The debate between shareholder primacy and stakeholder theory concerns the legal obligations of corporate directors. Introduction A corporation is never just a machine for making money. It is a legal institution, a social system, and a vehicle for allocating power, risk, and responsibility. That is why one of the most important debates in corporate governance continues to divide scholars, executives, regulators, and investors: should corporations exist primarily to maximize shareholder value, or should they balance the interests of all the people and institutions affected by their actions? This debate is commonly framed as shareholder primacy vs. stakeholder theory. Shareholder primacy says the corporation's central obligation is to its owners, the shareholders. Stakeholder theory says the corporation owes duties to a wider circle of affected parties, including employees, customers, suppliers, creditors, communities, and sometimes society at large. This is not a purely academ...
Business law in 2026 is examined here as a set of regulatory systems moving at different speeds. This post traces the EU AI Act’s staged application dates, the proposed EU Inc. corporate form, the Cyber Resilience Act’s live reporting obligations, and the United Kingdom’s CPTPP access, and argues that compliance is increasingly a process of continuous regulatory monitoring rather than a one-time exercise.
By Kateule Sydney — Researcher and Writer | Last Verified: 2026-10-05 | Published by Kat-Syd Resources Hub
Business-law compliance is increasingly a process of continuous regulatory monitoring rather than a one-time exercise. The practical task is to distinguish what is already law, what is entering into application, what remains proposed, and what is merely an interpretation of likely commercial consequences.
Table of Contents
AI Governance Is Being Staged, Not Abandoned
The EU AI Act is a risk-based regulatory framework governing artificial-intelligence systems according to the nature and level of risk they present. The Regulation entered into force in August 2024 and has been designed to become applicable progressively rather than through a single compliance date.
The general application date is 2 August 2026, but several provisions apply earlier or later. Prohibited AI practices and AI-literacy requirements began applying on 2 February 2025, while governance provisions and obligations concerning general-purpose AI models began applying on 2 August 2025.
The timetable for certain high-risk systems has subsequently been changed. Regulation (EU) 2026/1744 provides that the relevant high-risk requirements apply from:
- 2 December 2027 for high-risk AI systems classified under Article 6(2) and Annex III.
- 2 August 2028 for high-risk AI systems embedded in regulated products under Article 6(1) and Annex I.
The change was linked to implementation difficulties, including the availability of harmonised standards, common specifications, guidance and national competent authorities. The EU’s own explanation therefore supports describing the change as an adjustment to the implementation timetable rather than as abandonment of high-risk AI regulation.
For businesses, the practical significance is straightforward: a delayed application date is not the same thing as removal of the obligation.
The additional time can be used to identify potentially high-risk systems, map responsibilities, prepare documentation, establish governance processes and monitor the standards and guidance on which implementation will depend. But the precise compliance requirements will depend on the particular AI system, its classification, its role in the relevant value chain and the provisions applicable to it.
The broader analytical point is therefore narrower than saying that the AI Act is simply being “staged to match regulatory infrastructure.” The evidence supports the more defensible conclusion that EU AI regulation is being implemented progressively, with some high-risk obligations delayed to allow implementation mechanisms to develop.
That distinction matters. Businesses should treat the revised dates as implementation milestones rather than as a suspension of regulatory direction. For the governance structures that oversee compliance, see my post on Risk, Procurement, and Stakeholder Management.
The 28th Regime and the Proposed EU Inc. Company Form
The European Commission presented its proposal for an EU Inc. corporate legal framework on 18 March 2026 as a central component of the broader “28th regime” initiative.
The proposal would create an optional, harmonised corporate legal regime operating alongside existing national company forms. It is intended to provide companies with a more uniform framework for incorporation and operation across the EU Single Market. The Commission describes EU Inc. as particularly relevant to innovative companies and start-ups, while making the proposed form available more broadly to companies that consider it suitable.
The proposal includes several significant features:
- Faster and fully digital company registration.
- A maximum registration cost of €100 under the proposed framework.
- No minimum share-capital requirement.
- Digital procedures throughout the company’s lifecycle.
- Simplified liquidation procedures.
- Digital share transfers and capital operations.
- An optional EU-wide employee-stock-option scheme with harmonised deferred taxation.
- Digital insolvency procedures.
- A common corporate framework intended to facilitate operation across the Single Market.
The important qualification is that EU Inc. is a proposal, not an existing company form. The European Commission has called on the European Parliament and Council to reach agreement by the end of 2026, but the legislative process remains ongoing.
It is also inaccurate to describe the proposal as replacing national corporate law. Its central design is optional: companies would be able to choose the EU Inc. framework alongside national company forms. Nor would it eliminate every national legal requirement. The Commission expressly states that national employment and social laws are not displaced by the proposal.
The economic rationale for reform is nevertheless substantial. IMF analysis estimates remaining intra-EU trade barriers at tariff-equivalent levels of approximately 44% for goods and 110% for services, while also warning that such estimates are model-dependent and should not be interpreted as literal tariffs.
The Commission’s own impact assessment estimates an overall administrative-burden reduction of approximately €328 million to €440 million over ten years, with much of the expected benefit accruing to newly formed innovative companies and scale-ups.
These figures support the proposition that regulatory fragmentation imposes meaningful economic costs. They do not, however, establish that EU Inc. itself will necessarily generate equivalent savings once implemented.
The strongest defensible interpretation is therefore that EU Inc. represents a proposed structural intervention aimed at reducing some of the corporate-law frictions associated with cross-border business in the Single Market. Its ultimate effect will depend on the legislation finally adopted, implementation by Member States and the extent to which businesses actually choose the new form. For the operational disciplines through which regulatory change is executed, see my post on Quality, Resources, and Communications in Projects.
What the EU’s AI and Corporate-Law Developments Illustrate
The AI Act and EU Inc. proposal address different legal problems.
The AI Act establishes regulatory obligations for artificial-intelligence systems according to risk. EU Inc., if adopted, would create an optional corporate-law framework intended to simplify aspects of establishing and operating companies across the Single Market.
It would therefore be misleading to describe the two measures as parts of a single regulatory strategy. They do, however, illustrate a broader feature of contemporary business regulation: regulatory change can simultaneously impose new obligations and attempt to reduce structural or administrative barriers to business activity.
The AI Act shows the implementation challenge associated with technologically complex regulation. The revised high-risk timetable provides additional time for supporting standards, guidance and institutional arrangements. EU Inc. shows a different approach: rather than adapting existing national corporate systems one by one, the proposal would introduce an optional common framework.
The Commission estimates that EU Inc. could reduce administrative burdens by €328 million to €440 million over ten years, but that is an impact-assessment estimate rather than an observed economic outcome.
For businesses, the more defensible lesson is not that regulatory change automatically creates an advantage for firms that monitor it. Rather, firms that systematically monitor regulatory developments are better positioned to identify approaching obligations, available options and changes requiring operational decisions.
The Cyber Resilience Act: Reporting Obligations Are Now Live
The EU Cyber Resilience Act (CRA) establishes horizontal cybersecurity requirements for products with digital elements, including requirements concerning cybersecurity throughout the product lifecycle and vulnerability handling. The Act entered into force in December 2024, while its main obligations apply from 11 December 2027. Its reporting provisions under Article 14 began applying earlier, on 11 September 2026.
As of that date, manufacturers are required to report actively exploited vulnerabilities and severe incidents having an impact on the security of products with digital elements. ENISA’s Single Reporting Platform became operational for this purpose on the same date.
For actively exploited vulnerabilities, the reporting sequence includes:
- Early warning: without undue delay and, in any event, within 24 hours of becoming aware of the actively exploited vulnerability.
- Vulnerability notification: within 72 hours of becoming aware of it, subject to the information requirements in Article 14.
- Final report: no later than 14 days after a corrective or mitigating measure becomes available.
For severe incidents, the CRA establishes a different final-report timetable: the final report is due within one month of the 72-hour notification.
Manufacturers submit notifications through the CRA Single Reporting Platform. The system is designed to allow a manufacturer to report once rather than separately notifying multiple authorities. The notification is addressed to the relevant CSIRT, with the system supporting dissemination to other relevant CSIRTs.
This makes the CRA reporting requirement more than a conventional documentation exercise. It is connected directly to vulnerability-management and incident-response processes.
Businesses within scope should therefore consider whether their existing processes can identify reportable events quickly enough, establish who has authority to make a report, maintain appropriate escalation procedures and preserve the information needed for successive notifications.
The precise compliance position nevertheless depends on the product, the manufacturer’s role and the circumstances of the incident. The CRA also contains specific provisions for microenterprises, SMEs and open-source software stewards, so businesses should not assume that a single compliance model applies uniformly to every organisation.
The central operational conclusion is consequently defensible: CRA reporting readiness needs to be integrated into cybersecurity incident response before a reportable event occurs. For the scheduling and cost controls that support regulatory response, see my post on Scheduling and Cost Control in Projects.
Digital Trade Rules and the UK’s CPTPP Position
Digital trade rules are provisions in trade agreements addressing matters such as electronic transactions, cross-border data flows, data localisation, digital services and related regulatory issues.
A significant UK development occurred on 1 September 2026, when the CPTPP entered into force between the UK and Canada. Canada had been the final CPTPP party to ratify the UK’s accession, meaning that from that date the UK could access CPTPP provisions in relation to all 11 other CPTPP members.
The digital provisions have practical relevance for businesses. UK government guidance states that CPTPP members have commitments against unjustified data and server-localisation requirements. These provisions can reduce the need for businesses to establish local infrastructure solely to satisfy certain localisation requirements, although the commitments remain subject to the agreement’s exceptions and individual countries’ applicable laws and regulations.
The agreement also provides business-mobility commitments. In relation to Canada, eligible CPTPP business visitors can stay for up to six months, compared with the previous limit of 90 days in any six-month period under the relevant UK-Canada arrangements. Other categories, including intra-corporate transferees, investors, and independent professionals and technicians, are subject to their own requirements and limits.
CPTPP also creates government-procurement opportunities for covered sectors and entities. UK government guidance identifies additional procurement access in Canada under CPTPP, including categories not covered in the same way by the earlier UK-Canada arrangements.
These provisions should not be described as eliminating regulatory barriers. Businesses remain subject to domestic regulation, immigration requirements, data-protection rules, sector-specific requirements and the conditions attached to the agreement itself.
The more defensible conclusion is that digital-trade provisions can form part of the legal infrastructure through which businesses structure cross-border digital operations. Their commercial value depends on the sector, destination market, domestic rules and the particular commitments applicable to the transaction.
Conclusion
Business law in 2026 is characterised less by a single regulatory transformation than by several regulatory systems moving at different speeds.
The EU AI Act is now broadly applicable, but important high-risk obligations have been moved to later dates: 2 December 2027 for relevant Annex III systems and 2 August 2028 for high-risk AI embedded in regulated products.
The proposed EU Inc. framework would create an optional EU-wide corporate legal regime if adopted. It is intended to reduce some of the administrative and structural frictions associated with operating across national corporate-law systems, but its economic effects remain prospective rather than demonstrated.
The Cyber Resilience Act has entered a more immediate operational phase. Its reporting obligations for manufacturers have applied since 11 September 2026, with 24-hour and 72-hour reporting stages for actively exploited vulnerabilities and subsequent final-report requirements.
The UK’s CPTPP position has also changed materially. Since 1 September 2026, the UK has had CPTPP access in relation to all 11 other parties, creating additional opportunities under the agreement’s digital-trade, mobility and procurement provisions.
Taken together, these developments support a broader analytical conclusion: business-law compliance is increasingly a process of continuous regulatory monitoring rather than a one-time exercise.
That does not mean every regulatory change creates a competitive advantage. Nor does monitoring regulation guarantee better commercial performance. It does mean that businesses operating across jurisdictions increasingly need systems for identifying changes, determining whether they apply, translating legal requirements into operational responsibilities, and distinguishing proposals from rules already in force.
For businesses, four practical priorities follow:
- AI governance: use the revised AI Act timetable to map potentially regulated systems, clarify responsibilities and prepare for the applicable obligations rather than treating delayed deadlines as cancelled requirements.
- Corporate structure: monitor the EU Inc. legislative process and assess its potential relevance only if and when the proposed framework is adopted in a form suitable for the business.
- Cybersecurity: integrate CRA reporting requirements into incident-response procedures, including escalation, responsibility, information collection and reporting through the Single Reporting Platform.
- Digital expansion: examine the digital-trade, mobility and procurement provisions of relevant trade agreements as part of market-entry planning, while separately assessing domestic regulatory requirements.
The important shift is therefore not simply that business law is becoming “more regulated.” Different areas are simultaneously being tightened, delayed, simplified, harmonised or newly structured.
For businesses operating across borders, the resulting legal environment is dynamic. The practical task is to distinguish what is already law, what is entering into application, what remains proposed, and what is merely an interpretation of the likely commercial consequences.
References
- European Union. Regulation (EU) 2024/1689 (EU AI Act), as amended, including the revised application dates for high-risk AI systems. EUR-Lex.
- European Commission. AI Act: Shaping Europe’s Digital Future. Application and implementation timetable.
- European Commission. EU Inc.: A new harmonised corporate legal regime. Proposal, features and supporting documents, 18 March 2026.
- European Commission. EU Inc.: making business easier in the European Union. 18 March 2026.
- European Commission. Towards a 28th regime for EU companies. COM(2026) 320 final, 18 March 2026.
- International Monetary Fund. Lifting Binding Constraints on Growth in Europe: Actionable Priorities to Deepen the Single Market. IMF Working Paper, 2025.
- European Union. Regulation (EU) 2024/2847 (Cyber Resilience Act). EUR-Lex.
- European Commission. Cyber Resilience Act: Reporting obligations. Updated 11 September 2026.
- ENISA. The CRA Single Reporting Platform is launched. 11 September 2026.
- UK Department for Business and Trade. UK secures full access to the 13 billion pound CPTPP trading bloc. 1 September 2026. GOV.UK.
- UK Government. CPTPP guidance for UK businesses and trade agreements in effect. Updated September 2026. GOV.UK.
Read Also on Kat-Syd Resources Hub
Risk, Procurement, and Stakeholder Management — Risk management, procurement, stakeholder management, and change control as interconnected governance functions.
Quality, Resources, and Communications in Projects — Quality, resource, and communications management as the operational disciplines that hold a project together.
Scheduling and Cost Control in Projects — Schedule management, CPM, PERT, CCPM, and EVM, tested against a 2026 Indonesian oil and gas compressor case study.
Written by Kateule Sydney — Researcher and Writer
© 2026 Kat-Syd Resources Hub. All rights reserved.
Kat-Syd Resources Hub — Educational case studies and analytical reference