Compliance & Risk Management

A provisional EU Council–Parliament agreement on the AI Act delays high-risk compliance deadlines to 2027–2028 but accelerates transparency and watermarking rules to December 2026. CFOs and General Counsel must now sequence compliance investment carefully and align AI governance with existing GDPR frameworks.

The EU AI Act provisional deal extends high-risk compliance deadlines to 2027–2028 but accelerates watermarking and transparency obligations to December 2026. CFOs and General Counsel must reprioritize now — the near-term compliance burden is heavier than the headlines suggest.

The EU AI Act’s provisional deadline extensions shift high-risk AI compliance obligations to December 2027 and August 2028 — but penalties remain unchanged and the AI-generated content transparency deadline arrives in December 2026. Here is what executive teams must prioritise now.

The CJEU’s review of FATCA-driven EU–US bank data transfers under GDPR, combined with the Digital Omnibus proposals and EDPB’s updated BCR-P guidance, signals a structural realignment of cross-border data compliance obligations in 2026. Mid-market and multinational firms must act now to integrate these developments into their enterprise risk management and M&A due diligence frameworks.

As EU Digital Omnibus reforms to GDPR and the AI Act remain in active negotiation, and CJEU scrutiny of EU-US data transfers intensifies, mid-market firms face a dual compliance horizon demanding immediate action. CFOs and General Counsel must integrate data privacy, AML, and enterprise risk management into a unified governance strategy before the next enforcement cycle begins.

The European Commission’s proposals to revise GDPR and the EU AI Act — including a delay of high-risk AI rules to December 2027 and projected savings of €5 billion by 2029 — represent a structural shift in EU digital governance. For CFOs, General Counsel, and board members, the reforms create strategic opportunity, but enforcement gaps and existing obligations demand immediate attention.

As of 2 August 2025, EU AI Act Article 5 prohibitions are fully enforceable, with fines reaching €35M or 7% of global turnover for the most severe violations. Mid-market firms deploying AI in Europe must act now to audit prohibited practices, align governance frameworks, and address overlapping GDPR and AML obligations.

The CJEU’s January–February 2026 rulings on pseudonymized data and FATCA transfers, combined with the EDPB’s updated Processor BCR framework, are reshaping GDPR compliance obligations for European businesses. CFOs, General Counsel, and M&A directors must act now to audit data inventories, stress-test cross-border financial data flows, and integrate data privacy risk into corporate governance frameworks.

The EU AI Act’s high-risk obligations intensify in 2026, exposing organisations to fines of up to €35M or 7% of global turnover. CFOs and General Counsel must act now to build integrated AI governance frameworks that address converging obligations under GDPR, NIS2, and DORA.

The European Commission’s November 2025 Digital Omnibus proposals extend GDPR breach reporting to 96 hours and delay EU AI Act obligations, offering compliance relief — but also introducing new governance risks that corporate leaders must address before 2026 enforcement deadlines arrive.