Regulation, Standards & Policy Change
Where compliance becomes strategy.
Latest: Europe switches on AI enforcement; Washington's crypto clocks slip
Europe switches on AI enforcement; Washington's crypto clocks slip
Third cycle. The AI Office's investigation and fining powers over general-purpose AI providers took effect on 2 August, entering the register as the cycle's steepest accelerator, and the sustainability rollback re-accelerated as the simplified ESRS was adopted.
Regulation by Purchase Order: Simplified Procurement Rulebooks Come Back Carrying More Conditions
The rulebook being simplified in 2026 is the one governing how the state buys, and it returns carrying more conditions.
Posture: PrepareThe rulebook stopped being the constraint. The enforcer did.
Over this cycle the strategic constraint changed hands: the rules are largely settled, the deadlines are still slipping, and what determines exposure is whether a jurisdiction has a funded enforcer...
The Summer That Enforcement Went Local
The rules are not the story this cycle. The enforcement machinery is. Across eight weeks, four separate jurisdictions changed not what they require but who requires it, how that person is funded...
Detection, Not Deregulation: Why Simplified Rulebooks Are Getting Harder to Breach
Supervisory detection capability, not the rule book, is the variable moving in 2026. Simplification packages cut visible burden while SupTech budgets, tax-authority analytics and reporting coverage...
Posture: PrepareRegulating by Class: PFAS Rules Now Attach to the Whole Chemistry, Not the Substance
PFAS regulation now runs by chemical class, not named substances; EU committees, US states and insurers enforce it while Washington rescinds.
Posture: PrepareDeregulation Without Repeal: Why the Rules Are Still on the Books
Most US deregulation since 2025 has suspended enforcement rather than repealed rules, so the obligations remain codified and reversible.
Posture: PrepareRules Without Referees: The EU's Missing Certification Machinery
The EU's binding regulatory constraint has quietly shifted from the rules to the machinery that enforces them. AI Act and Cyber Resilience Act certification depends on notified bodies and harmonised...
Posture: PrepareEurope enacts its simplification; the US stablecoin clock runs down
Second Change Tracker on Regulation, Standards and Policy Change. Nine signals: 4 Accelerating (EU AI Act deferral and simplification, US GENIUS Act stablecoin rulemaking, EU data-protection...
The Quantum Compliance Clock: Post-Quantum Migration Becomes Binding Law Before the Threat Arrives
Beneath the 'quantum is a decade away' consensus, post-quantum migration became enforceable regulation: EO 14412 binds US agencies to 2030-2031 deadlines and pulls contractors in through a FAR rule...
Posture: PrepareThe Liability Handover: Strict Liability for Software and AI Arrives as Europe's Rulebooks Retreat
Beneath the EU-deregulation consensus (Omnibus VII deferring the AI Act's high-risk rules to December 2027 and August 2028), enforcement is migrating from regulators to courts: the new Product...
Posture: PrepareThe Removable Regulator: How Eroding Agency and Central-Bank Independence Reprices Policy Risk
Beneath the headline policy reversals, the legal and normative firewall insulating independent regulators and central banks from at-will political removal is being dismantled - the Supreme Court is expected to gut or narrow Humphrey's Executor in Trump v. Slaughter and Trump v.
Posture: PrepareAfter Human-in-the-Loop: Regulators Concede Oversight Cannot Scale to Agentic AI
Beneath the human-in-the-loop consensus, financial regulators and standard-setters are conceding that human oversight cannot scale to agentic AI and are shifting the control model from supervising...
Posture: PrepareBrussels trims and defers; Washington carves its own track
Inaugural cycle. The dominant movement is a simplification turn in Europe: the AI Act's high-risk duties are deferred to 2027-2028, the Omnibus I sustainability rollback is in force, and a Digital Omnibus would lighten GDPR.
From Age Gate to Identity Layer: How Child-Safety Mandates Are Building the Internet's New Identity Infrastructure
Beneath the child-safety framing of 2026's online age-verification laws, age assurance is hardening into a standardised, platform-level identity layer for the consumer internet, converging OS...
Posture: PrepareCompliance Becomes Strategy
The cycle’s central tension is that regulation has become a strategic variable rather than a planning constraint.
Inside the Perimeter: Regulators Take Direct Oversight of the Cloud Hyperscalers
Financial regulators are for the first time gaining direct supervisory authority over cloud hyperscalers (AWS, Microsoft, Google Cloud) as designated entities.
Posture: PrepareAfter the Ratchet: How the EU's AI Act Rollback Reverses the Brussels Effect
The one-way 'Brussels Effect' regulatory ratchet has reversed: the May 2026 AI Act Omnibus is an early rollback of a flagship EU digital law, not a pragmatic compliance delay.
Posture: PreparePreemption by Other Means: How 'Managed Federalism' Is Quietly Reshaping Who Sets AI Rules
The US administration is chilling state AI lawmaking in practice without preempting it in law, a model Lawfare calls 'managed federalism'.
Posture: PrepareBeyond the Coverage Gap: D2D Satellite and the Unbundling of Mobile Spectrum
A cluster of May 2026 US spectrum decisions has quietly turned direct-to-device satellite from a coverage add-on into a market-structure event: reallocating dedicated mobile spectrum to...
The Disclosure That Didn't Disappear
The EU's Omnibus I directive frees roughly 80% of companies from mandatory sustainability reporting: but the demand for ESG data is not disappearing, it is migrating from one harmonised public...
Nature on the Supervisor's Desk
Beneath the conservation narrative, financial supervisors and central banks are quietly moving biodiversity loss inside prudential risk frameworks, ahead of the stalled multilateral track and the...