Premier League clubs face fines of up to £100,000 ($135,280; €116,872), if they fail to comply with mandatory cybersecurity rules, which are being introduced for the first time this season.
The league’s disciplinary procedures allow the Premier League board to impose punishment through summary jurisdiction if requirements are not met, although points deductions will not be pursued, according to sources briefed on the situation, speaking on the condition of anonymity.
Among the areas covered by the new measures are backups, incident response, risk management and security assurance, with later phases requiring further testing of clubs’ ability to recover from cyber incidents.
The cybersecurity section does not contain a bespoke sanctions regime. Under the Premier League’s general disciplinary rules, its board can issue a reprimand, impose a fine of up to £100,000 through its summary jurisdiction or refer an alleged breach to an independent commission.
This marks a significant tightening of the league’s approach to cybersecurity. Clubs had previously been provided with an implementation roadmap for a security baseline that was described in 2024 as non-prescriptive, but the 2026-27 rules introduce formal requirements and deadlines that clubs must meet.
The measures were approved by Premier League clubs at the league’s Annual General Meeting (AGM) in June following consultation over the previous two seasons. They are being introduced proactively to protect against future cybersecurity incidents rather than in response to a breach.
The standards will be introduced across three phases, with clubs required to comply with the first set of measures by April 30, 2027. Further requirements come into force in April 2028 and April 2029.
Clubs must submit an interim assessment of their compliance by January 10 each season, followed by a final assessment with supporting evidence by April 30.
Where a club is not compliant at the interim stage, it must provide the Premier League with a detailed plan within 28 days setting out how it intends to meet the relevant requirements.
The Premier League can request additional information and evidence to assess a club’s progress, while dispensations from individual requirements can be granted in exceptional circumstances.
