Privacy & Cybersecurity #94: EU Data Rules, AI Oversight and Security Guidance
Summary
This roundup covers EU data-sharing and cloud clauses, GDPR-related Advocate General opinions, AI oversight, CNIL session-replay recommendations, the UK NCSC’s cyber-threat review, and NIST cybersecurity guidance for self-employed businesses.
Key points
- The European Commission published voluntary model terms for data sharing and cloud contracts under the EU Data Act, including switching, security, and business-continuity provisions.
- Advocate General Szpunar proposed that dynamic IP addresses can be personal data when a recipient can reasonably identify the user; his opinion on compensation claims is not binding.
- In a separate non-binding opinion, Szpunar addressed copyright in AI training and chatbot responses, discussing text-and-data-mining limits and safeguards against reproducing protected works.
- Bavaria’s data protection authority plans 2027 guidance and inspections on AI agents, focusing on purpose limitation, transparency, access permissions, and human oversight; New York’s bar association also issued AI-use ethics guidance for lawyers.
- France’s CNIL recommended consent, data minimization, masking, and limited retention for session-replay tools, and clarified potential responsibilities of providers and website operators.
- The UK NCSC reported 1,831 cyber-attack reports for 2025–2026 and said four known access methods accounted for 88% of incidents affecting large organizations; it also warned of increasing AI-enabled threats.
- NIST’s CSWP 50 offers risk-based cybersecurity guidance for businesses without paid employees, including phishing-resistant MFA, software updates, tested backups, and incident-response planning.
Article Details
- Event Type
- Cybersecurity and data-protection guidance and regulatory developments, alongside a UK national cyber threat assessment
- Impact
- The NCSC reported 1,831 cyber-attack reports in 2025–2026, 337 requiring incident-management support, and 80 classified as nationally significant; it also notified approximately 8,500 organizations of suspected compromises. It identified exploitation of public-facing applications, phishing, misuse of legitimate accounts, and exploitation of external remote services as the origins of 88% of incidents affecting large organizations. The article also describes planned 2027 Bavarian supervisory inspections of AI agents and guidance from several authorities and organizations; many of the cited recommendations are non-binding, and the Advocate General’s Opinions are not binding on the CJEU.
MITRE ATT&CK
T1078 · Valid AccountsThe NCSC reported misuse of legitimate accounts as one of four initial access methods behind 88% of incidents affecting large organizations.T1133 · External Remote ServicesThe NCSC reported exploitation of external remote services as one of four initial access methods behind 88% of incidents affecting large organizations.T1190 · Exploit Public-Facing ApplicationThe NCSC reported exploitation of public-facing applications as one of four initial access methods behind 88% of incidents affecting large organizations.T1566 · PhishingThe NCSC reported phishing as one of four initial access methods behind 88% of incidents affecting large organizations.
People
Vendors
Products
Bardin Hungary, where Like Company, an operator of advertising-funded news websites, alleged that Google’s Bard and Gemini chatbots had used its articles without authorization. The company argued that its publicationsGeminiwhere Like Company, an operator of advertising-funded news websites, alleged that Google’s Bard and Gemini chatbots had used its articles without authorization. The company argued that its publications had beenGoogle FontsThe case arose in Germany, where a website operator used Google Fonts in its default dynamic configuration. This caused visitors’ IP addresses to be automatically transmitted to Google’s servers in the United States.
Countries
ChinaThe report identifies China as the UK’s most sophisticated and sustained adversarial cyber challenge, while describing Russia as its most audacious current cyber threat. It also highlights the growing economicRussiaChina as the UK’s most sophisticated and sustained adversarial cyber challenge, while describing Russia as its most audacious current cyber threat. It also highlights the growing economic consequences of cyber
Industries
Cloud Computingnon-binding model contractual terms for data access and use and standard contractual clauses for cloud computing contracts. Developed under Article 41 of the EU Data Act (Regulation (EU) 2023/2854), the models areCritical infrastructurethat AI-powered malware is highly likely to be used in a ransomware attack against UK critical national infrastructure by that time.