The Premier League’s mandatory cyber security standards introduce new evidence, assurance and remediation expectations for clubs from the 2026/27 season.
The Premier League announced at the start of the 2026/27 season its clubs will be required to assess their cyber security controls, provide evidence of compliance and address identified gaps. This new regulation turns cyber security from a matter of recommended practice into a formal, recurring obligation with implications for club operations, governance and investment.
The requirements will be phased over three seasons. Clubs must submit their first interim assessment by 10 January 2027 and meet the initial compliance deadline by 30 April 2027. Where gaps remain, clubs will need to provide a remediation plan and evidence of progress.
Non-compliance may result in a reprimand or a fine of up to £100,000, while more serious or persistent breaches may be referred for further disciplinary review.
Compliance will not end with the April submission. Clubs will need to maintain their controls, keep evidence current and demonstrate progress through subsequent assessment cycles.
For club leaders, the central question is whether the organisation can evidence effective controls, clear accountability and the ability to recover critical operations following disruption.
The implications extend beyond compliance
Premier League clubs depend on interconnected systems for ticketing, payments, supporter data, stadium access, matchday operations, player and medical information, commercial activity and third-party services. Weakness in any one of these areas can affect the club beyond the technology function.
- Operational disruption: an incident affecting stadium access, ticketing, payments or another critical system can disrupt matchday delivery and wider business operations.
- Commercial and reputational exposure: disruption or data loss can damage relationships with supporters, sponsors, partners and other stakeholders, as well as the club’s wider reputation.
- Governance pressure: evidence-based assessment will increase scrutiny of ownership, assurance, investment decisions and board oversight of cyber risk.
- Third-party dependency: clubs will need assurance over critical suppliers and platforms because outsourcing a service does not remove the club’s accountability for compliance or resilience.
- Delivery pressure: clubs must assess controls, assemble evidence and address gaps alongside day-to-day operations and the football calendar.
- Increased threat exposure: if a club’s cyber resilience weaknesses or compliance gaps become public, malicious actors may see it as a more attractive target. Public disclosure could reveal where controls are perceived to be weaker, increasing the likelihood of targeted phishing, extortion, disruption or attempts to exploit known vulnerabilities.
- Financial and disciplinary penalties: non-compliance may result in a reprimand or a fine of up to £100,000 under the Premier League’s existing disciplinary framework. More serious or persistent breaches may also be referred to an independent commission for further review, creating the potential for increased financial or other disciplinary consequences depending on the circumstances.
The greatest practical risk is identifying these weaknesses too late: unclear ownership, incomplete evidence, limited supplier assurance or recovery arrangements that have not been tested under realistic conditions. If those weaknesses are then publicised, the club could face greater scrutiny while also becoming a more visible target for malicious activity. Continued non-compliance may also expose the club to financial penalties, referral for further disciplinary review and the reputational impact of being seen to have failed a mandatory League requirement.
What clubs should focus on now
The immediate priority is to establish a reliable view of readiness before the first interim assessment. Clubs need to know which requirements apply, what evidence can be relied on, which gaps create the greatest exposure and who is accountable for addressing them.
Because the requirements are phased over three seasons, clubs should plan beyond the first submission. Compliance activity should support wider cyber and operational resilience priorities so that investment addresses material risk as well as the League’s requirements.
How we can help
Airwalk Reply helps organisations assess cyber and operational resilience, establish where assurance is reliable and prioritise action against regulatory or industry requirements. For Premier League clubs, this means an independent view of readiness and a proportionate route to compliance that reflects how the club operates.
Our work brings together cyber resilience, operational risk and regulatory experience. We help leadership and delivery teams identify material gaps, clarify accountability and direct effort towards the areas that matter most. Support is shaped around each club’s risks, operating model and existing capability.
A useful first conversation
Clubs do not need every answer now, but they do need a clear and defensible starting position. Leaving readiness work until the submission window will reduce the time available to confirm evidence, agree priorities and address material gaps.
Speak to Airwalk Reply
If you want an independent view of your club’s readiness and the risks that matter most, speak to us about a focused initial conversation.
