digital economy regulation

This report analyses the new measures, expected to be adopted in December 2026, to prevent impersonation fraud involving payment services providers (PSPs). Both telecoms operators and online platforms would be required to detect and prevent the use of their services for this type of fraud. The regulation would explicitly allow them to cooperate and share information with PSPs. Very large online platforms would have to verify that advertisements for financial services are from authorised providers. Platforms would also have to compensate PSPs for the amounts refunded to their customers in some cases, such as if they had failed to expeditiously remove the fraudulent content after becoming aware of it.

This edition features a story on the application of the Cyber Resilience Act’s reporting requirements; a new edition of the EU Timeline, highlighting key EU policy and regulatory developments foreseen until the end of 2026; and an update of the Digital Economy Trackers.

It is the second-largest fine imposed under the GDPR to date. The Dutch data protection authority found that, by suspending drivers’ accounts without human intervention, Uber subjected the drivers to decisions based solely on automated processing. Under the GDPR, such automated decision-making (ADM) is generally prohibited where it produces legal effects or similarly significantly affects the individuals concerned, subject to certain exceptions.

This edition of Cullen International’s EU Timeline highlights key policy and regulatory developments foreseen at EU level until the end of 2026.

This edition covers EU-level policy and regulatory developments tracked by Cullen International’s Digital Economy and Media services over the past week, as well as key reports published during the summer. These include an analysis of EU countries’ positions on the framework restricting high-risk suppliers under the proposed Cybersecurity Act 2 (CSA2); reports on the European Commission guidance on the Cyber Resilience Act (CRA); an analysis of core amendments to the EU AI Act, following the entry into force of the AI Omnibus; a story about the reinstatement of temporary rules on voluntary detection of child sexual abuse by messaging apps; a story about France’s Constitutional court ruling against a blanket social media ban for under-15s, with a potential impact on the Commission’s upcoming social media delay proposal; and developments in cases under the Digital Markets Act (DMA) and the Digital Service Act (DSA). It also lists events taking place this week.

According to a document prepared by the Council’s general secretariat and seen by Cullen International, several member states raised concerns over the proposed mechanism to designate high-risk suppliers (HRS) under the Cybersecurity Act 2 (CSA2). They called for an assessment in which suppliers’ links to countries posing cybersecurity concerns are treated as a risk indicator rather than a determining factor. Regarding telecoms networks, several member states questioned the proposed EU-wide three-year timeline for phasing out HRS components from 5G networks, favouring greater flexibility to account for national circumstances and the equipment lifecycles.