ZeroGravity Weekly Brief | February 9, 2026

Delayed AI Act guidance, sharper focus on AI chatbots under the DSA, and a lighter DMA touch for Apple. In Sweden, health data, cybersecurity registration, and DORA reporting deadlines are moving up the agenda. Regulatory pressure is building - clarity is not.

EU Level

AI Act

The European Commission missed its Feb. 2, 2026 deadline to issue guidance on how “high-risk” AI systems should comply with the AI Act – underscoring ongoing delays in the Act’s implementation. (The Commission plans to integrate feedback and release a draft of these high-risk AI guidelines by end of February.)

Read More

Digital Services Act (DSA)

The European Board for Digital Services (consisting of national DSA regulators and the European Commission) held its 17th meeting on Feb. 4, 2026, discussing the impact of AI chatbots, recent DSA enforcement actions, and planning future initiatives. (This Board meeting – marking the DSA’s second year in force – focused on upcoming systemic risk assessments and improved cooperation among Digital Services Coordinators.)

Read More

Digital Markets Act (DMA)

On Feb. 5, 2026, the European Commission announced that Apple’s online advertising service Apple Ads and map service Apple Maps do not meet the criteria for “gatekeeper” designation under the DMA. (After reviewing Apple’s notifications and arguments, regulators found these services are not “important gateways” for businesses to reach users in the EU, due to Apple Maps’ relatively low usage and the limited scale of Apple’s ad business.)

Read More

Sweden Level

GDPR

Sweden’s privacy regulator (IMY) and the eHealth Agency delivered a final report on Feb. 5, 2026, urging improved legal guidance for the use of health data. (The report identifies legal uncertainties and obstacles in sharing health data and proposes a framework for clearer guidance.)

Read More

NIS2 (Cybersecurity Directive)

Sweden’s Civil Contingencies Agency (Myndigheten för civilt försvar) launched a digital portal on Feb. 2, 2026 for companies to register under the new Cybersecurity Act implementing NIS2. (This follows the Act’s entry into force in January and ensures “essential” and “important” entities notify authorities of their operations as required by NIS2.)

Read More

DORA (Digital Operational Resilience Act)

Finansinspektionen (FI) – On 2 Feb 2026 FI published updated guidance clarifying how financial firms should report their DORA “information registers”. FI reminded firms that the DORA information register must be submitted by 28 February (covering the situation as of 31 Dec 2025), and provided a checklist explaining how to fill in the EBA reporting templates under DORA (Implementing Reg 2024/2956)

Read More

Continue reading
Need help?
Contact Us