AI in 2026: Why enterprises can’t afford to wait for regulatory certainty

The recent executive order issued by the White House aimed at establishing a single national framework for artificial intelligence has reignited debate about how — and how quickly — AI should be governed in the United States.

The order directs the federal government to push back on what it characterizes as overly burdensome state-level AI regulation, while signaling Congress’s eventual role in creating a comprehensive federal framework.

For enterprise leaders, however, the most important takeaway is not what the order may eventually become, but what it does not do. It does not eliminate existing state laws. It does not create immediate clarity. And it does not reduce the responsibility organizations already have to govern AI responsibly.

If anything, it reinforces a reality CIOs have been living with for years: AI policy development cannot wait for regulatory certainty. By the time formal rules are finalized — after litigation, political debate and enforcement challenges — organizations will be expected to have been compliant all along.

That reality makes 2026 less about reacting to new rules and more about reinforcing the foundations enterprises should already have in place.

Nothing about AI policy is new — only the urgency

Enterprises that have been paying attention know this moment did not arrive overnight. Long before generative AI became mainstream, organizations were dealing with data privacy, algorithmic bias, security controls and third-party risk. AI simply accelerates the consequences of getting those fundamentals wrong.

Businesses that succeed in periods of disruption are those that think like technology companies, and are intentional, adaptable and grounded in strong governance structures. That mindset remains essential as AI continues to evolve at a pace few regulatory bodies can match.

Similarly, enterprises that struggle with AI adoption often aren’t lacking ambition; they’re lacking readiness. Without clean data, strong controls and clear ownership, even the most powerful AI tools create more risk than value. The executive order amplifies these realities.

Why 2026 will feel more confusing, not less

In the short term, enterprises can expect more ambiguity around AI rules than clarity.

State AI laws remain on the books unless and until courts strike them down. Some may never be enforced. Others may quietly shape enforcement expectations even without formal penalties. Meanwhile, federal guidance will take time to materialize, and even longer to stabilize.

At the same time, AI innovation is unlikely to slow down. Hyperscalers and platform providers will continue to release new capabilities, often faster than enterprises can thoroughly assess their implications. In many cases, controls and safeguards arrive after features, shifting more responsibility onto customers to manage risk internally.

For CIOs, this creates a difficult but unavoidable tension: balancing speed-to-value with governance in an environment where the rules are still being written.

What will likely change first: vendors, pricing and pace

While regulation remains uncertain, several near-term impacts are easier to anticipate.

First, hyperscalers are likely to accelerate innovation. With fewer immediate regulatory constraints, speed to market may take precedence, leaving enterprises to adapt more quickly to changes in tools like copilots, embedded agents and automated workflows.

Second, cost pressures are coming. Increased investment in AI infrastructure, legal defenses and compliance capabilities will not be absorbed indefinitely. Enterprises should expect pricing models to evolve — and in some cases, increase — particularly as AI capabilities become more deeply embedded in core platforms.

Third, consolidation across the AI ecosystem is expected to accelerate. Large providers can absorb legal uncertainty. Smaller vendors often cannot. For enterprises, that means reassessing vendor viability, exit strategies and long-term dependencies sooner rather than later.

The case for building a defensible AI baseline now

The absence of clear regulation does not excuse inaction. In fact, it makes intentionality more critical.

A defensible AI posture begins with a baseline framework, one rooted in principles that your organization can stand behind, regardless of how regulations evolve. That framework should assume AI will become ubiquitous, not exceptional, over the next three to five years.

We’ve outlined this approach previously when discussing enterprise AI policies: effective governance is not about predicting every future rule. It’s about documenting intent, defining accountability and establishing controls that reflect your organization’s risk tolerance.

When regulators eventually arrive, organizations with documented intent, consistent practices and transparent decision-making are far better positioned to adapt quickly.

Practical questions CIOs should be asking now

Future-proofing AI governance requires asking difficult, operational questions today:

• Training and awareness: How often do AI-related training programs need to be updated if tools and capabilities change quarterly instead of annually?
• Data protections: What controls are in place to prevent enterprise data from being used to train external models — intentionally or otherwise?
• Vendor exposure: Which AI vendors are mission-critical? Which are experimental? How often should each be reassessed?
• Fourth-party risk: Do you understand not just what your vendors do, but what their underlying technologies and vendor partners collect, process and retain?
• Contractual flexibility: Are your contractual terms overly specific to today’s regulatory language, or flexible enough to adapt to future requirements?

These questions become even more pressing as AI capabilities become increasingly embedded in everyday workflows — from resume screening to customer engagement to decision support.

A mindset shift CIOs can’t avoid

Perhaps the most important change required in 2026 is conceptual. The assumption should be that nearly all software — and eventually most devices — will incorporate AI in some form. Risk assessments, policies and controls must reflect that reality.

This shift mirrors earlier transitions in cybersecurity and privacy. Organizations that waited for perfect clarity found themselves perpetually behind. Those who built adaptable frameworks gained resilience.

The role of transparency and intent

Ultimately, proper AI governance is about scaling AI use in a way that aligns with your organization’s values, industry obligations and risk appetite. Enterprises that document their intent, communicate transparently and align actions with stated principles create a defensible position.

The recent executive order may shape the regulatory path in the near future, but it doesn’t absolve enterprises of responsible AI use across the business. If anything, it underscores the importance of acting now, while there’s still time to shape your organization’s AI future deliberately rather than reactively.

In 2026, the most resilient enterprises will be those that built stability amid uncertainty and were prepared to pivot when the rules finally arrived.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?