EU Sets AI Cybersecurity Plan as Regulators Issue New Privacy Guidance
Summary
A roundup covers the EU’s AI cybersecurity action plan, new EDPB privacy guidance, Dutch NIS2 legislation, and developments in geolocation privacy, cross-border data transfers, U.S. surveillance warrants, and AI regulation.
Key points
- The European Commission’s AI cybersecurity plan calls for frontier-model evaluation and testing, improved access for trusted defenders, stronger vulnerability remediation, open-source support, and investment in European AI capabilities.
- The plan warns that AI can accelerate attacks and vulnerability discovery, urging organizations to adapt risk management and patching; ENISA is to update vulnerability infrastructure and issue guidance.
- The EDPB’s draft guidance says publicly accessible personal data remains subject to GDPR when scraped for generative AI training, and recommends safeguards including narrow collection, filtering, transparency, and limiting model memorization.
- The EDPB’s anonymization guidance emphasizes practical re-identification risk, while its blockchain guidance recommends assessing necessity and avoiding personal data directly on-chain where possible.
- The Netherlands’ proposed Cybersecurity Act advances NIS2 implementation, including board training, incident-reporting deadlines, supply-chain controls, and authority to restrict risky suppliers.
- France’s CNIL warns that location data can identify people and reveal sensitive movements; use for advertising or resale generally requires consent and must still meet data-minimization and security obligations.
- Sweden’s IMY says the EU–U.S. Data Privacy Framework remains in force but advises organizations to monitor legal developments and prepare contingencies; the U.S. Supreme Court held that obtaining historical Google Location History via a geofence warrant is a Fourth Amendment search.
Article Details
- Event Type
- Regulatory, legislative, and judicial developments in cybersecurity, AI governance, data protection, and digital privacy.
- Impact
- The European Commission's Action Plan sets out future measures to strengthen AI-enabled cyber defense, vulnerability remediation, and European AI capabilities while addressing AI-enabled threats. EDPB and EDPS guidance adds practical expectations for anonymization, AI-related web scraping, blockchain data processing, and human oversight. The Netherlands' Cybersecurity Act has passed the House of Representatives but still requires further steps before taking effect. The U.S. Supreme Court held that obtaining Google Location History through a geofence warrant is a Fourth Amendment search, while leaving the warrant's validity unresolved on remand. The FTC AI policy remains a proposal open for public comment.
People
Donald TrumpIssued the December 2025 Executive Order directing the FTC to clarify how Section 5 applies to state AI laws requiring altered AI outputs.Justice AlitoDissented, arguing that the decision expands Carpenter and undermines the third-party doctrine.Justice BarrettJoined substantial parts of Justice Alito's dissent.Justice GorsuchConcurred in the judgment and argued that users have a property interest in their digital location data.Justice JacksonWould have held that the geofence warrant violated the Fourth Amendment.Justice KaganWrote the five-justice majority opinion in Chatrie v. United States.Justice SotomayorJoined Justice Jackson's view that the geofence warrant violated the Fourth Amendment.Justice ThomasJoined substantial parts of Justice Alito's dissent.
Vendors
Products
Countries
FranceNetherlands🇳🇱 Netherlands Advances NIS2 Implementation Through Cybersecurity ActSweden🇸🇪 Sweden’s IMY Warns That U.S. Supreme Court Ruling May Affect EU–U.S.United StatesSupreme Court judgment in Trump v. Slaughter could affect future transfers of personal data to the United States under the EU–U.S. Data Privacy Framework (DPF). In a statement published on 3 July 2026, IMY confirmed