Compliance & Risk Management

The EU AI Act’s high-risk obligations, currently set for August 2026 with a proposed extension to December 2027, are converging with GDPR, ESG reporting, and AML frameworks to create the most complex compliance environment European enterprises have faced in years. Organisations that treat this window as preparation time — not a pause — will gain a measurable governance and transactional advantage.

The EU AI Act’s high-risk system obligations take full effect on August 2, 2026, but enforcement has already begun — with prohibited AI practices carrying fines up to 7% of global turnover since February 2025. CFOs and General Counsel must act now to align AI governance with converging GDPR obligations and avoid material regulatory exposure.

The EU AI Act’s high-risk AI obligations and enforcement mechanisms become fully applicable on August 2, 2026, with fines reaching €35 million or 7% of global turnover. CFOs, General Counsel, and board members must act now to align enterprise risk management frameworks before the compliance window closes.

With €1.2 billion in GDPR fines issued in 2024 and the EU AI Act fully applicable from August 2026, organisations face a dual compliance imperative that demands integrated governance now. This analysis examines what the latest regulatory developments mean for enterprise risk management, M&A due diligence, and AI governance frameworks.

The EDPB’s Coordinated Enforcement Framework 2026 mobilises 25 Data Protection Authorities to assess GDPR transparency compliance — a direct escalation for boards and General Counsel managing enterprise risk. With the EU AI Act fully applicable by August 2026 and cumulative GDPR fines at €5.88 billion, the window for reactive compliance strategies has closed.

The EU AI Act’s high-risk AI system obligations take effect August 2, 2026, with fines up to €35M — surpassing GDPR thresholds and creating dual compliance burdens for European enterprises. CFOs and General Counsel must act now to align AI governance, DPIA processes, and vendor contracts before enforcement begins.

The European Commission’s proposed delay to EU AI Act Annex III high-risk AI obligations — shifting enforcement to 2027 pending trilogue approval — creates a bifurcated compliance landscape that demands careful navigation. Article 50 transparency rules and financial sector AI obligations remain firmly set for August 2026, making a pause in compliance programmes a risk in itself.