7 trends shaping the GC and CoSec agenda in 2027

There's a version of the GC and CoSec role that still exists on paper: The GC as the organization's chief legal advisor, the CoSec as the person who makes the board cycle run. But ask anyone actually doing these jobs as 2026 gives way to 2027, and you'll get a different picture:

• 82% of directors are using generative AI for board work, but fewer than one in ten have a formal board AI policy in place. Closing that gap is now a GC and CoSec challenge
• GCs report their risk coordination workload has grown significantly, yet only 19% have fully integrated GRC systems
• Entity compliance mandates are expanding faster than the teams managing them, with subsidiaries becoming an underrated regulatory liability

The GC Risk Index Q2 2026 puts actual numbers on this: The risk environment for general counsel hit 7 out of 10 on the severity scale, up from 5.8 twelve months earlier. It's fair to say we have a new baseline for what the role is. As we look ahead to 2027, here are seven trends for GCs and CoSecs to keep an eye on.

1. AI in the boardroom has moved from experiment to governance problem

Picture a director the evening before a board meeting: 400 pages of materials, 45 minutes to prepare. They paste the executive summary into ChatGPT or Claude and ask it to summarize the risks. Most governance teams don't know this is happening. Almost none have a policy that addresses it.

The Diligent Institute's Director Confidence Index found 82% of U.S. public company directors used generative AI for board work in the first half of the year. Only 6% reported a formal policy specific to the board.

And, 49% said they use publicly available or consumer-facing versions of AI tools to do this work. When sensitive board materials leave the governance perimeter through a consumer tool, there are no permissions, no citations and no record. As courts and regulators ask what constitutes reasonable Duty of Care inquiry, that absence matters.

That’s why enterprise-grade AI tools are so vital. GovernAI is built specifically for governed, auditable AI use at board level, working within each director's existing permissions and logging every query as part of the governance record.

• For GCs: Take the lead on AI governance: Framing privilege risk, discoverability and fiduciary duty for directors is legal work, not an IT problem.
• For CoSecs: Start by finding out which tools directors are actually using, so you can build governance policy and a defensible record before it becomes an issue.

2. The GC's mandate has outgrown its infrastructure

Nearly half of general counsel now spend 21 to 40% of their time on enterprise-wide risk and compliance coordination, and 67% say that workload has grown. The mandate has expanded well beyond legal advice into board language, compliance strategy and decisions that sit well outside traditional legal training.

The KPMG 2026 Global GC Outlook, drawing on 468 senior legal leaders across 28 jurisdictions, found 75% of GCs are now regularly asked to advise on non-legal business issues, yet only 19% have fully integrated GRC systems to support it. That gap is where the function is most exposed. The role works only when the orchestra is playing from the same score: A patchwork of disconnected tools never is.

• For GCs: Map where your risk reporting relies on manual consolidation. That's where your governance exposure is highest, and where better infrastructure pays for itself first.
• For CoSecs: Position yourself as the person who can solve the GC's infrastructure problem. The CoSec who can deliver more integrated board reporting becomes indispensable as that coordination mandate grows.

3. Subsidiary governance is becoming a strategic liability

Growth adds complexity to even the best-run entity portfolio. Every acquisition, restructure or market entry adds obligations that are manageable in a vacuum, but unmanageable at scale. Diligent's Global State of Legal Entity Compliance 2026 report surveyed over 300 senior practitioners across 38 jurisdictions. The headlines: Compliance mandates are expanding faster than the teams managing them, manual processes still dominate and boards regularly underestimate the liability inside their own corporate structure.

In 2027, that liability will be harder to ignore. Sanctions screening, beneficial ownership transparency and frameworks including CSDDD and the EU AI Act can scale penalties to group level based on subsidiary conduct.

A GC without visibility into the entity estate can't manage what's in it.

Safran, a global aerospace and defense company managing several hundred subsidiaries, faced the same problem. Here's how they solved it.

• For GCs: Run an entity audit focused on the highest regulatory exposure. That's the visibility that turns entity governance from a reactive scramble into a strategic asset.
• For CoSecs: Map your entity estate against your current compliance calendar process. If it relies on manual tracking across spreadsheets, that's your biggest efficiency opportunity and your biggest liability.

4. Regulatory convergence is rewriting the compliance calendar

Regulations may carry different names, deadlines and jurisdictional boundaries, but they are converging around the same expectations: Stronger cyber resilience, responsible use of AI, clearer accountability and better evidence of oversight. This affects organizations of all sizes and footprints. Even leaders focused primarily on one market may find that several requirements touch the same teams, controls, third parties and governance processes.

The specific pressures vary by region:

• US: SEC cyber disclosure rules are in force and state-level AI legislation is advancing in Colorado, Illinois and beyond.
• Europe: DORA is live for financial services, NIS2 has extended cybersecurity obligations across a wider range of sectors, the EU AI Act's tiered requirements are landing in waves and CSDDD due diligence obligations are crystallizing across corporate group structures.
• APAC: MAS, APRA CPS 230 and a wave of national AI frameworks are adding obligations for organizations with regional footprints.

For GCs and CoSecs, there’s growing overlap between obligations that organizations still manage separately. The same policy, risk assessment, control or piece of evidence may be needed by several teams for several different requirements. When each regulation is treated as a standalone program, work is duplicated and gaps are harder to see.

A more connected approach maps common requirements once, coordinates ownership and gives leadership a clearer view of compliance across the business.

• For GCs: Identify where different regulatory obligations rely on the same controls, data and evidence. This is the starting point for reducing duplication and building a more coherent compliance approach.
• For CoSecs: Map which emerging requirements could affect board or committee oversight, charters and reporting. That will help the board respond consistently as expectations evolve.

5. The board's AI literacy gap is a GC problem

In almost every conversation I'm having with boards right now, the appetite to get AI oversight right is there. The expertise to do it confidently is still catching up. The 2026 What Directors Think report found only 8% of US boards rate themselves as having strong AI expertise, and 40% name AI as the single most challenging issue to oversee. Harvard Law's Forum on Corporate Governance has placed AI squarely inside the Caremark monitoring obligation, with the UK FRC and ASIC signaling comparable expectations around AI oversight accountability.

Board AI literacy sits squarely inside the GC's remit. That means translating AI risk into fiduciary language, identifying where AI use creates disclosure obligations and ensuring the board can demonstrate meaningful oversight. GovernAI brings that regulatory context into board preparation, giving directors cited, structured perspective on AI risk inside the environment they already use.

• For GCs: Put AI risk on a committee agenda with the right framing. Boards want to be led on this, and the GC is the right person to do it.
• For CoSecs: Start minuting AI oversight discussions explicitly and update committee charters to reflect them. It's a low-effort way to build the governance record proxy advisors are beginning to look for.

6. Data fragmentation at the board level is undermining governance quality

53% of directors still don't receive real-time data between meetings, according to What Directors Think 2026. Most board packs are manually assembled snapshots, stitched together from risk reports, finance data and compliance updates that don't share a common source of truth. By the time materials reach the boardroom, they're already a month out of date.

• For GCs: Audit what the board actually receives against what exists in your systems. The gaps you find are the ones most likely to matter when a decision gets examined.
• For CoSecs: Identify the highest-friction steps in your board pack assembly. That's the fastest route to a reporting process that doesn't rely on heroics every cycle.

7. Lean teams, expanding mandates mean something has to give

GRC headcount hasn't kept pace with GRC scope. The GC Risk Index Q2 2026 shows 67% of GCs have seen their risk coordination workload increase. Only 52% report significant AI efficiency improvements. Those gains are concentrated among teams that have deliberately integrated AI into their workflows, rather than simply giving employees access to  new tools.

For CoSecs, the same dynamic plays out in board administration: More directors, more committees, more materials and more regulatory scrutiny, with teams that haven't grown to match. Headcount growth isn't on the table, which makes the case for better infrastructure straightforward.

• For GCs: Identify the highest-volume, lowest-judgment tasks your team handles each cycle and target them for AI automation. That's the fastest way to reclaim time for work that actually requires you.
• For CoSecs: Identify which parts of your board cycle, preparation, minutes drafting, action tracking and entity maintenance, still run on manual effort. Those are your automation targets.

What to take into 2027

Getting ahead of 2027 comes down to infrastructure, not headcount

We've been tracking these pressures at the Diligent Institute throughout 2026. The pattern is consistent: The GCs and CoSecs who navigate the year ahead well will be the ones who've matched their infrastructure to what the role now demands.

How Diligent helps GCs and CoSecs in 2027

With an 8-for-8 record as a Leader across every major GRC analyst evaluation, including Forrester, Gartner, IDC, Verdantix and Chartis, Diligent is the platform governance teams trust to keep pace with what 2027 demands. For GCs and CoSecs, that means a function that keeps pace with the regulatory environment, not one that's always catching up to it:

• Secure AI for directors: GovernAI gives directors instant, cited answers straight from your board materials, so they stop reaching for ungoverned tools and you stop fielding the same questions before every meeting. Every query is logged automatically, giving you a complete, auditable record of how directors engaged with materials.
• Integrated board governance: Diligent Boards centralizes board materials, approvals, minutes and the full governance record in one secure platform, so CoSecs spend less time assembling and more time advising.
• Entity and subsidiary management: Diligent Entities keeps every subsidiary's compliance calendar, filing status and director register current and in one place, so a missed obligation in a market you barely operate in doesn't become a board-level problem.

See Diligent's GC and CoSec platform in action.