GRC Report Staff

Sustainability reporting used to be a document. At many large companies, it is now an institution, with its own staff, calendar, controls, and internal audit trail. The 2026 edition of the State of Play study from the IFAC, AICPA, and CIMA found that 97 percent of the world's largest companies disclosed some form of sustainability information in 2024, and 75 percent obtained some level of third-party assurance over it, up from 73 percent the year before and just 51 percent in 2019, the first year the study ran.

Ireland’s Data Protection Commission spent 5 years looking under the hood of AI systems before putting much of what it had seen into a single report. From 2021 through 2025, the regulator engaged with controllers over the creation, launch, and deployment of approximately 180 AI products and services. Behind that number sat thousands of pages of briefings, risk assessments, descriptions of technical and organizational measures, and compliance documentation. The work stretched from large language models and recommender systems to facial recognition, age assurance, personalization, and AI agents.

Nearly every senior AI executive surveyed by EY says their organization has formal rules governing artificial intelligence. Nearly half say those rules have been bypassed when a deployment was urgent. That runs through EY's new AI Risk and Governance Survey, which found that large US companies are rapidly putting AI and autonomous agents to work while struggling to keep their governance processes aligned with the technology.

The United States has asked an EU court for a place in the legal fight over the European Commission’s €120 million fine against X, arguing that the case reaches beyond one social media platform and into the limits of European authority over American companies and their owners.

Texas Attorney General Ken Paxton has announced an investigation into data center developments that have not responded to the Texas Water Development Board’s Water Use Survey. His office said the investigation is ongoing and is intended to ensure data centers provide accurate, current information about their water use.

The European Banking Authority has urged the European Commission to use its review of the Markets in Crypto-Assets Regulation to strengthen safeguards around certain stablecoin arrangements, clarify which crypto-assets fall within the law and consider bringing crypto lending under regulatory rules. The recommendations amount to an early accounting of where Europe’s landmark crypto regime is holding and where experience has begun to expose uncertainty.

TikTok has agreed to pay a £12.7 million fine imposed by the Information Commissioner’s Office in 2023 after the company dropped two appeals against the UK’s data protection regulator, bringing one long-running children’s privacy case to an end and allowing another to move forward.. TikTok has separately abandoned its challenge to an information notice seeking documents and details about how it processes teenagers’ personal information through its recommender systems. The first case reaches back to TikTok’s handling of children under 13, who were not supposed to be on the platform in the first place.