EU AI Omnibus in force: high-risk obligations deferred
27 Jul 2026
Amendments to the EU AI Act defer high-risk obligations and soften the AI literacy duty.
Changes to laws and regulations affecting information security, privacy, AI and resilience.
Amendments to the EU AI Act defer high-risk obligations and soften the AI literacy duty.
Section 250 of the Crime and Policing Act 2026 extends corporate criminal liability to any offence committed by a senior manager.
The Bill expanding the UK NIS regime has completed its Commons stages and moves to the House of Lords.
Canada’s Critical Cyber Systems Protection Act creates mandatory cyber security programmes and incident reporting for federally regulated critical sectors.
Hong Kong authorised institutions must now be operationally resilient, meeting the HKMA’s OR-2 requirements.
Covered platforms must now remove reported non-consensual intimate imagery, including AI deepfakes, within 48 hours of a valid request.
The Government will legislate for a statutory defence for legitimate security research under the Computer Misuse Act 1990.
New Zealand’s new IPP3A requires notification when personal information is collected indirectly from third parties.
Online services directed at US children under 13 must now comply with the amended COPPA Rule, including written security programmes and retention policies.
US rules on substance use disorder treatment records now align more closely with HIPAA, adding breach notification and civil penalties.
The main UK GDPR, DPA 2018 and PECR changes made by the Data (Use and Access) Act 2025 take effect today.
New CCPA regulations on cybersecurity audits, risk assessments and automated decision-making technology come into force in California.