It is January 2026. The initial dust surrounding the enactment of the EU AI Regulation (EU AI Act) has settled. The bans on unacceptable risks have been effective for almost a year, and the rules for General Purpose AI (GPAI) have been in force since August 2025. However, for most enterprises, the most critical phase is beginning right now. In August 2026, the 24-month transition period for high-risk AI systems under Annex III comes to an end. This means: In just under seven months, systems in areas such as HR, critical infrastructure, or credit scoring must be fully compliant. Companies still stuck in the analysis phase risk losing market access.

Key Takeaways

• The deadline for high-risk AI systems according to Annex III expires in August 2026.
• A robust Risk Management System (RMS) must now be operational and fully documented.
• Data governance is no longer just an IT topic but a central compliance requirement for training, validation, and testing data.
• Technical documentation must be completed before placing the system on the market, not just in time for an audit.

Operational Challenges

The clock is ticking relentlessly. While many GRC professionals focused primarily on identifying and inventorying their AI landscape in 2025, 2026 demands a hard transition into operational implementation. It is no longer sufficient to know which systems are classified as high-risk. The focus now lies entirely on the demonstrability of compliance.

One of the biggest practical hurdles currently appearing is the Quality Management System (QMS). The AI Act requires not just an isolated QMS for AI, but ideally its integration into existing structures such as ISO 9001 or ISO 42001. Many companies are discovering that their existing software development processes lack the granularity required by the legislator for AI systems. In particular, the documentation of the entire lifecycle – from the first design decision to the post-market monitoring strategy – often reveals gaps during audits.

Another critical point is data governance. For high-risk AI systems that train models, the regulation prescribes strict criteria regarding data quality. Datasets must be relevant, representative, free of errors, and complete. In practice, this is a massive challenge, as historical data was often not collected with these aspects in mind. GRC teams must now work closely with data scientists to conduct bias analyses and close gaps in data lineage. If proof of training data quality is missing, the conformity of the entire system is at risk.

Furthermore, the human factor must not be underestimated. The requirement for Human Oversight dictates that the individuals supervising AI systems must possess the necessary competence to do so. This means that training measures must start now. It is not enough to pro forma designate an employee as an overseer; they must be capable of recognizing malfunctions and stopping the system if necessary (“kill switch”).

The coming months will be characterized by high pressure on internal departments. Legal, IT Security, and Compliance must finally break down their silos. An integrated GRC approach that treats AI risks not as an isolated technical problem but as a company-wide governance topic is the only way to master the August 2026 deadline without operational disruptions.

FAQ

When exactly does the transition period for high-risk AI systems end?

For most high-risk AI systems falling under Annex III of the regulation (e.g., systems in education, employment, critical infrastructure), the transition period ends on August 2, 2026. All requirements must be met by this date.

What happens if a company misses the deadline?

Systems that are not compliant may no longer be placed on the market or put into service after the deadline. Additionally, severe fines apply, which can amount to up to 35 million euros or 7 percent of the total worldwide annual turnover, depending on the infringement.

Do all AI systems need to be certified?

No. Many high-risk AI systems are subject to an internal conformity assessment. Mandatory third-party assessment by a Notified Body is primarily required for specific systems, particularly those utilizing biometrics.

The regulation of crypto-assets in the European Union has reached a historic milestone with the introduction of the Markets in Crypto-Assets Regulation (MiCA). Fully applicable since the end of 2024, MiCA establishes, for the first time, a unified legal framework for the crypto market across all EU member states. Its goal is to foster market stability, protect investors, and create a level playing field for all providers. For companies, this represents a fundamental shift in governance, risk, and compliance management.

Key Takeaways

• MiCA has been fully applicable since December 30, 2024
• First-ever unified EU-wide regulatory framework for crypto-assets and service providers
• Mandatory licensing for crypto-asset service providers (CASPs)
• Strict rules for stablecoins, market integrity, and consumer protection
• Relevant for more than 10,000 businesses across Europe

Why MiCA Was Introduced

Before MiCA, Europe’s crypto market was shaped by fragmented national regulations. Each country had its own approach, leading to uncertainty for businesses and investors alike. Repeated market disruptions, fraud cases, and collapses of crypto exchanges further highlighted the need for a clear, harmonized legal framework.

The EU introduced MiCA to strengthen trust in the market and to position Europe as a competitive hub for crypto-asset innovation and investment.

Key Elements of MiCA

Licensing Requirements

All providers of crypto-asset services (CASPs) now require authorization. Licenses are granted by national supervisory authorities but are valid across the entire EU.

Stablecoin Regulation

Stablecoin issuers must hold sufficient reserves and comply with strict transparency obligations, minimizing the risks of instability and misuse.

Investor and Consumer Protection

Companies must publish detailed whitepapers outlining risks and functionalities of their products. Stronger requirements also apply to the safeguarding of client assets.

Market Integrity

MiCA introduces explicit rules against insider trading, market manipulation, and unfair practices to reinforce confidence in the market.

Implications for Governance, Risk, and Compliance

MiCA is more than a financial regulation—it reshapes companies’ governance and compliance frameworks.

• Governance: Clear responsibilities and oversight structures are essential to ensure MiCA-compliant business processes.
• Risk management: Companies must address new risks such as volatility, cyberattacks, and operational risks tied to crypto-assets.
• Compliance: Extensive documentation, continuous monitoring, and close interaction with regulators are now mandatory.

For GRC teams, MiCA expands responsibilities and requires tighter integration with IT security and financial supervision.

Opportunities and Challenges

While MiCA imposes significant implementation costs, it also creates opportunities. With a clear framework in place, legitimate providers can differentiate themselves from unregulated competitors, building stronger trust among investors and customers. International providers entering the EU must also comply with the same standards, giving regulated entities a competitive advantage.

Conclusion

With MiCA, the EU is setting a global benchmark for crypto-asset regulation. For companies, it is not just a legal obligation but an opportunity to modernize governance, risk, and compliance structures while strengthening trust in their services. Businesses that act early and embrace MiCA will gain regulatory certainty and long-term market opportunities.

---

FAQ

What is MiCA?
MiCA stands for Markets in Crypto-Assets Regulation, the EU’s first comprehensive crypto regulatory framework.

When did MiCA take effect?
MiCA has been fully applicable since December 30, 2024.

Who is affected?
All providers of crypto-asset services within the EU, as well as international providers offering services in Europe.

What does MiCA mean for stablecoins?
Stablecoin issuers must meet strict requirements on transparency, reserves, and risk management.

What are the penalties for non-compliance?
Violations can result in license revocation, heavy fines, and bans from operating in the EU market.

Why is MiCA a major GRC topic?
Because it deeply affects governance structures, risk management processes, and compliance systems, forcing companies to professionalize their controls.

In summer 2025, the EU adopted significant amendments to the Corporate Sustainability Reporting Directive (CSRD) and the Corporate Sustainability Due Diligence Directive (CS3D). The aim of these changes is to reduce the burden on companies without compromising the EU’s sustainability and human rights objectives. The new regulations affect thresholds, reporting obligations, and due diligence requirements – with considerable implications for Governance, Risk Management, and Compliance (GRC).

Key Takeaways

• Higher thresholds for CSRD and CS3D applicability
• Removal of reporting obligations for listed SMEs
• Risk-based approach to due diligence
• Extended implementation deadline until July 26, 2028
• Goal: Reduce bureaucracy while maintaining sustainability and human rights standards

Why the Changes Were Introduced

The original requirements of CSRD and CS3D drew criticism, particularly from mid-sized companies and industry associations. Main concerns included excessive administrative workload, lack of resources for implementation, and insufficient consideration of sector-specific risks. The EU responded with a revision that makes the requirements more risk-oriented and less administratively demanding, while keeping the core objectives intact.

What Has Changed

1. Higher Thresholds

The turnover and employee thresholds that determine whether the directives apply have been raised. This means fewer companies are subject to reporting and due diligence obligations.

2. Removal of Reporting Obligations for Listed SMEs

Listed small and medium-sized enterprises (SMEs) are no longer required to produce detailed sustainability reports under the CSRD.

3. Risk-Based Due Diligence

Companies must now implement due diligence primarily where human rights and environmental risks are highest. This enables a more targeted and resource-efficient approach.

4. Extended Implementation Deadline

The deadline for implementing the directives has been extended to July 26, 2028, giving companies more time to adapt their processes and systems.

Impact on Governance, Risk & Compliance

These changes highlight the growing importance of integrated GRC strategies. Companies that proactively align their governance and risk management processes with the new requirements will not only ensure compliance but also gain competitive advantages.
A risk-based approach also means companies must enhance their risk assessment processes – covering everything from supply chain oversight to internal operations and strategic decision-making.

Conclusion

By adjusting the CSRD and CS3D, the EU is addressing valid concerns from businesses without abandoning its ambitious sustainability goals. For companies, this is an opportunity to refine their sustainability and compliance strategies in a more focused and efficient way.

---

FAQ

1. What is the CSRD?
The Corporate Sustainability Reporting Directive requires certain companies to disclose their sustainability and ESG data.

2. What is the CS3D?
The Corporate Sustainability Due Diligence Directive establishes due diligence obligations for companies to prevent human rights and environmental violations throughout their value chains.

3. Which companies are affected by the changes?
Primarily mid-sized companies, listed SMEs, and businesses with international supply chains.

4. Why is the EU adopting a risk-based approach?
To direct resources to areas with the highest risks while reducing administrative burdens.

5. How should companies prepare?
By reviewing internal risk assessments, updating GRC processes, and integrating the new requirements into their overall strategy early on.

The European Union is launching a new era of regulated artificial intelligence with the AI Act (Regulation 2024/1689). Starting August 2, 2025, binding rules will apply to both providers and users of General Purpose AI (GPAI) models. Organizations that build or integrate AI systems – particularly in generative AI, machine learning, natural language processing, or automated decision-making – must realign their governance, risk management, and compliance structures.

This does not only concern tech companies – the regulation affects all industries, including financial services, healthcare, manufacturing, retail, and public institutions.

Key Takeaways

• Effective Date: August 2, 2025 – new legal obligations for GPAI models like ChatGPT, Claude, Gemini, Mistral, and LLaMA
• New Obligations for Providers & Users:
  • Transparency on training data & model architecture
  • Risk analysis and conformity assessments
  • Copyright protection and documentation
• Governance Requirements:
  • Internal responsibilities, audit trails, and supervisory structures
  • Mandatory employee training (AI Literacy)
• Penalties for Violations: up to €35 million or 7% of global annual turnover
• Voluntary “Code of Practice” for GPAI providers – reduces compliance risks

1. What Is the AI Act?

The AI Act is the world’s first comprehensive law regulating artificial intelligence. It classifies AI into four risk levels (prohibited, high-risk, limited-risk, minimal-risk) and assigns different obligations accordingly.

As of August 2, 2025, mandatory requirements apply for General Purpose AI (GPAI) – large AI models that can be used for a wide variety of applications such as text, image, code, speech, and data analysis.

Examples include:

• ChatGPT (OpenAI / Microsoft)
• Claude (Anthropic)
• Gemini (Google DeepMind)
• Mistral
• LLaMA (Meta)

2. Who Is Affected?

The new rules apply to:

• GPAI model developers and providers, regardless of whether they’re based in the EU
• Distributors and vendors of GPAI-based software
• Enterprise users of generative AI tools and services
• Finetuners and companies that customize existing base models

Even companies using ChatGPT Enterprise, Microsoft Copilot, Gemini for Workspace, or other generative AI platforms must comply if AI is involved in decisions or data processing.

3. What Will Be Mandatory from August 2, 2025?

A) Transparency & Documentation

• Disclosure of training data sources
• Explanation of model architecture and intended use
• Documentation for bias mitigation, safety, and fairness

B) Copyright & IP Protection

• GPAI models must prevent copyright infringement and respect third-party rights

C) Risk Assessment & Governance

• Formal AI risk assessments and impact analysis
• Establishment of internal controls and AI governance frameworks
• Ensure traceability and auditability of model outputs

D) Employee Training (AI Literacy)

• Employees must understand, evaluate, and monitor AI systems

E) Supervision by Notified Bodies

• Collaboration with Notified Bodies for inspections and certifications
• Authorities may require access to models, documentation, and audits

4. What Are the Penalties?

Non-compliance may result in administrative fines of up to €35 million or 7% of annual global turnover, depending on severity.

5. The GPAI Code of Practice: Voluntary but Strategic

The European Commission has introduced a non-binding Code of Practice for GPAI developers. Companies who implement this code benefit from:

• Regulatory relief and legal certainty
• Reduced audit burdens
• Stronger trust positioning in the EU market

6. Integrating AI into Risk Management & Compliance (GRC)

To meet the AI Act’s demands, organizations must:

• Embed AI into their enterprise risk management (ERM) frameworks
• Extend internal control systems (ICS) and ISMS policies to cover AI
• Maintain governance documentation for AI roles, models, and tools
• Track compliance obligations across jurisdictions
• Enable cross-functional collaboration between legal, data science, and IT security teams

7. How This Relates to GRC

These AI obligations are not just regulatory formalities – they directly connect to Governance, Risk, and Compliance (GRC) principles. Here’s how:

• Governance assigns responsibility for AI oversight and decision-making
• Risk Management ensures companies identify, assess, and monitor AI risks (e.g. bias, model drift, data leakage)
• Compliance ensures all legal and regulatory AI requirements are met and documented

A well-structured GRC platform enables companies to manage AI-related risks and controls alongside traditional areas such as ISO 27001, GDPR, and ESG. This leads to:

• Centralized audit readiness
• Consistent enterprise-wide documentation
• Greater visibility into emerging risks
• Stronger stakeholder trust

Conclusion

August 2, 2025 is not just another deadline – it marks the beginning of a new compliance era for artificial intelligence in Europe.

Whether you are building AI or simply integrating it into your workflows, the AI Act requires companies to demonstrate transparency, accountability, and responsible usage.

Those who act early, document thoroughly, and align with GRC frameworks will be better positioned to innovate with confidence, reduce legal exposure, and gain a long-term competitive edge.

FAQ – New EU AI Rules from August 2, 2025

What is General Purpose AI (GPAI)?
AI systems designed for broad, cross-domain use cases such as generating text, code, images, or speech. These include large foundation models like ChatGPT or Gemini.

Do the rules only affect tech companies?
No – all companies using AI tools operationally are impacted, particularly when AI influences decisions, data handling, or compliance-sensitive processes.

Is the Code of Practice mandatory?
No – it’s voluntary. But those who adopt it benefit from lower risk of sanctions and simplified compliance checks.

What are the financial penalties?
Up to €35 million or 7% of global annual revenue, depending on the type and severity of the violation.

How should companies prepare?

1. Inventory and classify all AI systems
2. Map model risks and use cases
3. Integrate AI oversight into GRC programs
4. Assign responsible officers for AI governance
5. Provide AI literacy training across the company

---

Let me know if you’d like a condensed version for a newsletter, an infographic, or a press release based on this article.

The European Union is currently increasing pressure on its member states to stop politically blocking cross-border bank mergers. The goal is a more integrated European banking sector that remains internationally competitive and better absorbs systemic risks. The debate surrounding planned mergers in Spain, Italy, and potentially Germany raises fundamental questions from a GRC perspective: Who governs the European banking market? Which risks take precedence? And how well are regulatory requirements being met?

Governance: Who Calls the Shots in the European Banking Sector?

At the heart of the dispute is the question of authority. Under EU law and the Banking Union, the power to approve cross-border bank mergers lies with European institutions such as the European Central Bank (ECB) and the European Commission. However, national governments like those in Italy or Spain are using so-called “Golden Power” laws to effectively claim a veto right.

From a governance standpoint, this creates conflict: The single market relies on uniform rules, while national interests (e.g., protecting domestic banks) push against them.

A strong GRC framework requires clear decision-making processes, institutional transparency, and a clear separation from political interference.

Risk: Systemic Risks vs. National Protective Interests

The EU sees mergers as a way to reduce systemic risks: Larger, more stable institutions with stronger capital positions and cross-border diversification are considered more resilient in economic crises.

In contrast, member states such as Germany or Italy fear loss of control, job cuts, or the concentration of risk in a few mega-banks.

From a GRC perspective, this represents a clash of risk paradigms. Sustainable risk management should take both views into account—systemic stability and national resilience—and translate them into objective, transparent risk assessments.

Compliance: National Exceptions vs. European Law

The EU accuses certain countries of violating principles of free capital movement and key Banking Union directives. Blocking mergers involving EU-supervised banks on a national level risks triggering infringement proceedings.

For GRC professionals, this is a textbook case of compliance failure: Domestic legal frameworks undermine international standards, creating uncertainty in the regulatory landscape.

A functioning compliance management system at the supranational level must reconcile federal diversity with legal harmonization.

Conclusion: Bank Mergers as a Test Case for European GRC

The current debate illustrates how closely economic integration, institutional governance, and regulatory coherence are intertwined. GRC is not just a corporate tool—it is an essential part of functioning financial markets.

The EU must demonstrate that it can effectively oversee cross-border mergers and that its institutional GRC philosophy leads to a more stable, efficient, and competitive banking system in the long run.

FAQ: Bank Mergers and GRC

What is GRC in the context of the financial sector?
GRC stands for Governance, Risk, and Compliance. In banking, it refers to the integration of corporate decision-making with regulatory requirements and stability goals.

Why is the EU pushing for more bank mergers?
The EU aims to create internationally competitive banks, reduce systemic risk, and strengthen the single market. Mergers are seen as a means to consolidate and increase efficiency.

What role does compliance play in bank mergers?
Compliance ensures that mergers follow legal standards and EU-wide rules. National interventions that violate EU law undermine this principle.

Why is there resistance to bank mergers?
National governments fear job losses, loss of control over systemically important institutions, or politically sensitive ownership changes.

How does the Banking Union relate to this?
The Banking Union seeks to harmonize rules for supervision, resolution, and deposit insurance. Bank mergers are a logical next step toward deeper integration.

The new EU directive NIS2 (Network and Information Security Directive 2) brings significant requirements for companies across the EU. The goal is to comprehensively improve cybersecurity in critical and important sectors. But what exactly does that mean for governance, risk, and compliance management (GRC) in your organization?

What is NIS2?

NIS2 replaces the previous NIS directive and significantly expands its scope. It no longer only affects critical infrastructure, but also many medium and large enterprises in sectors such as:

• Energy, transportation, healthcare, drinking water
• IT services, digital infrastructure
• Public administration, space, research

New requirements:

• Risk management for cyber and information security
• Incident reporting within 24 hours
• Company-wide security strategy
• Responsibility at management level
• Obligation to perform audits and provide evidence

What does NIS2 mean for your GRC system?

A modern GRC system is key to meeting the new requirements. Only with a systematic approach can risks, controls, reporting obligations, and responsibilities be documented and managed efficiently.

Specifically, this means:

• Risk Management: Integration of IT and cyber risks into the central risk register
• Compliance Monitoring: Tracking of obligations and deadlines according to NIS2
• Action Management: Assignment and tracking of protective and response measures
• Audit Trail & Documentation: Complete traceability for audits

Immediate actions to prepare for NIS2

1. Clarify whether you are affected: Is your company directly or indirectly subject to NIS2?
2. Conduct a gap analysis: What gaps exist in your current security and GRC structure?
3. Define responsibilities: Who is responsible for cybersecurity and reporting?
4. Upgrade GRC systems: Can your system integrate NIS2 requirements?
5. Train and raise awareness: Prepare management and key personnel

Conclusion: Action is needed now

NIS2 not only brings new regulatory obligations, but also offers a chance to embed cyber resilience strategically. Companies that already use a powerful GRC system—or upgrade now—gain a real competitive edge. Important: don’t wait for national legislation—the time to prepare is now.

---

FAQ on NIS2 and GRC

When does NIS2 take effect?

The EU directive has been in force since January 2023. National implementation must occur by October 2024. Companies should begin preparing now.

Which companies are affected?

All medium and large companies in certain critical and important sectors. This includes IT, energy, healthcare, transportation, and digital services.

What happens in case of non-compliance?

Severe fines and reputational damage. Liability may extend to the company’s management.

How does a GRC system help with NIS2?

It enables structured management of risks, actions, reporting obligations, and compliance requirements in a single integrated system.

How does NIS2 differ from ISO 27001?

NIS2 is a legal obligation; ISO 27001 is a voluntary standard. However, both complement each other: an ISMS in accordance with ISO 27001 can cover many NIS2 requirements.