23 September 2026
OpenAI model breaches Australian government websites
politico.com Australia's PM said an OpenAI agent breached a Medicare data portal in June and accessed non-public files; OpenAI waited until September to disclose it.
Italy's AI framework: Operationalizing the EU AI Act
iapp.org Italy's Legislative Decree 160/2026, in force from 30 September, sets criminal sanctions and civil liability rules for AI use by police, including facial recognition.
European Commission publishes new guidelines on the Cyber Resilience Act
osborneclarke.com The European Commission adopted 80-page Cyber Resilience Act guidelines clarifying scope for cloud software and open-source, plus a 5-year minimum vulnerability-support period.
22 September 2026
When the algorithm manages the workforce: Sweden's proposed platform work act
eversheds-sutherland.com A Swedish government inquiry proposed a Platform Work Act transposing the EU directive, giving gig workers a right to explanation and human review of algorithmic decisions.
The Spanish DPA fined Securitas Direct 100 000 EUR for making the exercise of data subject rights more difficult
edpb.europa.eu The Spanish DPA fined Securitas Direct €100,000 for steering data subjects to a chargeable phone number when they tried to exercise their GDPR rights.
Sanktionsavgift mot Miljödata för bristande säkerhet
imy.se Sweden's IMY fined IT vendor Miljödata SEK 1.8m under GDPR Article 32 after a 2025 breach exposed sensitive data of 2.2 million people via unmonitored systems. [discussion on reddit]
El juez sienta en el banquillo a Oscar Pierre, cofundador de Glovo, por mantener a falsos autónomos
elpais.com A Barcelona court ordered Glovo co-founder Oscar Pierre to stand trial for keeping riders as false self-employed, a crime carrying up to six years in prison.
ECB flags AML gap for stablecoin issuers lacking financial licence
amlintelligence.com The ECB urged EU lawmakers to close a gap letting some stablecoin issuers avoid anti-money-laundering rules that bind other crypto firms.
Council wants privacy enhancing tech incentives in omnibus
euractiv.com EU Council ministers want the Digital Omnibus to add incentives for privacy-enhancing tech and want the Commission to assess industry use of it, especially for cookies.
21 September 2026
WHAT TO FIX files DSA complaint over Meta's monetization enforcement and reporting systems
whattofix.tech WHAT TO FIX filed a DSA complaint with the Dutch ACM alleging Meta failed to enforce and process reports of possibly illegal monetization tied to EU-sanctioned actors.
Poor data sharing undermining EU cyber defences, auditors say
reuters.com The European Court of Auditors found EU states rarely share cyber-incident data, noting no 'large-scale' incident has been formally reported since 2016 despite qualifying attacks.
Irish data protection watchdog fines Google €403m over GDPR breaches
irishtimes.com The Irish DPC fined Google €403m for unlawfully processing location data via three account features and gave it six months to comply; Google may appeal. [discussion on hn]
Glovo, il giudice respinge la richiesta del pm sull'assunzione dei rider: "Deve decidere il Tribunale del lavoro"
ilfattoquotidiano.it A Milan judge rejected a bid to force Foodinho-Glovo to hire all 40,000 riders as employees, leaving classification to case-by-case labour-court review.
Europe Says Its AI Rules Are Enough. AI Agents Are Testing That Claim
techpolicy.press Brussels says the AI Act already covers agentic AI risks after Gemini and other models breached test systems, but experts say its market-based rules may not reach models still in testing.
EU lawmakers float product liability rules to help avert AI disaster
politico.eu Four MEPs urged the Commission to draft an AI Liability Act extending the AI Act to hold providers like OpenAI and Anthropic liable for harm from advanced models.
EDPB harmonises fining methodology and adopts final DSA-GDPR guidelines
edpb.europa.eu The EDPB adopted a five-step test for DPAs deciding whether to impose GDPR fines and finalised its guidelines on the DSA-GDPR interplay, with 14 worked examples.
Data Protection Commission fines Google €403 million following Inquiry into Google's processing of location data
dataprotection.ie Ireland's DPC fined Google €403 million for unlawful processing of location data in Web & App Activity and Location History, ordering compliance within six months.
AI: EU Member States plan “digital expropriation” of Europeans in the interest of AI companies
noyb.eu A leaked Irish Presidency text adds GDPR Article 88bis, making any personal data use “in the context of AI” lawful by default with no consent required.
20 September 2026
US employers use software to punish workers at sixteen times the European rate. The gap is the law.
thenextweb.com OECD survey of 6,047 firms found 67% of US employers use software to sanction workers vs 4% in Europe; most tools aren't AI and fall outside the AI Act's scope.
18 September 2026
Most EU countries late on pay transparency rules
euractiv.com Twenty-two member states have missed the Pay Transparency Directive deadline by over three months; six have published no legislative text at all.