Introduction

Artificial intelligence has moved from pilot projects to core business operations. With that shift comes legal exposure that boards, general counsel, and compliance teams must track in 2026. Regulators now treat AI as a primary corporate risk, not a technical curiosity. The European Union leads with binding rules, but the United States, China, Japan, and South Korea have added their own requirements. A single AI decision can now breach several laws at once. This article sets out the concrete legal risks every global company should monitor this year.

The pressure is structural. Analysis of more than forty regulatory instruments shows a fragmented enforcement landscape where obligations overlap and penalties stack. Companies face what researchers call cumulative penalty exposure, where one automated output can simultaneously violate data protection, copyright, and AI-specific rules. The result is that legal risk no longer sits with one department. It spans data governance, intellectual property, employment, and director duties.

The EU AI Act Reaches Full Force

The EU AI Act is the reference point for global compliance. It classifies AI systems into four risk tiers: unacceptable, high, limited, and minimal. Each tier carries different obligations for transparency, accountability, and human oversight. Unacceptable uses, such as certain social scoring, are banned. High-risk systems face the heaviest documentation, testing, and monitoring duties. The Act applies extraterritorially. A company based outside the EU must comply if it places AI systems on the EU market or if its outputs are used in the Union.

Timing matters in 2026. Full enforcement of the high-risk requirements takes effect on 2 August 2026. The Act uses a three-tiered penalty structure, with the largest fines reserved for prohibited practices. Enforcement runs through the European AI Office, which coordinates national authorities. Providers of general-purpose AI models carry specific duties. They must maintain model documentation, keep versions for ten years after a model reaches the market, and publish a summary of training content. Open-source models receive some exemptions, but those exemptions fall away once a model is classified as posing systemic risk. Systemic risk is tied to computational thresholds measured in floating-point operations, which trigger added obligations for risk assessment, red-teaming, and post-market monitoring. Companies that integrate these models, described as downstream providers, inherit compliance duties even when they did not build the underlying system.

Data Protection and Copyright Collide With AI Training

The General Data Protection Regulation sits at the centre of AI legal risk. Every processing of personal data needs a lawful basis under Article 6. Large language models are trained on web-scraped data that includes personal information, and consent is rarely workable at that scale. Developers therefore rely on the legitimate interests test in Article 6(1)(f), which requires a case-by-case balance against individual rights. Sensitive data raises the bar further. Following the Court of Justice ruling in Meta v Bundeskartellamt, data counts as sensitive under Article 9 whenever processing can reveal a protected category, even indirectly. That reading pulls much routine training data into the stricter regime, where the balancing test does not apply.

Three further GDPR risks deserve close attention. First, the accuracy principle in Article 5(1)(d) clashes with model hallucinations; the noyb complaint against OpenAI before the Austrian authority shows regulators will test inaccurate AI output. Second, the right to erasure in Article 17 is hard to satisfy because personal data can be memorised inside model parameters, raising unresolved questions about machine unlearning. Third, the SCHUFA judgment means automated scoring or ranking of individuals can count as automated decision-making under Article 22, even when a human signs off afterwards. Copyright adds a parallel exposure. AI training relies on the text and data mining exception in the 2019 Digital Single Market Directive, but rightsholders can opt out, and models must not scrape sites courts have flagged for infringement. The EU AI Code of Practice requires signatories to respect robots.txt, honour a planned list of restricted sites, and prevent models from generating infringing outputs. Litigation over training data continues to grow, and companies deploying third-party models can be drawn into those disputes.

Expanding Global Rules and Director Liability

The risk map extends well beyond Europe. United States regulation is developing at state level rather than federal level, which creates a patchwork. California requires disclosure of automated bots and transparency for generative systems. Several states, including Illinois, have introduced rules on AI use in employment decisions taking effect from 1 January 2026. China regulates algorithmic recommendation, deep synthesis, and generative services through separate instruments, while Japan and South Korea have added governance frameworks and a basic AI law. A company operating across these markets must map overlapping controls, because compliance in one jurisdiction does not guarantee compliance in another.

Director accountability is the newest pressure point. In 2026, AI is being treated as a major corporate risk that boards must actively govern, even though most company law was not written with AI in mind. Directors face fiduciary and regulatory exposure if they fail to oversee AI deployment, monitor errors, and reduce legal risk. Practical steps follow from this. Companies should build a documented risk management system, assign named owners for AI copyright and data policies, keep model documentation current, and run post-market monitoring for harmful outputs. The evidence indicates that firms treating AI compliance as a board-level, cross-functional duty will manage exposure better than those leaving it to technical teams. The legal risks are concrete, the deadlines are fixed, and the penalties stack across jurisdictions.