News and Insights

Compliance teams are being asked to operationalise AI Act obligations against an enforcement infrastructure that is visibly incomplete. The Digital Omnibus adds a second layer of uncertainty: the rules themselves may still shift before August. The actionable question for practitioners is not whether to act but how to build governance structures that can flex if deadlines or obligations move.

Organisations in regulated sectors are making procurement decisions based on sovereignty claims that the current regulatory framework cannot yet verify. The gap between what hyperscalers call sovereign and what EU law actually requires is concrete and consequential; especially for organisations with US parent companies or Singapore branches where data jurisdiction matters.

AI literacy is no longer a training budget aspiration. Article 4 of the AI Act requires providers and deployers to ensure sufficient AI literacy among staff and is already in force since February 2025. Reuters is a useful benchmark because it is a knowledge-work organisation, not a tech company, which makes the parallel directly relevant to legal, compliance, consulting and media teams.

Five months is not much time if you have not started. SMEs deploying AI in HR, hiring, finance or safety-critical processes need to classify their tools now, not in July. The conformity assessment process – documentation, risk registers, human oversight protocols – takes longer than most teams expect. The good news is that the August deadline applies to new deployments; legacy systems in regulated products have until 2027. Start with an AI inventory. Everything else follows from that.

The White House’s March 20 National Policy Framework pushes a unified federal baseline for AI safety, child protection, intellectual property safeguards, and fraud prevention, explicitly aiming to preempt a confusing patchwork of state-level regulations and foster consistent national oversight. This move signals President Trump’s administration prioritizing streamlined governance over fragmented rules.

New York proposes mandatory notices for generative AI outputs, Oregon targets oversight for AI “companion” apps handling sensitive interactions, and Utah strengthens rules on explicit deepfakes; running parallel to federal efforts and creating immediate compliance headaches for multi-state operators. These bills highlight growing bipartisan momentum at the state level, with enforcement teeth like civil penalties and injunctions already in committee drafts.