{"id":70299,"date":"2026-08-27T16:30:48","date_gmt":"2026-08-27T14:30:48","guid":{"rendered":"https:\/\/swissgrc.com\/en\/bacs-tightens-tone-on-reporting-deadlines\/"},"modified":"2026-08-27T16:36:52","modified_gmt":"2026-08-27T14:36:52","slug":"bacs-tightens-tone-on-reporting-deadlines","status":"publish","type":"post","link":"https:\/\/swissgrc.com\/en\/bacs-tightens-tone-on-reporting-deadlines\/","title":{"rendered":"BACS Tightens Tone on Reporting Deadlines"},"content":{"rendered":"<div id=\"sgce-a\" class=\"sgce-article\">\n<p class=\"rc-lede\">The Federal Office for Cyber Security (BACS) initially introduced the reporting obligation for cyberattacks on critical infrastructure in a cooperative manner and tolerated early teething problems. With the end of this transition phase in mid-2026, the trade publication sidd.swiss announces in its analysis of the NCSC\/BACS reporting obligation a more consistent enforcement, particularly for repeated violations and reports that only became known late. For companies, one question moves to the foreground: which timeline they must document without gaps in an emergency.<\/p>\n<div class=\"rc-tldr\">\n<div class=\"rc-tldr-label\">In short<\/div>\n<p>To prove that a cyber incident was reported to the Federal Office for Cyber Security on time, a company must document without gaps the moment of discovery, the course of internal escalation, the time of the initial report within 24 hours and the time of the follow-up report. What counts is the moment the attack became known, not the completion of the forensic analysis.<\/p>\n<\/div>\n<nav class=\"rc-toc\" aria-label=\"Contents\">\n<div class=\"rc-toc-label\">Contents<\/div>\n<ol>\n<li><a href=\"#a1-what-changes-at-bacs-from-mid-2026\">What changes at BACS from mid-2026?<\/a><\/li>\n<li><a href=\"#a2-when-does-the-reporting-deadline-start-r\">When does the reporting deadline start running?<\/a><\/li>\n<li><a href=\"#a3-which-timestamps-must-a-company-document\">Which timestamps must a company document?<\/a><\/li>\n<li><a href=\"#a4-how-does-the-bacs-deadline-differ-from-o\">How does the BACS deadline differ from other reporting obligations?<\/a><\/li>\n<li><a href=\"#a5-what-is-the-first-concrete-step-towards-\">What is the first concrete step towards demonstrable compliance?<\/a><\/li>\n<\/ol>\n<\/nav>\n<div class=\"rc-figures\">\n<div class=\"rc-figure-cell\">\n<div class=\"rc-figure-value\" data-to=\"24\">24<span class=\"unit\">hrs<\/span><\/div>\n<div class=\"rc-figure-label\">Deadline for the initial report of a cyberattack to BACS<\/div>\n<div class=\"rc-figure-src\">BACS, Information on the reporting obligation<\/div>\n<\/div>\n<div class=\"rc-figure-cell\">\n<div class=\"rc-figure-value\" data-to=\"14\">14<span class=\"unit\">days<\/span><\/div>\n<div class=\"rc-figure-label\">Deadline to complete the report with a follow-up report<\/div>\n<div class=\"rc-figure-src\">BACS, Information on the reporting obligation<\/div>\n<\/div>\n<div class=\"rc-figure-cell\">\n<div class=\"rc-figure-value\" data-to=\"100000\">100000<span class=\"unit\">CHF<\/span><\/div>\n<div class=\"rc-figure-label\">Maximum fine for failure to report<\/div>\n<div class=\"rc-figure-src\">BACS, Six months of the reporting obligation for cyberattacks on critical infrastructure<\/div>\n<\/div>\n<\/div>\n<h2 id=\"a1-what-changes-at-bacs-from-mid-2026\">What changes at BACS from mid-2026?<\/h2>\n<p>After the end of the authority&#8217;s transition phase, BACS moves from awareness-raising to consistent enforcement, with particular attention to repeated violations and late reports.<\/p>\n<p>The legal basis is the federal Information Security Act, whose contribution to strengthening the digital resilience of the federal government anchors the reporting obligation for operators of critical infrastructure. In the months following its introduction, BACS drew a positive balance: operators reported cyberattacks on time, within 24 hours, as the authority noted in its statement on six months of the reporting obligation. In total, 164 reports were received during this period, as BACS stated in the same communication.<\/p>\n<p>Anyone who violates the reporting obligation must, according to BACS, expect a fine of up to CHF 100,000, whereby the authority first contacts the organisation concerned before imposing a sanction. With the end of the transition phase, sidd.swiss expects a tougher line in its analysis, above all for repeated violations and for reports that only became known through media coverage.<\/p>\n<h2 id=\"a2-when-does-the-reporting-deadline-start-r\">When does the reporting deadline start running?<\/h2>\n<p>What counts is the moment the attack became known, not the completion of the forensic investigation.<\/p>\n<p>sidd.swiss states in its practical analysis of the 24-hour reporting obligation that the deadline begins upon discovery, not at the original time of the attack. For companies, the decisive question thus shifts from technology to organisation: from what point is an incident considered sufficiently identified. Once this threshold is reached, the 24-hour deadline for the initial report to BACS starts running, as the authority sets out in its information on the reporting obligation.<\/p>\n<p>Anyone who waits for a complete forensic investigation will, as a rule, already have missed the deadline. BACS explicitly expects a structured initial assessment, not finished forensics. Missing details can be added within 14 days in a follow-up report, as BACS states in its fact sheet on the reporting obligation.<\/p>\n<h2 id=\"a3-which-timestamps-must-a-company-document\">Which timestamps must a company document?<\/h2>\n<p>At least four points in time must be verifiable: detection, internal escalation, initial report and follow-up report.<\/p>\n<p>Without documented timestamps, it is difficult to prove after the fact that a report was made on time. BACS requires details of the date and time of detection as well as of the attack in the report itself. These details only make sense if they come from unbroken internal logging rather than being reconstructed afterwards.<\/p>\n<p>How demanding a complete evidence trail can become over several years is shown by the review of a long-running supervisory investigation in the UBS fine case.<\/p>\n<ul>\n<li>Time of the first indication of an incident<\/li>\n<li>Time of discovery by the responsible unit<\/li>\n<li>Time of internal escalation to management and the persons authorised to report<\/li>\n<li>Time of the initial report to BACS, at the latest 24 hours after discovery<\/li>\n<li>Time of the follow-up report with complete details, at the latest 14 days later<\/li>\n<\/ul>\n<h2 id=\"a4-how-does-the-bacs-deadline-differ-from-o\">How does the BACS deadline differ from other reporting obligations?<\/h2>\n<p>Companies subject to several regulations must keep several clocks in view at once; the BACS 24-hour deadline is only one of them.<\/p>\n<p>Regulated financial institutions already know a similar logic from FINMA supervisory practice: for serious incidents, the supervisory authority expects an initial report within 24 hours and a follow-up report within 72 hours. The BACS reporting obligation applies alongside this supervisory duty, but does not replace it.<\/p>\n<p>For manufacturers of products with digital elements, a further reporting obligation is added on 11 September 2026: from this date, the EU Cyber Resilience Act requires the reporting of actively exploited vulnerabilities and serious security incidents. A separate article examines where concrete gaps still remain in these CRA reporting obligations.<\/p>\n<p>Any company that has not clearly determined whether it qualifies as an operator of critical infrastructure or as an entity subject to NIS2 falls behind on every one of these deadlines. How significant this uncertainty is in practice is shown by the registration gap that many companies only close after a subsequent self-assessment.<\/p>\n<h2 id=\"a5-what-is-the-first-concrete-step-towards-\">What is the first concrete step towards demonstrable compliance?<\/h2>\n<p>The first verifiable step is a documented test report that runs through the complete timeline from detection to follow-up report.<\/p>\n<p>Companies should run through a test report in their internal playbook within the current quarter and log all four timestamps: detection, escalation, initial report and follow-up report. The person responsible for reporting, whether CISO or information security officer, should be named in writing and given the necessary authority. This exercise provides the basis for presenting a complete and verifiable timeline to BACS in an emergency.<\/p>\n<aside class=\"rc-takeaways\">\n<div class=\"rc-takeaways-label\">For practice<\/div>\n<h2>Key points<\/h2>\n<ul>\n<li>Document the moment of discovery as the starting point of the 24-hour deadline, not the completion of the forensic analysis.<\/li>\n<li>Name in writing who triggers the initial report to BACS in an emergency.<\/li>\n<li>Prepare templates for the initial and follow-up report so the 14-day deadline does not pass under time pressure.<\/li>\n<li>Check deadlines running in parallel under FINMA supervision, NIS2 and the Cyber Resilience Act, so that no reporting obligation is overlooked.<\/li>\n<li>Test the reporting chain annually with an exercise to credibly demonstrate the timeline in an emergency.<\/li>\n<\/ul>\n<\/aside>\n<section class=\"rc-faq\">\n<div class=\"rc-faq-head\">\n<div class=\"rc-faq-label\">FAQ<\/div>\n<h2>Frequently asked questions<\/h2>\n<\/div>\n<div class=\"rc-faq-list\">\n<details class=\"rc-faq-item\">\n<summary>\n<h3>How high is the fine for a late BACS report?<\/h3>\n<p><span class=\"rc-faq-mark\" aria-hidden=\"true\"><\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>Anyone who violates the reporting obligation must, according to BACS, expect a fine of up to CHF 100,000. Before imposing a sanction, the authority first contacts the organisation concerned. With the end of the transition phase in mid-2026, the trade publication sidd.swiss expects more consistent enforcement, particularly for repeated violations and reports that only became known late.<\/p>\n<\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary>\n<h3>How many hours does a company have for the initial report to BACS?<\/h3>\n<p><span class=\"rc-faq-mark\" aria-hidden=\"true\"><\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>The initial report to BACS must be made within 24 hours of discovering the attack. What counts is not the time of the attack itself or the completion of the forensic analysis, but the moment at which the responsible unit within the company classifies the incident as sufficiently identified.<\/p>\n<\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary>\n<h3>How long is the deadline for the follow-up report to BACS?<\/h3>\n<p><span class=\"rc-faq-mark\" aria-hidden=\"true\"><\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>BACS allows a deadline of 14 days after the initial report for the follow-up report. In this follow-up report, companies can add details that were not yet fully available in the first, structured initial assessment, such as findings from the forensic analysis.<\/p>\n<\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary>\n<h3>Does the BACS reporting obligation apply in addition to the FINMA reporting obligation?<\/h3>\n<p><span class=\"rc-faq-mark\" aria-hidden=\"true\"><\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>Yes. Regulated financial institutions already know from FINMA supervision an initial report within 24 hours and a follow-up report within 72 hours. The BACS reporting obligation for operators of critical infrastructure applies alongside this supervisory duty and does not replace it; both deadlines must be observed in parallel.<\/p>\n<\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary>\n<h3>From when does the Cyber Resilience Act reporting obligation apply?<\/h3>\n<p><span class=\"rc-faq-mark\" aria-hidden=\"true\"><\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>From 11 September 2026, the EU Cyber Resilience Act requires manufacturers of products with digital elements to report actively exploited vulnerabilities and serious security incidents. This deadline runs in parallel with the BACS reporting obligation and with further reporting obligations such as NIS2.<\/p>\n<\/div>\n<\/details>\n<\/div>\n<\/section>\n<section class=\"rc-sources\">\n<div class=\"rc-sources-label\">Sources<\/div>\n<ol>\n<li><a href=\"https:\/\/www.ncsc.admin.ch\/ncsc\/de\/home\/meldepflicht\/meldepflicht-info.html\" target=\"_blank\" rel=\"noopener nofollow\">Informationen zur Meldepflicht<\/a><span class=\"rc-source-pub\">Bundesamt f\u00fcr Cybersicherheit (BACS)<\/span><\/li>\n<li><a href=\"https:\/\/www.bacs.admin.ch\/de\/newnsb\/gezctyF6KYR7UkCjXBC5s\" target=\"_blank\" rel=\"noopener nofollow\">Sechs Monate Meldepflicht f\u00fcr Cyberangriffe auf kritische Infrastrukturen<\/a><span class=\"rc-source-pub\">Bundesamt f\u00fcr Cybersicherheit (BACS)<\/span><\/li>\n<li><a href=\"https:\/\/www.sidd.swiss\/en\/insights\/ncsc-bacs-reporting-obligation\/\" target=\"_blank\" rel=\"noopener nofollow\">NCSC \/ BACS: When Swiss Companies Must Report Cyber Incidents<\/a><span class=\"rc-source-pub\">sidd.swiss<\/span><\/li>\n<li><a href=\"https:\/\/www.sidd.swiss\/einblicke\/kritis-24h-meldepflicht-spital\/\" target=\"_blank\" rel=\"noopener nofollow\">24-Stunden-Meldepflicht f\u00fcr Spit\u00e4ler &#8211; ISG\/BACS in der Praxis<\/a><span class=\"rc-source-pub\">sidd.swiss<\/span><\/li>\n<\/ol>\n<\/section>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>To prove that a cyber incident was reported to the Federal Office for Cyber Security on time, a company must document without gaps the moment of discovery, the course of internal escalation, the time of the initial report within 24 hours and the time of the follow-up report. What counts is the moment the attack became known, not the completion of the forensic analysis.<\/p>\n","protected":false},"author":5,"featured_media":70300,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"_eb_attr":"","_swissgrc_real_author":"Yahya Mohamed Mao","real_author_title":"Chief Marketing Officer","real_author_bio":"Views GRC through the lens of market, brand and growth. Writes about making complex topics accessible, building trust and what it takes to position and scale a specialized software platform internationally.","real_author_photo":70555,"footnotes":"","_links_to":"","_links_to_target":""},"categories":[105],"tags":[136,137,138,139,140],"class_list":["post-70299","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-regulation-supervision","tag-24-hour-reporting-obligation-cyber-incident","tag-bacs-fine-reporting-obligation","tag-critical-infrastructure-reporting-obligation","tag-information-security-act-federal-government","tag-ncsc-reporting-obligation-deadline"],"acf":[],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO Pro 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"From mid-2026, BACS tightens the 24-hour reporting obligation. Which timestamps companies must document without gaps as proof.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"superadmin\"\/>\n\t<meta name=\"google-site-verification\" content=\"google-site-verification=BAztS2wKP0jEfbvHt4_mrvvD17WwzZg1w1A6R9uoQRU\" \/>\n\t<link rel=\"canonical\" href=\"https:\/\/swissgrc.com\/en\/bacs-tightens-tone-on-reporting-deadlines\/\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO Pro (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_GB\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Swiss GRC | Governance, Risk &amp; Compliance (GRC)\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"BACS Reporting Deadline: What Companies Must Prove From 2026\" \/>\n\t\t<meta property=\"og:description\" content=\"From mid-2026, BACS tightens the 24-hour reporting obligation. Which timestamps companies must document without gaps as proof.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/swissgrc.com\/en\/bacs-tightens-tone-on-reporting-deadlines\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/08\/bacs-tightens-tone-on-reporting-deadlines-swissgrc.webp\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/08\/bacs-tightens-tone-on-reporting-deadlines-swissgrc.webp\" \/>\n\t\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-08-27T14:30:48+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-08-27T14:36:52+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@SwissGRC\" \/>\n\t\t<meta name=\"twitter:title\" content=\"BACS Reporting Deadline: What Companies Must Prove From 2026\" \/>\n\t\t<meta name=\"twitter:description\" content=\"From mid-2026, BACS tightens the 24-hour reporting obligation. Which timestamps companies must document without gaps as proof.\" \/>\n\t\t<meta name=\"twitter:creator\" content=\"@SwissGRC\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/09\/Yahya-1_1.jpeg\" \/>\n\t\t<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t\t<meta name=\"twitter:data1\" content=\"superadmin\" \/>\n\t\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BlogPosting\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/bacs-tightens-tone-on-reporting-deadlines\\\/#blogposting\",\"name\":\"BACS Reporting Deadline: What Companies Must Prove From 2026\",\"headline\":\"BACS Tightens Tone on Reporting Deadlines\",\"author\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/author\\\/superadmin\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2026\\\/08\\\/bacs-tightens-tone-on-reporting-deadlines-swissgrc.webp\",\"width\":1200,\"height\":630,\"caption\":\"Swiss GRC article image showing the logo and an abstract network graphic in blue, category Regulation & Supervision\"},\"datePublished\":\"2026-08-27T16:30:48+02:00\",\"dateModified\":\"2026-08-27T16:36:52+02:00\",\"inLanguage\":\"en-GB\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/bacs-tightens-tone-on-reporting-deadlines\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/bacs-tightens-tone-on-reporting-deadlines\\\/#webpage\"},\"articleSection\":\"Regulation &amp; Supervision, 24-hour reporting obligation cyber incident, BACS fine reporting obligation, critical infrastructure reporting obligation, Information Security Act federal government, NCSC reporting obligation deadline\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/bacs-tightens-tone-on-reporting-deadlines\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/category\\\/regulation-supervision\\\/#listItem\",\"name\":\"Regulation &amp; Supervision\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/category\\\/regulation-supervision\\\/#listItem\",\"position\":2,\"name\":\"Regulation &amp; Supervision\",\"item\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/category\\\/regulation-supervision\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/bacs-tightens-tone-on-reporting-deadlines\\\/#listItem\",\"name\":\"BACS Tightens Tone on Reporting Deadlines\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/bacs-tightens-tone-on-reporting-deadlines\\\/#listItem\",\"position\":3,\"name\":\"BACS Tightens Tone on Reporting Deadlines\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/category\\\/regulation-supervision\\\/#listItem\",\"name\":\"Regulation &amp; Supervision\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/#organization\",\"name\":\"Swiss GRC AG\",\"description\":\"Swiss GRC delivers Software Solutions for GRC, CLM &amp; BPM, helping businesses worldwide manage risks, ensure compliance, and drive success.\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/\",\"telephone\":\"+41412207500\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2023\\\/06\\\/Logo_V1_Original_mit_Claim.png\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/bacs-tightens-tone-on-reporting-deadlines\\\/#organizationLogo\"},\"image\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/bacs-tightens-tone-on-reporting-deadlines\\\/#organizationLogo\"},\"sameAs\":[\"https:\\\/\\\/www.twitter.com\\\/SwissGRC\",\"https:\\\/\\\/www.instagram.com\\\/swissgrc\\\/\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UCy4QuXYekCQrA4n5oEwJSJg\",\"https:\\\/\\\/ch.linkedin.com\\\/company\\\/swissgrc\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/author\\\/superadmin\\\/#author\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/author\\\/superadmin\\\/\",\"name\":\"superadmin\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/bacs-tightens-tone-on-reporting-deadlines\\\/#authorImage\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2023\\\/01\\\/logo-red.svg\",\"width\":96,\"height\":96,\"caption\":\"superadmin\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/bacs-tightens-tone-on-reporting-deadlines\\\/#webpage\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/bacs-tightens-tone-on-reporting-deadlines\\\/\",\"name\":\"BACS Reporting Deadline: What Companies Must Prove From 2026\",\"description\":\"From mid-2026, BACS tightens the 24-hour reporting obligation. Which timestamps companies must document without gaps as proof.\",\"inLanguage\":\"en-GB\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/bacs-tightens-tone-on-reporting-deadlines\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/author\\\/superadmin\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/author\\\/superadmin\\\/#author\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2026\\\/08\\\/bacs-tightens-tone-on-reporting-deadlines-swissgrc.webp\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/bacs-tightens-tone-on-reporting-deadlines\\\/#mainImage\",\"width\":1200,\"height\":630,\"caption\":\"Swiss GRC article image showing the logo and an abstract network graphic in blue, category Regulation & Supervision\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/bacs-tightens-tone-on-reporting-deadlines\\\/#mainImage\"},\"datePublished\":\"2026-08-27T16:30:48+02:00\",\"dateModified\":\"2026-08-27T16:36:52+02:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/\",\"name\":\"Swiss GRC - Software Solutions for GRC, CLM &amp; BPM\",\"description\":\"Governance, Risk & Compliance (GRC)\",\"inLanguage\":\"en-GB\",\"publisher\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO Pro -->\r\n\t\t<title>BACS Reporting Deadline: What Companies Must Prove From 2026<\/title>\n\n","aioseo_head_json":{"title":"BACS Reporting Deadline: What Companies Must Prove From 2026","description":"From mid-2026, BACS tightens the 24-hour reporting obligation. Which timestamps companies must document without gaps as proof.","canonical_url":"https:\/\/swissgrc.com\/en\/bacs-tightens-tone-on-reporting-deadlines\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"google-site-verification":"google-site-verification=BAztS2wKP0jEfbvHt4_mrvvD17WwzZg1w1A6R9uoQRU","miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BlogPosting","@id":"https:\/\/swissgrc.com\/en\/bacs-tightens-tone-on-reporting-deadlines\/#blogposting","name":"BACS Reporting Deadline: What Companies Must Prove From 2026","headline":"BACS Tightens Tone on Reporting Deadlines","author":{"@id":"https:\/\/swissgrc.com\/en\/author\/superadmin\/#author"},"publisher":{"@id":"https:\/\/swissgrc.com\/en\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/08\/bacs-tightens-tone-on-reporting-deadlines-swissgrc.webp","width":1200,"height":630,"caption":"Swiss GRC article image showing the logo and an abstract network graphic in blue, category Regulation & Supervision"},"datePublished":"2026-08-27T16:30:48+02:00","dateModified":"2026-08-27T16:36:52+02:00","inLanguage":"en-GB","mainEntityOfPage":{"@id":"https:\/\/swissgrc.com\/en\/bacs-tightens-tone-on-reporting-deadlines\/#webpage"},"isPartOf":{"@id":"https:\/\/swissgrc.com\/en\/bacs-tightens-tone-on-reporting-deadlines\/#webpage"},"articleSection":"Regulation &amp; Supervision, 24-hour reporting obligation cyber incident, BACS fine reporting obligation, critical infrastructure reporting obligation, Information Security Act federal government, NCSC reporting obligation deadline"},{"@type":"BreadcrumbList","@id":"https:\/\/swissgrc.com\/en\/bacs-tightens-tone-on-reporting-deadlines\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/en\/#listItem","position":1,"name":"Home","item":"https:\/\/swissgrc.com\/en\/","nextItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/en\/category\/regulation-supervision\/#listItem","name":"Regulation &amp; Supervision"}},{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/en\/category\/regulation-supervision\/#listItem","position":2,"name":"Regulation &amp; Supervision","item":"https:\/\/swissgrc.com\/en\/category\/regulation-supervision\/","nextItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/en\/bacs-tightens-tone-on-reporting-deadlines\/#listItem","name":"BACS Tightens Tone on Reporting Deadlines"},"previousItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/en\/#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/en\/bacs-tightens-tone-on-reporting-deadlines\/#listItem","position":3,"name":"BACS Tightens Tone on Reporting Deadlines","previousItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/en\/category\/regulation-supervision\/#listItem","name":"Regulation &amp; Supervision"}}]},{"@type":"Organization","@id":"https:\/\/swissgrc.com\/en\/#organization","name":"Swiss GRC AG","description":"Swiss GRC delivers Software Solutions for GRC, CLM &amp; BPM, helping businesses worldwide manage risks, ensure compliance, and drive success.","url":"https:\/\/swissgrc.com\/en\/","telephone":"+41412207500","logo":{"@type":"ImageObject","url":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2023\/06\/Logo_V1_Original_mit_Claim.png","@id":"https:\/\/swissgrc.com\/en\/bacs-tightens-tone-on-reporting-deadlines\/#organizationLogo"},"image":{"@id":"https:\/\/swissgrc.com\/en\/bacs-tightens-tone-on-reporting-deadlines\/#organizationLogo"},"sameAs":["https:\/\/www.twitter.com\/SwissGRC","https:\/\/www.instagram.com\/swissgrc\/","https:\/\/www.youtube.com\/channel\/UCy4QuXYekCQrA4n5oEwJSJg","https:\/\/ch.linkedin.com\/company\/swissgrc"]},{"@type":"Person","@id":"https:\/\/swissgrc.com\/en\/author\/superadmin\/#author","url":"https:\/\/swissgrc.com\/en\/author\/superadmin\/","name":"superadmin","image":{"@type":"ImageObject","@id":"https:\/\/swissgrc.com\/en\/bacs-tightens-tone-on-reporting-deadlines\/#authorImage","url":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2023\/01\/logo-red.svg","width":96,"height":96,"caption":"superadmin"}},{"@type":"WebPage","@id":"https:\/\/swissgrc.com\/en\/bacs-tightens-tone-on-reporting-deadlines\/#webpage","url":"https:\/\/swissgrc.com\/en\/bacs-tightens-tone-on-reporting-deadlines\/","name":"BACS Reporting Deadline: What Companies Must Prove From 2026","description":"From mid-2026, BACS tightens the 24-hour reporting obligation. Which timestamps companies must document without gaps as proof.","inLanguage":"en-GB","isPartOf":{"@id":"https:\/\/swissgrc.com\/en\/#website"},"breadcrumb":{"@id":"https:\/\/swissgrc.com\/en\/bacs-tightens-tone-on-reporting-deadlines\/#breadcrumblist"},"author":{"@id":"https:\/\/swissgrc.com\/en\/author\/superadmin\/#author"},"creator":{"@id":"https:\/\/swissgrc.com\/en\/author\/superadmin\/#author"},"image":{"@type":"ImageObject","url":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/08\/bacs-tightens-tone-on-reporting-deadlines-swissgrc.webp","@id":"https:\/\/swissgrc.com\/en\/bacs-tightens-tone-on-reporting-deadlines\/#mainImage","width":1200,"height":630,"caption":"Swiss GRC article image showing the logo and an abstract network graphic in blue, category Regulation & Supervision"},"primaryImageOfPage":{"@id":"https:\/\/swissgrc.com\/en\/bacs-tightens-tone-on-reporting-deadlines\/#mainImage"},"datePublished":"2026-08-27T16:30:48+02:00","dateModified":"2026-08-27T16:36:52+02:00"},{"@type":"WebSite","@id":"https:\/\/swissgrc.com\/en\/#website","url":"https:\/\/swissgrc.com\/en\/","name":"Swiss GRC - Software Solutions for GRC, CLM &amp; BPM","description":"Governance, Risk & Compliance (GRC)","inLanguage":"en-GB","publisher":{"@id":"https:\/\/swissgrc.com\/en\/#organization"}}]},"og:locale":"en_GB","og:site_name":"Swiss GRC | Governance, Risk &amp; Compliance (GRC)","og:type":"article","og:title":"BACS Reporting Deadline: What Companies Must Prove From 2026","og:description":"From mid-2026, BACS tightens the 24-hour reporting obligation. Which timestamps companies must document without gaps as proof.","og:url":"https:\/\/swissgrc.com\/en\/bacs-tightens-tone-on-reporting-deadlines\/","og:image":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/08\/bacs-tightens-tone-on-reporting-deadlines-swissgrc.webp","og:image:secure_url":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/08\/bacs-tightens-tone-on-reporting-deadlines-swissgrc.webp","og:image:width":1200,"og:image:height":630,"article:published_time":"2026-08-27T14:30:48+00:00","article:modified_time":"2026-08-27T14:36:52+00:00","twitter:card":"summary_large_image","twitter:site":"@SwissGRC","twitter:title":"BACS Reporting Deadline: What Companies Must Prove From 2026","twitter:description":"From mid-2026, BACS tightens the 24-hour reporting obligation. Which timestamps companies must document without gaps as proof.","twitter:creator":"@SwissGRC","twitter:image":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/09\/Yahya-1_1.jpeg","twitter:label1":"Written by","twitter:data1":"superadmin","twitter:label2":"Est. reading time","twitter:data2":"7 minutes"},"aioseo_meta_data":{"post_id":"70299","title":"BACS Reporting Deadline: What Companies Must Prove From 2026","description":"From mid-2026, BACS tightens the 24-hour reporting obligation. Which timestamps companies must document without gaps as proof.","keywords":null,"keyphrases":{"focus":{"keyphrase":"BACS reporting obligation","score":0,"analysis":[]},"additional":[{"keyphrase":"24-hour reporting obligation cyber incident","score":0,"analysis":[]},{"keyphrase":"BACS fine reporting obligation","score":0,"analysis":[]},{"keyphrase":"critical infrastructure reporting obligation","score":0,"analysis":[]},{"keyphrase":"Information Security Act federal government","score":0,"analysis":[]},{"keyphrase":"NCSC reporting obligation deadline","score":0,"analysis":[]}]},"primary_term":null,"canonical_url":null,"og_title":"BACS Reporting Deadline: What Companies Must Prove From 2026","og_description":"From mid-2026, BACS tightens the 24-hour reporting obligation. Which timestamps companies must document without gaps as proof.","og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":"BACS Reporting Deadline: What Companies Must Prove From 2026","twitter_description":"From mid-2026, BACS tightens the 24-hour reporting obligation. Which timestamps companies must document without gaps as proof.","schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"BlogPosting","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"seo_analyzer_scan_date":"2026-08-27 14:38:06","breadcrumb_settings":null,"limit_modified_date":false,"open_ai":null,"ai":{"faqs":[],"keyPoints":[],"schemas":[],"titles":[],"descriptions":[],"socialPosts":{"email":{"subject":"","preview":"","content":""},"linkedin":[],"twitter":[],"facebook":[],"instagram":[]}},"created":"2026-08-27 16:30:48","updated":"2026-09-10 18:54:08","focus_keyword":"BACS","additional_keywords":[{"word":"24-hour reporting obligation cyber incident","score":63,"items":{"introductionKeyword":{"score":3},"keyphraseLength":{"score":6},"keyphraseDensity":{"score":4},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":3}}},{"word":"BACS fine reporting obligation","score":69,"items":{"introductionKeyword":{"score":3},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":4},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":3}}},{"word":"critical infrastructure reporting obligation","score":89,"items":{"introductionKeyword":{"score":9},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":9},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":3}}},{"word":"Information Security Act federal government","score":63,"items":{"introductionKeyword":{"score":3},"keyphraseLength":{"score":6},"keyphraseDensity":{"score":4},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":3}}},{"word":"NCSC reporting obligation deadline","score":69,"items":{"introductionKeyword":{"score":3},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":4},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":3}}}],"truseo_locale":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/swissgrc.com\/en\/\" title=\"Home\">Home<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/swissgrc.com\/en\/category\/regulation-supervision\/\" title=\"Regulation &amp; Supervision\">Regulation &amp; Supervision<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\tBACS Tightens Tone on Reporting Deadlines\n<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/swissgrc.com\/en\/"},{"label":"Regulation &amp; Supervision","link":"https:\/\/swissgrc.com\/en\/category\/regulation-supervision\/"},{"label":"BACS Tightens Tone on Reporting Deadlines","link":"https:\/\/swissgrc.com\/en\/bacs-tightens-tone-on-reporting-deadlines\/"}],"_links":{"self":[{"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/posts\/70299","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/comments?post=70299"}],"version-history":[{"count":1,"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/posts\/70299\/revisions"}],"predecessor-version":[{"id":70301,"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/posts\/70299\/revisions\/70301"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/media\/70300"}],"wp:attachment":[{"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/media?parent=70299"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/categories?post=70299"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/tags?post=70299"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}