Regulation
44 analyses
Political agreement between the Council and Parliament postpones the August 2026 deadline and opens a 19-month window for compliance, but fines and the extraterritoriality clause remain intact.
In August 2026, the EU AI Act imposes its first binding obligations for high-risk systems. Meanwhile, four US states have AI laws in effect that clash with the federal strategy of the Trump administration. For companies, compliance now means managing conflicting jurisdictions.
The Illinois Biometric Information Privacy Act (BIPA) has generated over $2.5 billion in settlements since 2008 and continues to produce record litigation. In 2025, Texas and Washington expanded similar legislation. In Europe, the AI Act classifies remote identification biometric systems as high risk. The proliferation of facial recognition cameras and voice authentication in the corporate environment exposes companies to increasing legal risks.
Since 2018, GDPR has accumulated €7.1 billion in fines, with 60% of the total issued after January 2023 alone. In August 2026, the EU AI Act adds a second layer: penalties of up to €35 million or 7% of global revenue. Organisations processing data with AI face dual and simultaneous regulatory exposure.
China has built the world's most detailed and layered AI regulatory framework. With three main regulations already in effect and at least two more in preparation, the country requires registration of foundational models, pre-launch security assessments, and control of AI-generated content. Companies with operations or users in China need to map compliance across multiple fronts simultaneously.
The SEC's rules on the disclosure of cyber incidents, effective from December 2023, require reporting of material incidents within four business days via Form 8-K. In May 2025, American banking associations petitioned the SEC to revoke the rule. The practical outcome: the CISO has become a direct interlocutor for the board and legal department in materiality decisions.
In December 2024, the Brazilian Senate approved PL 2338/2023, which establishes the regulatory framework for AI in the country. In March 2025, the text was forwarded to the Chamber of Deputies. The law adopts a risk-based approach, with three categories: excessive risk (prohibited), high risk (with stringent requirements), and other systems (general obligations). For developers and operators, the impacts are immediate and structural.
The Digital Operational Resilience Act came into effect on 17 January 2025, imposing uniform digital resilience requirements on approximately 22,000 financial entities in the European Union. In November 2025, AWS, Microsoft Azure, and Google Cloud were designated critical ICT providers, subject to direct audit by European regulators.