Training in 2027: new standards, regulation and competences to develop
What has changed in quality, auditing, privacy, cybersecurity and artificial intelligence, and how to turn these changes into priorities for training in 2027.
⏱️ Estimated reading time: 9 minutes
Planning training in 2027 starts with a question: what has changed in the organisation’s standards and frameworks, risks and responsibilities?
ISO publications, ENISA’s threat landscape and European and national legislation help identify different needs. It is important to distinguish between published standards and frameworks, whose changes need to be analysed; applicable obligations, which require preparation for the responsibilities involved; and draft standards, which should be monitored without treating their requirements as final.
The aim is not to train everyone in the same topics, but to understand who needs to make decisions, implement, oversee or assess, and which competences they need.
Digital exposure also extends to suppliers and AI
The ENISA Threat Landscape 2026, published on 22 September 2026 and based on incidents and events between 1 January and 31 December 2025, highlights how digital dependencies expand the attack surface: supply chains, third parties and the integration of artificial intelligence.
Preparation should therefore consider both internal systems and the external services on which operations depend. A supplier outage may require technical decisions, impact assessment, recovery and communication with customers and other interested parties. We explore this relationship in the article Cybersecurity and business continuity: what if your critical supplier stops operating?
New standards: what should training in 2027 cover?
This selection brings together publications from 2025 and 2026. The proposed implications support competence planning; they do not constitute obligations to attend specific courses.
On small screens, scroll horizontally to view the table.
| Standard and publication date | Relevance to competences |
|---|---|
| ISO 9001:2026 – September 2026 | Updates quality management requirements, with an emphasis on clarity, quality culture, leadership, risks and opportunities. It is important to assess the changes and prepare processes, the system and audits. |
| ISO 19011:2026 – May 2026 | Updates guidance on audit principles, programmes, conduct and auditor competence, with a greater emphasis on remote and hybrid audits. It is important to review planning, methods, competence criteria and the assessment of evidence, including digital evidence. It does not establish requirements for management system certification. |
| ISO/IEC 27701:2025 – October 2025 | Establishes requirements and guidance for a stand-alone privacy information management system, rather than only as an extension of an ISMS. It is important to reassess the structure, requirements, controls and alignment with information security. |
| ISO/IEC 27031:2025 – May 2025 | Provides guidance on information and communication technology readiness for business continuity. It is important to connect technology recovery, continuity objectives, external dependencies and team preparedness. |
| ISO/IEC 27000:2026 – July 2026 | Updates concepts, principles and relationships between information security management standards, supporting understanding of the system and the selection of standards and frameworks. It does not replace the requirements of ISO/IEC 27001. |
| ISO/IEC 27090:2026 – October 2026 | Provides guidance on understanding, detecting and mitigating threats to AI systems throughout their life cycle. It is important to strengthen the protection of data, models and processes, complementing existing security. |
When planning training in 2027, remember that a new edition does not, in itself, mean that the whole team should repeat all its training. The nature of the standard or framework, requirements or guidance, the changes and the roles affected should guide the choice between foundations, transition, implementation, auditing and specialisation.
ISO 9001 transition and revisions under development
The transition requirements of Global Accreditation Cooperation Incorporated (Global ACI) stipulate that the accredited certifications covered must complete the transition from ISO 9001:2015 to ISO 9001:2026 by 30 September 2029. This may take place during a surveillance, recertification or dedicated audit. For 2027, we recommend analysing differences and impacts before changing documentation, coordinating preparation with the certification body.
The revisions of ISO 31000 and ISO 22301 are at the Committee Draft stage; a new ISO 22313 is under development. Monitoring them is not the same as starting a transition. Drafts may evolve before publication; expected dates should be monitored on the official ISO pages.
Regulation: who needs training in 2027?
Scopes and timelines differ. The analysis should identify the obligations that actually apply to the organisation and to each role.
NIS 2 in Portugal
Decree-Law No 125/2025 of 4 December transposed Directive (EU) 2022/2555 and approved the new Cybersecurity Legal Framework. Article 25(1)(d) of the framework approved in the annex places a duty on the management, executive and administrative bodies of essential and important entities to ensure that cybersecurity training is delivered regularly.
Regulation No 756/2026 of 22 June implements the framework. Under the QNRCS – National Cybersecurity Reference Framework, set out in Annex I, point 6.2, measure PR.FC-1 addresses awareness and training for all staff; PR.FC-2 addresses the preparation of people with specialist cybersecurity roles and of management, executive and administrative bodies. The description of PR.FC-1 includes planning training activities and evaluating their success.
Implementing Regulation (EU) 2024/2690 establishes technical and methodological requirements for certain categories of providers, including cloud computing, data centres and managed services.
Governance, technical implementation and incident response require different preparation. Deadlines should be analysed by obligation and entity: these obligations do not all start in 2027. See also NIS 2 in Portugal: is appointing a cybersecurity officer enough?
DORA
Regulation (EU) 2022/2554 – DORA has applied to the financial entities within its scope since 17 January 2025. It covers ICT risk, incidents, resilience testing and third-party providers.
Training in 2027 should support the consolidation of implementation, monitoring and improvement, distinguishing between those who oversee risks, manage incidents, assess contracts or plan tests. It is not about preparing for the start of application.
Cyber Resilience Act
Regulation (EU) 2024/2847 – CRA is scheduled to apply generally from 11 December 2027. Since 11 September 2026, manufacturers within its scope have been subject to obligations to report actively exploited vulnerabilities and severe incidents affecting product security.
Preparation should connect product security, vulnerabilities, documentation and coordination between development, security and compliance, while also considering maintenance and monitoring. General awareness alone is not enough.
AI Act
According to the European Commission, the AI Omnibus, in force since 27 July 2026, set the application dates for the high-risk rules at 2 December 2027 for Annex III and 2 August 2028 for systems associated with regulated products covered by Annex I.
This is not a blanket postponement: general-purpose AI models and transparency have their own application milestones. The European Commission also notes the simplification of the provisions on AI literacy, so planning should take the updated framework into account.
The competences to be developed through training in 2027 depend on the organisation’s role and the systems it develops or uses: interpreting obligations, assessing risks, managing, overseeing or verifying compliance. ISO/IEC 42001 addresses the AI management system; ISO/IEC 27090 addresses specific security threats. They make distinct contributions and do not replace the regulation.
Training in 2027: three decisions to define competences
Identify the change. Link standards, requirements, technologies, dependencies or new responsibilities to a specific need. ‘Preparing process owners and auditors to assess the impact of ISO 9001:2026’ is more precise than ‘updating quality knowledge’.
Identify who needs to act. Management sets priorities; implementation structures processes; operations carry them out; auditing assesses evidence. Consider existing knowledge and experience: some professionals need targeted updates; others need foundations and specialisation.
Define practical application and assessment. Link learning to an analysis of changes, a transition plan, an audit programme, an assessment of dependencies or an exercise. Attendance does not guarantee practical application: appropriate working conditions and an assessment of demonstrated progress are required.
Example: an incident at a supplier disrupts an essential application
In this hypothetical scenario, the same dependency may reveal different needs:
On small screens, scroll horizontally to view the table.
| Role | Capability and practical application to assess |
|---|---|
| Management | Interpret impacts and justify decisions on alternatives, resources and recovery priorities. |
| Technical and continuity managers | Connect business needs, recovery and dependencies; conduct an exercise with identified objectives, results and improvements. |
| Internal audit | Assess preparedness against the applicable criteria, basing conclusions on plans, exercises and follow-up on improvements. |
If recovery does not meet business needs, assumptions, solutions, contracts or decisions may need to be reviewed. It is important to distinguish competence gaps from problems that require other measures. Training alone does not solve everything.
Training in 2027: choosing the delivery model and certification pathway
A specific need may justify individual training; related responsibilities, joint participation; and a need shared by the team, in-company training. Consider content, prior knowledge, participants, availability and practical application not just cost per person. See Team Pack or in-company training: how to choose the model that offers the greatest value?
For professional certification, consider the competences assessed, the examination, and the eligibility and maintenance requirements. Personnel certification and management system certification are distinct, as are their respective transition processes. Check the conditions for each course and, where applicable, the Behaviour certification transition application.
The central question is: does this pathway prepare me for my current responsibilities or for those I intend to take on?
How Behaviour keeps pace with these developments
At Behaviour Group®, course programmes and content are reviewed annually and updated whenever there are relevant changes to the body of knowledge.
The pathways address different needs: ISO 9001 Transition and ISO 27701 Transition to analyse differences between editions and their implications for processes, responsibilities and evidence; ISO 19011 Internal Lead Auditor for audit methodology; and ICT Readiness Lead Manager for technology readiness for business continuity.
In Digital Compliance and Operational Resilience and Artificial Intelligence, the offering distinguishes between foundations, governance, compliance, implementation and auditing, depending on the standard or framework and the role.
Planning training in 2027 is not about adding courses to a list. It is about distinguishing what requires immediate preparation, consolidation or monitoring, and preparing the right people to respond.
To develop your training plan or professional pathway, explore Training by Need or the Companies and HR area, linking roles, participants and intended outcomes.
Behaviour Group® – Dedicated to Best Practices.
Update note: reference information as at 22 October 2026. Standards and legislation may evolve; application requires an analysis of the organisation’s specific scope, obligations and deadlines.
Are you preparing your training plan for 2027?
Identify priority competences and the pathways suited to your organisation.
Date: 23 October 2026
Author: Behaviour Group
Copying or reproducing this article is not authorised.