6. Regulatory convergence grows across sectors and borders
Data law trends 2026
In brief
Digital technology is blurring the boundaries between privacy, competition, consumer welfare, cybersecurity and finance regulation – creating pressures that traditional governance structures struggle to absorb. Across Europe, the UK and the US, regulators are increasingly collaborating across sectors and jurisdictions to address risks that cut across multiple domains.
Companies that treat regulation as an interconnected system – rather than a checklist of siloed obligations – will be better placed to stay compliant in 2026. This chapter explores that convergence through three high-impact areas: digital platforms, finance and AI.
Regulators across domains are increasingly eyeing the same decisions: platform design, data sharing and AI behavior. Privacy, competition, cybersecurity, finance and consumer-rights authorities now intersect and co-investigate. In practice, this means a single change – in algorithm, contract or interface – can trigger scrutiny from multiple agencies. The Venn diagram below illustrates how these oversight domains overlap and converge.
Mapping the intertwined global enforcement landscape
Platforms: Market power, privacy and safety under joint scrutiny
Europe
The EU’s Digital Markets Act (DMA) addresses gatekeeper power, yet its first major fines centered on consent for data combination and user choice. Here, a competition tool was used to enforce privacy-style rules – illustrating a wider trend where competition enforcement is shaping data governance.
Meanwhile, the Digital Services Act (DSA) requires transparency in recommender algorithms, forcing content moderation, consumer protection and data governance teams to collaborate. National data protection and consumer agencies are embedded in the supervision structure, ensuring cross-disciplinary oversight from day one. The European Data Protection Board and national consumer authorities are also increasingly issuing joint opinions and coordinating enforcement strategies, particularly where algorithmic profiling affects both privacy and consumer rights.
United Kingdom
The Digital Markets, Competition and Consumers Act, in force since January 2025, gives the Competition and Markets Authority bespoke powers over large digital companies with substantial and entrenched market power, while the Online Safety Act empowers Ofcom to act against companies that fail to remove online harmful content. Both bodies participate in the Digital Regulation Cooperation Forum alongside the Information Commissioner’s Office (ICO). The forum already issues joint statements and guidance – illustrating how design choices with competition implications are simultaneously screened for their privacy and safety impact.
United States
No single federal statute mirrors the DMA or DSA, yet practice shows similar convergence. The Federal Trade Commission (FTC) can challenge unfair data practices, consumer protection concerns and anticompetitive conduct, often in parallel. State privacy laws, consumer protection lawsuits and Department of Justice (DOJ) antitrust litigation also frequently address the same fact patterns, prompting informal inter-agency coordination.
Takeaway: For platform operators, changes to terms of service, ranking algorithms or user interactions must now withstand scrutiny from competition, privacy, consumer and safety regulators – sometimes within a single investigation.
Finance: Open data, shared risks, coordinated regulators
Europe
The Digital Operational Resilience Act took effect in January 2025, complementing the NIS2 cybersecurity directive in protecting critical infrastructure. Both regimes extend deep into the supply chain, placing cloud and software vendors serving banks under dual cybersecurity scrutiny. Their significant overlap encourages integrated audits to avoid duplicate penalties for the same incident.
Meanwhile, competition-driven open finance initiatives require financial institutions to share customer data with third-party apps. However, this mandate depends on General Data Protection Regulation (GDPR)-level consent and security, requiring privacy and competition authorities to align on how data can be shared.
United Kingdom
The Financial Conduct Authority and the ICO run joint services, including sandboxes and AI labs, allowing FinTechs to test new data driven services once rather than twice. They have also issued coordinated guidance on AI credit scoring and consumer data rights. The Bank of England, Prudential Regulation Authority and National Cyber Security Centre share incident reporting templates – a sign that operational resilience audits are now multi-agency by design.
United States
The Consumer Financial Protection Bureau (CFPB) is finalizing an open banking rule under Dodd Frank §1033, while banking regulators are developing third-party risk standards that reference Cybersecurity and Infrastructure Security Agency cyber guidance. Privacy obligations stem from the Gramm-Leach-Bliley Act, but enforcement can involve the FTC and state attorneys general. Therefore, a single data breach at a financial institution can trigger investigation across multiple regulators – who increasingly coordinate.
Takeaway: Finance firms face oversight from data, prudential, conduct and cyber authorities that increasingly read from the same playbook. Controls, contracts and reporting lines must satisfy them all at once.
Open finance means open scrutiny – by privacy, cyber and conduct watchdogs alike.
Rachael Annear, Partner
AI: Horizontal rules, converging enforcement
Europe
The EU AI Act is explicitly ‘horizontal’ in scope, but fragmented in execution. Sector-specific AI – like in finance or healthcare, for example – is policed by national regulators depending on sectoral jurisdiction, leaving room for potential inconsistencies and friction. Only general-purpose AI models fall under the new European AI Office, which leads cross-border investigations and coordinates enforcement. The AI Office has called for joint enforcement protocols, particularly for biometric identification, profiling or automated decision-making. It has also signaled plans to work closely with GDPR authorities to avoid duplicative sanctions and ensure consistency where AI systems overlap with other frameworks, such as the DSA.
United Kingdom
Instead of a single AI statute, the UK embeds five high-level principles – safety, transparency, fairness, accountability and contestability – into existing laws. Each sectoral regulator must interpret them and cooperate with peers under a forthcoming statutory duty. The Digital Regulation Cooperation Forum is already producing joint guidance on issues such as children’s data and algorithmic discrimination.
United States
Congress continues to debate comprehensive AI legislation, but regulatory agencies are not waiting. The FTC is pursuing deceptive or biased practices related to the marketing and deployment of generative AI under its unfair practices authority. The Equal Employment Opportunity Commission (EEOC) focuses on bias in algorithmic employment decisions, while financial regulators examine AI-driven credit decisions. These agencies are coordinating more closely, formalized in a 2023 interagency memorandum of understanding on AI oversight signed by the FTC, DOJ, EEOC and CFPB.
Deploying AI without an integrated governance framework creates significant legal risk.
Beth George, Partner
Takeaway: Deploying AI can trigger parallel investigations into data provenance, fairness, sector specific risks and consumer deception. Governance teams must map which regulator leads on each risk – while assuming information-sharing among agencies.
Five ways to stay ahead in 2026
Continuing to address regulatory challenges in silos invites increased regulatory scrutiny and amplifies operational risk.
Vera Ibles, Principal Associate
- Adopt a ‘one dossier’ mindset. Build evidence, risk assessments and audit trails that address privacy, competition, consumer and sectoral questions together – not in silos.
- Establish cross-disciplinary teams. Legal, compliance, data science and product leaders should engage regulators jointly, rather than through fragmented briefings.
- Use global heat maps. Track how the same issue – such as consent for data reuse – triggers different frameworks in the EU, UK and US. Align policies to the highest common standard where feasible.
- Plan for coordinated enforcement. Expect regulators to synchronize remedies even if deadlines differ. Early dialogue can reduce the risk of conflicting orders.
- Safeguarding organizational credibility holistically. Customers and regulators do not distinguish between privacy breaches, unfair practices or biased algorithms. A failure in one area can undermine trust in all.
Looking ahead
Regulatory domains are no longer siloed – they increasingly overlap, creating a network of converging expectations. The intersections – privacy with competition, cybersecurity with financial conduct – mark the new frontier of compliance.
Organizations that map these overlaps and develop integrated response strategies will be more resilient, more credible with regulators and better positioned to thrive.
Our team
