Cloud and AI Development Act: analysis of EU-wide assessment framework for cloud and AI sovereignty
15 June 26
Elisar Bashir
The CADA proposal would specify the conditions that EU and national public sector bodies should use in public procurement procedures for the provision of cloud computing services (CCS). The legislative proposal would also determine the criteria for the recognition of trusted CCS across four assurance levels for public sector activities that are critical to the preservation of public order (e.g. law enforcement, NIS2 sectors such as health and transport).
Cybersecurity Act 2: BEREC warns against rapid phase-out of non-amortised telecoms equipment from high-risk suppliers
14 June 26
Alessandra Vaes
The Body of European Regulators for Electronic Communications (BEREC) recommends aligning supplier phase-out obligations for telecoms operators with network lifecycle planning, and introducing risk-based timelines tailored to specific network components.
EU Digital & Media Weekly Report
14 June 26
Alessandra Vaes
This edition features news about member states’ discussions on the proposed Cybersecurity Act 2 (CSA2); BEREC position on phase-out requirements in electronic communications networks in the CSA2; a new Benchmark by Cullen International on the implementation of the AI Act across EU countries; the publication of a code of practice on transparency of AI-generated content; discussions around the potential introduction of binding EU rules on the prominence of services of general interest; the adoption of a common template to notify data breaches under GDPR; and a provisional agreement by EU co-legislators on rules exempting some companies from GDPR's record-keeping obligations. It also lists events taking place this week.
How Europe could stimulate digital investment
11 June 26
Matej Podbevsek
Stakeholders and academics discussed how Europe can stimulate digital investment and innovation without weakening competition at an IRG event on 10 June in Brussels.
Court of Rome annuls €15m fine against OpenAI, holding that GDPR one-stop-shop mechanism assigns jurisdiction to Irish data protection authority
11 June 26
Marianna Mattera
The judgment ultimately focused on a procedural and jurisdictional issue, namely which data protection authority was competent to issue the decision on ChatGPT. The court did not touch upon the substance of the alleged General Data Protection Regulation violations nor on the proportionality of the €15m fine.
Cybersecurity Act 2: Council discussions focus on EU member states’ role and proportionality of high-risk suppliers’ framework
10 June 26
Visiola Pula
During the Telecommunications Council of 9 June 2026, several ministers and other delegates argued that member states should play a central role under the ICT supply chain security framework (e.g. in designating high-risk countries) in the proposed Cybersecurity Act 2. Some member states also emphasised that the framework should be proportionate and targeted at critical ICT assets and significant risks.