The EU AI Act Weekly

What changed

Documents we already monitor that moved this week.

Cyber Resilience Act (2024/2847) [EN]

EU · high · detected 2026-10-18

The document has been updated to include a formal citation and introduction of the Cyber Resilience Act, which establishes comprehensive cybersecurity requirements for products with digital elements. This change is significant as it aims to create a uniform legal framework to enhance cybersecurity across the EU, addressing vulnerabilities and improving user awareness. Organizations will need to comply with these new regulations, which may require adjustments in their product development and security practices.

AI Act — Regulation (EU) 2024/1689: Harmonised Rules on AI (Full Text)

high · detected 2026-10-17

The document has undergone a significant update, including the addition of the full title, purpose, and context of the regulation, which outlines the goals of establishing a uniform legal framework for AI systems in the EU. This change clarifies the intent to promote trustworthy AI while ensuring protection of health, safety, and fundamental rights, and it emphasizes the importance of preventing fragmentation of the internal market. These updates matter to organizations as they provide clearer guidance on compliance and the regulatory landscape for AI systems.

In Vitro Diagnostics Regulation (2017/746) — AI in IVD

EU · high · detected 2026-10-17

The document has undergone a significant revision to establish a more robust regulatory framework for in vitro diagnostic medical devices, replacing the previous Directive 98/79/EC. Key changes include a focus on high safety and health standards, harmonization of market rules, and enhanced transparency and traceability requirements. This matters to organizations as it sets stricter compliance standards and reinforces the importance of safety and performance in the market for in vitro diagnostics.

EC Communication: AI Innovation Package — Boosting AI Startups and Innovation (2024)

EU · high · detected 2026-10-17

The document has been significantly restructured to focus on a strategic investment framework aimed at boosting startups and innovation in trustworthy artificial intelligence. It emphasizes the importance of generative AI, its economic potential, and the need for Europe to enhance its competitiveness in this field. This change matters to organizations as it outlines new opportunities for investment and collaboration in AI, potentially influencing funding and regulatory priorities.

EU — Digital Markets Act (DMA, Regulation 2022/1925)

EU · high · detected 2026-10-17

The document has been updated to include the official citation and details of the Digital Markets Act (DMA), including its purpose and the characteristics of core platform services that can lead to market imbalances. This change clarifies the regulatory framework and the rationale behind the DMA, which is crucial for organizations operating in the digital sector as it outlines the expectations and obligations for fair competition. Understanding these provisions is essential for compliance and strategic planning.

Law Enforcement Directive (2016/680) [EN]

EU · high · detected 2026-10-17

The document has been updated to include specific references to the Official Journal of the European Union and the formal introduction of Directive (EU) 2016/680, which outlines the protection of personal data in the context of law enforcement. This change emphasizes the legal framework and obligations regarding personal data processing by authorities, which is crucial for organizations involved in law enforcement or data processing. It clarifies the legal basis for data protection and the responsibilities of organizations, ensuring compliance with EU regulations.

Regulatory document

high · detected 2026-10-17

The document has been updated to include references to Regulation (EU) 2023/957, which amends Regulation (EU) 2015/757 to incorporate maritime transport into the EU Emissions Trading System and outlines the monitoring, reporting, and verification of emissions from additional greenhouse gases and ship types. This change is significant for organizations involved in maritime transport as it introduces new compliance requirements related to emissions, potentially impacting operational costs and regulatory obligations.

Regulatory document

high · detected 2026-10-17

The document has undergone a significant update, specifically the removal of previous official journal references and the addition of new content related to Regulation (EU) 2024/573 on fluorinated greenhouse gases. This change indicates that the regulation has been amended and is now in force, which is crucial for organizations as it may affect compliance requirements regarding greenhouse gas emissions. Organizations must be aware of these updates to ensure they adhere to the latest regulations.

EU Act 52025IP0286

EU · high · detected 2026-10-16

The document has been updated to include a new resolution from the European Parliament regarding the impact of artificial intelligence on the financial sector, along with references to various reports and regulations related to AI and digital finance. This change is significant as it highlights the increasing regulatory focus on AI in finance, which organizations in this sector must now consider in their compliance and operational strategies.

EU Act 52025IP0198

EU · high · detected 2026-10-16

The document has been updated to include a new official journal entry that outlines the European Parliament's resolution on the stock-taking of the European elections in 2024. This includes references to various treaties and regulations that govern electoral processes and rights within the EU. The changes are significant as they formalize the framework and context for upcoming elections, which organizations involved in electoral processes must adhere to.

EU Act 32025R0454

EU · high · detected 2026-10-16

The document has been updated to establish a scientific panel of independent experts in artificial intelligence, detailing the criteria for their selection, the number of experts, and the importance of diversity in expertise. This change is significant for organizations as it outlines the governance structure and operational framework for compliance with Regulation (EU) 2024/1689, which could affect how they engage with AI technologies and regulatory requirements. The establishment of this panel aims to enhance the enforcement of AI regulations and ensure expert guidance in the field.

EU Chips Act (2023/1781) [EN]

EU · high · detected 2026-10-16

The document has been updated to reflect the official publication of the EU Chips Act, including the establishment of a framework to strengthen Europe's semiconductor ecosystem. It emphasizes the importance of reducing dependency on third countries and enhancing the resilience and competitiveness of the semiconductor supply chain. This change is significant for organizations as it outlines new regulatory measures and objectives that may affect their operations and investment strategies in the semiconductor sector.

Data Governance Act (2022/868) [EN]

EU · high · detected 2026-10-16

The document has been updated to include a new official journal reference and a more detailed introduction to the Data Governance Act, emphasizing the importance of data governance for the internal market and the digital economy. It outlines the need for a harmonized framework for data sharing and the establishment of common European data spaces, which is crucial for organizations involved in data management and sharing. This change highlights the regulatory expectations for organizations to comply with new data governance standards and frameworks.

Substances of Human Origin Regulation — Proposal COM(2022) 338 (AI in Biobanking)

EU · high · detected 2026-10-16

The document has been updated to reflect a new proposal for a regulation concerning the quality and safety standards for substances of human origin, replacing older directives. This change emphasizes the need for modernized regulations to address current scientific and technical advancements, ensuring better protection for patients and donors. It highlights the importance of harmonizing oversight across EU member states to facilitate safer and more efficient cross-border exchanges of biological materials.

General Product Safety Regulation (2023/988) — Consumer AI Products

EU · high · detected 2026-10-16

The document has been updated to reflect the official publication of Regulation (EU) 2023/988, which replaces previous directives on general product safety. This change emphasizes the need for a consistent regulatory framework for consumer safety, particularly in light of new technologies and online sales. Organizations must now comply with this regulation instead of the older directives, which may involve adjustments in their compliance and safety protocols.

Machinery Regulation (2023/1230) — AI Safety Requirements

EU · high · detected 2026-10-16

The document has been updated to replace Directive 2006/42/EC with Regulation (EU) 2023/1230, which aims to harmonize health and safety requirements for machinery across EU Member States. This change is significant as it seeks to improve and simplify conformity assessment procedures, ensuring uniform application of safety standards and reducing inconsistencies that previously existed under the directive. Organizations will need to adapt to these new regulatory requirements to ensure compliance and maintain market access.

Commission Staff Working Document - Executive Summary of the AI Act Impact Assessment (SWD(2021) 85)

EU · high · detected 2026-10-16

The document has undergone significant changes, including the addition of a formal introduction and a clear outline of the objectives and problems associated with AI regulation in the EU. It emphasizes the need for a regulatory framework to ensure safety, legal certainty, and prevent market fragmentation, which is crucial for fostering trust and innovation in AI technologies. These changes matter to organizations as they highlight the regulatory landscape they must navigate and the importance of compliance with new AI regulations.

EU Act 52026DC0234

EU · high · detected 2026-10-16

The document has been updated to include a report from the European Commission regarding the review of prohibited AI practices and high-risk AI systems under the AI Act. This change emphasizes the ongoing regulatory oversight and the need for organizations to stay compliant with evolving AI regulations, particularly as the Commission is tasked with annual assessments. The report outlines the AI Act's risk-based approach and the importance of adapting to technological advancements.

EU Act 52025IP0299

EU · high · detected 2026-10-16

The document has been updated to include references to various regulations and resolutions concerning the protection of minors online, including the Digital Services Act and the Artificial Intelligence Act. This change emphasizes the EU's commitment to enhancing online safety for minors and aligns with broader consumer protection efforts. Organizations subject to this regulation may need to adjust their practices to comply with these new provisions.

EDPB — Greek DPA Fines Clearview AI €20M for Biometric Data Violations (2022)

GR · high · detected 2026-10-14

The document was overhauled: many older entries (mostly 2026‑dated events and fines) were removed and replaced with new items, including a new "privacy by design and by default" heading, a statement on smart‑glasses data‑protection challenges, and a series of fresh enforcement actions—most notably large fines on Uber (€824.99 M), BBVA (€5.5 M), IQVIA (€7 M), and several Italian DPA penalties for health‑data and telemarketing breaches. The update signals heightened regulatory focus on health data, employee data, automated decision‑making, and emerging technologies, and introduces the privacy‑by‑design principle as a highlighted requirement.

EDPB — AEPD Imposes €6M Fine on CaixaBank for Unlawful Data Processing (2021)

ES · high · detected 2026-10-14

The update replaces a long list of 2026‑dated events with new enforcement actions and guidance, notably adding a "privacy by design and by default" principle, a statement on smart‑glass data challenges, several large Italian fines (e.g., €16.7 M for Wind Tre, €5.5 M for BBVA, €7 M for IQVIA), a €824.99 M Dutch fine on Uber for unlawful automated decision‑making and profiling, and other fines across Greece, Sweden and Spain. This signals heightened regulator scrutiny on health data, telemarketing, automated decision‑making and the need to embed privacy by design, meaning organisations must reassess compliance in those areas.

EDPB — AEPD Fines CaixaBank €3M for Unlawful Profiling for Commercial Purposes (2021)

ES · high · detected 2026-10-14

The document was stripped of a schedule of upcoming EDPB events, guidelines and policy drafts and replaced with a list of recent enforcement actions, including new privacy‑by‑design language and several large fines (e.g., €824.99 M against Uber, multi‑million‑euro penalties in Italy for telemarketing, health‑data misuse, and employee‑data breaches). This shift highlights a move from forward‑looking guidance to concrete enforcement trends, signalling to companies that regulators are actively penalising non‑compliance in areas such as direct marketing, health data processing, automated decision‑making and data‑subject rights.

EDPB — Facial Recognition in School: Sweden's First GDPR Fine (2019)

SE · high · detected 2026-10-14

The update replaces a list of EDPB events and guidance notes with a longer set of 198 items that focus on enforcement actions and new privacy principles. It adds a "privacy by design and by default" entry and a statement on smart‑glasses data‑protection challenges, and introduces several large fines from Italian, Swedish, Dutch and Hellenic DPAs for telemarketing, health‑data misuse, automated decision‑making and insufficient security. The removal of earlier guideline‑related items shifts the document’s emphasis toward recent penalties and concrete compliance requirements.

Regulatory document

medium · detected 2026-10-18

The document has removed specific references to the Official Journal and its verification process while adding navigation and access information related to the EUR-Lex website. This change is significant as it streamlines access to legal documents and emphasizes the importance of the European Climate Law, which organizations must comply with. The removal of the verification process may affect how organizations confirm the authenticity of legal texts.

Proposal for AI Liability Directive (COM/2022/496)

EU · medium · detected 2026-10-18

The document has removed references to the Official Journal and specific publication dates, while adding navigation and access information related to EUR-Lex, the platform for EU law. This change enhances accessibility and usability for organizations seeking to understand or comply with the AI Liability Directive. The removal of specific publication details may affect how organizations track updates or changes to the directive.

New this week

Newly ingested into the corpus.

ETSI EN 304 223 V2.1.1 (2025-12) — Securing Artificial Intelligence (SAI): Baseline Cyber Security Requirements for AI Models and Systems

EU · guidance · published 2025-12-01

**Summary (150 words):** The **ETSI EN 304 223 V2.1.1 (2025-12)** standard, titled *Securing Artificial Intelligence (SAI): Baseline Cyber Security Requirements for AI Models and Systems*, establishes cybersecurity principles and requirements for AI systems across their lifecycle. Developed by ETSI’s **Securing…

CEN-CENELEC JTC 21 — Business Plan: Artificial Intelligence (v1.0, March 2022)

EU · guidance · published 2022-03-01

The **CEN-CENELEC JTC 21 Business Plan (v1.0, March 2022)** outlines the standardization strategy for **Artificial Intelligence (AI)** in Europe. The committee, led by **Danish Standards**, aims to support **EU legislation, policies, and market needs** by developing AI standards, particularly in alignment with the…

CEN-CENELEC Focus Group Report — Road Map on Artificial Intelligence (September 2020)

EU · guidance · published 2020-09-01

The **CEN-CENELEC Focus Group Report — Road Map on Artificial Intelligence (September 2020)** outlines a strategic framework for AI standardization in Europe, developed by over 80 experts. The report identifies key themes for standardization, including **Accountability, Quality, Data for AI, Security & Privacy…

Obligations in focus

Active obligations attached to the documents in this issue — not necessarily extracted this week.

gatekeeper — Comply with the obligations laid down in Articles 5, 6 and 7.

Deadline: within 6 months after a core platform service has been listed in the designation decision

EU — Digital Markets Act (DMA, Regulation 2022/1925)

gatekeeper — Do not process personal data of end users using services of third parties that make use of core platform services of the gatekeeper for the purpose of providing online advertising services.

EU — Digital Markets Act (DMA, Regulation 2022/1925)

gatekeeper — Do not combine personal data from the relevant core platform service with personal data from any further core platform services or from any other services provided by the gatekeeper or with personal data from third-party services.

EU — Digital Markets Act (DMA, Regulation 2022/1925)

gatekeeper — Do not cross-use personal data from the relevant core platform service in other services provided separately by the gatekeeper, including other core platform services, and vice versa.

EU — Digital Markets Act (DMA, Regulation 2022/1925)

gatekeeper — Do not sign in end users to other services of the gatekeeper in order to combine personal data, unless the end user has given consent.

EU — Digital Markets Act (DMA, Regulation 2022/1925)

gatekeeper — Do not prevent business users from offering the same products or services to end users through third-party online intermediation services or through their own direct online sales channel at prices or conditions that are different from those offered through the online intermediation services of the gatekeeper.

EU — Digital Markets Act (DMA, Regulation 2022/1925)

gatekeeper — Allow business users, free of charge, to communicate and promote offers to end users acquired via its core platform service or through other channels, and to conclude contracts with those end users.

EU — Digital Markets Act (DMA, Regulation 2022/1925)

gatekeeper — Allow end users to access and use, through its core platform services, content, subscriptions, features or other items, by using the software application of a business user.

EU — Digital Markets Act (DMA, Regulation 2022/1925)