Real-time EU regulatory monitoring with AI-powered impact analysis
The European Commission's State of the Union 2026 address will outline the EU's digital and AI priorities for the coming year, including updates on regulations like the AI Act, GDPR, and NIS2. Organizations should expect potential shifts in policy focus that may influence compliance strategies. No immediate changes are announced, but the speech may signal future legislative or enforcement trends.
The French data protection authority (CNIL) is hosting its second 'Informatique & Libertés' event on September 29, 2026. The morning session will cover data protection topics, including the rise of connected glasses and the role of sanctions in enforcement.
The European Commission has designated ChatGPT as a Very Large Online Search Engine (VLOSE) and Reddit and Roblox as Very Large Online Platforms (VLOPs) under the Digital Services Act (DSA). These services must comply with additional DSA obligations by January 2027, including assessing and mitigating systemic risks related to illegal content, minors' protection, and fundamental rights.
The Swedish Data Protection Authority (IMY) has launched FantomApp, a tool designed to help young people protect their personal data on social media. The app assists with privacy settings, password testing, and blurring photos to enhance data security. While not a regulatory change, it signals growing focus on youth data protection in the EU.
This week’s CERT-SE newsletter highlights key cybersecurity events and includes a CISA evaluation of organizational cyber defenses, offering recommendations to enhance resilience. The insights are particularly relevant for EU-regulated sectors like critical infrastructure and financial services. Organizations should review the guidance to align with best practices and regulatory expectations.
The Dutch Data Protection Authority (AP) has issued an advisory regarding actively exploited vulnerabilities in WordPress, which is widely used in the Netherlands. These vulnerabilities have already led to data breaches, posing significant risks to organizations processing personal data under GDPR.
In 2026, France's data protection authority (CNIL) educated 2,500 primary school students (CM2) in the Oise department about digital issues and personal data protection. Teachers can access resources on CNIL's website to replicate this educational project in their classrooms.
Starting September 1, the Dutch Data Protection Authority (AP) is required by law to publicly disclose all GDPR fines and sanctions. This change aims to clarify enforcement standards and consequences for non-compliance, making it easier for organizations to understand expectations.
The French data protection authority (CNIL) has updated its tool for tracking the lineage of open-source AI models. The new version improves performance, usability, and automates data updates, with an English version now available.
The Swedish Data Protection Authority (IMY) has published guidance on the streaming of children's and youth sports under GDPR. The guidance outlines key factors organizations must consider to determine lawful processing of personal data when streaming such events. It emphasizes compliance with data protection principles, particularly for minors.
The Dutch data protection authority, in cooperation with France’s CNIL, fined Uber €825 million for using automated decision-making systems to evaluate and terminate drivers on its platform. This enforcement action highlights strict GDPR compliance requirements for automated decisions affecting individuals. Organizations must ensure such systems include human oversight and respect data subject rights.
Higher education institutions in the EU must exercise caution when using online collaborative tools to ensure GDPR compliance. The French data protection authority (CNIL) has reiterated applicable rules, emphasizing the need for vigilance in protecting personal data in these environments.
French educational institutions using online collaborative tools must ensure GDPR compliance, particularly when processing minors' personal data. The CNIL outlines key rules and best practices to mitigate risks associated with these tools.
The EU AI Office is hosting a pitching event on 20 October 2026 for the top 10 finalists of the Apply AI Startup Award, showcasing innovative AI solutions in strategic sectors. The event highlights the European AI innovation ecosystem and will feature short pitches from selected startups, with winners announced afterward.
The German Federal Commissioner for Data Protection (BfDI) has received a top rating ('very good') from the Consumer Centers' Materialkompass for its data protection educational series. This recognition highlights the quality of the materials, which can be used to improve data protection awareness and training. The update does not impose new compliance requirements.
The Dutch Data Protection Authority (AP) has fined Uber €824.99 million for fully automated decisions to deactivate driver accounts based on fraud suspicions or low customer ratings, which cut off their income without human review. This violates GDPR Article 22, which restricts automated decision-making that significantly affects individuals. The ruling underscores the need for human oversight in such processes.
This week's CERT-SE report highlights multiple system intrusions, disruptions, and actively exploited vulnerabilities by threat actors. Organizations should prioritize reviewing and addressing these issues to mitigate cybersecurity risks and potential compliance breaches.
The French data protection authority (CNIL) has fined MOBIUS SOLUTIONS LTD €1 million for a data breach, highlighting the serious consequences of failing to comply with GDPR breach notification and security obligations. This enforcement action serves as a reminder for all organizations to prioritize data protection and incident response. Organizations must ensure timely breach detection, reporting to authorities within 72 hours, and communication to affected individuals.
The French data protection authority (CNIL) has imposed a €1.7 million fine on NEXPUBLICA FRANCE for a data breach, highlighting strict GDPR enforcement. This case serves as a warning to EU organizations about the financial and legal consequences of failing to properly secure personal data or notify authorities in time. Organizations must ensure robust breach detection, response, and reporting mechanisms are in place.
The European Data Protection Board (EDPB) announced that FREE MOBILE and FREE were fined €42 million for a data breach. This enforcement action highlights the serious financial and reputational risks of non-compliance with GDPR data protection obligations. Organizations must ensure robust breach detection, reporting, and remediation processes to avoid similar penalties.
The European Data Protection Board (EDPB) announced that France Travail, a French public employment service, was fined €5 million for a data breach under GDPR. The breach involved the unauthorized access to personal data, underscoring the importance of strict adherence to data protection regulations. This case serves as a warning to all EU organizations about the severe penalties for failing to safeguard personal data.
Citrix has disclosed a critical vulnerability (CVE-2026-19490) in NetScaler ADC and NetScaler Gateway, rated 9.3 on the CVSS v4 scale. This flaw could allow unauthorized access or remote code execution, posing significant risks to affected systems. Organizations using these products must act immediately to mitigate exposure.
Twitch has revealed it shares user data, including streams and personal information, with Amazon to train AI models by default. The Dutch Data Protection Authority (AP) urges users to disable this setting to prevent their data from being used. Organizations using Twitch must ensure compliance with GDPR by opting out of this data sharing.
The French data protection authority (CNIL) has published guidance on credit refusal procedures, emphasizing GDPR compliance for transparency and data subject rights when applicants are denied credit or listed in files managed by the Banque de France or banks. Organizations must ensure clear communication and access to personal data in such cases.
Euregas analyzes regulatory updates and provides personalized action recommendations, deadlines, and compliance scores specific to your organization.