The EU AI Act’s provisional deadline extensions shift high-risk AI compliance obligations to December 2027 and August 2028 — but penalties remain unchanged and the AI-generated content transparency deadline arrives in December 2026. Here is what executive teams must prioritise now.
The CJEU’s review of FATCA-driven EU–US bank data transfers under GDPR, combined with the Digital Omnibus proposals and EDPB’s updated BCR-P guidance, signals a structural realignment of cross-border data compliance obligations in 2026. Mid-market and multinational firms must act now to integrate these developments into their enterprise risk management and M&A due diligence frameworks.
As EU Digital Omnibus reforms to GDPR and the AI Act remain in active negotiation, and CJEU scrutiny of EU-US data transfers intensifies, mid-market firms face a dual compliance horizon demanding immediate action. CFOs and General Counsel must integrate data privacy, AML, and enterprise risk management into a unified governance strategy before the next enforcement cycle begins.
The European Commission’s proposals to revise GDPR and the EU AI Act — including a delay of high-risk AI rules to December 2027 and projected savings of €5 billion by 2029 — represent a structural shift in EU digital governance. For CFOs, General Counsel, and board members, the reforms create strategic opportunity, but enforcement gaps and existing obligations demand immediate attention.
The CJEU’s January–February 2026 rulings on pseudonymized data and FATCA transfers, combined with the EDPB’s updated Processor BCR framework, are reshaping GDPR compliance obligations for European businesses. CFOs, General Counsel, and M&A directors must act now to audit data inventories, stress-test cross-border financial data flows, and integrate data privacy risk into corporate governance frameworks.
The EU AI Act’s high-risk obligations intensify in 2026, exposing organisations to fines of up to €35M or 7% of global turnover. CFOs and General Counsel must act now to build integrated AI governance frameworks that address converging obligations under GDPR, NIS2, and DORA.
The EU Digital Omnibus, AI Act Article 5 enforcement, and updated high-risk classification guidelines have moved AI and data privacy compliance into active enforcement territory. CFOs, General Counsel, and compliance teams must act now to map obligations, integrate certification pathways, and embed AI risk into board-level governance.
The parallel application of the EU AI Act and GDPR is creating compounding compliance obligations that demand integrated enterprise risk management frameworks. CFOs, General Counsel, and board members must act now to build governance architectures that address both regimes simultaneously.
The EU Digital Omnibus Package revises GDPR, the ePrivacy Directive, and the AI Act — shifting high-risk AI classification to self-assessment and extending enforcement to December 2027. Corporate decision-makers must act now to avoid the last-minute compliance failures that defined GDPR’s 2018 rollout.
New EU enforcement rules effective January 2026 compress GDPR investigation timelines to 12–15 months, while the Digital Omnibus Package proposes landmark AI-specific amendments. CFOs and General Counsel must act now to align compliance frameworks with an accelerating global regulatory environment.