The legal horizon — May 2026

On 7 May the Council, Parliament and Commission agreed the Digital Omnibus. Annex III high-risk obligations now apply from 2 December 2027, sixteen months later than the original date. But the synthetic-content transparency grace shortened from six months to three, pulling that deadline forward to 2 December 2026. The labelling work you have to hit this year got more urgent, not less.

Berlin chose its existing telecoms regulator. The Bundesnetzagentur is now Germany's lead AI Act market-surveillance authority and the single point of contact for the EU AI Office, with the BfDI handling data-protection-relevant high-risk systems. If you operate in Germany, your AI Act regulator is known, with twenty-five years of cross-sector market-surveillance experience behind it.

The SRA's November 2023 Risk Outlook is still the operative AI supervision benchmark for UK-regulated firms. What landed in May is on the data side: the ICO's AI guidance is now formally under review against the Data (Use and Access) Act 2025, with Section 103 (the standalone complaints duty) commencing 19 June. The framework hasn't changed; the data-protection enforcement posture has tightened.

The CNIL's GDPR-for-AI recommendations were finalised in February 2025 and remain France's operative standard. What landed in May is the 2026 work programme: workplace AI and health AI are now under direct supervisory focus, with sector-specific guidance expected later this year. The data-protection lens on AI in France just got more targeted.

Colorado pushed its AI Act to 1 January 2027 and traded the duty-of-care for a disclosure regime. Texas TRAIGA runs live on a restricted-purposes model. Connecticut's online-safety provisions hit chatbots and automated hiring from 1 October 2026. Three states, three different compliance regimes for what is commercially the same software.

The ICO fined South Staffordshire Water £963,900 on 7 May for UK GDPR Article 5(1)(f) and 32(1) failures following the 2022 Cl0p ransomware exfiltration of 633,887 customer and employee records. The penalty narrative is about controls: attacker dwell time from September 2020, monitoring covering 5% of the IT estate, Windows Server 2003 still in production. The ICO's bar for cyber hygiene at regulated firms is now publicly enforceable — and your board paper for next year's cyber budget just wrote itself.

California's AG and CPPA secured a $12.75m CCPA settlement against General Motors over OnStar selling driver telematics to Verisk and LexisNexis for insurance scoring. The previous CCPA high was Sephora at $1.2m; this is an order of magnitude bigger. Data minimisation and purpose limitation are now the lead enforcement theories, and the connected-product flows to data brokers (loyalty programmes, fleet telematics, connected appliances) are squarely in scope.

The 20th sanctions package, adopted 23 April, hit in two May tranches. From 14 May, transactions with four named payment agents (Arneis, Asia Import Group, GPAgent, Platejka) are prohibited. From 24 May, all dealings with Russia-domiciled crypto-asset service providers are banned. Third-country circumvention through UAE, Kazakhstan and Uzbekistan is named as an enforcement target, so sweep your counterparties twice.

OFAC designated twelve more entities on 11 May under the Economic Fury Iran-oil campaign, including UAE- and Hong Kong-based facilitators. Follow-on May designations added shadow-banking front companies and nineteen blocked vessels. Secondary-sanctions exposure for traders, shippers and banks now reaches through UAE, Hong Kong and PRC teapot refineries; counterparty diligence has to track the cargo, not the paper.

The CMA opened its fourth strategic-market-status investigation on 14 May, this time into Microsoft's business software ecosystem. Productivity software, OS, database and security are all in scope; the cited theories of harm are bundling, interoperability and default settings. Statutory designation decision by 14 February 2027. If your stack depends on Teams, Defender, Entra or SQL Server, start documenting switching frictions before the market test.

A Manhattan federal jury found Live Nation and Ticketmaster liable on every state and federal monopolisation, tying, and exclusive-dealing claim brought by 33 state attorneys-general. DOJ had settled in March without divestiture; the states rejected the deal and tried the case alone. Judge Subramanian opened remedies in May with structural breakup live on the table. For any vertically-integrated platform, a DOJ settlement is no longer the ceiling of antitrust risk.

The April 2026 wave of Australia's mandatory and suspensory merger regime added partial-asset acquisitions and a voting-power test. Notification triggers now reach minority stake build-ups, JV asset contributions and non-control share purchases (a much wider universe of deals). ACCC pre-clearance is phase-1-quick for the typical filing, but closing without it voids the deal. Update SPA conditions-precedent templates for any Australian-nexus transaction signed from April onward.

The SEC issued a proposed rulemaking on 29 May to rescind the 2024 climate-related disclosure rules in their entirety, citing lack of statutory authority. Federal mandatory climate disclosure is effectively dead for US issuers. California SB 253/261 and EU CSRD are the binding regimes going forward. Reallocate SEC compliance budget to CARB readiness and CSRD double materiality, but don't tear out the internal controls you already built.

Transposition deadline is 7 June 2026, and most member states aren't ready. Only Slovakia and Italy have comprehensive implementing legislation; Sweden has refused to transpose at all and is seeking renegotiation. From 8 June, unimplemented Directive provisions have direct effect against the state; private employers face a national patchwork. Adopt a pan-EU floor policy now (pay bands in job ads, candidate disclosure rights, no pay-history questions, gap analytics at 100+ employees) and layer national rules as they land.

ENISA's 2026 NIS360 lifted trust services, aviation, and financial market infrastructures into the high-maturity band. Gas, road, maritime and health strengthened within moderate. The two-year trend gives national competent authorities a calibration tool when prioritising audits and inspections. If you sit in a sector still flagged moderate (health and gas in particular), the FY27 cyber budget narrative writes itself.

The OECD's January 2026 Side-by-Side Package is now operative. US-parented MNEs can elect a deemed-zero top-up under both the IIR and UTPR, formalising US exclusion from Pillar Two globally. Twenty-two of twenty-seven EU member states now have both an IIR and a QDMTT in force, and the first calendar-year GIR (GloBE Information Return) filing falls due 30 June 2026. US-parented groups can largely stand down Pillar Two top-up planning; non-US-parented groups have a fortnight.

Sanction trackers passed 500 attorney cases tied to AI hallucinations in May; the Oregon $110,000 penalty is still the high-water mark. Enterprise procurement teams now include AI-review questions in security questionnaires, and the absence of a documented supervision workflow is itself a finding. Have a one-paragraph description of your review workflow ready: what the agent does, where the human sits, what gets logged.