December brings the first AI rule with a fine attached

Week Ahead · Ins7ghts Daily, Sunday 11 October 2026

Only what is already on the calendar. Not momentum, not prediction. Commitments with a public date attached, nearest first.

• 2 December 2026, fifty-two days out. The EU's Digital Omnibus on AI brings two prohibitions into force, on non-consensual deepfakes and on child sexual abuse material, with fines and output-marking duties for generative models, while the high-risk obligations slip to late 2027 and 2028.
• 1 January 2027. UK listed companies fall under the FCA's new disclosure guidance, including the duty to treat a cyber incident as inside information, which puts an AI failure inside a market regime that already fines people.
• End of March 2027, and this one is ours. Our open call from 1 October: at least one enterprise AI deal gets publicly repriced or delayed over a log or sandbox clause rather than over model quality.
• 1 July 2027. Every Florida district and charter school board must have an AI policy in place, parental opt-in and kill switches for autonomous tools included, under a definition of AI broad enough to catch ordinary classroom software.
• July 2027. The HIPAA Security Rule's mandatory encryption deadline, moved out from May 2026 and reclassified as a long-term action, while today's addressable standard stays enforceable and healthcare breaches still average $7.42 million.