What a decade of tech tells us about future regulation

Over the past decade, the technology landscape has been shaped by waves of innovation, regulatory intervention, and shifting boardroom priorities. Many of these trends have been the subject of annual predictions.

With it being that time of year again when the market analysts, major consultancies, and publishers look ahead to what is coming next, I have analysed a dataset of annual predictions from 2016 to 2026 – produced or published by organisations like Gartner, McKinsey, the BBC and WIRED. I found that certain themes have endured, some have evolved, and some have faded into the background. For UK and EU businesses, the lessons are clear: the interplay between technology and regulation is more dynamic – and more consequential – than ever.

The foundations: cloud, cybersecurity, and data

Some trends have proved to be the bedrock of digital transformation during the last 10 years. Cloud computing, cybersecurity and data analytics have been present in almost every year of the dataset, underpinning everything from artificial intelligence (AI) to fintech. Their persistence is no accident: as organisations have migrated to the cloud and embraced digital-first strategies, regulators have responded with heightened expectations around operational resilience, privacy, and market power.

Cloud is no longer just about scalability – it is about concentration risk, multi-cloud strategies, and the ability to exit or recover from severe incidents. Cybersecurity, once a technical concern, is now a board-level issue, with regulatory notification thresholds and “secure by design” principles embedded in everything from AI to tokenisation projects. Data analytics has moved from “big data” to “hyper-personalisation”, raising the bar for privacy, fairness, and explainability.

Disruptive arcs: AI and blockchain/Web3/crypto

Two themes stand out for their acceleration and transformation: AI and blockchain/crypto.

AI’s journey is striking. Early years focused on analytics and machine learning, but the narrative has shifted decisively towards generative and agentic AI. The arrival of the EU AI Act marks a watershed moment: prohibitions and AI literacy obligations are already in force, as are requirements relating to general-purpose AI (GPAI) models, with broader application dates – including in relation to ‘high-risk’ AI systems – looming. UK regulators, meanwhile, are taking a “pro-innovation” approach, emphasising accountability, model risk management, and outcomes testing. For businesses, this means mapping roles across the AI value chain, preparing technical documentation, and updating contracts to reflect new responsibilities for data, IP, and transparency.

Blockchain and crypto have followed a similar arc – from experimentation to regulated markets. The EU’s MiCA regime is now live, with stablecoin rules in force and the wider cryptoasset service provider regime rolling out. Under MiCA, crypto firms must implement strict safeguarding requirements and effect transparent reporting to regulators, fundamentally changing how digital assets are managed and traded. The UK is close behind, with draft legislation and FCA consultations on stablecoins and custody. The practical challenges for firms include to determine whether their activities trigger new permissions, design safeguarding and custody models, and ensure operational resilience in a rapidly evolving regulatory environment.

Fintech integration: from novelty to infrastructure

Open banking and embedded finance have matured from innovative concepts to essential infrastructure. The intersection with the UK’s consumer duty regime is particularly significant: firms are now responsible for outcomes even when using third parties or novel channels. The FCA’s focus on fair value, consumer understanding and third-party governance means that product governance and value assessments must be refreshed and rigorously tested.

What didn’t go mainstream

Not every predicted trend has become a fixture. The dataset shows spikes for the consumer metaverse, but these have not sustained prominence. It is possible that the real enterprise value in this area lies in targeted augmented or virtual reality deployments – training, therapy, industrial design – rather than mass-market reinvention.

Actions for businesses

The last 10 years have shown that while some trends come and go, the interplay between technology and regulation is here to stay. Successful businesses will be those who anticipate regulatory shifts, embed compliance into strategy, and remain agile as the next wave of innovation arrives.