Regulators Advance AI, Privacy and Post-Quantum Security Measures

Summary

A March 2026 roundup covers EU AI and data-protection proposals, national guidance on healthcare AI and automated hiring, Finland’s post-quantum transition, Canada’s lawful-access bill, and NIST’s AI-monitoring report.

Key points

• The EU Council adopted its negotiating position on AI Act changes, including proposed high-risk AI application dates of 2 December 2027 and 2 August 2028; trilogue negotiations are next.
• The EDPB and EDPS called for clearer limits and safeguards for processing clinical-trial data under the proposed European Biotech Act.
• French regulators opened consultation on guidance for AI used in clinical care; the Dutch DPA advised that automated recruitment decisions require meaningful human review and safeguards.
• Finland’s cryptographic product evaluations require quantum-resistant design features from 2026; EU-aligned 2030 and 2035 migration milestones are planning targets, not binding obligations.
• Canada’s Bill C-22 proposes new lawful-access powers and technical capability requirements for certain electronic service providers, with privacy and cybersecurity impacts among factors for regulators to consider.
• NIST’s AI 800-4 report identifies monitoring challenges including model drift, fragmented logging, limited human-AI feedback tools, and shortages of AI governance professionals.
• New York’s Assembly Bill A3411B, passed by both legislative chambers and awaiting the Governor’s consideration, would require notices that generative AI outputs may be inaccurate.

Countries

Industries