The EU AI Act Weekly

What changed

Documents we already monitor that moved this week.

EU incident response and cyber crisis management | ENISA

EU · high · detected 2026-10-28

The document has been updated to reflect the adoption of a new Cyber Blueprint in June 2025, which aims to enhance the EU's response to large-scale cybersecurity incidents by clarifying roles and responsibilities. ENISA's role as a key enabler of effective cyber crisis management is emphasized, along with its contributions to preparedness, operational coordination, and situational awareness. This change matters as it indicates a more structured approach to crisis management, which can improve the effectiveness of responses to cyber threats for organizations within the EU.

EDPB — Greek DPA Fines Clearview AI €20M for Biometric Data Violations (2022)

GR · medium · detected 2026-10-29

The document has been updated to include a section encouraging readers to stay informed about the latest developments in data protection, specifically mentioning various topics and sources of news related to GDPR enforcement and cooperation among data protection authorities. This change is significant for organizations as it emphasizes the importance of staying updated on regulatory changes and compliance requirements, which can impact their operations and legal obligations.

FTC — Privacy & Security Business Guidance (USA)

US · medium · detected 2026-10-28

The document has removed the entire Business Guidance Menu section, which included various categories related to advertising, privacy, security, and industry-specific guidance. This change may affect organizations by limiting their access to structured resources and guidance on compliance, potentially making it harder for them to navigate regulatory requirements.

South Korea — Personal Information Protection Act (PIPA) — Personal Information Protection Commission (PIPC)

KR · medium · detected 2026-10-28

The PIPC has shifted its focus to urging organizations to implement preventive measures against personal data breaches related to PHP2Shell and is inviting public input on safeguarding personal information in the context of AI. This change emphasizes the importance of proactive data protection strategies and public engagement in privacy matters, particularly as they relate to emerging technologies.

Brazil — ANPD: Autoridade Nacional de Proteção de Dados (National Data Protection Authority portal)

BR · medium · detected 2026-10-28

The updated document reflects the publication of an analysis regarding contributions to the regulation of the Internet Civil Framework and mentions corrective measures taken by the ANPD against a municipality for a data breach. This indicates a proactive approach by the ANPD in addressing data protection issues and enforcing compliance, which is crucial for organizations to understand their responsibilities and potential liabilities regarding data handling.

New Zealand — Privacy Act 2020 (OPC overview, commenced Dec 2020)

NZ · medium · detected 2026-10-28

The document now specifies that due to very high demand, there will be significant delays in processing complaints, potentially exceeding 12 months for investigations. This change highlights the expected timeframe for organizations and individuals submitting complaints, which is important for managing expectations and planning responses.

UK — AI Safety Institute: Research and Evaluations (aisi.gov.uk)

GB · medium · detected 2026-10-28

The document has removed a blog post about technical best practices for frontier AI development and replaced it with a new post discussing pretraining data filtering in biological models. This change indicates a shift in focus towards specific methodologies in AI model training, which could impact organizations by altering the guidance they receive on AI safety practices. Understanding these updates is crucial for organizations to stay compliant and effective in their AI development efforts.

AI Safety Institute - GOV.UK

medium · detected 2026-10-28

The document has shifted focus from a UK-US memorandum of understanding on AI safety to introducing systemic AI safety fast grants and guidance. This change indicates a move towards providing financial support and clearer instructions for organizations working on AI safety, which could enhance their ability to innovate and comply with safety standards.

European Centre for Algorithmic Transparency - European Centre for Algorithmic Transparency

medium · detected 2026-10-28

The title of the upcoming ECAT Research Workshop 2026 has been updated to specify that it will focus on 'genAI and the future of platforms and search engines.' This change is significant as it indicates a shift in focus towards generative AI technologies, which may impact organizations involved in platform and search engine development by highlighting emerging regulatory considerations in this area.

EDPB — AEPD Imposes €6M Fine on CaixaBank for Unlawful Data Processing (2021)

ES · medium · detected 2026-10-28

The document now includes a section encouraging readers to stay informed about the latest developments in data protection, highlighting news from the EDPB and national authorities. This addition emphasizes the importance of ongoing awareness and compliance with data protection regulations, which is crucial for organizations to avoid penalties and ensure they are up-to-date with legal requirements.

EDPB — AEPD Fines CaixaBank €3M for Unlawful Profiling for Commercial Purposes (2021)

ES · medium · detected 2026-10-28

The document now includes a section encouraging readers to stay informed about the latest developments in data protection, including news from the EDPB and national authorities. This addition emphasizes the importance of ongoing awareness and compliance with data protection regulations, which is crucial for organizations to avoid penalties and ensure they are up-to-date with legal requirements.

EDPB — Facial Recognition in School: Sweden's First GDPR Fine (2019)

SE · medium · detected 2026-10-28

The document now includes a section encouraging readers to stay informed about the latest developments in data protection, highlighting news from various authorities and topics related to GDPR enforcement and cooperation. This addition is significant for organizations as it emphasizes the importance of staying updated on regulatory changes and compliance requirements, which can impact their operations and legal obligations.

Artificial Intelligence | Shaping Europe’s digital future

EU · medium · detected 2026-10-28

The document shifted from reporting news articles to a call for proposals focused on new approaches for Human/AI collaboration in the workforce. This change emphasizes the European Commission's commitment to fostering innovation in AI and its integration into the workforce, which may impact organizations by encouraging them to align their projects with these new funding opportunities and strategic initiatives.

Policy papers and consultations - GOV.UK

UK · medium · detected 2026-10-28

The addition of 'National School of Government and Public Services' indicates a specific entity involved in policy papers and consultations. This change may affect organizations by highlighting a new or existing resource for guidance or training related to government policies.

Research and statistics - GOV.UK

UK · medium · detected 2026-10-28

The addition of 'National School of Government and Public Services' indicates a new entity involved in research and statistics within the UK government framework. This change may affect organizations by introducing new guidelines or resources related to public service training and development.

Guidance and regulation - GOV.UK

UK · medium · detected 2026-10-28

The document has shifted focus from summarizing a Memorandum of Understanding to announcing a collaboration between the governments of the UK and Canada, specifically involving the National School of Government and Public Services. This change indicates a new partnership or initiative that may affect organizations engaged with these governmental bodies.

EU international engagement on Artificial Intelligence

EU · medium · detected 2026-10-28

The document has removed references to a Eurobarometer survey on AI use in European companies and replaced it with information about a conference on the Cyber Resilience Act and funding for 6G research. This indicates a shift in focus from AI adoption metrics to cybersecurity and technological innovation initiatives, which may affect organizations by altering priorities and funding opportunities in the tech landscape.

Decision notices | ICO

UK · medium · detected 2026-10-28

The document has added several organizations and references to specific Freedom of Information (FOI) provisions. This change indicates that these entities are now recognized in the context of decision notices, which may affect how they handle information requests and compliance with FOI regulations. Organizations subject to this may need to adjust their practices to align with the updated references.

AI Act Standardisation — Harmonised Standards and Conformity

EU · medium · detected 2026-10-28

The document removed a news article about AI adoption rates in EU strategic sectors and replaced it with a news article focusing on funding for 6G research related to AI. This change shifts the focus from AI adoption statistics to investment in AI-related technology development, which may influence organizations' strategic planning and funding opportunities.

EU AI Pact - voluntary commitments

EU · medium · detected 2026-10-28

The document now specifies two organizations, DeskMagic UG and Velyx GmbH, as part of the voluntary commitments under the EU AI Pact, and it has updated the date to 23 October 2026. This change indicates a shift in the entities involved and the timeline for compliance, which could affect how organizations prepare for their commitments under the pact.

European AI Office - mandate and implementation role

EU · medium · detected 2026-10-28

The deadline for a specific requirement has been extended from September 30, 2026, to December 11, 2026. Additionally, a reference to a Eurobarometer finding on cyber threats has been replaced with a focus on product cybersecurity and the implementation of the Cyber Resilience Act (CRA). This change may affect organizations by providing them with additional time to comply with cybersecurity regulations and emphasizing the importance of product cybersecurity.

NORA — Norwegian Artificial Intelligence Research Consortium

NO · medium · detected 2026-10-28

The document has removed information about the BatterySwapAI 2026 Challenge and added details about the Nordic AI Cup 2026. This change highlights a shift in focus from battery maintenance AI applications to a broader celebration of AI talent across the Nordic countries, which may affect organizations involved in AI development and competitions in the region.

Data Protection Act 2018 (UK) — Contents Page — legislation.gov.uk

GB · low · detected 2026-10-28

There are no substantive changes in the content of the Data Protection Act 2018; the differences are purely formatting or navigation-related. This means that organizations subject to this regulation will not experience any changes in their compliance requirements or obligations.

Brazil — Lei Geral de Proteção de Dados Pessoais (LGPD, Lei 13.709/2018, Brazilian Data Protection Act)

BR · low · detected 2026-10-28

The document has undergone significant formatting and administrative changes, including the removal of specific references to the Brazilian Presidency and the inclusion of a notice regarding a blocked request. These changes do not alter the substantive legal provisions of the LGPD but may affect how organizations interact with the regulatory body and manage communications. The addition of a contact for blocked requests indicates a more structured approach to handling inquiries.

UK — Online Safety Act 2023

GB · low · detected 2026-10-28

The changes appear to be related to the formatting or presentation of the document rather than substantive content. There are no alterations to the legal text or requirements of the Online Safety Act itself. This is primarily an editorial update, which does not affect organizations subject to the Act.

New this week

Newly ingested into the corpus.

UNESCO — Recommendation on the Ethics of Artificial Intelligence (adopted Nov 2021)

The UNESCO Recommendation on the Ethics of Artificial Intelligence, adopted on November 23, 2021, aims to guide the development and implementation of AI technologies in alignment with ethical standards and human rights. It acknowledges AI's significant societal impacts and the necessity of addressing ethical concerns…

Obligations in focus

Active obligations attached to the documents in this issue — not necessarily extracted this week.

controlador — Encerrar o tratamento de dados pessoais quando a finalidade foi alcançada ou os dados deixaram de ser necessários.

Brazil — Lei Geral de Proteção de Dados Pessoais (LGPD, Lei 13.709/2018, Brazilian Data Protection Act)

controlador — Encerrar o tratamento de dados pessoais ao fim do período de tratamento.

Brazil — Lei Geral de Proteção de Dados Pessoais (LGPD, Lei 13.709/2018, Brazilian Data Protection Act)

controlador — Encerrar o tratamento de dados pessoais mediante comunicação do titular.

Brazil — Lei Geral de Proteção de Dados Pessoais (LGPD, Lei 13.709/2018, Brazilian Data Protection Act)

controlador — Encerrar o tratamento de dados pessoais por determinação da autoridade nacional.

Brazil — Lei Geral de Proteção de Dados Pessoais (LGPD, Lei 13.709/2018, Brazilian Data Protection Act)

Os agentes de tratamento — Adotar medidas de segurança, técnicas e administrativas aptas a proteger os dados pessoais de acessos não autorizados e de situações acidentais ou ilícitas de destruição, perda, alteração, comunicação ou qualquer forma de tratamento inadequado ou ilícito.

Brazil — Lei Geral de Proteção de Dados Pessoais (LGPD, Lei 13.709/2018, Brazilian Data Protection Act)

controlador — Prove that consent was obtained in accordance with this Law.

Brazil — Lei Geral de Proteção de Dados Pessoais (LGPD, Lei 13.709/2018, Brazilian Data Protection Act)

controlador — Ensure that written consent is provided in a clause that stands out from other contractual clauses.

Brazil — Lei Geral de Proteção de Dados Pessoais (LGPD, Lei 13.709/2018, Brazilian Data Protection Act)

órgãos de pesquisa — Tratem dados pessoais exclusivamente dentro do órgão e estritamente para a finalidade de realização de estudos e pesquisas.

Brazil — Lei Geral de Proteção de Dados Pessoais (LGPD, Lei 13.709/2018, Brazilian Data Protection Act)