Summer 2026 marks a regulatory turning point for European companies. Two normative frameworks are entering into concrete application at the same time, the AI Act and the CSRD, while business models are being reconfigured around agentic AI and non-financial reporting. Here are the key areas to watch.
AI Act: compliance obligations for high-risk systems
Since August 2, 2026, the AI Act fully applies to high-risk AI systems. Companies deploying artificial intelligence in human resources, credit granting, or education face heavy documentation and technical requirements. Fines can reach several tens of millions of euros.
We observe that most legal departments have not yet mapped all their AI use cases in light of the risk level classification of the regulation. The sorting between low-risk systems and high-risk systems conditions the extent of obligations regarding transparency, human oversight, and training data management.
Following business news on Actu Buzz allows you to spot feedback from companies already engaged in their compliance efforts, particularly regarding HR and client scoring aspects.
Article 4 of the AI Act, in effect since February 2025, also requires employers to ensure a sufficient level of understanding of AI among any employee interacting with these systems. National oversight will strengthen starting in August 2026, turning this training obligation into a tangible compliance risk.
CSRD and non-financial reporting: what changes concretely for SMEs
The CSRD directive redefines the scope of sustainability reporting. Previously reserved for large listed companies, it now affects a much broader spectrum of businesses. SMEs that fall within the scope must publish environmental, social, and governance data according to ESRS standards.
The issue is not limited to a declarative exercise. The CSRD creates a data transmission chain between clients and suppliers. An SME subcontractor of a large group subject to the directive is required to provide carbon indicators, documented social policies, and transition plans. Failing to be prepared means losing contracts.
Link between CSRD and AI Act
The intersection of these two regulations generates new complexity. An AI system used to collect or analyze ESG data potentially falls under the AI Act regime. Conversely, CSRD reporting must integrate the environmental impact of digital infrastructures, including energy consumption related to model training.
We recommend addressing AI Act and CSRD compliance within a unified governance framework rather than in regulatory silos. Companies that separate these initiatives duplicate audits, risk mappings, and documentation references.
Agentic AI in business: beyond classic automation
Agentic AI represents the most significant technical break in 2026 in the business world. Unlike a chatbot or a sequential automation tool, an AI agent makes intermediate decisions autonomously to achieve a user-defined goal.
In practice, this involves supply chain management, automated negotiation of supplier rates, or steering multi-channel marketing campaigns. The agent does not merely execute a rule: it adapts its strategy based on real-time feedback.
Operational risks and governance of agents
The deployment of AI agents raises control questions that current regulatory frameworks only partially cover. Does an agent negotiating a contract legally bind the company? Is the traceability of its intermediate decisions sufficient for an audit?
- Define autonomy thresholds by task type, with mandatory escalation to a human operator beyond a certain amount or risk level.
- Log each intermediate decision of the agent in a format usable for compliance and internal audit functions.
- Integrate AI agents into the AI Act mapping from their design stage, not after they go live.
Simplification of the Omnibus package: what companies can realistically expect
The Digital Omnibus Report, currently under discussion at the European level, aims to lighten certain reporting requirements for medium-sized enterprises. The promise of simplification does not mean the removal of obligations. The delegated acts of the CSRD are being adjusted, but the regulatory foundation remains in place.
Companies that have delayed their ESG reporting investments by betting on significant relief are taking a calculated risk. Application thresholds may be raised for certain categories, but large companies and their value chains will remain fully affected.
Strategic reading for business services
The consulting, auditing, and digital services sector is capitalizing on this regulatory complexity. The demand for support services for CSRD and AI Act generates recurring revenue and repositions firms on higher value-added missions than classic financial reporting.
SaaS compliance solution creators are also capturing an increasing share of the market. The challenge for these players is to offer platforms that simultaneously integrate the requirements of the AI Act, CSRD, and future developments of the Omnibus package, rather than siloed modules.
The start of 2026 requires leaders to simultaneously address AI compliance, non-financial reporting, and the integration of autonomous agents into their business processes. Companies that unify these initiatives within a common governance framework will gain efficiency. Those that treat them in parallel will multiply compliance costs without reducing their exposure to risks.