Targeted amendments to NIS2: submarine data transmission infrastructure in scope of cybersecurity rules for critical sectors
11 February 26
Visiola Pula
Large digital providers operating submarine data transmission infrastructure would be subject to security risk-management and incident reporting requirements under the Directive on measures for a high common level of cybersecurity across the EU (NIS2). These obligations would apply outside their core services, such as search engines or social media, which are already in the scope of the current NIS2.
AI Omnibus: European Parliament co-rapporteurs propose fixed timeline for high-risk AI systems rules
10 February 26
Elisar Bashir
While endorsing a postponement of the application date for the obligations applicable to high-risk AI systems, the two co-rapporteurs propose establishing a fixed timeline rather than making the application contingent on a Commission decision. The draft report tables further targeted amendments to the Commission’s proposal, including to AI literacy and the processing of special categories of personal data for bias detection and mitigation.
AI in the sky: SpaceX acquires xAI in US$1.25tn consolidation
09 February 26
Jose Jehuda Garcia
Two of Elon Musk’s companies, SpaceX and xAI, merged into a single entity that will house his rocket, satellite, artificial intelligence (AI) and social network businesses. Despite its very large scale (US$1.25tn), the transaction faces little antitrust scrutiny since the merger did not result in a change of control or ownership. However, several legal concerns could materialise in the future as Musk pursues a vision of AI data centres in space.
Belgian Court of Appeal annuls data protection authority’s decision validating IAB Europe’s action plan to bring cookie consent framework in compliance with GDPR
08 February 26
Marianna Mattera
The Brussels Court of Appeal annulled the Belgian data protection authority (APD)’s decision approving IAB Europe’s action plan to align its Transparency and Consent Framework with the EU General Data Protection Regulation. The court also rejected the APD’s broader view that IAB Europe was acting as joint controller for the data processing carried out in the context of the open real-time bidding protocol.
EU Digital & Media Weekly Report
08 February 26
Elisar Bashir
This report gathers policy and regulatory developments at EU level covered by Cullen International’s Digital Economy and Media services during the last week. It also lists events taking place this week.
Draft Cybersecurity Act 2: changes to the EU cybersecurity certification framework
05 February 26
Alessandra Vaes
The proposal would introduce a cyber posture certificate that would allow entities operating in critical sectors and providing services across several EU member states to demonstrate that they meet EU-level cybersecurity requirements. Future EU certification schemes would be developed by the EU cybersecurity agency (ENISA) within 12 months of the European Commission issuing a request.