Regulation, enforcement and compliance obligations.
18 items across all issues
Mistral published open weights for Mistral Large 4 on 29 October, a 1-trillion-parameter natively multimodal mixture-of-experts model trained on European infrastructure, under a modified-MIT ecosystem license (commercial hosted use needs a separate license). API pricing is 0.70 dollars per million input tokens and 2.10 per million output. Weights are on Hugging Face.
On 26 October the European Commission accepted Temu's action plan to remedy its breach of the Digital Services Act and reduce the availability of illegal products. The Commission accepted a remediation plan rather than moving straight to a fine. It was a quiet week for binding EU rule changes otherwise.
On 21 October a New Mexico court imposed 25 billion dollars in civil penalties on Meta in the state's Cambridge Analytica consumer-protection case, after a jury found about 43.9 million violations. The judge set the figure down from a much larger statutory maximum. Meta said it will appeal, and 48 other states had previously settled similar claims.
On 19 October DHS posted an order banning federal civilian agencies from acquiring DeepSeek products and requiring removal of DeepSeek and DeepSeek-based third-party tools, citing the Federal Supply Chain Security Act. National-security and SCI systems are excluded, and agencies can seek exceptions.
Quad9 announced on 22 October that it will cease serving French users on 24 November rather than comply with a court order to block DNS resolution of allegedly infringing domains. Quad9 argues geo-scoped blocking is technically unworkable without imposing French law globally.
The European Commission published the reference to EN 18286:2026, an AI quality-management standard, in the Official Journal on 19 October. It supports Article 17 on quality management for high-risk AI and grants providers a presumption of conformity, designed to work with ISO/IEC 42001 and ISO 9001.
On 21 October the European Commission opened formal DSA proceedings to assess whether Booking.com failed to mitigate risks from fraudulent listings and phishing targeting reservation data, and whether paid listings were properly labelled as advertising.
On 8 October the UK sanctioned payment platform Cryptomus over Russia-linked money laundering, freezing UK-held assets and barring UK firms from dealing with it. TRM Labs tied more than 7 billion dollars of processed transactions to ransomware, darknet markets and sanctions evasion.
Norway's DPA fined Xandr 8.6 million euros for unlawfully processing Grindr users' advertising IDs, IP addresses and location in real-time bidding. Because the data revealed sexual orientation, a special category, explicit consent was required, and the DPA found the relied-on consent invalid, stressing that each joint controller must verify valid consent for its own processing.
Adopted on 13 October, EDPB Statement 1/2026 flags data-protection risks of smart glasses, including covert recording of bystanders and risk in sensitive environments. It recommends visible recording indicators and states that manufacturers cannot transfer GDPR obligations to users.
Danish authorities disclosed that attackers abused a private company's legitimate access to the Central Person Register (CPR), running about 14 million automated searches in September before detection in early October. Exposed data includes names, addresses and CPR numbers for roughly 8.8 million people, about 80 percent of the register. A party claiming responsibility said access came via an IT company account protected by the password 123456.
The Dutch DPA fined Uber 824,990,000 euros for breaches of GDPR Article 22 on automated individual decision-making and Article 13 on information duties. Uber used fully automated decisions to temporarily or permanently deactivate driver accounts on suspicion of fraud or low ratings, causing income loss, without giving drivers enough information. Uber has appealed, so there is no final judicial decision yet.
On 8 October the US administration suspended Microsoft's access to the PERM green-card program for skilled foreign workers, alleging hiring-practice fraud. The suspension also named Adobe, Capgemini, Cognizant, HCL, Infosys, Tata and Wipro. The thread drew 945 points and over 1,600 comments on Hacker News.
The Swedish DPA fined Miljödata about 160,000 euros under GDPR Article 32 for insufficient technical and organizational security, including the lack of automated real-time intrusion and anomaly monitoring. About 2.2 million individuals were affected.
The Italian DPA fined IQVIA Solutions Italy 7 million euros for unlawful processing of patients' health data, citing GDPR Articles 5, 9 and 13.
German AI firm Aleph Alpha released Kolibri on 3 October, a mixture-of-experts model with 78 billion total and 3 billion active parameters and up to a 1M-token context, published on Hugging Face under Apache 2.0. Aleph Alpha positions it as sovereign, built and trained in Germany and Finland under EU and German law and designed around the EU AI Act and GDPR.
The European Commission opened a consultation on the EU KIDS Act on 2 October, closing 3 December, targeting child online safety and platform accountability. Feedback will feed the legislative process.
The European Commission opened a targeted consultation to support a better copyright environment on 29 September, closing 10 November, in preparation for a possible initiative. It is relevant to text-and-data-mining and AI-training copyright questions.
