Global Regulatory Outlook
2026.

The Global Regulatory Outlook 2026 is the inaugural edition of the ELDR Institute's annual assessment of the regulatory landscape across the domains where ELDR's practice operates: information security, artificial intelligence, data protection, financial services, healthcare technology, and enterprise governance. The assessment covers six primary jurisdictions — European Union, United States, United Kingdom, Canada, Nigeria, and the G7/OECD multilateral architecture — and identifies the regulatory developments that will have the greatest operational impact on enterprises and institutions in the 12–24 months following publication.

The 2026 assessment is characterised by a single structural dynamic that cuts across every domain: the simultaneous maturation of regulatory frameworks that were enacted in 2021–2024 and are now entering their enforcement phase. The EU AI Act entered full application in August 2026. DORA entered application for financial entities in January 2025. NIS2 transposition deadlines have passed. FedRAMP authorisation requirements continue to expand. FDA SaMD guidance is becoming progressively more prescriptive. Across every domain, the shift from framework enactment to active enforcement is the defining regulatory development of 2026 — and it is the development that has the largest operational consequences for governance documentation programs.

The decade from 2016 to 2026 produced the most consequential regulatory output in the history of enterprise information governance. GDPR (2016/679) established data protection as a fundamental rights framework with extraterritorial application. NIST SP 800-53 Revision 5 (2020) extended the most comprehensive US security control framework beyond federal environments. The EU AI Act (2024/1689) created the world's first comprehensive legal framework for AI governance. DORA (2022/2554) imposed digital operational resilience requirements on EU financial entities. NIS2 (2022/2555) expanded cybersecurity obligations across critical infrastructure sectors. FedRAMP's Authorise programme continued to expand its scope and specificity.

The structural consequence is that enterprises operating across multiple jurisdictions now face governance documentation obligations that span a dozen or more distinct regulatory frameworks — each with its own evidence requirements, documentation standards, review cadences, and enforcement expectations. The governance documentation challenge is not understanding what each framework requires. That information is publicly available. The challenge is designing documentation programs that satisfy multiple frameworks simultaneously, from a governance architecture that is coherent rather than redundant.

The 2026 regulatory environment is also characterised by increasing regulatory coordination across jurisdictions. The OECD AI Principles have been endorsed by G7 members and serve as the common reference for bilateral AI governance agreements. The Global Forum on Cyber Expertise and FIRST coordinate incident reporting standards. The Basel Committee's digital risk guidance increasingly references NIST frameworks. This convergence is producing gradual alignment in the substantive content of regulatory expectations — even where enforcement architecture diverges — and organisations designing global governance programs should anticipate that this convergence will continue through 2028.

The EU regulatory landscape of 2026 is defined by the transition from framework enactment to enforcement architecture activation. Three frameworks are at different stages of this transition.

EU AI Act. The EU AI Act entered full application in August 2026, with the high-risk AI system requirements now enforceable by national market surveillance authorities. The enforcement gap — the difference between what the Act requires and what most organisations have in place — is substantial. ELDR's assessment (reported in the State of AI Governance 2026) found that fewer than 35% of organisations can produce EU AI Act Annex IV–compliant technical documentation for all production high-risk AI systems. The conformity assessment requirement, the quality management system requirement (Article 17), and the post-market monitoring system requirement (Article 26) are the three most commonly unaddressed documentation obligations. National market surveillance authorities in Germany, France, and the Netherlands have indicated enforcement priority for high-risk systems in credit scoring, employment decisions, and healthcare diagnostics — the three highest-volume high-risk AI deployment categories.

DORA. The Digital Operational Resilience Act entered application for EU financial entities in January 2025. The third-party ICT risk documentation requirements — the register of ICT third-party service providers, contractual documentation requirements, and oversight documentation — have proven to be the most operationally demanding documentation obligation for affected entities. Most financial institutions had existing vendor management programs; almost none had documentation programs designed to produce the DORA-specific artefacts that supervisory authorities are beginning to request in examination. The DORA oversight framework for Critical ICT Third-Party Providers is also activating — with the European Supervisory Authorities beginning to exercise oversight over designated CTPPs.

NIS2. NIS2 Directive transposition deadlines have passed — but implementation quality varies significantly across EU member states. The expanded scope (from approximately 7 to an estimated 160,000+ entities) means that many organisations newly subject to NIS2 obligations are encountering cybersecurity documentation requirements for the first time. The NIS2 incident reporting timeline — significant incidents must be notified to the competent authority within 24 hours — is creating pressure for incident classification documentation that most newly-in-scope entities have not previously needed.

The US regulatory environment of 2026 operates without a comprehensive federal AI or data protection framework — but sector-specific regulatory pressure has produced a patchwork of requirements that is, in aggregate, increasingly demanding for regulated industries.

Financial services. The SEC's cybersecurity disclosure rules (effective December 2023) are generating their first enforcement actions in 2026, establishing materiality determination precedent and creating documentation obligations for the incident assessment process that most organisations had not previously formalised. FFIEC member agencies are developing AI examination guidance — the emerging expectation framework is converging on NIST AI RMF alignment with sector-specific evidence requirements, but final guidance has not been issued. OCC's model risk management guidance (SR 11-7 and its successors) is being extended to AI/ML models in ways that create model documentation obligations beyond what most financial institutions' existing model risk management programs produce.

Healthcare. FDA SaMD action plan implementation continues. The predetermined change control plan (PCCP) pathway — which allows AI/ML-based Software as a Medical Device to change according to a pre-approved plan without triggering a new 510(k) — is creating documentation obligations for AI system change management that most medical device documentation programs have not previously required. The FDA's AI/ML device guidance evolution is producing increasing specificity in performance evaluation documentation requirements — the most demanding documentation requirement for healthcare AI systems in the US regulatory environment.

Federal. FedRAMP authorisation requirements continue to expand through CISA Zero Trust Maturity Model expectations and OMB M-24-10 AI governance requirements. The OSCAL programme is advancing — machine-readable SSPs are increasingly feasible and are beginning to produce faster authorisation timelines for programmes that invest in OSCAL tooling. Zero Trust documentation requirements, per CISA Zero Trust Maturity Model Tier guidance, are becoming more specific in ways that create documentation obligations for boundary, identity, and monitoring documentation beyond what most existing SSPs address.

The UK's regulatory trajectory in 2026 is defined by differentiation from the EU — and by the governance complexity that differentiation creates for organisations operating in both markets. Three areas of material UK-EU regulatory divergence are the most operationally consequential for documentation programs.

The UK's AI regulation approach remains sector-led, with the FCA, ICO, MHRA, and Ofcom each developing AI governance expectations within their existing regulatory frameworks rather than through a standalone AI Act equivalent. This creates coherent sector-specific AI governance in regulated industries (financial services AI governance is well-developed through FCA guidance) but leaves cross-sector AI governance fragmented. UK organisations deploying AI systems must navigate sector-specific regulatory expectations while also meeting EU AI Act requirements for their EU market operations — requiring documentation programs capable of satisfying both regimes.

UK GDPR maintains the GDPR framework post-Brexit but continues to diverge from EU GDPR through ICO guidance and enforcement decisions that differ from EU Data Protection Authority precedent. The adequacy decision between the EU and UK is maintained but its long-term stability is subject to ongoing monitoring by the European Commission. Organisations relying on the UK adequacy decision for EU-UK data transfers should maintain contingency documentation for alternative transfer mechanisms.

The UK Cyber Security and Resilience Bill progressing through Parliament in 2026 will expand NIS regulations, introduce mandatory reporting requirements, and extend cybersecurity obligations to additional sectors. The Bill's documentation implications are significant but not yet final — organisations in scope for NIS2 in their EU operations should monitor Bill progress and design documentation programs that accommodate both frameworks.

The African regulatory environment is experiencing the most rapid pace of regulatory development in ELDR's coverage jurisdictions — with data protection, fintech regulation, and capital market governance all advancing simultaneously across multiple jurisdictions.

The Nigeria Data Protection Act 2023 (NDPA) established the Nigeria Data Protection Commission (NDPC) and created a comprehensive data protection framework broadly aligned with GDPR principles — but with significant differences in enforcement architecture, exemption scope, and implementation timeline. The NDPC's enforcement posture is developing; organisations processing personal data in Nigeria should treat the NDPA's documentation requirements as enforceable now, not aspirational.

The Central Bank of Nigeria's regulatory framework for payment service providers, fintechs, and digital financial services continues to evolve rapidly — with new guidelines on Open Banking, BNPL regulation, and crypto asset regulation all in various stages of development or implementation. The documentation obligations created by CBN regulation are operationally demanding for organisations navigating both CBN and SEC Nigeria compliance simultaneously.

Ghana's Bank of Ghana fintech regulatory framework and Kenya's Payment Service Act implementation represent parallel regulatory development in West and East Africa — each with distinct documentation requirements and enforcement trajectories. Organisations operating across multiple African jurisdictions face the documentation equivalent of the EU multi-framework challenge: multiple regulatory regimes, each with distinct documentation requirements, none of which are designed to be satisfied by a common documentation architecture. Designing for multi-jurisdiction African compliance is increasingly a first-order documentation architecture challenge for multinational financial services and technology organisations with African market presence.

• Enforcement maturation across all domains. 2027 will be the first full year of active enforcement across the major frameworks enacted in 2021–2024. EU AI Act enforcement, DORA supervisory oversight, NIS2 enforcement by national authorities, and SEC cybersecurity disclosure rule enforcement will all be more active in 2027 than in 2026. Documentation programs designed for compliance will face their first systematic enforcement pressure.
• Third-party risk documentation becoming a primary examination focus. DORA's third-party ICT risk documentation requirements, NIS2's supply chain security obligations, and FFIEC's third-party risk management expectations are converging on a common governance expectation: documented evidence that third-party risk has been assessed, managed, and monitored — not just a vendor risk management policy that asserts it is.
• AI governance documentation becoming an examination standard. FFIEC, OCC, FCA, and EU national supervisory authorities will all be developing AI-specific examination expectations in 2027. Organisations that have not built AI governance documentation programs — risk registers, model documentation, governance policies, incident response procedures — will face examination findings that require remediation under regulatory oversight.
• Cross-jurisdiction regulatory coordination increasing. The OECD AI Principles, G7 AI governance cooperation, and bilateral regulatory coordination agreements are producing regulatory convergence that will reduce — but not eliminate — the documentation burden of multi-jurisdiction compliance for organisations that design governance programs for converging rather than minimum requirements.
• Digital identity and authentication regulation emerging. eIDAS 2.0 in the EU, the UK Digital Identity Trust Framework, and emerging US federal digital identity standards are creating a new regulatory layer for identity governance documentation that most organisations have not yet incorporated into their governance programs.

The regulatory landscape of 2026 has three specific implications for organisations managing governance documentation programs.

First, enforcement is no longer prospective. The frameworks that have been described as "coming into force" for the past three years are now in force and actively enforced. Documentation programs that have been designed to achieve compliance "when required" are now either compliant or exposed. The appropriate governance response is an immediate documentation gap assessment — not against aspirational compliance targets, but against the current enforcement expectations of the relevant regulatory authority.

Second, multi-framework documentation architecture is no longer optional for organisations in multiple jurisdictions. The cumulative documentation burden of the EU AI Act, DORA, NIS2, GDPR, and sector-specific requirements cannot be sustainably managed through framework-by-framework documentation programs. Organisations that have not already built unified cross-framework documentation architectures will face documentation program costs that grow faster than the regulatory requirements they are designed to satisfy.

Third, the documentation programs that will perform best in the 2027 enforcement environment are the programs that have been designed for institutional durability rather than point-in-time compliance. Governance documentation programs with explicit lifecycle governance, continuous monitoring, and improvement architecture will sustain compliance through regulatory evolution. Programs designed for the last audit cycle will require emergency remediation for the next one.