The EU’s New Data-Centre Labels Won’t Tell You the Whole Energy Story
The EU plans public energy and water grades for individual data centres from 2027. The labels should aid comparisons, but will not show each site’s exact annual electricity total.
Legislation
Australia’s Critical-Infrastructure Regulator Wants More Than a Signed Risk Report
Australia's 2025-26 critical-infrastructure risk report is due on 28 September. The regulator says its next compliance cycle will look harder at serious or persistent gaps behind the board's statement.
When Election Certification Gets in the Way of a Security Patch
Election software can need an urgent security fix while certification rules make vendors and operators afraid to apply it.
Europe Just Started the 24-Hour Cyber Reporting Clock for Digital Products
ENISA's CRA Single Reporting Platform is now live, and the first 24-hour reporting clock is running. Manufacturers need more than a portal login to meet it.
America Declared a Power-Grid Emergency Over Hardware It Does Not Trust
A US national-emergency order treats power-grid security as a hardware, firmware, maintenance and remote-access supply-chain problem.
Alabama Is Testing Whether an AI Sandbox Failure Was Also a Consumer-Protection Failure.
Alabama has subpoenaed OpenAI over the Hugging Face agent intrusion, testing whether weak AI evaluation controls can also violate consumer-protection law.
The Algorithm Suspended the Driver. The Regulator Called It an €825 Million GDPR Violation.
A €824.99 million Dutch GDPR fine against Uber turns meaningful human review from an AI-governance slogan into an operational control.
Alabama Subpoenaed OpenAI. An AI Sandbox Escape Is Now a Consumer-Protection Case.
Alabama has subpoenaed OpenAI over the Hugging Face agent incident, testing whether an AI containment failure can become a consumer-protection case.
An EU Data Order Can Now Cross Borders Directly. The Provider May Have Eight Hours.
The EU e-Evidence Regulation makes cross-border data orders an eight-hour operational challenge for service providers, not merely a legal process.
China’s New Data Security Rule Starts Today. A Risk Assessment Is No Longer Just an Internal Document.
China’s new rules for network-data security risk assessments took effect on 20 August 2026. For organisations that process data in China, the important change is not simply another assessment obligation. The result may now have to leave the security team,…