Tech industry stakeholders have voiced optimism in the wake of the UK government’s Autumn Budget.

Chancellor John Healey's inaugural budget includes a £600+ million package to support British AI development, security, and skills capabilities.

Julian David, CEO of techUK, described the funding pledge as a “strong” indication of the government’s focus on AI’s economic potential.

“It signals that government is focused on the right issues on both securing the benefits of AI for the whole of the UK whilst also tackling the biggest questions and challenges around safety, security and economic impact,” he said.

Speaking in the House of Commons, Healey said the government aims to “forge a British way to seize opportunities and guard against the risks” associated with the technology.

On the security front in particular, the government will allocate £165 million for a new National AI Biosecurity Initiative, along with £120 million for the AI Security Institute (AISI).

An additional £60 million, meanwhile, will go toward funding the National Cyber Shield. First announced by the National Cyber Security Centre (NCSC) in May this year, the Cyber Shield initiative will build a nationwide defensive network using AI agents.

Investment on this front will be mirrored by a new £70 million Nation Exposure and Real Time Vulnerability (NERV) Centre, the government revealed. This will help identify cyber-related weaknesses in critical infrastructure.

Alexandra Rose, Head of Global Affairs, Policy, & Partnerships at Sophos, said investment in AI security capabilities will be critical to the success of the UK industry moving forward.

“Strengthening national cyber resilience and continuing to make cybersecurity a strategic priority is always welcome,” Rose commented.

“As AI accelerates vulnerability discovery and cybercriminal activity, investments such as the proposed National Exposure and Real-Time Vulnerability (NERV) Centre offer an important opportunity to strengthen our collective defences.”

Piero Gallucci, Regional VP for UK&I, Veeam Software, echoed Rose’s comments, noting that the investment is a “welcomed” step in the right direction.

“As we scale AI, we must also secure it. And so it’s hugely encouraging to see the Chancellor’s extensive AI growth plan, particularly the £120 million investment in the AI Security Institute and the £60 million allocated to the National Cyber Shield development,” he said.

Sovereign AI in the spotlight

The Budget also confirmed additional funding for the Sovereign AI Fund in the form of a $60 million investment.

Sovereignty has become a recurring flashpoint for firms across the UK and Europe more widely in recent years amidst rising concerns about overreliance on foreign tech firms.

As ITPro reported ahead of the Budget, UKAI said the country risks “becoming a vassal state” due to reliance on overseas technology providers.

The trade body, which represents hundreds of British AI firms, called for heightened investment in sovereign AI and compute capabilities to bolster self-reliance.

According to Downing Street, increased support for the Sovereign AI Fund will “enhance its ability” to invest in UK AI companies and support scaling.

“This will include expanding into a new focus area of Physical and Industrial AI,” the government said in a statement.

Mark Boost, CEO at Civo, welcomed the investment, noting that support for home-grown firms must be a priority for the government.

“Much of today’s Budget is encouraging, with the government having set out genuine ambition for the country’s digital future. Whether that ambition reaches British companies is a different story,” he said.

“If public spending continues defaulting abroad, AI will be running on foreign providers' platforms, with all of the value produced flowing overseas. All of the government’s best-laid plans for its AI goals will go awry if its procurement bravery fails to match its rhetorical ambition.”

Elsewhere, an additional £60 million will support the Sovereign AI’s R&D Procurement Scheme, Healey announced.

Downing Street said this will help provide “innovative solutions to challenges across the health and care system” as well as in AI security and adoption.

Boost once again reiterated that the focus should be directed toward supporting home-grown companies.

“Schemes like the new £60 million R&D Procurement competition are designed to help UK AI hardware and software companies deploy solutions at scale across public services like the NHS,” he said.

“But the sad truth is that UK public cloud spending has defaulted to US hyperscalers for years. Expanding the Sovereign AI Fund with an additional £60 million in equity capacity will help ensure homegrown AI scales securely and sustainably.”

FOLLOW US ON SOCIAL MEDIA

UKAI, the trade body for more than 270 British AI businesses, is calling for a dedicated sovereign AI action plan to save the UK from dependency on foreign tech giants.

The trade body said it wants to see next week's budget include a plan for AI sovereignty amidst lingering geopolitical uncertainty and in the wake of recent cloud outages.

"Piecemeal funding announcements are tactical at best, and we need detailed strategy about how the country will build and design a new wave of AI tools to support critical national infrastructure," said Charlotte Wilson, head of enterprise at Check Point.

"This should be written into the defense budget, especially with geopolitical uncertainty and hostile foreign states bombarding the country with increasingly malicious attacks.”

The government has made a number of moves aimed at improving the UK's AI sector, including efforts toward greater sovereignty.

In summer 2024, it launched an AI Opportunities Action Plan, followed earlier this year by a £500 million Sovereign AI fund aimed at boosting support for domestic AI companies. A further £60 million for the program was pledged last week.

Earlier this summer, it unveiled an AI Hardware Plan designed to give a helping hand to home-grown AI chip firms. However, UKAI said that while all three are valuable initiatives, they need to be merged into one overarching strategy.

"On their own, they are building blocks. Joined up as a strategy, they would be transformative," said Flagg.

AI sovereignty in the spotlight

UKAI joins a number of industry associations calling for a more aligned approach to AI sovereignty. Just last week, a new industry taskforce, Project Sovereign AI Leadership (SAIL), called for a clear definition of sovereign AI.

This would entail creating a workload classification framework that grades sovereignty across each layer of the stack - infrastructure, including data centers, compute and networks, data, models and applications, and workloads.

In July this year, the Council for Science and Technology (CST) called on the government to develop a UK AI Sovereignty Plan, set up clear governance and coordination for AI sovereignty choices, and increase investment in long-term domestic AI capability.

“The stakes could not be higher. Without immediate action, Britain risks becoming a vassal state, dependent on countries that control the AI infrastructure our economy increasingly relies on. We have the entrepreneurs, the research and the talent to compete, but they are fragmented and disconnected," said UKAI CEO Tim Flagg.

“Businesses are calling for action and the government has signalled its intent, yet nothing concrete has followed. Next week’s Budget is the moment to act. We urge the Chancellor to fund a Sovereign AI strategy and secure the UK’s place as a world leader in AI, rather than leave our future in other countries’ hands.”

FOLLOW US ON SOCIAL MEDIA

The UK can capitalize on a £75 billion economic boost by 2035 if it acts quickly enough on AI adoption, according to a new industry taskforce, but time is running out to act.

The Project Sovereign AI Leadership (SAIL) report has called for a “Prosperity Compact” between government, business, regions and citizens - which needs to be established within the next 12 months.

This call to action has been backed by senior executives at Microsoft, NScale, Cisco, and BT.

“AI is the defining technology of our generation, but realising its £75 billion economic potential requires genuine mobilization of the entire nation. By establishing a clear Prosperity Compact between government, industry, and local communities, we can build the infrastructure we need, equip our workforce with future-ready skills, and ensure Britain’s digital destiny," said Steve Rigby, CEO of Rigby Group and chair of the Project SAIL Taskforce.

"This taskforce’s goal isn’t another strategy document, but high-impact actions that materially accelerate the UK’s transition to an AI-enabled economy.”

The report makes ten specific recommendations for the government, kicking off with a Compute Accelerator service for mid-scale infrastructure capabilities.

This would see the creation of a dedicated service within the Department for Business, Innovation, Science and Trade (DBIST) to support local authorities in identifying, matching, and planning mids-cale data center and networking sites.

Of the roughly 73 GW of data center applications in the connection queue, about 93% sit in the two largest size bands - very little sits between 10 and 100 megawatts, the report noted.

It’s this mid-scale range where the UK can build at pace, serving enterprise, research, defence, and health. The taskforce said Downing Street should back the mid-scale with the same ambition it has shown for the flagship tier.

The taskforce also wants to see grid connection queue reforms, prioritizing homes on distribution networks, and fast-tracking data centers on transmission lines.

AI skills and sovereignty are key

Crucially, the taskforce called for a stronger focus on AI training, led by Skills England, across priority sectors including construction, care, professional services, and manufacturing.

The country also needs a clear definition of sovereign AI - often just a marketing label, the report warned. This means creating a workload classification framework that grades sovereignty across each layer of the stack - infrastructure, including data centers, compute and networks, data, models and applications, and workloads.

Elsewhere, the government should publish Cabinet Office guidance and gap analyses, requiring fallback mechanisms for public services reliant on hosted frontier AI models, starting with healthcare; and return the Government Digital Service to the center of government to lead procurement.

"The government has taken important steps to set the UK's AI ambition; now it’s time for government and industry to come together to deliver. Our national strategy must translate into tangible benefits for every region and community," said Sarah Walker, chief executive, Cisco UK & Ireland.

"That starts by recognising that AI is only ever as powerful as the infrastructure that underpins it, the power that sustains it, and the robust cybersecurity that protects it. By backing these recommendations and accelerating digital skills through strong cross-sector partnerships, government and industry can build the secure, trusted ecosystems needed for AI to scale responsibly.”

FOLLOW US ON SOCIAL MEDIA

European businesses are over-reliant on American AI providers and their laissez-faire attitude risks putting the continent at the mercy of closed systems and unexpected access restrictions.

That’s according to Mistral AI co-founder Arthur Mensch, who penned a column in Le Monde arguing Europe will be subject to an “an economic regime of dependence without equivalent in the history of civilization”.

Mensch claimed that “serious people” in Europe have suggested it’s better for the US and China to spend the millions or billions of Euros needed to create frontier AI models, rather than strain the European economy.

“According to them, it’s better to follow the recipe of the internet, where the value is in creating new applications and focus our efforts on what Europe knows how to do: its industrial data, its SMBs, and professional expertise. For everything else, open models created by others will suffice,” said Mensch.

“This is a fundamental error, which will cost Europe its place in the world,” he added. “AI isn’t the internet. The internet relied on open protocols that nobody owned. Closed AI models are proprietary. What an application or agent knows to do is decided by the model.”

Mensch pointed out not only can the owners of these proprietary models hike prices or retire a version of the model without user recourse, they can also cut access without notice. This isn’t hypothetical, as evidenced by Anthropic cutting off access to Fable and Mythos in June 2026.

“Access was reestablished, but the decision wasn’t taken in Europe, nor for Europeans. Nobody asked our opinion,” he added.

Mensch’s column comes amid heightened tensions over AI dependence and a rising interest in sovereign cloud and sovereign AI.

In the UK, the government established a £500 million startup fund to boost the country’s sovereign AI ambitions. Businesses in the country have also started to turn their attention towards sovereign AI in order to reduce their dependence on overseas providers.

Nevertheless, sovereign AI can have hidden costs. According to Forrester senior analyst Dario Maisto, this can mean slower roll out due to a skills deficit and a misunderstanding of what ‘sovereign’ is when it comes to infrastructure.

There’s also a monetary cost: research commissioned by CCIA Europe has claimed the EU sovereign AI bill could cost six times more than the bloc’s own upper estimate of €18 billion. Instead, the trade body – which is made up of non-EU businesses, primarily from the US – has predicted a potential cost of €115 billion over 10 years.

According to Mensch, however, the price is worth paying.

“If Europe resigns itself [to the status quo], AI will continue to be created elsewhere and we will only have access to second tier export versions, in exchange for licenses that will cost trillions of Euros,” he said.

The European Centre for International Political Economy (ECIPE) think tank has issued a report claiming that the EU's proposed sovereignty rules could cost the bloc billions.

The research, funded by CCIA Europe – a trade body with members including Amazon, Google, and Meta – examined the costs associated with the European Commission’s proposed Cloud and AI Development Act (CADA), which excludes non-EU providers from parts of the cloud and AI market.

The research found, the Act risks imposing €115 billion in costs over the next decade – six times the Commission’s upper estimate of €18 billion.

The reasons, said the researchers, come down to three critical blind spots in the Commission’s impact assessment:

• Failure to include €33.3 billion in direct public budget exposure
• Ignoring the cost of software re-architecting and code-rewriting, which ECIPE said accounts for 69% of CADA’s real-world impact
• Failure to take into account the cost of private-sector spill-overs, which, the report found, could amount to as much as €80 billion.

"Member states can’t rely on the Commission’s incomplete estimates when deciding CADA’s strict sovereignty requirements for cloud and AI providers," said CCIA Europe’s policy manager, Mitchell Rutledge. "Taxpayers and businesses will foot the bill, yet the official assessment missed 70% of CADA’s true impact.”

CCIA Europe is particularly bothered by Article 31 of the act, which allows the Commission to extend strict sovereignty restrictions beyond public procurement to certain private sectors, including banking, energy, healthcare, and transport.

This, it said, would increase the cost enormously, as European software vendors and digital SMEs would be forced to redesign applications currently built on global cloud architectures and AI platforms.

“Governments must recognise that CADA’s massive spillover costs for essential private-sector entities are not hypothetical but inevitable," said Rutledge. "Businesses cannot simply switch servers; they must redesign software and rewrite code across entire supply chains.”

Not entirely unexpectedly, CCIA Europe is calling on EU member states to drastically overhaul CADA, limiting sovereignty restrictions to sensitive workloads where specific public-order risks are demonstrated.

Describing corporate-origin and personnel-nationality requirements as 'discriminatory', it wants to see these rules replaced with risk-based technical safeguards.

Meanwhile, 'trusted international partners' with bilateral EU procurement commitments – like its members – should be exempted from Article 18 country screening.

“These sweeping restrictions risk draining European innovation and penalizing highly digitized member states," said Rutledge. "EU decision-makers must refocus CADA on objective, risk-based security rather than discriminatory rules that fragment the single market.”

Big US tech firms have put a lot of effort into convincing Europe that they too can provide sovereign European services. AWS's European Sovereign Cloud, for example, sees enterprise data hosted and stored solely in the region, and kept separate from other AWS Regions worldwide. Microsoft's Sovereign Cloud and Google's sovereign solutions make similar promises.

However, there are still concerns: US tech firms are subject to the US Cloud Act, which allows US law enforcement to demand access to the data they hold, even when it's stored outside the US.

Thanks to these concerns, according to Gartner research earlier this year, a fifth of European workloads are shifting to local clouds, with sovereign cloud infrastructure spending in the region set to triple between 2025 and 2027.

AI is significantly under-regulated, Microsoft vice chair and president Brad Smith has told the BBC, calling for greater legal obligations to organizations when their security is breached by AI.

"Right now, your washing machine is subject to more safety rules than AI," he told the BBC's Big Boss Interview podcast. "Every carton of milk that you see in the grocery store is subject to safety rules and inspection."

AI, he said, is both a "tool and a weapon", and AI firms need to implement kill switches for when things go wrong. He also called for a legal requirement for the companies to create incident reports and inform any victims.

Smith also called for new AI technology to be evaluated by independent government bodies – and said that the UK was the best-positioned country to take the lead, referencing the work of the AI Security Institute (AISI).

"I actually think the country and the government that is in the best position to advance AI safety standards and even rules is here, it's the UK," he said.

"In the world of technology, in the tech sector, most people that I know would say, if you ask them, name the country that is the leader in having this technical capability, they would say, it's very simple. It's the UK."

Meanwhile, Microsoft chief executive Satya Nadella has echoed Smith's remarks in a blog post over the weekend.

"It's time to step back and assess the trust architecture for this new era," he wrote. "We simply can't outsource responsibility for what intelligence does on our behalf. A model provider's assurances do not relieve us of that responsibility."

He called for systems to be developed around principles of observability, model diversity, observability, verifiability, and independent auditability. Models should be tightly contained from the start, and incidents should be quickly disclosed.

Notably, Nadella referred to AI as Super Intelligence – Donald Trump's preferred term. Trump, however, has repeatedly said that AI companies should be left to police themselves, and that he doesn't want to see them "stifled".

Late last month, he announced that Anthropic, Google, Meta, OpenAI, Nvidia and xAI had signed a pledge to work with independent auditors on their AI systems - although this was merely "morally binding".

Trump also recently called on AI developers to stop sharing unreleased systems with AISI, causing Anthropic to prevent UK officials from examining Claude Mythos 5.1, its newest model.

However, he has now reportedly reversed that ban, and Smith believes that a UK leading global AI safety efforts could be viewed positively in the US.

"In Washington DC, people don't look at the UK, and they don't look at London the way they look at Brussels – that's a strength," he said.

"Let's speak calmly, maybe even softly, but firmly, and start to bring people together. I hope that's the role we can play as a company. I hope that's the role the UK can play as a country."

The UK and Germany have announced a new Industrial Tech Corridor aimed at encouraging partnerships between companies in the two countries.

The deal, which builds on the existing Strategic Science and Technology Partnership, is being backed by some of Germany’s leading companies including Allianz, Bosch, RWE, and Siemens.

The aim is to connect industry leaders, tech firms, and innovators from both countries, allowing them to work together on AI and critical technologies.

"Together with the UK, we’re building an ideal launchpad for AI companies to scale internationally," said Germany's federal minister for digital transformation and government modernization, Karsten Wildberger.

"The UK-German Tech Corridor will accelerate scale-ups to enter Europe’s most advanced AI ecosystems. This partnership represents an important step to strengthening our digital sovereignty."

The focus will be initially on AI and high-value industrial applications, with a first dedicated Tech Corridor roundtable convening CEOs of selected primes, AI scale-ups, and senior officials scheduled for later this year.

To connect AI and critical technology scale-ups with industrial demand, firms in both countries will be encouraged to develop scaled industrial use cases.

The two countries will also share a pot of around €20 million to help accelerate joint quantum research. This will support projects in a range of areas, from quantum computing through to the technology’s use in financial services.

It could also lead to cutting-edge breakthroughs in areas such as quantum sensors.

This means cash for a further five research projects across Germany and the UK, making use of the existing bilateral quantum cooperation and increasing the number of funded projects to 10.

"We already work closely with Germany in key areas like AI and quantum, and today lays a new foundation - combining the strengths of our businesses and innovators so people in both countries will benefit from for years to come," said UK secretary of state for business, innovation, science and trade, Jonathan Reynolds.

MicroAGI announces London hub

Following the deal, Germany-based tech firm MicroAGI, a robotics research company headquartered in Munich, will expand its footprint in London, creating 180 new jobs, while energy company Proxima Fusion plans to expand its base in Oxfordshire, hoping to quadruple its local workforce by 2028.

The UK-based AI software company Quantexa, meanwhile, is committing to building a dedicated sovereign unit in Germany which will support AI deployment in both countries.

Similarly, the two countries have also convened senior business leaders for a Regional Growth Forum, focused on fostering business-government collaboration, regional growth and innovation.

The plan is to develop a deeper regional dialog to be held in 2027, involving local and regional stakeholders.

"Today’s agreements are great news for British tech, businesses, and workers. They mean more jobs, more investment, and more innovations that will change lives," said Reynolds.

FOLLOW US ON SOCIAL MEDIA

Compliance with AI regulations will present an enormous challenge for businesses, according to ISACA CEO Erik Prusch, describing the task as “Sarbanes-Oxley on steroids”.

Introduced in 2002 following the Enron and WorldCom accounting scandals, the Sarbanes-Oxley Act (commonly abbreviated to SOX) is a US federal law governing the reporting and verification of financial information by public companies.

Initial implementation of the necessary internal controls was notoriously costly and took several years to bed in, and compliance remains an annual exercise for US-listed companies.

Prusch, who was CFO of biometric authentication company Identix when the rules came into force, said the challenge of achieving compliance with incoming AI regulations dwarfs that work.

Prusch warned companies will need to do the same level of work five or even ten times faster thanks to the rapid pace of AI development – and all without a settled regulatory framework to guide them.

“It's the equivalent of SOX on steroids,” he told ITPro in an interview at the annual ISACA Europe conference in Munich. “It took us multiple years to get to a place where we actually knew what we were required to do from a Sarbanes-Oxley standpoint, and that was with the benefit of regulation that told us something to do.”

Dazed and confused over AI compliance

Part of the challenge with AI compliance, he explained, is that unlike SOX, the industry is still in the process of establishing the controls, accountability, and reporting lines that compliance will be based on.

“Who is responsible, who is ultimately going to be accountable, and how that is going to get communicated to the board, is brand new,” he said.

Further complicating matters, multiple countries and supranational bodies are butting heads over the best approach to regulating AI.

The EU's more cautious approach has favoured a comprehensive, risk-based rulebook – laid out in its AI Act – while the US federal government has prioritized development speed and innovation, resisting attempts to impose regulation at home and pressuring Brussels to scale back its own rules.

Combined with NIS2, DORA, and the Cyber Resilience Act, which govern cybersecurity for everything from critical infrastructure and banks to connected products, the AI Act makes the EU one of the more demanding regulatory environments for businesses.

Many organizations fall under several of these regimes at once, each with its own overlapping obligations.

"Over the last couple of years, we have seen a definite increase in the compliance burden," said Tara Wisniewski, senior vice president of advocacy at ISACA, citing complaints she’s heard from members.

"My DORA regulation says it has to look this way, NIS2 says it has to look this way, now CRA wants it this way… Why do I have to provide the same piece of information in six different colours? It gets ridiculous."

No light on the horizon

Prusch warned that the situation is likely to get worse before it gets better. He predicted that board members will be named in lawsuits when AI deployments go wrong, arguing that, as with SOX, regulation will arrive as a reaction to a string of high-profile failures.

"It's only going to take a couple of companies that frankly go out of business because they're exposed, and they haven't done the work necessary," he said. “Everybody’s going to have that ‘oh shit’ moment.”

"We're probably 12 months from panic," he added.

As part of efforts to address the gap, Wisniewski said ISACA is expanding its advocacy work, engaging with policymakers on the principles that should underpin AI regulation, and calling for greater consistency between different jurisdictions' rules.

This includes working with UK lawmakers on amendments to the Cyber Security and Resilience Bill.

At the same time, the association has also launched three AI-focused certification products, with a fourth on the way, and is building AI into established credentials such as CISA and CISM. Until regulation catches up, however, Prusch warned the onus is on businesses themselves.

“Every organization that is utilising AI without proper controls, without understanding risk, without governance policy principles, without cybersecurity awareness, is exposing that company to a traumatic amount of risk,” Prusch said.

FOLLOW US ON SOCIAL MEDIA

You can lose a job to AI, but in California, a human has to make the decision to fire you.

California Governor Gavin Newsom has signed into law the No Robo Bosses Act 2026, requiring human oversight in the workplace specifically when it comes to firing or disciplining workers.

Act SB 947, as it's officially known, was introduced by Senator Jerry McNerney to push back against the use of automated decision making systems (ADS) in the workplace. In a statement, McNerney's office pointed to the rise of "bossware" products used to manage workplaces, which have led to people being mistakenly fired. The new law doesn't outright ban the use of such systems, but requires a human in the loop.

“No worker should ever be fired or disciplined by a robo boss," said McNerney, in a statement. "Artificial intelligence systems have the potential to increase productivity, but they’ve also been prone to errors, bias, and misjudgments.”

McNerney added that the aim is ensuring human oversight in workplaces. “AI must remain a tool controlled by humans, not the other way around," he said.

California has led AI regulation, with laws requiring frontier AI developers to report safety incidents and publish safety frameworks, forcing AI generated content to be labeled as such, and creating a registry for AI auditors, alongside rules targeting political and sexual deepfakes, and AI generated unauthorised replicas of performers, among others. Newsom signed into law a list of other AI rules this week, including banning lawyers from handing over core work wholly to AI and requiring educational institutions to train staff and students about AI.

"Super intelligence is clearly not coming from the White House – that’s why California continues to lead," Newsom said in a statement. "AI should expand opportunity – not come at the expense of workers and families. As this technology reshapes the workplace, California is putting people at the center, ensuring we all have a voice in the decisions shaping their future."

No robo bosses

The robo boss legislation has three points. First, it bans employers from relying solely on ADS to make firing or disciplinary decisions. Second, it requires human oversight and verification when employers do use ADS to assist in those decisions. And third, if a company does use ADS for termination or disciplinary decisions, the impacted worker must be informed.

The rules will be enforced by the California labor commissioner, state attorney general, or local prosecutors. Similar laws are in the works in a handful of other states.

The law was backed by the local labor union, with Lorena Gonzalez, president of the California Federation of Labor Unions saying the law gives "other states and the nation a clear example of how, by letting workers lead, we can stop some of [the] worst abuses of AI at work."

SB 947 originally included a provision to notify employees if an AI system would impact their work, but Newsom vetoed it saying the focus should be on misuse rather than forcing "unfocused notification requirements on any business using even the most innocuous tools," he said at the time. That aspect was removed, as were protections for gig workers.

Rise of AI workplaces

The move comes as management becomes increasingly automated or algorithmically controlled. A survey from the OECD last year found that 90% of American managers polled said they have at least one such tool in place, versus 79% across Europe and 40% in Japan.

Beyond prevalence, that study also found that US companies were more likely than European counterparts to use algorithmic management for monitoring or evaluating workers even if it involves personal data and has "consequential outcomes" such as access to work. The study added that two-thirds of managers were concerned about the impact on workers, particularly with regards to unclear accountability in the case of incorrect decisions.

One example of that playing out now regards Meta, which faces a lawsuit after the Facebook-owner attempted to apply AI to monitoring and managing its own workers earlier this year, taking into account everything from token usage to keystroke monitoring – and reportedly using that data when deciding on a massive round of layoffs.

In response, a group of former and current staff have sued.

"Meta used a constellation of internal artificial intelligence systems – including a system referred to internally as ‘Metamate,’ employee-trained ‘second-brain’ agents, keystroke- and activity-monitoring data, AI-token-usage dashboards, and algorithmically assisted performance ranking and calibration – to score, rank, and select employees for inclusion on the list," a court filing reads, noting the system disadvantaged those on leave, including for maternity or disability.

UK tech leaders are calling on the government to invest much more heavily in sovereign AI.

In an open letter to Andy Burnham and AI minister Kaniska Narayan, executives from defense, financial services and critical national infrastructure firms say there's an urgent need to strengthen public confidence and national resilience.

Signatories include AI lab Cosine, PA Consulting, BT, Telefónica Tech, Leonardo, HPE, Kainos and Sopra Steria.

"AI is now a question of national capability. Countries with reliable access to compute, secure deployment pathways, strategic models, and effective procurement will have greater resilience and influence," the letter reads.

"Countries that lack those capabilities risk becoming dependent on decisions, infrastructure and operating conditions elsewhere."

The group wants to see financial support of at least £20 billion over the next five years, through public investment, procurement guarantees, and co-investment. This, they said, should be targeted at establishing sovereign British AI compute, power, data-center capacity, and network infrastructure for government, defense, academia, and strategic industry.

It's calling for changes to planning laws, energy policy, procurement, and long-term contracts to help AI firms, and a fast-track sovereign AI procurement route for urgent national priorities.

There should be financial backing for UK-led model development, with government, defense, and the NHS gaining access to proprietary British datasets for training these models, with strict privacy safeguards, mandatory audit trails, and interoperability standards.

"No mission-critical public service or critical national infrastructure should depend on a single model, provider, or cloud stack," Cosine said.

"Independent testing, evaluation and monitoring of AI models is essential to enable safe, secure and trusted AI adoption. Mandate tested fallback arrangements, independent alternatives, and human-in-the-loop control for all high-consequence AI systems."

The government, said the firms, should identify the areas of the AI value chain where the UK can become world-leading, then align infrastructure, procurement, research, regulation, and investment behind them. It should create a cross-party ten-year Sovereign AI Strategy with clear objectives, annual accountability, and long-term funding certainty.

Infrastructure, common standards, and interoperable systems should be shared with like-minded nations.

And it should identify the areas of the AI value chain where the UK can become world-leading, then align infrastructure, procurement, research, regulation, and investment behind them. It should create a cross-party ten-year Sovereign AI Strategy with clear objectives, annual accountability, and long-term funding certainty.

"Britain is coming from a position of strength. It has world-class research, deep software talent, strong cyber capability, credible institutions, strong digital infrastructure, and real advantages in science, defence and public services," the letter reads.

"But without a plan for AI sovereignty, the UK risks becoming a customer in the most important technological shift of this era, rather than a serious builder."

Earlier this year, the government launched a £500 million Sovereign AI fund aimed at helping domestic AI companies scale.

This will act as a venture capital fund within the government, making targeted investments in UK AI firms, and providing direct access to the UK's fastest AI supercomputers, along with specialist R&D support and grants.

Across the markets we work in, NIS2 has moved from a future concern to a present one. It's a single EU directive, but it only takes effect once each country has written it into national law, and member states have moved at very different speeds. In two of them, it is already in force: Germany, since 6th December 2025, and Greece, since November 2024.

Close behind is France, where NIS2 has been folded into a broader resilience law. Ireland has not passed its law yet, but its National Cyber Security Centre is already acting as the regulator.

While these laws take effect on different dates — some already passed, some still to come — the destination is the same: every one of these markets is heading to full NIS2 enforcement.

The channel has spent the past year preparing for this reality, but unfortunately, a lot of that effort has been misplaced. Much of the conversation I hear treats NIS2 explicitly as a sales opportunity — selling compliance, audit, and security products and services.

That instinct isn't wrong: there is a commercial opportunity here. But the full picture is that NIS2 has broader implications for the channel itself, and partners and MSPs need to understand that before they rush to sell. Because NIS2 pulls partners into their customers’ compliance posture and has them assessed as suppliers, your own security is being checked.

The obligation that arrives through procurement

Of course, none of this is new on paper. The supply-chain duty has been in NIS2 since 2022. What's changed is that as each country writes the directive into law, it has gone from text on a page to something your customers must now act on.

Article 21 requires organizations covered by the law to manage the security of their supply chain, including the security of their direct suppliers and service providers. In other words, a company is now responsible for the security of its suppliers, as well as its own. The European Commission has gone further and set out detailed rules on how this should work for digital providers, including Managed Service Providers (MSPs).

So, for the channel, the consequences directly affect you. If your customer is covered by NIS2 — a hospital, an energy company, a bank, a government body, a large manufacturer — its obligations do not end with its own systems. They extend to the suppliers it relies on. The customer now must assess and record the security of those suppliers, and a reseller with access to its systems, or an MSP managing part of its IT, is exactly the kind of supplier the law has in mind. If your customer falls under NIS2, part of that compliance burden now lands on you.

Belgium’s national cybersecurity authority has told any organization that might sit in the supply chain of a covered customer to meet a baseline security standard and has confirmed that a covered customer can require a particular standard from its suppliers through the contract. Irish guidance says the same in commercial language: suppliers of hardware, software and IT services should expect to prove they meet their customers’ NIS2 requirements.

So how might this look? For a partner, your interaction with NIS2 may be in the form of a request from a customer. To meet its own obligations, that customer has to be confident its suppliers are secure, so it starts asking you to prove it. A security clause appears in the contract. The service-level agreement gains tighter terms. You receive a supplier security questionnaire that has to be completed before the deal can close.

None of this stops at the EU's borders. The UK left the EU before NIS2 existed, so while the directive does not bind UK companies directly, the obligation travels through the supply chain regardless. A UK reseller or MSP that supports EU customers, the UK operations of an EU-covered group, or cross-border critical sectors sits in exactly the chain a covered customer must now account for.

Compliance is not just a product the channel can sell

Let’s look at what NIS2 actually asks of the organizations it covers. Most of it concerns how a company governs its own security: the decisions it makes, the processes it follows, and who is accountable for them. These duties sit mainly in two articles. Article 21 is a list of governance and process requirements: managing risk, handling incidents, checking your own suppliers, and being able to prove it. Article 20 makes a company’s senior management — its board or equivalent — responsible for approving and overseeing those measures and says they can be held liable when the company gets it wrong.

For the most critical organizations, enforcement can go as far as temporarily banning a senior manager from their job. In plain terms, the people at the top now carry the compliance risk personally. None of that is simply something a customer can buy off a product catalogue. A customer can own every security and audit product on the list and still fail an assessment, because it cannot show that anyone is accountable for how those products are used.

What the customer needs is help putting together a security setup it can defend to a regulator. They also need accountable suppliers and partners willing to work towards the security of these systems. That is old-school, relationship-building work, and exactly where a distribution partner can help. No single vendor meets NIS2 on its own. It takes a combination of products and the people who can run them – and a distributor that already works across those vendors can point a partner to the right security solutions and specialists.

The partners who sort out their own security first

The partners who do well out of NIS2 will be the ones who accept that they are now part of their customers’ compliance posture, whether they like it or not. Two things follow.

The first relates to your own security. If you are going to be assessed as a supplier, you need everything documented before customers start asking: your controls, how you handle incidents, who your own suppliers are. The partner who can answer quickly is the easy supplier to keep.

The second is about what you sell, and how you sell it. For partners, the conversation that delivers value is no longer “here is a compliance product.” It is “here is how we help you manage this, prove it, and account for the parts that run through us.” For a distributor, this is familiar ground. Our job has always been to do the assessment work, so partners do not have to do all of it themselves: to vet the products we sell our partners and take responsibility for them.

That kind of assurance — being able to vouch for the security of what you supply — is exactly what NIS2 now pushes down the chain. Each supplier must satisfy the customer above it, and it happens through contracts rather than goodwill. Your customers will start asking it of you, the same way you have always been able to ask it of us.

NIS2 was written to push cybersecurity up to the board and to make companies answerable for the security of their suppliers. Trust between a customer and its suppliers now has to be proven and recorded, whereas before it could be assumed. That is more work, and it is also where the opportunity is: the partner who can show its own security is in order and help a customer account for the parts of their systems that run through it, becomes the supplier a procurement team keeps rather than the one it is told to review.

In a market where it is easy to switch distributors or resellers, that is worth a great deal.

Meta has confirmed plans for a trade union access agreement in a move that will allow Prospect to speak to employees about membership.

Under the agreement, Prospect will be granted access to some 5,000 Meta staff located across the UK. This will allow the union to talk to staff about the benefits of union membership, the work of the union, and recruit prospective members.

Prospect represents over 160,000 workers across the UK, with roughly 50,000 of those working across the broader science and technology ecosystems.

While Prospect already has members at Meta, this marks the first formal agreement reached with the tech giant. A spokesperson for Meta told ITPro the move builds on discussions first sparked between the two organizations earlier this year.

“Employees who want to find out more about union membership have a straightforward way to do so,” the spokesperson said.

“Meta's industrial relations team already works with employee representative groups in multiple markets, and we are approaching this in the same way."

Meta moves ahead of new union rules

The move by Meta comes in the wake of changes to union membership entitlements introduced in the Employment Rights Act 2025. The Trade Union Right of Access comes into force in October, for example.

Mike Clancy, General Secretary of Prospect, said the agreement represents an “important step towards giving Meta workers a stronger voice at work”.

“Prospect has always believed that tech workers need unions just like other workers, and this agreement enables us to make our case to Meta workers and build on our existing membership there,” he said.

“It is to Meta’s credit that they have struck this voluntary deal with Prospect, rather than waiting for the new Right of Access to kick in, sending a positive message to staff that they are open to engaging with a union.”

FOLLOW US ON SOCIAL MEDIA

Fears of AI sparking an existential crisis for humanity have been batted away by American President Trump, who called the predictions a "hoax" in an interview-interrupting phone call to Nvidia's CEO.

Last week, an Anthropic researcher quit the company over concerns that the AI arms race was unsafe for humans. One of his colleagues subsequently predicted there was a more than 10% chance that AI will end humanity in the near future.

That sparked a call for greater regulation of AI and calls from inside the industry – including from Anthropic CEO Dario Amodei – to slow down the pace of frontier model development, with the US Congress looking set to demand action.

The fears of AI superintelligence causing harm to humans aren't new, and plenty of experts have suggested this is another phase in the AI hype cycle, designed to boost Anthropic ahead of a looming IPO, let AI companies self-regulate, or slow the progress of challengers such as China to keep them from catching up.

Trump calls AI fears a hoax

Trump also disputed the AI doomerism fears, though for different reasons. His addition to the discourse came via a phone call to Nvidia's CEO Jensen Huang, who was onstage at the All-In Summit in Los Angeles, California at the time. Huang answered the phone, put it on speaker mode, and informed Trump that he was "speaking with the world".

"The robots will not be taking over," he said. "The AI will not be taking over the rest of the world. The whole thing is a hoax."

"I'm telling you, it's all a hoax," Trump continued. "The data centers are great, and they make people wealthy, and they make states wealthy. And it's the oil of the next 20, 25 years."

Of critics, he said: "They're just playing into the hands of a lot of people that don't want to see it happen. And that could be political people, it could also be China, and we're not going to let that happen. It's a hoax."

Trump did admit that "we have to be careful" and "do things prudently", but added: "that doesn't mean we're going to stop an industry".

At one point, Huang responded: "We're going to make sure that everybody wins in the AI race in America. Every industry, every company, every state, every people."

No guardrails, just Trump?

The call echoes other comments made by the American president on his personal social media site, which said pushback against the technology was a "sick conspiracy." Trump also said that Anthropic's CEO was "pretending to be a 'perfect little angel'" and that the US administration had previously stopped Amodei and other "AI people" from doing "bad or potentially bad things".

Rather than regulation or a pause in development, all AI needs is a "strong and smart" president.

The American people don't necessarily agree. A poll by the University of Massachusetts found only 23% of people approve of Trump's handling of AI, versus 57% who disapprove. A separate study from the University of Maryland found 85% of Democrats and 79% of Republicans want AI regulated and monitored by a government agency.

Congress also doesn't appear to agree with Trump, with Democrats and some Republicans pushing for action – though as one noted, government regulation of the technology might not come easy given the current political climate. Rick Scott, a Republican senator for Florida, reportedly said: "Did we balance the budget? Oh, did we pass a budget? See, what have we gotten done? So you think we're going to get AI done?"

FOLLOW US ON SOCIAL MEDIA

A cross-party group of MPs and peers is calling for a new AI Bill to address the threats AI poses to human rights.

In a report, the Joint Committee on Human Rights (JCHR) said the existing regulatory and legal framework is inadequate, and that new legislation should be introduced.

A single, independent AI oversight body should be established on a statutory basis, acting as the central point of contact for raising concerns about the use of AI, overseeing AI firms and monitoring harms and risks. It should have strong powers to hold AI providers to account, including setting codes of practice, transparency requirements and the power to impose sanctions.

"AI is heralded as an unprecedented era of technological development with the potential to transform our lives for better or for worse," said JCHR chair Alex Sobel.

"It is moving with such speed and complexity that its impact is hard to accurately predict. What is clear is that at present we are unprepared to deal with its consequences, however potentially dire they may be."

Currently, the committee said that model developers engage with the AI Security Institute on a voluntary basis, with the institute having no statutory power. As a result, regulators have no powers to test and evaluate AI systems before they are released, or to prevent their release if they are considered to pose unacceptable risks.

Meanwhile, the current legal framework relies on harm-specific and sector-specific legislation, failing to address preventable human rights risks.

"Nowhere in the world, including the UK, has a current legislative and regulatory approach to AI that is fit for purpose," said Sobel. "New legislation is needed to establish a comprehensive set of protections that deal with the entire AI supply chain and its lifecycle."

A new bill, said the committee, should distinguish between low-risk AI systems, which should be subject to fewer and less demanding legal requirements, and higher-risk AI systems and models, which should have more demanding obligations.

Some uses of AI, said the committee, should be banned altogether, because they're incompatible with human rights: subliminal techniques and inappropriate use of profiling or biometric data, for example. There should be a public consultation over the detail of what is prohibited.

All stages of the AI lifecycle should be addressed, said the JCHR, with the entire supply chain required to carry out due diligence to prevent an unacceptable risk to human rights when designing, developing or deploying AI systems. These requirements should be graded based on their role in the supply chain and the seriousness of the risk they represent.

Transparency should be improved across the AI lifecycle, with AI systems that can have significant impacts on individuals, groups and communities required to state when AI systems are being used and how.

And there needs to be greater clarity in data protection law to ensure these safeguards operate effectively in practice, with robust protections against the misuse of automated decision-making.

"Today's report from the Joint Committee on Human Rights gives further support to those making the argument that the UK's current patchwork of sector-specific regulators is struggling to keep pace with AI's risks to fundamental rights," said Sophie Sheldon, partner at international law firm Simmons & Simmons.

"Whether government now makes moves toward a single statutory oversight body and a more EU AI Act-style framework, or continues refining the cross-sector approach, the pressure for a single legislative answer is growing."

The report comes after recent warnings from AI firms that the pace of development needs to be slowed. Over the weekend, Anthropic CEO Dario Amodei said he was worried that AIs could soon be capable of becoming a swarm that could take over the entire internet; Elon Musk and OpenAI co-founder Sam Altman have expressed similar concerns.

This week marks a major milestone in the phased introduction of the EU’s Cyber Resilience Act (CRA), with the introduction of new requirements for products with digital elements.

The aim is to make developers and manufacturers more responsible for cybersecurity, to tighten up reporting requirements, and to ensure that they deal with any problems promptly.

“The Cyber Resilience Act will strengthen the cybersecurity of connected products, tackling vulnerabilities in hardware and software alike, making the EU a safer and more resilient continent," said lead MEP Nicola Danti.

So what do the changes mean? Here are three things businesses need to know about the legislation.

Cyber Resilience Act imposes Initial reporting requirements

First, manufacturers must now notify the European Union Agency for Cybersecurity (ENISA) of any actively exploited vulnerabilities within 24 hours. The report should include any relevant information, such as whether the event might be malicious.

They should then provide a full report within 72 hours, including an initial assessment of the severity of the incident, the type of vulnerability, any mitigation measures that have been taken and recommended actions for users.

A final, detailed report will need to be submitted within 14 days in the case of an actively exploited vulnerability or a month for a severe security incident.

Ilkka Turunen, field CTO at Sonatype, said many organizations may struggle to comply on this front, largely thanks to a lack of clear understanding of the software they ship.

"The average software supply chain is over 180 external components, and in 2025 Sonatype found nearly 1.8 billion downloads that had risks with fixes available, but ignored. This shadow inventory is set to grow with the rise of AI development," he said.

“Teams need to know which products contain the affected components, which versions are exposed and inform both the regulator and their customers. If that picture has to be reconstructed manually during an incident, the reporting window will be nearly impossible to meet."

Focus on full lifecycle

Cybersecurity risks need to be considered across the full lifecycle of the product, including planning, design, development, production, delivery and maintenance.

Assessments will need to be documented and updated throughout a product’s supported life.

These new requirements apply to all products with digital elements that are available in the EU, including those already on the market.

“For developers not used to operating in regulated industries, particularly those designing individual elements or components embedded into wider products, this creates several new challenges," said Andrew Longhurst, managing director at Wittenstein High Integrity Systems.

"Chief amongst them is designing ‘out-of-context’ – building (and securing) a hardware or software element before knowing its final application or end-user environment. This will impact developers both upstream and downstream and could prove a major hurdle for those wishing to continue selling into Europe."

Penalties

The cost of noncompliance is high. Organizations face fines of up to €15 million or up to 2.5% of their total worldwide annual turnover for the preceding financial year, whichever is higher.

"European firms are now having to build security directly into their products from the design phase and will have a significant global advantage," said Vincent Lomba, chief product security officer at Alcatel Lucent.

"As a result, these rules will establish a new international benchmark. It will force tech suppliers around the world to up their resilience practices in order to continue to compete with the European supply chain."

FOLLOW US ON SOCIAL MEDIA

Peers have called on the UK government to introduce emergency powers such as an ‘AI kill switch’ to shut down dangerous systems and protect national security.

Liberal Democrat Lord Tim Clement-Jones proposed the measures as part of an amendment to the Cyber Security and Resilience Bill, also recommending that the government shut down data centers in the event of a national security threat.

Per reports from the BBC, Clement-Jones said the new powers would be a “vital safety net” aimed at halting a “runaway system before it can compromise our critical national infrastructure”.

The proposals come amidst rising concerns about the potential risks associated with powerful new AI models. Providers such as OpenAI, Anthropic, and Meta recently admitted that AI agents escaped test environments and breached third-party companies.

Security experts have also warned that the use of AI among cyber criminals is growing, with state-sponsored threat groups and ransomware gangs leveraging the technology to refine tactics and support attacks.

Simon Edwards, CEO of SE Labs, said a serious conversation is required on how to contain potentially risky AI systems.

“As AI is becoming increasingly autonomous, it is posing a huge threat to individuals and businesses of all sizes, on top of our critical national infrastructure,” he said.

“First-hand, we’ve seen how agentic AI tools can go rogue, and the question is to what extent could these AI systems get out of control before they cause serious harm?”

Edwards said the introduction of a “dedicated national cyber strategy” which takes AI risks into account should be a top priority for lawmakers.

Could an AI kill switch work?

The concept of an AI kill switch is by no means new. As ITPro previously reported, proposals on this front were being touted by industry stakeholders during the early days of the generative AI race.

In the wake of recent security incidents involving OpenAI agents, US lawmakers have also put forward similar proposals, including the ‘AI Kill Switch Act’.

Mark Boost, CEO at UK-based cloud provider Civo, welcomed the proposals in the House of Lords, but warned there are a variety of factors that could impede any efforts to introduce a kill switch.

“It’s reassuring to see Parliament finally waking up to the catastrophic risks of unmonitored, runaway technology,” he said.

“UK ministers having emergency powers to deactivate powerful AI systems and switch off the country's data centers is a necessary safeguard. But it only solves half the problem regarding our national security.”

Sovereignty is the first line of defense

In particular, Boost suggested that the UK is over-reliant on foreign tech providers and called for a broader effort to boost sovereignty capabilities.

“But the best way to eliminate existential security risks is to stop our overreliance on foreign tech giants in the first place,” he said.

“For many years now, we have warned that by lacking true digital sovereignty the UK is handing foreign powers and overseas tech monopolies an effective kill switch over our critical national infrastructure, defence systems, and digital economy.”

Research shows businesses in the UK and across Europe are growing increasingly concerned about the prospect of a US government-imposed kill switch for cloud services.

In a survey by Proton, nearly three-quarters of respondents (74%) said they were worried about having access to services cut off. Some ranked it as a bigger risk than cybersecurity threats such as ransomware.

Boost said that, ultimately, the introduction of a legislative kill switch is a good first step in bolstering national resilience. However, he insisted it “must be paired with procurement policy that puts UK-built, sovereign technology first”.

“We must stop playing tenant on our own land. We need to start acting like architects to power an independent AI future.”

FOLLOW US ON SOCIAL MEDIA

The government has outlined proposals for new powers under the Cyber Security and Resilience Bill aimed at boosting cyber defences for the UK's essential services.

With hostile cyber attacks and sabotage on essential services like energy, water, transport, and healthcare on the rise globally, vendors and companies with connections to hostile states pose a 'growing and serious' threat to the UK’s security.

The idea is for the government to be able to step in when essential service providers are looking to buy equipment or technology from suppliers that could pose a critical national security risk.

"These new powers mean we can act before a threat materializes, not just after the damage is done. By working together with industry, we're putting national security at the heart of how essential services choose their suppliers," said cyber security minister Liz Lloyd.

"This is about staying ahead of a growing threat, and giving the public confidence that the everyday services we depend on like water and energy supplies, our transport network and hospitals, are protected."

New cyber safe procurement guidance would be made available for all essential service providers to help them secure their supply chains. Providers will be able to refer themselves for a risk assessment if they're unsure about a vendor – and be given advice on how to mitigate any risks.

Meanwhile, the package would grant the government new legal powers to issue binding directions to essential service providers, including requiring extra security measures, a phased withdrawal, or in the most serious cases, an outright ban on acquiring a vendor or supplier's products or services.

Growing state-backed threats

The proposals come amidst growing concerns over the impact of state-sponsored cybersecurity threats.

Earlier this year, the National Cyber Security Centre (NCSC) warned that the UK is experiencing increased threats from Iranian-backed cyber groups, with a heightened risk of indirect threats for organizations with a presence, or supply chains, in the Middle East.

Government figures indicate that an outage caused by a cyber attack on London and Southeast England's electricity networks could potentially cost the economy up to £442 billion over the following five years.

Just this week, the vulnerability of key UK infrastructure was brought into focus by the news that Iranian-linked hackers were been able to knock a small power plant offline for four days.

The attack, which targeted internet-exposed programmable logic controllers (PLCs), is believed to be the first of its kind in the UK.

The amendments to the bill were laid before Parliament on Monday, ahead of Lords Committee stage scrutiny, which is set to begin in September.

FOLLOW US ON SOCIAL MEDIA

The UK could consider strict AI regulation amidst rising concerns over ‘rogue’ AI cybersecurity risks, according to reports.

So far, both the US and the UK have taken lighter approaches to AI regulation, but recent incidents involving OpenAI and Anthropic have sparked calls for tougher controls.

The UK's AI Minister Kanishka Narayan told Reuters that it would consider regulation to force testing before deployment if needed.

"If the right mechanism and lever changes in time and it feels like regulation might be a way that helps us do that, of course, we will look at it," Narayan told the publication.

Narayan said that the priority remained ensuring public safety rather than "obsessing only with the mechanism."

He added that it was "really, really unique" that the UK had access to frontier AI models before release, something it shared only with the US, which has existing provisions to test AI under military rules.

That comes via the UK's AI Security Institute, previously named the AI Safety Institute, which takes – so far, at least – a lighter approach to AI regulation than counterparts in the EU.

As ITPro reported on 3 August, aspects of the EU AI Act have now come into effect, requiring proactive testing of models and a concerted focus on model transparency.

The voluntary British model has been mimicked by Australia, via its own AI Safety Institute.

Data regulation

Owing to the amount of data used by AI, these systems are also covered in the UK by its data regulator, known as the Information Commissioner's Office (ICO).

That watchdog has said it is looking into OpenAI and Anthropic following the recent cybersecurity incidents. The two companies hit headlines in recent weeks after revealing agents escaped testing environments and hit third-party organizations.

"The ICO undertakes regular proactive supervisory engagement with ​AI developers, including OpenAI and Anthropic," the ICO said in a statement sent to Reuters. "We are aware of ‌recent ⁠hacking incidents affecting the sector and are monitoring developments closely."

But that shouldn't be taken as an indicator that the data watchdog is likely to crack down on AI.

Last month, the ICO said via a blog post that it wanted to support innovation in AI via a Statutory Regulatory Sandbox. This will act as an “experimentation regime to give innovators time-limited flexibility from parts of data protection law, so they can test ideas that might not otherwise be possible," the regulator said.

The watchdog noted that public trust was necessary to allow this and that any changes to data protection law would be necessary.

Rising concerns

AI-related safety concerns have been rising in recent months, particularly with the launch of powerful new cyber-focused models such as Anthropic’s Claude Mythos.

As ITPro reported in July, Google DeepMind chief Demis Hassabis called for a global framework to test frontier model safety, albeit one led by the United States.

Later today (4 August), leaders from Meta, Anthropic, OpenAI, and Google will meet with White House officials to discuss new safeguards, though reports suggest they will remain voluntary.

The aim is to convince companies to submit their technologies to security tests, following an executive order on national security grounds.

FOLLOW US ON SOCIAL MEDIA

Aspects of the EU AI Act have come into force, bringing a new set of obligations designed to improve transparency for AI use.

The new rules aim to counter misinformation and manipulation, fraud, impersonation, and consumer deception by making it easier for people to recognize when they are interacting with AI or are exposed to AI-generated content.

"AI is a transformative technology that can bring extraordinary benefits to our people and businesses. But we are also seeing that harms can occur if AI is not properly designed and used and the most advanced models create risks on an entirely new scale. Europe anticipated this development," said Henna Virkkunen, executive vice-president for tech sovereignty, security and democracy.

"With the AI Act, we established a clear, risk-based and durable framework for trustworthy AI — one that gives innovators legal certainty while protecting the public interest. As enforcement begins, we are taking an important step towards AI that people and businesses can understand and trust, and whose benefits are shared widely across our society."

The Commission has published guidelines to help those providing or deploying AI. So what will organizations now have to do?

Here are three things you need to know about the new rules.

Marking and labeling of AI-generated content

Certain AI-generated or manipulated content must be clearly and visibly labelled and include machine-readable marks, according to the European Commission. Icons used in labelling have been made available for use.

This covers deepfake images, audio, and video content that resembles real people, objects, places, entities, or events.

Emotion recognition and biometric categorization tools, as well as text covering matters of public interest that haven't been through human review or editorial control are also covered under the new rules.

Transparency when interacting with an AI system

Transparent AI deployment and use is a key focus with the EU AI Act.

Under the new rules, providers must ensure that users are aware they’re interacting with the technology, such as a chabot, avatar, or AI agent.

“These obligations are intended to foster trust and integrity in the information ecosystem,” the Commission said in a statement.

Tim Pfaelzer, Veeam’s SVP and general manager for EMEA, said these rules should not be viewed as simply “ticking a compliance checkbox” and enterprises should implement robust audit trails and governance policies.

"While on the surface, the transparency requirements for AI governance and operational accountability might seem an easier ask than the delayed high-risk requirements, it’s far trickier to solve in practice - something that enterprises will realise when they attempt to align their AI deployments with these requirements," Pfaelzer commented.

How the rules will be enforced

AI use will be policed by national market surveillance authorities, the European AI Office - for systems under its supervision - and the European Data Protection Supervisor, when EU institutions are providers or deployers.

They can issue fines of up to €15 million, or 3% of global annual turnover for non-compliant companies, and up to €750,000 for EU institutions, bodies, and agencies.

In terms of penalties, the Commission said ‘proportionality’ will be a key focus, and any potential fines will take into account small and medium-sized enterprises or small mid-cap companies.

High-risk systems

Last month, the implementation of special rules for high-risk systems was delayed, with stand-alone high-risk AI systems now to come in scope from 2 December 2027, and high-risk AI systems embedded in products from 2 August 2028.

High-risk AI systems are defined as those presenting significant threats to health, safety, or fundamental rights.

FOLLOW US ON SOCIAL MEDIA

AI minister Kanishka Narayan has been given a seat in incoming prime minister Andy Burnham’s cabinet following a reshuffle.

Narayan described the move as a sign of Burnham’s “deep commitment to AI’s importance” to the UK economy.

“AI is likely the most significant technology in human history. Its impact will dwarf other things,” Narayan said in a post on X.

“The best case for it is compelling beyond our dreams: a reindustrialised Britain, stronger national security, public services transformed for the better. The risks, too, are real: it is right that the British public shares those worries, for jobs, for the pace of change.”

The move comes as the UK's Department for Science, Innovation, and Technology (DSIT), where the AI minister role used to sit, has been scrapped in the wake of Burnham’s appointment.

Under the new setup, DSIT responsibilities will be merged with the freshly minted Department for Business, Innovation, Science, and Trade (DBIST), led by Jonathan Reynolds.

The role of technology secretary has also been cut.

AI focus welcomed

Mark Boost, chief executive of UK-based cloud computing firm, Civo, said retaining and elevating Narayan is a reassuring signal for UK businesses.

“Giving the AI minister direct access to cabinet decisions demonstrates that the government recognizes AI’s existential importance to our future economy,” he said.

“Positioned inside a high-powered business and trade department, an AI Minister with Cabinet authority will have real leverage to break down cross-Whitehall silos, accelerate national AI infrastructure, and give British tech companies the proactive backing needed to maintain a competitive global advantage.”

Andy McLean, CEO of the UK Semiconductor Centre, echoed Boost’s comments, noting that Narayan’s new role is a “positive signal of the importance being placed on AI at the center of government”.

Boost added, however, that any delays to AI-related initiatives caused by the DSIT shake-up could have a significant impact on global competitiveness.

“Any Whitehall restructuring brings administrative friction, and because the global tech and AI arms race is moving so quickly, the UK simply cannot afford a pause,” he said.

“Critical initiatives like the AI Opportunities Action Plan and sovereign infrastructure investments must be ring-fenced from bureaucratic delays.”

FOLLOW US ON SOCIAL MEDIA

UK tech industry stakeholders have hit back at alleged plans to scrap the Department of Science, Innovation and Technology (DSIT).

TechUK, a trade association for the country’s digital sector, described the rumoured move as a “terrible signal” for a burgeoning industry, which it noted is growing at a rate of 10% per year.

“Breaking up the work of DSIT endeavours such as the world-leading AI Safety Institute, the Sovereign AI Fund, GDS, and UKRI would slow momentum at a time when pace is essential for both the growth of the economy and our standing on the global stage,” techUK said in an open letter published on 19 July.

The backlash comes after the Financial Times reported on 17 July that incoming prime minister Andy Burnham plans to abolish the department.

Sources told the publication that advisers are creating plans to hand over technology policy to a larger business department, led by former business secretary Jonathan Reynolds.

ITPro approached the DSIT for comment, but did not receive a response by time of publication.

The move would see a return to a similar setup for science and technology policy prior to the foundation of the department in 2023.

The DSIT was formed under Rishi Sunak’s premiership and given direct responsibility for policy on these fronts. The department now plays a key role in driving growth in key digital sectors and leading digital transformation across public services.

According to Dom Hallas, executive director of the Startup Coalition, attempts to incorporate DSIT within a broader business department could dilute its influence and negatively impact the broader technology sector.

“A mega department would mean British tech competing with British steel for attention. And waste 6 months reorg-ing when time is of the essence. Not good,” Hallas said in a post on X.

Matt Clifford, AI adviser to outgoing prime minister Keir Starmer, echoed Hallas’ comments in a post on X.

“This would be a big mistake,” he wrote. “Right now is a critical moment for tech as an economic and national security issue. Tying up our most senior science and tech officials in a reorg wastes time and energy that’s desperately needed for the actual substance.”

Tim Flagg, CEO of trade association UKAI, took a different view, however, saying that while an overhaul of the department might cause disruption, the creation of a “super-department” could ultimately sharpen the country’s focus on AI.

“AI has the potential to transform Britain’s economy, our public services, and our security for a generation. Rethinking which department oversees this industry does not necessarily mean Burnham’s Britain is turning its back on that potential,” he said.

“It could even signal an ambition to go further: AI elevated into a super-department or placed at the very heart of the Cabinet Office. The real danger isn’t the ambition; it’s the distraction and the delay.”

All-in on AI

A recurring theme in the pushback to the proposals lies in the timing and current tech sector trends.

The UK government has placed a strong focus on supporting the UK’s burgeoning AI sector over the last two years under the premiership of Keir Starmer, with the aim of positioning the country as a leading economy on this front.

When Downing Street announced the AI Opportunities Action Plan, Starmer described the technology as the “defining opportunity of our generation”.

2025 saw a host of major global tech firms, including Nvidia and Microsoft, pledge billions in support for the UK tech sector, with a particular focus on infrastructure build-outs.

Additional hardware and skills-related investment was unveiled by Downing Street at London Tech Week last month.

FOLLOW US ON SOCIAL MEDIA

Google DeepMind CEO Demis Hassabis says only the United States is up to the task of keeping AI safe – but it's unclear why technology rivals, notably China, would heed an American standards body.

Hassabis has called for a framework for testing frontier models, on the grounds that he believes progress has been faster than expected and artificial general intelligence (AGI) will arrive imminently.

He argues that such work should be led by the US because of its technical and economic standing.

"This US-initiated effort would provide a strong starting point for creating shared international standards on Frontier AI," Hassabis noted in a social media post.

"Since this technology is going to affect the entire planet, ideally this framework would spur the international community to reach a consensus on how to manage the most serious risks while ensuring everyone has access to and can benefit from the opportunities that AI brings."

Hassabis' call for a US-led framework for managing AI follows similar calls by Anthropic CEO Dario Amodei and OpenAI CEO Sam Altman. Following a meeting on the subject last month, China called for a global AI organization open to all countries, rather than one led by the US.

The US has pushed for AI developers to submit models a month before release for testing, while the UK has its own testing regime via its AI Security Institute; Hassabis is British, and DeepMind was founded in London before being acquired by Google.

It's unclear why international AI companies would submit to US approval. The only motivation given by Hassabis is that frontier models would be required to pass this standards body's assessment in order to be deployed in the US.

Hassabis’ comments come after Anthropic’s Mythos and Fable models were hit with a temporary export ban by the White House amidst security concerns.

How would it work

Beyond being US-managed, Hassabis described a standards body that was federally overseen, such as a public-private partnership or self-regulatory organization, pointing to the Financial Industry Regulatory Authority (FINRA).

"The Standards Body would be responsible for developing assessment protocols and working with appropriate federal agencies and the US National Labs to conduct testing in areas relevant to national security," he said.

Anyone making a "frontier model" – as defined by a set of benchmarks – would be considered a "frontier lab", and be "encouraged" to adopt certain best practices.

This would include publishing technical details, ensuring internal security is up to standard, vetting key personnel, and adequate resourcing safety research.

Non-frontier models, such as those made by startups or academia, would not be expected to take part.

Hassabis also called for frontier labs to share new modes with the standards body 30 days before release, something the US government has pushed key developers to do with their AI models.

"Once the assessment protocol is shown to be effective and robust, formalisation could quickly follow, meaning that Frontier Models would be required to pass it to be deployed in the US market," Hassabis said. "Labs would also work with the Standards Body to address any critical post-release vulnerabilities."

Assessments conducted by the standards body would evaluate security, biological, and other threats, and check how well they withstood attempts to dodge guardrails. The tests would be regularly updated.

"The strength of this approach is it would be technically focused, while at the same time supporting innovation and incentivising responsible behaviour," he said.

FOLLOW US ON SOCIAL MEDIA

Stronger powers could be needed to regulate the use of AI in financial services as consumers flock to the technology for advice, according to the Financial Conduct Authority (FCA).

Following an investigation into the technology and its impact on consumer finance activities, the regulator has recommended a formal review into how to regulate the use of general-purpose LLMs across the industry.

The FCA report – known as the Mills Review after its author – noted that companies and consumers are increasingly delegating decisions about finances to AI and AI-powered systems.

A survey by the regulator found that one-in-five adults were already open to the idea of general-purpose AI tools – such as Claude, ChatGPT, or Gemini – making financial decisions on their behalf, in particular around debt advice, pensions, and investments.

While that could help reduce existing challenges such as "advice gaps" and friction around switching services, the FCA warned about risks including fraud and scams, as well as disrupting market structure and competition.

"AI offers a once-in-a-generation chance to close the information asymmetries and frictions that have long left people making poor financial decisions," said FCA executive director and report author Sheldon Mills in the forward to the review.

"The right spur, in retail financial services, is ensuring consumers can make healthy ones; regulation, whether supportive or restrictive, should serve that outcome."

The FCA noted that many consumers may not be aware that they have no formal recourse if something goes wrong, and said some assume they receive equal protection akin to traditional sources of advice.

Emma Banymandhub, CEO of The Payments Association, agreed that the gap in understanding could cause issues and urged caution on the part of consumers.

"Consumers may be increasingly comfortable using AI agents for routine tasks such as weekly shopping, but AI-driven savings and investment decisions present a very different set of challenges," Banymandhub commented.

"While AI can increasingly explain investment concepts and analyse financial information, personalised investment recommendations remain subject to important regulatory constraints."

AI gains traction in financial services

The financial services sector has rapidly emerged as one of the key growth spaces in terms of the use of AI, with a host of major providers across the UK ramping up adoption of the technology.

As ITPro previously reported, high street lenders such as Nationwide, Lloyds Banking Group, and Yorkshire Building Society have all made significant strides on this front over the last six months.

A parliamentary inquiry into the use of AI in financial services, published in January 2026, found that the sector “substantially outpaces” others with regard to AI adoption.

Indeed, around 75% of UK-based financial services firms are now using the technology, with insurers and large banks among the most aggressive in their pursuit of AI adoption.

Running parallel to this, the use of AI by consumers is also surging, according to research from Lloyds Banking Group. The firm’s 2025 Consumer Digital Index found that AI has “rapidly become a financial tool for millions across the UK".

56% of adults – equivalent to around 28 million people – revealed they’d used AI over the preceding 12 months for financial advice. ChatGPT, for example, was referenced as the most popular platform in this regard, used by six-in-10 consumers.

What the Mills Review recommends

With this in mind, the Mills Review recommended that the existing "regulatory perimeter" needs to be secured and adapted to take in AI's impact on retail financial services – and that should come via a review within the next six months into how AI is affecting the market.

"The review should examine how consumers use AI including general purpose LLM tools for personal financial management across savings, investments, pensions, mortgages and debt management, and the implications for competition, innovation and growth," the Mills Review said.

"It should examine the risks of consumer harm, including how far its usage has or will move along the autonomy spectrum, and any impacts on market integrity and the potential for regulatory arbitrage."

Based on that review's guidance, the FCA could tweak regulation as necessary, the report said. Beyond that, the review called for the FCA to monitor for evidence of harm and new consumer models, engage with providers for better insight into changes, and be ready with intervention tools and mechanisms as necessary.

Frontier model monitoring in finance

In the longer term, the Mills Review called for the FCA to keep an eye on frontier model capabilities and AI adoption, considering its impact on its regulatory work, in particular where use of AI falls outside of existing protections and once AI agents start taking more action on behalf of consumers.

The review also called for stronger powers for the FCA so it can look at these issues more widely.

"As is clear in the report, we need to keep pace with a rapidly changing environment and the principles-based, outcomes focussed approach we’ve taken on AI – relying on the Consumer Duty and Senior Managers Regime – has been critical to us doing so," said Ashley Alder, chair of the FCA.

"The recommendations build on work the FCA has been doing – not least allowing firms to test their use of AI with us – and our own use of AI to be a smarter regulator, more efficient and effective."

Banymandhub added that walking that balance between enabling AI and protecting consumers and companies was key.

"The FCA’s Mills Review reinforces that firms should treat agentic AI as an accountability and governance issue now, while providing greater confidence to innovate responsibly as AI adoption accelerates," she said.

"AI has enormous potential for financial services, but realising that potential will depend on strong governance, clear accountability and maintaining consumer trust."

FOLLOW US ON SOCIAL MEDIA

Europe’s complex network of overlapping regulations is hitting startup founders hard and holding back business, according to a new research by startup support organization DutchBasecamp.

Some 79% of tech founders claim they've been hit by regulatory friction over the last year, according to the The Realities of Scaling in Europe report, which was launched in partnership with the Computer & Communications Industry Association (CCIA).

More than half (58%) said they'd delayed entering another EU market, 45% have paused or canceled features, and 44% have experienced delayed or lost deals.

As negotiations on the Digital Omnibus continue, the CCIA warned that many meaningful simplification measures could fall by the wayside, which has the potential to further compound challenges faced by startups.

Some member states are resisting a proposal allowing businesses to report a cybersecurity incident once, rather than separately under seven overlapping frameworks.

Meanwhile, a fix that would establish legitimate interest as a legal basis for responsible AI training has been stripped out.

While postponing certain deadlines has provided some breathing room, many simplifications have been rejected, leaving developers with limited implementation time while essential codes, guidance, and standards are still missing.

“We warned from the start that the Commission’s proposals to simplify the patchwork of EU tech and digital rules were only the bare minimum. Instead of going further, Parliament and Council are now weakening, rejecting, or delaying even the most basic fixes," said Daniel Friedlaender, senior vice president and head of CCIA Europe.

“Europe’s innovators have shown remarkable patience in navigating today’s regulatory maze, but that patience is running out. EU institutions and member states need to wake up: 2026 must bring real improvements for tech companies. Europe knows the problems. If we refuse to fix them, we can’t be surprised if our founders look outside the EU for success.”

Growing regulatory friction

Nearly a quarter of survey respondents said they'd spent more than 30% of their budgets on compliance costs, while 24% are considering or have already relocated their headquarters due to regulation.

In January, the European Investment Bank, with the European Commission, found that roughly one-in-ten EU scale-ups have relocated abroad, with around 85% of those moving to the United States.

The Commission’s Joint Research Center put the headquarters-relocation rate for venture-backed startups at between 3.3% and 4.3%, ten times the rate for comparable non-VC-backed firms.

More than half of founders said they'd steered clear of an EU country because of regulatory concerns, and only 21% said they'd seen no material impact from EU or national rules.

"Europe is already losing tech founders, products, and growth," said Masha Moisseyeva, managing director of DutchBasecamp.

"When 45% of those surveyed have paused or cancelled features, 58% have delayed entering another EU market, and 44% have lost or delayed deals in a single year, the urgent need for regulatory simplification is no longer a theoretical debate about EU competitiveness. The damage is happening now.”

Regulatory confusion is rife

Much of the cost, the researchers found, comes not from compliance itself but from not knowing what compliance will require.

Indeed, founders often cite uncertainty surrounding future EU AI Act obligations before any requirement has formally bound them.

“Founders are not asking the EU to lower its standards. They are asking for clear, workable rules they can rely on across the Single Market," said Moisseyeva.

"Instead, uncertainty and overlapping obligations are dictating what they build, who they serve, and how fast they grow.”

FOLLOW US ON SOCIAL MEDIA

People in the technology sector often joke that anything new in winter will be obsolete by spring. This is especially the case in cybersecurity, where hacker groups and cybersecurity teams are locked in an ever-escalating war of attrition.

The speed of obsolescence far outpaces the legislative process: it can take up to two years for government bills to be enacted into law. This is due to the parliamentary process, where various readings, committee hearings and reports are required to ensure that bills are adequately scrutinized.

An outdated system

“The legislative process in this country is essentially a Victorian process, in the sense it takes a long time,” says James Morris, chairman of CSBR, who spoke to ITPro earlier this month at InfoSecurity Europe in London.

“Meanwhile, the world is changing every day. How you deal with that is, I think, a question of not wanting to try and do everything at once.”

Legislation tends to lag behind technology as the speed of technical innovation far outpaces the law-making process. Therefore, cybersecurity legislation risks becoming redundant before it is enacted.

Compounding this challenge is the intensification of cyber threats, in particular the problem of state-sponsored hacker teams and organized crime groups repeatedly targeting national infrastructure for financial or political gain.

“The Cyber Security and Resilience Bill represents a step change to our national security that will protect the services people rely on every day - reducing the risk of disruption to public services and businesses, and ensuring a faster national response when threats emerge,” said a spokesperson for the government.

“The Bill gives government powers to update cyber regulations as risks evolve, so our defences can keep pace with evolving threats. But there is also a lot we can do, and are doing, outside legislation. For instance, we're urging organizations across the economy to boost their resilience by signing up to the Cyber Resilience Pledge.”

As few politicians have an in-depth understanding of cybersecurity, they hence rely on committee hearings in order to become informed on the subject. However, the expert speakers have purely an advisory capacity, so governments are not bound to abide by their guidance.

As a consequence, there is often friction between government regulators and private enterprise. The government regulators could perceive emerging technologies as a potential risk to the public, whilst technology companies might consider that regulatory guard rails hamper development and innovation.

Regulation vs innovation

“There's a tension between regulation and innovation, and wanting the UK to be a technological cyber power in its own right,” says Morris.

“That’s a constant tension in policy, and that applies to the Cybersecurity and Resilience Bill as well, because as that regulatory system starts to get embedded, it's going to have an impact on small and medium-sized companies. We don't want to over-regulate markets which present the UK with growth opportunities.”

Given the rate of progress in technology, acts of law set broad expectations, with associated government regulation intended to give specific minimum expected requirements. Regulations are far easier to revise than government acts, as they often incorporate the so-called Henry VIII powers.

Henry VIII powers are clauses within government regulation that bestow upon government ministers the authority to change secondary legislation (such as regulations) without oversight from Parliament. However, the lack of transparency in Henry VIII powers means they often have restrictions on the extent of their authority, in order to limit potential abuse.

In order to ensure accountability for Henry VIII powers, the authorising partner can be cross-examined before a parliamentary committee on the reasoning behind regulatory updates they actioned.

Organizations can help by engaging with the legislative process, through offering their expertise to parliamentary committees, which regularly seek expert views.

“Any responsible government needs to be engaging. One of my concerns around the Cybersecurity and Resiliency Bill has been it's a bit top down. It gives government a lot of power and doesn't really talk about consulting with business,” says Morris.

“I'd like to see more of that because you're not going to make progress in improving standards across the board if you just impose stuff top down.”

The role of AI

AI is one of the key areas of current focus and technological development. It is one of the most rapidly developing fields of technology, and there are growing calls from many sectors for regulation.

“The challenge is about timescale and the rapidity of innovation, because when the Cybersecurity and Resilience Bill was introduced 16 months ago, AI was being talked about,” says Morris.

“But in that period, if you think of all the different innovations and things that have happened around AI, it's become much more of a central focus in discussions about resilience and critical national infrastructure.”

In addition to this, data sovereignty is coming to the fore as one of the key issues surrounding the use of AI. “I think we should be developing more sovereign technological capability, because we are very dependent on US data processing, and so on,” says Morris.

Many state-run organizations are colossal institutions with massive amounts of data, which could potentially be used to train AI tools to help government departments become more efficient. For example, Microsoft’s Dragon Copilot is being trialled to transcribe patient consultations with a clinician and automate the associated note-taking and form-filling.

Also, with current geopolitics, there is a question regarding whether the government and national infrastructure should move towards using systems developed within the UK. The UK government has previously found itself reliant on external technology providers, such as Huawei, which could potentially cause security concerns and data sovereignty issues.

“We need to look at how the legislative process could be improved, as it not just affects cybersecurity, but lots of other aspects, particularly around infrastructure development,” Morris adds.

“In the age we're living in, we need to look at how we can speed up legislation, because parliament is still operating like it was on a very traditional model.”

Amazon has hit back at EU lawmakers after the European Commission signalled its intent to designate the hyperscaler as a “gatekeeper” under the Digital Markets Act (DMA).

In a statement on 25 June, the Commission noted that Amazon Web Services (AWS) and Microsoft “hold an entrenched and durable position” in the EU cloud computing sector, with both potentially harming competition across the region.

AWS and Microsoft have already been designated as gatekeepers in other business areas, and with cloud computing, lawmakers are equally concerned the duo could stifle competition.

“Their cloud computing services AWS and Azure have achieved significant turnover, and their operational capacity and investments seem to have significantly outpaced those of competitors,” the Commission said.

“They both have vast and entrenched user bases and appear to benefit from lock-in effects and high switching costs, in addition to a large ecosystem.”

The Commission also highlighted competition concerns regarding the influence of AI services on the broader market, noting that both firms’ AI tools have “become a decisive factor in cloud procurement”.

“Whilst AI is significantly increasing the demand for cloud-related services, AWS and Azure appear to retain a large proportion of this increased demand within their respective ecosystems.”

While the Commission noted that this is a “preliminary view”, the statement follows a seven month investigation into the influence of both companies.

If designated under the legislation, lawmakers could impose a series of obligations on both companies, such as the introduction of new interoperability and data portability features.

Teresa Ribera, the EU’s executive vice president for Clean, Just, and Competitive Transition, said both companies will have the opportunity to respond before “final decisions are taken”.

AWS hits back at EU claims

AWS has contested the claims made by the European Commission, with a spokesperson suggesting the preliminary findings “disregard the breadth of cloud services available to European customers”.

The spokesperson added that designation under the legislation could risk “deterring future European investment and innovation”.

“AWS faces healthy competition and customers across Europe have more choice, lower prices, and greater flexibility than ever before,” the spokesperson said.

“The EU already has comprehensive cloud regulation through the Data Act, and adding another heavy layer of overlapping regulation under the DMA undermines European competitiveness and access to cutting-edge information technology.”

AWS said it intends to work closely with the Commission to “reach the right outcome for customers”.

Long-running competition concerns

The move by the Commission comes as relations between US-based tech giants and the EU grow increasingly tense.

European regulators have made repeated attempts to limit the influence of US firms across the region, having been locked in a series of battles with Microsoft over its dominance in the productivity software market.

Geopolitical tensions, however, are adding fuel to the fire on this front, particularly with regard to data sovereignty.

Critics argue that European organizations have become over reliant on US technology services, prompting calls to seek alternative, home-grown options.

Earlier this month, the Commission unveiled the technological sovereignty package, a series of measures aimed at strengthening digital sovereignty capabilities across the EU - spanning areas such as AI, cloud computing, and semiconductor manufacturing.

Speaking at the time, Ursula von der Leyen, president of the European Commission, said the package comes in direct response to concerns about overreliance on foreign technology services.

“We cannot afford to depend on others for the technologies that keep our hospitals running, our energy grids stable, and our services secure,” she said.

FOLLOW US ON SOCIAL MEDIA

The European Commission has unveiled a series of measures aimed at strengthening digital sovereignty across the union, in a move that’s sparked mixed reaction from industry stakeholders.

The European technological sovereignty package will bolster the EU’s capabilities across a range of areas, including AI, cloud, open source, and semiconductor manufacturing.

Ursula von der Leyen, president of the European Commission, said the move comes in direct response to concerns over long-running reliance on foreign technology services.

“We cannot afford to depend on others for the technologies that keep our hospitals running, our energy grids stable, and our services secure,” she said.

“This is about protecting our citizens, defending our interests, and making our own choices. Europe has the talent, the research excellence, the industrial base and the Single Market. Together, we must turn these strengths into technological sovereignty.”

The technological sovereignty package will focus on four key areas, according to the Commission, and includes two legislative proposals – the Chips Act 2.0 and the Cloud and AI Development Act (CADA).

A new Open Source Strategy and a Strategic Roadmap for Digitalisation and AI in Energy is also included in the package.

The first of these is aimed at “securing the semiconductor base for Europe’s AI ambition” and will focus on building capacity for semiconductor manufacturing and investment.

The CADA legislation, meanwhile, will increase investment for research and development and improve support for data center build-outs across the region.

Notably, this legislative package will also introduce a single EU-wide framework to help organizations assess cloud and AI provider sovereignty credentials.

Jaap Templeman, head of digital business practice in the Simmons & Simmons Amsterdam office, said the package represents a “welcome and necessary boost” to the EU and “ward off a long-term technological dependence” on big tech.

“Sadly, geopolitical developments show how vulnerable transatlantic dependence can be. The strict sustainability and security framework around the development of data center, AI, and chips capabilities might appear counterproductive to improving the EU's ability to compete but is of course necessary,” he said.

Concerns over ‘trusted partner’ elements

While industry stakeholders have welcomed moves to bolster European sovereignty efforts, concerns have been raised over certain aspects of the package.

The CADA legislation outlines a series of trust tiers for cloud services used by public sector organizations. These are based on considerations such as ownership and control of infrastructure, data processing and protection, and cybersecurity.

According to the Commission, the four trust levels are:

• Level 1: where data is processed and stored in infrastructure located in the Union
• Level 2: where providers must demonstrate independence from third countries and transparency over their software supply chain
• Level 3: where providers must be owned and controlled from the EU and meet additional criteria, such as personnel citizenship. The Commission can recognize third-country providers
• Level 4: where providers have full transparency and control over their software supply chain and no interference from a third country

Essentially, this aspect of the legislation aims to bolster protection of sensitive public sector and national security-related data. Public sector organizations will be required to use services that meet the requirements of at least Level 1, for example.

More sensitive areas, such as defense, national security, or law enforcement, meanwhile, will require providers that adhere to higher tiers.

Trade groups have warned that there is potential for these requirements to limit access for foreign providers. The Computer & Communications Industry Association (CCIA) described the legislation as a “dangerous recipe for progressive market shutdown”.

“By requiring Member States to assess which use cases demand specific sovereignty levels – levels that non-EU vendors would be unable to meet by default – the CADA relies on an impractical Commission framework that no international provider could possibly satisfy,” the trade group claimed.

Open source focus welcomed

The Commission’s focus on open source is one aspect of the package that has drawn praise. Lawmakers specifically highlighted the region’s burgeoning open source community, which is now home to over three million contributors.

Under the Open Source Strategy, the Commission aims to capitalize on this growing market to accelerate the development of sovereign solutions. The Commission said it plans to “scale up” open source alternatives in areas such as cloud, AI, and cybersecurity.

“The strategy will also support greater use of open source in public administrations through procurement guidelines and practical best practice,” the Commission said. “It will encourage uptake of European solutions and support standards and interoperability, including through initiatives such as the Open Internet Stack.”

Amanda Brock, CEO of OpenUK, said the UK should take note of the Commission’s acknowledgement of open source’s potential.

"It has taken decades of work, which included many from the UK, to get the EU to the position of recognizing the role of open source in today’s strategy,” she said.

“There cannot be digital sovereignty today without open source. As Hugging Face have said, open source is the cornerstone of sovereignty. The UK, despite our policy being 15 years old, is way behind today, and we need to build the infrastructure for this,” Brock added.

“Despite the UK being Europe’s leader in open source software and AI, we still fail to recognize this in our policy.

Before adoption and entry into force, the European Commission said the package and legislative proposals will be negotiated by the European Parliament.

FOLLOW US ON SOCIAL MEDIA

Google could be facing a fine from the EU in the high hundreds of millions of euros, according to reports, following an investigation by the European regulator into its search.

The fine relates to a European Commission (EC) investigation into whether Google breached the Digital Markets Act by favouring its own search engine. Launched last year, the EC sent preliminary findings to the company, accusing it of preferential treatment of Google's own services in its search results, including shopping, hotels, finance, and more. Google was then given a chance to respond and suggest changes to address the problems.

A report in the German newspaper Handelsblatt reported that the EC is considering fines in the hundreds of millions of euros after failing to come to an agreed solution.

Next steps

However, an EC spokesperson told Reuters that the regulator was keen to get Google in line rather than issue a punitive fine, suggesting that the EC was more interested in securing compliance.

"Even with ‌our ⁠negotiations on future solutions, we will not hesitate to move to the next steps as soon as possible," spokesperson Thomas Regnier told Reuters.

The EC earlier this month gave Google more time to develop a proposal after its previous efforts to avoid a fine failed to win over the regulator. But Google said in response to Reuters that it had already made too many changes to its search tool. ITPro contacted Google for comment, but has yet to hear back at the time of publishing.

Last year, Google-owner Alphabet's profit topped $132 billion with revenue over $400bn. While this fine would be the largest under the 2022 Digital Markets Act, the company has been hit by much bigger fines than that proposed by the EC this time around. In 2017, it was fined €2.4 billion for antitrust complaints related to Google Shopping, and the next year was hit by a €4.3bn over Android and €1.4bn for a case relating to online advertising. Last year, the EC leveled a €‎2.95bn fine following an investigation into adtech, and started a fresh investigation into Google over its use of online content to train its AI.

Appeal in the US

The reports come days after Google filed an appeal in US courts against a decision in 2024 that saw the company deemed a "monopolist" for its search deals, which included paying billions of dollars annually to rivals, including Apple, to use Google as their default for search. Google was ordered to share some search data with rivals, among other remedies.

Such an appeal is no surprise, but Google is arguing that the judge in the case made legal errors and that its search engine dominated because it was technically "superior."

"Competition produces winners and losers," the company said in its filing. "And sometimes a firm – by innovating better, investing more, or just working harder – will leave its rivals behind."

Last week, Google unveiled significant changes to its search tool, heavily embedding AI into the financially lucrative service.

The European Commission has published its long-awaited draft guidance on the classification of high-risk AI systems and has opened a public consultation.

The guidelines aim to help assess whether an AI system should be classified as high-risk; either intended to be used as a safety component of a product, or carrying the potential to endanger health, safety or fundamental rights. If they do, they need different treatment under Article 6 of the AI Act.

"The guidelines are intended to support providers, deployers, and other relevant actors in determining whether an AI system falls within the high-risk category," the Commission explained.

"They offer clarifications on the relevant provisions of the AI Act and include practical examples to illustrate how the classification should be assessed in different areas and use cases."

The guide comes in two parts, with the first covering AI systems that are themselves products, or safety components of products, under sectoral harmonization legislation, including the Machinery Regulation, the Toys Safety Regulation, the Radio Equipment Directive, medical devices, and the automotive and aviation regimes.

The second, meanwhile, covers AI systems that can significantly affect people's health, safety, or fundamental rights in specific use cases listed in the AI Act.

Article 6(3), covering the significant risk of harm to health, safety, or fundamental rights, is where most providers will go wrong, said Patrick Sullivan, VP of Strategy and Innovation at compliance provider A-LIGN.

There's a carve-out with four conditions – that the AI performs a narrow procedural task, improves the result of a previously completed human activity, detects decision-making patterns or deviations without replacing or influencing the human assessment, and performs a preparatory task to an Annex III assessment.

But, said Sullivan, hard exception applies, with an Annex III system is always high-risk where it performs profiling of natural persons. "This matters enormously for HR systems, credit decisioning, and any system that builds individual-level predictive profiles," he warned.

The document has been significantly delayed, having been expected to be published back in February; and following the political agreement on the AI Omnibus, there's a new enforcement timeline.

Rules for systems used in certain high-risk areas – including biometrics, critical infrastructure, education, employment, migration, asylum and border control – will apply from 2 December 2027, while for systems integrated into products such as robotics and industrial machinery, they'll come into effect on 2 August 2028.

The Commission is now holding a consultation on the guidelines, aimed at anyone with an interest in the development, deployment, supervision or use of AI systems is invited to contribute.

"This includes AI providers and developers, organisations using AI systems, public authorities, researchers, civil society organisations, supervisory bodies and members of the public," it explained.

The consultation is open until 23 June.

The UK Competition and Markets Authority (CMA) has launched a strategic market status (SMS) investigation into Microsoft’s software licensing practices.

The probe, which the regulator touted in late March, aims to establish whether the tech giant’s position in the market has a negative impact on competition and consumer flexibility.

In a statement announcing the move, the CMA said the probe will primarily focus on business software products used by organisations across the country, including:

• Productivity software
• Personal computer and server operating systems
• Database management systems
• Security software

Microsoft business products, which include Windows, Word, Excel, Teams, and Copilot, are used by hundreds of thousands of firms and public sector organizations across the country, the CMA noted, with more than 15 million commercial users.

The regulator highlighted concerns that UK customers “may not always be able to effectively combine software from Microsoft with that of other providers”. This, it said, could limit their ability to access preferred products at competitive prices.

“The CMA’s investigation will examine whether Microsoft has SMS in business software and consider whether it can use that position to limit customer choice,” the CMA said.

“It will assess whether bundling of products, limits in interoperability or default settings can prevent customers switching and weaken the competitive constraints Microsoft faces from rivals.”

Notably, the CMA said its decision to launch the probe comes in the wake of a previous investigation into the UK cloud services market.

The regulator’s lengthy probe found the dominance of hyperscalers including Microsoft and Amazon Web Services (AWS) had a negative impact on competition in the UK market.

Microsoft has repeatedly faced scrutiny over its software licensing practices. Slack, for example, filed an EU complaint in 2020 amid claims the company had engaged in anticompetitive behavior with Teams bundling practices.

EU-based trade group, Cloud Infrastructure Services Providers in Europe (CISPE), filed a similar complaint in 2022, alleging that Microsoft imposed higher charges for customers running software on rival cloud platforms.

Microsoft and CISPE agreed to a settlement in mid-2025, which was met with criticism by other industry groups.

CMA seeks business feedback

This latest probe into Microsoft practices must be completed within nine months, according to the regulator. A decision on whether to designate the tech giant with strategic market status is expected by February 2027.

In the meantime, the CMA said plans to gauge the thoughts of businesses across the country using Microsoft products, as well as challenger companies, over whether product choices may be limited.

This includes concerns surrounding product bundling, lack of interoperability, and default settings used by the company.

“Our aim is to understand how these markets are developing, Microsoft’s position within them and to consider what, if any, targeted action may be needed to ensure UK organizations can benefit from choice, innovation and competitive prices,” said Sarah Cardell, chief executive of the CMA.

A spokesperson for Microsoft told ITPro: "We are committed to working quickly and constructively with the CMA to facilitate its review of the business software market."

FOLLOW US ON SOCIAL MEDIA

Changes made to the EU AI Act last week have been welcomed by industry stakeholders, but the move doesn’t mean enterprises can take their eye off the ball on AI governance.

Last week, a provisional agreement was reached between the European Parliament and EU Council on the Omnibus VII legislative package. This includes proposals which aim to simplify the union’s legislative landscape.

Under the deal, significant changes to the EU AI Act will be implemented, including a revised compliance timeline for AI systems deemed “high-risk” under the legislation, as well as extended exemptions for small-to-medium sized enterprises.

As part of the delayed high-risk rules, new application dates will be 2 December 2027 for stand-alone AI systems, and 2 August 2028 for high-risk AI systems embedded in products, according to the EU Council.

Similarly, agreement reinstates provider obligations to register AI systems in the EU database for high-risk systems.

Elsewhere, the provisional agreement also postpones the deadline for the implementation of AI regulatory sandboxes at a national level until 2 August 2027.

Henna Virkkunen, executive vice president for tech sovereignty, security, and democracy at the European Commission, said the changes will help streamline implementation of the legislation.

“Our businesses and citizens want two things from AI rules. They want to be able to innovate and feel safe,” she said.

“Today’s agreement does both. With simpler and innovation-friendly rules, we make it easier to innovate without lowering the bar on safety. We are also making sure the tools supporting EU companies for a smooth implementation of the AI Act are ready.

“Meaningful changes” to the EU AI Act

The changes made to the legislation have been welcomed by industry stakeholders as a positive step toward streamlined implementation.

Mark Weir, regional director for the UK & Ireland at Check Point Software, said the alterations represent a “meaningful evolution in EU AI governance” that balances stronger protections alongside a practical approach to compliance.

“By harmonizing implementation across member states and reducing overlapping administrative obligations, the legislation removes genuine friction for organizations operating across Europe,” he said.

“Without clear guidance, even well-intentioned organisations struggle to translate broad principles into consistent practice,” Weir added.

“This closes a gap that has caused real uncertainty in the market. Taken together, these changes point toward a regulatory framework that is not just ambitious, but workable."

Weir noted that provider registration requirements are also a welcome move, and one that will give European legislators “real enforceability” over the EU’s digital sovereignty plans.

Levent Ergin, chief strategist for agentic AI, regulatory compliance, and sustainability at Informatica, echoed Weir’s comments but noted that the changes “shouldn’t detract from the need for better AI governance”.

“Businesses still need to ensure the data feeding their AI systems is governed, explainable, and built on trusted data foundations,” he said.

“Compliance is only part of the enabler of safe AI. Stronger governance, human oversight, and trusted context will ultimately determine which businesses can scale AI confidently and which struggle to move beyond experimentation.”

Looking ahead, the European Parliament and EU Council must not formally adopt the agreement.

FOLLOW US ON SOCIAL MEDIA

Microsoft and Amazon have announced changes to cloud practices following a lengthy probe by the Competitions and Markets Authority (CMA), provoking mixed reactions from industry stakeholders.

While the regulator concluded in 2025 that both hold “positions of significant market power”, neither were given a Strategic Market Status (SMS) designation.

This is a label given to organizations that hold a disproportionate influence on markets and allows the CMA to impose “conduct requirements or introduce pro-competition interventions” under the Digital Markets, Competition, and Consumer Act (DMCC).

In the wake of the investigation, both hyperscalers have agreed to take action on key issues such as cloud egress fees, interoperability, and the ability of customers to switch providers.

In a statement, the CMA said this will “support greater choice” for businesses and public sector organizations across the country.

“These changes will reduce expense and effort for UK customers when using more than one cloud provider,” the regulator said.

As part of the announcement, the CMA revealed plans to launch a separate SMS probe into Microsoft’s software practices due to competition concerns. Expected to begin in May, the investigation will see the regulator examine the firm’s business software licensing practices.

In a blog post reacting to the cloud market decision, Microsoft president Brad Smith said the company is committed to working “quickly and constructively” to address the CMA’s concerns.

“We appreciate the opportunity we have had for direct and constructive conversations with the CMA and its staff and look forward to an ongoing dialogue in relation to relevant cloud issues in the future,” he wrote.

Amazon said it is working toward a “new UK Addendum that formalizes our commitment to customer choice through clear, comprehensive rights around multicloud adoption, data portability, and switching processes”.

Industry stakeholders aren’t sold

Experts have mixed reactions to Amazon and Microsoft’s moves to address issues flagged in the cloud market probe.

CCIA senior director Matthew Sinclair said the decision will avoid “overly broad and prescriptive interventions” that could harm UK cloud innovation.

“The regulator can focus its efforts on action to address specific issues, particularly restrictive software licensing terms for legacy software, which are costing UK users a fortune,” Sinclair noted.

Nicky Stewart, senior advisor at the Open Cloud Coalition, urged the regulator to take “swift action” against both organizations if they fail to meet commitments on egress fees and interoperability.

“Slow progress on these issues continues to hamper growth, innovation, and resilience in the UK cloud marketplace,” Stewart commented. “Decisive action will set a benchmark for competition authorities across Europe and beyond.”

In contrast, Mark Boost, CEO at UK-based cloud provider Civo, questioned whether the voluntary actions by both firms will deliver changes called for by industry stakeholders.

“Voluntary arrangements made with parties outside of the SMS framework will not provide real impact, and by delaying its final decision regarding Microsoft and excluding AWS altogether, there is a risk for CMA to unnecessarily prolong uncertainty and miss an opportunity to future-proof the UK’s digital infrastructure,” he said.

Boost added that the CMA’s decision does not provide “adequate solutions” to solve lingering concerns over the dominance of both hyperscalers in the UK market. Last year, the regulator found Amazon and Microsoft controlled a share of the market ranging between 30-40%.

“There needs to be a fair digital market in which domestic innovation is encouraged, alongside continuing to help build opportunities for international collaboration and trade,” he said.

“If the CMA is serious about delivering on this, it will need to adopt an integrated approach as opposed to only partially regulating these hyperscalers. If the same standards are not applied to both parties, the UK will jeopardize its objectives related to digital sovereignty and economic stability.”

FOLLOW US ON SOCIAL MEDIA

The UK government’s much-anticipated Cybersecurity and Resilience Bill (CSRB) had its first and second reading in Parliament and is now progressing through the necessary next stages to become law.

Designed to improve the cybersecurity and resilience of the UK’s most important services, while taking into account the evolving challenges impacting today’s increasingly interconnected digital world, the new legislation makes crucial updates to the 2018 Network and Information Systems (NIS) Directive.

It mandates stricter controls around cyber best practices, reinforces the importance of supply chain security, and brings more organizations into the scope of government oversight, including Managed Service Providers (MSPs).

MSPs under the CSRB

MSPs have largely remained free from government oversight and were not included in the 2018 NIS regulation.

NIS covered Operators of Essential Services (OES) and Relevant Digital Service Providers (RDSPs), and while the government did announce plans to include MSPs in its update to the regulation in 2022, this was never enforced.

However, under the CSRB, MSPs will also soon be mandated and obligated to meet strict new compliance requirements.

According to the regulation’s proposal, MSPs will soon be required to abide by the same requirements placed on RDSPs under the NIS 2018 regulation. The government also recently confirmed that MSPs who employ at least 50 people and have a turnover exceeding €10 million will be regulated under the bill, potentially placing approximately 1,100 MSPs within its scope.

When it comes to the requirements placed on MSPs, these include:

• Registering with the ICO
• Having appropriate and proportionate security measures in place to manage risks to the network and information systems that support their service
• Notifying incidents to the ICO, where those incidents have a substantial impact on the provision of their service

Understanding the cyber risk to MSPs

The inclusion of MSPs in the CSRB is an important step in improving cyber resilience across the UK, and it is essential given the important role they play in today’s digital landscape.

Over the last seven years, MSPs have evolved from providing IT and communications services into providers that form the digital backbone of a significant part of the UK’s economy.

MSPs are now integral to thousands of organizations across the country, delivering everything from connectivity to IT to cybersecurity.

However, this concentration has turned them into major targets for threat actors.

Today, MSPs are routinely targeted by threat actors to launch supply chain attacks, where they gain access to one MSP and then pivot across to customer environments, launching widespread breaches.

This was demonstrated in the recent attack on Ingram Micro, when the IT distributor suffered a ransomware attack at the hands of SafePay, and customer data was reportedly compromised.

These attacks can be highly dangerous, impacting hundreds of organizations at once, while causing mass financial damage and operational disruption.

These are some of the key reasons why MSPs will soon be covered by the CSRB.

The government clearly wants to mitigate this potentially systemic risk.

However, considering many MSPs don’t have the in-house skills required to meet the new requirements, the forthcoming regulation will be a concern.

So, how can they prepare for the legislation today, before it officially comes into force?

Adopting cyber best practices within MSPs

Despite delivering security services to their clients, many MSPs are not experts in the field of cyber defense.

The requirements for delivering security have largely escalated due to customer demand, rather than an increase in in-house expertise.

However, with the CSRB, MSPs are suddenly under pressure to not only enhance their internal security, but also the security of their clients.

This means many MSPs will want to know what they can do to meet these new requirements, but without having to build out entirely new functions of business.

Fortunately, this can be achieved by collaborating with vendors that are dedicated to supporting MSPs.

Vendors can offer support to MSPs through their expertise in cybersecurity, alleviating the burden on their own resources, while also improving internal and customer defenses.

Delivering platforms that offer market-leading defenses, vendors can enhance cyber resilience for both MSPs and their customers.

However, MSPs should look for partners that support them with this new opportunity without looking to override their relationships with their clients.

Ideally, MSPs should look to partner with vendors that can not only support security across their own environments, but ones that can also enable them to deliver new and advanced capabilities to their clients without significant resourcing overhead or financial investment.

The inclusion of MSPs in the CSRB will likely come as a concern for the sector.

Suddenly, these organizations that have largely remained free from government oversight are under the spotlight.

This adjustment will undoubtedly be challenging, but the MSPs that take action today will be ready to meet the new requirements they face tomorrow, enhancing resilience across both their internal and customer environments.

The European Commission (EC) has renewed a pair of rules that will allow data to continue flowing between the European Economic Area and the UK.

The adequacy decisions were agreed after the UK left the EU via "Brexit" in 2020 on the grounds that the UK legal framework for data protections were as good as those in Europe.

While that was welcome news for British companies dependent on the flow of data, the former government still complained that the decision should have been taken before the official Brexit withdrawal date.

That agreement ran out in June 2025, but was given a technical extension of six months to give the EC time to consider the impact of changes brought in via Labour's Data (Use and Access) Act.

This loosened up some data controls for research and charitable fundraising, while requiring companies to have a data protection complaints procedure.

The aim, said then technology secretary Peter Kyle, was to enable the government to make use of the "goldmine of data" it holds for policing, admin and more.

In particular, the EC was considering the impact of those changes on the General Data Protection Regulation (GDPR) and the Law Enforcement Directive.

Six-year renewal

Now, the EC has announced that the adequacy decisions have been given another six years until 2031, with the possibility of renewal again, with the Commission and European Data Protection Board reviewing the system and any changes in four years.

"The decisions ensure that personal data can continue flowing freely and safely between the European Economic Area (EEA) and the United Kingdom, as the UK legal framework contains data protection safeguards that are essentially equivalent to those provided by the EU," the EC said in a statement.

The renewal means data will be able to continue to flow between the UK and Europe, avoiding serious disruption for businesses if that were to stop.

Adequacy agreements

The EC's first adequacy decision with a non-EU country following the introduction of GDPR was with Japan, coming into force in 2019, though the European body had similar agreements in place for other countries including Canada before the regulation was introduced.

Other countries with adequacy decisions in place include the US, Switzerland, Argentina, and Korea.

"The European Commission has the competence to determine, on the basis of the General Data Protection Regulation, whether a country or international organisation outside the EU ensures an adequate level of data protection," the EC explained.

"Following this, the Commission might initiate the process for the adoption of an adequacy decision, which allows the free flow of personal data from the EU and the European Economic Area (EEA) to a third country or international organisation without further obstacles."

For the UK renewal, a wide range of opinions were sought. "The adoption of the renewal decisions follows the European Data Protection Board's opinion and the Member States' green light in the so-called comitology procedure," the EC said in a statement, referring to a system that enables the EC to implement rules under the review of national representatives from member states.

The UK adequacy agreement was approved despite the changes introduced by the Data (Use and Access) Act introduced by the Labour government – which were more limited than a data overhaul initially planned by the last Conservative government that may not have been seen in such a positive light by the EC and member states.

FOLLOW US ON SOCIAL MEDIA

There's huge uncertainty over the UK-US Tech Prosperity Deal, with reports that the US has pulled out.

The deal, signed in September, saw the two countries agreeing to establish joint R&D, and advance "pro-innovation AI policy frameworks". The plan also called for cooperation on quantum computing and nuclear energy.

At the time, US president Donald Trump said it would "ensure our countries lead the next great technological revolution side by side".

However, reports from the New York Times suggest that talks have stalled due to “broader disagreements”.

This is believed to be in part a reference to the UK's Digital Services Tax, levied at 2% on US tech giants including Google, Amazon, and Apple, and raising around £800 million per year.

Trump is reportedly not a fan of the Online Safety Act, which requires tech companies to protect users from harmful content.

According to the NYT, the US is also concerned about the Economic Prosperity Deal between the two countries. The MOU for the Technology Prosperity Deal made it dependent on “substantive progress” towards the Economic Prosperity Deal signed in May.

The US is reportedly unhappy with perceived trade barriers in sectors such as cars, pharmaceuticals, and steel.

The stalled talks on the deal may just be a tactic to put pressure on the UK, as implied by a statement on X by Trump's science adviser Michael Kratsios.

"In line with Section III of the US-UK Technology Prosperity Deal, we hope to resume work with the United Kingdom once the UK has made substantial progress in implementing its commitments under the Economic Prosperity Deal," he said.

"We look forward to continuing our productive collaboration across AI, quantum, nuclear, and other critical technology areas under the Deal."

Reports from the BBC on Tuesday noted that the deal is still very much alive and kicking. According to the broadcaster, the prime minister’s office said the UK remains in “active conversations with US counterparts at all levels of the government” on the deal.

Who benefits from the Tech Prosperity Deal?

The Tech Prosperity Deal has been widely seen as favorable to the US, Last month, experts told ITPro the agreement was a “strikingly unequal partnership” that allows big tech to expand its presence in the UK unchecked.

According to campaign group Global Justice Now, the UK should be wary of making any more concessions.

"For Trump, collaboration on trade and investment only appears possible if other countries give US corporate giants free reign over their economies – and give up their democratic right to regulate and tax them," said policy and campaigns manager Tim Bierley.

"The news that the US is seeking even more concessions should be a wake-up call for those in government who think we can appease our way out of tariff wars with Trump – the more we concede, the more corporate America will demand."

Broadly speaking, the tech industry is more favorable toward the deal. The Computer & Communications Industry Association (CCIA), which has called for the Digital Services Tax to be repealed, pointed out that other nations are scrapping similar taxes.

“The technology deal was good news for investment and innovation in both countries, and it is unfortunate that lack of progress in broader trade issues resulted in its implementation being suspended," said CCIA senior director Matthew Sinclair.

"The UK should do more to address barriers to trade in digital services, whether that is taxes that single out US multinationals or regulators wielding unprecedented powers without the guardrails that should protect companies against disproportionate or simply misguided attacks on their businesses.”

FOLLOW US ON SOCIAL MEDIA

US president Donald Trump has signed an executive order aimed at banning individual states from regulating AI in a move one expert said could create a “regulatory vacuum” in the country.

In a move welcomed by a host of AI companies, Trump said he plans to create a federal AI Litigation Task Force responsible for challenging states’ AI laws.

"State-by-state regulation, by definition, creates a patchwork of 50 different regulatory regimes that makes compliance more challenging, particularly for start-ups. Second, state laws are increasingly responsible for requiring entities to embed ideological bias within models," he said.

"My administration must act with the Congress to ensure that there is a minimally burdensome national standard — not 50 discordant state ones."

The order also calls for the Secretary of Commerce to publish an evaluation of state AI laws that conflict with national AI policy priorities - and withhold non-deployment Broadband Equity Access and Deployment (BEAD) funding from any offenders.

Trump is of course keen to encourage AI firms to invest in the US - something he believes state-by-state regulation will hamper.

States including Colorado and New York have already passed laws regulating AI, with California set to require the biggest AI firms to publish plans for limiting the risks.

The move has been welcomed by the National Association of Manufacturers.

"As the president demonstrates his commitment to both advancing American technological dominance and bolstering investment in manufacturing, he is rightly recognizing that winning the global race for AI hinges on getting AI policy right, which means avoiding a cumbersome 50-state patchwork of laws and regulations that would throttle interstate commerce, stifle innovation, limit AI adoption and erode America’s competitive edge," said president and CEO Jay Timmons.

However, the American Civil Liberties Union (ACLU) begs to differ.

"Although AI might bring substantial benefits, it also carries substantial risks, and America will not win the AI ‘race’ if the AI used by the government, employers, schools, and health care providers is hallucinatory, unreliable, and dangerous," said And, said ACLU senior policy counsel Cody Venzke.

The executive order doesn't allow for a complete free-for-all, with states still allowed to introduce AI regulations aimed at protecting children, addressing concerns around data centers, and governing states' own procurement and use of AI.

However, California governor Gavin Newsom said the plan is self-serving and will endanger the public.

"Today, President Trump continued his ongoing grift in the White House, attempting to enrich himself and his associates," he said. "President Trump and Davis Sacks aren’t making policy — they’re running a con. And every day, they push the limits to see how far they can take it."

Move could create a “regulatory vacuum”

Ilia Kolochenko, CEO at ImmuniWeb, said the executive order and subsequent disruption to state-level efforts to regulate the technology could risk leaving the country in a “regulatory vacuum”.

“While President Trump's Executive Order may prevent some US states from enacting or enforcing complex and sometimes contradicting AI state laws and regulations – thereby considerably simplifying business for tech companies in America – it might also have a possible drawback by leaving America in a regulatory vacuum,” Kolochenko commented.

Enterprises operating on both sides of the Atlantic already face a fractured regulatory landscape. The EU, for example, has taken a far more robust approach to legislation, marking a contrast to the US' approach.

Enforcement of the order may prove tricky, and attempts are already underway to push back against limitations to state-level regulation. A first shot at limiting state AI laws has been defeated in a landslide 99-1 vote in the Senate.

Similarly, some Democratic lawmakers have said they are planning legislative action against the White House.

MORE FROM ITPRO

• Big tech looks set to swerve AI regulations – at least for now
• The tech industry reacts to the UK’s AI Growth Lab
• AWS thinks global alignment on AI regulation is possible but must be risk-based

Three major international technical standardization bodies are working to introduce ethical considerations into their standards, with the release of four guiding principles.

The International Organization for Standardization (ISO), the International Electrotechnical Commission (IEC), and the International Telecommunication Union (ITU) last week launched the Seoul Statement at an event in South Korea.

This statement is aimed at advancing the development of safe, inclusive, and effective international standards for AI. These standards, the bodies revealed, should reflect global needs, support regulatory alignment, and foster interoperability, trust and inclusion.

"It places international standards at the heart of AI governance," said Sung Hwan Cho, president of the ISO.

"We must systematically include social and human rights considerations into our standards work. We must collaborate across government, industry and civil society and academia to ensure all voices are heard."

The guiding principles for trustworthy AI

The statement is based on four core principles covering key areas spanning development, deployment, and long-term maintenance of AI systems.

Standards should actively incorporate sociological dimensions as well as technical ones, for example. They should deepen the understanding of the interplay between international standards and human rights, recognizing both their importance and universality throughout the AI development lifecycle.

They should also help strengthen an inclusive, multi-stakeholder community to develop and apply international standards for the design, deployment, and governance of AI. Elsewhere, the organizations encouraged closer collaboration between public and private sector entities on AI capacity building.

"Standards are technical tools to uphold the principles we want to live by,” said Seizo Onoe, director of the ITU telecommunication standardization Bureau.

"The vision set out by this joint statement calls for diverse expertise and global commitment to collaboration and consensus – exactly what drives our standards work and exactly the spirit needed to create the future we want.”

Any regulatory framework will need to be forward-thinking and adaptable, the bodies noted, largely due to the rapid evolution of the AI landscape moving forward.

Ethical specifications will have to reflect related issues such as the poor provision of energy supply in developing countries for example, as well as the lack of compute power.

Research highlighted by the standards bodies indicates that the developing world houses less than 1% of global data center capacity, underlining the need for greater investment to broaden compute capacity.

These nations are also struggling with a shortage of chipsets and AI components, a lack of public-private data sharing, and a severe shortage of training.

Tackling AI safety concerns

Next steps for the organizations include the drafting of standards on the storage of sensitive data.

The trio are also planning to look at the issues of election interference, deepfakes, and misinformation. The latter of these areas is of particular interest, they noted, with most current deepfake detectors failing to adequately deliver.

Threat actors are already using deepfakes to dupe unsuspecting enterprise workers, with a recent study from Ironscales showing that 85% of cybersecurity and IT leaders have experienced at least one deepfake attack in the last year, marking a 10% increase on 2024 statistics.

"How is a deepfake coming about, and how do we give the technical tools to make detecting it easier?" asked Philippe Metziger, CEO and secretary general of the IEC.

"Our role is making things more transparent from a technical point of view."

The statement was created following a UN recommendation last year, with the hope that standards convergence can help reduce fragmentation and lower compliance burdens, while focusing on responsible AI development and deployment.

"Standards don't solve everything," said Metziger. "But we see ourselves as major contributors to AI governance."

MORE FROM ITPRO

• Enterprises are concerned about ‘critical shortages’ of staff with AI ethics and security expertise
• How do we make AI ethical?
• IT professionals are the new guardians of ethical tech

With the advent of early automobiles in the 19th century, the UK introduced legislation to protect existing transport industries such as rail networks and stagecoaches.

One of the most notorious of these laws was the ‘Red Flags Act’, restricted the speed of ‘horse-less’ vehicles to just 2mph in built-up areas and 4mph in the countryside. Worse still, the legislation required three vehicle operators: two in the vehicle itself, and another walking ahead carrying a red flag to inform oncoming traffic that an automobile was coming.

The result of this, according to Sasha Rubel, head of public AI policy at AWS, was a hammer blow to an industry during its critical embryonic stages.

Speaking to ITPro at AWS re:Invent 2025, held in Las Vegas, Rubel says this is a perfect analogy to describe the current challenge industry and governments alike face with generative AI.

Driving growth of the industry and delivering on the potential of the technology will require a delicate balancing act in the coming years. Yet conflicting regulatory positions on both sides of the Atlantic pose a serious risk to progress and often leave businesses confused.

“For me, this is a really important lesson from history, because it shows that we not only need to have a shared understanding of what risk and misuse of the technology is, but if you overregulate a technology mitigating for every single possible misuse, you actually miss out on the benefits that this technology represents,” she tells ITPro.

“We need to focus not only on the risks of misuse of the technology, we also need to focus on what it means if we miss out – the missed use of the technology – if we miss out on what this opportunity represents, not only in terms of the economic benefits to GDP and European competitiveness, but more fundamentally to the beneficial use of what this technology represents for everyday life of people in Europe,” Rubel adds.

Rubel says discussions on AI regulation, particularly in Europe in recent months, show there’s now a “growing consciousness” that a more aligned international approach to the technology will be needed.

Robust regulatory frameworks may have noble intentions, but there’s a risk that without clear communication some regions globally may be left behind in the ongoing AI race.

“We see that in the policy conversations that are happening that we need to simplify rules, and we need to align internationally on what those rules look like in order to make sure that Europe and the United Kingdom remain competitive in this space.”

Misalignment is costing businesses big

The impact of this misaligned approach to AI regulation is already being felt by both providers and enterprises alike, Rubel says. In a study conducted by Strand Partners on behalf of AWS, more than two-thirds (68%) of organizations in the EU don’t understand their obligations under the EU AI Act.

Further, the study found companies that aren’t sure about compliance typically invest up to 30% less in technology year on year. To add insult to injury, the sheer complexity of compliance means the function ends up accounting for around 40% of overall IT spend at some enterprises.

“They’re afraid that they don’t understand the rules and that they’ll be fined because of the complexity of rules,” she says. “I hear every day from customers saying, ‘can you explain to us the interplay between the EU AI Act and the GDPR and the EU Copyright Directive’.”

Ultimately, reducing complexity in this regard will have a positive downstream effect on compliance costs, Rubel says. When businesses know they’re compliant and operating within established rules, this is conducive to innovation.

“Reducing those compliance costs by mainstreaming rules is really essential,” she says. “It allows startups to be competitive at the global level, but it also allows for an approach that’s globally aligned.”

Responsibility builds trust; trust drives innovation

“Responsibility and innovation need to go hand in hand,” Rubel tells ITPro. This is a point AWS has been keen to emphasize and promote in recent years, and is a longstanding mantra at the company.

Development policies that are responsible at heart ultimately reduce risk, Rubel says. First and foremost, acknowledging the risks associated with the technology will be critical.

“Responsibility and innovation are not opposites,” she adds. “Responsibility drives trust, which is one of the biggest blockers to AI adoption beyond regulatory uncertainty. That trust drives adoption, and that adoption drives innovation.”

Secondly, bringing together relevant stakeholders from various domains to tackle these risks collectively will be equally crucial. In doing so, Rubel believes this will be the first key step toward fostering broader global alignment.

Going forward, she calls for a risk-based approach developed by industry, academia, government, and civil society to ensure alignment and enable innovation.

Is regulatory alignment a pipe dream?

Achieving global alignment is easier said than done, however. There are economic, social, and geopolitical considerations on both sides of the Atlantic.

The lack of alignment between the United Kingdom, United States, and European Union highlights this, with the latter pursuing a harder approach to the laissez faire style across the pond.

Discussions about AI legislation in the US have proved controversial in recent months, with a rift emerging over federal and state-based approaches to regulating the technology.

Business leaders themselves also appear conscious of geopolitical factors at present, particularly with regard to issues like data sovereignty and reliance on foreign infrastructure providers.

In a survey conducted by Civo, UK-based IT leaders voiced serious concerns about the influence of US cloud providers in the wake of tariffs imposed by the Trump administration. More than half (60%) of respondents said the UK government should go so far as to cut its use of US cloud services.

While that research came specifically in response to economic strategy in the US, it does point toward a growing sentiment of isolationist-style, sovereign AI approaches. Political unions like the EU want their data kept in-region, governments want their data kept in-country, and so do the enterprises operating in those individual regions and nations.

If an aligned approach on data storage is being called into account, it's even more important that industry and public bodies come together to define clear, reproducible standards that lock in safety and innovation.

Laws to regulate AI have hit a hurdle following pushback from big tech and US President Donald Trump.

In the US, Trump is considering using an executive order to ban regulations to rein in AI, according to Reuters, while in Europe, the European Commission said it wants to delay some aspects of the AI Act in response to complaints from big tech over bureaucracy.

With no federal laws regulating AI forthcoming in the US, some states have pushed to enact their own local legislation, including recent laws in California and Colorado.

The Trump administration has previously attempted to block such state-level AI laws by including a 10-year moratorium on local regulation in his "big, beautiful bill" over the summer, though that was thwarted by the Senate. Earlier this week, Trump backed plans to add a similar ban in the National Defense Authorization Act.

Now, the president is considering using an executive order in an attempt to discourage any state-level AI laws by threatening lawsuits or withholding federal funding, according to a draft of the document seen by Reuters.

As drafted, the order would establish an "AI Litigation Task Force" led by Attorney General Pam Bondi to challenge in court any state that implements AI regulation, on the grounds that "such laws unconstitutionally regulate interstate commerce" and are preempted by existing federal rules.

The order would also see the Department of Commerce refuse to allocate funding for broadband to states that don't comply.

Colorado recently approved a rule designed to prevent algorithmic discrimination – highlighting a long-running issue of bias in large-language models (LLMs), which the draft order seen by Reuters noted may force "AI models to embed DEI in their programming".

California has also wrangled with a series of AI laws, and recently passed a law around disclosure that would require companies tell the government how they plan to avoid serious risks and fess up to any critical safety incidents.

A White House official did not confirm the order to Reuters, and said it was speculation.

European regulation delays

Over in Europe, the European Commission has suggested delaying some aspects of the EU AI Act for 16 months and tweaking others as part of a move which sparked concerns it's responding to criticism from American tech giants.

The commission said the move was part of wider efforts to "simplify existing rules" on AI, cybersecurity, and data in its Digital Omnibus, which aims to streamline technology-focused laws to make them easier to manage for companies.

The EU’s economy commissioner, Valdis Dombrovskis, said the measures would save businesses and consumers alike €5bn in red-tape related costs by 2029.

He added: "Europe has not so far reaped the full benefits of the digital revolution and we cannot afford to continue to pay the price for failing to keep up with a changing world."

Criticism of delay

Critics disagreed on the value, however. Blue Duangdjai Tiyavorabun, Policy Advisor at European Digital Rights (EDRi), suggated the Digital Omnibus is a “full-on betrayal of Europe’s promise”.

"They are trading the protection of people from harmful AI systems for hollow promises of ‘innovation’. This is no shocker: when tech money flows like water in Brussels, guess who is steering the ship?"

A Commission official said during a briefing: "Simplification is not deregulation. Simplification means that we are taking a critical look at our regulatory landscape."

Alongside delaying the timeline for implementing "high-risk rules" by 16 months to December 2027 from August 2026, the Commission said it would extend some rule simplifications for small businesses and small mid-cap companies.

Elsewhere, it plans to extend compliance measures so more companies can use regulator sandboxes in core industries like automotive and centralize oversight on AI systems to help reduce governance fragmentation.

"Efficient implementation of the AI Act will have a positive impact on society, safety and fundamental rights," the EC said in a statement. "Guidance and support are essential for the roll-out of any new law, and this is no different for the AI Act."

Thierry Breton, former European commissioner for the internal market and digital affairs, wrote in the Guardian, that Europe should be proud of its AI laws.

"We should resist any attempt to unravel these laws, through 'omnibus' bills or otherwise, mere months after they have entered into force, under the pretext of simplification or remedying an alleged 'anti-innovation' bias," he said.

"No one is fooled over the transatlantic origin of these attempts. So let’s not be useful idiots."

MORE FROM ITPRO

• Is the UK falling behind the EU on AI regulation?
• The fractured regulatory landscape tech companies face in 2025
• Three things you need to know about the EU Data Act

In September, the UK welcomed the US president Donald Trump with open arms ahead of the signature of the landmark US-UK Technology Prosperity Deal. This $42 billion agreement, the UK government believes, will strengthen the strategic relationship between the two countries in a variety of key areas – including quantum computing, nuclear energy and, most eye-catching of all, AI.

There's no doubting the US as an unmatchable force when it comes to tech innovation, with its biggest companies ploughing headfirst into a turbocharged AI summer. This agreement represents a chance for the UK to carve out a slice of that action, with the memorandum of understanding (MOU) laying out a framework for co-operation. In short, UK organizations should, over time, be given access to critical technology and research, while US companies will get the chance to invest billions of dollars into new initiatives – and reap the eventual rewards.

The reaction to the broad and far-reaching agreement has been overwhelmingly positive, for the most part. It is, however, not a treaty but a non-binding MOU, with plenty of details still to be ironed out. Over time, what will it mean for the long-term prospects of technology sectors in the two nations and their respective businesses?

The prospects on both sides of the Atlantic

Although much of the UK press lauded the agreement, it overwhelmingly favors the US, says John Bates, CEO at SER Group and a former Cambridge University computer science and deep learning academic. In reality, he says, "this deal may not be the win it's being sold as" because hyperscalers get to expand their presence on UK soil while strengthening their footprint.

"We’re expected to applaud America’s generosity on chips, AI models, and data centers, yet the UK risks becoming little more than an outsourcing hub for hyperscalers and Nvidia rather than a genuine AI power in its own right," Bates tells ITPro. "True innovation remains concentrated in the US, while the UK still struggles to define its own AI ambitions. Instead of relying on access to American technology, Britain should be doubling down on backing local innovators and developing homegrown AI capabilities."

That isn't to say there are no benefits at all for UK businesses. Bates suggests the UK remains more attractive than the EU as a global hub for AI innovation, for example. There's also a real upside for businesses seeking to tap into emerging technologies much faster than they could have done previously, explains Adnan Masood, chief AI architect at UST and an AI researcher.

"This shrinks a decade of infrastructure build-out into a couple of years – if power and permitting cooperate," he says, but echoes Bates' views that it's a lop-sided deal. "Let’s be honest, the CapEx is overwhelmingly American. That concentrates leverage with US vendors and raises long-term sovereignty and switching cost questions for UK buyers."

Much of this comes from the fact the US heavily outspends the UK in terms of AI investment. Last year, US private investments hit $109.1 billion, which was nearly 24 times higher than the UK's $4.5 billion, according to Stanford University research.

Given the head start, it's no doubt that perhaps the path of least resistance for UK firms is a deal that would allow them to tap into the technological progress that counterparts across the pond have already forged ahead with. It’s an alternative to spending the necessary time and money – which could take a great many number of years – to reach anywhere close to the proficiency that US firms already boast with the tech that's needed.

Charting a long-term, albeit turbulent, path for AI growth

Bates is not necessarily an advocate for this agreement, suggesting it diminishes the UK as a true factor in the global equation. "For a nation that pioneered computing, it’s a strikingly unequal partnership," he says. "I’m pro-US, but this investment doesn’t make the UK a true player. And the environmental cost of these AI factories – from potential near-permanent data center hosepipe bans to local infrastructure strain – feels a high price to pay for becoming a kind of AI Airstrip One for America."

Other downsides to consider, Masood explains, include the fact that it opens up UK businesses to US vendor lock-in and potentially stifles the prospects for a true UK rival to emerge. "The model assumes a US tech stack for chips, cloud, and tooling. That’s efficient – but it’s also a lock-in risk for the UK and reduces bargaining power for local suppliers. The UK gets capacity; the U.S. gets the standard."

There are also very genuine concerns over the technology, whether a growing bubble around the AI industry could pop, creating massive ripples in its wake. The Bank of England, for example, warned in October that there is a growing risk of the bubble bursting, with a "sudden correction" resulting in a drying up of funds. Even Sundar Pichai, CEO at Alphabet and a huge proponent for adoption of AI such as Google’s Gemini, has warned that “irrationality” in AI hype could harm the markets over the long term.

Over time, says Jim Piazza, VP of AI and machine learning at Ensono, the agreement should pave the way for a much healthier environment in the UK where businesses can pursue the integration of various advanced US technologies.

"With shared standards in place, it’s easier for vendors to demonstrate compliance and for buyers to evaluate offerings," he says. "That kind of clarity creates more confidence, especially at the enterprise level. If you can document and pass these new standards, you’ll have stronger access to funding, markets, and customers. That’s true on both sides of the pond.

"Longer term, I see this as a standardization flywheel that should mature over time. As vendors begin to pass these shared tests and document their results, they’ll unlock access to enterprise buyers and funding. Over time, that creates momentum and the more standardized and validated the ecosystem becomes, the faster adoption can happen. Once we get the teeth in place, we’ll see more clarity post."

Legislation aimed at shoring up the UK’s national cybersecurity capabilities is set to be introduced in parliament today – but some security experts have questioned the scope and practicality of new rules.

The Cyber Security and Resilience Bill comes in direct response to growing cyber threats faced by private and public sector organizations, targeting stronger defenses in areas such as healthcare, energy, and transport networks.

The bill also comes at a critical time, with figures from the Office for Budget Responsibility (OBR) showing attacks on critical infrastructure could have a massive impact on the economy.

Analysis from the OBR found a major attack could result in a temporary increase in borrowing by over £30 billion, or equivalent to around 1.1% of GDP.

Elsewhere, the financial impact of attacks across both the public and private sectors has been growing. Research published this week shows the average cost of a “significant cyber attack” on the UK now stands at over £190,000.

“Cybersecurity is national security,” said technology secretary Liz Kendall. “This legislation will enable us to confront those who would disrupt our way of life. I’m sending them a clear message: the UK is no easy target.”

So what can we expect from the bill?

What’s covered under the bill?

Under the legislation, digital and essential services such as IT management for critical sectors will be regulated for the first time and subject to robust minimum security standards.

“Because they hold trusted access across government, critical national infrastructure, and business networks, they will need to meet clear security duties,” the government said in a statement.

“This includes reporting significant or potentially significant cyber incidents promptly to government and their customers, as well as having robust plans in place to deal with the consequences.”

Elsewhere, regulators and government ministers will be given sweeping new powers to ensure organizations meet these base requirements.

“The technology secretary gets new powers to instruct regulators and the organizations they oversee, like NHS trusts and Thames Water, to take specific, proportionate steps to prevent cyber attacks where there is a threat to UK national security,” the government added.

Does the bill go far enough?

The introduction of the bill has, by and large, been welcomed by security industry stakeholders as a positive step toward limiting the impact of cyber attacks on critical infrastructure.

In particular, new rules around incident reporting will play a vital role in bolstering collective defense against growing threats, according to Trevor Dearing, director of critical infrastructure at Illumio.

“The shift from reporting only successful breaches to reporting all cyber incidents is long overdue and will drive rapid improvements in how organizations protect their most critical assets and respond to attacks,” he said.

“Granting the technology secretary new powers to ensure that regulators and organizations monitor or isolate high-risk systems is a smart move,” Dearing added.

However, some industry stakeholders have questioned the scope of the legislation, arguing that it fails to address lingering issues in some key areas.

Chris Dimitriadis, chief global strategy officer at ISACA, suggested the sharpened focus on critical infrastructure fails to address the reality of the modern digital economy.

Moreover, omitting particular sectors, such as retail, is an oversight on the part of the government given the spate of attacks waged against high street brands this year.

“The era when cyber regulation could focus solely on critical national infrastructure is over,” he said. “Today, every major employer is part of the digital economy - and therefore part of the threat landscape.”

“Yet many remain outside the scope of meaningful legislative protections. Recent attacks on major retailers such as M&S and Co-op are perfect examples of how vulnerable our digital ecosystem is and the urgent need to take action.”

Matt Houlihan, VP of government affairs at Cisco, also questioned the practicality of compliance for organizations that fall under the scope of the legislation.

"The success of this bill will rely on clarity and practical timelines to help organizations implement necessary measures effectively,” he said.

“We'd also urge the government not to miss an important opportunity to tackle the growing risks from unsupported, end-of-life equipment – a persistent weak point in UK infrastructure that too often leaves organizations exposed.”

Dearing echoed Houlihan’s comments on reporting, again noting that support for organizations will be crucial.

“Whilst it is understandable that the government is introducing tougher penalties for poor security practices, it is equally important that sufficient support is provided to help organizations achieve compliance,” he said.

“The government must ensure that investment is made in supporting organizations, particularly those with limited budgets.”

MORE FROM ITPRO

• What the UK’s Online Safety Act means for IT companies
• Ransomware payments are banned in the public sector: should businesses still pay?
• Why the UK's "outdated" cybersecurity legislation needs an urgent refresh

Ensuring that any organization can withstand, respond effectively to, and recover quickly from IT disruptions is a strategic imperative. This is particularly true within the financial sector.

The Digital Operational Resilience Act (DORA), which became mandatory on 17 January this year, was put in place to serve as a robust standard for resilience. It doesn’t just need organizations in scope to implement sophisticated technological defences; it needs them to have a proactive, well-informed workforce that is ready to tackle cyber threats.

At its core, DORA is a five-pillar framework. These cover ICT risk management, incident reporting, digital operational resilience testing, third-party risk management, and information sharing. Technology is a critical component of all of these pillars; however, the human element is equally important. This is hardly surprising when you consider that various sources cite human errors as being responsible for between 70% and 95% of all cyber incidents. This means that even when the most robust technological safeguards are in place, the human element will be a significant source of vulnerability.

Regardless of the source of the incident, employees can also be the difference between a controlled breach and a full-scale disruption.

What is needed is highly targeted training and simulation exercises that help organizations ensure that their staff are equipped to identify emerging threats, report incidents promptly, and engage in effective remediation efforts.

Digital operational resilience testing and human risk

Digital operational resilience testing under DORA goes beyond merely identifying what the vulnerabilities are. It also involves actively testing the human layer.

Simulated phishing attacks and other real-world-based cyber threat exercises serve multiple purposes. They not only provide a practical measure of employee readiness, but they also help to build essential knowledge and skills for identifying genuine communications from deceptive ones.

By exposing staff to realistic threat scenarios, organizations are cultivating a security-first mindset. This is vital for mitigating risks before they escalate and disrupt business operations.

Awareness enhances incident reporting

The quick reporting of incidents is a cornerstone of DORA compliance. It mandates strict timelines, for example, notifying relevant authorities within four hours of classifying a major incident, as well as following up with detailed reports within set timeframes.

It is important to ensure employees are aware of this, so they are equipped to act as the eyes and ears of the organization and support compliance. Their ability and readiness to spot and report anomalies will help to reduce the time to containment and ensure that incidents are managed efficiently and effectively. This not only supports DORA compliance, but it also safeguards both financial and reputational assets.

Establishing a sharing culture

In addition to ensuring individual preparedness, training, and awareness initiatives will also help establish an environment where information is able to flow freely. By encouraging employees to share all of their observations on suspicious activities or emerging threats, an organization will get stronger collective intelligence.

Staff need to be able to actively participate in the reporting process through easy-to-use tools and transparent processes. This will enable them to contribute to a dynamic, organization-wide threat intelligence network. Not only does this type of collaborative approach support internal decision-making, but it will also help to enhance the overall resilience of the financial ecosystem when these insights are shared across the industry.

A more resilient organizational culture

Ultimately, investing in employee training and awareness is far more than a tick-box DORA compliance exercise. It is a strategic investment in any financial sector organisation’s future. Building a culture that prioritizes cybersecurity will ensure that every member of the team understands their critical role in safeguarding the organization and the financial industry as a whole.

The nature of cyber threats will always be evolving, so a well-informed and agile workforce is the most important line of defence because it can adapt to and mitigate risks before they get a chance to occur.

Organizations should also look at additional innovative strategies, such as cross-sector workshops, inter-company threat simulations, or advanced behavioral analytics, as next steps toward deepening their digital resilience. These initiatives not only further empower employees but also help build genuine expertise, creating a ripple effect that will improve security standards across the industry.

California has officially adopted a law requiring AI companies to disclose how they plan to avoid serious risks stemming from their models and admit any critical safety incidents.

The Transparency in Frontier Artificial Intelligence Act (TFAIA), previously known as Senate Bill 53 (SB53), is focused on AI safety.

It includes whistleblower protections, requirements to meet international standards, and a mechanism to report safety incidents. It will also establish a consortium that will work on a new computing cluster accessible in the public cloud to develop safe, sustainable, and ethical AI.

California is of course home to many of the companies developing these technologies, meaning local regulations could have an impact. Anthropic has publicly supported this version of the bill, though has also called for a federal law.

In adopting the new law, California becomes the first US state to legislate on AI safety, ahead of New York which has its own plan in the works. The move comes amid a wider failure to legislate around AI, with no federal AI laws as yet in place.

Indeed, California governor Gavin Newsom signed this new bill into law a year after vetoing a previous AI legislative attempt that was widely opposed and included safety testing for large models and the requirement for a kill-switch to be included in AI systems.

"California has proven that we can establish regulations to protect our communities while also ensuring that the growing AI industry continues to thrive," Governor Newsom said in a statement. "This legislation strikes that balance."

Newsom added: "AI is the new frontier in innovation, and California is not only here for it – but stands strong as a national leader by enacting the first-in-the-nation frontier AI safety legislation that builds public trust as this emerging technology rapidly evolves."

What the law includes

The TFAIA was written by Democratic Senator Scott Wiener, who also wrote last year's vetoed version.

To encourage transparency, the law requires large frontier developers to publish a framework describing how it incorporates national and international standards, in effect sharing their safety plans.

The law also sets up a new mechanism for companies and the public to report critical safety incidents to California’s Office of Emergency Services and creates protection for whistleblowers who disclose significant health and safety risks of frontier models, with a civil penalty for noncompliance.

However, it only requires reports in case of physical harm, with the San Francisco Public Press stating that's been watered down from last year's bill which required all incidents to be reported. The TFAIA also comes ahead of one planned by New York, which requires reporting of any potential risk of serious harm, even before an incident happens. Under the TFAIA, California will fine companies that injure or "contribute to the death of" more than 50 people, or cause $1bn in damage.

But the fine has been slashed from $10m to $1m for a company's first violation, with the larger amount now reserved only for subsequent infractions. New York plans to fine up to $30m for repeated offenses, the San Francisco Public Press report added.

The newly signed regulation also means California will support development of safe AI: first it has established a consortium called CalCompute within the state's Government Operations Agency to develop its own framework for creating a public computing cluster to "advance the development and deployment" of AI that is safe, ethical, equitable and sustainable, the statement from the governor's office said.

To enable the law to keep up with innovation, the California Department of Technology can annually recommend updates based on stakeholder feedback, changes to international standards, or tech developments.

"As artificial intelligence continues its long journey of development, more frontier breakthroughs will occur," said a trio of AI leaders who helped lead a report into AI for Newsom, in a statement released alongside the governor’s.

The trio consists of Fei-Fei Li, co-director at the Stanford Institute for Human-Centered Artificial Intelligence; Jennifer Tour Chayes, dean of the College of Computing, Data Science, and Society at UC Berkeley; and Mariano-Florentino Cuéllar, former California supreme court justice and former member of the National Academy of Sciences Committee on the Social and Ethical Implications of Computing Research.

"AI policy should continue emphasizing thoughtful scientific review and keeping America at the forefront of technology," the trio added.

California counters Trump administration moves on AI

The move puts Newsom further at odds with President Trump, who widely supports unfettered development of the technology.

The government attempted to force into an unrelated bill a provision to ban state-level AI legislation for ten years, though it was removed by Senate amendment in July. In January, President Trump issued an executive order "removing barriers to American leadership in AI" that ended a Biden order on developing safe and secure AI and followed this in July with the US AI Action Plan which aims to heavily deregulate AI.

A statement released from the governor's office notes: "This legislation is particularly important given the failure of the federal government to enact comprehensive, sensible AI policy. SB 53 fills this gap and presents a model for the nation to follow."

A host of key provisions in the EU Data Act will come into effect on 12 September, and there’s a lot for businesses to unpack.

The regulation came into force on 11 January 2024 and while a grace period has been running to ensure implementation, rules under the legislation will be applicable across the European Union (EU) from here onward.

At its core, the EU Data Act will introduce sweeping changes with regard to how data from connected devices and cloud services is accessed, managed, and shared across the union. This includes new rules on data access, service portability for organizations, and contractual fairness.

The potential long-term impact of the legislation cannot be understated, according to Soniya Bopache, VP and general manager for data compliance at Arctera.

“The EU Data Act has the potential to foster a more competitive and equitable data economy – largely thanks to its provisions on data access, fair contractual terms, and cloud switching,” she said.

“For businesses governed by the Act, this isn’t just a matter of compliance, it’s an opportunity to build a more transparent, efficient, and innovative digital ecosystem.”

So what can businesses expect with the EU Data Act?

What industries fall under the EU Data Act?

The legislation applies to a broad range of sectors, spanning areas such as manufacturing, cloud computing, transport, and consumer goods.

Moreover, it’s not limited to the private sector, with public sector organizations also expected to benefit from the legislation, according to Peter Grimmond, VP and head of technology at Cohesity.

“The EU Data Act has huge potential to deliver acceleration of both public and private sector innovation, through increased data democratization and access,” he said.

“For all enterprise and public sector organisations that have a robust, compliant, data classification processes already in place, the act will create an environment of collaboration and innovation where innovation can thrive without compromising corporate resilience or individual rights”

Data Access and Transparency

Data access and transparency is a key focus of the legislation, according to official EU materials on the Act.

Fundamentally, the regulations are designed to “enhance the EU’s data economy and foster a competitive data market” by making data more accessible and usable.

The move comes in the wake of an explosion of connected devices across the union in recent years. These IoT products collect vast volumes of data, which the legislation aims to capitalize on for reuse across the region.

To achieve this, new rules under the act will give users of connected devices - including businesses and individuals - greater control over the data they produce.

Similarly, the Act also includes rules on how enterprises can share data with other businesses. According to Grimmond, this aspect of the legislation could deliver positive long-term benefits for both businesses and consumers alike.

“It will speed the ability for data to be shared from more devices across more organisations, and opens the door for the development of new products, services, and ways of doing business,” he explained.

“Crucially, it does this without undermining the robust privacy standards that are the EU’s hallmark regulatory framework: building on GDPR’s global standard for privacy and aligning with DORA’s focus on digital operational resilience.”

Cloud service flexibility

As mentioned, another core aspect of the legislation centers around data portability, particularly with regard to cloud services. The Act aims to provide enterprises more flexibility in how they engage with cloud providers and, crucially, switching or opting for multiple options.

This aspect of the legislation comes in direct response to growing calls for a more fluid and competitive cloud computing industry in the EU, with enterprises having contended with “vendor lock-in” for several years now.

Running parallel to this frustration has been the rise of multi-cloud and hybrid cloud strategies, whereby enterprises host data on multiple providers, or through a combination of on-prem and cloud-based services.

Yet businesses with one particular cloud provider aiming to switch to another have faced significant costs transferring data. These “egress fees” have become a recurring point of contention and even prompted legal action against major industry providers.

With this in mind, the EU Data Act includes measures that ensure customers can switch from one data processing service to another in a more efficient manner.

Notably, the Act doesn’t specifically rule out vendors charging fees for data transfers. However, it obliges cloud providers to pass on these costs to the customer rather than charging excessive payments.

Some providers have taken steps to adhere to the new legislation. Google Cloud, for example, recently announced it would waive data transfer fees for customers switching to another provider.

MORE FROM ITPRO

• DORA and why resilience (once again) matters to the board
• Everything you need to know about the NIS2 Directive
• What businesses need to know about the General-Purpose AI Code of Practice

The US has injected fuel into the AI arms race with an Action Plan — a sweeping set of aggressively deregulatory and integrative measures that collectively aim to cement American dominance in the technology.

"Whoever has the largest AI ecosystem will set global AI standards and reap broad economic and military benefits. Just like we won the space race, it is imperative that the United States and its allies win this race," wrote Michael J Kratsios, assistant to the President for science and technology; David O Sacks, special advisor for AI and crypto; and Marco Rubio, assistant to the President for national security affairs, in the policy.

The plan itself is focused on three core pillars: accelerating AI innovation, building American AI infrastructure, and leading in international AI diplomacy and security. Beyond the age-old adage of cutting metaphorical "rad tape", the measures also include plans to strip out perceived pro-liberal bias from AI systems and remove guardrails from AI development. Adnan Masood, chief AI architect at UST, tells ITPro this is a "win the race" blueprint that is significant for its "pivot to permissionless innovation".

There will undoubtedly be repercussions for those domestically and abroad, as the plan pledges to change the global economic and trade outlook. That said, it is important to remember that this is merely a plan – not a self-effectuating document, according to Cobun Zweifel-Keegan, managing director, DC at the International Association of Privacy Professionals (IAPP).

"Some of the actions outlined in the plan have already seen progress through executive orders, but many remain just ideas on a page. Nevertheless, it is a very helpful document toward understanding the Administration’s full slate of expected actions on AI and it’s the first real preview we have had into the current thinking on AI policy within the White House."

But how exactly should businesses expect to adapt to the new framework?

What's the point of the AI Action Plan?

The AI Action Plan rolls back on the capacity for various bodies in the US to regulate AI or add core safeguards while the technology is being developed. It contains more than 90 policy recommendations focusing on innovation, infrastructure, and protecting national security. If implemented, the plan has the potential to significantly change what AI developers should expect to do from a compliance standpoint. In other words, it's a ‘shoot first, ask questions later’ approach to AI development. But the gamble may well pay off, according to experts.

"At its core, the plan treats AI not as just another tech sector, but as critical national infrastructure similar to energy or defense," Angeli Patel, executive director from UC Berkeley Law and Business and a practicing attorney, tells ITPro. "Its top priority is ensuring America, not authoritarian regimes, sets the global course for AI by doubling down on domestic strength and production while embedding democratic values of free speech into the systems shaping our future."

The Action Plan also elevates AI development by giving it the same importance as national infrastructure – positioning AI as 'protected' against foreign adversaries and domestic regulation. "That means more money, faster deployment, and a clear win for Big AI."

]Masood agrees that the thrust of the plan is around deregulating early, building fast and exporting American AI end-to-end, adding that it seems substantive enough to achieve these core aims both on paper and in its early implementation. "The plan is dense with agency tasks and the GSA [General Services Administration] vendor list is already live, signaling procurement intent. The crux is execution on permitting, grid, and fabs."

Big Tech companies are big winners

AI developers stand to gain vastly from the new measures, experts tell ITPro. With better access to compute, talent, and a mergers and acquisitions market that is heating up. Patel expects booms in privacy tech, cybersecurity and AI education: "For businesses generally, AI adoption will spread rapidly if it hasn't already – from backend ops to customer-facing products."

Masood believes the industry has plenty to look forward to, as an AI architect and practitioner himself. Promoting open-weight model development, where internal parameters used in the training of large language models (LLMs) are made public, is an exciting proposition in particular. This, combined with standardized evaluations and testbeds, as well as easier federal access and richer public scientific databases, will directly translate into faster time-to-pilot for new systems, more deployment options and clearer acceptance criteria in regulated industries.

The fact that the administration supports the rights of AI developers to use copyrighted materials in training AI models, under "fair use" conditions, is also a nod to developers, with some early district court decisions being favorable to AI developers, according to Arnold&Porter legal analysis. There are, however, some hesitations on whether these decisions will hold considering the Supreme Court has not weighed in, nor has Congress on deciding definitively which way the fair use question will fall.

"It’s been clear since February’s AI Summit in Paris – that also focused on Action – that the Trump administration was going to enable AI in an unencumbered way. So the copyright decision is no surprise," says Amanda Brock, CEO of the open source trade organization OpenUK.

"The content creators shouldn’t be too upset," Brock tells ITPro. "They haven’t won licensing fees for AI training but the reality is that supporting them is a long-term challenge, created by the digital age. This is not purely a consequence of AI and would never really be resolved by copyright. More appropriate long-term solutions are needed."

Meanwhile, the investment picture is looking particularly rosy as a result of the new AI policy recommendations. Masood highlights that, for the likes of Oracle and Microsoft, who are big government players, there will be higher public sector workloads. For chip makers, meanwhile, there will be a strong demand and a boost in sales toward allied and US markets, in light of export control tightening. The emphasis on domestic fabrication, too, supports long-term supply security.

Patel says that Oracle, Microsoft, Nvidia and data center providers like Equinix "stand to gain from expanded government procurement and strong policy tailwinds". She adds: "At minimum, they’ll benefit from favorable regulatory treatment. At best, they'd be able to bid for direct federal investment. One of the most significant benefits for these AI infrastructure giants is the streamlining, or outright removal, of environmental permitting for AI-related infrastructure."

What risks does the new approach to AI open up?

The biggest concern the experts have with the Action Plan is the additional risk that it might add. The Biden administration focused its AI policy on mitigating the risks of disinformation, among other areas. But the National Institute of Standards and Technology (NIST) will now remove any references to diversity, equity and inclusion (DEI) and climate change, as well as misinformation, from its AI risk management framework (RMF).

Patel notes that such disregard for issues like DEI risks narrowing the innovation pipeline in the long term. "The plan sidelines DEI-focused research, which is critical for addressing bias and underrepresentation in LLMs and threatens to withhold support from states or organizations that don’t align politically. That’s not just bad for equity; it’s bad for innovation. By rewarding compliance over creativity, the plan may accelerate dominance at the cost of resilience."

She adds that the biggest downside of the plan is its shortsightedness. "Investing in AI infrastructure while cutting corners on environmental protection and workforce development may help scale the technology over the next five to ten years, but at the cost of hollowing out our core," she explains.

"Job displacement is already underway, and misinformation is already costing billions. This plan accelerates both, with no meaningful guardrails in place. It’s also combative by design. By framing AI as an arms race with China, the plan treats AI as a geopolitical weapon rather than a global system that demands multilateral stewardship. It misses the opportunity to use interdependence as a tool for de-escalation and collective resilience."

Masood focuses on the possible risks in enterprise safety as well as the nightmare of dual compliance, where enterprises will have to invest resources into complying with both US policies as well as EU regulations. With fewer ex-ante rules, regulations devised to prevent disasters before they happen, there will be an uptick in policing failures, including critical bias, safety incidents and privacy breaches, after they occur through existing laws and torts.

In the coming months and years, states will react to the recommendations within the plan and act accordingly. The Trump administration has threatened to divert AI-related federal funding from states with "burdensome AI regulations" and this could have an effect on businesses within those states.

Though California's AI bill was quashed by state governor Gabin Newsom in 2024, Colorado's own AI bill targeting algorithmic discrimination comes into force from February 2026. Other states looking to introduce AI transparency legislation include New York – and IT leaders will need to closely follow how legislation develops in any state they operate within.

The second major enforcement deadline for the EU AI Act is approaching, meaning big tech firms will face a greater degree of scrutiny over AI model safety.

From August 2nd, new governance rules for general-purpose AI (GPAI) models will be introduced through a voluntary Code of Practice.

The deadline represents the second major enforcement date for the landmark legislation this year, following on from a February deadline which focused primarily on prohibited use cases.

Enza Iannopollo, VP principal analyst at Forrester, said that while the onus will be placed on providers, enterprise end-users will also likely feel the impact of the new rules.

“Whilst the first regulatory milestone on 2nd February focused on requirements, including those on prohibited use cases, this second deadline expands accountability and enforcement as it introduces critical provisions regarding general-purpose AI (GPAI) models,” she explained.

“Providers of generative AI models are directly responsible for meeting these new rules, however it’s worth noting that any company using genAI models and systems — those directly purchased from genAI providers or embedded in other technologies — will feel the impact of these requirements on their value chain and on their third-party risk management practices.” 

What the GPAI code of practice means for businesses

The GPAI code of practice will enforce more robust guardrails for training AI models, according to EU lawmakers, and is based on three key pillars.

This includes greater transparency, meaning AI model providers are required to document and disclose training processes and share information on models with regulators.

Safety and security are a key focus of the code, again focusing on whether GPAI models pose risks to the public or enterprises. Under the new rules, providers are required to assess and document potential harms and take appropriate action to reduce any risks.

Dirk Schrader, resident CISO (EMEA) and VP of security research at Netwrix, said security considerations in the act are welcomed and help create a more aligned approach to AI-related security risks.

“One of the most significant anticipated successes of the Act is the standardization of AI security across the European Union, creating a harmonized, EU-wide security baseline,” he said.

“A key strength of the proposed regulations is their emphasis on a security-by-design ethos, mandating a lifecycle approach that integrates security considerations from the outset and throughout an AI system's operational life.”

Security considerations do raise questions over compliance, however. Simply put, there isn’t a solid baseline for enterprises to work from with regard to AI-related security risks at this stage.

“The Act is the first major law to call out protections against data poisoning, model poisoning, adversarial examples, confidentiality attacks, and model flaws,” he said.

“The real compliance burden will be determined by technical specifications that don't yet exist, as these will define the practical meaning of 'appropriate level of cybersecurity' and may evolve rapidly as AI threats mature.”

Elsewhere, rules pertaining to copyright are also outlined in the code of practice, and this has been a major point of contention in recent months. For example, under the code, signatories must ensure training data is sourced lawfully.

A host of major tech companies have agreed to the code of practice, most recently Google and OpenAI. Some, however, have taken a harder stance.

Earlier this month, Meta revealed it won’t sign up for the code of practice amid what it described as concerns over “legal uncertainties”.

In a LinkedIn post clarifying the company’s stance on the code, Meta’s chief global affairs officer Joel Kaplan said the code will introduce measures which “go far beyond the scope of the AI Act”.

"Europe is heading down the wrong path on AI. We have carefully reviewed the European Commission’s Code of Practice for general-purpose AI (GPAI) models and Meta won’t be signing it," he said.

The risks of non-compliance

Organizations that fail to comply with the EU AI Act face serious repercussions, and while the new code of practice is voluntary, Iannopollo said it’s crucial that enterprises operating in the region pay close attention to the enforcement deadline.

“Like it or not, the EU AI Act will contribute to shape AI risk management and AI governance practices of most global companies,” she said. “Its requirements may not be perfect, but they are the only binding set of rules on AI with global reach, and it represents the only realistic option of trustworthy AI and responsible innovation.

“It’s crucial that companies operating AI technology in the EU, or using AI-generated insights within the EU market, pay attention to this enforcement milestone.”

The EU AI Act contains “significant fines” for non-compliance, including up to 7% of a company’s global turnover. Iannopollo noted that not all the authorities responsible for enforcement are up and running yet, but others are, including the EU AI Office.

“Companies, make no mistake: there will be action in the next few months,” she said.

MORE FROM ITPRO

• The EU just shelved its AI liability directive
• How the EU AI Act compares to other international regulatory approaches
• Everything you need to know about the EU AI Act

It’s been some time since the Network and Information Systems 2 (NIS2) Directive (NIS2) came into force in the EU but many organizations are still struggling to comply. So much so that the EU’s leading security agency ENISA has issued a stark warning after finding that six critical national infrastructure (CNI) sectors are failing in their implementation of the directive.

ENISA found a need to align requirements across borders in each NIS sector. It said that collaboration must be strengthened through community building events and cooperation at sector, national and EU level.

Some industries are more far behind others, according to the report, which calls out six sectors struggling to meet the expectations of NIS2: ICT service management, space, public administrations, maritime, gas and health.

So why is NIS2 compliance causing so many headaches and what can security leaders do about it?

Challenged sectors

Some sectors were not equipped to deal with NIS2’s cybersecurity requirements in the first place. Certain industries are struggling due to complex and outdated infrastructure, a lack of sector-specific guidance and “insufficient investment in cybersecurity measures”, says Matt Riley, director for information security at Sharp UK and Europe.

All the highlighted sectors in ENISA’s report share common challenges, says John Lynch, director at Kiteworks: “Complex supply chains with numerous third-party data exchanges, limited visibility into how sensitive data moves between entities, and difficulty implementing the governance controls required by NIS2 for secure data sharing across organizational boundaries.”

One of the most affected sectors is ICT service management, which faces difficulties due to its cross-border nature and the “vast number of diverse entities” involved, says Vincent Lomba, chief technical security officer at Alcatel-Lucent Enterprise. This complexity makes it challenging to implement uniform cybersecurity measures across all levels of the sector, he says.

Healthcare also faces obstacles in complying with the NIS2 Directive, because organizations tend to have complex, interconnected supply chains that introduce vulnerabilities. “Additionally, the widespread use of legacy systems and poorly secured medical devices increases the difficulty of compliance,” Lomba explains.

Adding to this, healthcare is often held back by tight budgets and a lack of resources, making it no surprise that compliance is challenging.

Small businesses also face budget constraints and are under “significant pressure” to manage operating costs while maintaining their service delivery, says Lomba.

In contrast, sectors such as electricity, telecoms and banking have shown “strong resilience and maturity” in their cybersecurity practices, says Riley.

These sectors benefit from long-term investments, robust regulatory oversight, and strong public-private partnerships. This “proactive approach to cybersecurity”, including regular risk assessments, continuous monitoring and “a culture of collaboration and information sharing” makes the sectors much more prepared than their peers in other industries, he points out.

Country-by-country regulation

There are issues with the regulation at a country level holding many firms back from NIS2 compliance. Only a handful of EU member states including Belgium, Croatia, Hungary, Italy, Latvia, and Lithuania have adopted national legislation to transpose the NIS2 Directive. Others remain at various stages of implementation, says Scott Hudson, principal consultant at Bridewell.

Governments are facing capacity constraints and competing priorities, which has delayed the process, he says. “The fact that many member states have not yet established the laws needed to implement NIS2 clearly makes compliance challenging.”

The UK is not directly regulated by NIS2 following Brexit, but the regulation does impact firms doing business in the EU. At the same time, the UK has its own NIS regulations, which are being strengthened to align with NIS2's principles.

The proposed UK Cyber Security and Resilience Bill is not expected to be as broad in its sector focus as NIS2. Yet it will align the UK more closely with the EU's approach, says Clare Reynolds, digital resilience specialist at Taylor Wessing UK. “The expectation is that the UK regime will be no more onerous than NIS2, with minimal additional policies required to comply with both.”

Compliance quick fixes and long term strategies

If the NIS2 Directive impacts you, it’s important to not bury your head in the sand, says Hudson. He recommends gaining “a clear understanding of your assets, systems, critical functions and cyber risk exposure”, which he says is “essential” to remaining compliant.

Ollie Gower, senior managing director in the cybersecurity practice at FTI Consulting thinks an “organization-wide, risk-based approach” that “considers the business, culture, technology and supply chain” is key. “With so many elements to take into account, a pragmatic approach based on quick wins and clear prioritization of the most prominent gaps is recommended.”

To boost compliance with NIS2, organizations can adopt both quick fixes and long-term strategies. For a quick fix, Gower recommends firms appointing a leader to take control of NIS2. At the same time, organizations should focus on visibility. “Map out your critical assets, ICT systems and suppliers. You can’t secure what you don’t fully understand.”

Riley concurs, advising firms to conduct “comprehensive risk assessments to identify your assets”.

At the same time, ensure you are implementing basic cybersecurity hygiene practices such as regular software updates and patch management, and providing awareness training to employees, he adds.

Long-term strategies involve developing a robust cybersecurity framework, aligned to recognized standards such as ISO27001, alongside continuous monitoring and regular audits.

Hudson also advises ensuring you have dedicated resources, either in-house or externally, with the right skills and capabilities to “assess risk, prioritize efforts and drive compliance forward”.

Supply chain risk is a major part of NIS2. Taking this into account, organizations — especially those in high-risk sectors with complex supply chains such as healthcare — need to start evaluating their third-party vendors more rigorously, says Gower. “Create a provider inventory, and ensure there are clear expectations in contracts with third parties around cybersecurity practices.”

Meanwhile, having a basic, well-communicated incident response plan in place can make “all the difference in a time of crisis”, says Gower. He recommends “getting leadership involved early” and “making sure they understand the stakes.”

Meta has said it won't sign up for the EU's code of practice for providers of general-purpose AI models, citing concerns over "legal uncertainties".

The voluntary guidelines form part of the EU AI Act, due to come into force next month. They ask companies to, amongst other things, refrain from training AI on pirated materials and comply with requests from content creators to omit their work from training data.

As part of the rules, providers are also required to issue regular updates on AI tools and services.

While the code is voluntary, the EU has said that AI providers who don't sign up will be expected to demonstrate compliance by other means, and might face more regulatory scrutiny.

Meta has hit back at lawmakers, however, accusing the EU of overreach.

"Europe is heading down the wrong path on AI. We have carefully reviewed the European Commission’s Code of Practice for general-purpose AI (GPAI) models and Meta won’t be signing it," wrote chief global affairs officer Joel Kaplan in a post on LinkedIn.

"This Code introduces a number of legal uncertainties for model developers, as well as measures which go far beyond the scope of the AI Act."

Meta has history with the EU

Meta has been complaining about the AI Act for a while. Last summer, Mark Zuckerberg and Spotify CEO Daniel Ek issued a joint statement saying that "Europe’s risk-averse, complex regulation could prevent it from capitalizing on the big bets that can translate into big rewards."

The tech giant has support from US president Donald Trump on the issue, who has called for the AI Act to be paused - although the EU appears to be standing firm.

Henna Virkkunen, the European Commission vice-president responsible for tech sovereignty, recently said lawmakers are "very committed to our rules when it comes to the digital world".

Earlier this month, companies including Google, Meta, Airbus, BNP Paribas, and TotalEnergies called for a two-year delay in implementation, claiming that as it stands, the AI Act will stifle innovation.

"Businesses and policymakers across Europe have spoken out against this regulation. Earlier this month, over 40 of Europe’s largest businesses signed a letter calling for the Commission to ‘Stop the Clock’ in its implementation," said Kaplan.

"We share concerns raised by these businesses that this over-reach will throttle the development and deployment of frontier AI models in Europe, and stunt European companies looking to build businesses on top of them."

OpenAI and Mistral have already signed the code - although the latter has voiced concerns about the impact of the legislation.

"Compliance with the Code and the AI Act’s risk based framework must be as simple and streamlined as possible for the homegrown start-ups and smaller businesses that will be the future leaders of Europe’s AI-first economy," said OpenAI in a statement.

"We have advocated⁠ for greater simplification and harmonization to support these next generation companies and will continue to back their concerns, as they are key to AI of, by and for Europe."

MORE FROM ITPRO

• The UK government is working with Meta to create an AI engineering dream team
• Meta faces new ‘open washing’ accusations with AI whitepaper
• Meta is working on a 5GW data center to supercharge AI infrastructure

The UK government’s Online Safety Act (OSA) comes into force on 25 July 2025, requiring technology platforms to implement processes and systems to prevent users – particularly children – from accessing “harmful and age-inappropriate digital content”.

The UK’s media regulator, Ofcom, which will be enforcing the new act, says that 59% of teenage children (aged 13-17) have encountered potentially harmful content online. It has determined that technology providers can do more to address this and has set out new codes of practice to which these providers must adhere.

“The Online Safety Act introduces a fundamental shift in how online services – both UK-based and international – must operate when accessible by UK users,” explains Dr. Loredana Tassone, Managing Consultant and Head of EU and UK Representative Services at GRCI Law. “Ofcom now holds wide-ranging investigatory and enforcement powers, making compliance not just a legal necessity, but an operational and ethical imperative.”

The legislation regulates operators of digital platforms in a number of new ways, making them more responsible for their users’ safety. And it includes the responsibility to implement systems and processes that reduce the risk of illegal activity, including the removal of illegal content when it does appear.

“The regulator, Ofcom, has the power to require the provision of certain information, to issue fines of up to the greater of 10% of global annual turnover or £18m and to impose various business disruption measures,” says Nick Harrison, senior associate at global law firm Taylor Wessing. “New criminal offences are also introduced for certain breaches or failures to comply.”

All tech businesses operating in the UK need to carefully consider whether their services comply with the law and keep it in mind when seeking to expand in the region.

Ofcom’s guidance

On 24 April 2025, Ofcom presented its codes of practice to the UK Parliament, publishing guidance on how providers should carry out risk assessments for evaluating the potential harm to children, with services given three months to complete their audits ahead of the 24 July deadline.

“The Act places significant demands on platform governance and user content moderation, especially for services likely to be accessed by children,” says Tassone. “Businesses will need to embed safety into their governance structures, assess and mitigate content risks proactively, and implement age assurance mechanisms that are effective yet privacy conscious.”

The OSA doesn’t just apply to UK businesses, either, or those with a physical presence in the United Kingdom; it applies to any service which has "links with the UK".

“This threshold can be met in a number of ways: if the number of UK users of the service is "significant" (this is deliberately not defined and will be context-dependent), if UK users are a target market of the service, or if content on the service presents a material risk of significant harm to users in the UK who can access the service,” Harrison tells ITPro.

The OSA sets out a range of duties and explains how providers should approach them. For example, one of the safety duties surrounding illegal content is to take proportionate measures to prevent users from encountering that content. And it also stipulates that this applies to how a service is designed, operated and used.

“It is simply not enough for a provider to say that it was happy with the original design of a service and the real-world operation of it was uncontrollable,” says Daniel Milnes, partner at Forbes Solicitors. “What happens to users, specifically including the effect of algorithms, is a provider’s responsibility. The existence of this specific set of duties, mandatory assessments and reporting, and dedicated enforcement powers, is certainly intended to make providers focus more on protecting users.”

Concerns from SMEs

Smaller companies, especially SMEs and startups, have expressed concerns that the Online Safety Act may place excessive pressure on them.

"Implementation of the Online Safety Act faces hurdles in cost and technical feasibility,” explains Jason Soroko, Senior Fellow at Sectigo, a leading provider of SSL certificates. “Platforms, especially smaller or independent operators, may struggle with the expense of robust age verification and content moderation tools.

“Enforcement also poses challenges due to varied jurisdictional reach and resource constraints. Regulators risk focusing on easily targeted platforms while larger, multinational sites exploit legal loopholes or inconsistent international cooperation.”

Kevin Quirk, director at AI Bridge Solutions, agrees that the Online Safety Act may result in smaller companies being disproportionately affected, whilst also facing greater scrutiny from Ofcom.

“While large tech firms have long had legal teams and compliance departments in place, the Act presents a real challenge for smaller companies like ours, particularly when trying to remain agile and cost-effective,” Quirk tells ITPro. “Since the Act came into force, our clients have become far more cautious when launching new platforms. We’re seeing delays in deployment timelines while legal teams reassess features. Others have asked us to rebuild or modify platforms to better align with safety-by-design principles.”

Quirk also claims that, whilst the Act requires “reasonable steps” to be taken, it doesn’t do a satisfactory job of defining what “reasonable” looks like for an SME. “That ambiguity creates risk,” he says. “We’re spending more time than ever on policy, legal consultations, and risk assessments; resources that would otherwise go toward development and innovation.”

Potential knock-on effects

Alongside the added pressure of cost and compliance, there have also been concerns raised about a lack of clarity around “harmful content”, which may further complicate compliance, as platforms concerned about incurring fines are forced to navigate the waters between the Scylla of harmful content and the Charybdis of excessive censorship.

“One consequence may be censorship,” says Boris Cipot, senior security engineer at Black Duck, which helps teams manage security and compliance risks. “In many cases, content will be removed or prohibited due to generic rules disregarding the context due to the fear of facing penalties. This may mean that different viewpoints might be disregarded.”

Nick Henderson-Mayo, Director of Learning and Content at compliance eLearning and software provider, VinciWorks, agrees that censorship needs to be addressed with consideration, as it could affect areas such as encryption, an issue that was raised by companies such as WhatsApp and Signal in 2023.

“Encryption could be at risk if scanning mandates go too far, and fear of fines might lead to over-censorship. Ofcom says it’ll act proportionately, but privacy-focused platforms are watching closely,” says Henderson-Mayo. “In fact, several chat app providers have warned that if compelled to scan private messages proactively, it would “nullify the purpose of end-to-end encryption”. Some secure messaging apps might even withdraw from the UK rather than compromise their encryption, but we will need to see if they are serious or just scaremongering.”

While the UK’s Online Safety Act will mirror the EU’s goal of making the internet safer, with both the UK and EU acting in concert, there are concerns that the OSA and the EU’s Digital Services Act (DSA) may dissuade companies from launching and operating in Europe.

But Cipot tells ITPro that while firms may be concerned about this, the long-term effect is likely to be beneficial.

“Some services might not be willing to enter the UK market as they do not want to implement the additional safeguards. On the other hand, would you be ok using a service that does not have the safeguards provided by the Act?,” says Cipot. “I believe the Act will be a good way to ensure online safety improves.”

Preparing for the Online Safety Act

To prepared for the OSA, IT companies will need to determine whether they are in-scope and, if so, familiarize themselves with the various duties under the OSA and related guidance from Ofcom. They should then begin carrying out risk assessments as soon as possible. “This is a significant task and should not be put off since the timelines are quite tight and many deadlines for compliance have already passed,” explains Harrison.

By 25 July, affected online services, which are likely to be accessed by UK children, need to complete their risk assessment and comply with Ofcom’s Protection of Children Codes.

“The July 2025 deadline to protect children from harmful content adds urgency,” says Tassone. “Organizations should act now—conducting gap analyses, assigning accountability, and building cross-functional governance—to meet expectations and reduce compliance risk.”

Apple is pushing back against new app store rules imposed by the European Commission (EC), claiming the EU body has taken changes and a €500 million (£430m) fine too far.

The EC levied the fine in April, arguing Apple was in breach of anti-steering obligations in the EU Digital Markets Act (DMA). That refers to Apple's long-running ban on alternative app stores and rules that stop developers from telling users about discounts or other offers outside of the Apple platform.

Apple previously took a cut of up to 30% on sales inside apps and has been locked in a war of words over the practice with developers.

The tech giant complied with the app store rule changes last month in order to avoid additional fines that could reach 5% of its average revenue globally.

That included a wider range of commission rates up to 13%, alongside user acquisition fees, with the costs dependent on what marketing support the developer wants in the App Store as well as technical aspects such as automatic updates.

Developers will also be able to promote alternative ways of purchasing services outside the app, though Apple would charge a commission on sales advertised via apps in its App Store.

Apple is baffled, the EC is standing firm

Key to Apple’s argument, and appeal, is that the company claims this new system is "confusing" to business users.

"Today we filed our appeal because we believe the European Commission’s decision – and their unprecedented fine – go far beyond what the law requires," said Apple in a statement.

"As our appeal will show, the EC is mandating how we run our store and forcing business terms which are confusing for developers and bad for users."

Apple has yet to reply to a request for comment from ITPro.

The Commission, meanwhile, is standing by its decision. In a statement responding to the appeal, it said: "We stand ready to defend our decisions in court.”

The EC previously said that Apple shouldn't charge developers for the right to "steer" customers, suggesting that a commission on sales promoted in-app wouldn't meet requirements.

Political battle

A legal expert told The Guardian that Apple may be employing delay tactics.

"The blunt truth is that it is worth spending a few million on legal fees in order to disrupt and delay the development of a more open app ecosystem, which is a market that is worth many billions a year to Apple," Tom Smith, a competition lawyer at Geradin Partners, told the publication.

The app store quarrel isn't the only ongoing battle between the EU and tech companies. In April, Meta was hit with a €200m fine for charging users to get rid of ads, while last year Apple was fined €1.8bn over music streaming competition.

The appeal comes ahead of US President Donald Trump's 9 July deadline to settle a trade deal with the EU or risk 50% tariffs. The Trump administration has repeatedly said the EU is targeting US tech companies in retaliation for trade disruption and other political concerns, with Trump trade advisor Peter Navarro calling it "lawfare".

EU action against tech giants stretches back well before even the first Trump administration, with a €497 million fine against Microsoft in 2004 over Windows Media Player bundling that was later increased to €899 million for non-compliance.

That was followed by cases against Intel in 2009, an investigation against Google on search that began in 2010, and investigations into taxes that pulled in Apple and Amazon beginning in 2014.

That said, things have accelerated since 2017 with a €2.42bn fine against Google over price comparison shopping services. In subsequent years, EU lawmakers imposed a €4.34bn for Android and €1.49bn over AdSense, with other cases targeting Apple, Amazon and Meta in recent years.

MORE FROM ITPRO

• Apple throws cold water on the potential of AI reasoning
• Apple is offering rewards of up to $1 million to find critical flaws in its private AI cloud systems
• Apple: Our AI data was gathered responsibly