A) Regulatory developments

1) Data protection

• The Australian Government has released a Consultation Paper and Exposure Draft legislation to modernise and strengthen Australia’s privacy laws for the digital age.

  • Why does this matter? “The measures in the Exposure Draft Bill are designed to better protect Australians while supporting innovation and providing greater certainty for regulated entities.”

• The California Legislature passed SB 690, a bill that would narrow the private right of action available under the California Invasion of Privacy Act (CIPA) for certain website-tracking claims. The bill now awaits Governor Newsom's signature. If signed this year, it becomes effective as of January 1, 2027. (The National Law Review)

  • Why does this matter? “In practical terms, the bill eliminates the private cause of action for that specific category of CIPA claim. Private plaintiffs would no longer be able to sue businesses directly under § 638.51 for deploying tracking pixels, analytics tags, or similar technologies on their websites and apps. The enrolled language provides that the amendments `apply retroactively to any pending claim in an action commenced within two years before the operative date of that legislation.`”

2) Digital Policy, Cloud & Cybersecurity

• The European Commission has designated ChatGPT as a Very Large Online Search Engine (VLOSE), as well as Reddit and Roblox as Very Large Online Platforms (VLOPs), under the Digital Services Act (DSA).

  • Why does this matter? “Following the notification of the designations, these services have four months, i.e. by January 2027, to comply with the additional DSA obligations for VLOPs and VLOSEs, such as assessing and mitigating the systemic risks stemming from their service and algorithmic systems related to the dissemination of illegal content, the negative effects on minors, users' physical and mental well-being, fundamental rights, electoral processes and public security.”

• Slovakia´s government approved a bill proposing a ban on use of social networks by children ​under 16. (Reuters)

  • Why does this matter? “The law, if approved by parliament, will ban setting up social network accounts for younger children and require ​proving the user's age, according to documents posted on ​the government's website.”

B) Enforcement actions

1) AI

• According to Euractive, “the European Commission made first use of new AI enforcement powers this week, Tech Commissioner Henna Virkkunen told Euractiv, ordering information from leading developers on cybersecurity, safety and copyright compliance.”

  • Why does this matter? “Virkkunen said the EU wanted to ensure the labs in question had put in place good cybersecurity and physical infrastructure protections for their models. […] The Commission is also concerned with how much access developers are providing to external model evaluators, per Virkkunen, and how any outside safety recommendations are followed up, as well as how labs monitor model usage once an AI is publicly available.”

• The Federal Trade Commission (FTC) finalized orders requiring Cox Media Group (CMG) and two other firms to pay a total of $930,000 to settle allegations they deceived customers by falsely claiming to offer an AI-powered service that could target localized ads based on conversations captured from consumers’ smart devices and that consumers had opted into such targeting.

  • Why does this matter? “Contrary to these companies’ claims, however, the marketing service wasn’t based on voice data, and consumers hadn’t opted into this service. If the service had functioned as advertised, this collection and use of consumers’ voice data without adequate consent would itself violate the FTC Act.”

• Hellenic DPA takes a leading role in implementing the EU AI Act in Greece.

  • Why does this matter? “Law 5321/2026 (‘Measures for the implementation of Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 (Regulation on Artificial Intelligence) designated the Hellenic DPA, inter alia:

    • as the competent market surveillance authority for Artificial Intelligence systems falling under the prohibited practices of the Regulation, for high-risk systems of Annex III and for systems subject to the transparency obligations of Article 50 of the Regulation,

    • as the single point of contact for Greece with the European Commission and the respective national authorities;

    • as the competent authority for receiving and handling complaints concerning infringements of the Regulation,

    • as a notified body for the conformity assessment of specific high-risk AI systems, and,

    • together with EETT (Ηellenic Telecommunications and Post Commission), as the competent authority for the operation of the national AI regulatory sandbox.”

2) Data protection

• The Dutch DPA (AP) imposed a fine of EUR 825 million on Uber. The reason for this is that the AP has ruled that Uber made fully automated decisions about drivers. In case of suspicions of fraud or customer reviews that were too low, drivers' accounts were automatically temporarily deactivated or, in case of persistent low customer reviews, permanently deactivated. As a result, their income was lost via Uber during the deactivation.

  • Why does this matter? “According to AP, Uber has violated the prohibition of fully automated decision-making under the General Data Protection Regulation (GDPR). The AP also found that Uber did not sufficiently inform drivers about automatic decision-making.”

3) Digital Policy, Cloud & Cybersecurity

• Meta “settled […] a trial brought by a coalition of tens of U.S. states alleging that the tech giant had misled the public about the harms its platforms posed to younger users.” (CNBC)

  • Why does this matter? “The agreement includes a payment of up to $18 billion, part of which is tied to conditional action by other social media giants. Meta said it would also make fundamental changes to its platforms for users under the age of 18, including but not limited to a 2-hour daily usage limit that only a parent can lift, disabling extreme makeup and cosmetic surgery filters, tighter age verification measures, and night mode.”

  • TechPolicy published an analysis about the potential impacts of this settlemnent on child safety for Europe.

    • According to Julia Smakman of the Ada Lovelace Institute, as quoted in the analysis, “[…] the agreement could give European regulators a useful baseline, as long as European regulators are not afraid to also take more stringent measures or extend protections beyond children to all users.”

  • South Korea´s media regulator said that “measures proposed by Meta to curb potentially addictive features for young users should ideally be applied worldwide […].” (Reuters)

    • “The Korea Media and ​Communications Commission (KMCC) said in a statement to Reuters that social media companies needed to take greater responsibility for ​protecting children and teenagers and pointed to seven bills pending in the country's parliament aimed ⁠at strengthening youth protections online.”

• Brazil’s government filed a lawsuit in a federal court against Discord, “seeking damages of 500 million reais (about $97 million) for the company’s alleged failure to protect children online.” (AP)

  • Why does this matter? “The Solicitor-General’s office for President Luiz Inácio Lula da Silva said in a statement the damages it is seeking from Discord are due to alleged collective psychological harm it has allowed. […] The office is also asking the court to order Discord to immediately strengthen parental controls, expand cooperation with local law enforcement, and deploy automated tools to detect and remove dangerous content.”

  • The Brazilian DPA (ANPD) previously orderd Discord to suspend live broadcasts in Brazil.

C) Opinions, guidelines, reports & other publications

1) AI

• A new study shows that “nearly 1 in 5 young Americans now turn to AI when they need mental health advice. More than 90 percent of them say the responses are helpful.” (ZME Science)

  • Why does this matter? “This matters in a US mental health setting where four in 10 teenagers who experienced a major depressive episode in the previous year reported not receiving mental health services. […] Young people have also long used the internet to find mental health information because it is accessible, anonymous, and basically free. Chatbots take that one step further by turning a search into a conversation tailored to the user’s words. […] Young people have also long used the internet to find mental health information because it is accessible, anonymous, and basically free. Chatbots take that one step further by turning a search into a conversation tailored to the user’s words. […] […] among those who used AI for mental health advice, 63.3 percent had not told anyone about it. […] According to researchers, this lack of disclosure can also create a blind spot. If a chatbot gives poor or misleading advice, parents and health professionals may never know that the conversation happened.”

  • As reported in The Washington Post, court records also show that “chatbot exchanges are increasingly being introduced as evidence in civil lawsuits and criminal investigations, exposing deeply personal information that users may have never expected to become public […].” (Cleveland.com)

• Anthropic shared high-level results from the studies that were prepared as part of Anthropic´s pilot project, giving external researchers access to aggregate, real-world Claude usage data.

  • Why does this matter? Anthropic “partnered with three research groups: the Social and Language Technologies (SALT) Lab at Stanford University, the Human Information Processing Lab at the University of Oxford, and METR, a non-profit organization that evaluates frontier AI models. Each group developed its own research questions and used Anthropic Insights to conduct privacy-preserving analysis of roughly 250,000 Claude.ai or Claude Code conversations from April-May 2026.”

  • “Understanding AI’s effects on society is too big a job for AI companies alone. Real oversight needs external researchers asking their own questions of real-world usage data and publishing what they find independently. […] Our partners pursued research we would not have thought to design ourselves, and each told us something new about AI’s real-world impacts. […]”

• The Dutch DPA (AP) issued guidance detailing the EU AI Act´s fundamental rights impact assessment (FRIA) obligations for high-risk AI systems. (The document is in Dutch.)

  • Why does this matter? “The explanation of the FRIA is the first document in a series on AI and fundamental rights with which the DPA prepares organizations for their obligations under the AI Act.” The DPA also starts a pilot program to help organizations gaining practical experience with the European FRIA reporting template. Organizations will also receive feedback on their FRIA approach. The form of the feedback will not be an audit, inspection or enforcement process at the organizations that taking part in the pilot but the DPA will use the experiences of the pilot participants to improve information about the FRIA, the template and the future supervisory approach.

• The International Telecommunication Union published a guide presenting a structured and comprehensive framework for understanding, assessing and progressively advancing autonomous cities.

  • Why does this matter? “A central proposition of the guide is that cities are systems of systems. Urban life depends on the interaction of multiple infrastructures, services, institutions and communities. Changes in one system can produce ripple effects across others. […] The guide introduces a high-level model of autonomous systems built around five core components: sensors; sensing, perception and environment modelling; decision-making and action planning; actuators; and a learning module. This model provides a common language for assessing autonomy across diverse urban domains. […] The guide also provides a practical four-step methodology: baseline the current extent of autonomy; determine the target autonomous state; implement actions to close identified gaps; and evaluate outcomes. This methodology is intentionally iterative.”

  • “The key conclusion is that autonomous cities should not be pursued as a single end-state or as a purely technical ambition. They should be treated as a governed transition towards more adaptive, responsive and sustainable urban systems. The responsible deployment of autonomous systems requires clear objectives, proportionate risk management, staged implementation, human-centred design, rigorous testing and continuous oversight. When applied carefully, autonomous systems can support better resource allocation, faster response to disruptions, improved service quality and more evidence-based urban governance.”

    

    Source: ITU, Autonomous cities and AI: The next frontier of urban transformation, p. ix

2) Data protection

• The French DPA (CNIL) published a new version of its demonstrator to explore the genealogy of AI models published in open source. This update improves the performance of the tool, its ergonomics and automates the updating of data. An English version is now available. (More info about Genmod at HuggingFace.)

  • Why does this matter? “AI models published in open source can be downloaded, modified, specialized with new data or combined with other models, before being made available again. A single model (e.g. Kimi K3, Mistral Medium, LLaMa etc.) can thus be the source of many derived models. The Genmod demonstrator developed by the CNIL’s AI department in collaboration with the CNIL’s Digital Innovation Laboratory (LINC), initially published in November 2025, makes it possible to explore these links and to find the ancestors of a model (the models from which it comes) as well as its descendants (the models to which it has contributed). This traceability is particularly useful for studying the consequences of the memorization of training data by AI models. The aim is to identify, from a model that has memorized personal data, the other models in its “genealogy” that are likely to have also retained this information. In particular, this makes it possible to study the conditions for exercising the rights provided for by the GDPR.”

• BRUEGEL published a working paper, titled “Why the EU right to consent to personal data processing doesn’t work” (author: Bertin Martens).

  • Why does this matter? “This paper argues that consent banners for the collection of personal data under the European Union’s General Data Protection Regulation (GDPR) are, in practice, a legal and technical fiction. While the GDPR requires consent to be freely given, specific, informed and unambiguous, it prescribes no technical standards for consent tools. Publishers and advertisers design their own tools. They often exploit pervasive consent fatigue and use ‘dark patterns’ to nudge data subjects towards acceptance of personal data sharing. Few consent tools are fully GDPR-compliant.”

• The Swedish DPA (IMY) launched FantomApp in Sweden, an app that helps young people protect their personal data in social media. (FantomApp was developed by the French DPA in collaboration with young people in France. IMY has now translated and adapted the app to Swedish conditions.)

  • Why does this matter? “The app can, among other things, help with social media security settings, testing passwords and blurring photos.”

• New Zealand´s Privacy Commissioner issued guidance on the appropriete use of smart glasses.

  • Why does this matter? The Commissioner emphasized that by using smart glasses, “it’s very easy for people to be filmed covertly, which makes it harder for people being filmed to object to it.” He added that the concerns regargin the use of smart glasses would increase “if, in future, smart glasses are integrated with facial recognition technology.”

  • There are also intense debates about the use of smart glasses, e.g. in Germany and in Norway. (A brief overview about the debate in Germany is avalable here in Hungarian.)

  • The Spanish DPA (AEPD) has also published guidance on the proper use of smart glasses. (The document is in Spanish.)

• The Office of the Privacy Commissioner for Personal Data (PCPD) of Hong Kong has published a guidance, titled “Protecting Personal Data Privacy in the Use of Agentic AI”.

  • Why does this matter? The guidance “aims to provide practical recommendations to organisations on the safe and responsible use of agentic AI to assist them in harnessing the benefits of agentic AI while safeguarding personal data privacy and complying with the relevant requirements of the Personal Data (Privacy) Ordinance (PDPO).”

3) Cybersecurity

• “When more than 1,200 artificial intelligence (AI) agents within OpenAI started unexpectedly communicating, it led to a large group banding together in order to hack into Hugging Face.” (BBC)

  • Why does this matter? “[…] total of 1,206 AI agents that were meant to be kept isolated from one another began communicating. They did so by sending more than 70,000 messages on an “unsanctioned message board.” Those messages ended up seeing more than 700 agents take part in a collective effort to attack Hugging Face. […] As for why the agents began communicating in the first place when they were not supposed to, METR found that the communicating agents had “unintentionally been given an impossible task.” […] an impossible task is one where an AI tool is required to “exploit” its target in order to resolve its command. It led the agents to find ways to cheat, including getting messages to one another and accessing the outside internet, which then led to broader conversations between hundreds of agents looking for ways to cheat that would benefit all of the agents.”

• In a blog post, the U.S. National Institute of Standards and Technology (NIST) discussed some of the current identity and authorization practices that present substantial security challenges for agentic AI systems.

  • Why does this matter? “Perhaps one of the most important actions any organization can take when preparing for the agentic future is to do a clear-eyed evaluation of its current IAM practices, systems, and capabilities against current standards and best practices. Issues, challenges, and gaps in current capabilities will only be exacerbated by agentic scale deployed across enterprises. The established IAM standards and best practices of today are the foundation upon which we will build the secure and scalable agentic protocols of the future.”

• More than 100 technology companies, including OpenAI, Anthropic and Microsoft, signed a letter urging policymakers, and entities to “act decisively” to bolster cyber defenses in the age of AI. (CNBC)

  • Why does this matter? “The group of 116 entities urged every organization to “raise the security bar” on defense tools, upgrade security systems and utilize a mix of low-cost and frontier models. The letter also called for a coordinated government effort to fund cyber defense and improve accessibility for under-resourced critical infrastructure like hospitals and water treatment plants, which have been major attack targets.”

4) Digital Policy, Cloud and Data Strategy

• The European Law Institute (ELI) published “Model Rules on Succession and Access to Digital Remains”, as part of its dedicated project on developing such model rules.

  • Why does this matter? “These Model Rules set out a framework for succession to digital assets and access to personal digital remains after death. They address the growing practical and legal difficulties that arise when a person dies leaving online accounts, digital assets, cloud-stored materials, personal data, communications, and digital or AI generated representations. The Model Rules aim to provide legal certainty while respecting the privacy and dignity of the deceased, the rights and interests of heirs and other beneficiaries, the rights of living third parties, and the obligations of service providers. […] The Model Rules are built around the concept of ‘digital remains’. This umbrella concept includes both digital assets and personal digital remains. […] A central feature of the Model Rules is the distinction between succession and access. […] Overall, the Model Rules offer a structured and practical framework for post-mortem digital governance. They preserve succession to transferable digital assets, establish a distinct access regime for personality-linked digital remains, protect the deceased’s autonomy and dignity, safeguard third party rights, and impose workable obligations on service providers and others who control digital remains. Their purpose is to support coherent national and European approaches to digital succession and access, while avoiding reducing all digital remains to either property or personal data.”

• The European Parliamentary Research Service (EPRS) published a briefing about the rights to internet access in the EU.

  • Why does this matter? “Reflecting the increasing importance of digital technologies for participation in all aspects of modern life, access to the internet has become essential for work, education, public services and democratic engagement. […] If a right to internet access is recognised, its implications will depend on both its legal basis and how it is formulated. While a purely negative right of access would require the state to refrain from interfering with people's existing access, a positive right would oblige states to take active measures to ensure connectivity, for instance, by investing in infrastructure or providing financial support to ensure affordability. An investigation of the existing legal framework reveals that although restrictions on internet access have been found to violate the right to freedom of expression, in particular, a binding stand-alone right to internet access has not been recognised in international or European human rights law, nor derived from the Charter of the Fundamental Rights of the European Union. At secondary law level, the universal service obligations under the European Electronic Communications Code do not establish entitlements which can be claimed by individuals. However, in some EU Member States, internet access benefits from explicit constitutional or statutory protection. Several policy options have emerged regarding a novel right to internet access, ranging from a limited right to use the internet without arbitrary restriction to a broader right to 'meaningful' connectivity. However, it is increasingly argued that it should include a positive and a negative dimension. The quality of connection required to fulfil such a right and the extent of states' obligations will depend on how the right is formulated and interpreted by courts and may be regulated through secondary legislation, rather than as part of the right itself.”

Share

D) Data, Technology & Company news

• Nvidia agrees to buy Hugging Face for $12.9 billion. (CNBC)

  • Why does this matter? “If completed, the acquisition would put one of the most widely used platforms for sharing and working with open-source AI models under Nvidia’s ownership, expanding the chipmaker’s reach further into the software and model ecosystem.”

• At the second annual World Humanoid Robot Games in Beijing, robots’ physical capabilities were put to the test. (Nature)

  

  Source: Nature, credit: Lintao Zhang/Getty

  • Why does this matter? “The games highlighted how fast humanoid robots — which use artificial intelligence to learn, plan and execute real-world actions — are advancing. But they also demonstrated that the machines have a long way to go before they’ll be used by humans for practical tasks.”

  • “During the games, a robot from company X-Humanoid in Beijing took home a gold medal in the 100-metre sprint with a time of 8.64 seconds — almost one second faster than Olympian Usain Bolt’s record-breaking race in 2009. The same robot won the 100-metre sprint last year in 21.5 seconds, showing how quickly the technology is advancing.”

A) Regulatory developments

1) AI

• The Colorado attorney general´s office published draft regulations to help guide implementation of Colorado´s Automated Decision-Making Technology Act (ADMT Act) and the Chatbot Safety Act, which take effect January 1, 2027.

  • Why does this matter? The ADMT Act “defines an ‘automated decision-making technology’ (ADMT) and creates certain requirements for both developers of ADMT that is used to materially influence a consequential decision and deployers who use ADMT. It also gives consumers the right to request and correct inaccurate personal data used by ADMT.”

  • The Chatbot Safety Act adds “protections for users of conversational AI services, including requirements for chatbot operators to estimate the age of users, disclose that users are interacting with AI and not humans, safeguard teen users against sexually explicit content and simulated emotional dependence, and implement privacy/account-management tools for minor users. The Chatbot Safety Act also requires chatbot operators to create suicide and self-harm response protocols and prohibits chatbot outputs from being represented as equivalent to licensed professional services.”

2) Data protection

• The New Jersey Governor signed the New Jersey Kids Code Act, which adopts the New Jersey Age-Appropriate Design Code, into law. The law takes effect on September 1, 2027.

  • Why does this matter? “The new law creates strict design and privacy requirements for online services likely to be accessed by minors, plus a private right of action with $5,000 in statutory damages per violation.”

3) Digital Policy, Cloud & Cybersecurity

• The Constitutional Court of France shot down a bill seeking to ban access to social media for under-15s from September. (Politico)

  • Why does this matter? The Court “said the restrictions in the bill disproportionately infringe on minors’ right to freedom of expression and communication.”

  • “[…] the French presidential office said the government would not be giving up on the bill. It has set a new target date for spring 2027, which coincides with when Macron will leave office.”

B) Enforcement actions

1) AI

• German advocacy group, HateAid, lodges criminal complaint over Meta AI glasses. (Reuters)

  • Why does this matter? “HateAid said its complaint was based on a federal digital data protection law that prohibits the sale of communication devices designed ​to film people without them noticing.”

• Complaint under Article 85 of the AI Act can be submitted via AI Act complaints tool.

  • Why does this matter? “The AI Act Complaint Tool allows individuals and organisations to submit complaints to the AI Office concerning alleged infringements of the AI Act by providers or deployers of AI systems.”

2) Data protection

• The Italian Data Protection Authority (Garante) fined Piaggio & C. Spa EUR 460,000 for violations of privacy regulations relating to the management of company email accounts, data retention, and employee monitoring activities. (More information in English is available here at NOYB´s GDPRhub.)

  • Why does this matter? “[…] the DPA held that both an individualised corporate email address and the correspondence associated with it constituted personal data relating to the employee. According to the DPA, a request to deactivate such an account therefore amounted to a request to cease the related processing, […]. […] The DPA found that the controller therefore infringed Article 12(3) GDPR in conjunction with Article 17 GDPR.”

  • “With regard to the internal investigation, the DPA […] held that the investigation was therefore retrospective and relied on data that had already been systematically collected and retained before any specific suspicion arose. It noted that the use of keywords, filters and a balancing assessment did not remedy this. In addition, the DPA held that the controller’s stated purposes were formulated too generally to justify retaining the complete correspondence of all employees throughout their employment and for an additional five years. The DPA concluded that no appropriate legal basis under Article 6 GDPR applied because the controller had not demonstrated that its extensive retention was necessary for a specific and predetermined purpose. It further found that the controller infringed the principles of purpose limitation under Article 5(1)(b) GDPR, data minimisation under Article 5(1)(c) GDPR and storage limitation under Article 5(1)(e) GDPR.

  • The DPA […] held that both the content of emails and their metadata concerned correspondence protected by the right to privacy and secrecy of communications. […] The DPA distinguished between the email service itself, which may constitute a tool used by employees to perform their work, and the separate systems used to systematically collect, retain and process email content and metadata. These systems operate independently of the employee’s ordinary use of email and may enable the employer to reconstruct the employee’s activities. […] The DPA concluded that the systematic retention and subsequent use of the data enabled the controller to reconstruct and monitor employees’ activities. It further found that this monitoring had been carried out without the safeguards required under Italian labour law. It ruled that the controller infringed Article 5(1)(a) GDPR and Article 88 GDPR, together with Article 114 of the Italian Data Protection Code.

  • The DPA also held that the controller’s policy was unlawful insofar as it allowed a former employee’s email address to remain active for up to 30 days, even with their consent, and permitted incoming messages or mailbox contents to be forwarded or transferred to another employee on the basis of broadly defined service needs.

  • Finally, the DPA held that the controller had not demonstrated how and when the two data subjects had been informed about the processing. […] It held that the controller therefore infringed the transparency principle under Article 5(1)(a) GDPR and its information obligations under Article 13 GDPR.”

• According to news reports, “Ireland’s Data Protection Commissioner (DPC) plans to fine the US company behind the popular Tinder dating app between €8m and €11m for alleged compliance breaches of the EU’s data protection regulations.” (Irish Independent)

  • Why does this matter? “The DPC previously noted that it would set out to establish whether Tinder has a legal basis for the ongoing processing of its users’ personal data and whether it meets its obligations as a data controller with regard to transparency and its compliance with data subject rights requests.”

  • The company (Match Group) said that “We believe we have strong defences to these claims and will defend vigorously against them.”

3) Digital Policy, Cloud & Cybersecurity

• The Brazilian National Data Protection Agency (ANPD) issued a preventive measure determining that the Discord platform suspend the live streaming functionality in Brazil.

  • Why does this matter? “The action is part of the inspection process initiated […] to investigate failures in the protection of children and adolescents in the digital environment, […]. The precautionary measure to suspend the functionality of lives was determined […] due to robust evidence that the company has not adopted reasonable measures to prevent and mitigate risks of access, exposure, recommendation, or facilitation of contact with content or practices that represent serious violations of the rights of children and adolescents within the scope of its service, especially inducement, incitement, instigation or assistance to violence, self-mutilation and suicide, according to the Digital Statute of the Child and Adolescent […].”

C) Opinions, guidelines, reports & other publications

1) AI

• The Australian Government has commissioned a report to better understand emerging AI agent risks in Australia.

  • Why does this matter? “This report offers a framework to help organisations, policymakers and researchers understand and manage the risks when AI agents interact across organisations.”"

  • “The report builds its analytical framework around 3 tiers of agent governance:

    • singular governance

    • federated governance

    • open environments.”

  • “The overarching message is that the controls available, and who can action them, depend on the deployment tier.”

  • “For deploying organisations, the framework is a triage and decision instrument: identify the tier an existing or proposed system operates at, the controls applicable to that tier's risks, decide whether to deploy and if so which controls to apply, govern continuously, and recognise where unilateral reach ends.”

  • “For policymakers, the report offers a map: for each risk it identifies who can act, and for the risks that fall to no existing actor it characterises the gap.”

  • “For researchers and Standards bodies, it surfaces methodological and infrastructural gaps on which controls depend, from multi-agent evaluation to agent identity standards.”

• The European Commission requested and published a study to gather empirical evidence to assess the EU’s current and future requirements for cloud and AI infrastructure.

  • Why does this matter? “The study provides a comprehensive overview of:

    • Cross-border barriers to the provision of cloud services

    • lock-in practices within the AI computing stack

    • risks arising from third-country laws with extraterritorial effects

    • permitting procedures for data centres

    • financial and fiscal incentives

    • constraints related to energy grids and other critical resources such as water

    • initiatives to improve access to capital for data centre expansion

    • public-sector efforts to promote the adoption of open source solutions

    In addition, the study identifies the main challenges in the EU cloud and AI ecosystem:

    • the limited and geographically concentrated availability of computing capacity within the EU

    • the EU’s dependence on cloud and AI computing services provided by non-European suppliers.”

• The Brazilian Data Protection Authority (ANPD) released the English version of Technology Radar on Generative AI.

  • Why does this matter? “[…] the study aims to provide a comprehensive analysis of the topic, identifying potential privacy and data protection risks while assessing these scenarios against Brazilian Data Protection Law (LGPD).”

  • “The report examines the advances in generative AI and its impacts, with particular attention to personal data protection in Brazil. It also analyzes the underlying principles of the technology exploring aspects such as:

    • Web scraping, a practice that may involve the processing of personal data;

    • Generation of synthetic content that may be indistinguishable from personal data;

    • The relationship between personal data processing and generative AI systems.

    In addition, the study addresses issues related to the LGPD’s principles and highlights real-world examples of generative AI use in Brazil, including applications in the public sector, healthcare, and financial services.”

2) Data protection

• The German Federal Commissioner for Data Protection and Freedom of Information (BfDI) presented new recommendations for dealing with cookie banners. (The document is in German.)

  • Why does this matter? “The recommendations are based on the results of a nationwide representative survey commissioned by the BfDI […]. This shows that cookie banners often do not live up to the claim to informed decisions: Only 43 percent of Internet users know exactly what cookies are and what they are used for. 60 percent reject cookies across the board if this is possible with one click.”

• The Mecklenburg-Vorpommern´s State Commissioner for Data Protection and Freedom of Information (LfDI MV) published an AI guide for small and medium-sized enterprises. (The document is in English.)

  • Why does this matter? “[…] the AI Act focuses on high-risk systems, which is why the majority of existing guidelines also address these AI systems. Guidance tailored to AI systems with minimal or limited risk would be less complex. This guideline aims to fill this gap and focuses exclusively on AI systems with minimal or limited risk. It is oriented on the practical use and intended to provide direct support for the digitally sovereign, safe and data protection-compliant use of these AI systems.”

• The Polish Personal Data Protection Office (UODO) has prepared guidances to support privacy-compliant AI implementation. (The documents are in Polish.) Comments and experiences can be submitted to UODO until Septermber 30.

• The European Data Protection Supervisor (EDPS) has issued Opinion 18/2026 on the European Commission’s Proposal for a Regulation on the European Union Agency for Law Enforcement Cooperation (Europol), which would replace the current Europol Regulation, Regulation (EU) 2016/794.

  • Why does this matter? “The EDPS is particularly concerned by the serious risks to the right to the protection of personal data arising from the envisaged possibilities for Europol to process personal data pertaining to individuals with no established links to criminal investigations or proceedings, for an extensive and unspecified period of time. […]

  • […] the EDPS makes recommendations concerning strict purpose and storage limitation as well as legal certainty and foreseeability of the criteria upon which Europol would decide whether it is ‘relevant and necessary’ to process the personal data of individuals with no established connection to a criminal activity. The EDPS also comments on and provides specific advice on the proposed rules for access and query of Europol systems; the processing of personal data obtained directly from private parties; the supervision of data processing activities carried out by Europol staff in Member States and the EDPS’s cooperation with national supervisory authorities; the security of Europol services and tools; and other issues.”

• The Law Firm Noerr published a brief overview regarding the current debate in Germany on a possible ban on the private use of wearables with integrated cameras in public spaces. (Authors: Henrike von dem Berge and Marieke Merkle. The post is in German.)

  • Why does this matter? “The German discussion about smart glasses is at a crossroads. General bans or significant restrictions on use would – as was once the case with Google Street View – justify a special path. Neighbouring European countries are focusing on raising awareness and personal responsibility on the part of users. One legal approach to enabling independent private data collection in public is a contemporary, more literally-oriented interpretation of the household exception of the GDPR. What is still subject to exclusively private use in the sense of the household exception should be based on what is socially accepted as a private context in 2026. This avoids a rigid, outdated understanding of private technology use. Therefore, it should be critically questioned whether the ECJ's pre-GDPR case law on stationary private video surveillance should continue to serve as a benchmark for the use of new everyday technologies in public.”

3) Cybersecurity

• The Communications Security Establishment Canada is examining how AI can support cyber defence and help cyber security practitioners detect, understand and respond to cyber threats.

  • Why does this matter? “This first article focuses on detection engineering, the process of creating and testing rules that help cyber defenders identify suspicious activity on networks. […] The article outlines how the Cyber Centre has been testing frontier AI models in real operational environments. These hands-on evaluations have provided practical insight into how AI can support defenders working across complex systems, workflows, data, and cyber security challenges. By incorporating frontier AI into daily cyber defence workflows, the Cyber Centre is better equipped to keep pace with the rapidly evolving threat landscape. Using a practical test case, the article examines how AI can transform publicly available information about a cyber threat into detection rules. It demonstrates how AI can assist analysts with tasks such as drafting rules, identifying potential gaps, validating results against test and operational data, and preparing outputs for review. Throughout the process, human oversight remains essential, with analysts responsible for assessing outputs, validating results, and making operational decisions.”

• AI assistant hacked gym website in first known Australian autonomous cyber attack. (ABC)

  • Why does this matter? “Andrew asked his personal assistant to book him a spot in one of his gym's coveted morning classes.” The “AI assistant found a way to book the gym class months further in advance than the gym allowed, thanks to a vulnerability it discovered in the booking software. Then it went further, kicking someone out of the waiting list who was ahead of Andrew — something it was not asked to do.”

• According to the statement of the French Finance Ministry, “French taxpayers' ​data, both individuals and professionals, ‌were stolen in a cyberattack […].” (Reuters)

  • Why does this matter? “A "malicious actor" claimed on Wednesday ​he broke into the tax agency, ⁠General Direction of Public Finances, ​in late June […]. The data of ⁠678,000 ​users was stolen […].”

4) Digital Policy, Cloud and Data Strategy

• A report regarding the “Quantum computing’s growing presence in the corporate world” has been published.

  • Why does this matter? “In research commissioned by Fujitsu, FT Longitude, part of The Financial Times, surveyed 300 senior executives across industries and regions to assess current levels of awareness, readiness, and strategic intent, and to identify how leading organizations are positioning themselves to capture value while managing emerging risks.”

  • Key findings:

    • “96% of executives expect quantum computing to bring benefits to their organization at some point, and just over a quarter are already seeing some business benefits from their exploration.

    • 58% plan to include quantum computing in their strategic planning discussions this year.

    • 73% of public sector and defense organizations are actively assessing quantum computing use cases that could help them solve pressing problems, compared with only 32% of other sectors”

• The European Commission´s Joint Research Centre published a study, titled “Opportunities for young users on social media”.

  • Why does this matter? “[…] while it is true that social media use is associated with many risks and that minors are an especially vulnerable population, this practice also offer a wide range of opportunities touching to children’s rights to access to information, education and health tools, opportunities for civic participation, new environments for play and social interaction, for self-expression and improved accessibility for children with disabilities. […] The evidence gathered in this brief shows that, alongside well documented risks, social media platforms can provide minors with a range of concrete benefits that directly support several articles of the UN Convention on the Rights of the Child – notably the rights to education, information, participation, health and freedom of expression.”

• The 5G Observatory workshop explored Europe’s 5G progress, Digital Decade targets and future connectivity indicators as EU stakeholders assess the path from 5G to 6G.

  • Why does this matter? “The following key points emerged:

    • 1. Europe has largely achieved basic 5G coverage, but advanced 5G remains uneven.

    • 2. The next phase of 5G monitoring should focus on capability, availability, quality of experience and adoption.

    • 3. 5G standalone and private networks are key routes to 5G value creation, but scale up depends on clearer business cases and deployment models.

    • 4. The Observatory should keep core deployment indicators while selectively evolving towards 5G standalone, private networks, take-up, quality, value and readiness metrics. Future indicators should remain practical, comparable and proportionate.

    • 5. 6G monitoring should begin with readiness, spectrum, standardisation, research and innovation, use-case experimentation and emerging business models.

    • 6. The Observatory is a valuable monitoring tool that has kept pace with policy and market developments over the past decade. Ahead of forthcoming evolutions, driven by 6G, cloud and AI, it will continue playing an important role in supporting the Digital Decade reporting process.”

Share

D) Data, Technology & Company news

• Anthropic announced that it will include machine-readable marks in content that Claude generates.

  • Why does this matter? “Claude uses two complementary techniques to mark content generated and processed by Claude: (1) watermarks embedded in text, and (2) signed provenance metadata attached to files.”

  • “Machine-readable marks provide important signals about content, but it’s worth understanding their limitations across all content types.

    • A detected mark provides a signal that content was processed by Claude, but is not fully conclusive. […]

    • Lack of a detected mark doesn’t mean the content wasn’t AI-generated or processed. […]”

• Spotify introduces a new label for AI-generated artist identities.

  • Why does this matter? “[…] starting mid-September, you’ll begin to see an AI Persona badge on some artist profiles. The badge signals to listeners that an artist’s identity may be AI-generated and does not represent a real person. […] By default, Spotify will not include AI Personas in any editorial or algorithmic recommendations. That means you won’t see any music from AI Personas in your personalized recommendations, unless you follow AI Personas, for example.”

  

  Source: Spotify

• Mistral announced that it is advancing AI sovereignty “by offering enterprises and countries control over AI models, infrastructure, and compute capacity, ensuring regional compliance and reliability.”

  • Why does this matter? “The company is expanding open model access, introducing regional endpoints and priority tiers, and forming a coalition to secure long-term European AI compute capacity. With plans to build up to 1 GW of capacity by 2030, Mistral aims to provide a scalable, sovereign AI infrastructure that retains value and control for users.”

• “Canada-based BTQ Technologies and the Industrial Technology Research Institute (ITRI) have completed the first milestone in a multi-year program to validate a new chip architecture designed to accelerate post-quantum cryptography.” (Interesting Engineering)

  • “The technology is intended to provide hardware-based cryptographic acceleration for devices and systems that will need protection against future quantum computers. […] The architecture was tested within a TSMC 28-nanometre design environment, where researchers evaluated its ability to accelerate cryptographic operations while maintaining functional correctness. […] The key concept is to perform cryptographic operations inside the memory subsystem rather than moving data between separate processing and memory components. This approach is intended to reduce data movement, latency and power consumption.”

A) Regulatory developments

1) AI

• The AI Office of Ireland has been officially established under the AI Regulation Bill 2026.

  • Why does this matter? “The Act establishes Oifig IS na hÉireann (AI Office of Ireland) as an independent statutory body, which will act as Ireland's central coordinating authority for the implementation of the EU Artificial Intelligence Act, Regulation (EU) 2024/1689, and is an essential element of Ireland’s preparations for the supervision and enforcement of the EU AI Act.”

2) Data protection

• California’s Delete Act that forces data brokers to erase personal data became applicable as of August 1.

  • Why does this matter? “The law, authored by California Sen. Josh Becker, allows residents to request the deletion of personal information collected by data brokers. Becker said the measure is designed to give consumers more control over how their information is used.”

3) Digital Policy, Cloud & Cybersecurity

• The European Data Protection Supervisor (EDPS) published his Opinion on the proposal for the Cloud and AI Development Act.

  • Why does this matter? “The EDPS therefore strongly supports the objectives of the Proposal, i.e. to strengthen the Union’s cloud and AI ecosystem, reduce dependencies, increase operational resilience and sovereignty. […]”

  • “[…] The Union assurance framework may usefully add specific requirements relating to sovereignty, operational autonomy, resilience, public order, third-country access risks and service continuity. However, those requirements should build upon EU data protection law in order to avoid unnecessary duplication and legal uncertainty. To achieve this objective, the Proposal should further develop:

    • the relationship between the Union assurance criteria and audit evidence requirements […];

    • the interaction between the data localisation requirements […]; and

    • the relationship between the associated third-country mechanism [….]”

• The new CSAM Derogation was last week published in the Official Journal of the EU and is in force. New expiration date is 3 April 2028 (see Art. 11).

B) Enforcement actions

1) AI

• GEMA sued the US music AI developer Suno for copyright infringement in six musical works. (TechnoLlama) (The decision is available here in German.)

  • Why does this matter? “The Munich Regional Court largely found in favour of GEMA on the copyright infringement front, particularly on the reproduction and memorisation arguments. The court held that it had jurisdiction over both the alleged infringements occurring in Germany and the training carried out in the US. […] Although the court agreed that some part of the input phase could fall under the TDM exception, in this particular case they concluded that Suno’s use of the works for AI training infringed the reproduction right. […] So the court held that the TDM exception under German law did not apply here, mostly because the works had not been lawfully obtained, as there had been ripped from YouTube, and because valid rights reservations had been made, in other words, the authors had opted out of training. With respect to the US training, the court further concluded that the defendant could not rely on the US fair use doctrine […]. However, GEMA did not win all of its claims as the court rejected their separate claim that the defendant had infringed the right of communication to the public by merely offering the model itself. […]”

• The U.S. Court of Appeals for the Ninth Circuit issued a groundbreaking decision in Amazon.com Services, LLC v. Perplexity AI, addressing the legal status of so-called “agentic AI” tools. (For s summary, please see the post at Wilson Sonsini Goodrich & Rosati´s homepage.)

  • Why does this matter? “The Ninth Circuit held that Perplexity (through its AI agent) does not “access” Amazon’s computer system or website, as that term is understood under the CFAA* or its California analogue, the California Comprehensive Computer Data Access and Fraud Act (CDAFA). Therefore, Amazon was not likely to succeed on its claims against Perplexity under either statute, even if end users access Amazon.com through Perplexity’s Comet Browser. The court also emphasized that the CFAA is principally an anti-hacking criminal statute and courts should exercise caution before expanding liability under it to new technologies and contexts. […] An important lesson from the opinion is that operators of agentic AI technologies should avoid direct connections between their own computer systems and the third-party websites or systems that their tools are used to “access.” Beyond that, the details of how any given AI tool actually operates and is used will be essential in determining the risk of liability.” (*CFAA=Computer Fraud and Abuse Act)

2) Data protection

• The Federal Trade Commission (FTC), joined by Utah and California, sued Hims & Hers alleging that the telehealth provider shared consumers’ sensitive health information about medical conditions with third-party advertising platforms.

  • Why does this matter? “[…] the FTC and its state and local partners allege that Hims & Hers (Hims) fails to clearly disclose that it charges consumers for prescriptions almost immediately after they submit an intake form, despite telling consumers that they will be able to consult with a medical provider to find a treatment that is “right for them.” The FTC also alleges that the company has made it difficult for consumers to cancel subscriptions and misled consumers about keeping their health information private. The FTC alleges that Hims shared consumers’ health information with Meta, Snap and other third parties.”

3) Digital Policy, Cloud & Cybersecurity

• Meta was ordered to pay $567 million in New Mexico for teen mental health fund and change how its platforms function for young users after finding the company is to blame for harming children's wellbeing. (Reuters)

  • Why does this matter? Meta was ordered “to implement youth-safety measures, including monthly limits on teens' use of Facebook and Instagram, restrictions on notifications, tighter controls on adult contact with minors, safeguards for AI chatbots, and enhanced ​review of child sexual abuse reports, under a decree that will be in place for five years.”

  • Meta was also ordered “to prevent children ​in New Mexico from "engaging in romantic or sexualized interactions with Meta's artificial intelligence chatbots" and to prevent adults in New Mexico from using chatbots to simulate or discuss a sexualized interaction with a child.”

C) Opinions, guidelines, reports & other publications

1) AI

• The Center for Strategic & International Studies published a report comparing several U.S. state bills to international approaches to regulating and shaping frontier AI development, including the EU AI Act, and voluntary industry governance frameworks for frontier AI models.

  • Why does this matter? “The analysis, which extends through June 2026, reveals that U.S. states are serving as laboratories of democracy by trialing a variety of approaches to AI legislation. The most pro-regulatory versions of these experiments have failed to gain traction, whereas more modest approaches that mirror industrial practice have become law. These attempts could provide a blueprint for the U.S. government’s stated goal of putting into place a federal legislative framework that can preempt a state patchwork of laws and reduce the compliance burden for U.S. companies.”

    

    Source: CSIS report

• The Stanford Institute for Human-Centered AI (HAI) has published a policy brief, titled “The World Model and Spatial Intelligence Era: Governing AI Beyond Language”.

  • Why does this matter? “Key Takeaways:

    • World models are AI systems that build a working representation of an environment to predict how it changes in response to action. They could lower the cost of high-quality simulation, benefiting infrastructure planning, crisis response, experimentation, and embodied AI training.

    • No existing benchmark gives policymakers an adequate basis to evaluate a world model for safety-critical deployment. Closing that gap requires public investment in measurement science.

    • Policy built for existing AI-generated content and autonomous decision-making does not fully address the risk profile of world models. The distinctive question is whether a simulated environment matches physical reality closely enough to train or test another system or guide a real-world decision.

    • The scarcest input is action-labeled interaction data — robot trajectories and fleet logs that cannot be scraped from the web, which risks concentrated control. Public datasets should be an explicit target of federally funded research.

    • World models are dual use, with national security implications. By lowering the cost of capable autonomous systems, they could open military advantage to less-resourced entrants, making early leadership in world-model research, development, and governance an urgent national security priority.”

• UAE launched world’s first fully integrated AI-powered judicial platform. (Gulf News)

  • Why does this matter? “[…] the new platform is not intended to replace judges. Instead, it functions as an advanced legal assistant capable of analyzing case files, reviewing legislation, searching judicial precedents, and generating analytical insights that enable judges and legal professionals to reach decisions more efficiently while preserving complete judicial independence.”

  • “The AI-powered judicial platform is designed to integrate artificial intelligence across multiple stages of judicial proceedings, including:

    • Automated analysis of case files and legal documents.

    • Instant access to legislation and regulatory frameworks.

    • Rapid retrieval and comparison of judicial precedents.

    • AI-assisted legal recommendations and analytical reports.

    • Support in drafting legal memoranda and judicial documents.

    • Faster case processing and shorter litigation timelines.

    • Greater consistency in the application of legal principles.

    • Enhanced decision-making support without compromising judicial autonomy.”

  • “[…] the UAE’s initiative is distinguished by its fully integrated judicial ecosystem, bringing together multiple AI-powered legal functions within a single comprehensive platform rather than relying on isolated digital tools.”

• The new website, AI in Legal Education: Law School Policy Archive, launched by Andrew Perlman, dean of Suffolk University Law School, “catalogs public AI policies, teaching strategies, and curricular programs from 128 of the 196 U.S. law schools, organized into eight topic areas and derived from the schools’ own published documents.” (In Hungarian, please see at Jogaszvilag.hu, Wolters Kluwer.)

  • Why does this matter? Key findings can be categorized to the following topics:

    • “Prohibition is the default. […]

    • Mandatory AI instruction is spreading. […]

    • Assessment is changing. […]

    • Syllabus disclosure of AI. […]”

  • “[…] the site clearly addresses a gap in understanding how legal education is responding to AI, providing greater detail than had been available through scattered news stories or high-level surveys.”

• The Network Advertising Initiative released guidance outlining dos and don'ts regarding the implementation of AI and agentic workflows.

  • Why does this matter? “This guidance covers nine topics, each with practical do’s and don’ts:

    1. Inventory and enabling of AI use cases

    2. Advertising audience/segment review and activation

    3. Testing and monitoring of AI systems

    4. Disclosures about how AI systems are used

    5. Permissions and constraints applied to AI systems

    6. Choice and signal handling

    7. Oversight and logging for agentic AI systems

    8. Contracting and risk allocation between AI users and AI vendors

    9. Accountability”

2) Data protection

• The French Data Protection Authority (CNIL) issued guidance related to the obligations of media organizations that receive deletion requests from data subjects. (The document is in French.)

  • Why does this matter? “Any data subject has the right to request from a press organisation the deletion of personal data concerning him or her contained in a press article published online. However, this is not an absolute right: a balance must be struck between the interests involved.”

• The Dutch Data Protection Authority (AP) urged consumers to remain cautious when sharing sensitive health information on reproductive heath apps. (The document is in Dutch.)

  • Why does this matter? “In practice, it is not clear whether the apps share this information with, for example, advertising partners and whether users are properly informed about this. The AP advises to check what you give permission for when you install the app. If the information is unclear or there is no option to reject the sharing of data, for example, do not share information that you want to keep private.”

• Hamburg’s data protection commissioner, Fuchs warned against Meta smart glasses and said that “a ban is not ruled out”.

  • Why does this matter? “The Hamburg data protection commissioner Thomas Fuchs is responsible for Meta services in Germany. […] Fuchs also considers it quite possible that the glasses will be completely banned in Germany. The possession and sale of recording devices disguised as everyday objects is not allowed in Germany. And the Meta Glasses are, in Fuchs’ estimation, nothing more than camouflaged cameras. The Federal Network Agency would be responsible for such a ban. It is probably currently examining the further course of action. In the event of a ban, Meta would no longer be allowed to sell the glasses in Germany.”

• Australian Privacy Commissioner highlighted that they are giving “serious consideration to the issues raised by surveillance wearables and monitoring their market presence to understand if scrutiny and intervention is required or warranted.”

  • Why does this matter? “[…] The proliferation of smart glasses – and their future peers, such as wearable pins or advanced earbuds – would fundamentally alter our experience of interpersonal interactions, in both private and public spaces, […]. Without knowing, we could be filmed, recorded or photographed at any time. […] there will be exceptions to benign usage – where smart glasses users are able to use the tech in harmful ways to exploit or surveil vulnerable groups, such as children or victims of domestic violence, or for other untoward ends, such as corporate espionage, data theft, extortion or bribery. Beyond safety concerns, there is also the impact on community values and the public interest in privacy. In aggregate, the effects of mainstreamed surveillance wearables would be the emergence of new privacy risks, new safety concerns, and new societal norms.”

  • “It would also require consideration of whether we need new laws. Australia’s Privacy Act only applies to businesses and government agencies, not to individuals, and it only applies when those entities collect personal information.”

• The Information Commissioner’s Office (UK) published a survey, “Public Attitudes on Information Rights”. The primary goal of this survey wa to develop a reliable quantitative evidence base to measure progress on KPIs from the ICO25 strategic plan.

  • Why does this matter? “This research shows a broadly positive picture for the ICO in 2026, with rising awareness of information rights, improved satisfaction with organisations’ responses to rights requests, and higher awareness of the ICO itself. At the same time, the findings point to a more mixed picture on data privacy, with declining trust in formal advice sources and a significant minority saying their trust in organisations using their data has decreased over the last year. The research also highlights ongoing challenges with data breaches, low confidence in reporting spam, declining engagement on privacy notices, and declining optimism around some emerging technologies.”

    

    Source: Public Attitudes on Information Rights Survey 2026, Figure 8, p. 17

3) Cybersecurity

• Germany's Federal Office for Information Security (BSI) released a technical guide with cybersecurity recommendations to support Cyber Resilience Act compliance.

  • Why does this matter? “With a structured approach to risk-based selection of cybersecurity measures, the requirements of TR-03183-1 can serve as a guide for the CRA's class of standard products. Based on their risk analysis, manufacturers can identify what measures they should implement for an appropriate level of cybersecurity.”

• According to reports, “the White House does not plan to publicly release its new framework for evaluating advanced AI models […].” (Axios)

  • Why does this matter? “The voluntary framework has global implications for AI security, but details will only be made available to the companies that are part of the process.”

• “Anthropic’s Mythos 5 model created fake identities to try to convince a human to approve malicious changes to an open source project […].” (CNBC)

  • Why does this matter? “The incident happened during a cyber evaluation where the U.K.-based AI Security Institute (AISI) […]”

  • “The incident was discovered during routine cyber evaluations, with 17 actions coming from Anthropic’s Mythos and 2 from OpenAI’s GPT-5.6-Sol with cyber classifiers.

  • It comes after a series of cyber breaches carried out by models developed by Anthropic and OpenAI identified in recent weeks.”

• “[…] Meta has become the latest tech firm to say one of its AI models was able to connect to the internet and hack into another organisation's systems, during testing.” (BBC)

4) Digital Policy, Cloud and Data Strategy

• The European Commission has published a new study, “The EU’s Critical Digital Capacities: Deployment Beyond 2027”, revealing both strengths and gaps in Europe’s digital transformation ahead of the next Multiannual Financial Framework.

  • Why does this matter? “The study finds that next EU funding programme must address challenges around underinvestment, skills shortages, and market fragmentation, while building on existing strengths in green digital solutions, open source and a trusted regulatory and data protection framework.”

  • The study covers the following topics in its annexes:

    • Annex 3 - Advanced digital communications and connectivity

    • Annex 4 – Artificial Intelligence

    • Annex 5 - Blockchain and Distributed Ledger Technologies

    • Annex 6 – Cloud-Edge-IoT

    • Annex 7- Cybersecurity and digital identity technologies

    • Annex 8 – Data analytics and data sharing technologies

    • Annex 9 – High Performance Computing

    • Annex 10 - Microelectronics

    • Annex 11 – Next Generation Internet and Extended Reality

    • Annex 12 – Photonics

    • Annex 13 - Quantum

    • Annex 14 - Robotics

    • Annex 15 – Interoperability and GovTech

• The eSafety (Australia) published a report on the first experiences with social media age restrictions in Australia.

  • Why does this matter? “This report explores the early experiences of children, as well as their parents, three months after the commencement of Australia’s social media age restrictions.”

  • Key insights:

    • “The proportion of children (aged 10 to 15) owning a social media account declined from 52.4% at baseline to 42.1% at the three-month follow-up. […]

    • The primary reason children continued to hold age-restricted social media accounts at three months appeared to be ineffective implementation of age assurance measures by platforms. […]

    • There were early signals of redistribution of online activities among children at three months. […]

    • Parental awareness of children’s social media use declined at three months. […]

    • There was some evidence that perceived norms and attitudes towards social media had shifted at three months. […]

    • Parental support for and attitudes towards the age restrictions has remained consistent at three months. […]

    • At three months, most children reported that there was little to no change in their engagement with offline activities, behaviours associated with problematic online use, and their wellbeing. […]

    • There has been little change in family dynamics at three months. […]

    • There were some age and gender differences in children’s and parents’ early experiences of the age restrictions. […]”

Share

D) Scientific papers in AI, data protection & more

• “Architectural Implications of Agentic AI Workflows” (authors: Yang et al.)

  • Why does this matter? “[…] Guided by these findings, we derive implications for agentic servers and examine them through Agora, our prototype for commodity servers. Agora dynamically harvests idle CPU cores for co-located throughput work, while protecting agentic tail latency against tool spikes. It also oversubscribes GPU memory by placing more agents on each GPU, prefetching the next agent’s state to hide swap latency. To match the machine to the het erogeneous roles, Agora pools cores by role and applies affinity aware scheduling to restore locality. Finally, Agora automatically tunes all of these mechanisms to the running workload. These techniques substantially improve CPU and GPU utilization and per-server throughput while preserving agent tail latency. Our insights also identify key directions for future server architectures for agentic AI.”

• “Scientists have made the first viruses designed by artificial intelligence in a milestone that raises hopes for new medicines but also concerns over how to ensure the technology remains safe.” (The Guradian)

  • Why does this matter? “The ability to “rapidly design” genomes and tune them for specific bugs while overcoming resistance could “transform phage therapy” and “expand biotechnological toolkits”, the researchers wrote in the journal Science. […] But beyond the potential benefits, the scientists said the work raised “important biosafety, biocontainment and biosecurity considerations” and urged others who were designing whole genomes to “consult both safety and security professionals throughout the project”.”

    

  Source: “Generative design of bacteriophages with genome language models” (authors: King et al.)

E) Data, Technology & Company news

• “The European Commission is considering replacing the US technology underpinning a new digital recruitment tool with European cloud and artificial intelligence services […]” (Euractiv)

  • Why does this matter? “The tool, known as the Job Matching Application, is in the final stages of development. […] a Commission spokesperson confirmed the executive was considering replacing the underlying US digital services with European alternatives. […] The four successful providers under the framework are Germany’s StackIT and France’s OVHcloud, Scaleway and S3NS. […] The Commission is also considering replacing Anthropic’s AI model with a European alternative.”

• The European Commission and the SpaceRISE consortium concluded negotiations and signed an implementation agreement to roll out IRIS², the European Union's new flagship satellite constellation. First launches are expected by 2029.

  • Why does this matter? “The agreement, among other things, adds 66 satellites into low Earth orbit to the programme, bringing the main constellation to 348 satellites, and moving it from planning to full-scale deployment.”

  • “Once operational, the constellation will provide sovereign, secure and highly reliable connectivity for European governments, defence and security forces, and emergency services across Europe.”

• Chinese robot maker Unitree seeks to raise 6.1 billion yuan ($904 million) through its IPO in Sanghai. Unitree will become the first mainland-listed humanoid robot manufacturer. (Reuters)

  • Why does this matter? According to reports, Chinese humanoid robot manufacturers, including Unitree, has a 97% global market share.

• Google DeepMind introduced Gemini Robotics 2, “the intelligence layer powering the next generation of truly adaptable robots.”

  • Why does this matter? “Gemini Robotics 2 enables robots to reason through every movement, unlocking a broad range of tasks. For example, it can enable a humanoid to walk, crouch, stretch, and manipulate objects to clean up a cluttered room. It can even team up with other robots to finish the job faster. And this profound intelligence can also run locally on-device while seamlessly adapting to entirely new robotic bodies in just a few hours.”

A) Regulatory developments

1) AI

• The Digital Omnibus on AI has been published in the Official Journal of the EU.

  • Why does this matter? Timeline Adjustments:

    • 2 December 2026, the new prohibitions (see below) become applicable;

    • on 2 December 2026, the grace period ends for providers of AI systems already on the market to implement transparency solutions for AI-generated content (Article 50 transparency obligations becomes applicable as of August 2, 2026);

    • 2 August 2027 for the establishment of national AI regulatory sandboxes;

    • 2 December 2027 for high-risk AI systems listed on Annex III (stand-alone high-risk systems);

    • 2 August 2028 for high-risk AI systems listed on Annex I (high-risk embedded safety components).

    New Prohibitions:

    • Nudifier applications: ban on AI system that generates or manipulates realistic images, videos, audio or similar material of an identifiable natural person’s intimate parts, or of an identifiable natural person engaged in sexually explicit activities, without that person’s consent.

    • AI-generated CSAM: prohibition on AI system that generates or manipulates of child sexual abuse material.

    Further simplification:

    • Streamlining requirements for machinery and products already governed by sectoral safety laws.

    • Explicitly allows processing special categories of personal data when strictly necessary to detect and correct AI bias.

    • Extended regulatory exemptions to small mid-cap enterprises (up to 750 employees).

• The transparency obligations of the AI Act became applicable as of August 2. The Commission published guidelines on transparency obligations for providers and deployers of certain AI systems. AI Act’s transparency obligations start to apply on 2 August 2026.

  • Why does this matter? “Transparency obligations will help people recognise when they are interacting with AI or when content has been generated or altered by AI, reducing the risk of deception and manipulation. The guidelines clarify which providers and deployers must comply with the transparency obligations for interactive AI systems and the marking and labelling of AI-generated content.”

  • Practical Implications:

    • Providers and/or deployers must check how Article 50 disclosure and labeling requirements are applicable to them.

    • Organizations should review the Commission’s published guidelines, as they will set the practical benchmark for regulatory expectations. Failure to comply can result in fines of up to €15 million or 3% of global annual turnover.

• The AI Office can now enforce the AI Act's rules for providers of general-purpose AI (GPAI) models. (You can find more info about the enforcement framework of the AI Act here.)

2) Data protection

• In a letter sent to the Commission, the European Data Protection Board (EDPB) requested the review of EU-US Data Privacy Framework following the US Supreme Court´s decision in Trump v. Slaughter.

  • Why does this matter? “The EDPB respectfully notes that the European Commission, in the adequacy decision underpinning the EU-US Data Privacy Framework (‘DPF’), explicitly refers to the independence of the US authorities, including the FTC and that its five Commissioners may only be removed by the President for inefficiency, neglect of duty, or malfeasance in office. Given the potential consequences that the US Supreme Court’s judgment may have in the EEA and its considerable significance for the EDPB, the EDPB asks the European Commission to closely assess whether this development affects the functioning of Commission Implementing Decision EU 2023/1795 and would welcome relevant actions, including the continued sharing of information with the EDPB in a timely manner.”

3) Digital Policy, Cloud & Cybersecurity

• Proton launched an interactive map to show how age verification laws spread globally. (TechRadar)

  • Why does this matter? “Governments around the world are making age a condition for accessing certain parts of the internet. This page tracks where such laws are in force, where they are advancing, and how different countries are approaching the same policy goal.”

    

    Source: Proton, interactive map

• New Jersey bans ‘surveillance pricing’ for grocery items. (New Jersey Monitor)

  • Why does this matter? “The bill, dubbed the Fair Price Protection Act, is intended to forbid the use of surveillance pricing, in which prices are adjusted based on someone’s past purchases, online searches, and other personal digital data. The practice results in individual shoppers paying different prices for identical products purchased at the same time from the same place.”

B) Enforcement actions

1) AI

• xAI, owned by SpaceX, sued Minnesota to challenge a law that would ban so-called nudify apps in the state. (CNBC)

  • Why does this matter? “[…] attorneys for xAI wrote that the statute “imposes an overbroad, content-based ban on free speech and the tools of visual expression in a clumsy attempt to prohibit ‘nudification.’” […] The Minnesota law […] targets apps and websites that give people the ability to generate non-consensual sexualized imagery, levying $500,000 fines each time a user creates explicit deepfakes.”

2) Data protection

• The Italian Data Protection Authority imposed a fine of 2 million euros on Lusha Systems Inc., a US-based data broker operating a platform that provides paid access to ‘enriched’ information on individuals, such as their job titles, email addresses and telephone numbers.

  • Why does this matter? “The company processed the personal data of a large number of individuals in Italy without complying with the principles of lawfulness, fairness, transparency and data minimisation. In particular, the information provided to data subjects was neither clear nor easily accessible. Furthermore, with regard to the lawfulness of the processing, the Authority established that the pursuit of a legitimate interest did not provide an adequate legal basis.”

  • Practical Implications:

    • Organizations using third-party data enrichment services should verify that their vendors have a valid legal basis for processing personal data of EU individuals and are providing adequate transparency notices.

    • The Garante’s rejection of legitimate interest as a legal basis may signal a hardening enforcement posture that compliance teams should factor into vendor due diligence and data procurement strategies.

3) Digital Policy, Cloud & Cybersecurity

• The Commission fined AliExpress €550 million for breaching the DSA. The Commission preliminary found TikTok in breach of DSA for failing to ensure safe accounts for minors.

  • More details in the last edition of my DSA enforcement tracker:

• The U.S. law firm, Blank Rome is to face a proposed class action after ‌hackers targeted the firm in a May data breach. (Reuters)

  • Why does this matter? “The lawsuit, filed Monday in Pennsylvania federal court, was brought ​by Laura Delapaz, a California resident who said in her complaint that she ​was among 57,554 current, former and prospective Blank Rome clients whose personal information was compromised […]. […] A growing number of law firms have faced similar data ⁠breach ​lawsuits. Fox Rothschild; Wiley Rein; Pillsbury; and Kelley Drye are among the firms ​that have been sued in the past year. Some firms, including Gunster Yoakley & Stewart, Orrick Herrington & Sutcliffe, ​and Bryan Cave Leighton Paisner, have reached settlements in recent years.”

  • Law firm, WilmerHale was also sued over personal data breach.

C) Opinions, guidelines, reports & other publications

1) AI

• Government of Canada launched public consultation on AI transparency.

  • Why does this matter? “The public consultation supports the Government of Canada’s commitment to advancing AI transparency as outlined in Canada’s National Artificial Intelligence Strategy: AI for All and centres on:

    • detecting and identifying AI-generated content

    • helping individuals know when they are interacting with an AI system

    • improving access to consistent, understandable information about AI systems, including their development, capabilities and limitations

    • enabling the tracking of serious incidents related to AI systems

    • advancing ways to better track the activities and interactions of AI agents.”

• The European Parliamentary Reserach Service published a briefing, titled “The debate on AI and jobs”.

  • Why does this matter? “[…] Today, it is widely recognised that GenAI can both significantly enhance and degrade human skills, and cause labour market disruptions by transforming or displacing jobs. AI's impact on jobs depends on the degree to which these are exposed to AI, and is often estimated by the potential of individual tasks to be automated. Reports distinguish between augmentable, automatable and unaffected jobs. […] The most likely impact of GenAI is a profound transformation, rather than large-scale destruction, of jobs. Early evidence shows a strong impact on white-collar entry-level jobs and shifting regional labour-market dynamics, as AI's effects are more strongly felt in urban areas and in places where AI-adopting companies are located. […] Forecasts about how AI and digital technologies could reshape employment in European regions are cautiously positive. To reap AI's benefits and mitigate its negative effects on jobs, societal adaptations are needed. Beyond regulation and supportive policy, these start with training and education, to provide both current and future workers with the necessary skills, and include adapted social protection, social dialogue, and safeguards of workers' rights.”

• SAIL 2.0 framework for the management of AI-specific risks has been published.

  • Why does this matter? “The SAIL Framework provides a practical, lifecycle-oriented strategy to manage AI-specific risks and build trustworthy AI systems.”

  • “SAIL provides a holistic security methodology covering the complete AI journey, from development to continuous runtime operation. Built on the understanding that AI introduces a fundamentally different lifecycle than traditional software, SAIL bridges both worlds while addressing AI's unique security demands. SAIL's goal is to unite developers, MLOps, security, and governance teams with a common language and actionable strategies to master AI-specific risks and ensure trustworthy AI. It serves as the overarching framework that integrates with your existing standards and practices.”

• The University of Cambridge, in the framework of the Cambridge Programme on AI Science & Policy, published a reserach report about the use of AI by terrorists: “God has helped us, and so will AI”: How the Terrorist Group Boko Haram Uses Frontier AI.

  • Why does this matter? “How are terrorists using AI? Semi-structured interviews with 27 former Boko Haram members conducted in northeast Nigeria in 2025 and 2026 reveal unprecedented detail about AI-assisted terrorist activity primarily through 2024. This report finds that both factions of Boko Haram use frontier AI, including ChatGPT, Claude, Gemini, Grok, Meta AI, and DeepSeek, to assist in combat and day-to-day operations. This AI use is institutionalized through specialized units and internal training. It has aided in attack planning, weapons troubleshooting, and the design of explosive devices, as users have successfully circumvented some safeguards. This know-how was transferred through transnational jihadist networks, with Islamic State operatives delivering in-person training. Respondents expressed strong enthusiasm for AI and, in some cases, openness to mass-casualty weapons, though documented use remains conventional. Terrorist adoption of AI has thus advanced further and more systematically than prior analysis has recognized, making it a present and growing reality that warrants attention from policymakers, security communities, and AI developers.”

• UNESCO published a practical guide, titled “Integrating AI in TVET: A practical guide for institutions”.

  • Why does this matter? “This practical guide helps TVET* institutions to approach AI integration as a multistakeholder and institution-wide process. It shows how AI can be embedded across core areas of institutional practice to support meaningful change while mitigating risks.” (*Technical and vocational education and training)

2) Data protection

• The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) published a report on ransomware attacks to help organizations prevent such attacks.

  • Why does this matter? “A ransomware attack often does more than just shutting down computer systems. It could also jeopardise the personal data of hundreds, and sometimes millions, of people.” In the report, “[…] organisations share their experiences and the AP summarises the key lessons learnt from real-world cases.”

  • “The tips at a glance:

    • Make sure there is a good monitoring system in place to detect attacks early and to prevent access to your systems.

    • Draw up a plan (on paper) in case your organisation becomes the victim of a cyber attack. Test that plan on a regular basis.

    • Seek help from outside the organisation if you do not have the necessary expertise.

    • Know which data your organisation stores and from whom. Do not store data longer than necessary, because data you do not have, cannot be breached.

    • Provide the victims with information as soon as possible, allowing them to be vigilant right away. See the examples of warning messages on the AP website.

    • Ransomware costs organisations a fortune. Invest in a high level of cyber security and start by addressing the biggest risks first. Ensure you have reliable and up-to-date backups.”

  • Practical Implications:

    • Organizations should use the Dutch DPA’s real-world case lessons to benchmark their own incident response plans and demonstrate “appropriate technical and organisational measures” to supervisory authorities.

    • The emphasis on data minimization as a ransomware mitigation strategy reinforces that data retention reviews are not merely a compliance exercise — they also serve as a cybersecurity measure.

• Mozilla Foundation tested six popular period tracker apps to find out how they respect women´s privacy.

  • Why does this matter? Key takeaways:

    • “Using a period tracker isn’t neutral information

    • Watch out for the in-app browser

    • Safety and Privacy are sometimes just marketing

    • Choosing a private app does matter”

3) Cybersecurity

• The Commission published new guidance to support businesses’ implementation of the Cyber Resilience Act.

  • Why does this matter? “The new Commission guidance explains how these rules apply in practice. It clarifies which products fall within the scope of the Act, what constitutes a substantial modification, how support periods should be understood, and how to meet reporting obligations and risk assessment requirements.”

  • Practical Implications:

    • Manufacturers and developers of products with digital elements should review this guidance immediately, as the CRA’s vulnerability and incident reporting obligations under Article 14 take effect on September 11, 2026 — well before the main application date of December 11, 2027.

    • The guidance’s practical examples and use cases are particularly valuable. Although the guidance is non-binding, it will inform how market surveillance authorities interpret and enforce the CRA.

• The Forecasting Research Institute published a working paper, “Forecasting AI Cyber Risks and Capabilities: Results of a 2025 Pilot Study”.

  • Why does this matter? “A pilot study investigating how AI capabilities may affect near-term cybersecurity risk, focusing on two high-impact cyberattack pathways: data-damaging worm attacks and cyberattacks against the U.S. electrical grid.”

• Hugging Face published the full forensic timeline of OpenAI's rogue-agent breach.

  • Why does this matter? “This post walks through how the intrusion actually worked: the two initial-access vectors, how the agent pivoted and moved laterally, representative examples of the commands that were run and how we investigated with GLM 5.2 (an open-source model). […] We are publishing this level of detail because the technique matters more than the incident, as it reveals the emerging attack capabilities of the frontier agents, how they could be used by rogue actors, and how everyone should be prepared as defenders.”

• Anthropic also annopunced that “its AI models hacked into the systems of three organisations on their own, during a private security experiment.” (BBC)

  • Why does this matter? According to Anthropic, “in a review of our cybersecurity evaluation transcripts, we found three incidents in which a Claude model reached the internet from within or while interacting with a third-party evaluation environment, and then gained unauthorized access to the real systems of three different organizations.”

4) Digital Policy, Cloud and Data Strategy

• New method is developed that aims to keep kids safe from illegal AI-generated content.

  • Why does this matter? A new auditing approach is developed “that determines whether a model can produce CSAM* without prompting it. […] Their technique examines how the inner workings of a model have been adapted, but it never generates an output. By examining hidden representations, it can reliably infer whether a model has been specialized to produce harmful imagery.” (*child sexual abuse material)

• A new transparency report released by eSafety (Australia) reveals significant gaps in how major online platforms are tackling child sexual exploitation and abuse.

  • Why does this matter? “Apple, Discord, Google, Meta, Microsoft, Snap and WhatsApp are required to report to eSafety every six months over a two-year period on their compliance with the Basic Online Safety Expectations.”

  • “It is a particularly damaging form of online blackmail, where perpetrators share or threaten to share intimate material unless victims comply with demands. Reports of this abuse continue to rise. Between 1 July and 31 December 2025, eSafety received more than 2,000 complaints about sexual extortion, with young men aged 18 to 24 the most affected.”

  • “Gaps in reporting tools also persist across services like WhatsApp, iMessage, Discord and Google Messages, with some services lacking clear, accessible ways for users to report sexual extortion or child abuse or failing to provide dedicated reporting categories for these harms.”

  • “The report also highlights the challenges of detecting harm in private messaging and video environments, where both sexual extortion and livestreamed sexual abuse often occur.”

Share

D) Scientific papers in AI, data protection & more

• “DAO-enabled decentralized physical AI: A new paradigm for human-machine collaboration” (authors: Ballandies et al.)

  • Why does this matter? “We propose DAO-enabled decentralized physical AI (DePAI), a democratic architecture for coordinating humans and autonomous machines in the operation and governance of physical-digital systems. We (1) synthesize foundations in blockchains, decentralized autonomous organizations (DAOs), and cryptoeconomics; (2) connect DAO design with digital-democracy research on deliberation and voting, showing how each can advance the other; (3) position DAO-governed decentralized physical infrastructure networks (DePIN) within a vertically integrated stack that links energy and sensing to connectivity, storage/compute, models, and robots; (4) show how these elements specify workflows that couple machine execution with human oversight, enabling enhanced self-organization of techno-socio-economic systems, which we call DePAI; and (5) analyze risks, including security, centralization, incentive failure, legal exposure, and the crowding-out of intrinsic motivation, and argue for value-sensitive design and continuously adaptive governance. DePAI offers a path to scalable, resilient self-organization that integrates physical infrastructure, AI, and community ownership under transparent rules, on-chain incentives, and permissionless participation, aiming to preserve human autonomy.”

Source: “DAO-enabled decentralized physical AI: A new paradigm for human-machine collaboration” (authors: Ballandies et al.), Figure 1, p. 11

• “WEQA: Wearable hEalth Question Answering with Query-Adaptive Agentic Reasoning” (authors: Zhang et al.)

  • Why does this matter? “[…] we propose WEQA, a query-adaptive agent framework that unifies LLM reasoning with specialized wearable analytical and modeling tools. […] Experiments show that our framework is 24% more accurate than LLM and agentic baselines, and a blinded study with 12 medical experts and 8 users shows substantial gains in usefulness and clinical soundness.”

E) Data, Technology & Company news

• DeepSeek upgraded DeepSeek-V4-Flash-0731. (MarkTechPost)

  • Why does this matter? According to HuggingFace, “a model with 13B activated parameters now beats the 49B-active V4-Pro preview on all nine agentic benchmarks DeepSeek publishes — at a fraction of the cost to run.”

    

    Source: HuggingFace

• Moonshot AI (the creator of Kimi K3) was valued at $35 billion. (Yahoo!Finance)

  • Why does this matter? Kimi K3, “the 2.8 trillion-parameter model was the largest open-weight AI system ever released, with performance approaching frontier models from Anthropic and OpenAI at roughly half the API cost.”

• NVIDIA, with more than 70 other founding members, formed new alliance to build and share open tools that promote responsible use of and trust in AI.

  • Why does this matter? “Cybersecurity is among the top three beneficiaries of open source software. The Open Secure AI Alliance […] will work to remediate and disclose vulnerabilities using open technologies. […] That is the mission of the Open Secure AI Alliance: to ensure defenders everywhere have open, frontier tools they can trust and control.”

1. Regulatory & enforcement actions

• The Commission fined AliExpress €550 million for breaching the DSA.

  • What does this mean? “The European Commission fined AliExpress €550 million for breaching its obligations under the Digital Services Act (DSA) to diligently assess and mitigate risks relating to the sale of illegal, unsafe or counterfeit products on its e-commerce platform.”

  • What is the background to this? “AliExpress fell short of its obligation under the DSA to diligently assess the risk of dissemination of illegal, unsafe, or counterfeit products through its services in multiple ways:

    • AliExpress did not properly evaluate whether it had sufficient staff to review potentially illegal products. […]

    • AliExpress inadequately assessed how its recommender and advertising systems exacerbate the spread of illegal products. […]

    • AliExpress lacked quantitative metrics in its assessment. […]

    AliExpress failed to take effective measures to reduce the risk of dissemination of illegal products. The Commission identified, in particular, the following shortcomings:

    • AliExpress’ system to detect illegal products did not work properly. […]

    • AliExpress did not properly enforce its penalty policy for traders selling illegal products. […]

    • AliExpress’ product compliance checks could be easily circumvented through mis-categorisation of products. […]

    • AliExpress failed to adequately prevent the spread of counterfeit products. […]”

  • What are the next steps? “[…] AliExpress now has until 20 October 2026 to submit an action plan to the Commission. The plan must set out measures to remedy the breach of its obligations to assess and mitigate systemic risks. The European Board for Digital Services will have one month from the receipt of the plan to issue its opinion. The Commission will then have a further month to adopt its final decision and set a reasonable period for implementation. Failure to comply with the non-compliance decision may lead to periodic penalty payments. The Commission continues to engage with AliExpress to ensure compliance with the decision and with the DSA more generally.”

• The Commission preliminary found TikTok in breach of DSA for failing to ensure safe accounts for minors.

  • What does this mean? “The Commission preliminarily considers that TikTok – in line with the Guidelines on the protection of minors – should adjust the default settings of minors’ ‘public’ accounts, so that their content is, by default, visible only to TikTok users whom the minor has accepted. While older minors may have the option to share their content with a broader audience on TikTok, the content should under no circumstances be accessible to a global audience outside the platform. Moreover, TikTok should refrain from recommending minors’ content to other TikTok users through the For You Feed.”

  • What is the background to this? “On TikTok, minors can choose to set their account as ‘public’. This means that any user, including those without a TikTok account, may be able to view minors’ content. This setting also allows content published by ‘older’ minors (16-17 years old) to be recommended to any other TikTok user through the For You Feed. This exposure could result in unwanted contact from potential perpetrators and a risk that content can be used for cyberbullying. This feature potentially gives strangers a window into a child’s life. In addition, since what minors publish may stay online forever and follow them into adulthood, the feature comes with risks of potentially life-long consequences. Even when minors choose private accounts, their accounts can be easily found through the ‘following’ and ‘followers’ lists of other users, and their profile photos remain accessible to anyone, including users without a TikTok account. TikTok’s settings continue to expose them to risks – including unwanted contact, cyberbullying, or predatory behaviour.”

  • What are the next steps? “TikTok now has the possibility to examine the documents in the Commission’s investigation files and reply in writing to the Commission’s preliminary findings. In parallel, the European Board for Digital Services will be consulted. If the Commission’s views are ultimately confirmed, the Commission may issue a non-compliance decision, which can trigger a fine determined by the nature, gravity, recurrence, and duration of the infringement. The amount of the fine must be proportionate and shall in no case exceed 6% of a provider’s global annual turnover.”

• The European Board for Digital Services published its second report in cooperation with the Commission pursuant to Article 35(2) DSA on the

  most prominent and recurrent systemic risk as well as mitigation measures.

  • What does this mean? “The report identifies systemic risks - such as the spread of illegal content or threats to fundamental rights - occurring on very large online platforms. It also gives an overview of the mitigation measures taken by platforms to counter identified risks.”

  • What is the background to this? “Article 35(2) DSA sets out the requirement for the Board, in cooperation with the Commission, to publish comprehensive reports once a year. Article 35(2) DSA requires the identification and assessment of the most prominent and recurrent systemic risks in the Union and in the Member States, as well as best practices for their mitigation. This report is the second year’s edition of the Article 35(2) report. The first edition was adopted by the Board and published on 18 November 2025.”

  • What are the next steps? “The aim of this Article 35(2) report is to provide an overview of the most prominent and recurrent systemic risks that have been identified by the designated providers as stemming from their services, as well as by third-party stakeholders, such as academics, independent researchers, civil society organisations (“CSOs”), trusted flaggers and Out-of-Court Dispute Settlement Bodies (“ODSBs”), and an overview of certain risk mitigation practices. With regard to risk mitigation, this second edition, like the first one, focuses on reported practices without singling out any as “best” or “good” practice. Over time, and in light of accumulating experience with DSA implementation and enforcement in practice, future editions of this report will also aim to identify evolving best practices for the mitigation of systemic risks.”

• The European Commission has accepted X’s action plan to comply with transparency obligations and researchers’ access to data, under the DSA.

  • What does this mean? “To provide a functional advertisement repository, in line with the standards required by the Digital Services Act, X committed to implement the following corrective measures:

    • Enhance the repository’s search functionality by introducing additional search filters, such as those based on ad content and targeting criteria.

    • Display search results directly on the interface of the ad repository rather than on separate Excels.

    • Improve the repository’s response speed reducing the response time from 200 seconds to the minimum time technically achievable.

    • Provide additional information about advertisements, including the full content of the advertisement and the URLs to which advertisements redirect users.

    • Enable access to the repository via an API.

    Regarding the breaches concerning the obligation to grant researchers access to public data, X will take the following corrective measures:

    • Revise and improve its screening process for applications by researchers to access its public data via its API, ensuring eligible researchers are not excluded in error.

    • Provide eligible researchers with access to data free-of-charge.

    • Ensure timely access for eligible researchers, including to the appropriate volumes of data. X commits to reduce significantly the processing time for researcher applications, including by avoiding unnecessary exchanges with applicants.

    • Update its terms and conditions to explicitly state that eligible researchers are not contractually prohibited from scraping publicly available data.”

• The European Commission preliminarily found Meta in breach of the DSA for the addictive design of Instagram and Facebook. The investigation focuses on features such as infinite scroll, autoplay, push notifications, and the platforms' highly personalised recommender systems.

  • What does this mean? “Risk assessment: The Commission’s investigation indicates that Meta did not adequately assess the risks of its addictive design on the physical and mental wellbeing of users, including minors and vulnerable adults. For example, Meta did not consider certain design features of Instagram and Facebook, such as highly personalised recommendations, autoplay and infinite scroll, which constantly show users new content. These features fuel the user’s urge to keep scrolling and shift the brain into ‘autopilot mode’, contributing to unhealthy habits and compulsive use. Moreover, Meta disregarded available information about the time minors spend on Instagram or Facebook at night and how the optimisation of its different formats - such as reels and stories - could lead to excessive or compulsive use of the services.”

  • “Risk mitigation measures: Evidence also shows that Meta’s current mitigation measures failed to effectively tackle the risks stemming from its addictive design. For example, Instagram’s and Facebook’s time management tools, including those activated by default for teens, can be easily dismissed and do not lead to a meaningful reduction and control of the usage of the service. Moreover, the Commission considers that Meta’s parental controls are only effective if parents and guardians possess adequate technical expertise, as well as devote effort and time to understand them effectively. This undermines the efficiency of such measures in addressing the inherent risks posed by Instagram and Facebook’s addictive design.

    Meta’s awareness-raising measures, such as tips and links to mental health resources available via a separate ‘safety centre’ page, do not seem to sufficiently mitigate the risk of addictive design on Facebook and Instagram. At this stage of the investigation, the Commission considers that Meta needs to implement design changes to both Instagram and Facebook. For instance, by disabling key addictive features such as ‘autoplay’ and ‘infinite scroll’ by default, implementing effective ‘screen time breaks’, and adapting its recommender system to make it less engagement-oriented.”

  • What is the background to this? “The Commission’s preliminary findings today are part of its formal proceedings to investigate Meta’s compliance with the Digital Services Act, launched on 16 May 2024. […] This investigation also covers concerns about the age assurance measures Meta has put in place for minors below 13 years old, for which preliminary findings were adopted on 29 April 2026. Separately, the Commission continues its investigation into so-called ‘rabbit hole’ effects caused by the design of Facebook’s and Instagram’s recommender systems, which may exploit minors’ vulnerabilities and inexperience.”

  • What are the next steps? “Meta now has the possibility to exercise its right to defence. It may examine the documents in the Commission’s investigation files and reply in writing to the Commission’s preliminary findings. In parallel, the European Board for Digital Services will be consulted. If the Commission’s views are ultimately confirmed, the Commission may issue a non-compliance decision, which can trigger a fine proportionate to the nature, gravity, recurrence and duration of the infringement, capped at 6% of the total worldwide annual turnover of the provider.”

2. Guidelines, opinions, reports & more

• The European Commission has published the final report of the Special Panel on Child Safety Online.

  • What does this mean? Recommendations on age-appropriate use of social

    media and other digital services:

    

    Source: Child safety online, p. 17

  • Recommendations to protect children and adolescents online:

    • Propose a harmonised EU-wide access restriction to social media and other digital services for children under 13.

    • Introduce effective age-assurance systems to check age and underpin safety-by design and age-appropriate approaches to protect and empower minors online.

    • Extend and harmonise rules on key safety features in the design of social media and other digital services.

    • Shift the burden of proof to social media and other digital services providers to demonstrate that their products and services are safe for minors.

    • Strengthen enforcement and evaluation capacities.

    • Swiftly adopt measures to ensure social media and other digital services providers have clear obligations to prevent, detect, report and block child sexual abuse online, including in interpersonal communication.

    • Member States can introduce additional precautionary access restrictions to social media and other digital services as of 13.

    • Strengthen the enforcement of rules on researchers’ access to and scrutiny of data.

  • Recommendations to empower children and adolescents online:

    • Expand safe opportunities for minors to actively participate in shaping the social media+ environment.

    • Strengthen complaint mechanisms and consumer rights for children and adolescents.

    • Mainstream digital education and literacy actions for minors, parents and caregivers, teachers and educators.

    • Create more opportunities and adequate infrastructure to support offline activities.

    • Promote the co-creation of Guidelines for Parents.

    • Ensure sufficient public funding and common standards for civil society organisations and peer counselling.

    • Make available long-term funding for European large-scale longitudinal research and continue supporting randomised control trials.

  • What is the background to this? “The panel has brought together young people and experts from across the EU, including in health, neuroscience, psychology, computer science, child rights, and digital literacy. From March to June 2026, the panel met three times to explore both the opportunities and the risks of children spending time online. Discussions looked at how to better support parents and caregivers, while highlighting key lessons and good practices from across the EU and beyond.”

• The DSA Observatory published an analysis, “Platform Governance and Technology-Facilitated Gender-Based Violence: Positioning the DSA in the EU’s Legal Framework”

  • What is it about? “This post examines technology-facilitated gender-based violence (TFGBV) as a systemic phenomenon shaped by platform design and cross-platform ecosystems, and maps the main EU legal instruments available to address it. It argues that while the Digital Services Act’s systemic risk framework is particularly well suited to tackling the structural drivers of TFGBV, its promise has yet to be realised in practice through implementation and enforcement.”

• The bff (Federal Association of Women’s Counselling Centres and Women’s Emergency Hotlines in Germany) published a policy paper on the Digital Services Act and Digital Gender-Based Violence. (The policy paper is in German.)

  • What is it about? “Platforms decide on a daily basis how visible violence is – and how well those affected are protected. Our new policy paper shows how large online platforms have so far failed to adequately implement their obligations under the Digital Services Act (DSA) when it comes to (digital) gender-based violence. On the basis of the risk analyses according to Art. 34 DSA of platforms such as Instagram, TikTok, Snapchat, Pornhub and XVideos, we analyse key protection gaps in risk analyses, reporting channels and contact points. We show why gender-based violence is systematically trivialized, how manipulative designs prevent those affected from reporting – and why violence in the social environment continues to remain invisible. The paper formulates concrete, feminist recommendations on Art. 12, 16, 34 and 35 DSA: for binding standards, intersectional risk analyses and reporting channels that are actually easily accessible.”

3. Further DSA resources

• DSA Transparency Database

• DSA whistleblower tool

• The enforcement framework under the DSA

• List of designated very large online platforms and search engines under DSA

• Transparency reports of VLOPs and VLOSEs

• European Board for Digital Services

• Digital Services Coordinators

• Trusted flaggers under the DSA

• The Code of Conduct on Disinformation

• The Code of conduct on countering illegal hate speech online +

• EU Disinfo LAB

A) Regulatory developments

1) AI

• In a Decree of the Prime Minister of Vietnam, “high-risk” AI systems under Vietnam’s AI Law and implementing decree have been formally identified. (See Hogan Lovells Cadwalader´s overview about the Decree and its possible implications for developing, supplying or deploying AI in Vietnam.)

  • Why does this matter? “This is a significant development because only AI systems meeting the specific criteria set out in this taxonomy will be subject to Vietnam’s enhanced compliance obligations.”

2) Data protection

• The Commission found that Republic of Korea continues to provide an adequate level of protection of personal data.

  • Why does this matter? “The Commission concluded today its first review of the 2021 adequacy decision for the Republic of Korea, which allows the free flow of personal data from the EU to this country. […] The EU and Korean data protection frameworks have converged further, notably following amendments to South Korean law that strengthened the rights of data subject. The report also lays out recommendations to further reinforce some of the safeguards provided by the South Korean framework, in particular with respect to data transfers to third countries and enforcement. […] Mutual data flows between the EU and Korea benefit more than 500 million people. They also enhance the benefits of a trade relationship worth more than €150 billion per year.”

  • Practical Implications:

    • Companies transferring personal data between the EU and Korea can continue to rely on the adequacy mechanism without needing to implement Standard Contractual Clauses or other Chapter V GDPR transfer tools for that data flow.

    • Because the Commission flagged onward transfers to third countries and enforcement as areas for further reinforcement, compliance teams should monitor for follow-up amendments to Korean law.

3) Digital Policy, Cloud & Cybersecurity

• France´s parliament has approved a ban on social media for under-15s from January 2027. (BBC)

  • Why does this matter? “The law will mean everyone in France must verify their age to access social media and comes as the UK and EU are developing their own limits in response to concerns for children's mental health.”

  • Practical Implications:

    • Social media platforms operating in France should begin scoping age verification mechanisms well ahead of the January 2027 deadline.

    • Privacy teams should evaluate the data protection implications of any age verification method chosen against GDPR requirements, as these methods often introduce new categories of sensitive personal data processing.

    • Given parallel efforts in different jurisdictions, multinational platforms should track potential divergence in age-verification standards across jurisdictions to avoid a fragmented, jurisdiction-by-jurisdiction compliance approach.

• The Justice Ministry of Japan has come up with a draft report calling for the protection of the voices and images of famous individuals as the use of generative AI grows.

  • Why does this matter? “If an act affects a person’s feelings of honor and peace of mind beyond a tolerable limit, it could constitute an illegal act, according to the draft. […] The draft also noted criteria for determining the similarity between the voices of famous individuals and those created by generative AI as well as potential violations of the “right of publicity,” which allows celebrities to control the commercial value of their portraits.”

B) Enforcement actions

1) AI

• US appeals court overturnd Clearview AI settlement. (Reuters)

  • Why does this matter? The court “did not object to the settlement’s unique structure, which gave consumers a potential stake in Clearview’s future value, but ruled that a segment of class members ​were inadequately represented.”

  • “Clearview faced allegations that it scraped billions of facial images from the ​internet and sold the ​information without consent, ⁠violating an Illinois biometric privacy law. Clearview denied any misconduct.”

  • Note: The need for a prohibition on the creation and expansion of facial recognition databases through untargeted web scraping in the EU (see Art. 5 of the AI Act) was partly based on the activities of Clearview AI. Although regulatory and judicial proceedings have been ongoing against the company for years, the company continued its activity (according to a BBC article published in October 2023, Clearview AI has collected about 30 billion images from the internet into their database, and according to news reports, more than 1 million search requests were initiated by the police in the US until 2023).

2) Data protection

• The European Data Protection Board (EDPB) has published a binding decision under Art.65(1)(a) GDPR concerning a dispute submitted by the Belgian Data Protection Authority about a complaint against Vlaamse Radio-en Televisieomroeporganisatie (VRT), a public broadcasting company based in Belgium. The complaint was lodged with the Austrian DPA by the Austrian-based NGO Noyb on behalf of an individual. It concerns the use of cookie banners on the website of VRT. The Belgian DPA acted as the lead supervisory authority (LSA). (The fuill decision is available here.)

  • Why does this matter? “[…] the EDPB instructed the LSA not to dismiss the complaint, but to assess it instead on its merits and to submit a new draft decision to the CSAs* under Art.60(3) GDPR.” (*CSA: Concerned Supervisory Authority)

  • Practical Implications:

    • Organizations relying on cookie banners should treat this decision as a signal that lead supervisory authorities face growing pressure to fully substantively assess cross-border cookie complaints, increasing the likelihood of enforcement actions.

    • Compliance teams should proactively audit cookie banner design and consent flows.

• The French Data Protection Authority (CNIL) has issued 23 new sanctions (19 of which originate from complaints) since January, 2026 under the simplified procedure due to excessive video surveillance, cookies, non-respect for the rights of individuals or lack of cooperation with the CNIL.

  • Why does this matter? “As a reminder, video surveillance cameras installed in workplaces, whether or not they are open to the public, must respect the privacy of employees. Under no circumstances should the cameras permanently film employees if no exceptional circumstances justify it.”

  • “[…] the CNIL found that the information banners relating to cookies did not include complete information (lack of information on the purposes of the cookies and the data controller, on how to refuse or withdraw consent). […] Some organizations also placed cookies subject to consent (this is the case, for example, advertising cookies) before any action on the part of the user or did not offer a way for the user to refuse cookies as simply as to accept them.”

• Korea´s privacy watchdog fined TikTok 10.3 billion won ($7 million) for unlawfully collecting and using users´ behavioral data from third-party services to personalize advertisements. The watchdog ordered corrective measures against two Apple subsidiaries and fined them a combined 252 million won for personal information violations, such as collecting voice recordings and transcripts of users of the company´s Siri voice assistant without consent. (The Korea Times)

3) Digital Policy, Cloud & Cybersecurity

• The Commission fined Google €890 million for breaches of the Digital Markets Act.

  • Why does this matter? “[…] the European Commission took two decisions finding non-compliance by Google with the Digital Markets Act (DMA) for self-preferencing its own services on Google Search, and for putting in place restrictions on businesses to direct consumers to alternative, often cheaper, purchase channels on Google Play (steering). In this regard, the Commission issued Google a fine of €460 million and a fine of €430 million respectively.”

• A coalition of 42 attorneys general announced a settlement with the bankruptcy trustee for direct-to-consumer genetic testing company 23andMe.

  • Why does this matter? “This data breach exposed a wide range of data about 23andMe customers, including in some cases genetic ancestry information, and subsets of this data were subsequently published for sale on the dark web.”

C) Opinions, guidelines, reports & other publications

1) AI

• ​​​​​​The International Telecommunication Union (ITU), the UN agency for digital technologies, announced a new initiative to develop frameworks for trusted digital identity and to ensure that the behaviour of AI agents remains trustworthy and accountable throughout their lifecycle.

  • Why does this matter? “While agentic AI promises major gains in productivity, it also introduces new risks ranging from autonomous agents impersonating people or organizations, to taking unauthorized actions across interconnected systems. The ITU Focus Group will address these challenges by developing frameworks that preserve meaningful human control for tasks such as executing financial transactions and operating critical infrastructure.”

  • Practical Implications:

    • Legal teams drafting AI agent deployment policies should track this initiative closely, since frameworks addressing agent impersonation and unauthorized cross-system actions may eventually shape liability allocation and identity verification requirements for agentic AI products.

• The Center for Security and Emerging Technology (CSET) published an analysis on the U.S. workforce directly involved in AI system developments, separating it from people who merely use AI tools or whose roles may be affected by AI.

  • Why does this matter? “This report […] presents initial findings on the size and share of AI development jobs* in the U.S. labor market.” (*“We define AI development jobs as roles that require specialized knowledge, skills, and abilities and directly contribute to the technical development of AI systems.”)

  • Main findings:

    • “Approximately 1.6 million AI development job postings in the United States since 2010, including 331,445 postings in 2025.

    • Approximately 519,000 AI development workers in the United States as of March 2026.

    • AI development roles are a small portion of the total U.S. workforce, accounting for less than 1% of both total labor demand and employment.

    • AI development is concentrated in highly technical occupations, although among these occupations the proportion of roles that directly support AI development varies widely.”

• The OECD and the European Commission published an AI Literacy Framework for Primary and Secondary Education.

  • Why does this matter? “[…] This publication establishes a common framework for AI literacy, outlining desired outcomes for primary and secondary learners and guiding stakeholders in supporting those outcomes both inside and outside the classroom.”

• The trainees of the European Data Protection Supervisor and the European Data Protection Board organised a conference exploring the growing role of AI in modern recruitment and HR processes. If you missed it, you can rewatch the recording of the conference here.

  • Practical Implications:

    • HR and compliance teams deploying AI in recruitment should note that AI-driven hiring tools intersect both GDPR (automated decision-making, profiling) and, where applicable, AI Act high-risk employment use case obligations, warranting a combined privacy and AI compliance review rather than a siloed assessment.

2) Data protection

• The Spanish Data Protection Authority (AEPD) published guidance on “Accuracy, suitability and quality of data in processing personal data with Artificial Intelligence”.

  • Why does this matter? “This technical note discusses the application of these concepts (accuracy, minimisation, suitability and data quality) in the context of processing to which the GDPR applies. It is aimed at controllers, processors and DPOs, as well as for those involved in the development, testing and maintenance of products or services that require access to personal data sets, such as many types of AI models and systems.”

  • Practical Implications:

    • Organizations should use this guidance as a practical checklist for documenting data accuracy, minimization, and suitability assessments during model training and testing, since regulators are increasingly expecting demonstrable data quality controls specific to AI processing.

    • Accuracy and quality criteria should be implemented into vendor due diligence and data processing agreements.

• Singapore´s PDPC issued Guidance for Organisations on Responsible Use of Personal Data in Generative AI.

  • Why does this matter? “Organisations can tap on these Guidelines to understand how to responsibly collect and use personal data for GenAI development, especially in situations involving web-scraping and the re-use of data provided for non-GenAI purposes (User Data). The Guidelines also outline the data responsibilities of key GenAI stakeholders and how organisations should handle individual requests concerning the processing of their data for GenAI.”

3) Cybersecurity

• As part of its annual report on data breaches, the Dutch DPA (AP) raised concerns regarding AI’s impact on cyberattacks.

  • Why does this matter? “The rapid growth of artificial intelligence (AI) is increasing the risks of cyberattacks. There is a growing risk of phishing and data breaches. […] Organisations must take action now and get their digital security in order, according to the AP. Only in this way can they protect people’s data against increasingly sophisticated forms of cybercrime.”

  • Practical Implications:

    • Security and privacy teams should update phishing-awareness training and technical controls to account for AI-generated social engineering.

• OpenAI acknowledged that “two of its most capable AI models were responsible for the cyberattack targeting AI startup Hugging Face.” OpenAI and Hugging Face partnered to address security incident during model evaluation.

  • Why does this matter? “The co-founder of Hugging Face, a technology start-up that was hacked after some of OpenAI's most advanced artificial intelligence (AI) models went rogue, said on Thursday that the incident is “a wake-up call” for the industry.” (BBC)

  • As Clem Delangue, Co-founder and CEO, Hugging Face also added, “this incident, possibly the first of its kind, proves a point we´ve long believed: AI safety won´t be solved by any single company working in secret. It will be solved in the open, collaboratively, with broad access to AI for every defender, everywhere.”

• The White House launched Gold Eagle Initiative for cybersecurity vulnerability coordination.

  • Why does this matter? “GOLD EAGLE is a force multiplier, enabling government and industry to collectively identify risks, prioritize action, and strengthen the resilience of the systems that power our economy, national security, and daily life.”

• The European Parliamentary Research Service published a briefing on how the EU can respond to hybrid threats.

  • Why does this matter? “As security challenges increasingly overlap across civilian and military domains, the EU and the North Atlantic Treaty Organization (NATO) aim to ensure complementarity between the EU’s regulatory and civilian tools and NATO’s defence and military capabilities through improving coordination and enhancing situational awareness. The European Parliament emphasises that hybrid threats, mainly from Russia, China and Belarus, represent an escalating security challenge for the EU, and calls for a comprehensive EU response, stronger EU–NATO coordination, enhanced resilience and civil preparedness, targeted countermeasures, and closer cooperation with partner countries.”

  • Practical Implications:

    • Companies in critical sectors (energy, telecom, finance) operating across EU member states should anticipate increased regulatory convergence between civilian cybersecurity frameworks and EU-NATO coordination mechanisms, which may bring new reporting or resilience obligations tied to hybrid threats.

4) Digital Policy, Cloud and Data Strategy

• The Reuters Institute published its Digital News Report 2026.

  • Why does this matter? Main findings are as follows:

    • “1. Social media and video networks overtake news websites and apps

      […] social media and video networks are for the first time the single most widely used way of accessing online news (used by 54% of all respondents), ahead of news organisations’ own websites and apps (51%). This shifting composition of news consumption is happening among all age groups.”

    • “2. AI chatbots as a new frontier in intermediated news consumption

      The use of AI chatbots for news is growing quickly but not as quickly as AI use for other purposes: 10% of people use AI chatbots for news, up from 7% last year. […]”

    • “3. Online video marches on

      For the first time, a majority of people now watch online news video in all 48 Digital News Report markets: 77% of people globally consume online news video each week. […] The first wave of social media growth hit newspapers hardest. Now the second wave is affecting news organisations’ TV and video interests. TikTok (growing fastest from a small base, used by 20% globally for news) and Instagram (more modest growth, but a more significant presence – 26% usage for news) are the fastest growing video-led networks and they are driving much of the change together with YouTube (34% for news). Facebook remains the biggest platform overall for news consumption (used by 43% this year), reversing recent declines.”

    • “4. Creators at the forefront of video growth

      Around a quarter (27%) of respondents globally get some news from news-focused individual creators or influencers, and almost half (46%) get some news from creators of any type. […]”

    • “5. Interest in news falling

      […] A quarter (25%) of respondents are now casual or passive news users who typically only consume news once a week and say they have little to no interest in it, up from 16% in 2021. […]”

    • “6. Trust in news at a low

      Trust in news has fallen in 29 of our 48 markets this year, resulting in a drop overall to the lowest level we have recorded since we started to measure trust in 2015 (37%). […]”

    • “7. Paying for news also challenged by the drift away from direct consumption

      The percentage of people paying for access to online news in the basket of 20 countries we track is unchanged at 17%. Growing reader revenue is likely to prove harder as the flow of people into the subscription funnel coming to news websites and apps reduces. […] Significant numbers of people are supporting non-traditional news outlets financially. People mainly pay for news for the direct benefits they get from the content they want to access (81% say this is at least part of the reason for paying). But almost half (46%) of respondents who pay for news also express values-based motivations for paying (such as supporting journalism because of its importance to society) and some news organisations are capitalising on this.”

    • “8. Enduring support for impartiality as an ideal…

      […] Almost half (45%) of respondents still prefer news which does not take sides, and a similar share (46%) also believe consuming news which does not take sides is best for others in society. […]”

    • “… But misgivings about the reality of news

      […] In 26 countries with significant public service media (PSM) news providers we find variations in agreement with the proposition that public service news has a positive social impact. Across these 26 PSM markets overall, people in the aggregate believe that public service news has a positive impact on life in their countries (37% positive against 22% negative), but this is not the case everywhere. […]”

Source: The Reuters Institute´s Digital News Report 2026, p. 8

Share

D) Scientific papers in AI, data protection & more

• “Strategic Decision Support for AI Agents” (authors: Kiyani et al.)

  • Why does this matter? “Traditionally, decision support studies how humans use machine learning models to make better decisions. In modern agentic systems, this division of roles is increasingly reversed: AI agents act on behalf of users, while humans and tools becomes support mechanisms around them. […] Departing from the classical view of decision support, we revisit its two basic principles, the cost–value tradeoff of seeking support and the role of uncertainty quantification, in a setting where AI agents are the central actors. We propose a framework for strategic decision support for AI agents through an optimization problem that minimizes support usage subject to controlling a counterfactual missed-support error: the probability that the agent acts alone on instances where support would have materially improved its output. […] we develop an online algorithm that adaptively thresholds such a score and uses randomized exploration to control missed-support error without distributional assumptions. We further introduce a calibration-on-the-fly method that reduces unnecessary support calls online. […]”

• “Verbalizable Representations Form a Global Workspace in Language Models” (authors: Gurnee et al.) (Please find an overview about the key findings of the research paper here.)

  • Why does this matter? “[…] we observe that language models maintain a privileged set of internal representations, available for report, modulation, and flexible internal reasoning, atop a much larger volume of automatic processing. We identify these representations using a new interpretability technique, which surfaces the concepts a model is poised to verbalize at any point in its processing. Measuring and intervening on these representations provides us a window into a model’s thought processes, uncovering internal reasoning and reactions that do not appear in its output.”

E) Data, Technology & Company news

• Proton has revealed Lumo 2.0, its AI alternative to AI chatbots, like ChatGPT, Claude, and Gemini, focusing on privacy.

  • Why does this matter? “[…] it runs on Proton’s fully European infrastructure, protected by Swiss privacy laws and zero-access encryption.”

• The Swiss Armed Forces decided to start using OpenDesk, an open source alternative to Microsoft Office365. (Heise Online)

  • Why does this matter? “According to the report, the Swiss military fears that sensitive military information could ultimately fall into the hands of the US government through this detour. The head of Cyber Command, Simon Müller, points out that Microsoft's cloud-based Office 365 package is not suitable for an army with the highest demands on confidentiality, availability, and integrity. As long as corporations are subject to laws such as the US Cloud Act, they cannot be used for certain military contexts. The concern about hidden data leakage to foreign intelligence agencies like the NSA weighs heavily. The current geopolitical situation, in which digital infrastructures are increasingly being instrumentalized as geopolitical weapons, adds urgency to the issue.”

The strategic rationale is clear. Ottawa has committed roughly C$81.8 billion over five years to modernize its armed forces, spending historically directed toward U.S. contractors. Amid deteriorating relations with Washington - marked by the Pentagon’s suspension of the Permanent Joint Board on Defense and persistent trade friction - Canada is diversifying its defense-industrial partnerships. Canadian Prime Minister Mark Carney framed the shift in geopolitical terms: “In a dangerous and divided world, Canada and Europe are elevating our defence partnerships to rapidly procure new equipment and technology, accelerate NATO targets, and catalyse tremendous opportunities for our defence manufacturers. Canada’s participation in SAFE will fill key capability gaps, expand markets for Canadian suppliers, and attract European defence investment into Canada.” Concrete negotiations with Sweden’s Saab for surveillance aircraft, expanded cooperation with Poland and an order of 12 submarines from Germany illustrate this change of policy, while Montréal-based Marconi Technologies secured the first SAFE-funded contract granted to a Canadian company, supplying tactical radios to the Polish military.

Commercially, the Comprehensive Economic and Trade Agreement (CETA) continues to anchor bilateral economic relations, with two-way goods trade reaching approximately €81 billion and services trade exceeding €51 billion since provisional application began in 2017. At the fifth CETA Joint Committee meeting in March 2026, the parties adopted expedited arbitration procedures to improve SME access to dispute resolution and extended mutual recognition of pharmaceutical good manufacturing practices to active ingredients. An agreement on mutual recognition for architects (MRA) also entered into force at the end of 2025, easing professional mobility. The Canada-EU Strategic Partnership on Raw Materials, operational since 2021, positions Canada as a critical supplier of minerals essential to European aerospace, defense, and green-transition priorities. These commercial linkages, growing over seventy-five percent in goods trade since CETA’s application, reflect deepening economic interdependence.

Share

In a less publicized but legally significant development, Canada recognized the European Public Prosecutor’s Office (EPPO) as a supranational prosecutorial authority with an effect from mid-2026. This recognition enables the EPPO - the EU’s independent body responsible for investigating fraud, corruption, and cross-border VAT offenses affecting EU financial interests - to request judicial assistance directly from Canadian authorities in its own name, bypassing the slower channels of traditional mutual legal assistance treaties.

The above engagements undelines the statement that Canada is “the most European of non-European countries”.

Perhaps the most forward-looking dimension of the partnership concerns digital cooperation. The EU-Canada Digital Partnership, launched in late 2023, covers AI governance, semiconductor supply-chain resilience, quantum technology, cybersecurity, and data governance. An artificial intelligence cooperation agreement was finalized between Canada and the EU in late 2025. In March 2026, the parties formally opened negotiations for a dedicated Digital Trade Agreement intended to prohibit unjustified data-localization requirements, ban customs duties on electronic transmissions, and establish common rules for e-signatures, e-contracts, and consumer protection. EU Trade Commissioner Maroš Šefčovič captured the ambition: “By launching negotiations on a Digital Trade Agreement, we are ready to take the EU-Canada partnership to the next level. Already more than 40% of our €51 billion in services trade is delivered digitally. And data flows power far more than tech companies – no modern economy runs without trusted, secure data. If CETA laid the foundation, a Digital Trade Agreement will build the next floor.” With over forty percent of bilateral services trade already delivered digitally, the economic stakes are considerable. Analysts have suggested that a “well-designed DTA could serve as a blueprint for reconciling economic openness with regulatory integrity, fostering a single data area among other like-minded partners“. For businesses on both sides of the Atlantic, the mid-term implications could include greater legal certainty for cross-border digital operations, improved interoperability of digital frameworks, and enhanced digital cooperation.

A) Regulatory developments

1) AI

• The European Commission has presented an Action Plan on Cybersecurity and Artificial Intelligence to support the safe and responsible use of AI while strengthening Europe’s cybersecurity.

  • Why does this matter? “[…] the Action Plan sets out a coordinated approach to help Member States, businesses and public authorities benefit from the opportunities offered by AI while addressing the new risks it creates. It focuses on 3 complementary objectives:

    1. Promoting the safe and responsible use of advanced AI

    2. Reinforcing the EU’s cybersecurity and resilience

    3. Scaling up Europe’s AI capabilities for cybersecurity.”

• The Chinese Interim Measures for the Administration of AI Anthropomorphic Interactive Services took effect on July 15, 2026.

  • Why does this matter? “The Measures mark a significant expansion of China’s AI governance from content security to emotional and social relationship safety.”

2) Data protection

• The European Parliamentary Research Service published a briefing about the possible directions of regulating data rentetnion rules, applicable in the telecommunication sector for law enforcement purposes.

  • Why does this matter? “Despite judicial and now-defunct legislative efforts to harmonise data retention practices across the EU, national data retention regimes remain fragmented, with some countries adopting their own rules and others none at all. Law enforcement authorities report operational difficulties, while service providers face significant compliance burdens and costs. Although the Court's case law has clarified the general principles governing data retention, important practical details remain unresolved. In response, the European Commission is assessing the need for a new harmonised EU framework, with a proposal potentially forthcoming. […]”

3) Digital Policy, Cloud & Cybersecurity

• A report adopted by the European Parliament´s Committee on Culture and Education requires more protection for children online.

  • Why does this matter? The report says “that the online environment must be governed by the principles of privacy-by-design and safety-by-default, age-appropriate design, and algorithmic transparency.”

• The Joint Research Centre of the Commission published a policy briefing on Environmentally Sustainable Digital Sovereignty.

  • Why does this matter? “Environmentally sustainable digital sovereignty as a goal can potentially work as a competitive advantage for the EU. It can enable a thriving economy that empowers European companies and SMEs to innovate and operate based on low-resource technologies and infrastructure, through interoperability, coordination and diversification of the supply chain.”

B) Enforcement actions

1) AI

• Apple filed a lawsuit against OpenAI, alleging that OpenAI stole Apple´s trade secrets in a move to create its own hardware device. (The Guardian)

  • Why does this matter? “The suit claims OpenAI poached Apple employees, coaxing them to hand over confidential material, product designs and other tightly held information.”

  • “Tensions between the two companies began to simmer last year when OpenAI spent $6.4bn to acquire a hardware startup founded by former Apple design guru Jony Ive, indicating that the AI titan was foraying into hardware. Ive’s startup, io Products, is also named in Apple’s lawsuit.”

  • “The company is seeking damages and a court order that would block OpenAI from possessing or using its trade secrets.”

  • Practical implications:

    • This dispute is a useful reminder to tighten employee onboarding and offboarding controls (NDAs, IP assignment agreements, exit interviews) when hiring from competitors in fast-moving technology segments.

    • Employers should audit trade secret protection protocols and documentation practices, as disputes like this often turns on whether reasonable measures were taken to safeguard confidential information.

2) Data protection

• The Court of Justice of the EU (CJEU) has issued an important ruling on the interpretation of processing personal data for “journalistic purposes” (Case C-199/24, Legal Newsdesk Sweden). The Court confirmed that “the mere placing online, in return for payment, of decisions on criminal convictions, does not in principle constitute processing of personal data for ‘journalistic purposes’”.

  • Why does this matter? “According to the Court, personal data are processed for ‘journalistic purposes’ where the objective of that processing is to inform the public or to disclose opinions or ideas, where the content is prepared according to ethical rules or codes of conduct and has been edited or adapted, or at least is in line with an editorial policy. The facts presented must have been verified. The act of placing online, in return for payment, criminal convictions, does not appear, subject to a verification to be carried to be carried out by the national court, to fulfil those conditions or, consequently, to be capable of being regarded as carried out for journalistic purposes.”

• In Case C-474/24 (NADA Austria and Others), the CJEU concluded that “the GDPR does not preclude, in principle, the names of professional athletes who have infringed anti-doping rules, the duration of the ban imposed on them and the reasons for that ban from being published on the internet.”

  • Why does this matter? “The Court of Justice answers, first of all, that the information published is not covered, in principle, by the concept of ‘data concerning health’, unless reference is made in the publication to the name or category of the prohibited method or substance concerned by that infringement and that reference, combined with other information concerning the data subject, is capable of revealing, even indirectly, by means of an intellectual operation involving collation or deduction, information relating to the past, current or future physical or mental health status of that person.”

  • “[…] the personal data relating to offences provided for under national anti-doping legislation and to the sanctions imposed for such offences do not constitute personal data relating to criminal convictions and offences. […]”

  • “[…] the entity responsible for the publication must be able, prior to the publication, to carry out an individual balancing exercise weighing up the interests involved in order to ensure that that publication is made in a manner consistent with the GDPR, and, in particular, in observance of the principle of proportionality.”

3) Digital Policy, Cloud & Cybersecurity

• The CJEU has decided in Case C-788/24 (Anne Frank Fonds) that “a work that is in the public domain can be published online free of charge in a Member State even if it remains protected in another Member State”.

  • Why does this matter? “The website on which the work is made available must incorporate an 'effective’ technological measure to prevent its being accessed by internet users visiting the website from a Member State in which that work is protected.”

• The CJEU has also decided regarding streaming services that “the right of withdrawal cannot be excluded where the service is designed to adapt to the user’s behaviour”.

  • Why does this matter? “[…] it appears that the streaming service offered by Sky Österreich must be classified as a digital service, given the dynamic nature of the offering. Consequently, the right of withdrawal cannot be excluded and the customer thus has an appropriate period for reflection to examine whether the subscription meets his or her expectations.”

• In Case C-421/24 (AGCOM, Online gambling), the CJEU decided that “Google may be held liable for the YouTube videos of a content creator with whom it has a commercial partnership.”

  • Why does this matter? “[…] the hosting of advertising content relating to online gambling […] falls within the scope of the EU legislation on electronic commerce. […] in order to benefit from the exemption from liability in respect of the content published on a platform, the operator must act as an ‘intermediary service provider’, that is to say carry out a strictly technical, automated and passive activity, excluding any knowledge or control over the information which is transmitted or stored. That is not the case where an operator reviews, for the purpose of concluding a commercial partnership contract, the main theme of a video channel, that channel’s most viewed videos or newest videos and the associated metadata. The operator thus acquires specific knowledge of the essential content of a set of videos and cannot therefore claim to act as an intermediary service provider.”

• Musk’s xAI sued Grok user over sexualized ‘deepfakes’. (Reuters)

  • Why does this matter? “xAI has sued a South Carolina man arrested earlier this year on charges of sexually exploiting ​minors, alleging he misused the company's AI system Grok to ‌create child sexual abuse material. […] The case ​is one of the first brought by an AI company ​against one of its users for allegedly using an AI ⁠system to generate explicit material.”

C) Opinions, guidelines, reports & other publications

1) AI

• The Future of Life Institute´s AI Safety Index - Summer 2026 has been published, offering an updated picture of the current state of AI safety.

  • Why does this matter? Key findings:

    • “Anthropic, OpenAI, and Google DeepMind stay on top. […]

    • Meta improves and xAI deteriorates: Meta improved from 6th to 4th place, while xAI dropped from 4th to 7th place.

    • European dissonance: Although the European Union is a leader in AI safety regulation, the top European AI company Mistral scored dead last on safety.

    • Inadequate safety is a global problem, not a regional one. Three companies receive failing grades, one each from the US (xAI), China (DeepSeek), and Europe (Mistral).

    • Reviewers flagged the industry's pivot to military AI use as an emerging current harm risk. […]

    • Even industry leaders in safety practices are retreating from prior commitments. […]

    • Existential Safety is the weakest domain industry-wide. […]

    • Safety rhetoric outpaces revealed behavior. Across Google DeepMind, OpenAI, and xAI, leadership's reassuring public messaging diverges from commercial conduct and legislative stance, making stated commitments an unreliable proxy for actual safety practice.

    • Companies are publishing and updating safety frameworks, but these frameworks have weak teeth. As US/EU compliance deadlines near, Anthropic, OpenAI, Google DeepMind, Meta, and xAI published and updated fuller frameworks — yet they sometimes lack quantitative thresholds, genuinely independent audits, and clear decision authority.”

  • Practical implications:

    • Compliance teams vetting third-party AI vendors should treat published safety frameworks and commitments as a starting point for review.

    • Organizations relying on AI providers flagged with failing safety grades should reassess associated risk allocation in contracts, including indemnification, audit rights, and termination triggers tied to safety performance.

Source: The Future of Life Institute´s AI Safety Index - Summer 2026 (July 2026), p. 1

• Google announced new AI transparency features, introducing disclosures and labels for AI-generated ads.

  • Why does this matter? “We're adding a “How this ad was made” section to the My Ad Center panel, accessible globally by selecting the three-dot menu or info icon on ads across Search, YouTube and Discover. This panel will indicate if an ad was created or edited with AI.”

  • Practical implications: Companies (not only advertisers) using AI-generated or AI-edited content should review their disclosure practices, as platform-level transparency labeling may increase scrutiny of undisclosed AI use and could trigger emerging regulatory expectations around AI content labeling. (Please also note that transparency obligations under Art. 50 of the AI Act becomes applicable as of August 2, 2026.)

• The AI Office has published a report that summarises findings from over 100 experts on how the European Union can enhance its competitiveness, sovereignty and security in frontier AI.

• Approximately 200 leading economists and leaders signed a statement on AI’s Transformation of the Economy.

  • Why does this matter? “Economists, policymakers and technology leaders must act now to understand the economics of transformative AI and to build the incentives, guardrails, and institutions needed to steer AI in a direction that complements humans and benefits society.”

2) Data protection

• The French Data Protection Authority (CNIL) published guidance on mobile app obligations when collecting users’ geolocation information.

  • Why does this matter? “[…] the CNIL recalls the rules applicable to the collection and use of this data. It also provides data subjects with a practical sheet to help them control their data and exercise their rights.”

  • Practical implications:

    • Mobile app developers and publishers should review and update (if necessary) consent mechanisms and app privacy notices for geolocation data collection against this CNIL guidance to reduce enforcement risk. (The CNIL guidance is primarily applicable to those that are targeting users in France, however, this guidance can serve as a practical help for data controllers that are active on other markets.)

• The ICO (UK) published guidencae on “Using personal information to protect your business from crime”.

  • Why does this matter? “This guidance explains how data protection law applies if you are planning to share criminal offence data and provides you with resources to help you protect your business. At the end of this guidance there is a helpful checklist to take you through the steps you need to follow.”

  • Practical implications: Businesses using CCTV, dashcams, or crime-prevention data sharing (e.g., industry watchlists) should use the ICO’s checklist to confirm they comply with data protection requirements. (The guidance was prepared under the UK GDPR and is applicable in the UK, however, it can provide an useful checklist for entities outside of the UK as well.)

• The Dutch Data Protection Authority (AP) published new GDPR guidelines for generative AI. (The documents are in Dutch)

  • Why does this matter? The published guidelines include a guide for developers of generative AI models and a practical tool for organizations that want to implement and use generative AI.

  • The guide for developers “describes, among other things, the conditions under which organisations may process personal data, the grounds on which this may apply and the safeguards required to protect the rights of data subjects. Attention is also paid to topics such as managing, cleaning, enriching and storing data, indirect data collection and the use of personal data in training AI models.”

  • The guide for organizations planning to implement AI provides “a checklist that helps privacy professionals, project leaders and other responsible parties to assess step by step whether their organization wants, can and may use generative AI. It is a practical tool to determine which GDPR obligations apply and which technical and organizational measures are needed to use generative AI responsibly.”

• The Spanish Data Protection Authority (AEPD) published practical guidance for people, who are planning to wear smart sunglasses this summer. (The document is in Spanish.)

  • Why does this matter?

    • “1. Use smart glasses with the same criteria as a camera or mobile phone

    • 2. Be transparent about device usage

    • 3. Pay special attention to audio recordings

    • 4. Limit recordings to what is strictly necessary

    • 5. Please note that other data may be collected in addition to images and sound

    • 6. Configure privacy and security options properly

    • 7. Respect the legal limits of recording

    • 8. Delete recordings when they’re no longer needed”

  • “The responsible use of smart glasses helps to protect one’s own privacy and that of others. Before recording, storing or sharing content, always assess the impact that these actions may have on the rights and freedoms of others, and act with respect and responsibility.”

3) Cybersecurity

• The European Union Agency for Cybersecurity (ENISA) published its SME Cyber Resilience Maturity Assessment Model.

  • Why does this matter? “The SME Cyber Resilience Maturity Assessment Model provides a structured approach for micro, small and medium-sized enterprises (SMEs) to evaluate and strengthen their overall cyber resilience, while taking into account the requirements of the Cyber Resilience Act (CRA). The model is primarily intended for organisations that manufacture and place products with digital elements on the market, as these are directly subject to CRA requirements. However, it can also be used by other organisations involved in the product life cycle, such as integrators or service providers, to assess and improve their product security practices.”

4) Digital Policy, Cloud and Data Strategy

• The European Commission has published the final report of the Special Panel on Child Safety Online.

  • Why does this matter? “The report highlights the critical challenges children face online and provides recommendations and inspiration on better protecting and empower them, as well as on the age-appropriate use of social media and other digital services.”

  • Practical implications:

    • Social media platforms, app developers, and other digital service providers should review age-verification and age-appropriate design practices in light of the report’s recommendations.

    • Compliance teams should proactively assess current child safety features against the report’s recommendations, given that regulators frequently treat such expert recommendations as a roadmap for subsequent guidance or enforcement action.

• The UK´s Department for Science, Innovation and Technology (DSIT) published a qualitative study exploring the impact of social media restrictions on young people aged 13-17.

  • Why does this matter? “The study included 3 separate types of social media restriction, these were: limiting usage to 15 minutes per day (Intervention 1), installing a no-access curfew for social media from 9pm-7am (Intervention 2) and complete removal of access by uninstalling social media apps (Intervention 3).”

  • “Participants across the intervention groups reported a range of perceived benefits associated with social media restrictions, including improvements to wellbeing, sleep, and family life. Lasting impact appeared to be more likely where restrictions were supported by education and practical guidance and framed as a collective norm rather than an individual imposition.”

Share

D) Scientific papers in AI, data protection & more

• “Hallucinations in Organization-backed AI advisors: Evidence about Skepticism, Verification, and Reliance in Goal-Directed Use” (authors: Blanchard, Garvey and O’Laughlin)

  • Why does this matter? “[…] A central question for AI-advised decisions is […] not only whether users rely on inaccurate information, but whether they recognize that a response may require verification. […] We distinguish three constructs that existing studies often conflate: whether users are skeptical of information presented, whether they check it, whether checking succeeds, and whether the result of user verification affects reliance on the information. […]”

E) Data, Technology & Company news

• “Meta is facing a backlash over its new AI tool Muse Image, which can generate pictures using other people’s profile pictures without telling them.” (BBC)

  • Why does this matter? “It is one of many text-to-image tools publicly available, which as […] can create pictures from a few lines of simple written text. […] The feature is likely to face heightened scrutiny as regulators and campaigners raise concerns about AI-generated images, with Ofcom currently investigating X over Grok's role in creating and sharing non-consensual AI-altered images of real people.”

  • It´s worth noting that the Digital Omnibus on AI will introduce a new ban on “nudifier apps” (i.e., prohibiton on AI practices regarding the generation of non-consensual sexual and intimate content or child sexual abuse material) in the EU, as of December this year.

• “OpenAI is looking to expand its ad pilot across Europe, accelerating the international rollout of its ad business.” (Digiday)

  • Why does this matter? “[…] The latest expansion signifies that OpenAI will have achieved an advertising presence in every major global advertising region within less than a year. In Europe, the rollout now covers the U.K., France and Germany — the continent’s three largest digital ad markets, which together accounted for 62% of the region’s ad revenue last year, according to IAB Europe’s AdEx Benchmark 2025 report.”

• According to Chinese state media reports, China has successfully landed a reusable rocket for the first time. (BBC)

  • Why does this matter? “It signals that China may be able to challenge America’s dominance in reusable rockets after successful landings by Elon Musk’s SpaceX and Blue Origin, which is owned by Amazon founder Jeff Bezos.”

    

    Source: BBC (Video footage)

  • A day later, “Japan’s experimental reusable rocket took off and safely landed in a first test flight”. (AP)

    • Why does this matter? “Japan seeks to catch up with the technology Elon Musk’s SpaceX has been using for several years to cut launch costs of delivering payloads into space.”

1. Neurotechnology

• Meta introduced Brain2Qwerty v2, “the highest-performing end-to-end pipeline capable of real-time sentence decoding from non-invasive brain recordings, approaching levels of accuracy previously exclusive to techniques that require brain surgery.”

  • Why does this matter? According to the research paper, “restoring communication for people who have lost the ability to speak or move after a brain injury is a major challenge. While intracranial implants now enable high-performing brain-computer-interfaces, non-invasive alternatives are still lagging behind. Here, we present Brain2Qwerty v2, a model that can decode the production of natural sentences solely from real-time magnetoencephalography (MEG) recordings. By collecting 22,000 sentences typed by nine subjects, each recorded for 10 hours, our model leverages character, word and sentence-level representations to achieve an average word error rate (WER) of 39%. For our best participant, the model accurately decodes half of the sentences with one word error or less. Critically, decoding accuracy log-linearly improves with data volume, suggesting that the performance gap with intracranial approaches could be partially bridged through data scaling. We show that AI enables this performance in three main ways: the substitution of hand-crafted pipelines for event detection with deep learning, the finetuning of large language models to extract semantic representations, and the deployment of AI agents to iteratively refine our decoding pipeline via automated code development. Together, these results show that non-invasive brain-to-text decoding starts to operate at a level of accuracy previously thought exclusive to surgical implants, opening a path toward safe and efficient brain-computer-interfaces.”

• A new research project, BrainGuard, has been launched to strengthen the security of neurotechnologies.

  • Why does this matter? “Its goal is to develop novel security concepts for neurotechnologies that ensure the protection of sensitive neural data, prevent manipulation, and safeguard the autonomy of users. As medical devices become increasingly integrated with the nervous system, the potential risks associated with insufficient security measures grow accordingly.”

• A recent blog post published on the website of Stanford Law School, “Even Chile’s Neurorights Leave Inferred Mental Data in a Gray Zone” (by Bo Hyoung Lee), demonstrates that altough “Chile has gone unusually far in recognizing that brain-related information deserves special legal attention, yet it still does not clearly resolve how law should treat information inferred from neural activity once it is processed and used outside a traditional medical setting.”

• The EBRAINS Ethics and Society Committee, in collaboration with the International Brain Initiative, published a Guide to Protecting Brain Data.

  • Why does this matter? “The new ‘Mind Your Mind’ guide was created to empower the public with knowledge about neurodata: what they are, why they matter, and how they can and should be protected. It is aligned with the principles of the European Charter for the Responsible Development of Neurotechnologies, which calls for ethical innovation, a human rights-based approach, and robust safeguards for neurodata.”

• Risk Management Magazine published an article about the neural data privacy laws in the US, titled “State of Mind: The New Landscape of Neural Data Privacy Laws” (authors: Neil Issar , Davis Shugrue , Morgan Houghtlin).

  • Why does this matter? “To proactively manage the emerging risks around neural data, organizations must understand how this data interacts with business processes. In addition, the legal and regulatory landscape around neural data is also evolving with at least nine U.S. states enacting or considering laws regulating the collection and use of this data, creating new risks and obligations for protecting individual privacy.”

• The World Economic Forum (WEF) published an article about neurosecurity, i.e. how we balance neurotechnology’s opportunity with security.

  • Why does this matter? “Neural data is uniquely sensitive, revealing thought and emotion, making security and governance essential. A holistic, layered security and governance framework is necessary to protect trust, safeguard identity and unlock the transformative potential of neurotechnology.”

• In November 2025, UNESCO issued a Recommendation on the Ethics of Neurotechnology.

2. Quantum computing

• President Trump signed an Executive Order to supercharge U.S. innovation in quantum technologies and strengthen the national security in this critical area.

  • Why does this matter? “The Order establishes a national effort to develop the first ever quantum computer powerful enough to initiate the era of quantum-enabled scientific discovery and accelerate quantum capabilities for commercial applications. […] The Order ensures that the United States enters this new era of quantum innovation with ambitious national goals, a strong domestic workforce, and trusted supply chains in coordination with our international allies and partners.”

• OECD published a policy paper providing an overview of national strategies and policies for quantum technologies.

  • Why does this matter? “This paper takes stock of the ambitious national strategies and policy instruments countries are introducing to support the development and uptake of quantum technologies. It reviews the timelines, motivations, scope, goals, assessment and governance mechanisms characteristic of national quantum strategies. The paper also identifies the main objectives of policies with frequently used instruments, including institutional funding for public research, project grants for public research, grants for business R&D and innovation, public procurement and equity financing.”

• The European Parliamentary Research Service published an in-depth analysis on “Future-proofing the Quantum Europe Strategy for 2040”.

  • Why does this matter? “Quantum technologies are developing rapidly. They have extensive uses in secure communications, energy, healthcare, manufacturing, defence and security, and space, and may bring about a change of paradigm in technological capabilities. Their economic and strategic value makes them a high priority for EU strategic autonomy. The new Quantum Europe Strategy intends to establish the EU as a global leader in quantum technologies by 2030. This paper explores the potential paths the EU can take to establish itself as a global leader in this field. To ensure that the strategy holds in a highly unpredictable world, we have conducted a foresight exercise to ‘wind-tunnel’ (stress-test) statements taken from the quantum strategy against the European Commission Joint Research Centre’s four reference foresight scenarios.”

• The Australian Cyber Security Centre issued a guide on quantum computing risks.

  • Why does this matter? “Quantum computing has the potential to disrupt some current cryptography. As CRQCs* emerge, organisations will need to rely on quantum-resistant cryptography — known as post-quantum cryptography (PQC) — to maintain the security of systems and data.” (*cryptographically relevant quantum computers)

• Google, in a blog posts, proposed five actions policymakers can take to prepare for the quantum era

  ➡️ Drive society-wide momentum, especially for critical infrastructure

  ➡️ Ensure AI is built with post-quantum cryptography (PQC) in mind

  ➡️ Reduce global fragmentation

  ➡️ Promote Cloud-first modernization

  ➡️ Lean on the experts to avoid strategic surprise

  • Why does this matter? “The encryption currently used to keep your information confidential and secure could easily be broken by a large-scale quantum computer in coming years. And while we’re not there yet, malicious actors are not waiting until a Cryptographically Relevant Quantum Computer (CRQC) is ready. They are likely already carrying out “store now, decrypt later” attacks and collecting encrypted data, just waiting for the day when a quantum computer can unlock it.”

  Thanks for reading Datalawgy! This post is public so feel free to share it.

  Share

3. 6G

• The ETSI Industry Specification Group on Integrated Sensing and Communications (ISAC) has published ETSI GR ISC 004, a comprehensive report addressing security, privacy, trustworthiness, and sustainability considerations for Integrated Sensing and Communications (ISAC) in future 6G systems.

  • Why does this matter? “The report identifies 19 key issues, including 15 related to security and privacy and 4 focused on sustainability, reflecting the growing importance of responsible design in next-generation networks. As ISAC enables 6G systems to simultaneously communicate and sense their environment, new technical, ethical, and regulatory challenges emerge—particularly around unauthorised sensing, data confidentiality, human privacy, AI-based data processing, and secure handling of sensing data.

    The ETSI Report addresses the following main topics:

    • Protection against unauthorised use of 6G systems for sensing

    • Safeguards against target-based eavesdropping and over-the-air signal manipulation

    • Secure transport, storage, and immutability of sensing data

    • Consent, transparency, and privacy-preserving mechanisms for sensing humans (connected and non-connected)

    • Confidentiality in non-public and sensitive spaces

    • Sustainability challenges including power consumption, spectrum efficiency, environmental footprint, and health considerations

    • The report consolidates potential technical and non-technical requirements that future 6G systems should meet to ensure ISAC services are secure, privacy-preserving, trustworthy, and environmentally sustainable.”

• University College Dublin (UCD) has been named lead institution for Shield-6G, an €8m project funded under the EU’s Horizon Europe Smart Networks and Services Joint Undertaking.

  • Why does this matter? “Shield-6G is tasked by the European Commission with establishing the foundational security, reliability and resilience guidelines for 6G networks. In practical terms, it is an AI-driven cyber threat intelligence platform designed to shift the dial from basic network reliability to what its architects describe as an “unprecedented” standard of systemic resilience.”

• Vesa Lehtovirta (Ericsson) argues that the developments around 6G provide an “opportunity to revisit mobile security from the ground to adapt to new technologies, use cases and threats.”

  • Why does this matter? “6G offers a rare opportunity to revisit mobile security from the ground up. While the system will build on the strong foundation established by 5G, improvements must be guided by rigorous risk assessment and Zero Trust principles. Proactive, forward-looking design will be particularly important in areas such as post-quantum cryptography and embedding Zero Trust architecture from the outset. 3GPP SA3 is laying the foundation for 6G security, but the success of the next generation of mobile networks will depend on broad industry collaboration. Operators, vendors, academia and regulators all have a role to play in ensuring that 6G networks are secure, resilient and ready for the challenges of the decade ahead.”

4. AI

• The AI Futures Project published its positive vision for what should happen in the AI race until 2040 (Plan A). Plan A is contrasted with 4 alternative plans (B, C, D, and S), which correspond to the main ways the US could respond (or not) to the challenges of superintelligence.

  • Why does this matter? “In this scenario, humanity delays the development of superintelligence until 2040, makes all AI research public, allows dozens of companies globally to catch up to the frontier, and intentionally enters a regime of mutually assured compute destruction.”

    

    Source: The AI Futures Project, AI 2040, Plan A

  • “Plan A is our positive vision for how humanity can avoid AI-driven existential catastrophe and reach a flourishing future. It’s informed by conversations with experts at major U.S. frontier AI companies, direct experience at OpenAI, tabletop exercises, and discussions with policymakers, national security experts, and AI policy leaders. We recommend an international deal to avoid a dangerous race to superintelligence. The deal involves total research transparency for AI R&D, which allows the nations of the world to understand what’s happening and enforce guardrails. The result is multiple companies across multiple countries scaling slowly and safely together towards superintelligence, instead of racing each other in secrecy.

    Plan A is primarily a recommendation, not a prediction. This scenario is not our best guess as to what the future will actually look like. Instead, it’s a vehicle for communicating and stress-testing our policy recommendations. While the implementation of Plan A is a recommendation and not what we actually expect to happen, the subsequent effects depicted are predictions. In this AI 2040 scenario, Plan A is implemented successfully, albeit imperfectly and only in the nick of time.”

    

    Source: The AI Futures Project, AI 2040, Plan A

• The OECD published a working paper, titled “Exploring possible AI trajectories through 2030”.

  • Why does this matter? “The paper aims to improve understanding of how artificial intelligence (AI) is evolving and explores how AI innovation might advance – or slow down – by 2030. It presents four scenarios for possible AI trajectories by that year, providing a baseline for analysing future developments and their potential impacts.”

• The European Data Protection Supervisor published its TechSonar report, focusing primarily on AI-related technologies. (The report is available here.)

  • Why does this matter? “ This year’s TechSonar report includes six trends: agentic AI, AI companions, automated proctoring, AI-driven personalised learning, coding assistants and confidential computing. Agentic AI refers to artificial intelligence systems that can autonomously make decisions, take actions and achieve goals without constant human intervention. AI companions interact with and support humans through personalised experiences. Automated proctoring monitors online exams to detect cheating. AI-driven personalised learning customises content and learning experience to each student’s needs. Coding assistants help developers write and debug code. And confidential computing protects data while it is being used by performing computations in secure, isolated environments.”

You can find the previous issues of Quantum Leaps for Privacy here:

A) Regulatory developments

1) AI

• The Governor of Illinois signed the Artificial Intelligence Safety Measures Act that is intended to increase transparency and accountability requirements for the largest AI models.

  • Why does this matter? “The bill mirrors California’s SB-53 and New York’s Responsible AI Safety and Education Act, which were each signed in late 2025. It establishes new reporting standards for the possibility that the AI model could be used for large-scale harms, such as by providing users assistance in creating a chemical, biological or nuclear weapon or committing cyber-attacks.”

2) Data protection

• The European Parliament adopted amendments to a privacy exemption allowing electronic communication services to voluntarily detect child sexual abuse. The amendments would exclude “communications to which end-to-end encryption is, has been or will be applied” from the scope of the law.

  • Why does this matter? “The EP position (text as amended) will now be sent to the Council, which has three months to approve or reject the amendments. If the Council does not accept all of the amendments, EP and Council will move to conciliation to agree on the law.”

3) Digital Policy, Cloud & Cybersecurity

• A briefing, requested by the IMCO committee, has been published on “Fighting Premature Digital Obsolescence of Consumer Goods and Consumer Rights” (author: Prof. Dr. Alberto De Franceschi).

  • Why does this matter? “After the Digital Content Directive (DCD) and Sale of Goods Directive (SGD), some measures to improve durability and fight premature digital obsolescence were introduced by further EU legislation, but they are still not sufficient. Information about the minimum period during which the producer or the provider supplies software updates should be made available to consumers in all cases, and not only where the producer or provider makes such information available to the consumer’s contractual counterparty (Article 6(1)(lc) Consumer Rights Directive (CRD)). Information about the supply of updates should also be provided, according to Article 6(1)(o) CRD, in the framework of information on the duration of the contract.”

B) Enforcement actions

1) AI

• The US Supreme Court decided to allow Texas to enforce law requiring age verification and parental consent on apps. (SCOTUSblog)

  • Why does this matter? The challengers argue that the law (Texas App Store Accountability Act) violates the First Amendment. Texas countered such arguments that the law “regulates commercial transactions, rather than speech, specifically, the conditions in which young people can agree to contractual terms and conditions required to downland an app.”

2) Data protection

• The Norwegian Data Protection Authority has imposed an infringement fine of NOK 20 million (Approx. EUR 1.7 million) on Elkjøp, including for processing personal data in a customer loyalty club without valid consent. (A summary and detailed analysis of the case, together with practical advice on data privacy compliance, is available from Kjell Steffner, Nordia Law.)

  • Why does this matter? The investigation found several violations: Elkjøp did not have (i) obtained a valid consent to process personal data in the customer club, (ii) made necessary assessments about the use of personal data for new purposes, (iii) made good enough assessments of legitimate interest as a basis for processing, and (iv) responded to customer rights requests within the GDPR deadline.

• The Spanish Data Protection Authority (AEPD) imposed a fine of EUR 1,050,000 on Vodafone Espana. A person contacted Vodafone’s customer service, went through security checks and received a copy of the invoices containing the personal data of the person concerned (Vodafone subscriber) to an unauthorized email address.

  • Why does this matter? The AEPD found violations of Art. 6(1) GDPR (no legal basis for data disclosure) and Art. 32 GDPR (inadequate security measures).

• The Italian Data Protection Authority has fined Character Technologies Inc., a US company that manages Character.AI, a generative AI service that allows users, including minors, to create and interact via chat with virtual characters, for EUR 158,000. Considering the risks deriving from the use of generative AI in an entertainment service that is also accessible to minors, the Authority has also prescribed further measures.

  • Why does this matter? “[…] the preparation of the Data Protection Impact Assessment (DPIA) and the designation of the representative in the EU were late.

    Critical issues were also noted in the guarantees for the protection of minors and in the age verification procedures.”

3) Digital Policy, Cloud & Cybersecurity

• The European Commission preliminarily found Meta in breach of the Digital Services Act for the addictive design of Instagram and Facebook. The investigation focuses on features such as infinite scroll, autoplay, push notifications, and the platforms’ highly personalised recommender systems.

  • Why does this matter? “The Commission's investigation indicates that Meta did not adequately assess the risks of its addictive design on the physical and mental wellbeing of users, including minors and vulnerable adults. […] Meta disregarded available information about the time minors spend on Instagram or Facebook at night and how the optimisation of its different formats - such as reels and stories - could lead to excessive or compulsive use of the services. […] Evidence also shows that Meta's current mitigation measures failed to effectively tackle the risks stemming from its addictive design.”

  • What are the next steps? “Meta now has the possibility to exercise its right to defence. It may examine the documents in the Commission’s investigation files and reply in writing to the Commission’s preliminary findings. In parallel, the European Board for Digital Services will be consulted. If the Commission’s views are ultimately confirmed, the Commission may issue a non-compliance decision, which can trigger a fine proportionate to the nature, gravity, recurrence and duration of the infringement, capped at 6% of the total worldwide annual turnover of the provider.”

• The EU General Court dismissed Apple’s actions regarding its designation as a gatekeeper and it confirmed the designation of Apple as a gatekeeper in relation to the App Store and iOS, and finds the actions concerning the iMessage service to be inadmissible. (The full text of the judgment is available here.)

  • Why does this matter? The European Commission designated Apple as a ‘gatekeeper’ under the Digital Markets Act (DMA) in relation to the App Store, the operating system iOS and the web browser Safari in 2023. The Commission decided not to designate Apple as a gatekeeper in relation to iMessagealso, however, it classified the iMessage service as a number-independent interpersonal communications service (NIICS) constituting a core platform service (CPS). As the Court dismissed all the actions brought by Apple, the Commission´s decions remain in place.

• The Court of Justice upholds Google’s fine of around €4.1 billion. (The full text of the judgment is available here.)

  • Why does this matter? This judgment confirms the penalty imposed for Google Search’s abuse of a dominant position in the context of the Android operating system.

C) Opinions, guidelines, reports & other publications

1) AI

• The UN´s Independent International Scientific Panel on AI published its Preliminary Report that provides an evidence-based assessment of opportunities, risks and impacts of artificial intelligence.

  • Why does this matter? “This report presents a preliminary independent scientific assessment of the capabilities and the emerging opportunities and risks of artificial intelligence (AI), providing a shared evidence base to help Member States navigate a rapidly changing technology. […] The report is the first of its kind and will be updated progressively throughout the year, with thematic briefs addressing developments as they arise. It reflects the best available evidence at the time of publication, in a field moving so rapidly that any snapshot requires a commitment to revision.”

  • Key takeaways:

    (i) Capabilities and adoption

    • “Recent years have seen rapid, and in some areas accelerating, progress in a range of AI capabilities.”

    • “These gains have unlocked useful applications across science, health, agriculture, accessibility, knowledge work and information technology, including in the development of AI itself.”

    • “AI adoption has accelerated broadly, and unevenly, across countries and sectors.”

    • “While the shift towards AI agents is under way, their future adoption and economic impacts will likely be shaped by continued improvements in their ability to accomplish knowledge work with little or no human oversight.”

    (ii) Understanding and managing risks

    • “AI development entails risks, with potential negative impacts on human rights, social systems and the environment.”

    • “Looking ahead, the gap between rapidly improving capabilities and effective risk management methods may lead to catastrophic outcomes.”

    • “AI risks are unevenly distributed across populations and countries, while AI development and the wealth it creates are highly concentrated.”

    (iii) Governing artificial intelligence to unlock benefits and mitigate risks

    • “Realizing the full benefits of AI while minimizing its risks requires good governance.”

    • “Policymakers seeking to shape this governance face an evidence dilemma: they need evidence to make informed consequential governance decisions, but by the time the evidence exists, it might be too late to make them, as the evidence lags behind the pace of AI development.”

    • “The capacity to act on existing evidence of AI risks and impacts is unevenly distributed.”

    • “Concrete next steps to close the above gaps exist, but each requires sustained investment in Member State capacity to shape, evaluate and deploy AI.”

• The Federal Trade Commission is seeking public comment on a proposed policy statement addressing concerns that AI companies may be manipulating the behavior of their AI systems contrary to reasonable consumer expectations for objectivity and accuracy. The public will have until July 31, 2026, to submit comments on the policy statement.

  • Why does this matter? “As the proposed policy statement explains, the FTC Act prohibits businesses from engaging in “unfair or deceptive” conduct. The proposed statement goes on to describe how AI companies that distort their systems’ outputs to achieve undisclosed ideological objectives could be deceiving consumers in violation Section 5 of the FTC Act. Such conduct, it explains, may be at odds with explicit and implicit representations made to consumers about the effectiveness and suitability of AI systems for various tasks.”

• The Stanford Institute for Human-Centered Artificial Intelligence (HAI) published an industry report, titled “Human-Centered Large Language Models”.

  • Why does this matter? Key takeaways:

    • Competitive advantage is moving from model capability to human experience.

    • Data strategy is now AI and market strategy.

    • Benchmark performance does not guarantee business value.

    • The strongest deployments will optimize human–AI collaboration, not pursue automation by default.

    • Interaction design may produce greater returns than incremental model improvements.

    • AI risk accumulates over time, not only through isolated harmful outputs.

    • Human-centered AI requires accountable, cross-functional ownership.

2) Data protection

• The European Data Protection Board (EDPB) has adopted (i) guidelines on anonymisation, (ii) guidelines on web scraping in the context of generative AI, and (iii) the final version of its guidelines on the processing of personal data through blockchain technologies. The guidelines on anonymisation and on web scraping will be subject to public consultation until 30 October 2026.

  • Why does this matter? The new guidelines on anonymisation takes into account the judgment of the Court of Justice (CJEU) in the case C-413/23 P EDPS v SRB of 4 September 2025 and other CJEU jurisprudence. (For a more detailed summary of the new EDPB Guidelines on Anonymisation, please also see my Linkedin post.)

  • “In its guidelineson web scraping in the context of generative AI, the Board clarifies various aspects of the GDPR compliance of web scraping, including the legal basis for such activities and the conditions under which special categories of data can be processed in this context.”

  • “[…] the EDPB has adopted the final version of its guidelines on blockchain technologies. The guidelines help organisations using blockchain technologies to comply with the GDPR. The EDPB explains how blockchains work, assessing the different possible architectures and their implications for the processing of personal data.”

• The EDPB and the Anti-Money Laundering Authority (AMLA) are working together to develop Joint Guidelines on how to share information to fight financial crime while protecting personal data.

  • Why does this matter? “The fight against financial crime depends on cooperation, and information sharing can help detect and prevent money laundering and terrorist financing. Art. 75 of the AML Regulation makes this possible, allowing companies and professionals covered by anti-money laundering rules to share information with each other and with public authorities, within clear limits. The new information sharing possibility will apply from 10 July 2027.”

• The Spanish Data Protection Authority (AEPD) and the Belgian Data Protection Authority issued joint recommendations and best practices for data protection in video games.

  

  Source: Joint recommendations for video games, Figure 1, p. 9

• The Recorded Futureʼs Insikt Group published its report about the “State Digital Surveillance Risk Landscape”.

  • Why does this matter? Key findings:

    • “Insikt Group assesses that there are “highˮ or “very highˮ levels of digital surveillance risk in 31 countries due to their use of advanced surveillance capabilities against foreign businesses, travelers, and government critics, with limited to no oversight.”

    • “A further 74 countries have “mediumˮ levels of digital surveillance risk. […]”

    • “By exploiting control over telecommunications infrastructure and online platforms, governments can conduct mass, indiscriminate monitoring of traffic and user data. […]”

    • “The proliferation of commercial spyware, AI-powered public security infrastructure, and increasing collection of biometric and personal data almost certainly enables governments to build comprehensive digital profiles of individuals and leverage them for targeted surveillance operations.”

    • “Digital surveillance that is not subject to robust oversight and does not abide by the principles of legality, necessity, and proportionality very likely incurs heightened operational, reputational, and legal costs for organizations and individuals, including the loss of sensitive data, the proliferation of cyber vulnerabilities, and legal and physical risks.”

• The Australian Privacy Commissioner (OAIC) has inspected the use of tracking pixels by 50 healthcare providers and provided findings, case studies and recommendations to assist individuals and organisations in managing the privacy risks posed by this technology.

  • Why does this matter? Key takeaways for organisations:

    • “Assess the sensitivity of data (actual and inferred) and configure tracking pixels appropriately […]

    • Know what tracking technologies are in place and where […]

    • Ensure transparency and valid consent mechanisms are in place […]

    • Implement a privacy by design approach […]”

3) Cybersecurity

• The European Union Agency for Cybersecurity (ENISA) published its view on Cybersecurity in the Frontier AI Era.

  • Why does this matter? “This publication provides national competent authorities in Member States and EU policymakers, defenders, and service providers with an initial set of recommendations to support them in their respective roles towards developing the necessary operational capabilities to face machine-speed threats. The recommendations are not an all-inclusive checklist. ENISA aims to further refine and expand these recommendations in close cooperation with Member States and EUIBAs and will align these to upcoming European Commission Action Plan.”

4) Digital Policy, Cloud and Data Strategy

• The Future Foundation proposed “The 10 Rules for the Digital World”, “a novel ethical framework to help individuals and societies make prudent, human-centered decisions in the age of “supercharged” technology.” (“The 10 Rules for the Digital World” paper was published by Communications of the ACM. A more extended version with a preamble is available at the webpage of The Future Foundation.)

  • Why does this matter? “Each entry reflects a key technological issue seen through the lens of one of the biblical Ten Commandments and then plays out two exemplary interpretations: the perspective of an ordinary end user and that of a professional. By using the word “interpretation,” we signal that there are myriad ways to interpret a rule in a person’s individual context.”

    

    Source: 10 Rules for the Digital World, The Future Foundation

• The European Commission will grant €5.8 million to establish the first two Regional Cable Hubs, in the Baltic Sea and the Mediterranean Sea. It is also launching today a €40 million call to increase European capacity to repair submarine communication cables.

  • Why does this matter? “These two actions contribute to the delivery of the EU Action Plan on Cable Security, supporting the security and resilience of Europe's critical submarine data and energy cables, and enhancing our collective capacity to monitor, detect and respond to threats targeting critical undersea infrastructure.”

Share

D) Scientific papers in AI, data protection & more

• “Is an Intelligent Machine a Moral Machine?” (authors: Myers and Everett)

  • Why does this matter? “As artificial intelligence (AI) systems become increasingly sophisticated and used in more consequential domains, an unspoken assumption seems to suggest enhanced performance or “intelligence” would entail greater alignment and safety – “morality”. […] In this paper we draw on these philosophical debates and explore the psychological foundations of this apparent misconception: do people infer machine morality from machine intelligence? […] While most work focuses on intelligence and morality as independent and orthogonal facets of person perception and trust, we instead highlight a robust pattern of results in which people do not only perceive intelligence and morality in AI agents, but concerningly infer moral competence and moral motivation from machine intelligence - with consequences for trust and danger. These findings reveal a systematic tendency to infer moral qualities from intelligence, including moral motivation. This may distort public understanding of AI safety and trust, with concerning ethical and epistemic implications.”

• “The Red Queen Gödel Machine: Co-Evolving Agents and Their Evaluators” (authors: Iacob et al.)

  • Why does this matter? “[…] We introduce the Red Queen Godel Machine (RQGM), an evolutionary framework for recursive self-improvement under non-stationary utilities. […] We begin by showing that even on verifiable coding tasks, the RQGM improves test pass rate over the prior SOTA by adding a complementary agent-as-a-judge code-review signal. This signal is cheaper and the RQGM uses 1.35x-1.72x fewer tokens. We then turn to scientific paper writing and reviewing, and Olympiad-level proof writing and grading, where the RQGM improves performance over prior self-improving agents: co-evolved writers reach 1.78x-1.86x higher acceptance rates under a diverse agent-as-a-judge panel, while co-evolved graders reach 9% higher ground-truth accuracy. In paper reviewing, the strongest baseline reviewer over-accepts AI-generated papers at up to 1.91x the human rate. The RQGM corrects this by introducing an adversarial objective that discovers reviewers equally stringent on AI and human work.”

• “The DMA’s Contribution to EU Digital Sovereignty” (author: Jan Blockx)

  • Why does this matter? “Within the scope of core platform services, the Digital Markets Act (DMA) can contribute to the EU’s digital sovereignty. Since the gatekeepers of core platform services in the EU are currently mostly based in the United States and China, the DMA’s objective of making their position more contestable could, if successful, provide more room for providers from the EU or from other jurisdictions than those in which the gatekeepers are based. The growth of such alternative providers would reduce the ability of a single non-EU jurisdiction to control core platform services provided in the EU. […] To enhance EU digital sovereignty, additional supply and demand-side measures should be taken to facilitate the growth of European providers of digital services.”

E) Data, Technology & Company news

• OpenAI has launched GPT‑5.6 family of models for general availability following the limited preview⁠: new flagship, Sol, alongside Terra, a balanced model for everyday work, and Luna, the most cost-efficient model.

  • Why does this matter? “GPT‑5.6 Sol sets a new standard for both intelligence and efficiency, achieving state-of-the-art results across coding, knowledge work, cybersecurity, and science while outperforming previous and competing frontier models with fewer tokens and at lower estimated cost.”

• “Chinese-built AI models are gaining traction among U.S. companies as they narrow the performance gap with leading American rivals while remaining significantly cheaper to use.” (CNBC)

  • Why does this matter? “The share of tokens used by U.S. companies on Chinese AI models via OpenRouter — a platform that enables developers to access a range of AI models — has sat above 30% each week since Feb. 8, with that figure rising as high at 46%. The average across the previous 12 months was just 11%, falling to 4.5% in the first half of 2025.”

• OpenAI and Broadcom unveiled Jalapeño, OpenAI’s first LLM-optimized inference chip.

  • Why does this matter? “Early testing shows that the first-generation accelerator will deliver performance per watt substantially better than current state-of-the-art.”

A) Regulatory developments

1) AI

• The Council gave its final green light on the Digital Omnibus on AI. (The text of the Digital Omnibus on AI is available here.)

  • Why does this matter? “[…] the co-legislators […] agreed on a fixed timeline for the delayed application of high-risk rules: the new application dates would be 2 December 2027 for stand-alone high-risk AI systems and 2 August 2028 for high-risk AI systems embedded in products.”

  • What are the next steps? “The legislative act will be published in the EU’s official journal shortly and will enter into force on the third day after this publication.”

2) Data protection

• The European Commission proposed new measures to strengthen the EU’s response to an evolving criminal landscape.

  • Why does this matter? “The package includes two regulations to strengthen the mandates of Europol and Eurojust, a revision of the European Investigation Order, and amendments to the Data Protection Regulation for Union institutions and bodies. These measures will improve cooperation and complementarity between EU agencies and national authorities, including police, customs and courts. They will support more joint investigations, speed up prosecutions, and facilitate the exchange of information through a clearer legal framework and less administrative burden.”

3) Digital Policy, Cloud & Cybersecurity

• President Trump signed an Executive Order to supercharge U.S. innovation in quantum technologies and strengthen the national security in this critical area.

  • Why does this matter? “The Order establishes a national effort to develop the first ever quantum computer powerful enough to initiate the era of quantum-enabled scientific discovery and accelerate quantum capabilities for commercial applications. […] The Order ensures that the United States enters this new era of quantum innovation with ambitious national goals, a strong domestic workforce, and trusted supply chains in coordination with our international allies and partners.”

• According to Politico´s report, “social media giant Meta is pushing California state lawmakers to shield it from pending legislation that would increase legal penalties in child-harm cases”.

  • Why does this matter? “The draft amendments would exempt social media platforms from increased penalties in child harm cases if the companies activate a suite of default child safety settings. Those settings include disabling autoplay, restricting geolocation data sharing, silencing nighttime notifications, preventing kids from receiving direct messages from unknown adults, shielding minors’ profiles from public view and preventing explicit material from being shown to kids.”

  • “If accepted by lawmakers, the amendments could lead to reduced payouts in the pending cases where parents and young people accuse Meta, Google, TikTok and Snap of designing platforms that fostered youth harms including addiction, depression and suicidality. Meta and Google were ordered to pay $6 million in damages after a Los Angeles jury found the companies liable in one such case in March.”

B) Enforcement actions

1) AI

• I have collected several websites and databases that present legal disputes, lawsuits and other enforcement actions initiated against AI companies or in connection with AI-based products or services:

2) Data protection

• The US Supreme Court decided in Trump v. Slaughter that the president of the US has the power to fire leaders of independent agencies or commissions. This means that the independence of the US Federal Trade Commission (“FTC”) may also be questioned. (Slaughter was a member of the FTC and President Trump removed her from her position in March 2025 without giving any reason.)

  • Why does this matter? According to the first assessments, this “decision was a major victory for proponents of the “unitary executive” theory – the idea that the president should have complete control over the executive branch. Under this theory, the president should be able to fire any member of the executive branch, and laws – like the one that the court struck down – that restrict his ability to do so violate the separation of powers.”

  • Why is this decision important from a data protection perspective? FTC’s independence plays an important role in the EU’s adequacy regime with respect to the United States. As NOYB (Max Schrems’ NGO) says: “since 2000 the EU has relied on the “independent” FTC as the enforcer of EU-US deals on personal data. According to EU treaty law such oversight must be independent. In the current EU-US deal, the European Commission relies on the independent FTC 259 (!) times.” NOYB argues that “given that the EU in almost all cases relied on the “independence” of the FTC as a privacy watchdog, the entire structure of the EU-US Data Privacy Framework has just collapsed.”

  • What will be the next steps? The US Supreme Court decision has no direct impact on the European Commission´s adequacy decision, i.e., the EU-USData Privacy Framework remains in force until either the European Commission repeals it or the Court of Justice annuls it. However, NOYB immediately sent a formal letter to the European Commission, “asking the Commission to take the appropriate steps to repeal the EU-US data deal in an orderly way.” and NOYB also announced that it will also “file a lawsuit in the coming weeks, aiming to allow the CJEU to annul the current deal. However, such a lawsuit typically takes 2-3 years until a final decision is reached.”

  • What are the main lessons about compliance? Companies should start preparing for a scenario where they can no longer count on the Commission´s adequiacy decision for transferring personal data to the US. In addition, if SCCs or BCRs are used, the underlying ‘transfer impact assessments’ may also be reviewed to verify the legality of transfers and to review the measures applied.

  • What might be the broader implications? The U.S. Supreme Court’s decision could also have a broader impact on European technology and data souverignty initiatives, where there are clashes on many battlefields between the U.S. and the EU...

• The US Supreme Court also decided in Chatrie v. United States, concluding that police officers conducted a Fourth Amendment search when they acquired location data from Google.

  • Why does this matter? “An individual has a reasonable expectation of privacy in records about his cell phone’s location, and police intrude on that constitutionally protected interest when they demand the information—even though for only a limited time, and from a third-party tech company.”

• The Australian Privacy Commissioner (OAIC) has found that health service providers Medmate Australia Pty Ltd (Medmate) and Monash IVF Pty Ltd (Monash) interfered with the privacy of individuals whose sensitive information was collected via third-party tracking pixels.

  • Why does this matter? “The Privacy Commissioner’s decision establishes that the use of tracking pixels to track website visitors to health-related websites, and to subsequently target them with advertising on social media platforms, amounts to a collection sensitive information for which the website provider must obtain users’ consent.”

C) Opinions, guidelines, reports & other publications

1) AI

• The Centre on Regulation in Europe (CERRE) published two issue papers (author: Daniel Schnurr) regarding the implementation of the AI Act rules for high-risk AI systems: (i) “Information Sharing and Cooperation along the AI Value Chain” and (ii) “Evolving AI Systems under the AI Act: Substantial Modification and AI Value Chain”.

  • Why does this matter? The papers addresses “two central questions for policy makers and firms: when does a change to an AI system create new legal duties, and how should responsibility be shared between the actors that develop, supply, adapt, and deploy AI systems?”

• UNESCO launched the “Flanders Artificial Intelligence Readiness Assessment Report”, the first sub-national application of the Readiness Assessment Methodology (RAM), developed under the EU-funded “AI-Ready Flemish Public Administration” project.

  • Why does this matter? “The Readiness Assessment Methodology is a diagnostic tool developed by UNESCO to support governments in evaluating their preparedness to implement artificial intelligence in line with ethical principles, human rights, and the public interest. In the case of Flanders, the assessment was adapted to a multi-level governance context, reflecting regional, federal, and European dimensions, which was supplemented by expert interviews and stakeholder consultations across the Flemish AI ecosystem.”

  • “The report presents a set of governance recommendations aligned with the UNESCO Recommendation on the Ethics of Artificial Intelligence. These include strengthening independent oversight mechanisms, enhancing capacity for ethical impact assessments, promoting inclusive AI literacy and reskilling across society, and safeguarding the wellbeing of young people in AI-driven environments.”

• Nemko Digital published a brief overview about AI Washing in 2026: “AI Washing in 2026: From Illusion of Autonomy to Proof of Performance” (author: Joy Haggenburg).

  • Why does this matter? “AI washing can be understood as the strategic overstatement or misrepresentation of artificial intelligence capabilities in products, services, and organisational narratives. At its core, it constructs an illusion of autonomy: outcomes are framed as the result of advanced machine‑learning systems, when in practice they may depend on conventional software, manual processes, or extensive human labour. […]” ​

  • “To reduce the risk of AI washing and ensure compliance with emerging regulatory standards, organisations should adopt clear internal governance measures regarding the development, classification, and communication of AI systems. Effective governance requires transparency not only in the technical functioning of AI systems, but also in how these systems are presented to consumers, investors, and regulators.”

2) Data protection

• The EDPB has launched a dedicated contact form for stakeholders to report possible inconsistencies in how the GDPR is interpreted across Europe.

  • Why does this matter? “The new tool enables stakeholders to report alleged divergences between national positions, as well as between national positions and those of the EDPB.”

• The Franch Data Protection Authority (CNIL) published a compendium of G7 data protection and privacy authorities approaches on smart glasses.

  • Why does this matter? “This compendium provides a high-level overview of current developments in each G7 jurisdiction. Looking across jurisdictions can provide valuable insight into common concerns and approaches and has the potential to help develop future common positions to address this global challenge.”

  • At the G7 data protection and privacy authorities roundtable several other important topics have been discussed:

    • Children’s protection online and age assurance (see the “Statement for Privacy-Preserving Age Assurance”),

    • Connected Home Devices and Children’s Privacy (see the “G7 Data Protection and Privacy Authorities Joint Paper on Connected Home Devices and Children’s Privacy”),

    • Smart glasses (see above),

    • Agentic AI,

    • Enforcement cooperation,

    • Data Free Flow with Trust.

  • China has also issued the first industry code of conduct for smart glasses.

    • Why does this matter? “The voluntary code calls on smart eyewear manufacturers to adopt a “minimum data collection” approach, provide clear indicators when cameras or microphones are active, and obtain explicit user consent before recording.”

• CERRE also published a paper (authors: Marco Bassini and Cristiana Firullo) on “Making Data Protection Fit for the Age of AI”.

  • Why does this matter? “This report examines the Digital Omnibus […] as both a legal and an economic intervention in the EU digital rulebook. […] We conclude that the Omnibus is a constructive attempt to make EU data protection fit for the age of AI. However, to help Europe make the most of AI, lawmakers must clarify the law and ensure changes do not hurt smaller businesses, thus stifling competition.”

• Yeong Zee Kin, Chief Executive of the Singapore Academy of Law argues in a blog post that data embassies can be potential solutions to data localization requirements. However, as he concludes, “these concepts demand rigorous debate, targeted pilot initiatives, and continual refinement to ensure they effectively address both commercial needs and regulatory oversight.”

  • Why does this matter? “Over the past few years, geopolitical contestations have increased the rhetoric over data sovereignty. […] One natural response is to mandate the localization of data. […] The data embassy was initially developed as a government-to-government (G2G) arrangement. It has since seized the attention of businesses as a solution to circumvent data localization requirements. The primary motivation is to extend domestic laws and standards of protection to data that has been exported. […]

  • This paper explores “how increasing data localization requirements, fuelled by shifting geopolitical landscapes and heightened security concerns, present significant challenges to the seamless flow of information essential for the digital economy. In response, policy innovations such as data embassies and data corridors offer promising, albeit nascent, pathways to reconcile the imperatives of cross-border data transfers with legitimate governmental interests.”

3) Cybersecurity

• The International Monetary Fund (IMF) published an article, titled “Artificial Intelligence and Cybersecurity in the Financial Sector”.

  • Why does this matter? “[…] This note argues that the main financial stability concern lies less in new types of cyberattacks than in the scale effects AI can unleash across common technologies, amplifying how quickly and widely risks spread. Strong governance and technical controls that limit the “blast radius” of breaches—that is, the scope of damage they can cause—and effectively contain their spread, robust response and recovery capacity, and stronger international coordination will be essential to safeguard financial stability. A whole-of-nation approach, bringing together government, the private sector, and other stakeholders, is warranted given the cross-sector implications, limited private incentives for adequate cyber risk management, and benefits of public-private collaboration.”

4) Digital Policy, Cloud and Data Strategy

• Ireland assumed the Presidency of the Council of the European Union from 1 July to 31 December 2026. The Policy Programme of the Irish Presidency is available here.

  • Why does this matter? The Irish Presidency will take forward an agenda, focusing on competitiveness, values and security.

• The European Commission has published a new study, “The EU’s Critical Digital Capacities: Deployment Beyond 2027”, revealing both strengths and gaps in Europe’s digital transformation ahead of the next Multiannual Financial Framework.

  • Why does this matter? “The study finds that next EU funding programme must address challenges around underinvestment, skills shortages, and market fragmentation, while building on existing strengths in green digital solutions, open source and a trusted regulatory and data protection framework.”

• The European Parliament published a briefing, titled “Possible EU own resource based on a digital levy - Cross-border services trade, digital transformation and tax implications”.

  • Why does this matter? “[…] Services can now also be produced digitally and supplied automatically, which will expand further with artificial intelligence (AI). Automated digital services (ADSs) can be supplied from the cloud, so that there is no specific location for the place of supply. […] many countries have adopted unilateral measures, especially digital services taxes (DSTs). […] The various DSTs adopted by states all over the world have targeted a range of digitalised transactions, mainly sales to consumers. Overall, they cover only some 16 % of global cross-border services. The DST proposed for the EU in 2018 was targeted at services ‘characterised by user value creation’. If adopted now, it would cover some 10 % of EU cross-border services imports, generating up to an estimated EUR 7 billion annually. Extended to the wider scope of DSTs adopted by all EU Member States, it would cover 19 % of such imports, raising the estimated revenue to some EUR 13 billion annually. Consideration could also be given to a DST that applies to all ADSs. […] This would cover 33 % of EU imports of cross-border services, or 39 % by including payments for intellectual property rights (IPRs), generating almost EUR 32 billion annually. A broader tax would also have a less discriminatory effect, making it harder to treat as a trade barrier.”

  • It´s worth noting that President Trump has vowed to impose a 100% import tariff on any European country that introduces a digital services tax on American technology giants. (BBC)

Share

D) Scientific papers in AI, data protection & more

• “Small Agent Group is the Future of Digital Health” (authors: Meng et al.)

  • Why does this matter? “[…] real-world clinical needs include not only effectiveness, but also reliability and rea sonable deployment cost. Since clinical decision making is inherently collaborative, we challenge the monolithic scaling paradigm and ask whether a Small Agent Group (SAG) can support better clinical reasoning. SAG shifts from single-model intelligence to collective expertise by distributing reasoning, evidence-based analysis, and critical audit through a collaborative deliberation process. […] Our results show that SAG achieves superior performance compared to a single giant model, both with and without additional optimization or retrieval-augmented generation. These findings suggest that the synergistic reasoning represented by SAG can substitute for model parameter growth in clinical settings. Overall, SAG offers a scalable solution to digital health that better balances effectiveness, reliability, and deployment efficiency.”

  • Overview of the SAG architecture and workflow (Figure 2 of the article):

    

    Source: Figure 2, Small Agent Group is the Future of Digital Health, p. 3

• “Disparate privacy risks from medical AI” (authors: Knolle et al.)

  • Why does this matter? “Medical artificial intelligence (AI) models hold the promise to improve global access to high-quality diagnostics. However, the training data underlying these models often contain sensitive patient information that may be exposed through privacy attacks. […] We focus on membership inference attacks (MIAs), which seek to determine whether the data of a given individual were used to train a model. […] Together, our findings show that aggregate privacy metrics can severely underestimate individual privacy risk. Whether the disparate risk profiles we observe extend to attacks beyond MIAs remains an open question, motivating the further development of risk assessment and mitigation techniques that cater to all data-contributing patients.”

E) Data, Technology & Company news

• As of June 30, the US export controls on Anthropic´s Fable 5 and Mythos 5 have been lifted.

  • Why does this matter? Fable 5 will be available starting July 1, to users globally on certain payment plans. Access to Mythos 5 has been restored “for a set of US organizations, following the US government’s approval on June 26.” The access will be exapnded, in coordination with the US government, to the broader set of domestic and international partners of Anthropic in the Glasswing program.

  • Anthropic also introduced Sonnet 5, the most agentic Sonnet model yet that “can make plans, use tools like browsers and terminals, and run autonomously at a level that, just a few months ago, required larger and more expensive models.”

• The French domestic intelligence agency (DGSI) is dropping Palantir and it will replace the American firm’s data-analysis tools with software from ChapsVision, a French company. (The Next Web)

  • Why does this matter? “Germany’s domestic intelligence service, the BfV, recently chose ChapsVision over Palantir for its own data analysis, and the Bundeswehr has been pressing for a secure cloud in which no foreign firm has structural access. […] In Britain, the government has been reviewing its £330m NHS contract with the firm. The pattern is European governments reconsidering how much of their most sensitive infrastructure should run on American software.”

1. Regulatory & enforcement actions

• The European Commission issued a fine of €200 million to Temu under the Digital Services Act.

  • What does this mean? “The evidence at the disposal of the Commission indicates that consumers in the EU are very likely to encounter illegal items on Temu.”

  • What is the background to this? “The company failed to diligently identify, analyse, and assess the systemic risks of illegal products being offered on its platform and the resulting harm to consumers in the European Union.”

    • “Temu’s risk assessment of 2024 falls short of the standards laid out in the DSA:

      • It is based on general information about risks concerning the eCommerce sector as a whole, rather than on specific evidence about Temu’s own service, including public reports and testing.

      • It seriously underestimated how often EU consumers are likely to encounter illegal items. Evidence from a mystery shopping exercise included in the Commission’s investigation shows that a very high percentage of the selected chargers failed basic safety tests, while a high percentage of tested baby toys posed safety risks of medium to high severity, as they contain chemicals exceeding legal safety limits or pose suffocation hazards due to detachable parts.

      • It did not properly assess how the design of its service - including recommender systems and product promotion programmes by affiliated influencers - could amplify dissemination risks of illegal products.”

  • What are the next steps? “Temu has until 28 August 2026 to submit an action plan to the Commission, as required by Article 75 of the DSA. The plan must set out measures to remedy the breach of its risk-assessment obligations. The European Board for Digital Services will have one month from receipt of the plan to issue its opinion. The Commission will then have a further month to adopt its final decision and set a reasonable period for implementation. Failure to comply with the non-compliance decision may lead to periodic penalty payments. The Commission continues to engage with Temu to ensure compliance with the decision and with the DSA more generally.”

• The Special Panel on child safety online met for the third and final time on June 16.

  • What does this mean? “Discussions focused on lessons learned and good practices in the EU and in partner countries, as well as on crucial topics such as the empowerment of parents and guardians to ensure their children’s wellbeing online. This meeting builds upon insights from the two previous gatherings of the Special Panel on child safety online, which examined the risks and benefits of digital services for children and the EU regulatory framework for protecting minors online, respectively.”

  • What is the background to this? “On the occasion of the final panel, a new Eurobarometer survey confirms the significant impact of excessive screentime and social media on the mental and physical health of young people. On average, young people across Europe spend 4.5 hours online during a school day and 6.1 hours a day at weekends. Most strikingly, 14% of adolescents report spending more than 10 hours a day on screens.”

  • What are the next steps? “On 13 July, the Panel’s Co-chairs will present recommendations to President Ursula von der Leyen on how to further strengthen the EU’s trailblazing framework for the protection of minors online.”

• In the context of the EU-Brazil Digital Partnership in Brasília, the Commission’ services responsible for enforcing the DSA signed an administrative arrangement focused on the protection of minors online with Brazil’s Agência Nacional de Proteção de Dados (ANPD).

  • What does this mean? “The arrangement strengthens cooperation on the protection of minors online between the Commission’ services and ANPD, with special attention paid to transparency obligations for digital platforms, risk assessment and mitigation measures, and technological cooperation on algorithms and artificial intelligence. The arrangement will facilitate information exchange, including technical expert dialogues. It will, for instance, enable both authorities to share best practices, conduct joint studies, and cooperate on research projects.”

  • What is the background to this? “The Commission services have signed similar administrative arrangements with the UK's Ofcom and Australia's eSafety Commissioner. The three regulators launched a trilateral cooperation group on age assurance. More recently, the Commission has signed an arrangement with Japan's Ministry of Internal Affairs and Communications.”

  • What are the next steps? “The Commission remains committed to expanding global collaboration with leading national regulators to ensure a fair and safe digital future.”

• G7 agreed on common principles for protecting minors online.

  • What does this mean? G7 Digital and Tech Ministers, are committed to affirming the following principles defining a safer and more secure digital space for minors:

    • Principle 1: Effective age assurance is key to ensure a safer, more secure, and age-appropriate experience for minors.

    • Principle 2: Protect minors from harms online through safety by design approaches such as protective and by default settings, including parental control tools, which prevent minors from being exposed to content, interactions and features that are not age appropriate, safe and secure.

    • Principle 3: The creation and distribution of child sexual abuse material and criminal activity related to non-consensual intimate imagery must be prevented, consistent with G7 members’ current applicable legal obligations.

    • Principle 4: Parents, guardians and carers should be equipped with easy-to-use, privacy-respecting, effective parental control tools that are interoperable when technically feasible to help guide and empower minors online.

    • Principle 5: Minors should be empowered with a comprehensive education focused on building the necessary literacy and skills in order to better understand digital systems, and critically engage with digital technologies, media and information, to recognize risks and thrive online.

    • Principle 6: Minors’ safety is safeguarded by the implementation of risk management, assessment and mitigation, and following safety-by-design approaches.

    • Principle 7: Building a safer and more secure digital space for minors is enabled by digital service providers’ cooperation with relevant stakeholders.

  • The European Commission welcomed the G7 agreement on the abopve principles.

    • What is the background to this? “The agreed principles are firmly based on the EU’s ambitious approach, which combines decisive enforcement actions to hold platforms accountable with a collective societal effort to strengthen media literacy and raise awareness. Specifically, they reflect existing measures at EU level to protect and empower children, from the Digital Services Act (DSA) and its Guidelines on the protection of minors, over the Better Internet for Kids Strategy (BIK+), to the AI Act and the action plan against cyberbullying, and beyond.”

  • UNICEF also welcomed the G7 digital and technology ministers’ landmark agreement on common principles for a safer digital space for children.

• Bureau Européen des Unions de Consommateurs (BEUC*) filed a complaint against Meta, TikTok and Google with the European Commission and the competent national Digital Services Coordinators together with 29 members across 27 countries. (*BEUC is the umbrella group for 42 independent consumer organisations from 31 countries.)

  • What does this mean? “Under the Digital Services Act (DSA), Meta, TikTok and Google are required to have effective mechanisms in place to fight fraudulent ads and reduce the risks to consumers. However, our evidence gathering shows that Meta, TikTok and Google not only fail to pro-actively remove fraudulent ads but also do little when notified about such scams.”

  • What is the background to this? “The findings show that financial scams remain widespread on Meta, TikTok, and Google, and that platforms systematically fail to take effective corrective actions.
    In total, we flagged 893 fraudulent ads across 13 countries that were active on either Meta, TikTok or Google.

    In a nutshell, consumer groups found that:

    • Meta rejected nearly 43% of the submitted ads.

    • TikTok only removed 21% of the submitted ads. In 37% of the cases, TikTok claimed that the ad was removed before they could review it.

    • Google removed 60% of the submitted ads.”

2. Guidelines, opinions, reports & more

• The European Commission is seeking feedback on its draft guidelines on trusted flaggers, organisations specialised in identifying illegal content online. Feedback can be provided by 10 July.

  • What is it about? “The draft guidelines clarify the criteria, as well as the process by which the Digital Services Coordinators award the ‘trusted flagger' status. They also provide guidance on the technical requirements trusted flaggers and platforms should follow when processing notices of illegal content. Finally, the guidelines aim to ensure trusted flaggers remain independent, objective and accountable, and that they are operating in full respect of freedom of expression. The guidelines also include measures to safeguard the integrity of trusted flaggers, to ensure the mechanism is not misused. These measures include public annual transparency reports by trusted flaggers, as well as procedures to suspend or revoke the status of trusted flaggers.”

  • More than 70 trusted flaggers have already been appointed under the DSA.

  • The Commission has published a study mapping key stakeholders and assessing the early stages of implementation of the trusted flaggers mechanism.

• The DSA Observatory published an analysis, “State of Play of DSA Dispute Settlement: Meaningful Redress, Uneven Results”.

  • What is it about? “After almost two years of certified out-of-court dispute settlement (ODS) bodies operating under Article 21 of the Digital Services Act (DSA), the first transparency reports provide early evidence of how this new due process layer operates in practice. Drawing on 2025 data from multiple ODS bodies, this article assesses what value the system is already delivering, and where current constraints, including platform participation and information-sharing, limit its effectiveness. We discuss possible ways forward, including stronger incentives, technical infrastructure and feedback loops.”

• The DSA Observatory also published an analysis, titled “Digital Fairness Act: Why we need an ambitious DFA to protect digital consumers from manipulative and addictive design practices” (by John Albert, Marijn Sax, and Natali Helberger).

  • What is it about? “In this policy brief, we advocate for an ambitious Digital Fairness Act that futureproofs EU consumer law and protects consumers from the full range of unfair digital commercial practices across digital services, including deceptive interfaces, manipulative design, and addictive features. This brief builds on proposals developed in the report “Towards Digital Fairness”.”

• Pál Szilágyi wrote about a recent German court judgment (OLG Dresden, 14 UKl 3/25) on Art. 25 DSA, assessing dark patterns in the online booking process.

  • What is it about? “The DSA expressly excludes from its scope practices that fall within the ambit of the Unfair Commercial Practices Directive 2005/29/EC (UCPD), even where the UCPD does not prohibit them. […] This reasoning is consistent with the earlier OLG Bamberg decision (GRUR-RR 2025, 238) and establishes an important principle: the DSA dark pattern prohibition is residual in nature, it only applies where the UCPD leaves a gap.”

• Global Advisory Experts published a Compliance Checklist for Streaming Platforms, Creators & Publishers in Germany.

  • What is it about? “This guide delivers the step-by-step compliance checklists, contract templates and implementation roadmaps that streaming platforms, content creators and publishers need right now to meet their obligations under the DSA and the DDG in 2026.”

• Eucrim published an “Overview of the Latest Developments Under the Digital Services Act: November 2025 - February 2026” (by Dr. Anna Pingen).

  • What is it about? “This news item continues the reporting on the latest DSA developments by giving a chronological overview. It covers the period from November 2025 to February 2026.”

3. Further DSA resources

• DSA Transparency Database

• DSA whistleblower tool

• The enforcement framework under the DSA

• List of designated very large online platforms and search engines under DSA

• Transparency reports of VLOPs and VLOSEs

• European Board for Digital Services

• Digital Services Coordinators

• Trusted flaggers under the DSA

• The Code of Conduct on Disinformation

• The Code of conduct on countering illegal hate speech online +

• EU Disinfo LAB

A) Regulatory developments

1) AI

• California Governor Newsom signed first-of-its-kind executive order to prepare workers and businesses for potential AI disruption.

  • Why does this matter? “The order mobilizes state agencies, labor experts, economists, universities, and industry leaders to develop new policies, gather data, and identify early warning signs of workforce disruption — while ensuring workers share in the gains created by AI-driven productivity.”

  • Several mass layoffs due to the use of AI have been announce recently, e..g, “Oracle shed about 21,000 roles globally in the last year as the US technology giant reshapes its business around artificial intelligence (AI) […]” (BBC), “Amazon and Facebook-owner Meta have cut thousands of job in recent months as they invest heavily in AI.” (BBC). According to Tech Crunch, “so far this year, there have been an estimated 363 layoffs at tech companies this year, affecting nearly 150,000 people — a pace of about 974 people per day, 44% faster than last year — according to TrueUp, a tech job board and recruiting platform that also runs one of the most widely cited tech layoff trackers. […] AI was the most-cited reason for layoffs across every industry for the third month running according to outplacement firm Challenger, Gray & Christmas. […]”

• The Irish Government published the Regulation of Artificial Intelligence Bill 2026. (The Bill text is available here.)

  • Why does this matter? “The Bill, once enacted, will give effect in Ireland to the EU Artificial Intelligence Act […]. The Bill establishes Oifig IS na hÉireann (AI Office of Ireland) as an independent statutory body which will act as Ireland's central coordinating authority for the implementation of the AI Act.”

2) Data protection

• As NOYB reports, “as part of the ‘Digital Omnibus’, the European Commission […] wanted to get rid of cookie banners and replace them with an automated signal. […] In the Council’s latest position paper of 18 June, the plan to abolish the cookie banner has been scrapped. […]” (NOYB)

  • Why does this matter? “Users should actually have the option here to consent only if they wish to be tracked online of their own free will. Depending on the study, only around 3–10% of people want this. However, through so-called dark patterns (e.g. hidden ‘No’ buttons or pre-ticked consent boxes), the tracking industry achieves consent rates of up to 90%.”

• The Ada Lovelace Institute published a blog post commenting on the EU Digital Omnibus.

  • Why does this matter? “Much of the discussion around the EU Digital Omnibus proposal has focussed on article-by-article analysis of the proposed changes and their individual impacts. Although it is critical to make sure that the individual articles are sound, we must look at what the articles achieve together. This post draws on new legal analysis that examines five individual amendments to the GDPR in the Omnibus and their cumulative effects on both the overall level of protection the GDPR offers and primary EU law.”

3) Digital Policy, Cloud & Cybersecurity

• The European Commission published the fourth State of the Digital Decade report, showing that Europe has made progress on its 2030 digital transformation targets.

  • Why does this matter? “The Digital Decade Policy Programme serves as the EU's strategic compass for advancing and investing in Europe's digital competitiveness and sovereignty. The report evaluates progress made by the EU in its digitalisation across the board, including in critical infrastructures, digitalisation of business, digital skills, and digitalisation of public services. This year, the report goes beyond stocktaking, outlining priority reforms and investments at EU and Member States level in an attempt to guide digital funding allocations in the next EU Multiannual Financial Framework.”

  • What are the next steps? “[…] the Commission calls on Member States to update their National Digital Decade Roadmaps with concrete measures, while ensuring stronger alignment with the next Multiannual Financial Framework, notably in the context of the preparation of the National and Regional Partnership Plans and the future EU Competitiveness Fund. […]”

  • The Commission also published the last Special Eurobarometer, showing that “79% of Europeans rank digital policy as a top EU priority in shaping the future.”

• Norway plans to impose a ban on the use of generative AI tools among primary school students, while there are also plans to restrict the use of such tools in the education of older children to avoid a negative impact on learning. (Reuters)

  • Why does this matter? “Pupils from first ​through seventh grade, aged 6 to 13, should as a general ​rule not be using AI, while those in lower secondary school, aged 14 to ‌16, can ⁠cautiously adopt tools under teachers' supervision, the government said. In upper secondary education, from ages 17 to 19, students should learn to use AI appropriately so that they are prepared for further education and work […]”

B) Enforcement actions

1) AI

• With the advent of AI, there are almost countless lawsuits and other cases related to the use and development of AI, especially in various copyright, privacy, defamation, employment, product liability, and consumer protection cases. I have collected several websites and databases that collect legal disputes, lawsuits and other enforcement actions initiated against AI companies or in connection with AI-based products or services:

2) Data protection

• The Italian Data Protection Authority (Garante) issued an EUR 180,000 fine to Emirates as the airline did not comply with the principles of transparency and limit the retention of data to the period strictly necessary. (A summary is also available in this Reuters´report in English.)

  • Why does this matter? “Airlines may process the health data of passengers with disabilities or reduced mobility (PMR) without obtaining their consent when this is necessary to ensure the safety of transport and assistance during the journey, in accordance with the provisions of the sector regulations. However, they must ensure compliance with the principles of transparency on data processing and limit their retention to the period strictly necessary to pursue these purposes.”

3) Digital Policy, Cloud & Cybersecurity

• According to Westlaw Today, “two companies affiliated with Madison Square Garden are facing separate class-action lawsuits alleging they negligently handled customer data, allowing a hacker group to steal customer information tied to about 26 million records.”

  • Why does this matter? “Both lawsuits claim the companies negligently maintained customers’ PII and left their computer systems vulnerable to cyberattacks. A key allegation in both suits is that the companies have failed to notify potential victims.”

• The Commission has informed Amazon and Microsoft of its preliminary view that they should be designated as gatekeepers under the Digital Markets Act (DMA), for their cloud computing services, Amazon Web Services (AWS) and Microsoft Azure (Azure) respectively.

C) Opinions, guidelines, reports & other publications

1) AI

• The Commission extended the deadline in the consultation on the draft guidelines for the classification of high-risk AI systems. The new dedline is July 23, 2026.

  • Why does this matter? The consultation aims to collect feedback on the clarity of the guidelines and usefulness of the examples. The final guidelines will be adopted by the end of 2026.

• The UK´s Government Office for Science published its set of AI 2030 scenarios (“AI Scenarios 2030: Helping policy makers plan for the future of AI”). This Foresight report sets out 5 scenarios for how AI could develop by 2030 and it updates the first version of the report that was published in 2025.

  • Why does this matter? “These scenarios are tools for exploring uncertainty, stress-testing and developing policy. They are not predictions, and the future may involve elements from all scenarios. It is, however, clear that AI will have a profound impact by 2030.”

  • The key findings are as follows:

    • “AI capabilities will continue to increase. […]

    • AI could deliver widespread positive impacts. […]

    • AI could cause serious, potentially even existential harms, without government intervention. […]

    • The potential impact on cognitive labour is significant. […]

    • The frontier AI market is expected to remain highly concentrated toward 2030. […]

    • Adoption continues to increase, but the speed, distribution, and extent of adoption are expected to be varied. […]

    • Global competition is expected to continue, as economies become increasingly reliant on technology to drive growth and spheres of influence emerge, led by the United States (US) and China. […]”

• OECD published a working papaer, “The OECD AI exposure measure -

  Mapping the OECD AI Capability Indicators to occupations”.

  • Why does this matter? “This paper develops a new OECD measure of occupational AI exposure based on the OECD AI Capability Indicators. The measure addresses the need for a forward-looking, transparent and updateable approach to assessing how AI may affect work, skills and education over the next 5 to 10 years. It does so by mapping AI capabilities across nine cognitive, social and physical domains to occupational requirements and constructing an AI Capability Gap index. […] The measure provides a transparent foundation for analysing task-level transformation, changing skill demand and future labour-market effects, while recognising that actual impacts will depend on adoption, regulation, organisational change and social choice.”

2) Data protection

• The International Working Group on Data Protection in Technology published a working paper on Extended Reality.

  • Why does this matter? “[…] This technology raises serious concerns about privacy, not just for users, but also for bystanders whose presence and actions may be tracked

    with these devices. While many of the privacy risks presented by extended reality are common in other technologies as well, extended reality presents unique risks due to the source, type, and volume of information that it processes - just twenty minutes in a virtual reality simulation can generate nearly 2 million unique body language recordings. This paper provides a discussion basis for this issue by setting out an explanation of extended reality, what data is processed through this technology, and what privacy risks it presents. Finally, this paper proposes some recommended actions for extended reality developers as well as policymakers and regulators.”

• The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) has drawn up a list of types of processing for which a data protection impact assessment (DPIA) is not required. In order to ensure that this list is in line with practice, the DPA started a consultation until August 10, 2026. (The list is available here in Dutch. For an unofficial English translation, please see Luis Alberto Montezuma´s LinkedIn post).

  • Why does this matter? The intention of the DPA is to make GDPR compliance easier for SMEs, independent entrepreneurs, etc. For this reason, the processing operations listed by the DPA are not subject to a DPIA obligation insofar as they are carried out by controllers who are professionals or another natural person without an employment contract, or who are employers with a maximum of 250 employees.

• Consumer Reports´ investigation revealed Uber and Lyft AI-driven pricing lead to significantly different prices for customers.

  • Why does this matter? “A new investigation by Consumer Reports (CR) […] has uncovered that Uber and Lyft leverage AI-driven pricing tactics to routinely charge different customers significantly different prices for rides ordered at roughly the same times. This comprehensive investigation stems from consumer complaints and real-life observations, and highlights the pervasive issue of opaque pricing algorithms designed to optimize revenue by extracting more money from consumers.”

• The EDPB has published an update of the One-Stop-Shop (OSS) case digest on right to object and right to erasure.

  • Why does this matter? “The one-stop-shop thematic case digest on the right to object and right to erasure offers insights in how data protection authorities (DPAs) analyse the internal processes implemented within organisations to comply with these rights, lists the most frequent infringements and gives an overview of which corrective measures have been issued.”

• The EDPB launched its newly redesigned website.

  • Why does this matter? “The EDPB website now serves as a fully integrated digital resource, which also incorporates the “Data Protection Guide for Small Business” and the redesigned Coordinated Supervision Committee (CSC) website, and will bring together upcoming projects such as the “Privacy for Kids” hub.”

3) Cybersecurity

• The Five Eyes cyber security agencies issued a statement on the evolving landscape of AI that is rapidly transforming cyber risk.

  • Why does this matter? The following practical actions are proposed:

    • “Reduce your attack surface […]

    • Accelerate patching processes […]

    • Address legacy systems […]

    • Review and strengthen identity and access controls […]

    • Prepare for incidents before they happen […].”

• The World Economic Forum released guidance detailing cybersecurity risks and the potential benefits of implementing Zero Trust Architecture.

  • Why does this matter? “[…] companies paid an estimated $4.44 million per data-breach incident, according to research by IBM and Ponemon Institute. But a zero-trust architecture creates stronger identity-centric security controls and faster breach containment, which could lower data-breach costs.”

4) Digital Policy, Cloud and Data Strategy

• The European Law Institute (ELI) published its 1st Supplement to the ELI’s work on product liability, titled “Liability for Defective Software Under the New EU Product Liability Regime - Will Liability Under the New PLD Extend to Social Media, AI Chatbots and Similar Digital Consumer Offerings?”.

  • Why does this matter? The document sets out three possible routes by which liability for social media, AI chatbots and comparable consumer offerings might be construed under the new PLD, subject to the CJEU’s eventual position:

    • Route No. 1: The Digital Offering Itself Qualifies as ‘Software’ Made Available on the Market

    • Route No. 2: Software as a Product is Used for Supplying the Digital Offering as a Service

    • Route No. 3: The Digital Offering is a Service Related to Software as a Product

  • “[…] it is important to recall that the PLD is not the only potential basis of liability, as Art 2(4)(b) PLD expressly underlines. Apart from contractual causes of action, the tortious liability of service providers may therefore also be based on negligence. This could include, for example, liability for non-compliance with obligations under the Artificial Intelligence Act or under the Digital Services Act (DSA) – see, for example, Art 54 DSA on compensation, and see obligations such as Art 28 DSA on the protection of minors”

Share

D) Scientific papers in AI, data protection & more

• “A relative mess: Identifying data subjects in multi-party processing” (author: Jennifer Cobbe)

  • Why does this matter? “[…] The question of when an individual is in some way ‘identifiable’ therefore helps determine whether its processing falls within data pro tection law’s framework. I argue that the CJEU’s jurisprudence on this question in practice combines with common multi-party processing arrangements to produce a space of effective legal immunity around shadow processing for speculative accumulation of and value extraction from data relating to people, beyond the reach of data protection law. This is because the CJEU’s modified relative understanding of identifiability systematically excludes certain supply chain actors from the law’s scope. In doing so, this interpretation undermines data protection law’s purpose and objectives of protecting people’s rights and interests where information about them is being processed, operates retrospectively and produces legal uncertainty for many parties, and leaves governance of shadow processing to unsuitable private law mechanisms. This interpretation should be rejected in favour of a contextual and pluralistic one, which better accounts for the distributed and multi-party nature of data processing today.”

• “How to Detect and Measure the AI Dangers to Democracy” (authors: Giulia Sandri and Claudio Novelli)

  • Why does this matter? “[…] In many phases of democratic systems, principals delegate key functions to AI systems and their providers without really being able to monitor how these systems operate or the outputs they produce. Treating AI as a delegation problem helps identify accountability gaps and other governance failures. Most importantly, as we shall illustrate, it provides metrics for empirical assessments of AI impact on democracy. […], we propose an analytical framework that centers on institutional assessability as the central condition for democratic control over AI. However, we stress that how severe a harm is, and how much risk is acceptable, are evaluative judgments that current methodologies neither acknowledge nor operationalize. This becomes acute when such evaluative judgments are (silently) delegated to private vendors. We identify this as a strong limitation left for future work.”

E) Data, Technology & Company news

• Midjourney has introduced a medical scanner that can compete with conventional MRI scanners but is much easier to use. (Heise Online)

  • Why does this matter? “In just one minute, such a device is supposed to create a complete scan of a body using ultrasound. […] The quality is said to be comparable to an MRI scan but take only a fraction of the time. The stated goal is to collect as much data as possible for better medical care […] “Our ambitious goal is by 2031 to have a fleet of over 50,000 scanners worldwide - with a total scanning capacity of a billion scans a month,” Midjourney writes. This could cover “a huge percentage of the global population,” or scan a billion people once a month.”

• Google introduced “the Open Knowledge Format (OKF), an open specification that formalizes the LLM-wiki pattern into a portable, interoperable format.”

  • Why does this matter? “This is a vendor-neutral, agent- and human-friendly standard for representing the metadata, context, and curated knowledge that modern AI systems need.”

  • “[…] You need a format, a way to represent knowledge that:

    • Anyone can produce, without an SDK

    • Anyone can consume, without an integration

    • Survives moving between systems, organizations, and tools

    • Lives in version control alongside the code it describes

    • Is readable by humans and parseable by agents: the same file, no translation layer

    By design, OKF is that format.”

• SpaceX announced it will acquire the AI coding startup Cursor for $60 billion in an all stock transaction. (CNBC)

  • Why does this matter? “The Cursor deal could bolster SpaceX efforts to compete with rivals like Anthropic and OpenAI, which offer popular coding tools.”

  • How does this deal make sense? According to the Yahoo! Finance report, `“It’s all about vertical integration,” explained Shay Boloor, chief market strategist at Futurum Equities. “At the bottom [SpaceX is] pretty well fit with energy infrastructure and compute,” Baloor said. “In the middle, it’s … the model layer through xAI, which is okay, it’s not great — [CEO Elon Musk has] been very public about why it’s lagged and why he wants to improve that area. The top of that stack is one of the fastest-growing AI applications in the world, which is Cursor. And if you speak to a lot of developers who use Cursor, they will never leave that platform.”`

I also collected some prominent regulatory, and policy trackers, as well as EU AI Act compliance checkers, AI incident and vulnerability databases, AI risk trackers, and AI indexes.

Happy browsing!

AI litigation and enforcement trackers

1. Worldwide databases

• AI Hallucination Cases (by Damien Charlotin)

  • “This database tracks legal decisions in cases where generative AI produced hallucinated content – typically fake citations, but also other types of AI-generated arguments. It does not track the (necessarily wider) universe of all fake citations or use of AI in court filings.”

• AI Litigation Case Law Tracker (by Hogan Lovells)

  • “Our AI Litigation Case Law Tracker monitors key AI-related cases involving IP, copyright, media, commercial, consumer, data protection, and other laws across global jurisdictions.”

• Generative AI – Intellectual property cases and policy tracker (by Mishcon de Reya LLP)

  • “In this tracker, we provide an insight on the various intellectual property cases relating to generative AI going through the courts, as well as anticipated policy and legislative developments.”

• World Map of Copyright Suits (by ChatGPT is eating the world)

  • Copyright lawsuits

  • Status: February 15, 2026

2. Europe

• AI & Copyright Case Tracker (by AI & Copyright Case Experts of Taylor Wessing)

  • Up-to-date overview of ongoing lawsuits at the intersection of AI and copyright law across Europe

• AI and intellectual property case tracker (by Practical Law)

  • Not free.

  • “This case tracker lists and links to some key decisions made by the courts that consider legal issues relating to artificial intelligence (AI) and intellectual property.”

  • “The tracker focuses on the law of England and Wales, but will also cover EU and European Patent Office (EPO) decisions where relevant.”

Share

3. US

• AI Lawsuit Tracker (provided by a small editorail team with a mix of legal training, court-reporting experience, and software engineering)

  • U.S. federal cases and curated international filings

  • Copyright, privacy, defamation, employment, product-liability, and consumer-protection actions against AI companies and AI-driven products

• AI Tort Lawsuit Tracker (by ChatGPT is eating the world)

  • Tort lawsuits

• The Database of AI Litigation (DAIL) (by Ethical Tech Initiative at The George Washington University)

  • “The Database of AI Litigation presents information about ongoing and completed litigation involving artificial intelligence and related topics. It covers cases from complaint forward - as soon as we learn of them - whether or not they generate published decisions. It is intended to be broad in scope, covering everything from algorithms used in hiring and credit and criminal sentencing decisions to generative AI training and AI companion liability.”

• AI Litigation Tracker (by Fisher & Phillips LLP)

  • “The AI Litigation Tracker provides a comprehensive view of litigation matters filed across all 50 states that involve the use of AI technologies, such as Gen AI, resume screeners, electronic monitoring, notetaking, call recording, and other AI tools. The tracker includes all matters filed since February 25, 2021.”

• Standing Orders, Local Rules, and Decisions on the Use of AI (by Ropes & Gray LLP)

  • Cases and court rules on AI use

• AI Litigation Tracker (by McKool Smith P.C., Avery Williams)

  • Regular updates on key generative AI-focused copyright infringement-related litigations impacting the media and entertainment industries

• Federal Court AI Cases Involving Copyright Claims (by Copyright Alliance)

  • Copyright cases

  • US federal courts

• AI Cases Bot (by Free Law Project)

• Case Tracker: Artificial Intelligence, Copyrights and Class Actions (by Baker & Hostetler LLP)

  • This case tracker is in archive mode.

  • This case tracker monitors key U.S. litigation that raises copyright (and copyright adjacent) issues related to the creation and use of generative AI.

• A visualisation of selected lawsuits from over 100 filed against AI companies as of June 2026 (by David McCandless, Information is Beautiful)

4. Canada

• Canadian AI Case Tracker (by Anand & Siu LLP)

  • This is a curated list of interesting and important artificial intelligence (AI) related cases that are ongoing or have been decided in Canada.

AI regulatory & policy trackers

• Global AI Regulation Tracker (by Raymond Sun, techie_ray)

  • “An interactive world map that tracks AI law, regulatory and policy developments around the world.”

• AI Tracker – Tracking AI law and policy globally (by Herbert Smith Freehills Kramer LLP)

• AI Regulatory Horizon Tracker (Bird & Bird)

• AI Watch: Global regulatory tracker (by White & Case)

• The OECD.AI Policy Navigator (by the OECD)

• Digital Regulation Tracker Tool (by CMS)

• Global AI Law and Policy Tracker (by IAPP)

  • Full access is available for IAPP members.

• Global Artificial Intelligence Policy Tracker (by Bhaskar Bhatt and Niraj Bhusal)

• U.S. AI Law Tracker (by Orrick, Herrington & Sutcliffe, LLP)

• US State AI Governance Legislation Tracker (by IAPP)

  • Full access is available for IAPP members.

EU AI Act Compliance Trackers

• EU AI Act Compliance Checker (by AI Act Service Desk, AI Office)

  • “The official AI Act Compliance Checker helps users understand which AI Act rules may apply to their AI system, including possible obligations for providers, deployers and other operators under Regulation (EU) 2024/1689.”

  • Betta version

• EU AI Act Compliance Checker (by Future of Life Institute)

• COMPL-AI (by ETH Zurich, INSAIT, and LatticeFlow AI)

  • “COMPL-AI is an open-source compliance-centered evaluation framework for Generative AI models”

AI Incident and Vulnerability Databases

• AI Incident Database (by The Responsible AI Collaborative)

• MIT AI Incident Tracker (by MIT AI Risk Initiative)

  • “The MIT AI Incident Tracker classifies more than 1,400 real-world report incidents from the AI Incident Database by risk, cause, harm, severity, and other relevant dimensions.”

• OECD AI Incidents and Hazards Monitor (AIM) (by OECD)

  • “The OECD AI Incidents and Hazards Monitor (AIM) documents AI incidents and hazards to help policymakers, AI practitioners, and all stakeholders worldwide gain valuable insights into the risks and harms of AI systems.”

• AI Vulnerability Database (by AI Risk and Vulnerability Alliance)

• AIAAIC [AI, Algorithmic and Automation Incidents and Controversies] Repository (by Charlie Pownall & individual contributors)

  • “The independent, grassroots public interest collection of incidents and ethical controversies caused by and associated with AI, algorithms, and automation.”

AI Risk trackers and taxonomy

• MIT AI Risk Repository (by MIT AI Risk Initiative)

  • MIT AI Risk Navigator

    • “The Navigator connects MIT’s AI Risk Repository datasets through a shared taxonomy […].”

• AI risk atlas (by IBM)

  • “Explore this atlas to understand some of the risks of working with agentic AI, generative AI, and machine learning models.”

  • AI Atlas Nexus

    • “AI Atlas Nexus provides tooling to bring together resources related to governance of foundation models. […] Our goal is to turn abstract risk definitions into actionable workflows that streamline AI governance processes. […] AI Atlas Nexus builds on the IBM AI Risk Atlas making this educational resource a nexus of governance assets and tooling. […] Our intention is to create a starting point for an open AI Systems ontology whose focus is on risk and that the community can extend and enhance. This ontology serves as the foundation that unifies innovation and tooling in the AI risk space. By lowering the barrier to entry for developers, it fosters a governance-first approach to AI solutions, while also inviting the broader community to contribute their own tools and methodologies to expand its impact.”

• AI Risk Explorer (by Observatorio de Riesgos Catastroficos Globales, a project of Players Philanthropy Fund, Inc.)

  • “The AI Risk Explorer is an online platform monitoring the emergence and management of large-scale AI risks.”

AI Indexes and Benchmarks

• Artificial Analysis

  • LLM Leaderborad (by Artificial Analysis)

    • “Comparison of over 100 AI models from OpenAI, Google, DeepSeek & others”

• The AI Agent Index

  • “The AI Agent Index (AIAI) is a research project that documents and compares the capabilities, safety features, and transparency practices of prominent AI agents.”

  • “The 2025 AI Agent Index documents the origins, design, capabilities, ecosystem, and safety features of 30 prominent AI agents based on publicly available information and correspondence with developers.”

• The 2026 AI Index Report (by Stanford HAI)

  • “The mission of the AI Index is to provide unbiased, rigorously vetted, and globally sourced data for policymakers, researchers, journalists, executives, and the general public to develop a deeper understanding of the complex field of AI. To achieve this, we track, collate, distill, and visualize data relating to artificial intelligence.”

• BenchLM leaderboard (by @glevd)

  • “124 provisional-ranked models, 33 verified-ranked models, and 261 tracked LLMs. The most comprehensive LLM comparison tool — 249 benchmarks, real pricing, and runtime data in one place.”

• LLM-stats (by The AI Benchmarking Hub)

  • “Independent rankings of GPT, Claude, Gemini, Llama, DeepSeek and 300+ AI models — composite LLM Stats Score, updated continuously from public benchmarks and live API metrics. See the full LLM Leaderboard for complete LLM rankings with advanced filters.”

A) Regulatory developments

1) AI

• The European Parliament has given its final approval to the amendment of AI Act and the introduction of a “nudifier” app ban.

  • What are the next steps? “Before the law can enter into force, it still needs to be adopted formally by the Council.”

  • Why does this matter? The legislation postpones the application of certain parts of the AI Act regarding high-risk AI systems. Obligations will apply:

    • “from 2 December 2027 for stand-alone high risk AI systems;

    • from 2 August 2028 for AI systems embedded as safety components and covered by EU sectoral legislation on safety and market surveillance.”

  • “The law also delays the application of watermarking obligations on AI-generated content until 2 December 2026.”

  • “The law bans AI systems that generate child sexual abuse material or create images, videos and audio depicting an identifiable person’s intimate parts, or sexually explicit activities, without their consent. […] Companies will have until 2 December 2026 to bring their systems in line.”

• Estonia is set to become the first country to issue digital identities for AI agents. (Heise Online)

  • Why does this matter? “An independent identity can enable the AI agent to present itself to the system it is using as an agent acting on behalf of a specific principal, rather than pretending to be the principal itself. Based on this distinction, the system used can then grant granular access to functions or deny it.”

2) Data protection

• The Government of Canada introduced Bill C-36, an Act to enact the Protecting Privacy and Consumer Data Act (PPCDA), to amend the Personal Information Protection and Electronic Documents Act.

  • Why does this matter? “The proposed PPCDA represents the most significant change to Canada's private-sector privacy law in over 25 years. […] The PPCDA will establish clear guardrails to protect Canadians' personal information in a rapidly changing digital world, with a particular focus on children's personal information, while supporting responsible innovation, a stronger economy, and Canada's digital and data sovereignty.”

3) Digital Policy, Cloud & Cybersecurity

• The UK Government announced that social media platforms will be blocked from offering services to under-16s.

  • Why does this matter? “The government plans to use the same model for a social media ban as Australia. This would capture user-to-user platforms, whose purpose is to enable social interaction and which allow users to post material, alongside algorithms. The ban will therefore include platforms like Snapchat, TikTok, YouTube, Instagram, Facebook and X. We do not intend for messaging services like WhatsApp and Signal to be included in the social media ban.”

• In Hungary, the Government has submitted its legislative program for autumn 2026, which includes a number of proposals concerning data, data protection, artificial intelligence, cyber security and digital legislation. (The program is available here in Hungarian.) The relevant bills are scheduled to be submitted to the Parliament in October or November.

  • Why does this matter? The legislative proposals will concern, inter alia:

    • Amendment of Act C of 2003 on Electronic Communications

    • Bill on the mitigation of the harmful effects of digital devices on children.

    • Bill on Countering Disinformation.

    • Bill on the National Cybersecurity Agency.

    • Bill on the Digital Innovation Agency.

B) Enforcement actions

1) AI

• A new AI Tort Lawsuit Tracker has been launched. The tracker was created by Professor Edward Lee (University of Santa Clara, Law faculty). (For a map of the copyright lawsuits against AI companies, please check this map.)

  • Why does this matter? The tracker follows the US tort lawsuits against AI companies. It contains currently 75 cases. It looks like OpenAI is leading in total count (29) today.

• Google will appeal a German court ruling which said it ​is legally liable for false claims appearing in ‌AI Overviews. (Reuters)

  • Why does this matter? “Google’s ​integration ⁠of AI into its online search results has sparked criticism from publishers and content providers, which said this has ⁠negatively ​affected their traffic, readership and revenue. ​Antitrust regulators are also looking into the issue.”

  • Backgound: “[…] the Munich I Regional Court has prohibited Google from disseminating untrue factual allegations about two Munich-based publishers in the search function “AI Overview”. The AI had mistakenly assigned information on dubious machinations of other companies to the plaintiffs’ company. In the judgment of May 28, 2026 (case no. 26 O 869/26), the chamber did not classify Google as an indirect indicator of false allegations, but as a direct disruptor whose AI produced false reports as independent content.” (Heise Online) Please see an English language summary of the judgment here (Yahoo! Tech).

• A new class action lawsuit against Meta has been published in Germany.

  • Why does this matter? “The subject of the collective action is compensation for damages caused by the processing of personal data for the purposes of AI training or by interaction with AI-controlled systems designed to promote addiction.”

2) Data protection

• The European Court of Justice (ECJ) published its judgment in Case C‑484/24, interpreting Articles 5, 6, 9, 13 and 17 of the GDPR in the context of evaluating unlawfully obtained evidence in court proceedins.

  • Why does this matter? The judgment, in line with the AG´s opinion, confirms that courts may process personal data as evidence even if obtained unlawfully.

• The ECJ also decided that a data protection authority cannot reject a complaint under Article 77 GDPR just because the same matter has been brought to court under Article 79, while that court case is still pending (C‑414/24).

  • Why does this matter? Articles 77(1) and 79(1) of the GDPR “must be interpreted as precluding a supervisory authority, with which a complaint has been lodged under Article 77(1) of that regulation, from rejecting that complaint on the sole ground that judicial proceedings under Article 79(1) thereof, and concerning the same subject matter, have already been brought and even though the decision given in those proceedings is not yet final.”

3) Digital Policy, Cloud & Cybersecurity

• According to the judgment of the ECJ in Joined Cases C-188/24 (WebGroup Czech Republic and NKL Associates) and C-190/24 (Coyote System), the Court declared that information society service providers are liable for the content and information they control. (The full text is available here.)

  • Why does this matter? “[…] the Court of Justice, first, specifies the conditions under which Member States may impose an obligation to verify the age of users of pornographic websites and prohibit the rebroadcasting of information relating to certain roadside checks on their territory. The Court confirms that, under the system of the Directive on electronic commerce, such obligations and prohibitions, in principle, fall within the jurisdiction of the Member State in which the providers of the services concerned are established. Nevertheless, other Member States may impose such obligations and prohibitions on providers which are not established on their territory, subject to compliance with the conditions laid down in that directive, in particular where that proves necessary on grounds of public policy, security or safety. Second, the Court states that the operator of an information society service cannot be exempted from its liability for the information stored and rebroadcast over which it has control. That is the case where the operator determines, by means of an algorithm, under what conditions, how and in which order of priority that information is or is not rebroadcast.”

• The ECJ also provided guidance on the rules of jurisdiction in cases of breach of personality rights resulting from the broadcast of a television series

  in several Member States and on the internet (Case C-232/25). (The full text of the judgment is available here.)

  • Why does this matter? “[…] natural or legal persons who consider that their rights have been breached by content broadcast on television cannot bring proceedings before the courts of the Member State in which their centre of interests is located in order to secure compensation for the entirety of the alleged damage. They may bring proceedings before the courts of each Member State in which the programme was broadcast and where they consider their reputation to have been harmed. However, the jurisdiction of those courts is circumscribed to actions seeking compensation solely for the damage caused in the Member State concerned. […] Compensation for the entirety of the damage may, however, be sought before the courts of the Member State in which the defendant is domiciled or in which the producers in the series are established. […] As regards audiovisual content broadcast on the internet, the Court points out that the courts of the Member State in which the centre of interests of the natural or legal person who has allegedly suffered damage is located may hear an action seeking compensation for the entirety of the alleged damage only if that content makes it possible to identify, directly or indirectly, that person as an individual. […]”

C) Opinions, guidelines, reports & other publications

1) AI

• The Digital Transformation Agency of the Australian Government released Agentic AI addendum to the AI technical standard for Australian Government.

  • Why does this matter? “This standard provides best practice guidance for Australian Government agencies implementing agentic AI. As an addendum to the AI technical standard, this standard highlights best practices key considerations for the secure and governed implementation of agentic AI systems.”

• The Institute of Electrical and Electronics Engineers (IEEE) recommended “Practice for Ethical Considerations of Emulated Empathy in Partner-Based General-Purpose Artificial Intelligence Systems”.

  • Why does this matter? “Recommended practices for ethical usage of emulated empathy in general-purpose artificial intelligence (GPAI) systems for human-artificial intelligence (AI) partnerships are provided in this standard. The use of emulated empathy in GPAI systems for human-AI partnerships refers to general-purpose AI products marketed as empathic partners, personal AI, companions, co-pilots, agents, assistants, and related phrasing for human-AI partnering. IEEE Std 7014.1™ is a domainspecific extension of IEEE Std 7014™, IEEE Standard for Ethical Considerations in Emulated Empathy in Autonomous and Intelligent Systems. Whereas IEEE Std 7014 provides overarching principles for ethical evaluation of emulated empathy across AI, IEEE Std 7014.1 focuses on the overlap of GPAI, emulated empathy and human-AI partnering.”

• Singapore´s Infocomm Media Development Authority (IMDA) published a discussion paper, “Legal Responsibility for AI Agents”.

  • Why does this matter? “This paper examines how legal responsibility should be allocated when AI agents act autonomously, use tools, interact with third parties, and cause harm. It focuses on civil liability and private law, especially Singapore law, while recognising that agentic AI may also raise other legal issues. […] The aim is to develop an initial understanding of the key legal issues and challenges relating to agent liability in private law. If users and enterprises understand their legal responsibilities in relation to agentic AI, they can adopt it with greater confidence. At the same time, there is a need to look ahead and investigate whether the accountability landscape changes as agents become more autonomous and potentially more unpredictable.”

• G7 country leaders and top AI CEOs agreed that “the West should come together to rein in the most capable artificial intelligence models to keep China at bay […].” (Politico)

  • Why does this matter? “China was mentioned multiple times during the talks, according to detailed notes shared by one participant, reflecting fears that while American companies gained an early lead on artificial intelligence, China is becoming a real competitor in part due to the energy supplies needed to build the most powerful models.”

  • “The takeaway from Wednesday’s talks on artificial intelligence was the idea of defining standards that the developers of frontier AI models, such as OpenAI and Anthropic, should adhere to.”

2) Data protection

• The European Data Protection Supervisor, Wojciech Wiewiórowski published a short blog post about “Managing Shadow AI’s Hidden Data Breach Risk”.

  • Why does this matter? “We must adopt a proactive, comprehensive approach to AI governance that balances robust technical controls with a culture of awareness.”

  • “This begins with robust AI governance policies, where organisations develop and maintain clear, practical and aligned frameworks that explicitly define the authorised use of AI tools, establish clear data classification schemes and outline rigorous approval processes for evaluating new technologies. However, policy alone is not enough, and must be backed by technical controls and monitoring.”

  • “These technical controls include blocking unapproved AI domains, enforcing data loss prevention rules, and applying endpoint restrictions to prevent the installation of unapproved AI software. The most effective way to discourage the use of unapproved tools is by providing approved AI platforms that are secure, compliant and capable of meeting staff needs while ensuring full regulatory compliance. This technical foundation must be supported by enhancing employee awareness through continuous training, ensuring that staff understand the real-world risks associated with using public AI systems, the potential impacts on data subjects, and the importance of protecting sensitive data.”

  • The latest issue of the EDPS´newsletter has also bee published. This issue discusses the use of AI at the EU borders, an overview of the EDPS Annual Report 2025, the Digital Omnibus promise for data protection, Europe Day, global AI leadership, upcoming events, and more.

  • Shadow AI may also mean regulatory liability for financial institutions and the businesses that serve them. In the US context, you can read about this topic more here (The National Law Review).

  • I wrote a blog post about shadow AI in 2024, where I argued that banning is not a solution in itself, but that there should be proper compliance measures (including awareness raising, increasing AI literacy among employees, establishing appropriate internal regulatory frameworks; establishing and consistently applying appropriate internal control processes, monitoring the available IT and AI solutions, etc.).

• New VinciWorks survey found that AI governance has become the defining GDPR challenge.

  • Why does this matter? “When asked which GDPR issue feels most challenging right now, over two in five respondents (43%) selected AI and automated decision-making. No other issue came close. Just over one-fifth (22%) cited supplier and processor management, while approximately one in five (19%) pointed to staff awareness and training. International transfers were cited by fewer than one in ten (8%) as were data subject rights requests, at 8%.”

3) Cybersecurity

• Australian Signals Directorate published a guidance on the “Opportunities for AI in cyber defence”.

  • Why does this matter? “This guidance outlines how organisations can use AI to strengthen organisational cyber security while managing the risks of using AI. It outlines how the cyber security landscape is evolving and describes how organisations can use AI aligned with the Information security manual (ISM) cyber security functions of Govern, Identify, Protect, Detect, Respond and Recover. It also sets out principles for securely adopting AI, along with key questions for cyber defenders to ask AI vendors to support secure use.”

• France's cybersecurity agency ANSSI would stop certifying security products that lack quantum-resistant encryption. (Reuters)

4) Digital Policy, Cloud and Data Strategy

• OECD published a report, titled “Digital Government Outlook 2026”.

  • Why does this matter? “This report presents results from the OECD Digital Government Index (DGI) and the Open, Useful and Re-usable Data Index (OURdata), illustrating how governments across 36 OECD countries and 8 accession countries have been improving coherent, effective and human-centred digital transformation in government in recent years.”

Share

D) Scientific papers in AI, data protection & more

• “Reasoning Structure of Large Language Models” (authors: Berdoz et al.)

  • Why does this matter? “Large reasoning models (LRMs) are often evaluated using metrics such as final-answer accuracy or token count. However, identical scores on these metrics can hide fundamentally different reasoning structures. To address this limitation, we introduce a scalable LRM benchmark of logic puzzles and a pipeline that converts unstructured traces into verifiable reasoning graphs of claims and dependencies. This turns reasoning into a structured, measurable object whose topology can be quantitatively analyzed. Building on this, we define a reasoning efficiency metric that quantifies how concentrated the model's logical flow is. Our analysis on open-source reasoning models shows that structural measurements separate behaviors that token count and accuracy conflate, providing a practical tool for diagnosing failure modes and comparing how reasoning scales with puzzle difficulty.”

    

    Qualitative reasoning graphs.

    Source: “Reasoning Structure of Large Language Models”, Figure 1, p. 1

• “Will AI Agents Free Us From Meaningless Work? A Human-Centered Analysis” (authors: Ghia et al.)

  • Why does this matter? “Some claim that AI agents will free workers from the boring parts of their jobs, yet little is known about how workers themselves identify which tasks should be automated. Prior research focuses on occupations, overlooking that workers may experience varying levels of meaning across tasks within the same role. We address this gap with a task-level analysis grounded in Graeber’s theory of bullshit jobs. Using ratings from 202 workers on 171 workplace tasks, we (1) validate a five-item scale of perceived bullshitness, (2) show that perceived bullshitness strongly predicts desire for AI delegation, and (3) find that such tasks are also seen as requir

    ing less human oversight. Together, these findings suggest that tasks perceived as bullshit are natural candidates for AI delegation, aligning worker preferences with perceived feasibility.”

E) Data, Technology & Company news

• Vinci, Poland´s state fund, took an $11M stake in ElevenLabs, the $11bn AI-voice company. (The Next Web)

  • Why does this matter? “Vinci, the venture arm of Poland’s state development bank BGK, has taken an $11mn stake in ElevenLabs, the AI-voice firm valued at $11bn. The same day, it launched AI Lab Poland, a national programme to funnel funding, mentoring and global contacts to the country’s early-stage AI startups.”

  • ElevenLabs also signed a Memorandum of Understanding with the UK Government to bring voice AI to public services. (The MoU is available here.)

• “Microsoft is moving Copilot Cowork to usage-based pricing as it expands access to the enterprise AI tool — and is considering a Microsoft-hosted version of DeepSeek as a cheaper model option.” (Yahoo! Tech)

  • Why does this matter? “Microsoft's move to add a model from a Chinese AI company could draw criticism. […] If Microsoft goes forward with DeepSeek, the company says, the model would be optional for customers and fully hosted on Azure, keeping customer data within Microsoft’s cloud and covered by Azure’s enterprise security, compliance and data-residency controls.”

• Chinese AI startup Z.ai announced the release of GLM-5.2, “a 753-billion parameter open-weights large language model (LLM) engineered specifically to dominate “long-horizon” autonomous coding and engineering tasks.” (Venture Beat)

  • Why does this matter? According to Artificial Analysis, “Z ai’s GLM-5.2 is the new leading open weights model on the Artificial Analysis Intelligence Index scoring 51 and it sits on the Pareto frontier of Intelligence vs Cost per Task”

• The U.S. government issued an export control directive that forced Anhtropic to suspend all foreign access to the Fable 5 and Mythos 5 models.

  • Why does this matter? Please see my short article on this export ban and its impact on the EU’s tech sovereignty:

From an EU technological sovereignty perspective, this episode is significant because it clearly shows that access to frontier AI capabilities supplied by U.S. (or other third-country) providers can be easily interrupted and this can endanger Europe´s position in the global technological race.

1. Background: U.S. Export Restrictions on Anthropic Models

Anthropic stated on June 12, 2026, that the U.S. government, citing national-security authorities, issued an export-control directive requiring suspension of all access to Fable 5 and Mythos 5 by any foreign national, whether inside or outside the United States, including foreign-national Anthropic employees. Anthropic also stated that the directive did not provide specific details of the national-security concern, although the company understood the concern to relate to a method of bypassing, or “jailbreaking,” Fable 5. The company’s statement emphasized that access to other Anthropic models would not be affected.

Share

2. EU Technological Sovereignty Implications

For the EU, the episode crystallizes a core sovereignty concern: reliance on non-EU AI providers can become a legal, operational, and strategic dependency when access is subject to foreign export-control decisions. The Commission defines tech sovereignty as Europe’s ability to act independently in the digital world by developing and controlling key technologies, data, and infrastructure while reducing reliance on non-EU providers. The Commission has also stated that the EU relies on non-EU countries for more than 80% of key digital products, services, infrastructure, and intellectual property.

The Anthropic restriction affects more than procurement convenience; it raises questions affecting the concept of tech sovereignty as such. The Commission has expressly warned, in response to the Anthropic situation, that contingency measures addressing cyber risks “should not be discriminatory against partners,” while noting that it was assessing practical consequences for European users. From a sovereignty perspective, the risk is that EU users may be locked out of frontier capabilities for cybersecurity, scientific, or industrial use cases precisely when those capabilities become strategically important.

Remember when President Trump announced the intention of the US to claim Greenland from Denmark? At that time, Denmark immediately regretted buying F-35 fighters from the U.S., fearing that the U.S. “may have a “kill-switch” that allows Washington to remotely disable F-35s purchased by US allies.” This may not be true, but it clearly shows that dependency on third parties in strategic areas such as defense and core technologies can make Europe vulnerable.

The critical-infrastructure dimension is particularly acute because AI capabilities increasingly support defense (including cyber defense), energy optimization, healthcare and more. It also increases concentration risk because EU organizations have relied on a small number of U.S. frontier-model providers for high-value workflows.

Subscribe now

3. The EU Tech Sovereignty Package

The proposal for an European Technological Sovereignty Package was presented on June 3, 2026, to strengthen Europe’s capacity in semiconductors, artificial intelligence, cloud, and open source. The package includes two legislative proposals: the Chips Act 2.0 and the Cloud and AI Development Act, as well as the EU Open Source Strategy and a Strategic Roadmap for Digitalisation and AI in Energy. The Commission describes the package as designed to reduce structural dependencies and ensure Europe can develop, deploy, and secure the technologies Europeans rely on.

The Chips Act 2.0 element is aimed at strengthening the semiconductor ecosystem, supply-chain resilience, cutting-edge semiconductor capacity, and domestic demand. The Cloud and AI Development Act (CADA) is intended to support research and innovation, accelerate data-center deployment conditions, and introduce a single EU-wide assessment framework for cloud and AI sovereignty. The Open Source Strategy is intended to reduce dependencies across the technology stack, while the energy roadmap includes measures to build sovereign and secure AI models trained on European data for the energy sector.

The package builds on the AI Continent Action Plan, which focuses on computing infrastructure, data, skills, adoption, and regulatory simplification. Funding and infrastructure measures include InvestAI, which aims to mobilize €200 billion for AI investment, including a €20 billion European fund for AI gigafactories. EU AI Factories and Gigafactories are intended to give startups, SMEs, researchers, industry, and public authorities access to advanced compute for developing and fine-tuning AI models. In this respect, a U.S. access restriction strengthens the policy rationale for EU-owned compute, EU-governed model development, open-source alternatives, and public-sector procurement strategies that avoid single-provider dependence.

4. Outlook

EU policymakers should treat this Anthropic episode as evidence supporting faster implementation of the Technological Sovereignty Package, especially the Cloud and AI Development Act, AI Factories, AI Gigafactories, open-source strategy, and sovereign AI initiatives in critical sectors. The EU should also press diplomatically for allied carve-outs, transparency, and non-discriminatory contingency mechanisms where U.S. export controls affect EU users and institutions.

EU organizations should respond by conducting AI vendor concentration reviews, testing fallback options, strengthening data portability, and maintaining model-agnostic architectures for critical workflows. In practical terms, the ban should accelerate a shift from “best model available” procurement toward resilience-based AI governance that prioritizes operational continuity and strategic autonomy.

A) Regulatory developments

1) AI

• Italy’s Council of Ministers approved two implementing decrees under Law No. 132/2025 to operationalize a comprehensive national AI regulatory framework under the AI Act. (For a summary in English about these steps in the AI Act implementation in Italy, please see Giulio Coraggio´s article.)

  • Why does this matter? “Two decrees were approved:

    1. Powers of national AI authorities; AI in education and professional training; AI in employment relations.

    2. AI in law enforcement (including biometric surveillance); civil liability for AI-caused harm; new criminal provisions.”

• President Javier Milei of Argentina promised the world’s tech firms that Argentina will create a special legal framework to foster the development of AI, reaffirming his commitment to keeping the sector “unregulated”. (Buenos Aires Times)

  • Why does this matter? “[…] the President stressed that its first pillar of his plan is a `commitment to keep AI unregulated so that it can develop freely, without the burden of premature and misguided regulation.`”

  • “[…] Milei outlined his government's plan to create a new category of corporate entity in legislation: the “non-human corporation,” entities operated entirely by AI agents or robots.”

2) Data protection

• The New York State Senate passed the Bill that prohibits the use of surveillance pricing. The bill awaits for the Governor Hochul´s signature.

  • Why does this matter? “To protect consumers from discriminatory, opaque, and exploitative pricing practices driven by algorithmic systems that rely on personal data. The bill prohibits surveillance pricing, regulates the use of certain dynamic pricing systems, establishes disclosure requirements for certain pricing practices, and creates enforcement mechanisms to protect consumers from unfair and deceptive conduct.”

  • New York joins Maryland and Connecticut as the third state in the US to pass a surveillance pricing ban.

3) Digital Policy, Cloud & Cybersecurity

• The Government of Canada introduced legislation (Bill C-34, the Safe Social Media Act) to make social media services and AI chatbots safer for children.

  • Why does this matter? “While laws exist to respond once harm has happened, there is currently very little that requires online services to prevent harm in the first place. The Safe Social Media Act aims to change that by ensuring that social media services and artificial intelligence (AI) chatbots are responsible for addressing harm before it occurs.”

  • “It will include an age restriction preventing children under the age of 16 from having accounts on social media services, with a pathway for social media services to seek an exemption if they can demonstrate that they have put in place sufficient safeguards for children.”

  • “The new requirements will also put children’s safety first when products and features are designed, including measures to reduce children’s exposure to certain content and high-risk interactions. Regulated services will be required to identify, mitigate and address the risks on their platforms.”

  • “The proposed legislation will create a legislative and regulatory framework through a new Digital Safety Act for social media services, including user-uploaded livestreaming and adult content services, and for certain AI chatbot services.”

B) Enforcement actions

1) AI

• Tech Justice Law, Social Media Victims Law Center and Susman Godfrey have filed a lawsuit in San Francisco County Superior Court against OpenAI and Sam Altman on behalf of Kristie Carrier, mother of ChatGPT suicide victim.

  • Why does this matter? “The lawsuit alleges various legal claims grounded in product liability, negligence, wrongful death and unfair competition. The suit also requests an injunction requiring OpenAI to implement a range of safeguards by default for users. The lack of such safeguards, or even warnings regarding the risk of psychological dependence or other harms, is a direct result of OpenAI’s prioritization of rushed product development and growth over user safety.”

• The Privacy Commissioner of Canada´s investigation into the Grok chatbot and sexualized deepfakes found violations of privacy law. (The Report of Findings is available here.)

  • Why does this matter? “[…] Grok’s AI image-generation tool was launched without proper safeguards or sufficient consideration of potential privacy harms. […]”

• The Council of Europe’s Cybercrime Convention committee and the Lanzarore Committee* have issued a joint statement addressing the growing threats posed by AI-generated and altered child sexual exploitation and sexual abuse material. (*Committee of the parties to the Convention on the protection of children against sexual exploitation and sexual abuse)

  • Why does this matter? “The committees encouraged state parties to both conventions to review reservations that may limit the criminalisation or prosecution of AI-generated or altered child sexual-exploitation or sexual-abuse material in light of the rapid development of artificial intelligence technologies.”

  • “The committees encouraged states parties to the conventions to strengthen efforts to prevent, detect, investigate and prosecute offences involving such material, including through enhanced international cooperation, the rapid removal of such material, specialised training for relevant professionals, and closer engagement with service providers and technology companies.”

2) Data protection

• The Irish Commercial High Court decided to uphold the main findings of the Data Protection Commission (DPC) against TikTok regarding the violations of Articles 46 and 13(1)(f) GDPR over data transfers to China and transparency obligations. (TikTok´s press release is available here.)

  • Why does this matter? The Court also declared that “necessary prerequisite to the imposition of an administrative fine was met. I propose accordingly to dismiss the appeal against the decision to impose administrative fines. For the reasons explained above, I will leave over for further decision TikTok’s appeal against the amount of the fines imposed.”

  • Until the outcome of TikTok’s appeal, the Court allowed transfers of EEA users’ data to China to continue in the meantime.

  • What is the background to this? The Irish Data Protection Commission, as the Lead Supervisory Authority for TikTok, fined TikTok EUR 530 million in May 2025. The DPC found that TikTok “infringed the GDPR regarding its transfers of EEA User Data to China and its transparency requirements”. The decision included “administrative fines totalling €530 million and an order requiring TikTok to bring its processing into compliance within 6 months.” In addition to this, TikTok’s transfers of users´data were ordered to be suspended to China if processing is not brought into compliance within the above timeframe.

• The Australian Privacy Commissioner found Optus, an Australian carriage service provider, interfered with the privacy of individuals whose personal information was listed in the White Pages contrary to an expressed preference or request for an unlisted number. (The detailed report is available here.)

  • Why does this matter? “The outcome was that 41,278 porting customers who had indicated an unlist preference remained published in the White Pages, exposing them to potential harm, particularly those in vulnerable circumstances.”

3) Digital Policy, Cloud & Cybersecurity

• The South Korean´s Personal Information Protection Commission (PIPC) fined Coupang, an online retail giant, with a record fine of more than $400m over a massive data breach that exposed the data of more than 30 million customers last year. (BBC)

  • Why does this matter? “The leak exposed the names, contact and delivery details and order histories of some customers of Coupang, South Korea’s largest e-commerce platform often described as its equivalent of Amazon. […] The PIPC on Wednesday announced a 423.6bn won fine over the personal data breach, and an additional 201bn won for the non-consensual collection of information.”

C) Opinions, guidelines, reports & other publications

1) AI

• The European Commission published the final Code of Practice on marking and labelling AI-generated content. (The Code is available directly here.)

  • Why does this matter? “The Code is voluntary and sets out practical steps to help providers and deployers of generative artificial intelligence (AI) systems meet the AI Act transparency obligations that will apply from 2 August 2026. From that date, the AI Act will require clear labelling in key cases. Deepfakes and AI-generated or AI-manipulated text published on matters of public interest must be clearly labelled. Users must also be informed when they are interacting with an interactive AI system, such as a chatbot.”

  • Providers and deployers of genAI systems may sign up to the code. “With their signatures, providers and deployers of generative AI systems signal their intent to adhere to the code of practice as a way to comply with the obligations for transparency of AI-generated content (Article 50(2) and (4) of the AI Act).”

  

  (Source: Code of Practice on marking and labelling AI-generated content, Annex 1, p. 38)

• The UK Government launched a new AI growth project to fast-track innovation in legal technology, often known as LawTech.

  • Why does this matter? “AI Growth Labs give organisations a safe space in which to test innovative legal services products and discuss any regulatory issues directly with regulators.”

  • Based on the statement, released by ICO (UK data privacy watchdog), the ICO will be collaborating with the Council for Licensed Conveyancers (CLC), Solicitors Regulation Authority (SRA) and Legal Services Board (LSB) to work with innovators on cross-regulatory challenges. William Malcolm, Executive Director for Regulatory Risk and Innovation, said that “it's essential that legal firms and businesses can navigate data protection requirements with confidence as they seek to make legal services more efficient and effective for people. This pilot will help the sector access the new opportunities AI brings while providing assurance to the public that regulatory standards are met.”

• Oxford Economics published a study, titled “The Economics of Sovereign AI: Balancing Autonomy, Innovation, and Growth in the Asia-Pacific”.

  • Why does this matter? “AI sovereignty can be pursued through a range of policy designs that vary in how far they require the AI stack to be domestically owned and localised. These choices can strengthen control, but can also introduce material trade-offs—higher costs, slower innovation cycles, constrained access to talent, and reduced interoperability. Where these costs translate into higher prices for AI services, compute, and compliance, they are ultimately borne by businesses and filter through the wider economy, reducing efficiency and, over time, constraining overall prosperity”

2) Data protection

• The European Data Protection Board (EDPB) has just released a common template for data breach notifications. The template is open for public consultation until 5 August 2026.

  • Why does this matter? “The template provides predefined options to choose from, and further guidance on how to fill in the fields. This will help save time and costs, particularly for smaller organisations lacking dedicated DPOs or legal resources. […] Following the public consultation, the EDPB will decide on the timeline for the practical implementation of the template by all DPAs.”

  • The publication of the template is in line with the EDPB’s Helsinki Statement to make GDPR compliance easier and strengthen consistency across Europe.

• The Information Commissioner´s Office (UK) published the finalised guidance on consumer Internet of Things (IoT) products and services, providing their expectations for manufacturers and developers on how to use people’s personal information responsibly.

  • Why does this matter? “This guidance covers the processing of personal information by organisations providing IoT products on the consumer market. […] This guidance also applies to user devices on which software or apps are installed that enable, configure or control the functionality of an IoT product (eg mobile phones, tablets, other computing devices).”

  • ICO´s expectations for IoT manufacturers and developers:

    • “Privacy must be built in from the start, not bolted on afterwards - with protective settings on by default and data collection limited to what is strictly necessary.

    • Consent must be real, specific and freely given via a clear opt-in - and it must be just as easy to withdraw.

    • Genuine transparency is more than a privacy notice - users must be clearly informed about how their data is used, in plain language and at relevant points across the whole product.

    • Most firms will have to do a Data Protection Impact Assessment – due to the sensitive nature of the data they collect, with an even higher bar if children may use the product.

    • Security is an ongoing legal obligation, not a one-time consideration – it requires regular updates, encryption, and multifactor authentication throughout the product’s lifetime.”

• The Dutch data protection authority, Autoriteit Persoonsgegevens (AP) received more than 13,500 complaints and tips about possible privacy breaches in 2025, a rise of 75% on the year before. (The original report is available here in Dutch).

  • Why does this matter? “Most complaints were regarding organisations involved that were not open about what personal data they hold, or refused to delete people’s data when asked, the watchdog said in its annual complaints report. Other complaints related to companies and public bodies that requested personal information without good reason.”

  • AP highlighted that “in 2025, the Dutch DPA received the most complaints about healthcare. More than half of these were about the data breach at Clinical Diagnostics.” AP adds that they “received many complaints in particular about how organizations deal with the right of access and the right to delete data. For example, organizations regularly do not respond or respond too late to access requests.”

3) Cybersecurity

• The National Security Council of Germany decided to set up an AI security institute. (Heise Online)

  • Why does this matter? “The German government wants to be able to better assess the opportunities and risks of modern AI models with the help of a new committee.” The Institute “is intended to bundle the capacities for analyzing the capabilities of modern AI models, including their risks.”

  • “According to Bitkom and the TÜV Association, the new Institute for Artificial Intelligence will have the working title “German AI Security Institute (DE-AISI)”. In the initial phase, it is planned as a “virtual institution”, using structures and competencies of the Federal Network Agency and the Federal Office for Information Security (BSI).” See Bitkom´s position paper about the German AI Security Institute (DE-AISI) here.

  • The institute is also to engage more closely with comparable foreign institutes (e.g. the UK-AISI) and work towards uniform standards in dealing with AI with international partners.

• ENISA published its report about the outcome ot the survey launched at the end of 2025 to gather factual data on how organisations across industries and of varying sizes are approaching Software Bill of Materials (SBOM) adoption in response to the EU Cyber Resilience Act (CRA).

  • Why does this matter? “This report analyses the survey results, which confirm that the CRA acts as an accelerator for SBOM adoption. Organisations are broadly investing in SBOM generation and automation to integrate SBOMs into the Software Development Life Cycle (SDLC), while also accelerating their implementation timelines to meet expected maturity levels.”

4) Digital Policy, Cloud and Data Strategy

• OECD published a report, “Smart Regulations, Strong Business - Enabling Growth and Societal Protection in a Fast‑Changing World”.

  • Why does this matter? “In a fast-changing and complex environment, governments are striving to maintain streamlined regulatory design and implementation that will enable growth and societal protections. The OECD Simplifying for Success (S4S) survey provides emerging evidence on where rules and procedures are considered most burdensome and on ongoing simplification efforts. This report highlights priority areas for regulatory simplification and reform, helping governments address both symptoms and root causes of excessive regulation, and offering policy considerations for more efficient and effective rulemaking.”

• OECD also published a new policy paper, titled “Information sharing in competition policy”.

  • Why does this matter? “Competition rules governing information sharing must balance two primary risks: permissive rules may facilitate tacit collusion or explicit cartel conduct, while overly restrictive frameworks can chill legitimate collaboration and create market inefficiencies. This paper reviews how different forms of information exchange affect firm incentives and market outcomes, drawing on recent economic literature. It also examines how competition authorities across OECD jurisdictions have approached the issue in practice, including through enforcement, case law and guidance. The paper aims to clarify the main factors that shape competitive risk and how those factors are reflected in current assessment and enforcement.”

• The European Committee of the Regions published a “Foresight study on the future and potential use of quantum technology by local and regional authorities”.

  • Why does this matter? “[…] The study looks at national Quantum strategies of different EU Member States, involvement of cities and regions in their implementation and how these strategies should be aligned at EU level to contribute making the EU a homogenous landscape for Quantum technology. The study looks at how LRAs should participate in pilot projects and pave the way for Quantum adoption at a larger scale and its combined use with state-of-the-art technology such as AI. It identifies how cities and regions can act as early adopters, testbeds, and sandboxes for Quantum solutions, thereby accelerating the responsible and inclusive deployment of these technologies across the EU for the benefit of European citizens. The results include actionable policy recommendations, a roadmap for local and regional engagement, and a set of indicators for monitoring progress. The study provides a reader-friendly introduction into Quantum technology for local political leaders and citizens to increase the acceptance rate of Quantum technology.”

Share

D) Scientific papers in AI, data protection & more

• “You Trust Your Chatbot With Everything. Should You? Part 2: Governments, Courts, and the Battle Over Your Chatbot Conversations” (AI Regulation Papers, 26-06-1, author: Theodore Christakis)

  • Why does this matter? “The very choices that make a chatbot useful, namely retention, memory, logging, personalisation and connected tools, are the choices that make the resulting record preservable, searchable, discoverable, disclosable and exploitable. A single stored conversation is, at the same moment, a candidate for police referral, a target for a government demand, evidence in a lawsuit, and an asset in a data breach. No prior work, to the author’s knowledge, has examined these four exposures together.”

  • The first part of the article, “You Trust Your Chatbot With Everything.

    Should You? - Part 1: How The Controller Uses Your Chat Data” is available here.

• “Strategic Integration of Artificial Intelligence in the C-Suite: The Role of the Chief AI Officer” (author: Marc Schmitt)

  • Why does this matter? “[…] This paper develops a role-design theory to explain this variation. I identify three properties that distin guish AI from earlier cross-cutting enterprise technologies—distributed accountability for judgment, upstream governance, and non-stationarity—and three configurations through which organizations respond: concentrated extension, distributed extension, and role creation. The CAIO Framework links these properties to the executive design problems they generate and to the functions and capabilities required of the dedicated role. Four propositions specify when a dedicated CAIO emerges, what form an orga nization’s response takes, when the dedicated role is effective, and how configurations evolve over time. This paper contributes to research on executive leadership, orga nizational design, and digital governance by offering a theory-driven account of the strategic integration of AI at the executive level.”

E) Data, Technology & Company news

• Anthropic launched Claude Fable 5 and Claude Mythos 5.

  • Why does this matter? “It is state-of-the-art on nearly all tested benchmarks of AI capability, showing exceptional performance in software engineering, knowledge work, vision, scientific research, and many other areas.”

  • If you want to have an impression how good Fable 5 is in researching and writing academic papers, please check Andrew Maynard´s LinkedIn post, including “100% Fable-generated paper on student-centred higher education in the age of Mythos-class AI”.

  • At the same time, Anthropic calls for global pause in AI development due to models’ “recursive self-improvement” capabilities: “We believe it would be good for the world to have the option to slow or temporarily pause frontier AI development to enable societal structures and alignment research to keep up with the advance of the technology.”

• OpenAI submitted a draft confidential registration statement (S-1) to the U.S. Securities and Exchange Commission (SEC) for a proposed initial public offering (IPO).

  • Why does this matter? “We have not decided on timing yet; it may be a while because there are things we want to do that are likely easier as a private company.”

  • Anthropic submitted a S-1 statement to the SEC one week before OpenAI.

  • According to recent estimates from Sensor Tower (market intelligence firm), ChatGPT reached one billion monthly app users in May. (CNBC)

  • OpenAI launched ChatGPT ads in the UK, its first European market.

• SpaceX completes the largest IPO in history when the company debuts on the Nasdaq on 12.06.2026. “Pricing at $135 a share, the group is raising $75 billion at a valuation of $1.77 trillion.” (CNBC)

A) Regulatory developments

1) AI

• President Trump signed an Executive Order on “Promoting Advanced
  Artificial Intelligence Innovation and Security”. (A fact sheet issued by the White House is available here.)

  • Why does this matter? According to the first assessment by the Council on Foreign Relations, the Executive Order (EO) “marks a shift by the administration toward federal oversight of AI.”

  • “Among other measures, the order requests that AI companies voluntarily provide the federal government access to “covered frontier models” for a cybersecurity review up to thirty days before their planned release to “other trusted partners.” Its passage comes as concerns have mounted over the ability of some powerful AI models, such as Anthropic’s Claude Mythos, to autonomously identify and exploit hidden vulnerabilities in real-world software.”

  • According to Matthew Ferren (an international affairs fellow in national security at the Council on Foreign Relations, sponsored by Janine and J. Tomilson Hill), “The order is best understood as an attempt to engineer a cybersecurity window of opportunity. It grants defenders preferential access to frontier cyber capabilities while attempting to delay adversary access through a prerelease evaluation period and a classified National Security Agency-run process for designating `covered frontier models.`”

  • According to Vinh Nguyen (a senior fellow for AI at the Council on Foreign Relations), “President Trump’s order supplies the institutional framework for reviewing new frontier AI systems. Its most consequential provision is also the most difficult to execute: defining what counts as a ´covered frontier model.´” […] “What remains to be seen is whether the classified benchmarking process can evolve at the pace the technology demands. Frontier AI capabilities advance on a timeline measured in months, not years. The institutions charged with evaluation will need to match that tempo or they will assess yesterday’s models against yesterday’s threats.”

2) Data protection

• Louisiana has become the 22nd U.S. state to enact a comprehensive consumer privacy law and the third this year following Oklahoma and Alabama. The law will go into effect on January 1, 2027. (Future of Privacy Forum) For more info, please see FPF´s blog post about the new law.

  • Why does this matter? “Overall, this is a fairly standard state privacy law that follows the Washington Privacy Act framework apart from the law’s CCPA-style applicability thresholds.”

3) Digital Policy, Cloud & Cybersecurity