GRC Report Staff

For an accounting firm auditing companies under the supervision of Saudi Arabia’s Capital Market Authority, an inspection will no longer necessarily end when the regulator leaves the room. The CMA Board has approved amendments to the Rules for Registering Auditors of Entities Subject to the Authority’s Supervision, tightening requirements around professional qualifications, quality management, regulatory inspections and transparency. The amendments take effect from the date of their publication.

More than 1,000 organizations in Wales already work under the Wales Accord on the Sharing of Personal Information. What changes now is the footing beneath that work. WASPI has launched its UK GDPR Code of Conduct for Information Sharing Protocols, an Article 40 Code designed to give organizations a consistent framework for sharing personal information across health, education, social care, safeguarding, and other public services.

New consumer protection rules against greenwashing began applying on September 27, bringing into force a set of restrictions that reach directly into the words, labels and environmental promises businesses place in front of consumers. Directive (EU) 2024/825, adopted in February 2024, amends the EU’s Unfair Commercial Practices Directive and Consumer Rights Directive. Member States had until March 27, 2026, to transpose it into national law. Those measures have now entered into application.

Finland’s financial regulator sees room to make the rulebook simpler. What it does not see is a reason to surrender the resilience that has allowed the country’s financial sector to withstand years of economic and market uncertainty.

Sustainability reporting used to be a document. At many large companies, it is now an institution, with its own staff, calendar, controls, and internal audit trail. The 2026 edition of the State of Play study from the IFAC, AICPA, and CIMA found that 97 percent of the world's largest companies disclosed some form of sustainability information in 2024, and 75 percent obtained some level of third-party assurance over it, up from 73 percent the year before and just 51 percent in 2019, the first year the study ran.

Ireland’s Data Protection Commission spent 5 years looking under the hood of AI systems before putting much of what it had seen into a single report. From 2021 through 2025, the regulator engaged with controllers over the creation, launch, and deployment of approximately 180 AI products and services. Behind that number sat thousands of pages of briefings, risk assessments, descriptions of technical and organizational measures, and compliance documentation. The work stretched from large language models and recommender systems to facial recognition, age assurance, personalization, and AI agents.

Nearly every senior AI executive surveyed by EY says their organization has formal rules governing artificial intelligence. Nearly half say those rules have been bypassed when a deployment was urgent. That runs through EY's new AI Risk and Governance Survey, which found that large US companies are rapidly putting AI and autonomous agents to work while struggling to keep their governance processes aligned with the technology.