Update on standardisation work in support of EU cybersecurity rules for products with digital elements
22 March 26
Alessandra Vaes
The European Commission noted that it has received the vast majority of the draft standards in support of the Cyber Resilience Act (CRA). It also stated that the EU single reporting platform for incident notifications is expected to be ready before reporting obligations apply (i.e. 11 September 2026). The CRA sets baseline cybersecurity requirements for the design, development and maintenance of products with digital elements.
AI Omnibus: European Parliament co-lead committees agree to postpone application of high-risk AI systems rules
19 March 26
Elisar Bashir
Members of the co-lead committees adopted on 18 March 2026 all compromise amendments to the draft report on the AI Omnibus proposal amending the Artificial Intelligence Act. Such amendments include expanding the scope of prohibited AI practices and delaying the application of the rules for high-risk AI systems.
EU Digital & Media Weekly Report
15 March 26
Miljana Todorovic
This report gathers policy and regulatory developments at EU level covered by Cullen International’s Digital Economy and Media services during the last week. It also lists events taking place this week.
European Parliament proposes to restrict the scope of the e-Privacy derogation for the voluntary detection of child sexual abuse online
11 March 26
Laura Sboarina
The European Parliament proposed to restrict voluntary detection to previously identified child sexual abuse material, unknown material flagged by other users, and targeting of suspects. It also clarified that the derogation of the e-Privacy Directive should not apply to end-to-end encrypted communications. Trilogue negotiations can now start.
European Commission consults on guidance for upcoming IoT security rules
10 March 26
Javier Huerta Bravo
The Commission aims to provide operators with timely guidance to support compliance with the EU Cyber Resilience Act (CRA). While the CRA will apply from 11 December 2027, incident reporting obligations will become applicable in September 2026. The consultation will be open for feedback until 31 March 2026.
EU Digital & Media Weekly Report
08 March 26
Miljana Todorovic
This report gathers policy and regulatory developments at EU level covered by Cullen International’s Digital Economy and Media services during the last week. It also lists events taking place this week.