He highlights emerging trends and potential regulatory risks for companies in areas including AI, cybersecurity, and data protection.
1. AI Vacuums Become a Major Risk
AI-first search is transforming how people find and trust information online, creating “AI vacuums,” where legitimate organisational content may be missing or misrepresented. These vacuums present new risks in terms of scams, phishing, and reputational harm. The collapse in the cost of AI inference, from $60 per million tokens three years ago to just $0.06 today[i], enables threat actors to exploit these vacuums at scale.
2. Vendor Compromise Will Increase
Supply chains remain a key vulnerability. Cybercriminals are targeting payroll providers, HR platforms, or other critical suppliers to increase the likelihood of financial gain. With attacks now cheaper and easier to execute, organisations need to strengthen their oversight of their third-party partners.
3. AI Literacy Failures Could Spark Legal Cases
As AI adoption grows, errors caused by lack of employee understanding or training are expected to drive legal claims. Sectors such as law, where AI hallucinations still occur, could be particularly exposed if organisations fail to demonstrate adequate AI literacy programs.
4. AI Regulation Will Grow, But Piecemeal
AI legislation is expanding rapidly. While the EU AI Act sets a framework, countries such as Italy and Hungary are introducing additional measures. In the US, regulation is likely to emerge reactively, driven by incidents, creating fragmented compliance challenges.
5. AI Enforcement Under GDPR Will Rise
Enforcement action around AI and data protection is already significant, with fines approaching €300m in the EU. This trend is expected to accelerate, highlighting the importance of AI compliance and data governance strategies.
6. Nation-State Use of AI and Agentic AI Will Expand
State actors are increasingly leveraging AI to pursue political and strategic aims, as seen in investigations into platforms like Deepseek and ReplikaAI. Discussions around Agentic AI – autonomous systems capable of decision-making – are expected to intensify in 2026, raising new regulatory questions.
Jonathan Armstrong, Partner at Punter Southall Law, comments, "2026 will be a pivotal year for organisations navigating the intersection of law and technology. From AI vacuums to nation-state threats, the impact technology is having on businesses is changing rapidly. Businesses must stay ahead, not just by adopting new technologies, but by embedding robust governance, compliance, and training programmes to mitigate these emerging risks."
