digital economy regulation

This edition covers EU-level policy and regulatory developments tracked by Cullen International’s Digital Economy and Media services over the past week, as well as key reports published during the summer. These include an analysis of EU countries’ positions on the framework restricting high-risk suppliers under the proposed Cybersecurity Act 2 (CSA2); reports on the European Commission guidance on the Cyber Resilience Act (CRA); an analysis of core amendments to the EU AI Act, following the entry into force of the AI Omnibus; a story about the reinstatement of temporary rules on voluntary detection of child sexual abuse by messaging apps; a story about France’s Constitutional court ruling against a blanket social media ban for under-15s, with a potential impact on the Commission’s upcoming social media delay proposal; and developments in cases under the Digital Markets Act (DMA) and the Digital Service Act (DSA). It also lists events taking place this week.

According to a document prepared by the Council’s general secretariat and seen by Cullen International, several member states raised concerns over the proposed mechanism to designate high-risk suppliers (HRS) under the Cybersecurity Act 2 (CSA2). They called for an assessment in which suppliers’ links to countries posing cybersecurity concerns are treated as a risk indicator rather than a determining factor. Regarding telecoms networks, several member states questioned the proposed EU-wide three-year timeline for phasing out HRS components from 5G networks, favouring greater flexibility to account for national circumstances and the equipment lifecycles.

This Flash highlights the main aspects addressed in the guidance on the Cyber Resilience Act (CRA) related to free and open-source software (FOSS). It provides examples where FOSS is considered to be supplied during a commercial activity and hence placed on the market, triggering the obligations for manufacturers. The guidance also clarifies the concept of stewards and when they would be subject to the CRA reporting obligations. A steward sustains and supports FOSS intended for commercial use but does not place the software on the market.

The guidance sets out the Commission’s interpretation of certain provisions of the Cyber Resilience Act (CRA) and provides practical examples on their implementation. This Flash highlights some of the main aspects addressed in the guidance, including products designed before the CRA becomes applicable on 11 December 2027, remote data processing solutions, and conformity assessment for products posing a higher risk.

The government of Panama formally launched its National Advanced Technologies Agenda, which consists of two core state strategies: the new National Artificial Intelligence Strategy and the 2025 National Strategy for Semiconductors and Microelectronics. The aim is to position the country as a regional technology hub, particularly as a secure transit node for the technology supply chain. US involvement plays an important role in the background.

The AI Omnibus, amending key provisions of the AI Act, entered into force on 27 July 2026, following its publication in the Official Journal of the EU.