EU AI Act Changes, Agentic AI Privacy Risks and New Cybersecurity Initiatives
Summary
A newsletter roundup covers EU AI Act changes and transparency guidance, ENISA’s SME cyber-resilience model, European regulators’ AI privacy guidance, and the US GOLD EAGLE vulnerability coordination initiative.
Key points
- The EU Digital Omnibus delays some high-risk AI Act obligations and prohibits certain AI systems intended to generate non-consensual intimate imagery or AI-generated child sexual abuse material.
- European Commission guidance explains AI transparency duties, including disclosure for human-facing AI and machine-readable marking of synthetic content.
- ENISA released an SME cyber-resilience maturity model to help organizations prepare for the Cyber Resilience Act; the model is an assessment tool, not proof of legal compliance.
- France’s CNIL and AI Council warn that agentic AI can complicate GDPR compliance and increase privacy and cybersecurity risks, recommending safeguards such as restricted data access, isolated execution, and human approval for higher-risk actions.
- The Dutch DPA says generative AI developers should assess GDPR lawfulness throughout the model lifecycle, minimize training data, and provide evidence of training-data compliance to organizations deploying third-party models.
- The White House announced GOLD EAGLE, a public-private initiative to coordinate vulnerability reporting, verification, prioritization, and remediation across critical infrastructure.
Article Details
- Event Type
- Launch of GOLD EAGLE, a public-private vulnerability coordination initiative.
- Impact
- According to the announcement, the initiative is intended to accelerate vulnerability reporting, verification, prioritization, remediation, and information sharing across U.S. critical infrastructure. It uses AI-assisted vulnerability management and has begun accepting reports and coordinating scanning verification activities.