AI regulation in 2026: a year in review

An intense year comes to an end, and it is time to take stock. If 2026 has left one clear lesson in my work, it is that AI regulation has gone from being a conversation about the future to an operational reality that shapes every project. I want to gather here what I have learned, because understanding where we come from helps us prepare for what is coming.

The year the EU AI Act became tangible

For a long time, the EU AI Act was a text that was cited more than it was applied. In 2026 that changed: with milestones such as those in August, the obligations took concrete shape and the authorities began to take form. The regulation stopped being a horizon and became an agenda with dates.

The main lesson is that those who integrated compliance into the design of their systems experienced the year calmly, while those who postponed it had to rush.

The compliance lessons of 2026

Governance cannot be improvised

The most repeated lesson: documentation, the inventory of AI assets and traceability must be built beforehand, not on the day of the audit. Anyone who left it until the end discovered that evidence cannot be manufactured in a hurry.

Overlap is the key to efficiency

Managing DORA, NIS2, GDPR and the AI Act separately proved unsustainable. Well-exploited regulatory overlap was what allowed many organisations to comply without overwhelming their teams.

People remain at the centre

Despite so much technology and regulation, 2026 confirmed that literacy and change management decide success. The projects that took care of people adopted AI; those that only looked at the technology stumbled.

What is coming: preparing for the next stage

The regulatory calendar does not stop. There are stages of the EU AI Act still to be applied, frameworks such as the EU Data Act gaining weight and new requirements on the horizon. My recommendation for the coming year is the same one that has worked this year: integrate compliance into the design, govern data well and never lose sight of people.

From uncertainty to structured governance

If I had to sum up the lesson of 2026 in one idea, it would be this: AI regulation stopped being a theoretical debate and became an everyday management practice. At the beginning of the year many organisations were still debating whether the European framework affected them; by the end of it, the conversation revolved around how to document, audit and demonstrate compliance. That change of mindset, from uncertainty to structured governance, is for me the real milestone of the year.

A decisive part of that change has been the obligations for general-purpose AI models (GPAI), which forced many teams to understand for the first time which models they were really using and with what guarantees. That traceability, which a year ago seemed a luxury, has become a basic requirement for any organisation that takes its use of artificial intelligence seriously.

The standard as an ally of compliance

Another clear lesson of 2026 is that regulation and management standards have begun to converge. The companies that adapted fastest were not the ones with the most lawyers, but those that already had a mature management system. Adopting a framework like the one I describe in my article on ISO 42001 as an AI management system gave them a structure on which to fit each new obligation without reinventing processes every time.

That combination of legal norm and voluntary standard marks, in my opinion, the path of the next stage. Anyone who treats compliance as a reactive to-do list will keep putting out fires; anyone who integrates it into their management system will turn regulation into a competitive advantage. The year we are closing has shown that this difference of approach separates the organisations that suffer regulation from those that take advantage of it.

There is one final lesson I take from this year that is worth not forgetting: compliance cannot be sustained without culture. An impeccable management system is useless if the people who design and operate the models do not understand why it matters. The organisations that navigated 2026 best invested in training their teams, in explaining the meaning of each control and in making responsibility for AI a shared value. Regulation set the framework; it was people who turned it into real practice, and that will also be the key to the year now beginning.

Conclusion: a year that laid the foundations

2026 will be remembered as the year AI regulation stopped being theory. We have learned that compliance, far from slowing down innovation, orders it and makes it sustainable. I close the year with one certainty: the organisations that understand regulation as part of the design, and not as an obstacle, are the ones building a real advantage for the future.

Frequently asked questions about AI regulation in 2026