million in 2026 (1).
• 85% of executives PwC surveyed in 2025 say compliance requirements have grown more complex in three years (4).
• 48% of breaches in Verizon's 2026 Data Breach Investigations Report (DBIR) involved a third party (5).
• Breaches reported by HIPAA business associates accounted for 85% of the individuals affected by large breaches that occurred in 2024 (6).
• The HIPAA regulation caps penalties for identical violations at $2,190,294 per calendar year, as adjusted on 28 January 2026 (7, 8).
• The Justice Department recovered over $52 million in nine cybersecurity fraud settlements under the False Claims Act in fiscal year 2025 (9).
• 14.3% of the organizations in Verizon's 2024 Payment Security Report were fully PCI DSS compliant at interim validation in 2023 (10).
• 96,709 ISO/IEC 27001 certificates were valid worldwide in 2024 (11).
• Nearly 2,000 defense contractors held CMMC Level 2 (Final) certification as of 15 July 2026 (12).
• Regulatory compliance was the main driver of cybersecurity investment for 70% of the EU organizations ENISA surveyed in 2025 (13).
• 55% of cybersecurity teams in ISACA's 2025 survey were understaffed (14).
• 59% of the governance, risk and compliance (GRC) practitioners surveyed for the State of GRC 2026 used no commercial GRC tool (15).

Methodology and sources

• Regulators and agencies: HHS Office for Civil Rights reports to Congress for 2020 to 2024, the European Data Protection Board and national authorities' 2025 annual reports, the Justice Department, the FTC, the FBI's IC3, the Department of Defense and The Cyber AB, the CMMC accreditation body.
• Breach research: IBM's Cost of a Data Breach Report 2026, whose year label is the publication year, not necessarily the breach year (1); Verizon's 2026 Data Breach Investigations Report and 2024 Payment Security Report; Coalition's 2026 Cyber Claims Report on its policyholders' claims.
• Surveys of organizations and professionals: PwC's 2025 Global Compliance Survey of 1,802 executives (4), ENISA's NIS Investments 2025 study of EU organizations, the Thomson Reuters Institute's 2025 C-Suite Survey, ISACA's State of Cybersecurity 2025 and State of Privacy 2026, ISC2's 2025 Cybersecurity Workforce Study, the IAPP's privacy and AI governance reports, and GRC Engineer's State of GRC 2026 (795 responses) (15).
• Vendor surveys: NAVEX's 2026 State of Risk & Compliance, nearly 1,200 risk and compliance leaders, and Hyperproof's 2026 IT Risk and Compliance Benchmark Report, 1,002 IT risk and compliance professionals surveyed in November and December 2025 (16, 17).

Sources were checked from 10 to 15 September 2026.

The state of compliance in 2026

• 85% of 1,802 executives PwC surveyed in 2025 say compliance requirements have grown more complex in the last three years (4).

"Compliance is not just about passing audits. Compliance now requires instrumentation and mechanisms to ensure your obligations, to your customers, are being met ..."
Anil Markose, Chief Compliance Officer, Oracle SaaS, in PwC's 2025 Global Compliance Survey (18).

• 51% of the executives PwC surveyed ranked cybersecurity among their top five compliance risks in 2025, and 51% ranked data protection and privacy there (4).
• 70% of the EU organizations ENISA surveyed in 2025 named regulatory compliance, including the NIS2 Directive, as the main driver of their cybersecurity investment (13).
• 45% of the EU organizations ENISA surveyed named better regulatory compliance as a key outcome of their cybersecurity investment in 2025 (13).
• 19 EU Member States received reasoned opinions in May 2025 for not fully transposing the NIS2 Directive, and on 8 July 2026 the European Commission took Ireland, Spain, France and the Netherlands to the Court of Justice over it, asking for financial sanctions (19, 20).
• 19 US states had passed comprehensive consumer privacy laws by October 2025 (21).
• 68% of the C-suite leaders the Thomson Reuters Institute surveyed called compliance and reporting tasks a moderate or significant constraint on enabling functions such as technology and operations in 2025 (22).
• 47% of the risk and compliance leaders NAVEX surveyed in 2026 describe compliance programs as a "necessary evil" that can inhibit business (16).

Compliance maturity and readiness gaps

• Just 7% of the executives PwC surveyed considered their company a leader in compliance in 2025 and 31% called it mature, while 84% aim to be leading or mature within three years (4).
• 91% of the privacy professionals the IAPP surveyed were at least somewhat confident their organization could meet privacy requirements in 2024, while 99% faced challenges delivering privacy compliance (23).
• 46% of the privacy professionals ISACA surveyed are very or completely confident their team can comply with new privacy laws in 2026 (24).

Third-party and vendor risk statistics

• 48% of breaches involved a third party in the 2026 DBIR, up 60% in a year (5).
• Business associates filed 16% of the reports of HIPAA breaches affecting 500 or more individuals that occurred in 2024, and those breaches accounted for 85% of all affected individuals, 206,921,071 people (6).
• 32% of breaches at healthcare organizations involved a third party in the 2026 DBIR (5).
• Only 23% of third-party organizations fully fixed missing or weak multifactor authentication (MFA) on their cloud accounts in the 2026 DBIR (5).
• 90% of the EU organizations ENISA surveyed had specific controls for third-party and supply chain security in 2025 (13), yet 47% still named supply chain attacks a top concern, their second most cited (13).
• Supply chain breaches, where a compromised business partner became the attack vector, were the costliest breach factor in 2026, adding $227,250 to the average breach (1).
• 34% of Hyperproof's respondents still tracked third-party risk in spreadsheets in 2026 (17).
• 19 cloud and IT providers, including Amazon Web Services, Google Cloud, Microsoft, Oracle and SAP, were designated critical ICT third-party providers under the EU's Digital Operational Resilience Act (DORA) in November 2025 (25).
• Requiring suppliers to comply with security standards and maintain certifications was the most common supplier security measure among the EU organizations ENISA surveyed in 2025, at 63% (13).

Table 1: The most common third-party and supply chain security measures, 2025. Source: ENISA. (13)

For a buyer, that is a reason to ask vendors how quickly they fix what an assessment finds, not only which certificates they hold.

The cost of compliance vs. the cost of non-compliance

Compliance carries two price tags: the budget a program needs to run, and what an incident costs when controls fail.

• Cybersecurity accounted for 9% of total IT budgets in 2024, with a median cybersecurity spend of €1.5 million, among the EU organizations ENISA surveyed (13).
• Mean compliance program budgets in NAVEX's 2026 survey rose with maturity, from $700,000 for underdeveloped programs to $3.5 million for adapting ones and $12 million for optimizing ones (26).
• HHS estimated in January 2025 that its proposed HIPAA Security Rule update would cost regulated entities about $9 billion in the first year and about $6 billion a year in years two to five (27).
• The Department of Defense (DoD) estimates its 2025 CMMC acquisition rule costs the public $38,580,316 a year over 10 years (28).
• A CMMC Level 2 certification assessment by a C3PAO costs a small entity $101,752, against $34,277 for a Level 2 self-assessment, by DoD's 2024 estimate (29).

Table 2: DoD's cost estimates per CMMC assessment in the CMMC Program final rule of 15 October 2024. They cover the assessment and affirmation, not implementing the requirements. Source: DoD. (29)

Breach and non-compliance costs

• The global average cost of a data breach reached a record $4.99 million in 2026, up 12% in a year and driven by higher detection, escalation and lost business costs (1).

"AI is making attacks faster and cheaper, while breaches keep getting more expensive. When organizations have an extended gap between discovery and remediation, that imbalance shows up directly in breach costs."
Suja Viswesan, VP, IBM Security Software, on the 2026 report (30).

• Non-compliance with regulations added $201,112 to the average cost of a breach in 2026 (1).
• Cyber insurance claims at Coalition averaged $116,000 in 2025, down 19%, while claims frequency rose 3% (31).
• Losses reported to the FBI's Internet Crime Complaint Center (IC3) reached $20.877 billion in 2025 across 1,008,597 complaints, 26% more than in 2024 (32).

Learn more: the CMMC certification cost guide covers what drives a defense contractor's budget.

Breach response, recovery and remediation times

• Identifying and containing a breach took 247 days on average in 2026, 183 to identify and 64 to contain, ending a five-year decline (1).
• Breaches that took more than 200 days to identify and contain cost $5.65 million on average in 2026, against $4.32 million for faster ones (1).
• 28% of the EU organizations ENISA surveyed took more than three months to patch critical vulnerabilities in 2025 (13).
• 4% of breached organizations fully recovered in under 50 days in 2026, and full recovery includes having "met compliance obligations, such as paying fines" (1).

Cybersecurity compliance statistics by framework

HIPAA compliance statistics

OCR enforces HIPAA compliance and reports to Congress each year on breaches of unsecured protected health information (3, 6).

• From 2018 to 2023, breaches of protected health information reported to HHS rose 100% and the number of people they affected rose 950%; breaches involving hacking rose 260% and ransomware 264% (27).
• Hacking and IT incidents caused 81% of the large HIPAA breaches, those affecting 500 or more people, that occurred in 2024, and they affected 241,582,022 people (6).
• The Change Healthcare breach affected approximately 192.7 million people, Change Healthcare reported to OCR on 31 July 2025 (33).
• Healthcare organizations had the costliest data breaches of any industry for the 13th year running in 2026, at $6.64 million per breach on average, down 10.5% (1).
• Health care providers filed 505 (76%) of the reports of large HIPAA breaches that occurred in 2024, affecting 34,456,670 people, and health plans filed 50 (8%), affecting 1,303,493 (6).
• OCR's investigations of 2024 HIPAA breaches found five Security Rule areas needing improvement: risk analysis, risk management, information system activity review, audit controls and person or entity authentication (6).
• Impermissible uses and disclosures were the top issue alleged in the 28,228 HIPAA complaints OCR resolved in 2024, in 660 complaints (3).

Table 3: The top five issues alleged in the 28,228 HIPAA complaints OCR resolved in 2024. Source: HHS Office for Civil Rights. (3)

HIPAA fines and enforcement statistics

• OCR received between 27,182 and 34,077 new HIPAA complaints a year from 2020 to 2024 and initiated no HIPAA audits in any of those years (3, 34, 35, 36, 37).

"OCR did not initiate any audits in 2024 due to a lack of financial resources."
HHS Office for Civil Rights, report to Congress for 2024 (3).

Table 4: HIPAA complaints, compliance reviews, audits and large breaches by calendar year, 2020 to 2024. A breach spanning more than one year is counted in its last year. Source: HHS Office for Civil Rights. (3, 6, 34, 35, 36, 37, 38, 39, 40, 41)

• 663 of the 730 compliance reviews OCR initiated in 2024 followed a report of a breach affecting 500 or more individuals; two followed smaller breach reports, and 65 came from multiple complaints about one entity, media reports or other means (3).
• Nine OCR complaint investigations ended in 2024 with a settlement or a civil money penalty, totaling $1,180,781, and 13 compliance reviews ended the same way, totaling $8,763,831 (3). Since 2003 OCR has settled or penalized 152 cases for $144,878,972, as of October 2024 (42).
• After HHS's inflation adjustment of 28 January 2026, the HIPAA penalty tier for willful neglect not corrected within 30 days runs from $73,011 to $2,190,294 per violation, for violations that occurred on or after 2 November 2015 (7).

Table 5: HIPAA civil monetary penalty amounts by culpability tier, as adjusted on 28 January 2026. Source: HHS. (7, 8)

• In practice the annual caps are lower: HHS's April 2019 notice of enforcement discretion set them at $25,000, $100,000, $250,000 and $1,500,000 by tier, to be used "as adjusted for inflation, until further notice" (43). The 2026 adjustment gives no adjusted figure for the three lower caps (7).
• OCR's $1,500,000 civil money penalty against Warby Parker, final in December 2024, applied the reasonable-cause tier to three Security Rule violations, risk analysis, risk management and information system activity review, capped at $100,000 per violation per calendar year (44, 45).

GDPR fines and compliance statistics

• EU and EEA data protection authorities issued €1,145,760,374 in GDPR fines in 2025 (2).
• Two fines on TikTok made up €530 million of the Irish Data Protection Commission's €530.77 million in 2025 fines (46).
• Ireland's authority issued €530,773,000 in GDPR fines across 4 fines in 2025, and France's €486,854,500 across 84 (2).

Table 6: The ten EU and EEA supervisory authorities with the largest GDPR fine totals in 2025, of 30 listed. Source: European Data Protection Board (EDPB). (2)

Slovakia, Germany and Spain issued the most fines (2). For a GDPR compliance program, your own authority's line says more than the EU-wide total.

• France's CNIL issued 83 sanctions totaling €486,839,500 in 2025, with cookies, employee surveillance and data security as the main subjects, plus 143 formal notices to comply, 31 reminders of legal obligations and two warnings (47).
• 414 cross-border cases were created in the EDPB's case register in 2025, and 1,299 One-Stop-Shop procedures under Article 60 GDPR were triggered, of which 572 produced final decisions (2).
• The Irish Data Protection Commission received 6,521 valid data breach notifications in 2025 (46).
• The UK Information Commissioner's Office issued eight UK GDPR fines totaling £32,402,373 in the year to March 2026, up from two, led by Reddit (£14,472,500) and Capita (£14,000,000, after a cyber-attack) (48).

Learn more: a guide to the consequences of non-compliance covers the direct and indirect costs across industries.

CMMC and NIST SP 800-171 compliance statistics

The security requirements for CMMC compliance at Level 2 are identical to those in National Institute of Standards and Technology (NIST) SP 800-171 Revision 2 (49).

• CMMC has 15 Level 1, 110 Level 2 and 24 Level 3 security requirements in 2026 (49).
• 337,968 prime contractors and subcontractors will be subject to CMMC, 229,818 of them (68%) small entities, by DoD's estimate in its 2025 Defense Federal Acquisition Regulation Supplement (DFARS) rule (28).
• Nearly 2,000 defense contractors held CMMC Level 2 (Final) certification as of 15 July 2026 (12).
• DoD's 2024 rule projected C3PAO assessments rising from 135 in the first year to 4,452 in the fourth, and 8,350 medium and large entities needing Level 2 certification (29).
• About 80% of the authorized or accredited C3PAOs were small businesses in August 2026 (50).
• There were 110 authorized C3PAOs and over 1,000 CMMC Certified Assessors as of 15 July 2026 (12).

Table 7: The CMMC ecosystem as of 15 July 2026. Source: The Cyber AB. (12)

• The Justice Department recovered over $52 million in nine cybersecurity fraud settlements in fiscal year 2025, and such settlements "have more than tripled in each of the past two years" (9).
• Health Net Federal Services and Centene Corporation paid $11.2 million in fiscal year 2025 to resolve allegations that Health Net falsely certified compliance with cybersecurity requirements (9).

Table 8: Cybersecurity fraud settlements under the False Claims Act named by the Justice Department for fiscal year 2025. Source: U.S. Department of Justice. (9)

The CMMC Phase II suspension

On 13 July 2026 the Department of War, the Department of Defense's secondary name under Executive Order 14347, suspended CMMC Phase II requirements (51, 52). What changed and what did not:

• Phase I stays. It began on 10 November 2025, when the revised DFARS clause 252.204-7021 took effect, and the Department's CMMC page states that "All Phase I self-assessment requirements remain firmly in place" (51, 53).
• Third-party assessments are paused in new requirements. While the suspension lasts, requiring activities may ask only for CMMC Level 1 (Self) or Level 2 (Self) assessments, not Level 2 (C3PAO) or Level 3 assessments (54). Existing C3PAO and Level 3 requirements are to be removed from active solicitations, and from existing contracts at the next option period or administrative modification (54).
• The underlying rules do not change. DFARS 252.204-7012 remains in effect, the Department will enforce NIST SP 800-171 Revision 2 through self-assessments and select government-led assessments, and Revision 2 remains the assessment standard until Revision 3 is written into the CMMC Program rule (53, 54).
• Certification is still available. On 15 July 2026, The Cyber AB stated that only Phase II implementation had been suspended and that C3PAO Level 2 certification assessments remained operational and available (12).

"NIST SP 800-171 and DFARS 7012 requirements remain in place and unchanged for most all [sic] contractors."
Matthew Travis, Chief Executive Officer, The Cyber AB, 15 July 2026 (12).

For a defense contractor, the practical reading is that the requirement to pass a third-party assessment is paused, while the NIST SP 800-171 obligations behind it are not.

Learn more: the CMMC compliance guide explains the levels and the certification process.

PCI compliance statistics

Verizon's 2024 Payment Security Report measures how many organizations keep full PCI DSS compliance between assessments (10, 55).

• 14.3% of the organizations in Verizon's 2024 Payment Security Report were fully PCI DSS compliant at interim validation in 2023 (10).

"During the lifetime of PCI DSS v3.2.1, fewer than half of organizations demonstrated that they developed and maintained a robust, sustainable PCI security program that enabled them to rapidly detect and correct controls that are not in place."
Verizon, 2024 Payment Security Report (10).

• PCI DSS v4.0 added 64 new requirements, 51 of which became mandatory on 31 March 2025; v4.0.1, the only active version since 31 December 2024, added none (56, 57).
• The overall control gap across the 12 PCI DSS key requirements was 4.5% in 2023, below its 7.7% peak in 2019 but up from 3.2% in 2022 (10).
• Requirement 11 (security testing of systems and networks) had the largest control gap in 2023, followed by Requirements 6 (secure systems and software), 10 (logging and monitoring of access) and 2 (secure configurations) (10).

SOC 2 and ISO 27001 compliance statistics

The American Institute of CPAs (AICPA) defines a SOC 2 compliance report as covering controls relevant to security, availability, processing integrity, confidentiality or privacy (58).

• SOC 2 examinations at the 74 CPA firms that answered the AICPA's 2020 survey rose 49%, from 1,064 in 2018 to 1,587 in 2020 (59).
• 96,709 certificates for ISO 27001 compliance covering 179,877 sites were valid worldwide in 2024, as counted by ISO from accredited certification bodies' reports (11).
• All ISO/IEC 27001:2013 certificates had to move to the 2022 version or expire by 31 October 2025 (60).
• For comparison with ISO/IEC 27001, the quality management standard ISO 9001:2015 had 1,474,118 valid certificates covering 2,321,640 sites in 2024 (11).

Table 9: Valid certificates and sites for management system standards beside ISO/IEC 27001, 2024. The 2024 edition is the first compiled from the IAF CertSearch database, so it is a level, not a trend, and German counts are incomplete. Source: ISO. (11)

The Trust Services Criteria and the Type 1 and Type 2 reports are covered in the explainer on what a SOC 2 report is.

Compliance budgets, staffing and skills

Surveys of security professionals show budgets under pressure and teams that stay small, even as the compliance workload grows.

Compliance budgets and investment

• 53% of cybersecurity teams in ISACA's 2025 survey called their budget underfunded, down from 59% a year earlier, and 43% of privacy teams did so in 2026 (14, 24).

Table 10: Budget outlook among cybersecurity and privacy professionals, 2025 and 2026. Source: ISACA. (14, 24)

• 33% of 16,029 cybersecurity practitioners ISC2 surveyed in 2025 say their organization lacks the resources to staff their team, and 29% cannot afford staff with the skills they need (61).
• 36% of the practitioners ISC2 surveyed experienced cybersecurity budget cuts in 2025 and 24% layoffs, each one point lower than in 2024 (61).
• 70% of Hyperproof's respondents had an annual GRC budget over $1 million, and 58% expected to spend more on GRC in 2026 (17).

Compliance staffing and workload

• 55% of cybersecurity teams in ISACA's 2025 survey were understaffed, and 65% had unfilled positions (14).
• Cybersecurity staff made up only 10.6% of IT full-time equivalents in the EU organizations ENISA surveyed in 2025, the lowest share ENISA has recorded (13).
• 76% of the EU organizations ENISA surveyed struggled to attract cybersecurity professionals in 2025, and 71% to retain them (13).
• The median privacy team in ISACA's survey shrank from eight people in 2025 to five in 2026 (24).
• US employers posted 514,359 cybersecurity job listings from May 2024 to April 2025, up 12%, and Oversight and Governance, the category that holds compliance and risk roles, was the largest, with 355,590 (62).
• The median US information security analyst earned $129,180 in May 2025, and the occupation is projected to grow 21% from 2025 to 2035 (63).
• 51% of the GRC teams in the State of GRC 2026 survey had four people or fewer, and 18.5% of practitioners ran GRC alone (15).
• 68% of Hyperproof's respondents expected their GRC team to grow over the two years from 2026 (17).

Cybersecurity and compliance skills

• 95% of the practitioners ISC2 surveyed reported at least one skill gap on their team in 2025, and 59% a critical or significant one (61).
• 88% of the practitioners ISC2 surveyed had experienced at least one significant cybersecurity consequence because of a skills shortage in 2025, and 69% more than one (61).
• The executives PwC surveyed named specialist knowledge (53%) and data management (43%) the key compliance skills in 2025, and more than half of those who rated them critical expect a shortage within 12 months (18).
• Only 1.5% of 671 professionals surveyed by the International Association of Privacy Professionals (IAPP) in spring 2024 expected to need no additional AI governance staff within 12 months (64).

Your own team's capacity, not the average of any one survey, is what an assessment calendar has to be planned around.

Compliance automation and AI statistics

Automation tools are where a thinly staffed compliance team looks for capacity, and AI is now both a tool for that work and a risk the program has to govern.

Compliance tools and automation

• 59% of the GRC practitioners surveyed for the State of GRC 2026 used no commercial GRC tool (15).
• Among GRC practitioners without a commercial tool in 2026, spreadsheets were the primary tool for 93 respondents, custom stacks on Jira, Notion or SharePoint for 70 and open source for 38 (15).
• 76% of Hyperproof's respondents spent 30% or more of their team's time on repetitive tasks in 2026 (17).
• 49% of the executives PwC surveyed used technology for 11 or more compliance activities in 2025, led by training (82%), risk assessment (76%) and transaction monitoring (75%) (18).
• 82% of the companies PwC surveyed planned in 2025 to invest more in at least one technology to automate compliance (4, 18).
• Only 25% of Hyperproof's respondents collected control evidence continuously in 2026; 54% collected it around internal and external audits (17).
• Organizations using AI and automation extensively in security saved an average of $1.93 million in breach costs in 2026, compared with those using none (1).
• 56% of Hyperproof's respondents used a common controls framework in 2026 (17).

AI adoption in compliance programs

• 71% of the executives PwC surveyed expected AI to have a net positive impact on compliance in 2025, while 32% were not yet using or piloting AI for any compliance activity (18).
• Only 4% of the risk and compliance leaders NAVEX surveyed used no AI anywhere in their compliance program in 2026 (16).
• 97% of Hyperproof's respondents used AI to streamline their workflows in 2026 (17).
• 26% of the privacy professionals ISACA surveyed had no plans to use AI for privacy tasks in 2026, down from 36% in 2024 and 31% in 2025 (24).
• 45% of employees regularly used AI on corporate devices in the 2026 DBIR, up from 15% a year earlier, and 67% of them did so through non-corporate accounts (5).
• Shadow AI, the use of AI services the organization has not approved, became the third most common non-malicious insider action in Verizon's data loss prevention data in 2025, four times its share a year earlier (5).
• 43% of the security incidents in IBM's 2026 study involved an organization's shadow AI, up from 20%; those breaches cost $5.39 million on average, and in about one in five of them the organization reported paying a regulatory fine (1).

AI governance and oversight

• 77% of the organizations in the IAPP's spring 2024 survey were working on AI governance, and nearly 90% of those already using AI (64).
• The EU AI Act's prohibitions have applied since 2 February 2025 and its general-purpose AI rules since 2 August 2025; after the 2026 AI Omnibus, its high-risk rules apply from 2 December 2027 and 2 August 2028 (65, 66).
• 47% of the cybersecurity professionals in ISACA's 2025 survey had helped develop AI governance, up from 35%, and 40% had worked on AI implementation, up from 29% (14).
• 68% of breached organizations had no AI governance to manage AI or detect shadow AI in 2026, up from 63% (1).
• 92% of organizations with an AI-related breach lacked proper AI access controls in 2026, and only 40% of the organizations studied used access controls on AI models and data (1).
• 32% of breached organizations had AI governance policies in place in 2026, down from 37% (1).

Table 11: AI governance policy status among breached organizations, 2026 and 2025. Source: IBM. (1)

• Privacy and legal and compliance each held primary responsibility for AI governance at 22% of the organizations in the IAPP's spring 2024 survey (64).

Table 12: Functions most often tasked with primary responsibility for AI governance, surveyed in spring 2024. Source: IAPP. (64)

For a compliance program, the Verizon figures on non-corporate accounts and shadow AI are the ones to act on first: they describe AI use outside approved accounts, and so beyond the controls a policy can evidence.

What the numbers mean for your compliance program

Proof of compliance travels with every contract. Third parties were involved in 48% of breaches in Verizon's 2026 DBIR (5), and breaches reported by business associates accounted for 85% of the individuals affected by large HIPAA breaches in 2024 (6). Expect customers to ask how you evidence your security posture between assessments, not only which report you hold.

HIPAA enforcement runs on complaints and breach reports, not audits. OCR initiated no HIPAA audits from 2020 to 2024 (3, 34, 35, 36, 37), and 663 of its 730 compliance reviews in 2024 followed a large breach report (3). Its breach investigations named risk analysis and risk management first among the Security Rule areas needing improvement (6), which makes a current risk analysis the first document to have ready.

What you certify is a compliance risk of its own. Several of the Justice Department's fiscal year 2025 cybersecurity fraud settlements turn on false certifications, an inaccurate score for required controls and misrepresented adherence to standards (9). An attestation or a contract certification should say only what your controls can show.

Match the statistic to the budget case. IBM's 2026 average data breach cost of $4.99 million (1) describes organizations that were breached; Coalition's 2025 average claim of $116,000 (31) describes insured businesses. Pick the figure whose population looks like yours, and name its source.

Bring AI use inside your policies. 45% of employees were regular AI users on corporate devices in Verizon's 2026 DBIR, two-thirds of them through non-corporate accounts (5). The approved tools, and the sensitive data they may touch, belong in your policies, your data privacy program and your risk assessment.

Plan around the team you have. In the State of GRC 2026, 51% of GRC teams have four people or fewer and 59% of practitioners use no commercial GRC tool (15). Staging frameworks, reusing evidence across them and deciding what to hand to outside help are capacity decisions as much as budget ones.

Final thoughts

The 2026 numbers point one way: requirements keep growing, teams stay small, and regulators act on complaints, breach reports and false certifications rather than on scheduled audits. That puts the weight on evidence an organization can produce at any time, not only in the weeks before an assessment.

Build a compliance program you can evidence

Most of the figures above come down to one question from a customer, an assessor or a regulator: can you show it? Our cybersecurity compliance services start with a gap assessment that maps every gap to the requirement it belongs to, with a risk rating attached.

From there we build a remediation roadmap, stay involved while the controls are implemented and draft the policies, procedures and records an assessor expects to see, for SOC 2, ISO 27001, HIPAA, PCI DSS, CMMC, GDPR and the other frameworks we support. Most of our clients stay on recurring engagements, so their compliance posture is maintained between assessment cycles rather than rebuilt before each one. Tell us which framework is next, and we will get back to you within a day.

References

1. IBM, Cost of a Data Breach Report 2026 (full report behind registration). https://www.ibm.com/reports/data-breach
2. EDPB, Annual Report 2025. https://www.edpb.europa.eu/system/files/2026-04/edpb-annual-report-2025_en.pdf
3. HHS Office for Civil Rights, Annual Report to Congress on HIPAA Privacy, Security, and Breach Notification Rule Compliance for Calendar Year 2024. https://www.hhs.gov/sites/default/files/compliance-report-to-congress-2024.pdf
4. PwC, Global Compliance Survey 2025 (report PDF). https://www.pwc.com/gx/en/issues/risk-regulation/pwc-global-compliance-study-2025.pdf
5. Verizon, 2026 Data Breach Investigations Report. https://www.verizon.com/business/resources/T5f4/reports/2026-dbir-data-breach-investigations-report.pdf
6. HHS Office for Civil Rights, Annual Report to Congress on Breaches of Unsecured Protected Health Information for Calendar Year 2024. https://www.hhs.gov/sites/default/files/breach-report-to-congress-2024.pdf
7. HHS, Annual Civil Monetary Penalties Inflation Adjustment, 91 FR 3665 (28 January 2026). https://www.federalregister.gov/documents/2026/01/28/2026-01688/annual-civil-monetary-penalties-inflation-adjustment
8. HHS, 45 CFR 160.404 (Amount of a civil money penalty), eCFR, current as of September 2026. https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-D/section-160.404
9. U.S. Department of Justice, Fact Sheet: False Claims Act Settlements and Judgments FY2025. https://www.justice.gov/opa/media/1424126/dl
10. Verizon, 2024 Payment Security Report. https://www.verizon.com/business/resources/T5f4/reports/2024/2024-payment-security-report.pdf
11. ISO (CASCO), The ISO Survey of Management System Standard Certifications 2024, Explanatory Note, September 2025 (full results behind registration). https://www.iafcertsearch.org/services/iso-survey
12. The Cyber AB, Statement on the Department of War's Suspension of CMMC Phase II Requirements, 15 July 2026. https://www.cyberab.org/Portals/0/Documents/CyberABStatementOnDoWPhaseIISuspension-15JUL2026.pdf
13. ENISA, NIS Investments 2025. https://www.enisa.europa.eu/sites/default/files/2026-02/NIS%20Investments%202025%20-%20Main%20report.pdf
14. ISACA, State of Cybersecurity 2025 (press release). https://www.isaca.org/about-us/newsroom/press-releases/2025/state-of-cybersecurity-2025-global-press-release
15. GRC Engineer, The State of GRC 2026. https://grcengineer.com/report/
16. NAVEX, 2026 State of Risk & Compliance (vendor survey). https://www.navex.com/en-us/northstar/global-risk-compliance-statistics/
17. Hyperproof, 2026 IT Risk and Compliance Benchmark Report (vendor survey; full report behind registration). https://hyperproof.io/it-compliance-benchmarks/
18. PwC, Global Compliance Survey 2025. https://www.pwc.com/gx/en/issues/risk-regulation/global-compliance-survey.html
19. European Commission, news "Commission calls on 19 Member States to fully transpose the NIS2 Directive" (7 May 2025). https://digital-strategy.ec.europa.eu/en/news/commission-calls-19-member-states-fully-transpose-nis2-directive
20. European Commission, press release on the NIS2 referrals to the Court of Justice (8 July 2026). https://digital-strategy.ec.europa.eu/en/news/commission-refers-ireland-spain-france-and-netherlands-court-justice-failing-transpose-rules
21. IAPP, US State Comprehensive Privacy Laws Report (last updated 27 October 2025). https://iapp.org/resources/article/us-state-privacy-laws-overview
22. Thomson Reuters Institute, 2025 C-Suite Survey (full report PDF). https://www.thomsonreuters.com/en-us/posts/wp-content/uploads/sites/20/2025/05/2025-C-Suite-Report.pdf
23. IAPP, Privacy Governance Report 2024. https://iapp.org/resources/article/privacy-governance-report
24. ISACA, State of Privacy 2026 (press release, 15 January 2026). https://www.isaca.org/about-us/newsroom/press-releases/2026/new-isaca-study-privacy-teams-are-shrinking-increasingly-stressed
25. European Supervisory Authorities (EBA, EIOPA, ESMA), list of designated critical ICT third-party providers under DORA (18 November 2025). https://www.esma.europa.eu/sites/default/files/2025-11/List_of_designated_CTPPs.pdf
26. NAVEX, 2026 State of Risk & Compliance Report, full report PDF (vendor survey). https://cdn.navex.com/image/upload/v1780920735/resources-2026/benchmarking-reports/NAVEX_Risk_and_Compliance_Report_2026.pdf
27. HHS Office for Civil Rights, HIPAA Security Rule proposed rule, 90 FR 898 (6 January 2025). https://www.federalregister.gov/documents/2025/01/06/2024-30983/hipaa-security-rule-to-strengthen-the-cybersecurity-of-electronic-protected-health-information
28. U.S. Department of War (Department of Defense), DFARS final rule: Assessing Contractor Implementation of Cybersecurity Requirements (10 September 2025). https://www.federalregister.gov/documents/2025/09/10/2025-17359/defense-federal-acquisition-regulation-supplement-assessing-contractor-implementation-of
29. U.S. Department of Defense, Cybersecurity Maturity Model Certification (CMMC) Program, final rule, 89 FR 83092 (15 October 2024). https://www.federalregister.gov/documents/full_text/text/2024/10/15/2024-22905.txt
30. IBM, Cost of a Data Breach Report 2026 (press release, 29 July 2026). https://newsroom.ibm.com/2026-07-29-ibm-study-one-in-four-malicious-breaches-are-ai-enabled,-costing-companies-6-million-on-average
31. Coalition, 2026 Cyber Claims Report (announcement). https://www.coalitioninc.com/announcements/2026-cyber-claims-report
32. FBI IC3, 2025 Internet Crime Report. https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
33. HHS Office for Civil Rights, Change Healthcare Cybersecurity Incident Frequently Asked Questions. https://www.hhs.gov/hipaa/for-professionals/special-topics/change-healthcare-cybersecurity-incident-frequently-asked-questions/index.html
34. HHS Office for Civil Rights, Annual Report to Congress on HIPAA Privacy, Security, and Breach Notification Rule Compliance for Calendar Year 2020. https://www.hhs.gov/sites/default/files/compliance-report-to-congress-2020.pdf
35. HHS Office for Civil Rights, Annual Report to Congress on HIPAA Privacy, Security, and Breach Notification Rule Compliance for Calendar Year 2021. https://www.hhs.gov/sites/default/files/compliance-report-to-congress-2021.pdf
36. HHS Office for Civil Rights, Annual Report to Congress on HIPAA Privacy, Security, and Breach Notification Rule Compliance for Calendar Year 2022. https://www.hhs.gov/sites/default/files/compliance-report-to-congress-2022.pdf
37. HHS Office for Civil Rights, Annual Report to Congress on HIPAA Privacy, Security, and Breach Notification Rule Compliance for Calendar Year 2023. https://www.hhs.gov/sites/default/files/compliance-report-to-congress-2023.pdf
38. HHS Office for Civil Rights, Annual Report to Congress on Breaches of Unsecured Protected Health Information for Calendar Year 2021. https://www.hhs.gov/sites/default/files/breach-report-to-congress-2021.pdf
39. HHS Office for Civil Rights, Annual Report to Congress on Breaches of Unsecured Protected Health Information for Calendar Year 2022. https://www.hhs.gov/sites/default/files/breach-report-to-congress-2022.pdf
40. HHS Office for Civil Rights, Annual Report to Congress on Breaches of Unsecured Protected Health Information for Calendar Year 2023. https://www.hhs.gov/sites/default/files/breach-report-to-congress-2023.pdf
41. HHS Office for Civil Rights, Annual Report to Congress on Breaches of Unsecured Protected Health Information for Calendar Year 2020. https://www.hhs.gov/sites/default/files/breach-report-to-congress-2020.pdf
42. HHS Office for Civil Rights, HIPAA Enforcement Highlights (results as of 31 October 2024). https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/data/enforcement-highlights/index.html
43. HHS, Notification of Enforcement Discretion Regarding HIPAA Civil Money Penalties, 84 FR 18151 (30 April 2019). https://www.federalregister.gov/documents/2019/04/30/2019-08530/notification-of-enforcement-discretion-regarding-hipaa-civil-money-penalties
44. HHS Office for Civil Rights, Notice of Proposed Determination, Warby Parker, Inc. (5 September 2024). https://www.hhs.gov/sites/default/files/ocr-warby-parker-npd.pdf
45. HHS Office for Civil Rights, Notice of Final Determination, Warby Parker, Inc. (11 December 2024). https://www.hhs.gov/sites/default/files/ocr-warby-parker-nfd.pdf
46. Irish Data Protection Commission, Annual Report 2025 (announcement, published 30 June 2026). https://www.dataprotection.ie/en/data-protection-commission-publishes-2025-annual-report
47. CNIL, Sanctions et mesures correctrices: bilan 2025 (published 9 February 2026). https://www.cnil.fr/fr/bilan-sanctions-2025
48. Information Commissioner's Office (UK), Annual Report and Financial Statements 2025/26, HC 274 (July 2026). https://ico.org.uk/media2/ybsi5n0j/ico-annual-report-202527.pdf
49. U.S. Department of War (Department of Defense), 32 CFR Part 170 (CMMC Program), eCFR, current as of September 2026. https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170
50. The Cyber AB, response to the Department of War's RFI "Reforming CMMC and Reducing Compliance Burden" (14 August 2026). https://cyberab.org/News-Events/Press-Releases/the-cyber-abs-response-to-the-dows-reforming-cmmc-and-reducing-compliance-burden-rfi
51. U.S. Department of War (Department of Defense), Chief Information Officer, About CMMC. https://dowcio.war.gov/CMMC/About/
52. The White House, Executive Order 14347: Restoring the United States Department of War, 90 FR 43893. https://www.federalregister.gov/documents/2025/09/10/2025-17508/restoring-the-united-states-department-of-war
53. U.S. Department of War (Department of Defense), Office of the Chief Information Officer, CMMC Program Frequently Asked Questions, Revision 2.3 (Excerpt), July 2026. https://dowcio.war.gov/Portals/0/Documents/CMMC/FAQsv6.pdf
54. U.S. Department of War (Department of Defense), Cybersecurity Maturity Model Certification Procedures, memorandum attachment cleared for open publication 13 July 2026. https://dowcio.war.gov/Portals/0/Documents/Library/ImplementingSuspensionCMMC-PhaseII.pdf
55. Verizon, Payment Security Report landing page (read 10 September 2026). https://www.verizon.com/business/reports/payment-security-report/
56. PCI Security Standards Council, PCI DSS v3.2.1 to v4.0 Summary of Changes, revision 1 (May 2022). https://listings.pcisecuritystandards.org/documents/PCI-DSS-v3-2-1-to-v4-0-Summary-of-Changes-r1.pdf
57. PCI Security Standards Council, blog "Just Published: PCI DSS v4.0.1" (11 June 2024). https://blog.pcisecuritystandards.org/just-published-pci-dss-v4-0-1
58. AICPA & CIMA, System and Organization Controls: SOC suite of services. https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services
59. AICPA & CIMA, System and Organization Controls (SOC) Survey (2020 survey, published 2021) (free AICPA & CIMA account required to download the PDF). https://www.aicpa-cima.com/resources/download/soc-survey-results-point-to-the-value-of-soc-1-and-2-engagements
60. International Accreditation Forum, IAF MD 26:2023 Transition Requirements for ISO/IEC 27001:2022, Issue 2. https://iaf.nu/iaf_system/uploads/documents/IAF_MD26_Issue_2_15012023.pdf
61. ISC2, 2025 Cybersecurity Workforce Study (announcement). https://www.isc2.org/Insights/2025/12/ISC2-Publishes-2025-Cybersecurity-Workforce-Study
62. CyberSeek (NIST NICE, CompTIA and Lightcast), June 2025 release. https://www.cyberseek.org/docs/06-02-2025_CyberSeek_June_2025.pdf
63. US Bureau of Labor Statistics, Occupational Outlook Handbook, Information Security Analysts (last modified 27 August 2026). https://www.bls.gov/ooh/computer-and-information-technology/information-security-analysts.htm
64. IAPP, AI Governance Profession Report 2025 (fieldwork spring 2024). https://iapp.org/resources/article/ai-governance-profession-report
65. European Commission, AI Act Service Desk, Article 113 of Regulation (EU) 2024/1689. https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-113
66. European Commission, AI Act policy page (Shaping Europe's digital future), read 25 September 2026. https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
67. HHS, 45 CFR 164.404 (HIPAA Breach Notification Rule, notification to individuals), eCFR, current as of September 2026. https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D/section-164.404
68. HHS, 45 CFR 164.412 (HIPAA Breach Notification Rule, law enforcement delay), eCFR, current as of September 2026. https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D/section-164.412
69. Regulation (EU) 2016/679 (GDPR), Article 83, consolidated text on EUR-Lex (read 10 September 2026). https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679
70. Irish Data Protection Commission, decision on data transfers by Meta Platforms Ireland Limited for its Facebook service (12 May 2023). https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-concerning-data-transfers-eueea-us-meta-platforms-ireland-limited-its-facebook-service