Global Cybersecurity and Privacy Updates Cover NIS2, Post-Quantum Deadlines and AI Risk
Summary
A June 2026 roundup covers GDPR evidence rules, Portugal’s NIS2 regime, post-quantum migration deadlines, agency guidance on AI-driven cyber risks, and other privacy and AI regulatory developments.
Key points
- The CJEU ruled that GDPR does not automatically bar courts from using personal data that may have been unlawfully obtained, while the original collection may still create separate liability.
- Portugal’s NIS2 implementing regulation sets cybersecurity requirements for covered entities, including incident reporting, minimum controls, and inventories of publicly accessible assets.
- U.S. Executive Order 14412 sets federal post-quantum migration deadlines: key establishment by the end of 2030 and digital signatures by the end of 2031 for specified systems.
- Spain’s CCN-CERT urged organizations to speed up foundational defenses against AI-accelerated attacks, including patching, access controls, monitoring, and IT/OT segmentation.
- Five Eyes cyber agencies warned that AI is accelerating cyber risks and urged executives to improve readiness, reduce attack surfaces, and test incident response.
- Italy’s ACN updated cryptographic guidance with post-quantum solutions, including in its TLS guidance, and recommended replacing vulnerable classical signature schemes.
Article Details
- Event Type
- Multiple cybersecurity, AI governance, privacy, and post-quantum cryptography policy developments
- Impact
- The developments clarify how courts may use personal data in evidence, establish or advance national AI and cybersecurity regulatory frameworks, and increase pressure on organizations to strengthen cybersecurity controls. U.S. federal agencies face post-quantum cryptography migration deadlines, while governments and security agencies warn that AI is accelerating cyber risks and exploitation timelines.
People
Bernie SandersU.S. Senator named as a cosponsor of the Stop Spying Bosses Act.Brian SchatzU.S. Senator named as a cosponsor of the Stop Spying Bosses Act.Cory BookerU.S. Senator named as a cosponsor of the Stop Spying Bosses Act.Edward MarkeyU.S. Senator who introduced the Stop Spying Bosses Act.Elizabeth WarrenU.S. Senator named as a cosponsor of the Stop Spying Bosses Act.John FettermanU.S. Senator named as a cosponsor of the Stop Spying Bosses Act.Kathy HochulGovernor of New York who signed the synthetic performer advertising law in December 2025.Richard BlumenthalU.S. Senator named as a cosponsor of the Stop Spying Bosses Act.Tammy BaldwinU.S. Senator named as a cosponsor of the Stop Spying Bosses Act.
Countries
Australiarisk “in months, not years.” The statement was published on 22 June 2026 and signed by leaders from Australia, Canada, New Zealand, the United Kingdom, and the United States, including the Canadian Centre for CyberCanada“in months, not years.” The statement was published on 22 June 2026 and signed by leaders from Australia, Canada, New Zealand, the United Kingdom, and the United States, including the Canadian Centre for CyberGermanyIreland🇮🇪 Ireland Advances AI Act Implementation BillItaly🇮🇹 Italy’s ACN Updates Cryptographic Guidelines with Post-Quantum FocusNew Zealandnot years.” The statement was published on 22 June 2026 and signed by leaders from Australia, Canada, New Zealand, the United Kingdom, and the United States, including the Canadian Centre for Cyber Security,Portugal🇵🇹 Portugal Issues Implementing Regulation for NIS2 Cybersecurity RegimeSpain🇪🇸 Spain’s CCN-CERT Warns That Offensive AI Requires Faster, More Governed CybersecurityUnited Kingdomwas published on 22 June 2026 and signed by leaders from Australia, Canada, New Zealand, the United Kingdom, and the United States, including the Canadian Centre for Cyber Security, GCHQ/NCSC, NSA, and CISA.United States22 June 2026 and signed by leaders from Australia, Canada, New Zealand, the United Kingdom, and the United States, including the Canadian Centre for Cyber Security, GCHQ/NCSC, NSA, and CISA.
Industries
advertising🇺🇸 New York AI Advertising Law Requires Disclosure of Synthetic PerformersFinancial ServicesPublic SectorFor the public sector, CCN-CERT identifies a particular risk because public bodies manage sensitive information, operate essential services, rely on interconnected providers, and increasingly connect IT and OTTechnologyecosystem, but it is also relevant to private organizations that provide systems, services, or technology to public entities.