Across Europe and globally, we’re seeing enterprises quickly pivot from AI experimentation to driving tangible impact. Deloitte’s Tech Trends 2026 report notes that only 1% of leaders surveyed say their company has no major operating model changes underway.
Deloitte also observes that leaders are moving from incremental IT management to orchestrating human–agent teams, with CIOs often cast as “AI evangelists.” I would argue we have to be both evangelical and pragmatic. We’re re-architecting our platforms, data governance, and organizations to prepare for a fundamental shift in how work gets done — but also have to balance the rate of change and a business’ ability to absorb it.
As we work to put the right controls and operating models inside our own walls, a second layer of governance is taking shape around us. Regulators are now defining (and in some cases revising) the rules for how AI can be built and deployed.
AI regulation in flux
European AI regulation, once seen as a global benchmark, is now in a period of recalibration. The original strict timelines and obligations under the AI Act (and related digital laws) are shifting, with important implications for businesses operating in Europe.
There are multiple developments at play here.
1. Timeline changes and regulatory simplification
The European Commission has proposed a “Digital Omnibus” package aimed at simplifying and streamlining Europe’s digital rulebook, covering the AI Act, GDPR, e‑Privacy Directive, and the Data Act. It includes delaying key AI Act compliance deadlines, potentially pushing the enforcement of high‑risk rules from August 2026 to late 2027 or beyond. There’s a political balancing act at play here: preserving core safeguards while reducing perceived regulatory friction that critics say could slow AI adoption and weaken global competitiveness.
2. Pushback from industry and critics
Some of the delay pressure is coming from within Europe’s business community, with letters and calls for more time to adjust to complex obligations. But civil rights advocates warn this “simplification” risks diluting fundamental rights protections and giving tech giants easier access to data if GDPR and privacy rules are loosened. As I’ve said before, the more we automate with AI, the more we need to take accountability when AI-enabled processes go wrong.
3. The complex UK regulatory outlook
The UK’s regulatory landscape is evolving, too, including digital omnibus proposals to align or diverge from EU frameworks, ongoing inquiries on AI and copyright, and new approaches to AI labelling and oversight. This underscores that regulation is no longer a uniform Europe‑wide project, and multinational leaders must track multiple regimes in 2026.
Unified data foundations are now leadership priority
Having a unified data platform for your global teams that can ensure strict data governance without hindering AI innovation is becoming a prerequisite.
We see this in practice with organizations like the Police Service of Northern Ireland, which manages highly sensitive case files with robust access controls and full auditability, and Arriva, which centralizes CCTV footage and other regulated content on Box. As Arriva’s Head of Solution Architecture notes, this approach enables faster response times and stronger collaboration with authorities, without compromising governance.
Looking ahead
The next phase of AI adoption in Europe will be defined by how confidently we can operate in an environment where rules, standards, and expectations are still taking shape. Those who invest now in strong data foundations and governance will be best positioned to move quickly when the regulatory picture finally settles — and to earn the trust of customers, employees, and regulators along the way.
Which governance practices will you prioritise to ensure innovation and accountability go hand in hand as AI adoption accelerates in 2026? Explore more of our latest thinking and sign up to be the first to receive these insights on the Box Executive Insights page.
