Court of Rome annuls €15m fine against OpenAI, holding that GDPR one-stop-shop mechanism assigns jurisdiction to Irish data protection authority
11 June 26
Marianna Mattera
The judgment ultimately focused on a procedural and jurisdictional issue, namely which data protection authority was competent to issue the decision on ChatGPT. The court did not touch upon the substance of the alleged General Data Protection Regulation violations nor on the proportionality of the €15m fine.
How Europe could stimulate digital investment
11 June 26
Matej Podbevsek
Stakeholders and academics discussed how Europe can stimulate digital investment and innovation without weakening competition at an IRG event on 10 June in Brussels.
Cybersecurity Act 2: Council discussions focus on EU member states’ role and proportionality of high-risk suppliers’ framework
10 June 26
Visiola Pula
During the Telecommunications Council of 9 June 2026, several ministers and other delegates argued that member states should play a central role under the ICT supply chain security framework (e.g. in designating high-risk countries) in the proposed Cybersecurity Act 2. Some member states also emphasised that the framework should be proportionate and targeted at critical ICT assets and significant risks.
White House orders cybersecurity hardening and optional pre-release review of new AI models
10 June 26
Jose Jehuda Garcia
The White House issued an executive order to address the cybersecurity risks posed by advanced AI systems. The order balances the Trump administration’s commitment to light-touch AI regulation with national security imperatives triggered by frontier AI models (such as Anthropic’s Mythos) that demonstrate a remarkable ability to exploit software vulnerabilities. However, many details are yet to be fleshed out by the implementing government agencies.
UK CMA requires Google to give publishers greater control over use of their content in generative AI
08 June 26
Miljana Todorovic
The UK Competition and Markets Authority (CMA) imposed a legally binding publisher conduct requirement (CR), obliging Google to give publishers control over how their content is used in generative AI, including the ability to opt out of training and grounding at both directory and page level. Google must also provide transparency on the use of publishers' content and user engagement with it, while ensuring clear attribution and access to the original sources. Most of the publisher CR will enter into force in December 2026.
EU Digital & Media Weekly Report
07 June 26
Marianna Mattera
This edition features news about the European Commission’s tech sovereignty package; an industry event addressing ICT supply chain measures under the proposed Cybersecurity Act 2; a BEREC workshop on measures to combat fraud; discussions on piracy and dynamic blocking injunctions in the European Parliament; and the Commission’s publication of the conclusions from its workshop on the review of the Audiovisual Media Services Directive. It also lists events taking place this week.