Real-time EU regulatory monitoring with AI-powered impact analysis
The European Data Protection Board (EDPB) has called for the establishment of a legal basis to enable information sharing across different regulatory frameworks. This move aims to facilitate better cooperation between authorities while ensuring compliance with GDPR. Organizations should prepare for potential changes in data sharing requirements.
The EU AI Office is hosting the first annual event for the Advanced Virtual Human Twins (VHT) Platform on 20-21 October 2026 in Brussels and online. The event aims to gather stakeholder feedback to shape the platform’s development, focusing on usability, adoption, interoperability, and trust. Discussions will include legal, ethical, and technical considerations for VHT models, with open and closed sessions for different audiences.
The European Commission has accepted X's action plan to address Digital Services Act compliance failures, including improved transparency in advertising, faster researcher data access, and independent audits of implementation. While the Board for Digital Services deemed the measures partially inadequate, the Commission has set a six-month deadline for X to implement these changes and clarify several compliance points. This decision establishes important precedent for how large social media platforms must provide transparency and research access under EU regulations.
The Swedish government has commissioned an investigation, led by IMY's legal chief David Törngren, to explore improved possibilities for processing personal data to prevent erroneous payments and abuse of public authority processes. The findings may influence future GDPR interpretations in Sweden and the EU.
Multiple major software vendors (Cisco, Microsoft, SAP, Ivanti, Fortinet, Adobe) have released their July 2026 security updates. Organizations must review and apply these patches to address vulnerabilities that could lead to compliance breaches under EU regulations like GDPR, NIS2, or DORA. Failure to patch may expose sensitive data or critical systems to exploitation.
The European Data Protection Board (EDPB) has published three new guidelines addressing data scraping for training generative AI, data anonymization, and the use of blockchain technology. These guidelines clarify compliance requirements under GDPR for organizations handling personal data in these contexts.
SonicWall has released security updates addressing two critical vulnerabilities (CVE-2026-15409 and CVE-2026-15410) in its SMA1000 series appliances. These vulnerabilities have been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. Organizations using affected SonicWall devices must apply patches immediately to mitigate risks of unauthorized access or data breaches.
The European Data Protection Board (EDPB) has issued a binding decision requiring the Belgian Data Protection Authority (DPA) to investigate the merits of a complaint by NOYB regarding cookie banner practices. This move underscores stricter enforcement of GDPR consent requirements for cookies, particularly around transparency and user choice. Organizations using cookie banners should expect increased scrutiny and potential penalties for non-compliance.
A coordinated supply chain attack has compromised separate AsyncAPI GitHub repositories. Attackers exploited a vulnerability in GitHub Actions to distribute malicious npm packages, posing risks to organizations using these dependencies.
The European Commission is gathering stakeholder feedback to define the EU's position for the World Radiocommunication Conference 2027 (WRC-27), which will shape global radio spectrum and satellite orbit regulations. The process may influence EU policies on connectivity, transport, space, and climate initiatives like Copernicus and IRIS². Organizations in these sectors should monitor developments as the EU's stance could impact future compliance and operational frameworks.
The Dutch Data Protection Authority (AP) has published two new GDPR guidelines for generative AI: one for developers of AI models and another for organizations implementing generative AI. These documents provide practical guidance on responsible development and deployment while ensuring compliance with GDPR.
The EU AI Office's special panel has published a report on child safety online, offering recommendations to protect and empower minors in digital environments. It addresses challenges like age-appropriate use of social media and other digital services, with a focus on AI-driven systems. The report may influence future AI Act compliance requirements for organizations deploying AI that interacts with children.
The French data protection authority (CNIL) has launched a new teleservice for health and research authorization requests, simplifying the submission process. Organizations processing health or research data under GDPR must adapt to this change, which may affect their compliance workflows. A webinar is available to explain the updates.
The European Commission has preliminarily determined that Meta (Facebook and Instagram) violates the Digital Services Act (DSA) due to addictive design features like infinite scroll, autoplay, and personalized recommender systems. The investigation found that Meta failed to adequately assess or mitigate risks to users' physical and mental health, particularly for minors and vulnerable adults. This marks a significant enforcement action under the DSA, with implications for other platforms.
The German Federal Commissioner for Data Protection (BfDI) hosted a strategic foresight workshop on neurotechnologies, highlighting emerging privacy and ethical challenges. The event underscores the need for organizations to consider GDPR compliance when processing neural or biometric data. While no new regulations were announced, this signals increased scrutiny of neurotechnology applications under existing EU data protection frameworks.
EU regulators urge businesses and governments to prioritize digital autonomy when procuring IT services. They recommend joint action among organizations to strengthen negotiating power with IT suppliers and reduce reliance on non-European providers. This aims to boost the adoption of European digital solutions.
A new EU study estimates that every euro invested in the European Competitiveness Fund’s Digital Leadership window could generate €1.84–€2.21 in GDP over ten years, with cross-border spillover effects boosting economic growth. The fund aims to support digital infrastructure, skills, and innovation, potentially increasing EU GDP by €13–16 billion annually by 2037. Findings will shape the final design of the fund to maximize economic benefits across Member States.
Starting 2 August 2026, providers and users of AI systems in the EU must clearly disclose when humans interact with AI. The European Commission published a practical code on 10 June outlining some of these transparency obligations, and the Dutch Data Protection Authority (AP) advises affected organizations to review and sign (parts of) this code. Early signatories before 22 July 2026 will be listed as first adopters.
The EU AI Office has launched a call for tenders to expand EU Code Week from 2027 to 2030, aiming to increase coding education, community engagement, and digital skills across Europe. The initiative seeks to empower teachers, attract more youth (especially girls), and develop high-quality learning resources. While not a regulatory change, it supports AI literacy goals under the AI Act.
Employers in the EU have the right to monitor employee activity and use of work equipment as part of the employment contract, but this must be done proportionately and without excess. The CNIL guidance emphasizes that such monitoring must respect GDPR principles, particularly transparency, necessity, and employee privacy rights.
On 7 July 2026, the European Data Protection Board (EDPB) adopted guidelines on anonymization and web scraping for generative AI, as well as final guidelines on processing personal data using blockchain technology. These documents clarify compliance obligations for organizations using these technologies under the GDPR.
The Court of Justice of the European Union (CJEU) has issued a ruling on a Swedish search service with a voluntary publishing certificate that publishes criminal court judgments. The case addresses the balance between the GDPR and Sweden’s system of voluntary publishing certificates. The Swedish Data Protection Authority (IMY) will now analyze the implications of this ruling for its ongoing supervision of such search services.
The EU AI Office is hosting an info webinar on 22 July 2026 to explain the AI-BOOST Open Innovation Competition, focusing on AI in health, wellbeing, and digital society. The event aims to guide applicants on how to participate in the competition. This is an informational session with no direct compliance implications.
The European Data Protection Board (EDPB) has adopted guidelines on anonymization and finalized guidelines on processing personal data through blockchain technology. These documents clarify when data is considered anonymous under GDPR and how blockchain implementations can comply with data protection rules.
Euregas analyzes regulatory updates and provides personalized action recommendations, deadlines, and compliance scores specific to your organization.