GRC events & news

Key takeaways  How Fairlife’s cyberattack became a group governance issue  On July 16, 2026, Coca-Cola disclosed that Fairlife, its dairy business, had detected unauthorized access to a section of its network, including production-linked systems. Production at Fairlife’s 4 US factories stopped. Canadian production continued. Product on shelves stayed safe.  A ransomware-as-a-service group calling itself Anubis claimed responsibility, saying it had taken 1 terabyte of data and threatening to leak it. According to…

Key takeaways  Introduction: the AI compliance deadline GRC teams have been racing toward just moved  For eighteen months, “2 August 2026” has been a fixed point on the calendar for compliance, risk and AI governance teams across Europe, and well beyond. This was the date the EU AI Act’s toughest obligations, covering high-risk AI systems, were due to bite: conformity assessments, technical…

Key takeaways  Introduction: for many businesses the lights went out when the US government enforced AI restrictions   Picture this: it’s the morning of 13 June 2026 and the compliance team at a mid-sized, European financial services business opens their AI-assisted regulatory monitoring tool – the one they recently rolled out, that surfaces horizon risk items and flags policy changes across five jurisdictions. It is offline, with no warning email, no estimated time of restoration and, critically, no fallback. …

Key takeaways What happened at Novo Nordisk?  Reuters reported that cyber extortion group FulcrumSec claimed it spent more than 2 months inside Novo Nordisk’s network and stole more than 700,000 files, equal to roughly 1.3 terabytes of data. The group also claimed Novo Nordisk refused to pay a $25m extortion demand. Reuters said it could not immediately verify the authenticity of the data…

Key takeaways  Introduction: Is AI changing the cyber threat environment faster than organizations can respond?  AI is not only a technology that organizations need to govern internally. It is also reshaping the external cyber threat environment. Used well, AI can help teams detect vulnerabilities, strengthen defenses and respond to incidents more quickly. However, the same capabilities can create new attack…

Key Takeaways Introduction: what happened in the Carnival data breach? Carnival Corporation is one of the world’s largest cruise operators, with a portfolio of cruise brands serving customers across international markets. On 14 April 2026, Carnival Corporation said its IT security team identified unauthorized activity involving an employee account. According to the company, an unauthorized…

Recent regulatory activity in the US and UAE points to a bigger GRC trend: regulators are looking beyond policies and asking whether organizations can prove control across more areas of the business.  In the US, the Department of Justice announced a $549.5m False Claims Act settlement over alleged evasion of customs duties on Chinese aluminum extrusions. The…

Key takeaways Ireland’s Data Protection Commission has opened an inquiry into SHEIN Ireland over transfers of EU/EEA personal data to China. The DPC has said transfers to China are now an “important strategic priority,” and the inquiry will examine GDPR principles, transparency obligations, and Chapter V transfer requirements. This messaging makes this far more than…

Key takeaways / abstract Anti-bribery enforcement is not standing still. In the space of a few weeks, cases and enforcement activity across the UK, US and Middle East have pointed to the same issue: regulators are not just looking for policies. They are looking for proof that compliance programs work in practice. The Ultra Electronics…

Last week’s AI headlines did not just signal another round of model launches. They signaled a shift in cyber risk that business leaders should take seriously. In the space of a few days, Anthropic unveiled Mythos, OpenAI expanded trusted access to a more cyber-capable model for verified defenders and the UK government issued an open…

Recent ESG headlines are not pointing in one simple direction. In the U.S., the political environment has become less supportive of climate-related regulation under the current administration, but investor pressure has not disappeared. In the past week alone, investors pressed Amazon, Microsoft, and Google for sharper disclosure on the water and power demands of their…

On 31 March 2026 UK’s Information Commissioner’s Office (ICO), called on businesses to review their use of automated decisions in recruitment and published fresh expectations for organizations using automated decision-making in hiring. The regulator said it had engaged with more than 30 employees, wrote to 16 organizations likely to be using automated decision-making in candidate…

As many business leaders will have noticed, data breach headlines have come thick and fast in early 2026, but the bigger story is not just volume. It is pattern. Look across the year’s most visible incidents and the same problem keeps surfacing through different routes. Different sectors, different systems, different immediate causes, but the same…

Recent reporting suggests compliance leaders are entering a tougher phase. Regulatory fragmentation is pushing businesses away from self-declaration and toward verified data. Meanwhile AI, fraud, and rising complexity are turning compliance into a technology arms race just as already-stretched teams face tighter resources and mounting pressure to move faster. That is exactly why the idea…

The European Commission published draft EU Cyber Resilience Act guidance on March 3, 2026, and opened feedback until March 31. The draft focuses on the exact implementation knots teams have been struggling with: remote data processing, free and open-source software, support periods, and how the CRA fits with other EU laws. That means this is…

HF Sinclair’s CFO, Atanas Atanasov, took a voluntary leave of absence after concerns raised by the audit committee, one week after CEO Tim Go did the same. The internal review started after concerns were raised about the company’s 2025 disclosure process and “tone at the top,” and the audit committee ultimately reported no deficiencies in financial reporting controls or disclosure…

From April 2026, more organizations will fail Cyber Essentials. Not because the five controls are changing, but because the scheme is becoming far less forgiving of gaps between what you say you do and what is actually happening on systems day to day. Cyber Essentials has always been sold as baseline cyber hygiene. Baseline does…

Across the Middle East, governance, risk, and compliance are undergoing a quiet but consequential shift. What was once treated as a supporting function is increasingly becoming a core driver of credibility, investment, and long-term resilience.  This change is not being led by speeches, slogans or strategy documents. It is showing up in how regulation is…

Over the past year, cyber-attacks have stopped looking like technical failures and started behaving like prolonged business crises.  Retailers, airlines, manufacturers, healthcare providers and media organizations have all been headline news for their cyber incidents. In many cases, the initial breach was only the beginning. We witnessed; operations were disrupted, supply chains stalled, customer services faltered and leadership teams were forced into crisis mode long after systems…

For teams who follow AI policy in the United States, the missing American equivalent to the EU AI Act is easy to misunderstand. Many readers assume this signals hesitation or a light touch approach. From a distance, the US model can appear unclear and even permissive.  That view gets the story wrong.  Regulation is already here, just…

The UK’s decision marks the end of crypto’s regulatory grey zone. At CoreStream GRC, we’re seeing global crypto and fintech teams move from asking if regulation will land, to working out how to prepare for it in a way that does not slow the business down. In this piece our team at CoreStream GRC breaks…