Our Team

Our Awards

Social Impact

Newsroom

Locations

Careers

About Us

Contact

Do Not Sell my Personal Information

Cookie Preferences

Humanity-in-the-Loop

Industries

Insights

Investor Relations

TELUS International (Cda) Inc. and its subsidiaries use TELUS Digital for branding purposes.

Privacy Shield Framework

Privacy Policy

Modern Slavery Act Transparency Statement

Solutions

Subscribe to Newsletter

Technology Partners

Website User Terms

Icon facebook

Icon youtube

Icon linkedin

Technology

Banking, Financial Services & Insurance

Automotive

Healthcare

Communications & Media

Games

Retail & Ecommerce

Travel & Hospitality

infobrief

Guide

Resource Type Article

Article

case-studies thumb

Case Study

Preventing fraud for a global tech company in the travel and hospitality space image with fern in background

TI resource case 900x510

Video

whitepapers thumb

Research & Reports

brochures thumb

Brochure

Podcast Type Image

Podcast

Mockup image of TELUS Digital's Maturity Assessment Financial Crime and Compliance

Maturity Assessment Financial Crime and Compliance Asset

Mockup image displaying TELUS Digital's Maturity Assessment: Financial crime and compliance

Maturity Assessment: Financial crime and compliance - Hero

Financial crime and compliance maturity assessment

Next-generation KPIs: Redefining customer experience measurement - Hero

Customer experience (CX) is evolving — and your measurement strategy should too. Discover how next-generation KPIs can offer deeper insight into CX performance, from customer effort and journey satisfaction to agent engagement and digital maturity.

Next-generation KPIs: Redefining customer experience measurement

1:17 - How is the regulatory landscape around AI shifting?

3:03 - What's the difference between AI regulation, compliance and governance?

4:33 - Why is global AI regulation so fragmented?

5:25 - How should companies approach different regulations across borders?

6:02 - Does the EU AI Act apply to companies outside Europe?

7:33 - What are the penalties for EU AI Act violations?

9:04 - Should companies wait for regulatory clarity before acting?

9:26 - What are the EU AI Act's transparency requirements?

11:52 - How are bad actors exploiting AI?

12:38 - Why are regulators playing checkers while fraudsters play chess?

14:47 - Is AI compliance keeping pace with AI-powered fraud?

16:53 - How can you assess your fraud prevention program?

17:22 - What's at stake if companies don't keep up with AI compliance?

20:21 - Can AI compliance become a competitive advantage?

21:40 - Why does AI compliance matter to CX leaders specifically?

22:50 - What's the tension between innovation and responsible AI?

24:11 - Who should own AI governance in an organization?

25:06 - What does cross-functional AI governance look like?

27:43 - What's the first action CX leaders should take?

29:23 - How do you conduct an AI inventory?

[00:00:00] Robert Zirk: ​The era of "light touch" AI oversight is over.

[00:00:04] Jeff Brown: We can't treat it as an optional compliance matter or an aspirational goal. You will now be facing serious consequences if you don't comply.

[00:00:13] Robert Zirk: And at the same time that lawmakers are codifying regulatory frameworks, the threats are multiplying at an unprecedented rate.

[00:00:21] Natalia Fritzen: The competitive edge in AI will soon no longer exclusively be who launches what first, but who launches what in the more responsible manner as well.

[00:00:33] Robert Zirk: AI compliance will affect your brand in 2026. As a CX leader, are you ready?

[00:00:39] Today on Questions for now, I'm joined by Jeff Brown, general counsel and global privacy officer at TELUS Digital, and Natália Fritzen, head of AI compliance at Sumsub, as we ask: What are the AI compliance trends leaders can't ignore in 2026?

[00:01:06] Welcome to Questions for now, a podcast from TELUS Digital where we ask today's big questions in digital customer experience. I'm Robert Zirk.

[00:01:17] Robert Zirk: If you're a customer experience leader, AI feels like it's everywhere. It's analyzing customer sentiment. It's assisting agents by offering up real-time recommendations. And it's powering chatbots. By now, AI is permeating virtually every aspect of CX.

[00:01:35] But here's what might not be on your radar: the regulatory landscape around AI is shifting — and it directly impacts every AI-powered customer interaction.

[00:01:47] Jeff Brown: For years, it's been a relatively permissive environment for AI development: voluntary guidelines, soft frameworks, industry self-regulation...

[00:01:56] Robert Zirk: That's Jeff Brown. He's general counsel and global privacy officer at TELUS Digital, where he also leads the company's AI governance committee, a cross-functional team that oversees the operationalization of responsible AI at scale.

[00:02:11] He pointed out a fundamental shift in the regulatory environment for AI in the United States.

[00:02:16] Jeff Brown: This isn't sign on to a voluntary directive anymore and say, "we're gonna be responsible in the way we use AI." We can't treat it as an optional compliance matter or an aspirational goal. You will now be facing serious consequences if you don't comply.

[00:02:31] Robert Zirk: Across borders and jurisdictions, regulations on AI are being put into place and enforced.

[00:02:38] Jeff Brown: With the EU AI Act now fully enforceable, we've got an act here in Colorado where I live, the AI Act, that's fully enforceable. China's regulations have now been published. We waited for those for a while. India just published regulations as well, and more and more jurisdictions are implementing binding rules. So we've really entered into the era of hard law.

[00:02:58] Robert Zirk: Meaning an era of legal requirements with serious consequences.

[00:03:03] Before we dive deeper, I asked Jeff to clarify the difference between AI regulation, compliance and governance.

[00:03:11] Jeff Brown: AI regulations are the laws and binding rules that governments create. A great example is the EU AI Act. AI compliance is meeting those legal requirements, but governance is really broader. It's the whole set of internal frameworks, policies, practices that companies establish just to make sure AI is developed and deployed responsibly, even beyond what's legally required.

[00:03:33] So I think of it as compliance is really the floor. You have to stay outta trouble. You have to keep the data protection authorities and the AI authorities away from your door. Governance is the ceiling or the aspiration. I don't know that you ever hit it completely, but that's the Sistine Chapel ceiling we're looking at when we're trying to think about AI and how to control it but also use it.

[00:03:54] Robert Zirk: In early 2025, TELUS Digital commissioned a global survey conducted by Ryan Strategic Advisory that posed questions to more than 800 enterprise CX decision-makers across North America, Europe and Asia-Pacific. The findings, published in TELUS Digital's Safety in Numbers report, revealed that 44% cited compliance with government regulations and industry standards as their top concern in maintaining safe and secure digital environments.

[00:04:24] And according to Gartner, 70% of organizations consider regulatory compliance a major challenge in implementing GenAI tools.

[00:04:33] So we've established that the regulatory environment has shifted from voluntary to mandatory, but here's where it gets complicated: there's no single set of rules. Instead, companies face what Jeff describes as a fragmented patchwork of regulations.

[00:04:50] Imagine you're operating an AI-powered customer service platform globally. In Europe, you're dealing with the EU AI Act's risk classifications and conformity assessments. In the United States, on top of federal regulations, you're navigating state-by-state laws — for example, Colorado has algorithmic discrimination rules, while California enacted a series of new regulations in late 2025, including the Transparency in Frontier Artificial Intelligence Act. And in China, you're also meeting different definitions and risk thresholds.

[00:05:25] Jeff Brown: It is genuinely complex. Cross a border and you've got a whole new set of rules, but you've just got the one AI system, so what do you do? The way we've attacked it is let's go to the highest standard. And we'll take the chance that we may have a toe foul in some other jurisdiction, but if we're picking, for example, the EU AI Act, it's the toughest. So let's do that, but let's do it everywhere.

[00:05:48] Robert Zirk: Natália Fritzen is the head of AI compliance at Sumsub, a full-cycle verification platform enabling scalable compliance from identity and business verification to fraud prevention and ongoing monitoring.

[00:06:02] She envisions many companies will adopt a similar approach to what Jeff described — tailoring governance to the most stringent regulations — and noted that some regulations can have an effect on your business regardless of whether or not you have a physical presence there.

[00:06:17] Natalia Fritzen: The EU AI Act, even though it carries the name EU in its title, it has a wide scope of applicability and it is a regulation with an extraterritorial scope, right? I believe what it says is that if you are, let's say, an AI developer in Canada, but the AI system that you manufacture has an effect on the residents in the European Union, that AI system should abide by the stipulations of the EU AI Act.

[00:06:45] Robert Zirk: Jeff mentioned earlier that TELUS Digital's approach is to build to the highest standard — essentially, if you comply with the EU AI Act, you'll likely be compliant everywhere else. But he also acknowledges that any sound strategy requires nuance.

[00:07:01] Jeff Brown: I was a little cavalier and said, "Listen, just go to the toughest law and do that one, and you'll be fine everywhere."

[00:07:07] But what's the reality of the situation? And I think, if you did that, it might cut off some opportunities, frankly, for development.

[00:07:13] I would say, sure, build to the highest standard. Be aspirational. But smart companies will create modular governance frameworks that can flex really based on the jurisdiction, while maintaining those core principles around transparency, explainability. So it's really about finding the balance between global consistency and local compliance.

[00:07:33] Robert Zirk: The EU AI Act lists potential fines of up to 35 million Euros, or 7% of global annual revenue, for serious violations. But, as companies look to ensure their compliance, Natália pointed out that the act's implementation timeline is uneven. Some sections are already being enforced, while the enforcement timelines for other sections remain unclear.

[00:07:57] Natalia Fritzen: Provisions relating to AI literacy or prohibited AI practices or general purpose AI models? Yes, those are enforced since the beginning of this year, but what I believe should be the heaviest of the regulatory burdens imposed by the act, meaning the regulatory requirements applicable to providers of high-risk AI systems, those requirements should kick in only in August 2026.

[00:08:25] But currently, the EU AI Act is going through a potential revamp. The European Commission presented a omnibus package in which they propose a postponing of the act entering into force, which is conditioned to when we are going to have standards, guidelines, so on and so forth to help providers figure out the act.

[00:08:48] So what the European Commission is saying: "Yeah, we're not going to enforce it until we have this guidance." But at the same time, it says that if we don't have this guidance until December of 2027, then it will become enforceable, the act. So right now, this is, in my opinion, the most confusing and the biggest challenge.

[00:09:04] Robert Zirk: But uncertainties like these aren't reasons for companies to put off the work that needs to be done in AI governance.

[00:09:11] Natalia Fritzen: I believe companies should work under the assumption that it'll be eventually enforced. So this is not for companies to give up on their AI compliance frameworks and they should work towards that, but there is a legal uncertainty there that is not negligible.

[00:09:26] Robert Zirk: One of the most talked about aspects of the EU AI Act is its transparency requirements for AI-generated content.

[00:09:34] This has implications far beyond fraud prevention. It affects every customer interaction where AI is involved.

[00:09:41] Natalia Fritzen: The transparency requirements prescribed by the EU AI Act under Article 50 are meant basically to ensure some type of transparency and traceability. The main idea being that users should know when they're dealing with an AI system and when a content is synthetic or manipulated. So what the act does is to impose some key obligations on the deployers and providers of such AI systems, such as the need to inform people when they are interacting with an AI system.

[00:10:13] So if an AI system is designed to interact directly with natural people, these people should be informed about it in most cases. Same when, you are disseminating a content that is AI generated, you should disclose that. For providers who need to input watermarks into the AI-generated content of their systems, how those watermarks should be operationalized, we don't know that yet.

[00:10:37] The EU AI Act does foresee that the European Commission or the AI office will provide guidelines to clarify how this obligation should be implemented. And in fact, a couple of months ago, European Commission released a public consultation. So different stakeholders could opinionate on how this transparency requirement should be implemented. The period for contribution has closed now, but we are waiting to see what they come up with.

[00:11:04] My suggestion would be to, of course, wait and see what will be the recommended approach. Keep an eye on what the AI office has published. But also do not just sit and wait for these guidelines to be released. I think for one, if producing synthetic content is something that your company really does, you should start mapping which AI projects those are.

[00:11:26] That would be my advice for any company who is considering to start an AI governance program. Map your AI projects in a company-wide level. I know this might sound daunting, especially for tech companies, but building this type of inventory is a way that you get to know which are your AI technologies, and then you can see which one of those are covered by which AI regulation or which dispositions of the EU AI Act.

[00:11:52] Robert Zirk: There's another dimension to the challenge of keeping pace with AI regulation and adoption that goes beyond just navigating different regulatory frameworks. While regulators work to create rules, bad actors are already exploiting AI in increasingly sophisticated ways.

[00:12:09] Natalia Fritzen: At Sumsub, we publish an identity fraud report once a year based on our internal statistics that we see in terms of fraud trends. And in 2025, the share of these complex attacks, among all fraud attempts detected globally within Sumsub's platform, have risen from 10% in 2024 to 28% this year, which shows us a growth rate of 180%. 180

[00:12:38] Robert Zirk: Natália described the current fraud prevention landscape with an analogy: that regulators are playing checkers while fraudsters play chess.

[00:12:47] Natalia Fritzen: What I mean is that with the sophistication of frauds, AI technologies are increasingly better at impersonation, increasingly better at falsifying documents, so on and so forth. With this sophistication, while regulators are using simpler reactive methods, like the straightforward, usually short-sighted moves seen in the game of checkers, fraudsters, on the other hand, they operate using far more complex, strategic and forward looking techniques as seen in the game of chess.

[00:13:18] So, if you take the EU AI Act, for example, if you consider that one of the biggest fraud threats that businesses face nowadays concern deepfakes, the EU AI Act, which is new and one of the most comprehensive AI regulations that we have up to date, the EU AI Act itself says very little when it comes to deep fakes.

[00:13:39] It imposes certain transparency requirements on the deployers and providers of technologies that can generate deepfakes. But it offers, for example, little protection to victims of deepfakes. Of course, in all fairness, the EU AI Act is not a regulation aimed at fraud prevention, but I'm just bringing it up to say that there is this mismatch between what fraudsters are doing, the harms that people are suffering as a result of AI-perpetrated fraud, and the protections that regulations offer to these victims or the requirements when it comes to fraud prevention.

[00:14:15] Robert Zirk: According to Deloitte's Center for Financial Services, generative AI-enabled fraud is predicted to increase by a compound annual growth rate of 32%, potentially reaching losses of $40 billion in the United States by 2027.

[00:14:30] And TELUS Digital's Safety in numbers report highlights that two thirds of enterprise CX decision makers plan to increase their fraud detection investment in the coming year.

[00:14:40] I asked Natália if AI use for compliance is keeping pace with the speed of AI-powered fraud.

[00:14:47] Natalia Fritzen: It's trying. It is trying Companies like Sumsub try hard to keep in pace with the fraudsters because this is a simultaneous trend, right? So this AI, sophisticated power technology, is available for legitimate companies, including those companies that develop solutions to fight fraud. But these technologies are also available to scammers.

[00:15:09] Robert Zirk: Sumsub publishes an annual identity fraud report that identifies trends based on internal statistics. Natália pointed out the increase in sophistication of fraud as one of the major trends of 2025.

[00:15:22] Natalia Fritzen: We see fraudsters moving from high-volume, low-effort scams to highly targeted, multi-step, often AI-driven operations. When interviewing people to make our fraud report, 75% of respondents are highly convinced that fraud is becoming more and more sophisticated and AI-driven and that's why we say here in Sumsub, year after year, we see how AI is helping fraudsters more and more and that's why we say that we should fight AI with AI. So only equally accurate, equally high-performing AI technologies produced on our end are enough to defeat the AI technologies that scammers also have very easy access to.

[00:16:06] Robert Zirk: To underscore why it's important to leverage AI in your compliance strategies, Natália pointed out an example of how fraudsters are using deepfakes to try to get around security measures.

[00:16:17] Natalia Fritzen: Coming back again to the EU AI Act that I was mentioning before, one of the few things that requires in terms of deepfakes is that once a deepfake is being created or further disseminated, the provider or the deployer of the AI system that created the deepfake should disclose somehow that content is AI generated.

[00:16:37] And this is an expectation that we can just not afford to have of fraudsters. They will, of course, not let us know that when they're trying to bypass our KYC with deepfakes that is AI-generated content. So there comes the importance of, again, fighting AI with AI.

[00:16:53] Robert Zirk: If you're wondering how your organization's fraud prevention and compliance measures stack up, TELUS Digital just published a downloadable financial crime and compliance maturity assessment. It's a self-assessment tool that can help you to benchmark your AML controls, fraud detection practices and compliance maturity against industry standards. You can find the link in our show notes.

[00:17:17] We've established that the regulatory landscape is complex and evolving. So what happens if companies don't keep up? What's actually at stake in 2026? Jeff warned that the consequences of inaction are too serious to ignore.

[00:17:33] Jeff Brown: The stakes are really significant. I think this is the time to act. We talked a bit about these potential fines, up to 35 million euro or 7% of your global annual turnover, or as we call it, revenue, here in the U.S., for those serious violations.

[00:17:47] But beyond the fines, there's reputational risk. Your product could get banned. You could certainly lose competitive advantage in the market. Given the level of anxiety in the public around AI, and I think it's dropped dramatically over the last year and a half, but companies that haven't started should begin immediately with a risk classification exercise.

[00:18:04] So understand which of your AI systems fall into the prohibited range or the high-risk range, or the limited risk category and what you need to do when you've done that inventory. I think that's really step one.

[00:18:16] Robert Zirk: Jeff breaks the consequences of compliance inaction down into three categories. First, there are the direct regulatory penalties.

[00:18:24] Jeff Brown: They are increasing, they're proliferating around the globe. And I think if you're a data protection authority or an AI authority, you don't mind the revenue when you catch people not following the laws and not being properly respectful of people's personal data, which belongs to them. And, in some parts of the globe and in a lot of these directives, it's really a human right to control your personal information.

[00:18:44] Robert Zirk: The second consequence of compliance inaction is the erosion of customer trust.

[00:18:49] Jeff Brown: If an AI system behaves unexpectedly or unfairly, customers will notice and they will disengage.

[00:18:56] Robert Zirk: And lastly, Jeff cited operational disruption as the third repercussion of compliance inaction.

[00:19:02] Jeff Brown: If you have to pull an AI system offline mid-deployment because compliance wasn't built in from the beginning, that's tremendously expensive. It's tremendously disruptive to your revenue and profit stream.

[00:19:13] And the hidden cost is opportunity. Near and dear to me as an attorney, a great quote from one of the leaders of one of our outside counsel said, "AI is not likely to replace lawyers, but the lawyers who use AI are certainly gonna replace the ones who don't use it."

[00:19:26] It's one of those things. You gotta be in the game, but you gotta do it thoughtfully and carefully.

[00:19:29] Robert Zirk: Jeff just outlined three categories of costs: direct regulatory penalties, customer trust, erosion and operational disruption.

[00:19:39] Brands can't afford to treat AI compliance as optional. Natália emphasized that regulatory demands aren't going away.

[00:19:47] Natalia Fritzen: I believe these regulations are here. They're here to stay with many more to come. And therefore, my advice for companies that are not looking to that now because they perhaps underplay the role that these regulations will play — my advice would be to start having a look, because I believe that part of the competitive edge in AI will soon no longer exclusively be who launches what first, but rather, to an extent, who launches what in the more responsible manner as well.

[00:20:21] Robert Zirk: For companies that prioritize responsible AI, compliance can become an asset that builds digital trust with customers.

On this episode, we explore why customer experience (CX) leaders need to be aware of developments in AI compliance in 2026 — and why a “light touch” approach puts your CX at risk.

Headshots of Natália Fritzen and Jeff Brown, accompanied by their written names and titles

Questions for now AI compliance in 2026 image

The era of voluntary AI oversight is over. Binding regulations are now enforceable globally. AI-powered fraud is accelerating. And for CX leaders, compliance directly impacts customer trust, and therefore your bottom line.

Our expert guests cut through the complexity, revealing how to navigate fragmented global regulations, what you can do as a CX leader to prepare your organization and why the competitive edge in AI is shifting from who launches first to who launches responsibly.

Listen for the compelling insights of Jeff Brown, former general counsel, global privacy officer at TELUS Digital, and Natália Fritzen, head of AI compliance at Sumsub.

Natália Fritzen headshot

Natália Fritzen

Jeff Brown headshot

Jeff Brown

Benchmark your fraud prevention and compliance program with TELUS Digital’s financial crime and compliance maturity assessment

Explore the data behind the fraud trends discussed in this episode with Sumsub’s Identity Fraud Report 2025-2026

What are the AI compliance trends leaders can’t ignore in 2026?

TELUS Digital overview 2026

Want to speak with an expert?

Transform your business

Discover how Customer Experience is transforming business.

At TELUS Digital, we empower the human experience through digital enablement, agile and lean thinking, spirited teamwork, and a caring culture that puts customers and the value of human connection first. Learn more about who we are and what we do.

Get to know us in two pages. Learn more about who we are and what we do.

TELUS Digital overview brochure Q1 2026

Check out our solutions

TELUS Digital Overview

Discover how TELUS Digital transformed customer support for a leading cryptocurrency platform, scaling the program within weeks while achieving high customer satisfaction scores.

Individual reviewing a financial platform on their mobile phone, laptop and monitor. 

crypto-case-study-HERO

Reduction in Average Handle Time within 3 months

Reduction in Customer First Response Time

Elevating the customer experience for a leading cryptocurrency platform

See how TELUS Digital helped a leading global fintech enhance their sales operation with enterprise lead qualification, delivering 47.6% conversion rate growth and $121 million in operating net revenue.

Image of a person writing notes with pen and paper and a laptop open to a meeting currently taking place

B2B Sales Transformation for Global Fintech

Transforming a global fintech’s sales operations with enterprise lead qualification

Three paths of AI adoption-CTA

Build and deploy the AI adoption strategy your business needs

Discover how Data & AI is transforming business.

Talk to us

Enterprise AI: The build path

Platform-native AI: The buy-and-extend path

AI-first point solutions: The buy-and-plug-in path

Explore the three paths of AI adoption 

Data & AI Advisory Director

All businesses have three AI adoption strategies to choose from: the enterprise path (build), the platform path (buy and extend) and the point solution path (buy and plug in). Success isn’t about choosing one path, but understanding how and when to orchestrate each approach into a unified AI adoption strategy.

Explore the three paths to AI adoption — enterprise, platform native and point solutions — to build your business’s adoption strategy.

Three paths of AI Adoption - A guide to choosing the right approach for your business

Three paths of AI Adoption

Three paths of AI adoption: A guide to choosing the right strategy for your business

Are your CX outsourcing partnerships generating as much revenue as they could? New IDC research reveals the gap — we break down what to do about it.

Woman seated and looking at her computer monitor adjusts the mouthpiece on her headset. 

Insights Overview

Categories

Industries

Resource Types

Glossary

End-to-end digital CX solutions

Share