Across jurisdictions and legal areas, including data protection, artificial intelligence, competition and intellectual property, new regulations create a shifting landscape
Over the past two decades, innovation has shifted from the physical to the digital world. Data has become the lifeblood not only of e-commerce, but also of the full range of economic and social activity, including in the areas of health, finance, manufacturing, energy, communication and security.
The rise of AI is driving unprecedented change in the use of data, and in the core relationship between humans and machines. Generative AI (GenAI) only made its public debut in late 2022 with the launch of ChatGPT. Yet, by 2024, 65 percent of major companies reported using GenAI technology, according to McKinsey. The International Monetary Fund estimates that AI will impact at least 40 percent of jobs worldwide in the years ahead.
Across the globe, individuals, businesses and governments are trying to keep pace with this digital acceleration. Individuals are integrating new technologies into their lives at breakneck speed—from smart devices to GenAI-based personal assistants. Businesses are finding ways to deploy and leverage vast troves of data and the ability of AI to process it. Governments are continuing to attempt to bring the rules that have long regulated the off-line world into this even more quickly evolving digital era.
New regulations across sectors and jurisdictions
The past five years have seen a wave of new technology regulation, as governments seek to mitigate the risks of new technologies, ensure competition, and address perceived imbalances between consumers and technology platforms. The rapidity and reach of this digital acceleration have led to a proliferation of often inconsistent and incomplete regulation across jurisdictions.
Data protection rules
The number of countries imposing data protection and privacy laws has doubled from 68 in 2010 to 137 in 2023. The EU led the way with the GDPR, harmonizing strict personal data privacy standards across the bloc. The GDPR establishes certain rights of individuals with respect to the processing of their personal data, including rights to be informed, rights of access, rights to rectification, rights to erasure, rights to restrict processing, rights to data portability, rights to object and rights in relation to automated decision-making and profiling. Fourteen additional countries or jurisdictions with laws offering similar levels of protection of personal data have received "adequacy" determinations under the GDPR, allowing the unfettered flow of data between them and countries in the European Economic Area.
Other jurisdictions are taking their own approaches. For example, the US regulates the use of data through a patchwork of data protection regulation in different sectors. Some US states, including California, Connecticut, Colorado, Utah and Virginia, have sought a more comprehensive approach and have developed their own data protection and privacy laws. Yet other countries have prioritized sovereign interests in the use and control of data through data-localization regulations that restrict the movement of data out of a country's territory.
AI regulation
Across the globe, countries are racing to catch up with AI's rapid development and deployment. Definitions of AI itself vary widely, and countries have taken different conceptual approaches to AI regulation and enforcement. Some jurisdictions have developed broad principles—such as the UK's AI framework—and others have adopted more structured, cross-sectoral regulation, such as the EU's AI Act. In 2023, the Biden administration implemented an Executive Order on the Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence. International organizations like the G7 have put forward AI codes of conduct. These efforts across countries are often inconsistent and even potentially contradictory. Businesses must decide whether their approach to compliance will be one-size-fits-all or regionally specific.
The most far-reaching of these new efforts is the EU AI Act, which entered into force in 2024 and will generally be effective as of August 2, 2026. The AI Act provides a "comprehensive horizontal legal framework for the regulation of AI across the EU." It seeks to promote the development of trustworthy AI and protect core values such as health, safety, democracy, rights and the rule of law. The act categorizes AI systems based on their degree of risk and imposes corresponding compliance requirements, ranging from outright prohibition to transparency obligations. The Act is to be enforced by a range of regulators, including a new AI Office within the European Commission, as well as national-level regulatory authorities.
Competition regimes
The past five years have seen new applications of competition rules in the digital space. A 2020 survey of 30 advanced economies found that 29 had updated or expanded their competition rules and enforcement powers in the prior decade. The rise of large technology platforms has exacerbated domestic political pressures in some countries to use competition authority to address a perceived overconcentration of power. The focus of the European Commission and the national authorities of member states has shifted to the digital economy, often concentrating on large US-based tech firms. The EU's Digital Markets Act, enacted in 2022, increases the regulation of digital platforms and introduces ex-ante behavioral requirements for companies that act as digital gatekeepers. Other countries, including the UK and Germany, have likewise updated their competition rules for the digital age. US regulators too have turned to antitrust law to address concerns about digital platforms, with a landmark 2024 decision finding a major search firm in violation of the Sherman Antitrust Act.
Intellectual property
The digital acceleration focuses new attention on intellectual property (IP) protections. New technologies themselves often benefit from IP protections and their deployment may require licensing or other compliance measures. Training of AI systems requires enormous amounts of data, creating new legal considerations, and, in turn, potential liability. Dozens of lawsuits in the US and beyond claim that GenAI training infringes existing copyright protections or that the use of AI models trained on copyrighted material is itself an unauthorized derivative work. Profound questions are surfacing about whether, how and when GenAI-produced content or other outputs (including AI-generated art, music or inventions) should itself be protected and, if so, who is the rightful author or inventor.
Seizing opportunity while navigating risk
The digital acceleration is transforming the global economy and the very foundations of our societies. It is creating opportunities never imagined for every sector of the economy. Whether in manufacturing, pharmaceuticals or finance, the possibilities presented by digital acceleration abound: new objectives, new products, new markets, new knowledge, new ways of operating, new interactions with consumers and new sources of capital.
Yet, seizing the opportunities of digital acceleration is neither easy nor risk-free. Businesses must keep ahead of the frantic pace of both technological and regulatory change. They must address the legal hurdles of technological innovation, adoption and integration. They must navigate a complex, shifting, and inconsistent regulatory environment across jurisdictions and substantive areas of law. As change continues to accelerate and digitization breaks down geographic and jurisdictional barriers, businesses must have both the foresight and global perspective to stay ahead of technology and law.
