The global biotechnology landscape is evolving at an unprecedented speed, driven by advances in synthetic biology and genome editing, which, coupled with AI, make biotechnology stand at the forefront of innovation. These developments offer unprecedented opportunities for advancing health and protecting against biological threats, but also make biotechnological misuse faster, cheaper, and more accessible. For that reason, the European Commission has proposed the introduction of a new Union-level framework on biodefence and the prevention of biotechnology misuse in the European Biotech Act (the “Biotech Act”).
Continue Reading The Proposed EU Biotech Act: New Biosecurity Rules for Artificial Intelligence and Biotechnology CompaniesEuropean Union
European Defense After the NATO Summit
Executive Summary
There were a few key takeaways from the 2026 NATO Summit in Ankara, where Covington was present:
- Industrial collaboration boost: Introduced a “Front Door for Industry” to streamline engagement and procurement processes.
- “Made in NATO”: Aims to foster industrial cooperation and ensure nondiscrimination across the Alliance. For non-EU firms, this will help balance the EU’s preference for “made in the EU” production.
- Strategic industry cooperation: Strategy emphasizing communication, innovation, and scaling defense production, recognizing industry as integral to security alongside armed forces.
- Division of roles: NATO focuses on command, control, and capability standards, and the EU to manage funding and regulatory frameworks – a complex but opportunity-rich environment.
French CNIL Publishes Note on Agentic AI and Data Protection
By Jadzia Pierce on
On July 20, 2026, the French data protection authority (the Commission Nationale de l’Informatique et des Libertés, “CNIL”) published a joint exploratory note with the French AI and Digital Council (“CIANum”) on the data protection implications of agentic AI (the “Note”). The Note is exploratory rather than prescriptive: it does not purport to state definitive regulatory expectations, and it does not announce forthcoming guidance. However, it does provide helpful considerations for when the EU’s General Data Protection Regulation (“GDPR”) might come under strain in the course of processing personal data via autonomous systems, and identifies legal and technical measures that might help mitigate potential risks. The CNIL frames this exercise as connected to its engagement with several international counterparts, including through the G7 data protection authorities during the French G7 presidency.
The Note is the latest in a rapidly accumulating body of regulator commentary on agentic AI, including by the UK ICO, Spanish AEPD, and Singaporean IMDA. Below are some key takeaways.
Continue Reading French CNIL Publishes Note on Agentic AI and Data ProtectionEDPB Publishes Draft Guidelines on Anonymisation
By Dan Cooper, Kristof Van Quathem & Alix Bertrand on
On July 7, 2026, the European Data Protection Board (“EDPB”) adopted draft Guidelines 02/2026 on Anonymisation (“Guidelines”), updating a 2014 Opinion on Anonymization Techniques. While the EDPB maintains a cautious approach to anonymization, the new Guidelines appear to offer a more structured and practical framework for assessing whether information can be considered anonymous. The Guidelines are open for public consultation until October 30, 2026.
Continue Reading EDPB Publishes Draft Guidelines on AnonymisationLooking beyond the tech sovereignty package: how the EU is moving to ensure tech sector resilience
By Paul Maynard, Jadzia Pierce & Sam Jungyun Choi on
On 3 June 2026, the European Commission published several legislative and policy measures wrapped up in one “tech sovereignty” package (see our posts summarising the package as a whole here, and diving deeper into the Cloud and AI Development Act here). But the EU’s tech sovereignty drive has a long history, and is by no means limited to this package.
In this post, we take a closer look at the current and forthcoming EU legislative measures aimed at increasing the resilience of services provided in the EU against external, malicious influence, a key aspect of tech sovereignty. Relevant legislation falls into two broad categories: (1) laws promoting cyber resilience generally, to prevent malicious actors from disrupting services and critical infrastructure; and (2) laws focused on building supply chain resilience and reducing dependencies on certain external actors by building European industrial capacity in key tech sectors.
Continue Reading Looking beyond the tech sovereignty package: how the EU is moving to ensure tech sector resilienceIrish NCSC Issues Cyber Governance Guidance for Management Boards Ahead of NIS2 Implementation
By Mark Young & David Brazil on
Posted in Cybersecurity, European Union
On July 7, 2026, the Irish National Cyber Security Centre (“NCSC”) published guidance for management boards and senior executives of organizations subject to the EU’s Network and Information Security Directive (“NIS2”). Reflecting a central theme of NIS2, the Guidance makes it clear that cybersecurity is no longer solely a technical issue, but a governance and risk-management matter that requires active oversight at “the highest levels of executive management.” It is a helpful document for organizations that are likely to be subject to NIS2, expect to be supervised in Ireland, and that are considering their governance structures and board-level oversight mechanisms.
Continue Reading Irish NCSC Issues Cyber Governance Guidance for Management Boards Ahead of NIS2 ImplementationAmadeus IT Group Receives GDPR Fine
By Joshua Gray, Nigel Howard & Will Capstick on
On May 26, 2026, the Spanish Data Protection Agency (“AEPD”) published details of its decision to fine Amadeus IT Group, S.A. (“Amadeus”), a Madrid-headquartered technology provider for the global travel and tourism industry, EUR 18 million in connection with GDPR violations involving Amadeus’s Global Distribution System (“GDS”). Amadeus voluntarily paid the fine, less a 20% reduction, on May 29, 2025, thereby terminating the proceedings without admitting liability. The fine, one of the largest the AEPD has imposed, highlights the enforcement risks associated with repurposing personal data such as passenger data without appropriate transparency or a valid legal basis under the GDPR.
Continue Reading Amadeus IT Group Receives GDPR FineEU AI Act Update: The European Commission Publishes Draft Guidelines on HRAIs
On 19 May 2026, the European Commission published its long-awaited draft, non-binding guidelines on the classification of high-risk AI systems (“HRAIs”) under the EU AI Act (the “Guidelines”). Across three documents—covering general principles, high-risk classification in the context of regulated products (Annex I), and high-risk use cases (Annex III)—the Commission sets out its approach to one of the AI Act’s central questions: when does an AI system fall within the high-risk regime (and, just as importantly, when does it not)?
Continue Reading EU AI Act Update: The European Commission Publishes Draft Guidelines on HRAIsEU AI Act Update: Timeline Relief, Targeted Simplification, and New Prohibitions
On 7 May 2026, negotiators from the Council of the European Union, the European Parliament, and the European Commission reached a provisional agreement on the terms of the Digital Omnibus on AI, marking the first set of amendments to the EU AI Act since its adoption in June 2024. The…
Continue Reading EU AI Act Update: Timeline Relief, Targeted Simplification, and New ProhibitionsEU AI Act Update: Timeline Relief, Targeted Simplification, and New Prohibitions
On 7 May 2026, negotiators from the Council of the European Union, the European Parliament, and the European Commission reached a provisional agreement on the terms of the Digital Omnibus on AI, marking the first set of amendments to the EU AI Act since its adoption in June 2024. The final package of amendments reflects a mix of pragmatic timeline extensions, focused simplification measures, and a small number of substantive policy changes.
Continue Reading EU AI Act Update: Timeline Relief, Targeted Simplification, and New Prohibitions