.png)
EU
AI ACT
EU prepares enforcement of new AI “nudification” ban.
The Commission confirmed it will be ready to enforce the AI Act’s new prohibition on AI systems generating non-consensual sexual or intimate content and CSAM from 2 December 2026, as scrutiny of AI “nudifier” tools intensifies.
AI ACT
Commission consults on AI and copyright.
The Commission opened a targeted consultation on how technological developments, including generative AI, affect copyright protection. It specifically examines the use of copyright-protected material in AI and potential future EU measures.
Responses are open until 3 November 2026.
AI ACT
EU and Canada deepen cooperation on AI regulation.
The EU and Canada held their Digital Dialogue, with AI safety, regulation and innovation among the main areas of cooperation alongside online safety, digital credentials, high-performance computing and secure connectivity.
DATA ACT
EU focuses on turning data rules into practical economic value.
At Connecting Europe Days, the Commission highlighted the Data Act, Data Governance Act and AI Act as foundations of the EU Data Union, focusing on how data sharing can support AI, competitiveness and digital sovereignty.
DMA
Booking.com changes practices following DMA dialogue.
Following Commission regulatory dialogue, Booking.com stopped using off-platform prices when determining eligibility for its Sponsored Benefit programme and introduced greater transparency around partner programmes and ranking. The changes apply to accommodation providers across the EEA.
DMA
Google challenges EU DMA orders on AI and search data.
Google challenged two Commission DMA orders requiring greater interoperability for competing AI services on Android and access to anonymised Google Search data for eligible rivals. Google argues the measures create privacy and security risks.
DMA
Google seeks suspension of EU search-data order.
Google asked the EU General Court to temporarily suspend the Commission’s DMA search-data order while its legal challenge is pending, arguing that implementation could expose European users to serious privacy risks.
DSA
Commission operationalises Article 18 criminal-offence notifications.
The Commission published national contact points for DSA Article 18 notifications. Hosting providers must promptly alert relevant law-enforcement or judicial authorities when they become aware of suspected criminal offences threatening a person’s life or safety.
DSA
Commission escalates DSA proceedings against Bulgaria.
The Commission sent Bulgaria an additional letter of formal notice for failing to fully comply with the DSA, focusing on whether its Digital Services Coordinator and other national authorities have sufficient powers to enforce the regulation effectively.
DSA
Commission clarifies ChatGPT data access under the DSA.
The Commission said regulators and vetted researchers may access data needed to examine systemic DSA risks involving ChatGPT, subject to necessity, proportionality and data-protection safeguards. It did not specifically confirm access to private conversations or stored memories.
DSA
Commission says Grok DSA investigation remains ongoing.
The Commission confirmed its DSA investigation into risks linked to Grok-generated non-consensual intimate images and potential CSAM remains ongoing, while pointing to the AI Act’s new prohibition taking effect on 2 December 2026.
Sweden
GDPR
IMY investigates ICA’s drug testing of job applicants.
Sweden’s privacy regulator IMY opened GDPR investigations into ICA Gruppen and ICA Sverige over drug testing in recruitment, examining what personal data is processed, how it is handled and whether the processing has a valid legal basis.
NIS2
New Swedish cybersecurity requirements take effect.
Sweden’s MCFFS 2026:11 entered into force on 1 October, detailing risk-based cybersecurity measures and management training for essential and important entities covered by the Swedish Cybersecurity Act implementing NIS2.
NIS2
New rules introduce security audits and scanning.
Also from 1 October, MCFFS 2026:12 applies to security audits and security scanning of entities covered by Sweden’s cybersecurity regime, adding more detailed supervisory mechanisms to the country's NIS2 implementation framework.
