The Algorithm Suspended the Driver. The Regulator Called It an €825 Million GDPR Violation.
A €824.99 million Dutch GDPR fine against Uber turns meaningful human review from an AI-governance slogan into an operational control.
Legislation
Alabama Subpoenaed OpenAI. An AI Sandbox Escape Is Now a Consumer-Protection Case.
Alabama has subpoenaed OpenAI over the Hugging Face agent incident, testing whether an AI containment failure can become a consumer-protection case.
An EU Data Order Can Now Cross Borders Directly. The Provider May Have Eight Hours.
The EU e-Evidence Regulation makes cross-border data orders an eight-hour operational challenge for service providers, not merely a legal process.
China’s New Data Security Rule Starts Today. A Risk Assessment Is No Longer Just an Internal Document.
China’s new rules for network-data security risk assessments took effect on 20 August 2026. For organisations that process data in China, the important change is not simply another assessment obligation. The result may now have to leave the security team,…
America Is Hiring Private Cyber Firms to Hack Back! (Under Government Control)
A new White House programme will let vetted U.S. security companies conduct surveillance and disruptive operations against foreign cybercrime groups under federal direction. It is a significant expansion of private-sector offensive capability, but the memorandum’s legal guardrails leave difficult questions about attribution, accountability and escalation.
The CRA Reporting Clock Starts on 11 September 2026
CRA Article 14 reporting is now operational. ENISA's portal has no API, and its 72-hour display can run early, so manufacturers must calculate legal deadlines independently from the awareness timestamp.
The High-Risk AI Deadline Moved. Article 50 Did Not.
The European Union delayed major requirements for high-risk AI systems. It did not delay the transparency rules that already determine whether a chatbot must identify itself, whether synthetic output needs a machine-readable mark, and whether deepfakes or certain public-interest text…
The Exploit Was Unpatchable. A Court Order Took the Original Research Offline.
The usbliter8 exploit exposed an immutable Apple SecureROM flaw. A court order removed the original research, but it could not remove the vulnerability or copies already distributed.
The Gambia Assented to a Modern Privacy Law. The Next Step Is Operational.
The Gambia has assented to a modern privacy framework covering extraterritorial processing, data rights, security, breaches and transfers.
Kenya Expanded Its Cybercrime Law. The Courts Have Already Drawn a Boundary.
Kenya expanded its cybercrime law in 2025, then saw the High Court invalidate administrative website blocking and a vague speech offence in 2026.