.png)
EU
GDPR
The EDPB's 122nd plenary (7 July) adopted draft guidelines on anonymisation and on web scraping for generative AI, both open for consultation until 30 October. Final blockchain guidelines were also adopted.
AI Act
The Commission published final Article 50 transparency guidelines (20 July) covering chatbots, deepfakes, emotion recognition, and AI-generated content labelling, ahead of the 2 August application date. On 31 July, it confirmed that enforcement starts 2 August, with the full market surveillance chapter (Chapter IX) becoming enforceable. The Code of Practice on AI-generated content transparency was deemed adequate, with roughly 180-plus signatories by the 27 July deadline.
DORA
The ESRB published a systemic cyber-risk warning (7 July), upgrading frontier AI threats from "elevated" to "severe." The ECB instructed its roughly 110 directly supervised banks to deliver comprehensive action plans by 31 October 2026.
DSA
The Commission fined AliExpress €550 million (20 July), the largest DSA fine to date, for failing to tackle illegal and counterfeit products, with a remediation plan due 20 October. Four days later (24 July), the Commission issued preliminary findings against TikTok over minors' default-public account settings, with a potential fine of up to 6% of ByteDance's global turnover.
DMA
The Commission issued the first-ever DMA fines: Google was hit with €890 million in total (23 July), €460 million for self-preferencing in Search and €430 million for Play Store anti-steering, with 60 days to comply or face periodic penalties of up to 5% of worldwide turnover. The Commission also issued guidance to Google on AI interoperability on Android (16 July).
Sweden
GDPR
The CJEU ruled in the Lexbase case (C-199/24, 9 July) that selling criminal judgments online for payment does not qualify as "journalistic purposes," meaning Sweden's utgivningsbevis system cannot function as a blanket GDPR carve-out. Data subjects must be afforded real remedies, including a DPA complaint, judicial review, and damages. This is significant for IMY's four pending investigations into search services such as MrKoll.
