The Digital Download | Alston & Bird's Privacy & Data Security Newsletter | August 2025

The European Parliament and Council have formally adopted amendments to the EU Artificial Intelligence Act as part of the Digital Omnibus package, introducing extended compliance deadlines for high-risk AI systems, a targeted prohibition on AI-generated non-consensual intimate imagery, and measures to reduce regulatory duplication for businesses operating in the EU.

The EU Cyber Resilience Act's incident reporting obligations take effect on September 11, 2026, requiring manufacturers of connected devices and software to report certain vulnerabilities and cybersecurity incidents. This marks a critical milestone in EU cybersecurity regulation, introducing new compliance requirements for companies that may already face reporting obligations under other digital regulations.

The European Commission has designated ChatGPT as a Very Large Online Search Engine under the Digital Services Act, marking the first time a generative AI assistant has been classified this way. This designation, alongside Reddit and Roblox being named as Very Large Online Platforms, introduces systemic risk assessment obligations, independent audits, and advertising transparency requirements that most AI products have not previously faced. What does this mean for other AI assistants with web-search capabil

Many AI tools deployed for HR purposes are likely to be classified as "high risk" under the AI Act, triggering strict obligations for employers, including mandatory human oversight...

The European Union has reached a provisional political agreement on amendments to the AI Act, introducing targeted changes aimed at reducing administrative burden while maintaining the regulatory framework's core architecture. The agreement extends compliance timelines for high-risk AI systems, strengthens governance through enhanced EU AI Office powers, and introduces new prohibited practices related to AI-generated content.

A significant milestone for cybersecurity in Belgium was reached when the Parliament ratified the transposition of the EU NIS2 Directive on 18 April 2024.

Following the adoption of the "Regulation laying down harmonised rules on Artificial Intelligence" (AI Act) by the European Parliament and the Council of the European Union...

A significant milestone for cybersecurity has been reached with the adoption of the European NIS2 directive. Its Belgian transposition law will take effect in exactly one month (18 October 2024).

The European Commission has issued comprehensive interpretive guidelines on high-risk AI system classification under Articles 6(1) and 6(2) of the EU AI Act, while simultaneously postponing key compliance deadlines through the AI Omnibus package.

The EU AI Act introduces a comprehensive AI literacy obligation requiring organizations to ensure their staff possess adequate skills and knowledge for informed AI system use.

The California Privacy Protection Agency has voted to advance formal rulemaking on opt-out preference signals and new audit requirements for data brokers...

The National Association of Insurance Commissioners intensified its regulatory focus on artificial intelligence governance, third-party data models, and cybersecurity oversight at its Summer 2026 meeting. Regulators are shifting from principles-based guidance to examination-ready supervisory tools, emphasizing that insurers remain accountable for the technologies and vendors they deploy. The meeting revealed how AI risk evaluation, vendor oversight frameworks, and privacy modernization efforts are convergin

Explore the latest developments in AI regulation, cybersecurity threats, and compliance frameworks as businesses navigate personalized pricing scrutiny, prompt injection attacks, and evolving transparency obligations. Discover how government initiatives and international intelligence agencies are responding to AI-driven vulnerabilities while organizations implement practical governance strategies across legal, privacy, and operational domains.

In 2024, the Federal Trade Commission (FTC) has continued its public data privacy and security enforcement actions. Many of these actions have addressed alleged violations relating to health, location, and biometric data...

On May 9, 2025, the Texas Attorney General Ken Paxton announced a $1.375 billion settlement with Google—by far the largest state-level privacy settlement reached against Google to date.

The EU Cyber Resilience Act's incident reporting obligations take effect on September 11, 2026, requiring manufacturers of connected devices and software to report certain vulnerabilities and cybersecurity incidents. This marks a critical milestone in EU cybersecurity regulation, introducing new compliance requirements for companies that may already face reporting obligations under other digital regulations.

Alston & Bird's quarterly Digital Download examines the rapidly evolving intersection of privacy, cybersecurity, and data strategy, highlighting how AI-driven threats are reshaping breach costs, regulatory frameworks, and organizational defense strategies. From IBM's 2026 breach report showing record-high costs to new government initiatives like the White House's Gold Eagle clearinghouse, the landscape demands heightened vigilance and sophisticated governance approaches.

Artificial intelligence agents are gaining unprecedented autonomy and cyber capabilities, transforming theoretical risks into tangible legal liabilities. As AI systems independently exploit vulnerabilities and access unauthorized systems, organizations face complex questions about criminal and civil exposure under existing computer fraud laws. Understanding how autonomous agents can go rogue—and what legal frameworks apply when they do—has become essential for any company deploying these powerfu

On May 1, 2025, the U.S. Department of Justice (DOJ) announced a settlement under the False Claims Act (FCA) involving defense contractors Raytheon Company (Raytheon)...

The recent indictment of 14 North Korean nationals for fraudulently obtaining remote IT jobs with U.S.-based companies underscores the importance of vigilant hiring practices.