EU, UK and US Advance New Privacy, Data Protection and AI Rules
Summary
The roundup covers new and proposed rules on GDPR breach notifications, AI content labeling, consumer IoT privacy, data intermediaries, health information, surveillance pricing and conversational AI, alongside an AI-model access suspension linked to a reported jailbreak
Key points
- The EDPB opened consultation on a common GDPR personal data breach notification template, with feedback due by 5 August 2026.
- The EU’s voluntary AI content-labeling code calls for machine-readable marking, detection tools, and privacy and security safeguards.
- The UK ICO finalized consumer IoT guidance covering consent, tracking technologies, sensitive data, and likely DPIA requirements.
- A UK government consultation identifies cyberattack, impersonation, and misuse risks as personal data intermediaries handle concentrated data and delegated authority.
- New York advanced proposals on surveillance pricing and health information, including restrictions on data processing and requirements for authorization, access, and deletion.
- Colorado enacted conversational AI requirements that include disclosures, minor-safety measures, self-harm response protocols, and annual reporting.
- Anthropic said a US export-control directive led it to suspend access to Fable 5 and Mythos 5 for all customers after the government cited a jailbreak.
Article Details
- Event Type
- A US government export-control directive required Anthropic to suspend access to its Fable 5 and Mythos 5 models for foreign nationals.
- Impact
- Anthropic said it would disable Fable 5 and Mythos 5 for all customers because of the directive's scope; access to its other models would remain unaffected. Anthropic said the directive cited national security authorities without detailed reasons and that its understanding was that the government had learned of a narrow, non-universal jailbreak used to identify a small number of previously known, minor software vulnerabilities.
People
Vendors
Products
Countries
FranceFrance’s data protection authority, the CNIL, published guidance on 10 June 2026 explaining how organizations should distinguish between commercial prospecting, transactional communications, and relationship-basedMalta🇲🇹 Malta MFSA Sets AI Governance Expectations for Financial Services FirmsUnited KingdomUnited Statesto its Fable 5 and Mythos 5 models by any foreign national, whether located inside or outside the United States, including Anthropic’s own foreign-national employees. Anthropic stated that, because of the scope of
Industries
Artificial intelligenceServices Authority issued a Dear CEO Letter setting out supervisory expectations for the use of artificial intelligence by MFSA-supervised license holders across Malta’s financial services sector. The letter appliesFinancial Services🇲🇹 Malta MFSA Sets AI Governance Expectations for Financial Services FirmsLegal services🇬🇧 UK Launches AI Growth Lab for LawTech and Legal Services