ETSI launches approval process for 17 harmonised standards supporting the Cyber Resilience Act.

China: CAC clarifies the use of publicly available personal information and measures to prevent data breaches.

Italian National Cybersecurity Agency (ACN): new FAQs published on monitoring, supervision and enforcement activities concerning NIS entities.

France: CNIL issues guidance on identifying and managing DPO conflicts of interest.

Council of Ministers approves measures on AI, cybersecurity and strategic digital infrastructure.

EU: first DORA assessment of major ICT-related incidents records 3,383 cases in 2025, with almost one third linked to third-party dependencies.

ENISA translates “secure by design” and “secure by default” principles into 22 practical playbooks for SMEs.

AI Act: transparency obligations come into force on 2 August. The European Commission has updated its FAQs on Article 50 of the AI Act, supplementing the final guidelines published on 20 July 2026.

Italian Data Protection Authority: corporate emails and defensive controls; Piaggio fined €460,000 for the systematic retention of employees’ emails.

Web scraping and collective redress: the Court of Milan admits the privacy class action against Meta.

Data Protection Authority; favourable opinion on the draft legislative decree aligning Italian legislation with the AI Act.

Data Protection Authority: favourable opinion on the draft legislative decree on facial recognition and AI in policing. Mass biometric data collection and databases created through web scraping are prohibited.

Regulation 2026/1744 (Digital Omnibus on AI) comes into force: more time for high-risk sys-tems, fewer burdens on businesses and new powers for the AI Office.

EU Commission: operational guidance for businesses on the Cyber Resilience Act published.

National Cybersecurity Agency: FAQs on security measures for the supply chains of NIS entities updated.

World Intellectual Property Organisation: in 2025, investment in intangible assets exceeded the $10,000 billion mark for the first time.

Bank of Italy and IVASS: by 31 December 2026, banks and insurance companies must submit a plan addressing the new cyber risks posed by AI.

EU Court of Justice: Google may be held liable for YouTube videos posted by a content creator bound by a commercial partnership.

EU designs: the new European regulatory framework is now fully applicable.

EU Commission: the European Code of Transparency has been endorsed as the main tool for complying with Article 50 of the AI Act from 2 August onwards.

National Cybersecurity Agency: FAQs on the roles and duties of the administrative bodies of NIS entities updated.

Court of Justice of the European Union: the online publication of the names of professional athletes who have breached anti-doping rules does not infringe Union law.

Supreme Court of Cassation: a blog operator is liable for defamatory content published by third parties that has not been removed.

Communications Regulatory Authority: report published on AGCOM’s activities as National Coordinator under the Digital Services Act (DSA) in 2025.

European Supervisory Authorities (ESAs): systemic cyber risk to the financial sector arising from so-called ‘cutting-edge’ AI models is significant.

Court of Justice of the EU: the mere online publication, for a fee, of criminal convictions does not constitute the processing of personal data for journalistic purposes.

EU Commission: new Action Plan on cybersecurity and advanced artificial intelligence presented.

Court of Justice of the EU: Apple’s appeal against its designation as a gatekeeper under the Digital Markets Act (EU Regulation 2022/1925 – DMA) for the Apple Store and iOS has been dismissed.

Court of Justice of the European Union: an administrative complaint to the Data Protection Authority and a judicial appeal on the same subject may proceed in parallel.

European Data Protection Board (EDPB): Guidelines 2/2026 on anonymisation approved. The EDPB introduces a new legal and technical test.