Australia Wants Companies Disclose Ransomware Payments

Australia Wants Companies Disclose Ransomware Payments – that’s the headline grabbing attention, and rightfully so! This isn’t just another cybersecurity story; it’s a potential game-changer in how businesses handle ransomware attacks. The Australian government is considering mandatory disclosure of ransomware payments, a move that sparks intense debate. Will this boost transparency and deter future attacks, or will it inadvertently expose vulnerabilities and empower cybercriminals?

Let’s dive into the fascinating complexities of this proposal.

The proposed legislation aims to force companies to report ransomware payments, a move that has both fervent supporters and staunch critics. Proponents argue that increased transparency will discourage attacks by making the financial incentives less attractive. Others worry that mandatory disclosure could lead to more attacks, as criminals would know exactly how much they could potentially extort. The potential impact on small businesses, insurance policies, and international relations is equally complex, making this a truly multifaceted issue.

Current Australian Legislation Regarding Data Breaches and Ransomware Payments: Australia Wants Companies Disclose Ransomware Payments

Australia’s approach to data breaches and ransomware payments is evolving, reflecting a global shift towards greater transparency and accountability. While specific legislation directly addressing ransomware payments is still developing, existing frameworks around data breach notification and broader corporate responsibility provide a foundation for managing these complex incidents. This post explores the current legal landscape and compares it to international best practices.

Mandatory Data Breach Notification in Australia

The key legislation governing data breaches in Australia is the Privacy Act 1988, specifically through the Australian Privacy Principles (APPs). APP 11 requires organisations to take reasonable steps to notify individuals if there has been an eligible data breach. An eligible data breach is defined as an unauthorised access or disclosure of personal information that is likely to result in serious harm to an individual.

The notification must include details about the breach, the types of personal information involved, and steps individuals can take to protect themselves. The legislation focuses on notifying affected individuals, not necessarily public disclosure of the ransomware payment itself. The threshold for “serious harm” is crucial, and interpretations can vary.

Regulations and Guidelines Concerning Ransomware Payments

There aren’t specific Australian regulations directly prohibiting or mandating the disclosure of ransomware payments. However, several existing laws and guidelines indirectly influence how organisations should handle these situations. The Australian Securities and Investments Commission (ASIC) and the Australian Prudential Regulation Authority (APRA) provide guidance for companies in regulated sectors regarding cybersecurity and incident response. These guidelines often emphasise the importance of transparency and timely disclosure of material information to stakeholders, which could arguably encompass significant ransomware incidents.

Furthermore, general corporate law principles regarding directors’ duties and obligations to act in the best interests of the company could also influence decision-making around ransomware payments and their disclosure.

Comparison with International Best Practices on Ransomware Disclosure

Internationally, there’s a growing trend towards greater transparency regarding ransomware payments. Some jurisdictions are exploring mandatory reporting requirements, particularly for critical infrastructure sectors. The US, for example, is moving towards greater regulatory scrutiny of ransomware attacks and payments. The UK’s National Cyber Security Centre (NCSC) provides guidance emphasizing proactive security measures and responsible disclosure, while encouraging reporting of incidents to relevant authorities.

Compared to these international counterparts, Australia’s current approach is relatively less prescriptive. While the focus on individual notification under APP 11 is important, a clearer framework specifically addressing ransomware payments and public disclosure is arguably needed to align with international best practices and foster greater transparency and accountability.

Penalties for Non-Compliance: Australia and Other Countries

The penalties for non-compliance with data breach notification laws vary significantly across jurisdictions. In Australia, the Office of the Australian Information Commissioner (OAIC) can issue infringement notices for breaches of the APPs, with penalties ranging from thousands to millions of dollars depending on the severity of the breach and the organisation’s culpability. Other countries have even more stringent penalties.

Arguments For Mandatory Disclosure of Ransomware Payments

The debate surrounding mandatory disclosure of ransomware payments in Australia is complex, but a compelling case can be made for transparency. While concerns exist about potentially emboldening attackers, the benefits of open reporting significantly outweigh these risks, ultimately contributing to a stronger and more resilient cybersecurity landscape. Transparency fosters a culture of proactive security and helps build a more informed and prepared nation.Public disclosure of ransomware payments acts as a powerful deterrent to future attacks.

Criminals thrive in secrecy; the light of public scrutiny significantly reduces the appeal of targeting organizations known to be transparent about such incidents. The potential reputational damage, coupled with the increased likelihood of regulatory scrutiny and potential legal ramifications, creates a substantial disincentive. This deterrent effect extends beyond the directly affected organizations, influencing the risk assessment of potential targets across various sectors.

Improved Cybersecurity Practices Through Public Disclosure

Open reporting of ransomware payments can dramatically improve cybersecurity practices across industries. When incidents are publicly disclosed, a wealth of information becomes available for analysis. This includes details about the attack vector, the type of ransomware used, and the effectiveness of the organization’s security measures. This collective learning fosters a shared understanding of evolving threats and best practices, driving improvements in prevention and mitigation strategies.

The knowledge gained from disclosed incidents allows other organizations to learn from mistakes and proactively strengthen their own defenses, creating a ripple effect of enhanced cybersecurity preparedness.

Enhanced Incident Response Strategies with Open Data

The availability of open data related to ransomware payments significantly enhances incident response strategies. Analyzing patterns and trends from disclosed incidents allows for the development of more effective incident response plans. This includes better preparation for negotiation with attackers, understanding the likely demands, and developing strategies for data recovery and system restoration. The collective knowledge derived from open data enables the creation of standardized response protocols and the development of more effective tools and technologies for dealing with ransomware attacks.

For instance, understanding common attack vectors from previous incidents allows for the implementation of more robust preventative measures.

Preventing Further Damage Through Transparency

In several instances, the lack of transparency surrounding ransomware payments has exacerbated the damage caused by attacks. Consider a scenario where a critical infrastructure provider is hit with ransomware. If the payment is kept secret, the vulnerability remains undisclosed, potentially allowing other attackers to exploit the same weakness. Public disclosure, however, would alert other organizations to the specific vulnerability, allowing them to patch their systems and prevent similar attacks.

Similarly, transparency can help identify trends in attacker tactics, enabling the development of more effective countermeasures and ultimately preventing widespread damage. For example, if multiple organizations disclose being targeted by the same ransomware-as-a-service (RaaS) group, a coordinated response can be initiated, potentially leading to the disruption of the criminal operation.

Arguments Against Mandatory Disclosure of Ransomware Payments

The debate surrounding mandatory disclosure of ransomware payments is complex, with compelling arguments on both sides. While transparency can foster a more secure digital environment, forcing companies to publicly admit to paying ransoms raises serious concerns about the potential for unintended negative consequences. This section explores the counterarguments against mandatory disclosure, focusing on the risks and potential harms associated with such a policy.

A key concern is the potential for mandatory disclosure to inadvertently incentivize further attacks. Public knowledge of a company’s vulnerability, demonstrated by their willingness to pay a ransom, could attract more sophisticated and frequent attacks. Criminals might view companies that have already paid ransoms as easier targets, leading to a cycle of exploitation and increased financial losses.

Increased Attack Frequency and Sophistication

The revelation of a successful ransomware attack, coupled with the confirmation of a ransom payment, paints a clear target for future attacks. Cybercriminals can assess the company’s security posture, identify weaknesses exploited in the initial attack, and refine their tactics for future intrusions. This knowledge could also embolden less sophisticated actors to attempt attacks, increasing the overall volume of ransomware incidents.

For example, if a large corporation publicly admits to paying a significant ransom, it signals to other threat actors that this company is a potentially lucrative target with the resources to pay, thus potentially attracting a surge in attacks.

Negative Impact on Company Reputation and Share Price

Public disclosure of a ransomware attack and subsequent payment can severely damage a company’s reputation. This can lead to a loss of customer trust, damage to brand image, and ultimately, a decline in share price. Investors may perceive a company that has been victimized by ransomware as having inadequate security measures, potentially leading to divestment and financial instability.

The reputational damage could be amplified if the disclosed payment is large, or if sensitive customer data was compromised during the attack. For instance, a major retailer announcing a substantial ransom payment could see its stock price plummet due to investor concerns about data security and the company’s handling of the incident.

Increased Extortion Attempts

Mandatory disclosure could potentially embolden cybercriminals to engage in more aggressive extortion tactics. Knowing that a company is obligated to publicly reveal a ransom payment, attackers could demand larger sums, threaten to release more damaging information, or prolong the attack to maximize their leverage. This could lead to a chilling effect, where companies feel compelled to pay higher ransoms to avoid the reputational and financial damage of public disclosure, further enriching cybercriminals.

In scenarios where the attacker already has access to sensitive data, the threat of public exposure becomes a powerful tool for extortion.

Examples of Unintended Negative Consequences

While specific examples of direct negative consequences from mandatory disclosure are difficult to isolate without a policy in place, we can extrapolate from existing cases. Consider a scenario where a small business, already struggling financially, is forced to disclose a ransomware payment. The public revelation could further strain its finances, leading to bankruptcy. Conversely, a large corporation might face significant investor pressure and legal challenges following disclosure, even if their security protocols were robust and the attack was highly sophisticated.

The focus would shift from the attacker’s malicious actions to the company’s handling of the incident, leading to a negative public perception regardless of their efforts to mitigate the attack. This illustrates the potential for unintended consequences that disproportionately affect businesses of varying sizes and resources.

The Role of Insurance in Ransomware Payments and Disclosure

Cyber insurance has become a crucial component in managing the risks associated with ransomware attacks. However, the interplay between insurance coverage, ransomware payments, and mandatory disclosure laws creates a complex landscape for businesses. Understanding the typical policy clauses, the insurance industry’s potential response to regulatory changes, and the impact on premiums is essential for effective risk management.Cyber insurance policies typically include clauses specifying coverage for ransomware incidents.

These clauses often detail the extent of coverage for ransom payments, incident response costs, data recovery, and business interruption. Crucially, many policies include conditions and exclusions, such as requirements for prompt notification, cooperation with investigations, and adherence to best security practices. The specifics vary significantly between insurers and policies, so careful review is essential.

Typical Clauses in Cyber Insurance Policies Regarding Ransomware Payments

Common clauses address the insurer’s obligation to cover ransomware payments, often setting limits on the maximum payout. Some policies may require prior authorization before a ransom is paid, while others might offer reimbursement after the payment, subject to a thorough investigation. Policies often stipulate the methods of payment and documentation required to substantiate the claim. Exclusions might exist for payments made to known terrorist organizations or if the insured failed to maintain adequate security measures.

For example, a policy might cover up to $1 million in ransom payments but exclude coverage if the insured knowingly ignored a known software vulnerability.

Insurance Company Responses to Mandatory Disclosure Laws

Mandatory disclosure laws could significantly alter the insurance landscape. Insurers might respond by adjusting their underwriting processes, potentially increasing premiums for businesses deemed high-risk due to insufficient security measures or a history of incidents. They may also introduce stricter policy clauses, including more stringent reporting requirements and penalties for non-compliance. Some insurers might even choose to limit or withdraw coverage for ransomware altogether in jurisdictions with particularly stringent disclosure mandates.

The potential for increased litigation related to non-disclosure could also drive insurers to be more cautious.

Potential Impact on Insurance Premiums with Mandatory Disclosure

Mandatory disclosure could lead to a rise in insurance premiums. This increase reflects the increased risk for insurers, as public disclosure might lead to reputational damage for the insured company, potentially impacting the insurer’s brand as well. Furthermore, mandatory disclosure provides more data for insurers to assess risk, which could lead to more accurate, and potentially higher, premiums.

The extent of the premium increase would depend on various factors, including the specific industry, the size of the company, and the jurisdiction’s disclosure requirements. For example, a small business in a heavily regulated sector might experience a more substantial premium increase than a larger company in a less regulated sector.

Different Insurance Approaches to Ransomware Incidents, Australia wants companies disclose ransomware payments

Insurance companies adopt different approaches to handling ransomware incidents. Some insurers actively assist insured parties with incident response, providing access to forensic experts and legal counsel. Others primarily focus on financial reimbursement after a thorough investigation of the incident. Some insurers might offer proactive security assessments and training as part of their policy, encouraging preventative measures. The choice of insurer should be based on the level of support and the specific needs of the business.

A company with limited internal cybersecurity expertise might benefit from an insurer offering extensive incident response support, whereas a company with robust internal capabilities might prioritize an insurer with a strong track record of financial reimbursement.

Impact on Small and Medium-Sized Enterprises (SMEs)

The debate surrounding mandatory ransomware payment disclosure often overlooks a crucial stakeholder: small and medium-sized enterprises (SMEs). These businesses, the backbone of many economies, face unique challenges in responding to ransomware attacks and disproportionately bear the brunt of mandatory disclosure regulations. Their limited resources and often less robust cybersecurity infrastructure make them particularly vulnerable.SMEs’ Unique Challenges in Responding to Ransomware AttacksSMEs frequently lack the dedicated cybersecurity personnel and sophisticated technology possessed by larger corporations.

This leaves them more susceptible to ransomware attacks and less equipped to handle the complexities of recovery. Many lack comprehensive backup and recovery plans, leading to significant data loss and prolonged downtime. Furthermore, the financial resources available to SMEs are often far more limited than those of larger organizations, hindering their ability to invest in robust cybersecurity measures or to quickly pay a ransom.

This lack of resources also impacts their ability to engage external cybersecurity experts for incident response. A small business owner might have to personally manage the crisis alongside their day-to-day operations, leading to further stress and potentially exacerbating the situation. The lack of dedicated IT staff means that the burden of recovery often falls on already overstretched employees.

Disproportionate Impact of Mandatory Disclosure on SMEs

Mandatory disclosure places an additional burden on SMEs, potentially damaging their reputation and hindering their ability to secure future business. Unlike larger corporations with dedicated PR teams and legal counsel, SMEs often lack the resources to manage the fallout from a public announcement of a ransomware attack. The disclosure itself could trigger a loss of customer confidence, impacting sales and potentially leading to financial ruin.

Smaller businesses rely heavily on their reputation for trustworthiness and reliability; a ransomware attack and subsequent disclosure can severely damage this perception, even if the business takes swift and effective action to mitigate the impact. For example, a small bakery suffering a ransomware attack might face a significant drop in customers if the attack is publicly disclosed, leading to a potentially devastating financial impact.

Financial Burdens of Compliance for SMEs

The costs associated with complying with mandatory disclosure requirements can be crippling for SMEs. These costs extend beyond the immediate financial impact of the ransomware attack itself. SMEs might need to engage external legal and PR professionals to manage the disclosure process, incurring significant fees. They may also face fines or penalties if they fail to comply with the reporting requirements, adding to their financial burden.

The cost of restoring systems and data, coupled with the potential loss of revenue during downtime, further compounds the financial strain. A small manufacturing company, for example, could face substantial losses if production is halted during a ransomware recovery, potentially leading to missed deadlines and contract breaches.

Support Program for SMEs Navigating Mandatory Disclosure Requirements

A comprehensive support program is crucial to help SMEs navigate the complexities of mandatory disclosure. This program should include:

• Financial assistance: Grants or subsidies to cover the costs of legal, PR, and cybersecurity services related to disclosure.
• Cybersecurity training and resources: Free or low-cost training programs to enhance SMEs’ cybersecurity awareness and preparedness.
• Simplified reporting procedures: Streamlined reporting processes tailored to the specific needs and resources of SMEs.
• Access to cybersecurity experts: A network of cybersecurity professionals who can provide SMEs with affordable and accessible support.
• Public awareness campaigns: Educating the public about the challenges faced by SMEs in ransomware attacks to foster understanding and empathy.

Such a program would ensure that mandatory disclosure doesn’t disproportionately harm SMEs and instead helps them strengthen their cybersecurity posture and navigate the challenges of ransomware attacks effectively.

Potential Enforcement Mechanisms and Challenges

Enforcing mandatory disclosure laws for ransomware payments presents significant challenges. The clandestine nature of ransomware attacks, coupled with the complexities of international jurisdictions and the potential for victims to prioritize damage control over reporting, creates a difficult environment for regulators. Effective enforcement requires a multi-pronged approach, combining robust monitoring, clear penalties, and proactive engagement with affected organizations.

Challenges in Enforcing Mandatory Disclosure Laws

Several hurdles complicate the effective enforcement of mandatory disclosure legislation. Firstly, identifying ransomware attacks can be difficult, as victims may not always report them, especially if they’ve paid the ransom and believe the matter is resolved. Secondly, proving the payment itself can be challenging, as transactions are often conducted through cryptocurrencies, designed to obfuscate origins and recipients. Thirdly, the international nature of cybercrime complicates jurisdictional issues.

A company based in Australia might be attacked from overseas, requiring international cooperation for effective investigation and enforcement. Finally, the fear of reputational damage can dissuade organizations from reporting incidents, hindering enforcement efforts. Balancing the need for transparency with the potential for market disruption remains a delicate task.

Methods for Monitoring Compliance

Monitoring compliance with mandatory disclosure laws requires a multi-faceted approach. Regulatory bodies could leverage existing data breach notification systems to incorporate ransomware payments into reporting requirements. This could involve expanding existing reporting forms to include questions about ransom payments, attack vectors, and the amounts paid. Furthermore, analyzing publicly available information, such as news reports and dark web forums, can provide insights into ransomware attacks and potential non-compliance.

Collaboration with cybersecurity firms and threat intelligence providers could significantly enhance monitoring capabilities. Finally, proactive audits of organizations in high-risk sectors could serve as a deterrent and help identify potential violations.

Australia’s push for mandatory ransomware payment disclosure is a smart move, forcing transparency in a shadowy world. Building robust, secure systems is crucial, and that’s where learning about the future of application development comes in, like exploring the possibilities discussed in this great article on domino app dev the low code and pro code future. Ultimately, stronger security measures, informed by advancements like low-code/pro-code development, are key to reducing ransomware attacks and the need for such disclosures.

Potential Penalties for Non-Compliance

Penalties for non-compliance must be substantial enough to act as a deterrent but also proportionate to the offense. Potential penalties could include significant financial fines, scaled to the size of the organization and the amount of the ransom payment. Other penalties could involve mandatory security audits, public naming and shaming, and suspension or revocation of licenses in regulated industries.

For repeat offenders, even criminal prosecution could be considered. The severity of the penalty should also take into account factors such as the organization’s efforts to mitigate the attack and its cooperation with investigations. A tiered penalty system could offer flexibility and ensure fairness.

The Role of Regulatory Bodies in Enforcement

Regulatory bodies play a crucial role in enforcing mandatory disclosure laws. Their responsibilities include developing clear guidelines, investigating suspected violations, imposing penalties, and fostering collaboration with other agencies and international partners. Effective enforcement requires dedicated resources, specialized expertise in cybersecurity and data privacy, and the ability to handle complex international investigations. Strong collaboration with law enforcement agencies is vital for tackling the criminal aspects of ransomware attacks.

Regular review and updating of enforcement mechanisms are also necessary to adapt to the evolving landscape of cyber threats.

International Comparisons and Best Practices

The global response to ransomware attacks is varied, reflecting differing legal frameworks, cybersecurity capabilities, and national priorities. Understanding how other countries approach mandatory disclosure, incident response, and international cooperation offers valuable insights for Australia’s ongoing policy development. A comparative analysis reveals both successful models and areas needing further refinement.

Several countries have adopted different strategies for managing ransomware incidents, ranging from strong encouragement of voluntary disclosure to mandatory reporting requirements. These approaches impact the effectiveness of incident response, the ability to track ransomware trends, and the overall security posture of businesses and governments. The success of these strategies is often measured by factors like the reduction in the impact of attacks, improved coordination between stakeholders, and the deterrence of future attacks.

Ransomware Disclosure Requirements in Various Jurisdictions

The United States, for instance, doesn’t mandate ransomware payment disclosure at the federal level, relying instead on a patchwork of state-level regulations and industry best practices. This approach fosters a degree of flexibility but can lead to inconsistencies in reporting and response. In contrast, certain European nations, such as some within the EU, have implemented stricter data breach notification laws that, while not explicitly focused on ransomware, often encompass ransomware payments as part of the broader data breach disclosure requirements.

These regulations typically require organizations to notify authorities and affected individuals within a specific timeframe following a data breach. The specifics of what constitutes a reportable breach, however, can vary significantly. For example, the definition of “personal data” differs across jurisdictions, leading to differing interpretations of the applicability of ransomware disclosure regulations.

Successful International Models for Managing Ransomware Incidents

The UK’s National Cyber Security Centre (NCSC) provides a strong example of a successful national approach. Their focus on proactive guidance, incident response support, and threat intelligence sharing has proven effective in mitigating the impact of ransomware attacks. Their active engagement with the private sector, providing resources and support, encourages timely reporting and facilitates a more coordinated response.

Similarly, Singapore’s Cyber Security Agency (CSA) has implemented a robust framework combining regulatory guidance, incident response capabilities, and public-private partnerships. This collaborative approach encourages early detection and response, minimizing the impact of ransomware attacks.

Examples of Effective Regulatory Frameworks

The EU’s General Data Protection Regulation (GDPR) is a significant influence on data breach notification laws globally. While not explicitly addressing ransomware payments, its broad scope and stringent requirements for data protection and notification have driven improvements in data security practices and incident response across many jurisdictions. This regulation serves as a benchmark for comprehensive data protection and highlights the importance of a robust regulatory framework in mitigating the impact of ransomware attacks.

The GDPR’s emphasis on accountability and data minimization incentivizes organizations to implement strong security measures and promptly report breaches, including those involving ransomware.

International Cooperation in Combating Ransomware

Effective international cooperation is crucial in tackling ransomware. Sharing threat intelligence, coordinating law enforcement efforts, and establishing mutual legal assistance treaties can significantly enhance the global response to ransomware attacks. International collaborations, such as those facilitated by Interpol and Europol, are vital in tracking down ransomware operators, disrupting their activities, and recovering stolen data. These collaborations also facilitate the exchange of best practices and the development of coordinated strategies for mitigating ransomware threats.

For example, joint investigations across borders allow law enforcement agencies to track the flow of ransomware payments, identify the perpetrators, and potentially recover the stolen data.

Visual Representation of Key Data Points

Data visualization is crucial for understanding the complex landscape of ransomware attacks in Australia. By presenting key information graphically, we can better grasp the frequency of attacks across different sectors, the process of responding to an incident, and the financial impact on businesses of varying sizes. This section provides three visual representations to illustrate these critical aspects.

Ransomware Attack Frequency by Sector in Australia

The following bar chart depicts the hypothetical frequency of ransomware attacks across various sectors in Australia. Note that precise, publicly available data on ransomware attack frequency broken down by sector is often limited due to underreporting. This chart uses estimated data for illustrative purposes. It’s important to remember that these figures are estimations based on available reports and may not represent the complete picture.

Ransomware Attack Response and Disclosure Process

This flowchart Artikels the typical steps involved in responding to a ransomware attack and the subsequent disclosure process. The process can vary depending on the severity of the attack and the organization’s specific policies and procedures. Effective and timely response is critical to minimize damage and comply with legal obligations.

Step 1: DetectionIdentify the ransomware attack.
Step 2: ContainmentIsolate affected systems to prevent further spread.
Step 3: InvestigationDetermine the extent of the breach and data compromised.
Step 4: RecoveryRestore data from backups or implement alternative solutions.
Step 5: NotificationNotify relevant authorities and affected individuals as required by law.

Step 6: RemediationImplement security measures to prevent future attacks.
Step 7: Disclosure (if applicable)

Publicly disclose the incident if mandated by law or deemed necessary.

Financial Impact of Ransomware Attacks on Businesses of Different Sizes

The following table illustrates the potential financial impact of ransomware attacks on businesses of varying sizes. The figures are estimates and can vary significantly based on factors such as the type of ransomware, the amount of data compromised, and the business’s response capabilities. Larger organizations often face higher financial losses due to greater data volumes and more complex IT infrastructure.

However, the relative impact on smaller businesses can be proportionally devastating.

Last Recap

The debate surrounding mandatory ransomware payment disclosure in Australia is far from over. It’s a high-stakes game of risk versus reward, with potentially significant consequences for businesses, governments, and the overall cybersecurity landscape. While transparency is often lauded, the potential unintended consequences of forcing disclosure need careful consideration. The ultimate outcome will likely shape not only Australian cybersecurity policy but also influence international best practices in dealing with the ever-evolving threat of ransomware.

Quick FAQs

What are the potential penalties for non-compliance with mandatory ransomware disclosure in Australia?

This is currently undefined but could range from hefty fines to legal action depending on the final legislation.

How will Australia enforce mandatory ransomware disclosure?

Enforcement mechanisms are still being developed but might involve audits, investigations, and collaboration with industry bodies.

Does mandatory disclosure apply to all types of ransomware attacks?

The specifics of which attacks would be subject to mandatory disclosure are likely to be detailed in the final legislation. It’s expected to cover significant attacks impacting critical infrastructure or large amounts of data.

Will this affect my small business?

Yes, potentially. The impact on SMEs is a major concern, and the legislation may include provisions to support smaller businesses in complying with the new rules.