In 2026, we are seeing a shift from 'maybe we should regulate this' to 'here is a 500-page book on how you must operate.' Programs like the Genius Act and the Clarity Act in the US have created an environment where you have to prove your compliance effectiveness every single day. Authorities no longer want to see a PDF of your policy. They want to see data-driven proof that your controls actually work in practice.
User access to data from connected devices will be crucial, requiring companies to design products for secure direct sharing, with compliance obligations beginning in September 2027.