What changed in EU digital regulation

Detected guidance relating to Digital Services Act: “Signatories of the DSA Code of Conduct on Disinformation”. Summarised automatically from the primary source; open the source link for the authoritative text.

Detected law relating to AI Act: “Commission Implementing Decision (EU) 2026/2274 of 12 October 2026 on the harmonised standards for high-risk AI systems drafted in support of Regulation (EU) 2024/1689 of the European Parliament and of the Council”. Summarised automatically from the primary source; open the source link for the authoritative text.

Detected guidance relating to GDPR: “Statement of the EDPB on smart glasses”. Summarised automatically from the primary source; open the source link for the authoritative text.

Detected guidance relating to GDPR: “EDPB publishes statement on the data protection challenges of smart glasses”. Summarised automatically from the primary source; open the source link for the authoritative text.

Detected enforcement from EDPB: “Italian DPA fines Wind Tre EUR 16 700 000 for unlawful telemarketing and data protection infringements”. Framework not yet determined — open the primary source to see which EU rules apply. Summarised automatically; not yet editorially verified.

The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) has fined Uber EUR 824 990 000 for infringing the GDPR. According to the AP, Uber took fully automated decisions about drivers between 2018 and 2022: on a suspicion of fraud or after customer ratings that were too low, driver accounts were automatically deactivated, temporarily or, with persistently low ratings, permanently, without any human assessment, so that drivers lost their income through Uber during the deactivation. The AP found that Uber infringed the prohibition of fully automated decision-making (Article 22 GDPR) and did not inform drivers sufficiently about that decision-making (Article 13 GDPR). The case started with complaints from 171 French drivers, lodged through the Ligue des droits de l'Homme with the French CNIL; the AP handled it under the one-stop-shop mechanism because Uber's European headquarters are in the Netherlands. The AP announced the fine on 21 August 2026; the EDPB published its summary on 8 October 2026. Uber has stopped the infringements and is challenging the fine; the decision is not final.

The European Commission decided on 1 October 2026 to send Bulgaria an additional letter of formal notice (INFR(2024)2241) for not complying with the Digital Services Act (Regulation (EU) 2022/2065). This follows a letter of formal notice sent in December 2024 and a subsequent reasoned opinion sent in May 2025. Bulgaria has since adopted legislation empowering one of the authorities acting as Digital Services Coordinator, but according to the Commission it still has not designated and empowered the Personal Data Protection Commission and the Electronic Media Council, which would complete the national enforcement framework of the DSA. The Commission also considers that Bulgaria implemented the DSA's powers to sanction incorrectly: the law does not always respect the maximum fine limits and does not ensure that all penalties are effective, proportionate and dissuasive, also in view of a distinct treatment of natural and legal persons that the DSA does not establish. Bulgaria has two months to respond and address the shortcomings; without a satisfactory response, the Commission may issue an additional reasoned opinion.

The European Board for Digital Services adopted a document of good practices and practical examples for notifying suspected criminal offences under Article 18 of the Digital Services Act. It covers when hosting providers become aware of relevant information, indicators of offences involving a threat to life or safety, identifying the Member State concerned, and the channels for transmitting notifications to law enforcement; a list of national contact points is published alongside it.

The Irish Data Protection Commission, as lead supervisory authority, issued a final decision on 21 September 2026 finding that Google Ireland Limited infringed the GDPR in its processing of location data in 'Web & App Activity', 'Location History' and 'Location Accuracy' between 25 May 2018 and 4 February 2020. The infringements concern lawfulness and fairness, accountability, transparency and retention; the DPC imposed fines totalling EUR 403 000 000 and ordered Google to bring its processing into compliance within 6 months.

On 17 September 2026 the EDPB adopted version 2.0 of Guidelines 3/2025 on the interplay between the Digital Services Act and the GDPR, the final version after public consultation. The guidelines address, among other things, advertising and the ban on using special categories of data (Article 26 DSA), recommender systems, the protection of minors under Article 28 DSA, including age assurance, and systemic-risk management by very large platforms and search engines (Articles 34 and 35 DSA), where the EDPB states a data protection impact assessment is likely to be mandatory if systemic risks are identified.

On 17 September 2026 the EDPB adopted version 1.0 of Guidelines 04/2026, for public consultation, on how supervisory authorities decide whether to impose an administrative fine under the GDPR, in addition to or instead of the other corrective measures under Article 58(2) GDPR. The guidelines set out a five-step methodology, give an overview of corrective measures such as warnings, reprimands, orders, limitations including bans, and withdrawal of certification, and include 14 practical examples; they replace the WP29 guidelines on administrative fines. The guidelines are open for public consultation until 13 November 2026.

ENISA has deployed the initial operating capability of the Single Reporting Platform, the tool through which manufacturers report actively exploited vulnerabilities and severe incidents under the Cyber Resilience Act. ENISA states that these reporting obligations apply to manufacturers from 11 September 2026, that a notification goes to the coordinating CSIRT and is made available to ENISA, and that the obligations for open-source software stewards apply from 11 December 2027.

In Case C-798/24 (Jautiva), a preliminary reference from the Latvian Constitutional Court, the Court of Justice (First Chamber) ruled on 3 September 2026 that Article 14(d) of the company-law Directive (EU) 2017/1132 does not require disclosure of information on all shareholders, including minority shareholders. It also held that Articles 5 and 6 GDPR, read with Articles 7 and 8 of the Charter, preclude national legislation making identity, contact and shareholding data of all shareholders of public limited companies publicly available where access is not subject to any conditions, such as demonstrating a legitimate interest.

On 31 August 2026 the European Commission designated ChatGPT as a Very Large Online Search Engine and Reddit and Roblox as Very Large Online Platforms under the Digital Services Act, after the services declared at least 45 million average monthly users in the EU. According to the Commission, the services have four months, i.e. by January 2027, to comply with the additional obligations for such services, including assessing and mitigating systemic risks; the Commission supervises them in cooperation with Coimisiún na Meán (ChatGPT) and the Dutch ACM (Reddit and Roblox).

ENISA published a report on the high-level technical competences that conformity assessment bodies will need to be notified under the Cyber Resilience Act, in particular experience and training requirements for auditors and evaluators. ENISA notes that these must be complemented by competences specific to the harmonised standards still under development.

ENISA published procurement guidelines to help hospitals and healthcare providers build cybersecurity objectives into every phase of their procurement life cycle. The guidelines set cybersecurity requirements, specify information suppliers must provide, and are aligned with the NIS2 Directive, the medical device regulations, the GDPR and the European Health Data Space regulation.

In version 2.0 of Guidelines 2/2023, the final version after public consultation, the EDPB sets out when Article 5(3) of the ePrivacy Directive applies to tracking techniques beyond cookies. It identifies the key elements of 'information', 'terminal equipment' and 'gaining access' or 'storage', and applies them to use cases including URL and pixel tracking, local processing, IP-based tracking, IoT reporting and unique identifiers.

Guidelines 02/2024 (final version 2.1) explain that under Article 48 GDPR judgments or decisions of third-country authorities cannot automatically be recognised or enforced in the EU, and are generally recognised through international agreements such as mutual legal assistance treaties. The EDPB states that answering a third-country authority's request for personal data is a transfer that must comply with Article 6 and Chapter V GDPR, with other legal bases or the Article 49 derogations considered where no international agreement provides them.

Regulation (EU) 2026/1744 (Digital Omnibus on AI) was published in the Official Journal on 24 July 2026 and entered into force on the third day after publication, i.e. 27 July 2026. It amends the AI Act so that the high-risk requirements (Chapter III, Sections 1 to 3) apply from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I systems, replaces the AI literacy provision in Article 4, and adds prohibitions in Article 5 on AI systems generating non-consensual intimate material or child sexual abuse material, applying from 2 December 2026.

European Commission communication marking the start of enforcement of the AI Act from 2 August 2026 — including the Article 50 transparency obligations for chatbots and AI-generated content and the general-purpose AI (GPAI) obligations. See the primary source for scope and detail.

European Commission announcement of strong stakeholder backing for the Code of Practice on the transparency of AI-generated content, which supports the Article 50 marking and disclosure obligations. See the primary source for detail.

Court of Justice (Grand Chamber) preliminary ruling on the GDPR (Regulation (EU) 2016/679): material scope (Article 2), the principles relating to processing and its lawfulness (Articles 5 and 6), the concept of data concerning health (Article 9) and personal data relating to criminal convictions (Article 10). See the primary source for the Court's operative findings.

Court of Justice (Fifth Chamber) preliminary ruling on the GDPR (Regulation (EU) 2016/679): its scope where information on criminal convictions is made available to the public online in return for remuneration, and reconciling the right to protection of personal data with the right to freedom of expression and information. See the primary source for the Court's operative findings.

European Commission guidance to help businesses implement the Cyber Resilience Act (Regulation (EU) 2024/2847). See the primary source for the full guidance.

Preliminary finding by the European Commission that TikTok breaches the Digital Services Act by failing to ensure safe accounts for minors. This is a preliminary finding, not a final decision; TikTok can respond before the Commission concludes. See the primary source for details.

The EDPB adopted a common data breach notification template to harmonise GDPR Article 33 breach notifications across the EU.

The European Commission accepted X’s action plan to comply with the Digital Services Act’s transparency obligations and researchers’ access to data, after its December 2025 decision that X was in breach of the DSA and a fine. X committed to improve its advertisement repository (more search filters, results shown in the interface, faster responses, fuller information on each advertisement and access via an API) and to give eligible researchers free and timely access to public data, with a better screening of applications and terms that no longer prohibit eligible researchers from scraping public data. The Board for Digital Services found the plan insufficient overall in its opinion of 15 June; the Commission has clarified points X must take into account. X has six months to implement the plan and must then submit an independent external audit; the Commission supervises the implementation closely.

Commission Implementing Regulation (EU) 2026/1755 sets detailed procedural arrangements for how the Commission conducts certain proceedings under the AI Act (Regulation (EU) 2024/1689). Published in the Official Journal.

The European Commission published guidelines to help providers and deployers of AI systems meet the transparency obligations of Article 50 of the AI Act, which apply from 2 August 2026. The guidelines clarify which providers and deployers must comply with the obligations for interactive AI systems and for marking and labelling AI-generated content. Providers must design AI systems so that people are told when they interact directly with AI, and must add machine-readable marks so that AI-generated or manipulated content can be detected. Deployers must inform people when they are exposed to deep fakes, to AI-generated content on matters of public interest without human review or editorial control, and to emotion recognition or biometric categorisation systems. Regulation (EU) 2026/1744, which entered into force after the guidelines were published, gives providers of generative AI systems placed on the market before 2 August 2026 until 2 December 2026 to comply with the marking obligation in Article 50(2).

The European Commission fined AliExpress €550 million for breaching its obligations under the Digital Services Act to diligently assess and mitigate the risks of illegal, unsafe or counterfeit products being sold through its e-commerce platform, and ordered the platform to take action. According to the Commission, AliExpress fell short of its duty to assess the risk of such products spreading through its services in multiple ways, and failed to take effective measures to reduce that risk. Failure to comply with the non-compliance decision may lead to periodic penalty payments.

On 8 July 2026 the EDPB published guidance on when data counts as anonymous and how the GDPR applies to web scraping used to train generative AI. Data is anonymous only if individuals cannot be singled out, linked across records, or inferred - and that assessment can differ per recipient. Scraping personal data must respect purpose limitation, transparency, accuracy and data minimisation, and special-category data still needs both an Article 6 lawful basis and an Article 9(2) exception. The anonymisation and web-scraping guidelines are open for public consultation until 30 October 2026 and may still change; the accompanying blockchain guidelines were adopted in final form.

An enforcement action related to NIS2/cybersecurity regulation: “Commission refers Ireland, Spain, France and the Netherlands to the Court of Justice for failing to transpose the rules on cybersecurity”. See the primary source for the authoritative text.

ENISA published NIS2 implementation guidance: NIS2 Technical Implementation Guidance plus a companion on cybersecurity roles and skills for essential and important entities.

The Commission published a Code of Practice on marking and labelling AI-generated content. It supports the Article 50 transparency obligations: machine-readable marking and detectability of synthetic content by providers (Art. 50(2)) and disclosure/labelling of AI-generated or manipulated content by deployers (Art. 50(4)).

The ban on AI emotion recognition in the workplace and education applies since 2 February 2025 (Art. 5 AI Act). Enforcement is still nascent — no major formal case yet. Fines for prohibited practices are the highest in the regulation.

The SyRI welfare-fraud risk system breaches Article 8 ECHR: insufficiently transparent and not proportionate. Use prohibited.

Years of unlawful and discriminatory processing of applicants' (dual) nationality for childcare benefits; nationality wrongly used as a risk indicator.

Unlawful database of billions of facial images scraped from the internet for facial recognition, without a valid legal basis; processing of biometric personal data.

ChatGPT trained on personal data without a valid legal basis, breach of transparency duties, failure to report a data breach (March 2023) and missing age verification.

Regulation (EU) 2026/1744 was published on 24 July 2026 and entered into force on 27 July 2026. The binding high-risk application dates are 2 December 2027 for Annex III systems and 2 August 2028 for AI embedded in Annex I regulated products.

Voluntary code of practice for providers of general-purpose AI models (Art. 53/55), with three chapters: transparency, copyright and safety/security. Signatories (incl. Anthropic, Google, Microsoft, OpenAI, IBM) use it to demonstrate compliance; Meta did not sign.

The Commission's official guidance on the prohibited practices (Art. 5): manipulation, exploitation of vulnerabilities, social scoring, untargeted facial scraping, emotion recognition at work/education, biometric categorisation and certain real-time biometric identification. Non-binding; the CJEU has the final say.