Navigating AI Integration and Cybersecurity Demands

As the development and use of AI continues to evolve over the next 12 months, organisations should consider two fundamental issues. On the one hand, how can they leverage AI to enhance and grow their business (such as improving efficiency and reducing costs)? And on the other, will AI render certain aspects of their business less important—or even obsolete? The answer to these questions will play a critical role in shaping their success over the coming years.

Organisations will ramp up their preparations for compliance with the EU’s AI Act, which took effect in August 2024 but whose provisions will apply in a staggered timeline over the next three years. Establishing governance frameworks, mapping products and services for potential AI Act application, and educating internal stakeholders should all be front of mind for organisations as they plan for the coming year.

Complying with a pair of new EU cybersecurity laws will be a particular focus for many organisations in 2025. The NIS2 Directive took effect on 17 October 2024, and the Digital Operational Resilience Act takes effect on 17 January 2025. Both laws impose new and enhanced obligations around operational resilience, incident reporting and third-party contracting—with GDPR-like fines for non-compliance and liability going to the board level.

The Labour government’s legislative agenda for digital regulation will further take shape in 2025. In addition to the Data (Use and Access) Bill, which was introduced to Parliament in October 2024 and seeks to reform Britain’s data protection regime, we expect to see legislation around cybersecurity (including provisions on notifying the Government of ransom payments) and, perhaps, artificial intelligence.

As children go online at a younger age than ever before, regulators have been increasingly vocal about ensuring their protection. Although to date there has been sporadic enforcement against companies processing children’s data, 2025 could be the year that changes—with large fines being issued in relation to (i) allowing underage children onto social media platforms, and (ii) advertising being targeted to children.