Regulatory compliance, risk assessment frameworks, GDPR, and governance strategies for international businesses.
The EU AI Act’s high-risk AI obligations and enforcement mechanisms become fully applicable on August 2, 2026, with fines reaching €35 million or 7% of global turnover. CFOs, General Counsel, and board members must act now to align enterprise risk management frameworks before the compliance window closes.
With €1.2 billion in GDPR fines issued in 2024 and the EU AI Act fully applicable from August 2026, organisations face a dual compliance imperative that demands integrated governance now. This analysis examines what the latest regulatory developments mean for enterprise risk management, M&A due diligence, and AI governance frameworks.
The EDPB’s Coordinated Enforcement Framework 2026 mobilises 25 Data Protection Authorities to assess GDPR transparency compliance — a direct escalation for boards and General Counsel managing enterprise risk. With the EU AI Act fully applicable by August 2026 and cumulative GDPR fines at €5.88 billion, the window for reactive compliance strategies has closed.
The EU AI Act’s high-risk AI system obligations take effect August 2, 2026, with fines up to €35M — surpassing GDPR thresholds and creating dual compliance burdens for European enterprises. CFOs and General Counsel must act now to align AI governance, DPIA processes, and vendor contracts before enforcement begins.
The European Commission’s proposed delay to EU AI Act Annex III high-risk AI obligations — shifting enforcement to 2027 pending trilogue approval — creates a bifurcated compliance landscape that demands careful navigation. Article 50 transparency rules and financial sector AI obligations remain firmly set for August 2026, making a pause in compliance programmes a risk in itself.