Legal and compliance chiefs are rating the level of risk in the current business environment at 7.9 out of 10, where 1 is Negligible and 10 is Significant. This marks a 16 percent increase from Q1 levels, though the figure has remained relatively flat since Q3—suggesting the risk escalation may be stabilizing.

While the new year often brings a renewed sense of optimism and a resetting of the slate, legal and compliance leaders are ending 2025 with persistent concerns about the risk landscape: The overall sentiment among the general counsel, audit, legal and compliance leaders participating in the Q4 Business Risk Index, conducted by Diligent Institute and Corporate Board Member, points to compounding pressures across economic, regulatory and political realms creating a precarious environment for business.

“These elements are directly related,” said one respondent. “As one risk escalates, the others do, too.”

“In 2025, risk levels didn’t just spike, they settled into an ‘alwayson’ baseline,” says Dottie Schindlinger, Executive Director of the Diligent Institute. “In a world where significantly high risk levels are constant, the GC’s agenda may become increasingly defined by AI and broader tech exposure. 

, predicting heightened regulatory tracking, audits and policy reviews in 2026.”

The most striking finding from the survey is the dominance of technology-related concerns. Sixty percent of respondents cited technology as a risk today, well ahead of any other issue, including the economy (33 percent) and tariffs (23 percent). Legal, compliance and audit leaders view increasingly sophisticated cyber-attacks as a primary threat vector.

“Cyber threats and supply chain instability continue to create pressure, particularly for tech and services companies that depend on stable, secure environments,” said Taras Lytovchenko, chief legal and compliance officer at Trinitex.

“From an IT business perspective, the regulatory uncertainty is the biggest factor, especially around data protection, AI governance and cross-border compliance,” added another respondent. “On top of that, cyber threats and supply-chain instability continue to create pressure.”

“Technology risk is now the connective tissue across the entire risk register,” says Kira Ciccarelli, Senior Manager of Research at the Diligent Institute. “We know that 

boards too are experimenting with new tech like AI tools

 to enhance oversight, yet relatively few organizations are leveraging AI powered dashboards for risk monitoring. Closing that execution gap will separate leaders from laggards.”

While those polled expect most risks to lessen as businesses get more clarity around issues such as trade, regulations and the economy, AI-related risks are the notable exception. The majority continue to cite it as a top risk for their organization in 2026, well ahead of the economy (23 percent) and regulations (19 percent). 

When asked which key risk indicators (KRIs) they were monitoring closely into the new year, market conditions ranked first, with 33 percent of votes, followed by cyber alerts (27 percent).

Budget constraints despite rising threats

A concerning disconnect emerged in the survey: despite increasing risks and reported vulnerabilities in cross-function coordination, a full third of respondents said their organizations were reducing or keeping risk management operational budgets flat in 2026.

“Cost cutting focus is increasing our risk across the globe,” said one respondent sounding the alarm.

Others flagged a potential lack of awareness to growing intrinsic risks: “My concerns are potentially developing risk mitigation gaps due to role/employee changes and perceived cultural shifts leading to accepting more risk when it is not prudent. Employee morale is also low and can lead to apathy and lack of concentration needed to perform risk mitigation at a high level.”

For organizations that are expected to receive budget increases, the most common investments are in regulatory tracking and monitoring technology (26 percent) or data privacy and cyber defenses (23 percent).

When asked what they would improve if given a chance, cross-function coordination took the top spot, with 44 percent of the votes. 

“We are large company and have many opportunities to be even better than we are now,” said one respondent. “My thought is to create less-siloed systems and activities that would allow high-level views to see trends and allow for more in-depth review for continuous improvement.”

“I would prioritize stronger, faster visibility into external regulatory changes, especially shifts in trade policy, tariffs and cross-border rules that affect IT outsourcing,” said another. “We need a smoother way to detect these changes early, assess their impact and adjust our delivery model before clients feel the pressure.”

“Cross functional coordination is key for operating in a world where top risks are interdependent and self amplifying; where geopolitical, regulatory and technology currents shift together,” says Ciccarelli. “And yet, governance, risk and compliance integration remains a major execution gap.”

 found that only 4 percent of governance professionals say their GRC and financial systems are fully integrated, which can keep risk data trapped in silos. “In an ideal future state, GRC systems should flow in a single stream so that one trigger, whether a cyber alert, a tariff change or an AI policy shift, automatically informs the others,” notes Schindlinger.

Business risk grew double digits in 2025, according to GCs

Public boards face a complex regulatory landscape, intensified by public scrutiny. Emerging technologies like AI, coupled with rising expectations for transparency and ethical tech use, are raising the stakes for governance. The pressure is on: gaps in oversight can lead to costly legal penalties and lasting reputational damage. Strong, proactive governance isn’t optional; it’s essential.

Keeping ahead of regulations and obligations: A 2026 guide for public sector boards

," provides a sharp look at the shifting regulatory demands shaping governance. Developed with insights from public sector leaders, this report highlights the most pressing compliance areas that will shape governance practices in the coming year, emphasizing a strategic shift toward resilient and forward-thinking approaches.

Five key regulatory fronts for public sector boards

As we approach 2026, this guide identifies five pivotal areas where public boards must focus their attention to ensure effective governance and compliance.

The push for greater transparency in public meetings is accelerating. Many states now require 

 and archived recordings, with some already having these laws in place. This trend demands both the necessary technical infrastructure and clear policies to ensure fair access and compliance with public record laws, reflecting a broader societal expectation for open government.

Ensuring digital and physical accessibility for all citizens is transitioning from a best practice to a growing legal imperative. Public sector entities are under increasing pressure to comply with evolving accessibility standards, particularly for online services and information. This requires a comprehensive approach to design and delivery, ensuring that public services are truly inclusive.

The threat landscape for public sector organizations is constantly expanding, making 

 non-negotiable. Boards must grapple with increasingly sophisticated cyber threats and a patchwork of federal, state and local regulations designed to protect sensitive data and critical infrastructure, underscoring the need for continuous vigilance and adaptive security frameworks.

The rapid adoption of AI across government functions introduces a new frontier of regulatory challenges. Public sector boards must navigate 

 concerning AI ethics, data privacy, bias mitigation, and accountability. Developing 

 is crucial to harnessing its benefits responsibly while safeguarding public trust.

The complexity of these evolving regulations places a significant burden on board members. Comprehensive, 

 is essential, extending beyond traditional fiduciary duties to include cybersecurity risks, AI implications and compliance best practices for effective oversight and strategic direction.

This report is a vital resource for public sector boards. It advocates for a proactive, rather than reactive, approach to compliance, urging organizations to build robust governance structures that can anticipate and respond to regulatory changes. By understanding these critical trends and implementing strategic measures, public sector entities can mitigate risks, enhance effectiveness, and maintain public confidence.

For a comprehensive understanding of these challenges and actionable strategies for your organization, 

Keeping ahead of regulations and obligations: A 2026 guide for public boards  

This article originally appeared in our December 4th edition of the Diligent Minute Newsletter. For more insights like these, delivered straight to your inbox, subscribe 

Compliance gaps widen: Are you ready to respond?

 from Diligent Institute, in partnership with Corporate Board Member, reveals a clear trend: legal, compliance, and audit leaders continue to perceive significantly heightened risk heading entering Q4 with heightened risk perceptions - and they are mobilizing accordingly. 

Business risk now stands at 7.9 out of 10

, up from 5.8 in Q1, a 36% increase in just six months. Leaders point to the combined impact of regulatory complexity, tariff volatility, geopolitical tensions, and persistent inflation as the primary forces destabilizing today’s operating environment.

“The convergence of these factors keeps risk levels high and requires businesses to invest more in 

proactive compliance, risk management, scenario planning and governance frameworks

,” says respondent Taras Lytovchenko, Chief Legal and Compliance Officer at Trinitex.

Shifting risk landscape: From regulatory exposure to tariff and cross‑border volatility

Regulatory risk remains a top concern, but its share dropped by 10 percentage points since our Q2 2025 reporting, suggesting growing confidence in internal regulatory frameworks and monitoring capabilities. As compliance programs mature, attention is moving toward more specific operational threats: tariff changes, global volatility, and cross-border policy shifts that can outpace traditional response mechanisms.

Accordingly, legal and compliance teams report reinforcing nearly every dimension of their programs — with a strong focus on technology (including AI) for monitoring and regulatory tracking, alongside expanded training and policy reviews. One area that isn’t gaining traction: whistleblower and reporting channels, which most GCs do not expect to prioritize in 2026.

Geopolitical risk shows a clear divide in response. Nearly 27% of organizations have expanded their monitoring of cross-border trade or engaged external advisors to navigate international regulatory complexity; proactive moves that position them to adapt as conditions change.

Yet, 43% report no change in compliance priorities, even though geopolitical conflicts rank as the third-most pressing risk today. This disconnect should concern directors and executives alike. True resilience requires active reassessment of policies and controls as the environment evolves, not a wait-and-see approach.

AI integration: Widespread planning, uneven confidence

Many teams have started building AI governance guardrails, but confidence remains low. Only 29% report a comprehensive plan in place, while 38% are actively drafting guidelines and 44% say their policies need refinement. Just 11% feel very confident in their current approach. The pace of AI adoption is introducing novel risks, making transparency and trust essential in deployment and oversight.

Board action plan: 4 steps to close compliance gaps now

Double down on scenario planning for tariff and trade disruptions; ensure supply chain, pricing, and market-entry contingencies are current and tested.

Strengthen regulatory monitoring with technology-enabled workflows, and pair them with periodic policy reviews and targeted training to maintain agility.

Address the geopolitics posture gap by mandating regular reviews of regional exposure, even if current operations feel insulated.

Prioritize AI governance through clear usage policies, risk assessments, human oversight protocols, and transparent reporting. Educate the board so oversight keeps pace with adoption.

The headline is clear: Risk is rising, but so is the capacity to respond. The organizations that win in this environment will be those that turn maturing compliance programs into a forward-looking risk posture, board-level fluency on emerging technologies, and maintain consistent operational readiness.

 for more insights on emerging threats and benchmarks to guide your next move. 

Diligent

Blog

Business risk grew double digits in 2025, according to GCs

Keeping ahead of regulations and obligations: A 2026 guide for public boards

Your Data Matters