EU Geopolitical Risk Update - Key Policy & Regulatory Developments No. 126

The European Parliament and Council have formally adopted amendments to the EU Artificial Intelligence Act as part of the Digital Omnibus package, introducing extended compliance deadlines for high-risk AI systems, a targeted prohibition on AI-generated non-consensual intimate imagery, and measures to reduce regulatory duplication for businesses operating in the EU.

The EU Cyber Resilience Act's incident reporting obligations take effect on September 11, 2026, requiring manufacturers of connected devices and software to report certain vulnerabilities and cybersecurity incidents. This marks a critical milestone in EU cybersecurity regulation, introducing new compliance requirements for companies that may already face reporting obligations under other digital regulations.

The European Commission has designated ChatGPT as a Very Large Online Search Engine under the Digital Services Act, marking the first time a generative AI assistant has been classified this way. This designation, alongside Reddit and Roblox being named as Very Large Online Platforms, introduces systemic risk assessment obligations, independent audits, and advertising transparency requirements that most AI products have not previously faced. What does this mean for other AI assistants with web-search capabil

The European Union has reached a provisional political agreement on amendments to the AI Act, introducing targeted changes aimed at reducing administrative burden while maintaining the regulatory framework's core architecture. The agreement extends compliance timelines for high-risk AI systems, strengthens governance through enhanced EU AI Office powers, and introduces new prohibited practices related to AI-generated content.

Many AI tools deployed for HR purposes are likely to be classified as "high risk" under the AI Act, triggering strict obligations for employers, including mandatory human oversight...

A significant milestone for cybersecurity in Belgium was reached when the Parliament ratified the transposition of the EU NIS2 Directive on 18 April 2024.

Following the adoption of the "Regulation laying down harmonised rules on Artificial Intelligence" (AI Act) by the European Parliament and the Council of the European Union...

A significant milestone for cybersecurity has been reached with the adoption of the European NIS2 directive. Its Belgian transposition law will take effect in exactly one month (18 October 2024).

The European Commission has issued comprehensive interpretive guidelines on high-risk AI system classification under Articles 6(1) and 6(2) of the EU AI Act, while simultaneously postponing key compliance deadlines through the AI Omnibus package.

The EU AI Act introduces a comprehensive AI literacy obligation requiring organizations to ensure their staff possess adequate skills and knowledge for informed AI system use.

The Code is voluntary, but it will likely become an important reference point for demonstrating compliance with Article 50 of the AI Act.

The Ninth Circuit Court of Appeals vacated a preliminary injunction against Perplexity AI, determining that when an AI agent acts at a user's direction, it is the user—not the AI company—who "accesses" computer systems under federal and California computer fraud statutes. This landmark appellate decision addresses how existing computer-access laws apply to agentic artificial intelligence and has significant implications...

The New York Stock Exchange and Nasdaq are implementing overnight trading sessions starting December 6, 2026, extending the trading day to nearly 23 hours by compressing the daily pause to just one hour. While this evolution toward continuous trading introduces new considerations for corporate actions, disclosure timing, and deal execution, the practical impact varies significantly between NYSE-listed companies,

China's Supreme People's Court has issued comprehensive judicial rules addressing artificial intelligence disputes, establishing frameworks for product liability, intellectual property rights, and data protection. These landmark opinions provide critical guidance for global companies navigating AI-related legal risks in China's evolving regulatory landscape.

The European Commission has initiated infringement procedures against 20 EU Member States for failing to transpose the EmpCo Directive by the March 27, 2026 deadline. This directive aims to combat greenwashing by requiring substantiation of environmental claims and third-party certification for sustainability labels, with full implementation expected by September 27, 2026.

Mexico's comprehensive anti-money laundering framework has undergone a sweeping transformation through Acuerdo 115/2026, introducing mandatory risk-based methodologies, enhanced client due diligence protocols, and automated monitoring requirements. With implementation deadlines beginning March 1, 2027, obligated parties conducting vulnerable activities face compressed timelines to overhaul their compliance infrastructure while navigating heightened enforcement risks and stricter beneficial ownership thresho

The European Commission has proposed replacing the EU's three core procurement directives with a single, directly applicable Regulation that would fundamentally reshape how companies compete for public contracts across Member States. The reform introduces mandatory quality criteria thresholds, embeds ESG considerations as evaluation factors, and establishes new security and European-preference provisions that could restrict participation based on ownership, supply chain exposure, and strategic dependencies.

A federal court has struck down New York's Climate Change Superfund Act, which sought to recover $75 billion from fossil fuel companies based on historical emissions. The ruling found the Act preempted by the Clean Air Act, marking the first judicial decision on state climate superfund legislation and establishing that EPA's rescission of the endangerment finding does not alter preemption analysis.

The Ninth Circuit has ruled that health plan participants whose confidential information was disclosed without authorization have standing to sue in federal court, even without showing financial loss or future harm. This decision, which departs from the risk-based approach many courts have applied since TransUnion, relies on the centuries-old action for breach of confidence and could have significant implications for companies' privacy commitments and data-sharing practices.

The European Commission has adopted final Guidelines on exclusionary abuses of dominance under Article 102 TFEU, introducing a "workable effects approach" that narrows presumptions while expanding guidance on objective justifications and recognizing sustainability benefits as valid efficiencies for the first time. These Guidelines replace the 2008 Enforcement Priorities Guidance and are expected to significantly impact enforcement practices across EU Member States and beyond, particularly for digital market