Key Takeaways:
- The PCI DSS 4.0.1 requirements that were designated as future-dated requirements, 51 in total, became mandatory on March 31, 2025. There is no remaining transition window left in the standard.
- 2026 is the first full calendar year in which PCI DSS assessments are being conducted entirely after the March 31, 2025 deadline, meaning some merchants may be encountering these requirements as mandatory for the first time during their current assessment cycle.
- PCI SSC’s June 2026 guidance on compensating controls and the Customized Approach gives merchants and assessors a clearer, less subjective way to justify non-standard controls.
- Mid-market merchants who treated 2025 as a future deadline are discovering implementation gaps during the assessment itself, the costliest possible point to find them.
PCI DSS 4.0’s future-dated requirements, the 51 new controls the standard introduced as best practices, became mandatory on March 31, 2025. That date has already passed, and 2026 is the first full calendar year in which every PCI DSS assessment occurs after that deadline. For merchants whose previous assessment occurred before March 31, 2025, some of those requirements may therefore be tested as mandatory for the first time. For merchants who spent 2025 treating those requirements as someday work, the gap is showing up now, during the assessment itself.
THE FUTURE-DATED REQUIREMENTS AREN’T FUTURE ANYMORE
PCI DSS 4.0 replaced version 3.2.1 as the only active standard on March 31, 2024, with a set of initial requirements that took effect at rollout. A second wave, the requirements the Council originally listed as best practices rather than mandatory controls, carried a one-year runway before becoming enforceable on March 31, 2025. Version 4.0.1 clarified wording and closed gaps in 4.0 without changing that timeline. There is no remaining transition window in either version. A requirement that shows up in an assessment today gets tested as a mandatory control.
2026 IS WHEN THE GAP SHOWS UP
A compliance deadline that passed without incident a year ago doesn’t feel real until an assessor sits down and tests against it. That’s what’s happening across 2026 assessment cycles: merchants whose 2025 roadmap listed the newer requirements as “in progress” are now being evaluated against requirements that have been mandatory since March 31, 2025. For organizations whose previous validation occurred before that date, the current assessment may be the first time some of those requirements are being formally tested as mandatory controls.
The organizations getting caught off guard are often the ones who took PCI DSS 4.0.1 seriously: they tracked the deadline and planned around it reasonably, but still ran out of runway, leaving the requirements written into policy before they were running in production.
NEW PCI SSC GUIDANCE SHARPENS THE CUSTOMIZED APPROACH
The PCI Security Standards Council added a useful tool to this cycle in June 2026, publishing new guidance on compensating controls and the Customized Approach. Both provide flexibility, but they serve different purposes. Compensating controls are used within the Defined Approach when a legitimate technical or documented business constraint prevents an organization from meeting a requirement as stated. The Customized Approach, by contrast, allows an organization to intentionally implement a different control design that meets the requirement’s Customized Approach Objective. The new guidance gives merchants and assessors additional practical guidance and examples for documenting and validating each approach, which matters directly for any merchant whose environment doesn’t map cleanly onto the standard’s default controls.
WHAT TO CHECK BEFORE YOUR NEXT ASSESSMENT
A mid-market merchant heading into an assessment cycle should be able to answer these without waiting for the assessor to ask first:
- For each requirement that became mandatory in March 2025, is there implementation evidence on file, beyond a policy describing the intended control?
- Where a compensating control or the Customized Approach is in use, does the documentation now reflect the Council’s June 2026 guidance, or does it still rely on an older, more subjective justification?
- Has anyone reviewed the merchant’s own Report on Compliance or Self-Assessment Questionnaire against the mandatory requirements before the assessor does, rather than during the engagement?
Finding a gap during an internal review costs a remediation sprint but finding the same gap in the middle of an assessment costs the assessment itself.
PCI DSS 4.0.1 stopped being a future problem in March 2025. What changed in 2026 is the number of merchants discovering the difference between planning for a requirement and having it in place.
