GRC Trends for 2027: What Leaders Need to Know

When the EU pushed back the high-risk rules of the AI Act in 2026, many GRC teams took the chance to exhale. Sustainability reporting for companies outside the first wave moved too, and so did supply chain due diligence.

The relief won’t last. Several of the deadlines postponed in 2026 now fall in 2027, alongside dates that never moved, such as the Cyber Resilience Act and the EU’s new anti-money laundering rulebook. Obligations that looked years apart in 2025 now arrive within months of each other.

That’s what defines the GRC trends of 2027. Most of the requirements are already known, and many have been in preparation for years. What’s new is how tightly the dates are stacked. Teams that run each regulation as its own project will meet them one after another, with little time in between. In 2027, the regulation isn’t the hard part. The timing is.

This blog post explains the six GRC trends shaping 2027 and separates the dates that are fixed in law from those that are still expected. It closes with a calendar of the key deadlines.

As part of its simplification agenda, the EU adjusted several timelines in 2026. Sustainability reporting under the Corporate Sustainability Reporting Directive (CSRD) was pushed back for companies outside the first wave, and Member States now have until July 2028 to transpose the Corporate Sustainability Due Diligence Directive (CSDDD). The AI Act’s high-risk obligations moved as well, which Trend #2 covers in detail. [1]

Our GRC Trends for 2026 looked at where these rules stood before the changes.

The reasons differed. For CSRD and CSDDD, the EU wanted to reduce the reporting burden on companies. For the AI Act, the technical standards needed to demonstrate conformity weren’t ready in time.

A postponement changes when the work is due. The work itself stays the same size. The revised European Sustainability Reporting Standards (ESRS), adopted by the European Commission on July 3, 2026, are set to apply from financial year 2027. That means the data for the first reports has to be collected during 2027. Teams that paused their programs in 2026 now have the same scope to cover in less time. [2]

Deferred obligations now land next to deadlines that were never in question. In financial services, the EU Anti-Money Laundering Regulation (AMLR) applies from July 10, 2027, and replaces national rules with one directly applicable rulebook. By around December 2027, organizations that must use strong user authentication, such as banks and payment providers, are also expected to accept the EU Digital Identity Wallet under eIDAS 2. Manufacturers face two product regulations in the same year, covered in Trend #3. [3, 4]

For organizations in scope of several of these rules, preparation for one deadline overlaps with the application of another. Which dates apply depends on sector and products, so a practical first step is to mark the relevant rows in the calendar at the end of this article.

Hint: Download our free GRC Compliance Calendar 2027, with recommended lead times for every key date and a readiness checklist.

The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on July 27, 2026. It moved the obligations for stand-alone high-risk AI systems listed in Annex III of the EU AI Act to December 2, 2027. Annex III covers areas such as biometrics, employment, creditworthiness, education and critical infrastructure. High-risk AI that’s part of a regulated product under Annex I follows on August 2, 2028. [5, 6]

Not everything was postponed. Obligations for general-purpose AI models have applied since August 2025. The transparency rules in Article 50, such as telling people they’re interacting with an AI system, have applied since August 2, 2026. The only extension there covers the marking of AI-generated content from generative systems already on the market, which has until December 2, 2026. [6]

The registration requirement under Article 49(2) also stays in effect, in simplified form. It applies to providers who conclude that a system listed in Annex III is exempt from classification as high-risk. [6]

Under Annex III, a system’s risk category follows from its intended use, whatever technology it runs on. A tool that screens CVs in recruitment can fall under Annex III, and so can a model that supports credit decisions. An assistant that answers internal IT questions usually doesn’t. [7]

The first task for 2027 is an AI inventory that records each system’s purpose and context of use. That inventory works best when it’s linked to the risk assessment and the classification decision, with the registration record kept alongside them. A spreadsheet nobody owns won’t hold up when questions come.

Hint: Check how prepared you are with the EU AI Act Maturity Check.

A classification decision has to stay defensible long after it’s made. If an organization concludes that a system listed in Annex III isn’t high-risk, it has to document that conclusion and register it under Article 49(2). Both steps are far easier while the system is being assessed than after the deadline, when supervisory authorities may start asking questions. With the December 2027 deadline approaching, the order of the work matters as much as the date.

The Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, applies in full from December 11, 2027. Products with digital elements placed on the EU market must then meet essential cybersecurity requirements and carry the CE marking, backed by technical documentation. For certain important and critical products, a notified body has to assess conformity. [8]

Part of the CRA already applies. Since September 11, 2026, manufacturers have had to report actively exploited vulnerabilities and severe incidents, including for products already on the market. That gives teams a chance to practice the reporting process before full application. [8]

On January 20, 2027, the Machinery Regulation, Regulation (EU) 2023/1230, replaces the Machinery Directive. As a regulation, it applies directly in all Member States without national implementation. It also addresses newer risks. Machinery with safety functions based on self-learning behaviour, such as machine learning, needs a conformity assessment by an independent body. [9]

Both regulations require evidence that requirements are met before a product reaches the market, and that they stay met afterwards. GRC teams already know this work. It follows the same pattern of requirements, controls, owners and evidence, maintained over time.

What changes is the object of control, which becomes a product line. Organizations that already run an internal control system can extend it to product compliance and avoid building a second structure.

A connected machine can fall under both the Machinery Regulation and the CRA. If it uses AI, the AI Act may apply as well, although the AI Omnibus changed how the AI Act treats machinery and further Commission acts will shape the details. Each regime has its own documentation and conformity logic, yet much of the underlying evidence is shared. Mapping the requirements once and linking them to common controls avoids running separate compliance projects for a single product. It also leaves room to absorb the rules that are still being defined.

Most Member States have now transposed NIS2 into national law, though a few were still outstanding in mid-2026. Scope and registration windows differ from country to country, and so do supervisory powers. Groups operating across borders have to check each national law separately.

Germany’s NIS2 implementation act entered into force on December 6, 2025, with no transition period. The statutory registration deadline was March 6, 2026, and the Federal Office for Information Security (BSI) later gave late registrants until July 31, 2026. By mid-2026, fewer than two-thirds of the roughly 29,500 entities expected to be in scope had registered. [10]

Austria’s new NIS Act entered into force on October 1, 2026, with registration due by December 31, 2026. Entities then have twelve months from the registration obligation to submit a self-declaration on the measures they’ve implemented, which puts it in autumn 2027. From October 1, 2028, Austrian authorities can request proof of implementation by an independent body. [11]

Registration is only the first step. The next question is what has actually been implemented. Supervisors will look at risk management measures and incident handling, along with supply chain security and management accountability, all documented so it can be shown on request.

Evidence holds up best when it comes out of normal control operation, with a named owner and a date for each item. Organizations that treat NIS2 as an evidence task from the start will find the move to supervision much easier. Our guide to building a compliance monitoring plan shows how to set that up, and the DORA compliance checklist covers the financial-sector side.

Hint: See how organizations implement NIS2 and DORA in practice with ADOGRC in our webinar Success factors for the successful implementation of NIS-2 and DORA.

Some of the most pressing risks for 2027 have no deadline at all. According to the Verizon 2026 Data Breach Investigations Report (DBIR), a third party was involved in 48% of the breaches analyzed. That’s up from 30% in the previous edition and 15% the year before. A growing share of incidents now starts outside an organization’s own perimeter. [12]

Regulators have responded. Under the Digital Operational Resilience Act (DORA), the European Supervisory Authorities designated 19 critical ICT third-party providers for direct EU oversight in November 2025, and the list is updated annually. [13]

Financial entities keep full responsibility for managing their own ICT third-party risk. What’s new is that supervisors also look at dependencies across the sector.

One questionnaire per supplier per year captures a single point in time. The relationship itself changes every time a new service or subcontractor comes in.

For 2027, the more useful question is which critical functions depend on a supplier, and which controls cover that dependency. Answering it means connecting third-party risk to the processes and systems that rely on each supplier, and keeping it in the same risk management structure as every other risk.

Gartner predicts that more than 40% of agentic AI projects will be cancelled by the end of 2027, citing unclear ROI, rising costs and inadequate controls. [14]

A separate Gartner analysis points to a related problem, a binary approach in which an agent is either locked down or fully trusted. Over-restricting simple agents slows delivery and pushes development into the shadows. Under-restricting more autonomous agents creates operational and security risk, along with compliance exposure. [15]

That shadow side is already visible. The Verizon 2026 DBIR reports that 45% of employees now use AI regularly on corporate systems, up from 15% a year earlier. It also found that 67% of users access AI services through non-corporate accounts on corporate devices. [12]

Gartner’s alternative is to classify agents by what they’re allowed to do and to let controls grow with each level. [15]

1. Observe. The agent has read-only access, and its output is visible only to the requesting user. Scoped data access and usage logging are enough at this level.
2. Advise. The agent produces recommendations and drafts that humans review and execute. Controls add accuracy and hallucination testing, plus training on how far to rely on the output.
3. Act with approval. The agent can write data or send communications, but only after explicit approval of each action. Approval workflows with audit trails become necessary, along with agent-specific incident response, so approvals stay a real control.
4. Act autonomously. The agent acts within guardrails, and humans review exceptions and aggregated outcomes. This level calls for continuous monitoring and rollback mechanisms. It also needs an automatic shut-off when thresholds are breached and clear ownership of the agent’s behaviour.

Applying this model requires knowing which agents exist and what they can access, which requirements apply to them and who is accountable. Those are the same connections that turn an AI inventory into operational AI governance, and they build on the inventory the AI Act’s December deadline already requires.

The four autonomy levels

These are the compliance deadlines for 2027 at a glance. Rows marked “Your organization” apply wherever you’re in scope, and the others are deadlines for Member States or the European Commission. The status column shows whether a date is fixed in law or still expected.

Each of the six trends adds its own requirements, yet most of them draw on the same controls and the same evidence. The CRA and the Machinery Regulation rely on overlapping product documentation. DORA and NIS2 both ask how supplier dependencies are governed, and the AI Act inventory is the starting point for agent governance. Handled as separate projects, each obligation rebuilds work that already exists somewhere else in the organization.

An integrated GRC program treats 2027 as one schedule. In practise, it rests on four connected elements:

• One requirements register. Every obligation is recorded with its deadline and its status, fixed or expected, and linked to the controls that address it.
• A common control set. A single control can provide evidence for several regimes, so a vulnerability handling process can serve both the CRA and NIS2.
• Named ownership. Each control and each piece of evidence has an owner and a review date, which makes readiness something an organization can show at any point in the year.
• Impact analysis. When a deadline moves or a new obligation applies, the links show which processes and owners are affected, and where evidence is still missing.

Organizations that work this way spend 2027 maintaining one model as each date arrives, which is far less work than rebuilding the picture before every deadline.

ADOGRC, BOC Group’s GRC platform, is built around this kind of connected model. Its integrated compliance library contains more than 1,000 control objectives across more than 30 standards and over 40 domains. Teams start from those objectives and link them to their own controls and owners, which gives them the requirements register and the common control set from day one.

The same structure extends to the areas these trends reach. Internal controls can cover product compliance, and operational risk management can include third-party dependencies. Information security and data protection are part of the platform too, along with ESG, so compliance management runs in one governed context.

Hint: ADOGRC is fully containerized. It runs as SaaS or in a private cloud and can also be deployed on premises, which gives regulated organizations full control over their data and deployment. Read more on why data sovereignty matters for regulated organizations.

A full calendar awaits GRC owners in 2027. The good news is that almost none of it comes as a surprise, since most of the dates are already written into EU law and the rest are close to final. That leaves GRC leaders with one real decision for the year, which is when to start treating those dates as a single schedule. The earlier that happens, the more each deadline builds on the work done for the one before it, and the more confidently teams can meet each date.