The EU Cyber Resilience Act (CRA) makes cybersecurity a prerequisite for access to the EU market, not only for hardware products with digital elements, but also for software placed on the market independently. Its core requirements are far-reaching: conformity assessments, European Conformity (CE) marking, and a duty to supply security updates free of charge throughout
This GT Alert summarizes the state-law developments and highlights practical compliance considerations for businesses that develop, sell, or use algorithmic pricing tools.
Continue Reading Algorithmic Pricing Under Fire: State Restrictions on Personalized and Surveillance Pricing
On July 10, 2026, New York City Department of Consumer and Worker Protection (DCWP) finalized and adopted its “Click-to-Cancel Rule,” which takes effect on Oct. 1, 2026.
Continue Reading NYC Finalizes Click-to-Cancel and Hotel Junk Fees Rules, Proposes New Junk Fees Rule
Illinois’s new Artificial Intelligence Safety Measures Act imposes governance, audit, transparency, and incident-reporting obligations on frontier AI model developers, with key compliance deadlines beginning in 2027 and 2028.
Continue Reading Illinois Enacts Artificial Intelligence Safety Measures Act
The European Commission has proposed significant amendments to the EU Data Act as part of its Digital Omnibus package, touching on cloud switching, trade secret protections, and public sector data access. While several business-friendly changes are on the table, meaningful ambiguities remain unresolved.
Continue Reading EU Digital Omnibus Package Proposes Amendments to Data Act
The UK government has published its Smart Data 2035 Strategy, setting a target of five or more active smart data schemes by 2030 and 20 or more by 2035, backed by at least £36 million in public investment over four years.
Continue Reading UK Smart Data and the Data (Use and Access) Act 2025: Considerations for Businesses
The European Commission’s draft guidelines on Article 50 of the EU AI Act clarify how transparency and disclosure obligations apply to interactive AI systems, synthetic content, deepfakes, and AI-generated text on matters of public interest. With the rules taking effect 2 August 2026, organizations should act now to assess their AI governance frameworks, labeling practices, and editorial workflows.
On June 2, 2026, the White House issued an Executive Order designed to bolster U.S. cybersecurity through AI-enabled defenses and a voluntary collaboration framework between federal agencies and private AI developers. The Order also directs the Attorney General to prioritize prosecution of AI-assisted cyber offenses under existing federal law.
Continue Reading White House Issues Executive Order Targeting Frontier AI Models
Colorado’s newly signed AI Act replaces the state’s 2024 comprehensive AI regulation with a more targeted framework governing automated decision-making technologies used in high-stakes decisions involving employment, healthcare, and financial services, with a compliance deadline of January 1, 2027.
Continue Reading Colorado Repeals and Replaces the Colorado AI Act
The CJEU’s March 19, 2026, judgment in Case C-526/24 marks a significant development in GDPR enforcement, holding for the first time that even a single data access request may be refused as “excessive” under Article 12(5) GDPR if made in bad faith, while also confirming that an unjustified refusal to comply with such a request can itself give rise to damages liability under Article 82(1) GDPR.
Continue Reading CJEU: First Request for Access May Be Rejected as Abusive Under GDPR