On August 12, 2026, the Administration published a National Security Presidential Memorandum (“NSPM”) (“Expanding Capabilities to Combat Transnational Cyber-Enabled Crime”) that signals the Administration’s focus on private-sector participation in offensive cyber operations by establishing a federally supervised program to enable private sector participants to conduct offensive cyber operations against “Cyber-Enabled Transnational Criminal Organizations” (“CE-TCOs”).  

The NSPM follows Executive Order 14390, which, together with the U.S. National Cybersecurity Strategy, demonstrated the U.S. government’s continued focus on disrupting foreign cyber-enabled criminal organizations that engage in fraud, scams, and related cyber-enabled schemes.  The NSPM, which states that “it is the policy of the United States to use all instruments of national power, including the innovative capabilities of the private sector, to combat cybercrime,” signals a potential shift in the U.S. government’s approach to offensive cyber operations by non-government actors.  At the same time, the NSPM makes clear that any such operations would be conducted only after U.S. government vetting and authorization, under federal coordination and oversight, and consistent with U.S. law.   This post summarizes the NSPM and identifies practical takeaways for private-sector entities that may be considering whether to participate in the program.  Additional implementation guidance is expected by mid-October 2026 (60 days after the NSPM publication).

Continue Reading White House Releases National Security Presidential Memorandum on Expanding Capabilities to Combat Transnational Cyber-Enabled Crime

In an August 2026 Unified Agenda entry, the Department of Justice (“DOJ”) stated that it intends to complete its long-running effort to revise the regulations implementing the Foreign Agents Registration Act (“FARA”). The National Security Division (“NSD”) stated that it is considering a final rule that would adopt “many…

Continue Reading DOJ Signals it will Move Forward with Significant Revisions to FARA Regulations

On August 14, 2026, the French Constitutional Council (the “Constitutional Council”) struck down Article 1 of France’s Act to protect minors from the risks posed by the use of social media (the “Act”), which would have barred minors under the age of fifteen from accessing online social media services. The Constitutional Council held that the prohibition infringed on the freedom of expression and communication in a manner that was not appropriate, necessary, or proportionate to the objective pursued and, separately, that the legislature failed to provide the legal safeguards required to protect the right to respect for private life in connection with the age verification process that the ban would, by necessity, have entailed.

We summarise key aspects of the decision below.

Continue Reading French Constitutional Council Strikes Down Under-15 Social Media Ban

On July 20, 2026, the French data protection authority (the Commission Nationale de l’Informatique et des Libertés, “CNIL”) published a joint exploratory note with the French AI and Digital Council (“CIANum”) on the data protection implications of agentic AI (the “Note”). The Note is exploratory rather than prescriptive: it does not purport to state definitive regulatory expectations, and it does not announce forthcoming guidance. However, it does provide helpful considerations for when the EU’s General Data Protection Regulation (“GDPR”) might come under strain in the course of processing personal data via autonomous systems, and identifies legal and technical measures that might help mitigate potential risks. The CNIL frames this exercise as connected to its engagement with several international counterparts, including through the G7 data protection authorities during the French G7 presidency.

The Note is the latest in a rapidly accumulating body of regulator commentary on agentic AI, including by the UK ICO, Spanish AEPD, and Singaporean IMDA. Below are some key takeaways.

Continue Reading French CNIL Publishes Note on Agentic AI and Data Protection

In a moment when Democratic Members of Congress are preparing for sweeping inquiries of the administration should they win control of the House or Senate in the upcoming midterm elections, the practical implications of OLC’s analysis for future oversight disputes appear to be very significant.  Most immediately, the opinion opens another front in the long-running institutional struggle between the political branches over congressional access to executive branch information, with Democratic congressional leaders already signaling their intention to forcefully contest any forthcoming privilege claims.  At the same time, however, the opinion seems likely to extend those disputes to communications between the administration and companies, individuals, and entities outside the government that may themselves become subjects of congressional scrutiny. 

Continue Reading OLC Opinion Would Extend Executive Privilege to Include Private Advisers, Inviting Future Disputes with Congress and New Considerations for Private Parties

I. Introduction

On 3 August 2026, the President of the EU General Court issued an order addressing the scope of legal privilege under EU law. The order dismissed Broadcom’s application to suspend a decision by the European Commission requiring the production of documents in its investigation into Broadcom’s allegedly abusive software licensing practices.

The purpose of Broadcom’s application for interim measures was to enable it to withhold certain documents until the EU General Court rules on the main appeal against the decision.  In the main appeal, Broadcom had argued that the Commission’s decision was unlawful in so far as it compelled the production of documents that were privileged under the laws of third countries, such as the United States.

Although issued in interim proceedings and on well-established points of law, the order provides welcome guidance on the right balance between the European Commission’s investigative powers and the parties’ rights of defence. The President of the EU General Court highlights with unprecedented clarity the fundamental importance of legal privilege as a core part of procedural fairness in EU competition investigations.

That reasoning, and the further discussion on the European Commission’s practice in relation to legal advice from non-EU external lawyers, should help companies navigate the complexities of maintaining privilege over legal advice they receive, especially in global competition investigations.

Continue Reading In or out?  Navigating Legal Privilege in EU Competition Investigations post-Broadcom

The Illinois Governor recently signed SB 2886, which expands the scope of the state’s Genetic Information Privacy Act (“GIPA”) to include “biomarker testing” and “biomarker.” GIPA currently regulates the collection, use, and disclosure of genetic testing information.

The bill defines “biomarker” as “a characteristic that is objectively measured and…

Continue Reading Illinois Expands Genetic Privacy Law to Biomarkers

Introduction

On August 5, 2026, NHV Group announced that its proposed acquisition by GD Helicopter Finance (“GDHF”), ultimately controlled by China-based GDAT Group, would not proceed after Belgian authorities blocked the transaction under Belgium’s foreign direct investment screening regime, following a review coordinated by the Interfederal Screening Committee (“ISC”). This marks the first public prohibition under Belgium’s foreign direct investment screening mechanism, which has been operational since July 1, 2023. The Committee did not publish detailed reasons for the decision.

While noteworthy, this should not be misread as a shift toward protectionism. Belgium’s FDI statistics show the regime has been overwhelmingly supportive of transactions. The NHV/GDHF case illustrates the regime’s core security function: transactions where critical infrastructure intersects with a geopolitically sensitive investor profile are at the heart of the ISC’s mandate. At the same time, the case sharpens existing criticisms of the regime’s opacity and complexity—criticisms that Belgian authorities are now actively addressing through a public consultation and upcoming EU-level harmonization.

Continue Reading First Prohibition Under Belgium’s FDI Regime: A Milestone, Not a Revolution

On 29 July 2026, the UK’s Medicines and Healthcare products Regulatory Agency (“MHRA”) (the regulatory authority with responsibility for enforcing UK medical device rules) published new guidance on ambient voice technology-enabled products (“AVTs,” also known as ambient scribing tools) (“AVT Guidance”).  The AVT Guidance is intended to clarify (and essentially overrule) a decision by NHS England that AVTs that summarize interactions between patients and healthcare professionals (“HCPs”) are medical devices. 

AVTs are “AI-powered tools that automatically capture and convert spoken words into text and/or other outputs.”  In a healthcare setting, such products can be used to transcribe consultations between patients and HCPs, and produce outputs including summaries of such interactions or other clinical correspondence arising from the consultation (e.g., referral letters). 

In April 2025, NHS England issued guidance suggesting that ambient scribing products in healthcare settings that use generative AI for further processing, such as summarizing the transcribed content, would be treated as high functionality and would therefore likely qualify as a medical device.  This was followed by a “priority notification” from NHS England’s Chief Clinical Information Officer that stated that any ambient scribing software that performs summarization in the healthcare setting must be regulated as at least a Class I medical device. 

In the AVT Guidance (which applies to AVTs placed on the market/put into service in Great Britain), the MHRA clarifies that summarization alone is not sufficient to trigger medical device requirements, and confirms that AVTs must have a “medical purpose” to fall within the definition of a medical device.

Continue Reading New UK Guidance Clarifies Medical Device Status of AI Scribes

Executive Summary

Last week, the Forced Labor Enforcement Task Force (“FLETF”) added 43 entities to the Uyghur Forced Labor Prevention Act (“UFLPA”) Entity List and made technical name updates to two existing entities.[1] This is the first update to the Entity List since President Trump took office and is the…

Continue Reading DHS Expands UFLPA Entity List Amid Intensifying Enforcement Landscape