News and Insights

A US Supreme Court ruling on 29 June, about the president’s power to sack officials, has knocked away a pillar the EU-US data deal rests on: the independence of the FTC, the body meant to police it. The adequacy decision formally still holds and certified firms can keep relying on it, but Max Schrems is preparing a fresh challenge at the EU’s top court. The question for EU organisations is how much of their data architecture sits on a US framework whose legal foundation is now openly contested.

EU regulators have taken a preliminary view that AWS and Microsoft Azure should be designated gatekeepers under the Digital Markets Act, the first time the DMA reaches cloud infrastructure. If confirmed, the two face curbs on self-preferencing, new portability and interoperability duties and fines up to 10% of turnover. For EU-regulated firms this is leverage against cloud lock-in, deepened by AI on top. Worth watching: whether designation turns into real portability, or years of appeals.

EuroCommerce, the body behind Amazon, H&M, Inditex and Ikea, wants the Commission to spare non-misleading AI-generated adverts from the AI Act’s deepfake labelling duty that starts on 2 August. Its argument: an AI-rendered room around a real sofa is not a deep fake. For any EU-facing brand using generative AI in marketing, the safer read is that labelling applies by default and a carve-out is a lobbying ask, not law. Worth watching: how the Commission defines a deep fake in advertising.

Kansas City plans to scale facial recognition on its public buses, from a nine-bus pilot to as many as thirty, scanning riders against watch lists in real time. The project was paused over privacy and funding, then chosen for expansion. In the EU, real-time biometric identification in public spaces is largely off-limits under the AI Act. So the same deployment reads as routine in one market and high-risk or prohibited in another. The question worth watching: which way does the line move next?

On 16 June Parliament gave the AI Act omnibus its final green light, 423 votes to 57. The headline reads as relief: high-risk duties under Annex III slip to December 2027, embedded systems to August 2028. The same vote draws a fresh hard line, an EU-wide ban on AI that generates child sexual abuse material and non-consensual intimate imagery, due by December 2026. So the timeline loosens and tightens at once. For your organisation, the question is which of your own deadlines just moved.