In a nutshell: The European Commission published, guidance to support the Cyber Resilience Act implementation, an Action Plan on Cybersecurity and AI, guidelines on AI systems transparency and a study on the intellectual property domain name information and alert system. The European Commission also referred certain Member States to the Court of Justice for failing to transpose the NIS 2 Directive. European Parliament committees moved further on the Digital Omnibus, NIS 2 targeted amendments and the Cybersecurity Act 2 proposal. The European Parliament think tank published an analysis on online fraud and fake web shops. EDPB adopted guidelines on anonymisation, web scraping in the context of generative AI.
Cybersecurity
The European Commission referred Member States to the Court of Justice for the lack of NIS 2 Directive transposition.
On 8 July, the European Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice of the EU for failing to transpose the NIS 2 Directive into their national laws. Member States had until 17 October 2024 to transpose the Directive. The referral to the Court of Justice also includes a request to impose financial sanctions on the infringing Member States.
The European Parliament submitted amendments to the Digital Omnibus
Throughout summer, members of the Industry, Research and Energy (ITRE), Civil Liberties, Justice and Home Affairs (LIBE) and Internal Market and Consumer Protection (IMCO) committees of the European Parliament published amendments (available here: 1 2 3 4 5 6 7 8 9) on the Digital Omnibus proposal (see our previous coverage here). In the cybersecurity domain, the Digital Omnibus proposes to create a Single-Entry Point (SEP) for incident reporting at the EU level, managed by ENISA. However, some proposed amendments in the European Parliament’s ITRE and LIBE seek to move the SEP to the national level. Certain amendments aim to harmonise incident-reporting timelines across multiple EU legislations, including the NIS 2 Directive, GDPR, CRA, and EUID through a delegated act. Finally, MEPs proposed amendments to harmonise the interpretation of the NIS 2 Directive, such as the requirements, scope and frequency of cybersecurity audits. The amendments filed in the IMCO committee included, among others, a call for further assessment of overlaps and inconsistencies in EU digital legislation via the upcoming Digital Fitness Check.
IMCO published amendments to the NIS 2 targeted amendments
On 1 July, the European Parliament’s IMCO committee published amendments to the NIS 2 targeted amendments (see our previous reporting here). IMCO is not in charge of the European Parliament’s position on the file, but gives an opinion that the main ITRE committee may or may not take into account when negotiating the Parliament’s position. Among IMCO amendments are changes to the need for cybersecurity certification, as one IMCO amendment would require entities in the scope of the NIS 2 Directive, that provide services across several Member States, to be certified. In contrast, other amendments modify the Commission proposal so that Member States may only encourage, not require, essential and important entities to obtain a certificate on their cyber posture under the European cybersecurity certification scheme. The Commission proposal would prevent Member States from imposing additional technical, methodological or sectoral requirements on those entities, for which such requirements were already imposed through the implementing acts (such as TLD registries). Several IMCO amendments, however, delete or otherwise soften this provision to allow Member States to impose their own requirements on entities within the scope of the implementing acts. Several amendments also include the ‘report once’ principle. The IMCO committee will consider the amendments on 28 September, with the vote planned for 15 October 2026.
IMCO published amendments to the Cybersecurity Act 2
On 1 July, the European Parliament’s IMCO committee published its amendments (here and here) to the proposal for the Cybersecurity Act 2. Some IMCO amendments propose that the phase-out of high-risk third-country suppliers should occur under a clear, predictable, and transparent process with reasonable transition periods available to ensure operational continuity for business. According to one amendment, the Commission should consult the European Cybersecurity Certification Group, relevant stakeholders, and publish a reasoned assessment before adopting an implementing act designating a third country as posing serious and structural non-technical risks to ICT supply chains. Several amendments also propose to make the Council of the EU, instead of the Commission, responsible for determining the exclusion of third countries and third-country suppliers. The justification is that the decision is primarily geopolitical and focuses on national security matters. Two opposing amendments were also proposed, with one making the European cybersecurity certification scheme mandatory, and the other making it completely voluntary. The IMCO committee will consider the amendments on 28 September and have a vote on the committee’s opinion on 15 October 2026. The IMCO’s opinion will inform the work of the leading ITRE committee, which will prepare the initial European Parliament’s position.
The European Commission published guidance to support the Cyber Resilience Act implementation
On 27 July, the European Commission published guidance to support the Cyber Resilience Act (CRA) implementation. The CRA puts cybersecurity requirements on manufacturers when placing products with digital elements on the European market, as well as during the lifecycle of these products. The guidance aims to facilitate compliance with the CRA by explaining which products fall within the scope of the Regulation, when a product is ‘placed on the market’, and how to fulfil the reporting obligations and risk assessment requirements. A standalone software product is considered placed on the market when its manufacturing phase is complete and the software is first supplied for distribution or use on the EU market in the course of commercial activity. New updates of the software product with digital elements are considered to be newly placed on the market when there have been ‘substantial modifications’ to the software itself. CRA’s main obligations will apply from 11 December 2027, with reporting obligations already applying as of 11 September 2026.
AI
The European Commission published an Action Plan on Cybersecurity and AI
On 7 July, the European Commission published an Action plan on Cybersecurity and AI. The Action Plan aims to ensure a safe and responsible adoption of frontier AI. According to the document, the Commission will increase its capacity to evaluate frontier AI models before their release. It will facilitate access to advanced AI-enabled cyber capabilities for European actors and support efforts to test available AI models for cybersecurity. The EU will support critical sectors and SMEs in preparing for AI-powered cyber threats by stimulating the integration of AI into their cybersecurity operations and using the latest AI models to fix the most critical vulnerabilities. Critical sector operators and financial entities should also adjust their risk management framework to anticipate AI-powered cyberattacks at a higher scale, and to reduce time-to-patch. ENISA will prepare guidance on how to protect against AI-powered threats and foster the secure integration of AI tools in cybersecurity operations. Member States should also assess critical infrastructure preparedness together with the NIS Cooperation Group and the AI Board. Importance for ccTLDs – Low: The upcoming ENISA guidance may help registries identify ways to strengthen their cybersecurity practices.
The European Commission published guidelines on AI systems transparency
On 20 July, the European Commission published guidelines on implementing AI transparency obligations. The guidelines are intended for the providers and deployers of AI systems, as well as for competent authorities. The AI Act transparency rules require AI providers to design their AI systems so that individuals are informed when they interact with an AI system, and that the AI system's output is marked in a machine-readable format and detectable as artificially generated or manipulated. The deployers of AI systems have to inform individuals about being exposed to AI systems for emotion recognition and biometric categorisation, and to deepfakes (i.e., AI-generated or manipulated image, audio, or video content that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful), or text publications on matters of public interest without human review or editorial control. The guidelines cover these four instances, including examples of which AI systems fall into the scope of the transparency obligations. The guidelines recommend that even actors outside the scope of the transparency obligations who disseminate AI-generated or AI-manipulated content inform the individuals exposed to it.
Consumer protection
The European Parliament published an analysis on online fraud and fake web shops.
On 22 July, the think tank of the European Parliament published an analysis on online fraud and fake web shops as requested by the European Parliament’s IMCO committee. The document provides an overview of the entire online fraud and fake webshop lifecycle and discusses the gaps in EU legislation. The analysis notes that: “the speed at which fake web shops can be created, monetised, and relaunched under a new domain[…] is not compatible with enforcement responses calibrated to individual site removal.” As part of the gap analysis, the document notes that the use of the Consumer Cooperation (CPC) Regulation, which empowers competent authorities to order domain registries to delete a specific domain name, is suited to disrupt established operations but not to match the speed with which fraudulent web shops hop domains. It suggests that the upcoming Action Plan on Fighting Online Fraud should require the Commission, the CPC Network, registrars, hosting providers, and platforms to adopt operator-level disruption protocols that treat a cluster of related domains and accounts run by the same operator as one continuing operation, not separate incidents. Co-legislators should also introduce proportionate (unspecified) ex ante duties, rather than relying on disruption operations after victims are first defrauded. Furthermore, the Commission can press for clearer, faster use of existing legal instruments, such as domain name-related provisions in the CPC Regulation, and Article 28 of the NIS 2 Directive on providing domain name registration data to legitimate access seekers within 72 hours. It also highlights the Digital Services Act and orders to provide information as a legal basis for an authority to compel domain registries to provide information on fake web shops.
Data protection
The EDPB adopted guidelines on anonymisation, web scraping in the context of generative AI.
On 8 July, the European Data Protection Board (EDPB) published guidelines on anonymisation, web scraping in the context of generative AI and on the processing of personal data through blockchain technologies. With regard to the guidelines on anonymisation, EDPB recalls that under GDPR, the data is anonymous if it does not relate to an identified or identifiable natural person. A natural person is considered identified or identifiable if they can be distinguished from others in a specific context using means reasonably likely to be used in a way that makes it possible to treat them differently. The guidelines help determine whether anonymisation has been successful. The framework presents three criteria of no record violation, no linkage and no inference, which, when passed, mean that the data can be considered anonymous. The guidelines on web scraping in the context of generative AI note that web scraping often occurs without data subjects' awareness, which poses risks to personal data protection. GDPR applies to web scraping when it includes personal data processing operations, with multiple organisations potentially being involved. The qualification of the organisations involved (i.e., processors, controllers, joint controllers or processors) should be determined on a case-by-case basis. The controller must comply with the principles of purpose limitation, transparency, and data minimisation. The guidelines note that private entities often use legitimate interest as the legal basis for web scraping, which requires them to undertake a balancing test between the data subject's fundamental rights and the controller's legitimate interest in processing the data. The guidelines suggest several mitigation measures to help controllers apply the balancing test, such as ensuring that certain data categories are not collected or that certain sources are excluded by default from data collection, limiting the collection to freely accessible data, etc. The guidelines are open for feedback until 30 October 2026 here and here.
Geographical indications
The European Commission published a study on the intellectual property domain name information and alert system.
In April, the European Commission published a study on intellectual property domain name information and alert system. The study aimed to gather evidence on potentially abusive domain name registrations in the context of geographical indications (GIs) protection. The study defines “abusive domain name registration” as cybersquatting. 4868 GIs were checked against a local database of domain names imported from gTLD and ccTLD zone files. A sample of domain names containing 11 different crafts and agricultural GIs was selected for more granular analysis predominantly in gTLD space. The study noted that from the examined domain names, 25% were considered as “legitimate” and 75% as “suspicious”. However, the study notes that “these domains could include perfectly legitimate commercial actors selling genuine products protected by the GI in question[…]. Determining whether these domains are ultimately abusive is obviously entirely up to a legal review[…] that is beyond the scope of this Study”. The main focus of the study was to explore the options for domain name information and alert system. From the explored options, the study concludes that the most cost-efficient solution is to rely on nameserver lookups complemented with WHOIS lookups for a subset of domain names. It would also not require additional technical and administrative efforts on the side of the TLD registries. The alert function would enable GI holders to opt in to receive alerts as soon as a domain name that is identical to their GI is registered.
