Regulatory compliance, risk assessment frameworks, GDPR, and governance strategies for international businesses.
The European Commission’s Digital Omnibus proposal bundles ten reforms to GDPR and the EU AI Act, signalling a structural rationalisation of Europe’s digital compliance landscape. For CFOs, General Counsel, and risk teams, the window between proposal and implementation is a strategic opportunity — not a reason to pause.
GDPR fines have surpassed €7.1 billion, with over 60% of penalties issued since January 2023 — and enforcement is intensifying beyond Big Tech. With the EU AI Act reaching full force in August 2026, organizations face a converging regulatory stack that demands board-level accountability and mature governance programs.
A provisional EU Council–Parliament agreement on the AI Act delays high-risk compliance deadlines to 2027–2028 but accelerates transparency and watermarking rules to December 2026. CFOs and General Counsel must now sequence compliance investment carefully and align AI governance with existing GDPR frameworks.
The EU AI Act provisional deal extends high-risk compliance deadlines to 2027–2028 but accelerates watermarking and transparency obligations to December 2026. CFOs and General Counsel must reprioritize now — the near-term compliance burden is heavier than the headlines suggest.
The EU AI Act’s provisional deadline extensions shift high-risk AI compliance obligations to December 2027 and August 2028 — but penalties remain unchanged and the AI-generated content transparency deadline arrives in December 2026. Here is what executive teams must prioritise now.
The CJEU’s review of FATCA-driven EU–US bank data transfers under GDPR, combined with the Digital Omnibus proposals and EDPB’s updated BCR-P guidance, signals a structural realignment of cross-border data compliance obligations in 2026. Mid-market and multinational firms must act now to integrate these developments into their enterprise risk management and M&A due diligence frameworks.
As EU Digital Omnibus reforms to GDPR and the AI Act remain in active negotiation, and CJEU scrutiny of EU-US data transfers intensifies, mid-market firms face a dual compliance horizon demanding immediate action. CFOs and General Counsel must integrate data privacy, AML, and enterprise risk management into a unified governance strategy before the next enforcement cycle begins.
The European Commission’s proposals to revise GDPR and the EU AI Act — including a delay of high-risk AI rules to December 2027 and projected savings of €5 billion by 2029 — represent a structural shift in EU digital governance. For CFOs, General Counsel, and board members, the reforms create strategic opportunity, but enforcement gaps and existing obligations demand immediate attention.
As of 2 August 2025, EU AI Act Article 5 prohibitions are fully enforceable, with fines reaching €35M or 7% of global turnover for the most severe violations. Mid-market firms deploying AI in Europe must act now to audit prohibited practices, align governance frameworks, and address overlapping GDPR and AML obligations.
The CJEU’s January–February 2026 rulings on pseudonymized data and FATCA transfers, combined with the EDPB’s updated Processor BCR framework, are reshaping GDPR compliance obligations for European businesses. CFOs, General Counsel, and M&A directors must act now to audit data inventories, stress-test cross-border financial data flows, and integrate data privacy risk into corporate governance frameworks.