Does PCI DSS v4.0.1 create a new general cybersecurity law?

PCI DSS is an industry standard within the payment-card ecosystem, not a general federal law. PCI SSC's v4.0.1 publication retained 31 March 2025 for the future-dated requirements; the Council also issued specific SAQ A changes in January 2025. Version announcement; SAQ A update.

What to do now: ask the acquirer or qualified assessor to confirm the correct validation route and scope for the actual payment flow. Check the effects of outsourced payment pages, scripts, service providers and changes to the checkout design. Do not buy a generic “PCI package” before that conversation.

Evidence to retain: documented scope, applicable assessment, exceptions, owner decisions and validation results. A vendor's product description cannot itself establish the merchant's compliance.