The EU AI Act Weekly

What changed

Documents we already monitor that moved this week.

Cyber Resilience Act (2024/2847) [EN]

EU · high · detected 2026-09-10

The diff shows the removal of the entire substantive content of the Cyber Resilience Act (EU 2024/2847)—including its preamble, legal basis, recitals, and regulatory framework—and replacement with only header/navigation elements from the Official Journal. This appears to be a document formatting or archival error rather than a regulatory change, as the actual regulation text has been deleted entirely.

EU — Digital Markets Act (DMA, Regulation 2022/1925)

EU · high · detected 2026-09-10

The diff shows the removal of the complete substantive text of EU Regulation 2022/1925 (Digital Markets Act) and its replacement with a navigation menu for the Official Journal website. This appears to be a document format or database error rather than a regulatory change—the actual DMA legal provisions have been deleted and replaced with metadata/navigation elements.

EU — Digital Services Act (DSA, Regulation 2022/2065)

EU · high · detected 2026-09-10

This diff shows the removal of the complete substantive text of EU Regulation 2022/2065 (Digital Services Act) and its replacement with generic Official Journal metadata and publication date listings. The regulatory content—including the legislative preamble, recitals explaining the regulation's purpose, and foundational provisions—has been entirely deleted and replaced with navigation/indexing information unrelated to the DSA's actual requirements.

EU — General Data Protection Regulation (GDPR, Regulation 2016/679)

EU · high · detected 2026-09-10

The entire substantive text of GDPR Regulation 2016/679 has been removed and replaced with a navigation index for the Official Journal publication system. This appears to be a document formatting or archival error rather than a regulatory amendment, as the core GDPR regulation itself has been deleted and replaced with metadata about journal publication dates.

Market Surveillance Regulation (2019/1020) — Enforcement of AI Product Safety

EU · high · detected 2026-09-10

The entire substantive content of EU Regulation 2019/1020 on market surveillance and product compliance has been removed and replaced with a navigation index for the Official Journal publication system. This represents a complete deletion of the regulatory framework governing market surveillance, product safety enforcement, and compliance requirements across EU member states, replacing it with only technical metadata about journal publication dates.

Open Data Directive (2019/1024) — Public Sector Data Reuse for AI

EU · high · detected 2026-09-10

The diff shows the removal of the complete substantive text of EU Directive 2019/1024 (Open Data Directive) and its replacement with generic Official Journal navigation metadata and publication dates. This appears to be a document formatting or database error rather than a regulatory change—the actual legal requirements, obligations, and provisions of the directive have been deleted and replaced with non-normative header information.

Health Technology Assessment Regulation (2021/2282) — AI Diagnostics Evaluation

EU · high · detected 2026-09-10

The entire substantive content of EU Regulation 2021/2282 on health technology assessment has been removed and replaced with navigation/metadata for an Official Journal index page. This represents a complete deletion of the regulatory framework governing HTA processes, assessment domains, and coordination mechanisms across EU Member States, replaced by what appears to be a website navigation element.

Platform-to-Business Regulation (2019/1150) — Algorithmic Ranking Transparency

EU · high · detected 2026-09-10

The entire substantive content of EU Regulation 2019/1150 (Platform-to-Business Regulation) has been removed and replaced with navigation/metadata elements from an Official Journal index page. This appears to be a document corruption or replacement error rather than a regulatory amendment. The regulation establishing transparency and fairness requirements for online platforms' treatment of business users is no longer present.

Regulatory document

medium · detected 2026-09-12

The document version date has been updated from May 27, 2026 to September 10, 2026, indicating a new current version is now in effect. Without visibility into the actual substantive changes between these versions, the impact cannot be determined from this metadata change alone. Organizations should review the full updated document to identify any regulatory or compliance requirement changes.

South Korea — Personal Information Protection Act (PIPA) — Personal Information Protection Commission (PIPC)

KR · medium · detected 2026-09-09

The regulatory update replaces a notice about a youth monitoring initiative with an announcement of actual enforcement actions against four businesses for data breaches. This shift from preventive program announcement to concrete sanctions demonstrates the PIPC's active enforcement posture and signals increased scrutiny of data protection compliance. Organizations should note that the PIPC is moving from awareness-building to penalty-imposing, indicating heightened regulatory enforcement activity.

AI Safety Institute - GOV.UK

medium · detected 2026-09-09

The document title and date have changed from an 'International Scientific Report on the Safety of Advanced AI: interim report' dated October 22, 2025, to a 'Frontier AI Taskforce: second progress report' dated October 30, 2023. This represents a substitution of one AI safety document with another from a different source and earlier timeframe, suggesting a rollback or replacement of the referenced guidance material.

EU Artificial Intelligence Act (Regulation 2024/1689) — Official Journal PDF

EU · low · detected 2026-09-10

The diff shows a removal of the EUR-Lex document metadata and navigation interface (header, search tools, language options, and publication details) and replacement with a simplified Official Journal publication schedule listing. This appears to be a formatting or document structure change rather than a substantive regulatory modification. The actual AI Act regulatory text and requirements remain unchanged.

Regulatory document

low · detected 2026-09-10

The diff shows removal of the complete content of Commission Implementing Decision (EU) 2019/1145 regarding anti-dumping measures on ductile cast iron tubes and pipes from India, replaced with navigation elements for an Official Journal publication listing. This appears to be a document structure or website template change rather than a substantive regulatory modification. The actual regulatory decision content has been deleted and replaced with generic journal navigation links.

Regulatory document

low · detected 2026-09-10

The diff shows removal of EUR-Lex website navigation and document metadata elements, replaced with what appears to be Official Journal publication date entries from September 2026. This represents a formatting/structural change in how the document is presented rather than a substantive change to the regulation's legal content itself. The underlying Regulation (EU) 2024/573 on fluorinated greenhouse gases remains unchanged in its requirements.

Effort Sharing Amendment - Regulation (EU) 2023/857

EU · low · detected 2026-09-10

The diff shows removal of EUR-Lex website navigation and document metadata elements (header, language options, document identifiers) and replacement with Official Journal publication schedule entries. This appears to be a formatting/structural change in how the regulation is presented online rather than a substantive change to the regulation's legal content itself. The actual regulatory requirements of the Effort Sharing Amendment remain unchanged.

Regulatory document

low · detected 2026-09-10

The diff shows removal of the full EUR-Lex webpage interface and document metadata for EU Regulation 2018/842 (greenhouse gas emission reductions), replaced with a navigation menu for Official Journal publication dates from September-October 2026. This appears to be a website restructuring rather than a substantive regulatory change to the underlying emission reduction requirements themselves.

EDPB — Greek DPA Fines Clearview AI €20M for Biometric Data Violations (2022)

GR · low · detected 2026-09-09

The document was updated to add a new entry regarding an Irish Data Protection Commission decision concerning the Health Service Executive (HSE), dated September 3, 2026. This represents an addition of one new regulatory action item to what appears to be a collection of EDPB/DPA enforcement cases, replacing or supplementing a previous Italian case reference.

Data Protection Act 2018 (UK) — Contents Page — legislation.gov.uk

GB · low · detected 2026-09-09

No substantive regulatory change detected. The diff shows identical text content between the two versions, indicating this is either a formatting/display update or a technical correction with no material impact on the Data Protection Act 2018 requirements or obligations.

UK — Online Safety Act 2023

GB · low · detected 2026-09-09

No substantive regulatory change detected. The diff shows identical text content between the two versions, with only formatting or metadata differences in the document header/navigation elements. This appears to be a technical update to the legislation.gov.uk website interface rather than a change to the actual Online Safety Act 2023 requirements.

GPAI — Global Partnership on AI: Projects & Research Overview

INTERNATIONAL · low · detected 2026-09-09

The document removed 'and the Environment' from the 'AI Compute' topic heading and completed the truncated text about the OECD AI Incidents Monitor (AIM) from 'AIM tra' to 'AIM tracks AI incidents in'. This represents a minor editorial change removing environmental considerations from the AI Compute research area and clarifying the AIM description.

European Centre for Algorithmic Transparency - European Centre for Algorithmic Transparency

low · detected 2026-09-09

The document updated its news and events section by replacing outdated content from July-September 2026 with newer entries from September-November 2026. Specifically, it removed a truncated article about AI chatbot research and replaced it with a completed article about ECAT's participation in ECAF'26, while also updating the events calendar to reflect upcoming conferences (Recsys 2026 keynote and ECAT Research Workshop 2026) instead of the past ECAF'26 event.

OECD Recommendation on AI — AI Principles (2019, revised 2024)

INTERNATIONAL · low · detected 2026-09-09

The copyright year has been updated from 2025 to 2026, reflecting the document's publication or revision date. This is a routine administrative update with no substantive changes to the AI principles, requirements, or guidance themselves.

EDPB — AEPD Imposes €6M Fine on CaixaBank for Unlawful Data Processing (2021)

ES · low · detected 2026-09-09

The document was updated to add a new regulatory case entry: an Irish Data Protection Commission final decision regarding an inquiry into the Health Service Executive (HSE), dated September 3, 2026. This addition expands the regulatory precedent collection from 183 to 184 items, adding an Irish jurisdiction case alongside the existing Spanish CaixaBank case. The HSE case likely involves health data processing violations, which is significant as it establishes new enforcement precedent in the healthcare sector under Irish/EU data protection law.

EDPB — AEPD Fines CaixaBank €3M for Unlawful Profiling for Commercial Purposes (2021)

ES · low · detected 2026-09-09

The document was updated to add a new item (item 184) referencing an Irish Data Protection Commission decision regarding the Health Service Executive (HSE), dated September 3, 2026. This expands the regulatory case collection from 183 to 184 items and adds an Irish jurisdiction example alongside the existing Spanish CaixaBank fine. The addition demonstrates ongoing enforcement action in health sector data handling practices.

EDPB — Facial Recognition in School: Sweden's First GDPR Fine (2019)

SE · low · detected 2026-09-09

The document list was updated to include one additional item (184 total, up from 183). A new entry was added regarding the Irish Data Protection Commission's final decision on an inquiry into the Health Service Executive (HSE), dated September 3, 2026. The Italian SA fine regarding post-sick leave questionnaires was removed. This reflects a change in the document's reference materials or case examples.

New this week

Newly ingested into the corpus. Showing 15 of 21.

The Digital Services Act | Shaping Europe’s digital future

The Digital Services Act (DSA) establishes a comprehensive regulatory framework for online services in the EU, aiming to create a safer digital environment for citizens. Key provisions include enhanced user rights such as transparency in content moderation, options for appealing decisions, and mechanisms for reporting…

Methane Emissions Reduction in the Energy Sector - Regulation (EU) 2024/1787

EU · regulation

# Summary: Regulation (EU) 2024/1787 on Methane Emissions Reduction **Purpose:** This EU regulation establishes a comprehensive legal framework to reduce anthropogenic methane emissions in the energy sector, addressing a critical climate gap. **Key Provisions:** - Applies to oil and gas upstream operations…

Alternative Fuels Infrastructure Regulation - Regulation (EU) 2023/1804

EU · regulation

# Summary: Regulation (EU) 2023/1804 **Purpose:** Regulation (EU) 2023/1804, adopted September 13, 2023, establishes a framework for deploying alternative fuels infrastructure across the EU, repealing Directive 2014/94/EU. **Key Issues Addressed:** The regulation responds to uneven infrastructure development, lack of…

ReFuelEU Aviation - Regulation (EU) 2023/2405

EU · regulation

# ReFuelEU Aviation Regulation Summary **Purpose:** Regulation (EU) 2023/2405, adopted October 18, 2023, establishes a framework to ensure fair competition in sustainable air transport while promoting decarbonization. **Key Legal Obligations:** - Implements EU climate goals under Regulation (EU) 2021/1119: achieve…

FuelEU Maritime - Regulation (EU) 2023/1805

EU · regulation

# FuelEU Maritime - Regulation (EU) 2023/1805 Summary **Purpose:** This EU regulation mandates the use of renewable and low-carbon fuels in maritime transport to achieve climate neutrality by 2050, supporting the EU's commitment under Regulation (EU) 2021/1119 to reduce greenhouse gas emissions by at least 55% by…

Heavy-duty Vehicle CO2 Standards - consolidated Regulation (EU) 2019/1242

EU · regulation

# Summary: Heavy-duty Vehicle CO2 Standards (EU) 2019/1242 **Purpose:** Regulation (EU) 2019/1242, adopted June 20, 2019, establishes CO2 emission performance standards for new heavy-duty vehicles to support the EU's climate-neutrality objective and Paris Agreement commitments. **Scope:** Applies to new heavy-duty…

Cars and Vans CO2 Standards - consolidated Regulation (EU) 2019/631

EU · regulation

# Summary: Regulation (EU) 2019/631 – Cars and Vans CO2 Standards **Purpose:** This EU regulation establishes CO2 emission performance standards for new passenger cars (Category M1) and light commercial vehicles (Category N1) to support greenhouse gas reduction targets under Regulation (EU) 2018/842 and the Paris…

F-gas Regulation - Regulation (EU) 2024/573

EU · regulation

# Summary of Regulation (EU) 2024/573 on Fluorinated Greenhouse Gases **Purpose:** This regulation replaces Regulation (EU) No 517/2014 to strengthen controls on fluorinated greenhouse gases (F-gases), which account for 2.5% of EU greenhouse gas emissions and are thousands of times more potent than CO2. **Key…

Energy Efficiency Directive - Directive (EU) 2023/1791

EU · regulation

# Summary: Energy Efficiency Directive (EU) 2023/1791 **Purpose:** This directive recasts Directive 2012/27/EU to strengthen EU energy efficiency requirements in support of the EU's climate goals. **Key Objectives:** - Achieve at least 55% GHG emissions reduction by 2030 (compared to 1990 levels) - Reach climate…

Renewable Energy Directive - consolidated Directive (EU) 2018/2001

EU · regulation

# Renewable Energy Directive (EU) 2018/2001 Summary **Purpose:** Directive (EU) 2018/2001, adopted December 11, 2018, establishes a common EU framework promoting renewable energy use. It sets binding 2030 targets for renewable energy's share in gross final consumption. **Key Provisions:** - Establishes support schemes…

Governance of the Energy Union and Climate Action - Regulation (EU) 2018/1999

EU · regulation

# Summary: Regulation (EU) 2018/1999 **Purpose:** This regulation establishes governance mechanisms for the EU Energy Union and Climate Action, ensuring achievement of 2030 and long-term energy and climate objectives aligned with the 2015 Paris Agreement. **Key Targets (2030):** - Minimum 40% economy-wide GHG…

Carbon Border Adjustment Mechanism - Regulation (EU) 2023/956

EU · regulation

# Summary: Carbon Border Adjustment Mechanism (EU 2023/956) **Purpose:** Regulation (EU) 2023/956, adopted May 10, 2023, establishes the Carbon Border Adjustment Mechanism (CBAM) to support the EU's climate objectives under the European Green Deal and Paris Agreement commitments. **Key Context:** - Implements the EU's…

LULUCF Amendment - Regulation (EU) 2023/839

EU · regulation

# LULUCF Amendment - Regulation (EU) 2023/839 Summary **Purpose:** This regulation amends Regulation (EU) 2018/841 on Land Use, Land Use Change and Forestry (LULUCF) to strengthen climate and biodiversity goals. **Key Amendments:** - Expands LULUCF scope - Simplifies reporting and compliance rules - Establishes Member…

LULUCF Regulation - Regulation (EU) 2018/841

EU · regulation

# LULUCF Regulation (EU) 2018/841 Summary **Purpose:** This EU regulation integrates greenhouse gas emissions and removals from Land Use, Land Use Change and Forestry (LULUCF) into the EU's 2030 climate and energy framework, amending Regulation (EU) No 525/2013 and Decision No 529/2013/EU. **Key Legal Provisions:** -…

Effort Sharing Amendment - Regulation (EU) 2023/857

EU · regulation

# Summary: Regulation (EU) 2023/857 - Effort Sharing Amendment **Purpose:** This regulation amends Regulation (EU) 2018/842 to strengthen EU greenhouse gas emission reduction targets and align with the Paris Agreement and European Climate Law commitments. **Key Legal Framework:** - Implements Regulation (EU) 2021/1119…

Obligations in focus

Active obligations attached to the documents in this issue — not necessarily extracted this week.

gatekeeper — Comply with the obligations laid down in Articles 5, 6 and 7.

Deadline: within 6 months after a core platform service has been listed in the designation decision

EU — Digital Markets Act (DMA, Regulation 2022/1925)

controller — Provide information on action taken on a request under Articles 15 to 22 to the data subject.

Deadline: within one month of receipt of the request

EU — General Data Protection Regulation (GDPR, Regulation 2016/679)

controller — Inform the data subject of any extension of the period for responding to a request under Articles 15 to 22.

Deadline: within one month of receipt of the request

EU — General Data Protection Regulation (GDPR, Regulation 2016/679)

controller — Inform the data subject of the reasons for not taking action on a request under Articles 15 to 22.

Deadline: at the latest within one month of receipt of the request

EU — General Data Protection Regulation (GDPR, Regulation 2016/679)

controller — Provide information under Articles 13 and 14 and any communication and actions taken under Articles 15 to 22 and 34 free of charge.

EU — General Data Protection Regulation (GDPR, Regulation 2016/679)

controller — Request additional information necessary to confirm the identity of the data subject if there are reasonable doubts concerning the identity of the natural person making the request.

EU — General Data Protection Regulation (GDPR, Regulation 2016/679)

controllers — Implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation.

EU — General Data Protection Regulation (GDPR, Regulation 2016/679)

controllers — Implement appropriate technical and organisational measures, such as pseudonymisation, to implement data-protection principles, such as data minimisation.

EU — General Data Protection Regulation (GDPR, Regulation 2016/679)