Key Global Corporate Regulatory Trends in Q3 2026

As 2026 heads into its final quarter, regulation is having more tangible consequences for businesses. Across AI, sustainability, climate, and supply chains, Q3 saw regulators drawing clearer lines around who is accountable and what happens when risks materialize.

AI rules focused on responsibility for harm. Reporting became more flexible but more judgment-based. Claims faced tighter scrutiny, climate goals were pursued through energy policy, and nature and social risks became tied to market access and capital. The common thread is that regulation is shifting the question from what companies disclose to who is accountable, and how they can prove their decisions.

AI regulation draws clearer lines of responsibility

In Q2, AI regulation focused on technological sovereignty, computing capacity, and frontier model security. In Q3, attention moved to accountability for how AI systems behave and the harm they may cause.

Obligations are becoming more harm-specific. The proposed EU KIDS Act would require providers of AI companions and chatbots to avoid designs that foster emotional dependency in minors, with fines of up to 6% of worldwide turnover, while California’s AB 1709 bans addictive platform features for users under 16. Hong Kong’s Privacy Commissioner confirmed that AI agents are not legal persons, so organizations remain fully accountable for their actions. That principle is now being tested in Legal Advocates for Safe Science and Technology v. OpenAI, over allegedly unauthorized actions by autonomous agents.

Policymakers are also exploring emergency intervention through the US AI Kill Switch Act, a California executive order advancing consideration of shut-off mechanisms for frontier models, and the UK Artificial Superintelligence Bill. Meanwhile, Greece enacted national EU AI Act legislation, and AI governance is converging with cybersecurity, with Japan’s revised Corporate Governance Code making boards explicitly responsible for cyber risk oversight.

What businesses should do:

• Assign clear ownership for each AI use case, with human oversight of high-impact decisions.
• Integrate AI risk into enterprise risk management and cybersecurity governance, with board-level oversight.

Accountability takes center stage in corporate reporting

Sustainability reporting became more flexible and jurisdiction-specific, placing more weight on companies’ materiality judgments. The revised ESRS, published in the Official Journal on September 21 and applying from FY2027, cut total data points by more than 70%, introduced a top-down materiality assessment, and capped value chain data requests to protect smaller suppliers. That flexibility raises the bar for documenting the judgments behind each reporting decision. Assurance also advanced, with CEAOB technical advice proposing an ISSA 5000-based EU limited-assurance standard.

The same shift appeared elsewhere. In the UK, the FRC urged directors to own materiality judgments, and the FCA’s final UK SRS rules moved climate reporting to comply-or-explain. Australia consulted on more proportionate assurance, Japan streamlined its Corporate Governance Code, and CARB’s SB 253 guidance kept California’s first reporting cycle on track for November 2026. This divergence makes the ISSB’s global baseline harder to achieve, though EFRAG’s proposed “ISSB+” approach offers a route to interoperability.

What businesses should do:

• Document materiality assessments with defined ownership and board oversight, and back any “explain” decision with the same evidence as a disclosure.
• Build a common core of data adapted to local requirements, and prepare early for assurance.

Climate policy takes a broader energy focus

As climate policy becomes more contested in some markets, energy security, affordability, and competitiveness are increasingly the main routes for advancing decarbonization. The EU’s Electrification Action Plan and ETS review link free allocation more closely to transition measures, while Germany’s fossil fuel transition roadmap sets sectoral pathways to climate neutrality by 2045.

Infrastructure constraints are also becoming more visible. Germany’s Grid Package introduced curtailment and feed-in caps to manage more than 400 GW of pending connection requests, and the EU adopted a rating scheme for data centers. Feasibility concerns are reshaping existing rules too: the US EPA repealed carbon capture and co-firing requirements, and the European Commission recommended suspending certain EU methane penalties. Meanwhile, the UK’s CBAM Rate and Relief Regulations and Norway’s draft CBAM regulation both target a January 2027 start.

What businesses should do:

• Strengthen emissions data ahead of CBAM liabilities from January 2027.
• Stress-test climate investments against grid access, technology readiness, carbon costs, and policy change.

Sustainability claims get a clearer rulebook

As reporting becomes more flexible, regulators are becoming more prescriptive about the claims companies make outside formal reporting. The EU’s Empowering Consumers for the Green Transition Directive entered into application on September 27, restricting generic environmental claims without recognized environmental performance, certain offset-based product climate claims, and sustainability labels that don’t meet its criteria. The European Parliament’s SFDR position would reserve sustainability terms in fund names for products that meet defined criteria and restrict use of the term “impact.”

In the US, the proposed Truth in Labeling Act would standardize terms such as “recyclable” and “compostable,” while the Food Labeling Modernization Act would define claims like “natural” and “ultra-processed.” France’s ultra-fast fashion law extends transparency rules into advertising and influencer promotion. Sustainability transparency now reaches well beyond the annual report.

What businesses should do:

• Set formal governance over claims, with clear ownership across legal, marketing, and sustainability teams.
• Keep robust evidence behind every claim, and apply consistent standards across labels, fund names, advertising, and influencer content.

Nature and social risks shape market access 

After regaining momentum through standard setters in Q2, nature and social issues shifted toward enforcement and finance in Q3. Key EUDR implementation measures became legally binding ahead of the main compliance dates, under a regime that requires Member States to set maximum fines of at least 4% of EU-wide annual turnover for companies. Ireland’s draft enforcement bill would introduce personal liability for directors and officers in specified circumstances, and prison terms of up to three years. The European Commission’s Forced Labor Regulation guidelines clarified how the EU product ban will operate, and Australia announced plans for a failure-to-prevent modern slavery offense.

On finance, Japan’s Nature Finance Practice Guideline, the proposed biodiversity objective in Hong Kong’s sustainable finance taxonomy prototype, and the UK’s Nature-Positive Transition Pathways moved natural capital closer to lending and investment decisions. The contrast is notable: the revised ESRS provide temporary relief from some biodiversity and social value-chain disclosures, yet trade and finance regimes are making that evidence more decisive for market access and capital.

What businesses should do:

• Strengthen traceability and due diligence across higher-risk value chains, with clear leadership accountability.
• Build reliable site-level and supply-chain data to meet growing scrutiny from lenders and investors.

Don't let the next quarter catch you off guard

Behind every development above sits a deadline, a liability, or a market-access risk, and the details dictate what your business needs to do next. With CBAM liabilities starting in January 2027, the revised ESRS applying from FY2027, and EUDR enforcement taking shape, the cost of finding out late is rising.

Datamaran’s regulation monitoring solution helps organizations cut through global regulatory noise and stay ahead of the changes that matter most by enabling them to:

• Monitor: Stay on top of relevant regulatory developments as they happen, with AI-powered monitoring across policies, standards, and regulatory signals worldwide.
• Discover: Identify which regulations, standards, and emerging trends are truly relevant based on industry, footprint, and risk profile.
• Manage: Act on insights through structured, cross-functional governance workflows that support compliance, accountability, and strategic alignment.

Book a demo to learn how Datamaran helps organizations turn regulatory complexity into clarity, combining in-depth quarterly analysis with real-time intelligence to navigate regulatory change with confidence.

This article's contents are drawn from our latest quarterly policy brief, which is provided to Datamaran customers and Harbor+ community members, alongside comprehensive weekly regulation updates. Find out more about Harbor and register to join.