Europe Updates AI, NIS2 and Privacy Rules as New Cybersecurity Guidance Emerges
Summary
A roundup of new AI and privacy rules, NIS2 security measures, AI deployment guidance, and updated security-planning recommendations, alongside developments affecting EU–U.S. data transfers.
Key points
- The EU approved amendments to the AI Act, delaying some high-risk AI requirements and adding prohibitions related to non-consensual intimate material and AI-generated child sexual abuse material.
- The NIS Cooperation Group published a reference document mapping NIS2 security objectives to standards including ISO 27001, NIST CSF 2.0, and IEC 62443; national requirements still apply.
- Ireland’s NCSC issued an AI risk assessment and lifecycle security guidelines, highlighting prompt injection, supply-chain compromise, excessive agency, and risks from agents with elevated access.
- NIST updated its system-planning guidance to connect security, privacy, and cybersecurity supply-chain risk plans, including attention to cloud services, dependencies, and supplier risks.
- European data-protection authorities published guidance on privacy risks in video games, including telemetry, profiling, children’s data, and retention.
- The EDPB updated its digest on GDPR erasure and objection cases, emphasizing workable request-handling processes and proportionate identity checks.
- A U.S. Supreme Court ruling on FTC commissioner removals prompted new concerns about the FTC’s role in the EU–U.S. Data Privacy Framework.
Article Details
- Event Type
- Publication of cybersecurity risk-management guidance and regulatory updates, including NIS2 security measures, AI deployment guidance, and revised system-planning guidance.
- Impact
- The publications give organizations guidance for assessing and managing cybersecurity risks across governance, AI lifecycles, supply chains, and system planning. They clarify expected controls but do not replace applicable national laws or sector-specific requirements.