PCI DSS is a card industry standard, not law. It is issued by the PCI Security Standards Council and enforced contractually by the card brands and acquirers rather than by any regulator. Version 4.0.1 was current as of August 2026, with all previously future-dated v4.x requirements mandatory since 31 March 2025. The Council ran a request for comments on v4.0.1 in mid-2026, so a successor version is plausible but unscheduled: confirm the current version before relying on this entry.