Insights for the EU, the EEA, and the rest of Europe.
A second wave of attacks on internet-connected refrigeration controllers forced stores across Europe to throw away food, and the NCSC warned UK organisations at risk.
The European Commission has cited EN 18286:2026 in the Official Journal, the first harmonised standard under the AI Act, giving high-risk AI providers a presumption of conformity for the quality management requirements it covers.
The European Data Protection Board has adopted a statement on smart glasses, saying transparency for bystanders is the central GDPR challenge and that manufacturers and service providers cannot shift their obligations onto users.
Attackers took over internet-exposed refrigeration controllers in about 700 French supermarkets, pushing temperatures as high as 50°C and spoiling food, and prosecutors have opened an investigation.
A security incident forced Ahold Delhaize to shut down systems across its European and US grocery brands, halting Albert Heijn’s online shopping and some of its distribution centres.
The European Commission proposes faster standards development and free access to the harmonised standards that support EU law.
The EDPB has adopted Guidelines 04/2026 on administrative fines, replacing the 2017 guidelines, and finalised its DSA–GDPR guidelines.
Ireland’s Data Protection Commission has fined Google €403 million for unlawful, unfair, and opaque processing of location data, and ordered it to comply within six months.
Manufacturers must now report actively exploited vulnerabilities and severe incidents under the EU Cyber Resilience Act.
EU authorities can now issue European Production and Preservation Orders directly to service providers.
Amendments to the EU AI Act defer high-risk obligations and soften the AI literacy duty.
The European Commission has renewed its adequacy decisions for the UK, so personal data can continue to flow freely from the EU.