Deloitte Monday Briefing: Iceland, From Doom To Boom

September brought significant regulatory developments in AI governance, with new frameworks emerging across the UK, Europe, and the United States. From the UK government's AI Risk Management Toolkit to Florida's unprecedented legal action against OpenAI, regulators and policymakers are working to ensure AI capabilities are matched by robust safeguards and accountability measures.

The EU's Cyber Resilience Act introduces mandatory cybersecurity reporting obligations for manufacturers of digital products starting September 2026, requiring notification of actively exploited vulnerabilities and severe incidents within strict timeframes. Companies must establish procedures to identify and report security events to national Computer Security Incident Response Teams, with potential fines reaching €15 million or 2.5% of global turnover for non-compliance.

The EU AI Act's transparency rules now require businesses using AI systems to disclose when customers interact with artificial intelligence or encounter AI-generated content.

The European Commission has unveiled a European Innovation Act designed to strengthen the EU's innovation ecosystem by addressing two critical challenges: limited access to finance for IP-rich businesses and fragmented regulatory frameworks across Member States. The proposal introduces measures including a common IP valuation framework, streamlined R&D procurement procedures, and harmonized regulatory sandboxes to help startups and scaleups commercialize their innovations more effectively.

Legal AI has rapidly proliferated across in-house legal teams, appearing in budgets and workflows everywhere, yet a striking gap has emerged between adoption and effective implementation. While nearly every legal department now uses AI tools, only a small fraction has successfully scaled their deployment, and the vast majority cannot determine if their investments are delivering value.

The Solicitors Regulation Authority has issued a warning notice on AI misuse in legal practice, clarifying what responsible adoption looks like. While recognizing AI's benefits for document review, drafting, and research, the regulator emphasizes that solicitors remain accountable for their work regardless of the tools used, requiring proper governance, human oversight, and professional judgment to manage risks like hallucinated citations and confidentiality breaches.

The EU Cyber Resilience Act (CRA) is an EU product cybersecurity law for connected products (formally, “products with digital elements” under the CRA) commercialized in the EU; it entered into force on 10 December 2024...

This content appears to be a placeholder or test page containing only the text 'OK'. Without substantive information, it's not possible to determine the article's premise, purpose, or subject matter.

Professor Richard Susskind challenges senior in-house legal leaders to rethink AI's role in the legal profession, arguing that while short-term impacts are overestimated, the long-term transformation toward Artificial General Intelligence will fundamentally reshape how legal services are delivered. Can legal departments prepare for a future where AI doesn't just assist lawyers but potentially replaces the traditional advisory model entirely?