Global Compliance Weekly: Key Developments in Late August 2025
A roundup of the most significant compliance developments from the final week of August 2025
Bottom Line Up Front
The final week of August 2025 has delivered several pivotal compliance developments that will reshape regulatory landscapes globally. The EU AI Act's General-Purpose AI obligations took effect August 2nd, marking a watershed moment for AI regulation. Meanwhile, major SEC enforcement actions continue under the new administration, and cross-border procurement restrictions signal increasing trade compliance complexities. Organizations must act swiftly to address these evolving requirements.
Lovable
EU AI Act: General-Purpose AI Regulations Now in Force
The Game Changer
August 2, 2025 marked a critical deadline under the EU AI Act as obligations for providers of general-purpose AI (GPAI) models officially entered into force. This represents the most significant AI regulatory milestone to date for global technology companies.
Compliance Hub
What Changed
The European Commission and EU AI Office released final Guidelines for providers of general-purpose AI models and completed a General-Purpose AI Code of Practice, with the Commission confirming the Code's formal approval on August 1st. These frameworks provide:
- Interpretative guidance for understanding GPAI model provider obligations
- Specific compliance measures companies can implement to demonstrate regulatory adherence
- Clear regulatory pathways for AI deployment in EU markets
Compliance Hub
Business Impact
Organizations deploying AI models in EU markets must now ensure compliance with these new frameworks or risk significant penalties. The regulations particularly affect companies with AI models that have widespread applications across multiple use cases.
EU-China Trade Compliance: Medical Device Procurement Restrictions
Historic Enforcement Action
For the first time, the European Commission completed an investigation under the International Procurement Instrument (IPI) and implemented measures to limit the participation of economic operators from non-EU countries – specifically China – in the EU public procurement market.
The New Rules
The EU responded with Implementing Regulation (EU) 2025/1197 that requires contracting authorities/entities in all EU member states to exclude Chinese suppliers – and to a certain extent products manufactured in China – from larger public procurement contracts for medical devices.
Strategic Implications
This action signals:
- Escalating trade tensions between EU and China
- Supply chain diversification requirements for EU healthcare organizations
- New due diligence obligations for procurement teams
- Potential reciprocal actions from other jurisdictions
SEC Enforcement Trends Under New Leadership
Enforcement Strategy Shift
Under Chairman Atkins, the SEC filed 31 enforcement actions in Q2 2025, with a strong fraud focus and continued scrutiny of advisers and broker-dealers. The new administration has implemented several key changes:
AIRiskAssess TeamNotable Developments
- Crypto-friendly approach: The SEC announced the formation of the Crypto Task Force on January 21, 2025, led by Commissioner Hester Pierce, dedicated to developing a comprehensive regulatory framework for crypto assets
- Case dismissals: Several enforcement actions from the previous administration were dismissed as part of regulatory reform efforts
- Focus refinement: Every case filed in district court alleged fraud, suggesting the SEC has refocused its limited enforcement resources on fraud cases involving more egregious conduct
Key Enforcement Areas
- Investment adviser compliance - Fee disclosures and conflict of interest violations
- Broker-dealer SAR filing failures - Continued emphasis on suspicious activity reporting
- Fraud-focused actions - Moving away from technical violations toward serious misconduct
Cybersecurity Compliance Intensifies
Regulatory Acceleration
The compliance landscape in 2025 is marked by aggressive regulatory momentum and cross-border enforcement alignments, with expanded reporting windows and stricter definitions of "material breach".
Healthcare Under Siege
Cyberattacks on the healthcare sector surged 86% globally in 2024, with patient data exposure and ransomware incidents driving the majority of compliance violations. New 2025 regulations demand:
- Airtight data governance protocols
- Zero-trust security frameworks
- Proactive breach response capabilities
- Real-time incident reporting
Cross-Sector Impact
The SEC now requires publicly traded companies to report cyber incidents within four business days, while HHS has refined its HIPAA enforcement playbook to include explicit criteria for ransomware breach thresholds.
David StaussUK Education Compliance Overhaul
New BCA Requirements
Starting in September 2025, UK universities and colleges will face significantly higher compliance standards under the updated UK BCA rules 2025.
Stricter Thresholds
The revised requirements include:
- Visa refusal rate: Must maintain below 5% (previously 10%)
- Enrollment rate: Minimum 95% of issued CAS must result in actual enrollment
- Course completion rate: At least 90% completion required (up from 85%)
Enforcement Mechanisms
The white paper calls for a public-facing Red-Amber-Green (RAG) banding system to clearly indicate each sponsor's compliance status and boost transparency.
Breach Notification TrackerCross-Border Legal Jurisdiction Challenges
Internet Governance Complexity
Via the Internet, companies can publish information, offer contracts, deliver virtual items, and send payments to any country in the world, raising questions about what law governs transactions and activities involving businesses in multiple jurisdictions.
Practical Implications
Organizations operating globally must navigate:
- Multi-jurisdictional compliance obligations
- Conflicting regulatory requirements
- Data localization mandates
- Cross-border enforcement coordination
AI Risk Assessment
Looking Ahead: Compliance Priorities for September 2025
Immediate Action Items
- AI Compliance Audit - Review AI deployments against new EU requirements
- Supply Chain Assessment - Evaluate medical device procurement processes for EU operations
- Cybersecurity Framework Review - Ensure incident response capabilities meet new timelines
- Cross-Border Operations Analysis - Map jurisdictional compliance obligations
Strategic Considerations
- Technology integration with compliance monitoring systems
- Enhanced due diligence for international business relationships
- Regulatory change management processes
- Cross-functional compliance team development
Key Takeaway
The convergence of AI regulation, trade restrictions, cybersecurity mandates, and enforcement evolution creates an unprecedented compliance complexity that demands proactive, technology-enabled approaches. Organizations that adapt quickly to these regulatory shifts will gain competitive advantages, while those that lag risk significant penalties and operational disruptions.
For ongoing compliance updates and analysis, subscribe to our weekly compliance intelligence briefings.
This analysis is based on developments through August 23, 2025, and reflects publicly available regulatory information. Organizations should consult with qualified legal counsel for specific compliance guidance.
