AI product management · Industry brief

The European Union's AI Act is now in active enforcement with material regulatory obligations already operational. Prohibited AI practices began applying in February 2025, general-purpose AI model obligations became applicable in August 2025, and on August 2, 2026, the European Commission's AI Office and national authorities began exercising significant enforcement powers with transparency requirements now in effect. High-risk AI systems listed in Annex III covering employment, education, biometrics, and essential services are scheduled to apply from December 2, 2027. The EU has established the world's most comprehensive horizontal AI regulatory framework using a risk-based structure. The United States lacks a comprehensive federal AI statute as of September 2026 and instead governs AI through existing federal laws, agency enforcement, sector-specific rules, and an expanding patchwork of state legislation. Texas's Responsible Artificial Intelligence Governance Act became effective January 1, 2026, while Colorado substantially revised its approach in 2026 with new Automated Decision-Making Technology law requirements beginning January 1, 2027. The Federal Trade Commission continues enforcement against allegedly deceptive AI product claims, establishing that traditional consumer-protection principles remain applicable. The United Kingdom regulates AI principally through existing legal frameworks and sector-specific regulators rather than adopting a comprehensive AI statute. China has created a distinct model combining generative AI rules with data protection, cybersecurity, algorithm governance, and content requirements. The Measures for Labeling Artificial Intelligence-Generated Synthetic Content became effective September 1, 2025, requiring identification of AI-generated and synthetic content across text, images, audio, video, and virtual environments.

AI startups are accelerating M&A activity as a core growth strategy, with 195 acquisitions of AI companies by other venture-backed AI firms recorded through September 29—14% more than all of 2025. OpenAI leads with 20 AI-related acquisitions including 10 this year, while repeat buyers like Anthropic, Legora, and Harvey account for 42% of all transactions over three years. The largest disclosed deals include Nscale's $1.65 billion acquisition of Anyscale, Cyera's $1 billion purchase of Oasis Security, and Anthropic's $400 million acquisition of Coefficient Bio. (Source: Crunchbase News) Well-funded vertical AI startups—particularly in legal tech, customer service, and software development—are using M&A to fill product gaps and enter new markets faster than building internally. Legal AI startup Legora has made five acquisitions in 2026 including Walter AI, Qura, Graceview, Cadastral, and Wexler AI; Harvey has made four acquisitions focused on technical talent and platform expansion into asset management; and Sierra has expanded geographically and operationally through acquisitions in Japan and Europe. Industry observers attribute the surge to the speed advantage in AI markets: acquiring established teams and products provides faster scale than organic building, while high valuations give AI startups favorable currency for deal-making with minimal dilution. (Source: Crunchbase News)

President Trump convened leading AI executives at a White House meeting on September 29, resulting in a voluntary "White House Accord on Super Intelligence" signed by representatives from Anthropic, Google, Meta, OpenAI, Nvidia, and xAI. The accord establishes a four-layer governance framework for frontier AI systems: internal controls to monitor model capabilities and alignment, internal teams to verify control effectiveness, independent external audits to assess whether controls operate as intended, and independent board committee oversight of audit findings. The agreement is legally non-binding and creates no federal requirements, penalties, or government enforcement mechanisms, though it represents significant industry endorsement of established regulatory concepts like internal controls and independent testing. The accord's most notable feature is the commitment to independent external evaluation, analogous to auditing frameworks in financial services and healthcare, though critical details remain unspecified including auditor qualifications, independence standards, testing methodologies, and public disclosure requirements. The agreement leaves open the possibility of future legislation or regulation, stating "over time, it may make sense to codify these steps into laws or regulations." Key questions persist regarding actual implementation of meaningful independent audits, auditor access and independence, board responsiveness to audit findings, and whether Congress will eventually convert these voluntary commitments into enforceable requirements.

Google completed its $32 billion acquisition of cloud and AI security platform Wiz in March 2026, following US approval in November 2025 and EU approval in February 2026, integrating it into Google Cloud. IBM completed its roughly $11 billion acquisition of data streaming platform Confluent, which serves more than 6,500 enterprises including 40% of the Fortune 500, linking it to watsonx.data to help firms govern data for AI agents. ServiceNow agreed to acquire Armis for $7.75 billion in cash, pricing in a 27% premium to Armis's $6.1 billion valuation based on $340 million in annual recurring revenue. The European Commission's AI Act enforcement, along with NIST's July 2024 generative AI profile and ISO/IEC 42001:2023, has converted AI governance from discretionary consulting into a funded operating requirement, with certain violations carrying penalties up to €15 million or 3% of worldwide annual turnover. Organizational AI adoption rose from 78% in 2024 to 88% in 2025, though agentic AI deployment remains in the single digits across most business functions, and documented incidents increased from 233 to 362 over the same period.