The 2026 CEO Outlook: The Repricing of Enterprise Scale

In 2026, most enterprise dashboards track past events. Board meetings focus on the economy, supply chain changes, tariffs, and AI productivity. While these points are relevant, they are already well-known in the industry. CEOs who gain a true cost-of-capital edge are watching four bigger changes. These changes have moved from daily business concerns to key financial questions.

These four changes have something in common. The topics provenance, infrastructure scarcity, insurance hardening, and regulatory shifts aren’t new. What’s new is that all four are now removing, at the same time, the key assumptions that allowed companies to grow big over the past decade: that a company’s identity could be trusted, that cities would meet new needs, that companies could transfer big risks for a set price, and that multinationals could operate with a single global system. Now, each assumption affects how CEOs decide to use money. If boards treat these as only tech, operating, or legal issues, they may be left behind by market changes.

Santiago & Company’s approach to the four changes uses the Scaling Enabler Diagnostic to review them in the order that matters most for boards. The first is most urgent, because it underpins all the others.

The trust surface is no longer guarenteed.

For most of the digital age, proving who worked at a company was easy. If someone logged in or joined a call, they were trusted. That is no longer the case.

‍

The case that crystallized it was Arup, the British engineering firm, in January 2024, when a finance employee in Hong Kong wired roughly $25 million across fifteen transfers after a video conference with what the employee believed was the firm’s chief financial officer and several colleagues. Every face on the call was synthetic. The fraud was confirmed and publicly disclosed months later by the Hong Kong police and Arup itself. In March 2025, a finance director at a multinational in Singapore approved $499,000 during a Zoom meeting that turned out to be entirely AI-generated; HSBC flagged a follow-on $1.4 million request before more was lost. Singapore’s police force reported that government-official impersonation cases more than doubled between 2024 and 2025, with total losses of S$242.9 million. Pindrop’s 2025 voice intelligence report tracked a 1,300% surge in deepfake fraud attempts in 2024, from roughly one per month to seven per day. Deloitte’s Center for Financial Services has projected that AI-enabled fraud losses in the United States could reach $40 billion by 2027, up from $12.3 billion in 2023, on an annual growth rate of 32%.

The standard counter is that none of this is yet routine, that the named cases are outliers, and that authentication technology, most notably the Coalition for Content Provenance and Authenticity (C2PA) standard, is moving fast. All three points are partially true, and none of them lets a board off the hook. C2PA 2.3 was released in December 2025; the U.S. Cybersecurity and Infrastructure Security Agency endorsed it in a January 2025 advisory; the European Union’s AI Act Article 50 begins enforcement on August 2, 2026, with machine-readable disclosure requirements on AI-generated content. Sony shipped the first professional camcorder with native C2PA signing, and Google’s Pixel 10 added it as a hardware feature. But C2PA records provenance; it does not detect deepfakes, and most major social platforms still strip embedded metadata during transcoding as a normal consequence of image processing. The standard is a foundation, not a finished defense.

The harder reality for boards is that the question is no longer whether a deepfake will reach an enterprise treasury function; most large enterprises that have looked have found attempts already in the wire approval queue, but what the absence of cryptographic provenance now signals to a regulator, an auditor, or a plaintiff’s counsel after a breach. The signal in the public filings is already shifting. Of 503 S&P 500 issuers reviewed in a 2025 analysis on the Harvard Law School Forum on Corporate Governance, 76% added or deepened AI-related risk-factor language in their most recent 10-K filings (fiscal year 2024, filed in early 2025), against 14% in the prior year’s filings; 48% now cite AI risk in board oversight disclosure. Santiago’s own analysis of 75 recent 10-K filings across 40 large-cap issuers, pulled directly from EDGAR, corroborates and extends that picture: the median firm’s AI-term count in Item 1A rose from 1 in 2025 filings to 5 in 2026; the share hitting our deep-disclosure threshold (≥20 AI mentions in Item 1A) more than doubled year over year, from 11.4% to 24.2%. But within that same 2026 panel, the share of filings using AI-specific governance language board, committee, or AI-policy terms within close proximity to an AI term fell to 0.0%. Enterprises are now disclosing AI as a material risk. They are not yet disclosing who oversees it.

‍

Santiago’s main finding this year: Most boards have not set clear rules about when cryptographic signatures are needed for executive paperwork, SEC filings, or big vendor approvals. Since there are no rules, the default is not to require them. AI isn’t the cause of this; it just made these kinds of attacks cheap enough that preventing one costs less than a single fraud. Now, for the first time, tracing the source is a board-level financial question.

The physical substrate is shifting.

The second key assumption being re-examined is practical: that with enough money, any company can quickly obtain power, water, and approval for a new site. The biggest problems are in data centers, but these issues are spreading.

In August 2024, Dominion Energy disclosed that interconnection wait times for new data centers above 100 megawatts in Virginia had extended from a typical three to four years to as long as seven. The company is currently fielding requests for roughly 70 gigawatts of total load against a system whose current peak it expects to grow by 25% over the next decade. In December 2024, the Virginia Joint Legislative Audit and Review Commission reported that, under unconstrained data center growth, the state’s electricity demand would rise by 183% by 2040, versus 15% without it. Lawrence Berkeley National Laboratory has projected that data centers, which used 4.4% of U.S. electricity in 2023, will use between 6.7% and 12% by 2028. Then, in November 2025, the Virginia State Corporation Commission approved a new rate class  GS-5, taking effect January 1, 2027, requiring large-load customers (≥25 MW) to commit to fourteen-year contracts and to absorb a minimum of 85% of transmission and distribution demand charges and 60% of generation demand charges. That is not a market signal; that is the codification of a new economic premise for a $1.5-trillion-and-growing class of facility decisions.

‍

A similar challenge is happening in local politics. Between May 2024 and June 2025, 36 data center projects were blocked or delayed due to public resistance, totaling about $162 billion. Loudoun County, Virginia, saw water use by data centers jump 250% from 2019 to 2023. While data center operators are improving cooling, and water is still a small part of the city supply, these changes are setting new rules, rate classes, long contracts, tighter water rules, and organized local opposition. These rules will also affect other industries, such as manufacturing and biotech.

Small modular reactors and behind-the-meter generation are real options on the horizon, but the consensus deployment timeline puts them in the 2030s at the earliest. That horizon does not relieve the decision on a 2026 or 2027 facility. It does, however, sharpen what the CEO's question actually is: not whether power and water will be available eventually, but what the maximum tolerable interconnection delay is before a siting decision moves locations, technologies, or business units. AI demand is a real accelerant on the constraint, but reshoring, electrification, and chip-fab buildouts had already filled most of the relevant utility queues. The board's decision is on what to build, where, and on what schedule, against a substrate that no longer scales on call. Santiago’s Infrastructure Scarcity Index, which aggregates six public-data indicators projected data-center load growth, utility interconnect queue time, large-load rate-class activity, water stress, local project opposition, and major-facility permit time across all 50 states, finds Virginia 23 points above the next-ranked state (CA). Only four states, VA, CA, TX, and AZ, sit in the severe or material scarcity bands. That geographic concentration is the real board data point: “siting risk” is not a national-average question; it is a question of which few states already have no runway.

‍

The financial buffer has weakened.

The third assumption that catastrophic risk can be transferred to a balance sheet other than the enterprise’s own, for a knowable premium, is more nuanced. Insurance markets have not collapsed; standard property and casualty coverage remains broadly available; cyber rates declined roughly 7% globally in 2025. But beneath that aggregate stability, insurers are selectively retreating from precisely the categories that now matter most, and the largest enterprises are answering structurally.

The cyber insurance market reached $16.3 billion in 2025 and is projected to reach $30 billion to $50 billion by 2030. Munich Re recorded $320 billion in global natural-catastrophe losses in 2024, of which roughly $140 billion were insured; 2025 was the sixth consecutive year of insured nat-cat losses above $100 billion, with the January Los Angeles wildfires alone accounting for $40 billion in insured loss. On the cyber side, the CrowdStrike outage in July 2024 ranked among the largest IT disruption events on record across multiple industries; Change Healthcare’s ransomware incident in 2024-2025 compromised more than 190 million patient records, with UnitedHealth’s total impact estimated at roughly $2.4 billion. Coalition reported in early 2025 that 40% of large cyber claims now include data theft, up from 25% across all of 2024.

The structural answer the largest enterprises are giving is visible in the captive insurance data. Marsh-managed captive gross written premium reached $77 billion in 2024, up 6% year over year; the global captive market is now estimated at over $80 billion in premiums across more than 10,000 risk-bearing entities, with formations outpacing closures for four consecutive years. Approximately 90% of Fortune 500 companies maintain captive subsidiaries. Captives are not new; what is new is the velocity of formation among enterprises that historically transferred almost everything, and the categories, particularly cyber tower layers and AI-exposure carve-outs, that captives are now being formed to retain.

The skeptic’s point that the market is functioning, that specialty markets exist, and that captives have always existed is correct on the surface. It is also the wrong question. The question for the board is not whether commercial insurance is available, but which exposures are structurally migrating from a known operating expense (the premium) to a contingent capital commitment (the captive layer or the uninsured tail). The Santiago observation is that this migration shows up in two places that boards do not always connect: it slowly drains the M&A war chest, because dormant capital must back the captive; and it complicates dividend planning, because the loss-absorption layer has to be held against an event that may or may not arrive in any given year. AI widens this gap further by introducing exposures with no actuarial loss history, deepfake-driven fraud, and AI liability, for which the cyber market took a decade to learn to price ransomware.

The decision threshold the board needs to set is the coverage-gap-to-balance-sheet ratio at which it commits new capital to a captive structure. The default answer that the broker handles the renewal is, in 2026, a financial decision the board has implicitly made. Santiago’s 4-Shift Capital Repricing Model, applied to an illustrative $10B-revenue reference enterprise, quantifies how insurance repricing looks small in isolation ($4–11M a year by 2028) but sits inside a stack where architecture and regulatory-debt shifts dominate. The combined three-year repricing runs $125M in 2026, rising to $184M in 2028, roughly 10% of base-case EBIT for the reference enterprise, with one-in-ten stress scenarios reaching $249M. The insurance line is not where the drama lives; it is where the board first feels the other three.

The architectural unity is vanishing.

The fourth assumption is the one most likely to be rejected as too abstract for a CEO piece. It is also, by 2027, the one most likely to be the largest single line item moving on enterprise margin: the assumption that a multinational can run a unified global operating architecture and let regional units consume it.

That assumption was always part economics and part politics. The economics of the compounding return on a single global instance of an ERP, a CRM, a data lake, and an AI model have built the multinational margin advantage of the last twenty years. The politics of a relatively benign global posture toward data flows enabled it to operate. The politics broke first. Now the economics are following.

Gartner forecast on February 9, 2026, that worldwide sovereign cloud infrastructure-as-a-service spending would reach $80 billion in 2026, a 35.6% year-over-year increase. That is roughly twice the growth rate of standard public cloud. European spend alone is projected to nearly double, from $6.9 billion in 2025 to $12.6 billion in 2026, a 83% jump, with Middle East/Africa rising 89% and mature Asia/Pacific 87%. These are vendor-side forecasts, and the supply side has already moved to meet them: SAP committed €20 billion to European digital sovereignty investments; Oracle’s EU Sovereign Cloud is operational with EU-resident staff; Microsoft has built sovereign offerings through partnerships with Bleu (Orange and Capgemini) in France and Delos (with SAP) in Germany. Enterprise-side adoption has not yet shown up in named-multinational regional architecture splits at the scale the supply-side build implies, but the supply build is being underwritten against forecast demand from those same multinationals, and procurement RFPs in 2025 already require sovereign-tier options as a default specification rather than an exception.

The driver is regulatory, not market preference. The European Union’s AI Act Article 50 takes binding effect on August 2, 2026, requiring machine-readable disclosure of AI-generated content; the penalty ceiling is €35 million or 7% of worldwide annual turnover, compared to the GDPR’s 4%. Compliance estimates for high-risk AI systems at enterprises with revenue above €1 billion range from $8 million to $15 million in initial investment. India’s Digital Personal Data Protection Act is now in effect, with the Data Protection Board operationalized and significant data fiduciaries required to appoint data protection officers and adopt local storage measures. Saudi Arabia’s PDPL has been fully enforceable since September 2024. Deloitte’s late-2025 enterprise AI survey found that 73% of leaders cite data privacy and security as their top AI risk concern, ahead of legal/IP/regulatory compliance at 50%.

The skeptic’s argument that abstraction layers, supercloud platforms, and modern multi-cloud tooling reduce the technical cost of regional deployment is correct on the technical surface. It misses where the cost actually lands. Abstraction reduces engineering friction; it does not absorb regulatory friction. Each jurisdiction still requires separate data governance, audit trails, legal review, compute residency, and model documentation. Those costs do not show up in the IT budget. They appear in operating margin, compliance headcount, and the audit calendar. IDC has projected that by 2028, 60% of multinational firms will split AI stacks across sovereign zones, with integration costs tripling.

The repricing mechanism is therefore unusual. Most of the prior three shifts compress capital efficiency by adding cost to a known activity. This one reprices the unit economics of running as a single multinational. When shared services cannot be shared across regions, the economies of scale that justified consolidated systems start to invert. Duplicate infrastructure CapEx does not generate the compounding returns of unified investment. Operating model duplication adds permanent payroll. Regional unit margins begin to diverge in ways that complicate, rather than simplify, group reporting. And the EU AI Act’s 7% of global turnover ceiling is not a fine; it is an at-risk capital line item that must now be planned against.

The CEO's question is the breakpoint. At what percentage of global revenue exposed to divergent jurisdictions does the cost of a unified architecture flip from economic to uneconomic? Most enterprise architectures were designed when that breakpoint was hypothetical. By the second half of 2026, any multinational with material exposure to the EU, India, or Greater China will be operational.

What the four shifts say together

Trust, matter, money, architecture. The external surface, the physical substrate, the financial buffer, and the operating model. Stated separately, each is a known issue with a familiar functional owner. Stated together, they are something the dashboard does not show: four enablers of enterprise scale being repriced simultaneously, in the same fiscal year, against the same balance sheet, in the same boardroom.

‍

This is what the Santiago & Company Scaling Enabler Diagnostic is built to surface. It is not an empirical index. Santiago is fielding the 2026 CEO Outlook Program separately, with results to be published as that work completes. It is a board diagnostic: four dimensions (Identity Integrity, Infrastructure Access, Risk Retention Load, Jurisdictional Fragmentation) scored on a transparent five-level rubric with weighted composite scoring. The four dimensions are drawn from Santiago’s CEO advisory engagements over the past year; we do not present them as the only way to organize the evidence, but as the structure we have found most actionable for board-level capital allocation. The full rubric, dimension weights, and an illustrative Fortune 500 scoring run are documented in Appendix A. A skeptic could collapse risk and architecture into a single dimension or split infrastructure into power and water; we have kept the four separate because each maps to a distinct capital decision a board has to make. The output is not a number to admire; it is a list of which board decisions are now overdue. From Santiago’s CEO advisory engagements over the past year, the boards that have absorbed all four shifts share three behaviors. First, they have moved at least one of the four from a functional report-out to a standing board agenda item. Second, they are committing capital against each other on a planned, multi-quarter cadence rather than reactively after an incident.

Third, and this is the change most boards still resist, they have stopped treating the four as risk topics and started treating them as scaling topics, because that is what they are. Two of the 2026 inflection points are dated calendar events. EU AI Act Article 50 enforcement begins August 2, 2026. Dominion’s GS-5 large-load rate class takes effect January 1, 2027. Both are in regulatory calendars today; both will show up in some enterprise’s earnings call as a downside surprise. The other two inflection points are trends, not dates, but they are running on a faster cadence than most board calendars assume.

Cyber reinsurance treaty renewals at January 1 and mid-year cycles are tightening exclusion language faster than primary-market rate stability suggests; boards should expect 2026 renewal terms to constrain 2027 program coverage in categories such as AI liability, deepfake-driven fraud, and systemic outages, which captives, not commercial markets, will increasingly be asked to absorb. And the cadence of new local opposition to large industrial siting, by Data Center Watch’s tracking, has compressed from annual to quarterly. Each of these four two-dated, two-trend-driven is something a board can plan against today.

The harder question for any CEO reading this is not whether the company is exposed; every enterprise is to some degree. The harder question is whether the board has decided, with specificity, what to do about each one and committed the capital before the market reprices on its behalf. Repricing happens whether the board sequences it or not. The CEOs who emerge with a durable cost-of-capital advantage in 2027 are the ones who chose the sequence in 2026.

‍

About this article

This is the first installment of the Santiago & Company 2026 CEO Outlook Program, the firm’s recurring research franchise built around the Scaling Enabler Diagnostic. Subsequent installments will publish updated benchmarks, sector-specific applications of the diagnostic, and case-illustrated decision frameworks for each of the four enablers. To request the diagnostic worksheet for board use, contact the firm directly.