Last reviewed · 5 October 2026
Governance Watch.
Governance Watch is a manually maintained reading list for AI, privacy, virtual assets and health information regulation. It links to official sources and identifies practical questions for an organisation’s review. It is not a live legal monitoring service; readers should check the stated review date and the current official text.
Which regulatory developments deserve attention?
| Framework | Current reading | Practical question | Official sources |
|---|---|---|---|
| EU AI Act European Union · cross-border relevance | The European Commission's current guidance distinguishes obligations already applying from extended high-risk implementation periods following the AI Omnibus. There is no single compliance date for every AI system. The applicable position depends on the system, the organisation's role and the relevant transitional provisions. | Map territorial scope, provider and deployer roles, intended use and risk classification. Record which obligations apply now and which require a readiness plan. Verify the current consolidated law and guidance for the particular system. | European Commission — AI Act and application timelineEuropean Commission — AI Omnibus enters into force |
| PIPEDA reform Canada | PIPEDA remains the federal private-sector privacy framework described in the Privacy Commissioner's current guidance. The previous Digital Charter Implementation Act proposal did not become law. Reform proposals and targeted amendments must be distinguished from provisions actually in force. | Maintain compliance with the law applicable to the organisation today, including provincial regimes where relevant. Track parliamentary progress and commencement provisions before changing a compliance programme in reliance on a proposal. | Privacy Commissioner of Canada — PIPEDAPrivacy Commissioner of Canada — privacy law reformParliament of Canada — historical Digital Charter bill record |
| UAE virtual asset frameworks UAE · Dubai · DIFC · ADGM | The regulatory route depends on the location, activity and asset. VARA publishes compulsory and activity-specific rulebooks for its Dubai perimeter, excluding DIFC. DIFC and ADGM have their own financial-services regimes. A commercial licence or an asset's technical label does not settle the financial-regulatory analysis. | Map the proposed activity, customer location, token rights and custody model before selecting a route. Check the relevant regulator's current rules, permissions and marketing requirements with locally licensed counsel where required. | VARA — regulatory rulebooksDFSA — Crypto Token frameworkADGM — digital asset regulatory framework |
| Alberta Health Information Act Alberta · Canada | The HIA governs health information held by custodians within its scope. Alberta's privacy regulator states that custodians must submit a privacy impact assessment for review and comment before implementing relevant new or changed systems or practices involving identifying health information. | Confirm whether the organisation is a custodian, affiliate or information manager and document its role. Put the assessment, agreements, access controls and applicable breach procedures into the implementation plan. A health-related product is not automatically governed by HIA in every context. | Government of Alberta — Health Information ActAlberta privacy regulator — privacy impact assessments |
Related capabilities
From reading to readiness
Let’s start a conversation
Bring the hard question early.
Tell me what you are building, where it will operate, and the decision in front of you. Please leave sensitive details for an agreed channel.
What questions commonly arise?
What does this page explain?
Governance Watch is a manually maintained reading list for AI, privacy, virtual assets and health information regulation.
How do I discuss a related matter?
Email ruchi@ruchibindra.com with a brief outline. Availability, conflicts, jurisdictional scope and engagement terms must be confirmed before work begins.