AI minister Kanishka Narayan has been given a seat in incoming prime minister Andy Burnham’s cabinet following a reshuffle.

Narayan described the move as a sign of Burnham’s “deep commitment to AI’s importance” to the UK economy.

“AI is likely the most significant technology in human history. Its impact will dwarf other things,” Narayan said in a post on X.

“The best case for it is compelling beyond our dreams: a reindustrialised Britain, stronger national security, public services transformed for the better. The risks, too, are real: it is right that the British public shares those worries, for jobs, for the pace of change.”

The move comes as the UK's Department for Science, Innovation, and Technology (DSIT), where the AI minister role used to sit, has been scrapped in the wake of Burnham’s appointment.

Under the new setup, DSIT responsibilities will be merged with the freshly minted Department for Business, Innovation, Science, and Trade (DBIST), led by Jonathan Reynolds.

The role of technology secretary has also been cut.

AI focus welcomed

Mark Boost, chief executive of UK-based cloud computing firm, Civo, said retaining and elevating Narayan is a reassuring signal for UK businesses.

“Giving the AI minister direct access to cabinet decisions demonstrates that the government recognizes AI’s existential importance to our future economy,” he said.

“Positioned inside a high-powered business and trade department, an AI Minister with Cabinet authority will have real leverage to break down cross-Whitehall silos, accelerate national AI infrastructure, and give British tech companies the proactive backing needed to maintain a competitive global advantage.”

Andy McLean, CEO of the UK Semiconductor Centre, echoed Boost’s comments, noting that Narayan’s new role is a “positive signal of the importance being placed on AI at the center of government”.

Boost added, however, that any delays to AI-related initiatives caused by the DSIT shake-up could have a significant impact on global competitiveness.

“Any Whitehall restructuring brings administrative friction, and because the global tech and AI arms race is moving so quickly, the UK simply cannot afford a pause,” he said.

“Critical initiatives like the AI Opportunities Action Plan and sovereign infrastructure investments must be ring-fenced from bureaucratic delays.”

FOLLOW US ON SOCIAL MEDIA

UK tech industry stakeholders have hit back at alleged plans to scrap the Department of Science, Innovation and Technology (DSIT).

TechUK, a trade association for the country’s digital sector, described the rumoured move as a “terrible signal” for a burgeoning industry, which it noted is growing at a rate of 10% per year.

“Breaking up the work of DSIT endeavours such as the world-leading AI Safety Institute, the Sovereign AI Fund, GDS, and UKRI would slow momentum at a time when pace is essential for both the growth of the economy and our standing on the global stage,” techUK said in an open letter published on 19 July.

The backlash comes after the Financial Times reported on 17 July that incoming prime minister Andy Burnham plans to abolish the department.

Sources told the publication that advisers are creating plans to hand over technology policy to a larger business department, led by former business secretary Jonathan Reynolds.

ITPro approached the DSIT for comment, but did not receive a response by time of publication.

The move would see a return to a similar setup for science and technology policy prior to the foundation of the department in 2023.

The DSIT was formed under Rishi Sunak’s premiership and given direct responsibility for policy on these fronts. The department now plays a key role in driving growth in key digital sectors and leading digital transformation across public services.

According to Dom Hallas, executive director of the Startup Coalition, attempts to incorporate DSIT within a broader business department could dilute its influence and negatively impact the broader technology sector.

“A mega department would mean British tech competing with British steel for attention. And waste 6 months reorg-ing when time is of the essence. Not good,” Hallas said in a post on X.

Matt Clifford, AI adviser to outgoing prime minister Keir Starmer, echoed Hallas’ comments in a post on X.

“This would be a big mistake,” he wrote. “Right now is a critical moment for tech as an economic and national security issue. Tying up our most senior science and tech officials in a reorg wastes time and energy that’s desperately needed for the actual substance.”

Tim Flagg, CEO of trade association UKAI, took a different view, however, saying that while an overhaul of the department might cause disruption, the creation of a “super-department” could ultimately sharpen the country’s focus on AI.

“AI has the potential to transform Britain’s economy, our public services, and our security for a generation. Rethinking which department oversees this industry does not necessarily mean Burnham’s Britain is turning its back on that potential,” he said.

“It could even signal an ambition to go further: AI elevated into a super-department or placed at the very heart of the Cabinet Office. The real danger isn’t the ambition; it’s the distraction and the delay.”

All-in on AI

A recurring theme in the pushback to the proposals lies in the timing and current tech sector trends.

The UK government has placed a strong focus on supporting the UK’s burgeoning AI sector over the last two years under the premiership of Keir Starmer, with the aim of positioning the country as a leading economy on this front.

When Downing Street announced the AI Opportunities Action Plan, Starmer described the technology as the “defining opportunity of our generation”.

2025 saw a host of major global tech firms, including Nvidia and Microsoft, pledge billions in support for the UK tech sector, with a particular focus on infrastructure build-outs.

Additional hardware and skills-related investment was unveiled by Downing Street at London Tech Week last month.

FOLLOW US ON SOCIAL MEDIA

Google DeepMind CEO Demis Hassabis says only the United States is up to the task of keeping AI safe – but it's unclear why technology rivals, notably China, would heed an American standards body.

Hassabis has called for a framework for testing frontier models, on the grounds that he believes progress has been faster than expected and artificial general intelligence (AGI) will arrive imminently.

He argues that such work should be led by the US because of its technical and economic standing.

"This US-initiated effort would provide a strong starting point for creating shared international standards on Frontier AI," Hassabis noted in a social media post.

"Since this technology is going to affect the entire planet, ideally this framework would spur the international community to reach a consensus on how to manage the most serious risks while ensuring everyone has access to and can benefit from the opportunities that AI brings."

Hassabis' call for a US-led framework for managing AI follows similar calls by Anthropic CEO Dario Amodei and OpenAI CEO Sam Altman. Following a meeting on the subject last month, China called for a global AI organization open to all countries, rather than one led by the US.

The US has pushed for AI developers to submit models a month before release for testing, while the UK has its own testing regime via its AI Security Institute; Hassabis is British, and DeepMind was founded in London before being acquired by Google.

It's unclear why international AI companies would submit to US approval. The only motivation given by Hassabis is that frontier models would be required to pass this standards body's assessment in order to be deployed in the US.

Hassabis’ comments come after Anthropic’s Mythos and Fable models were hit with a temporary export ban by the White House amidst security concerns.

How would it work

Beyond being US-managed, Hassabis described a standards body that was federally overseen, such as a public-private partnership or self-regulatory organization, pointing to the Financial Industry Regulatory Authority (FINRA).

"The Standards Body would be responsible for developing assessment protocols and working with appropriate federal agencies and the US National Labs to conduct testing in areas relevant to national security," he said.

Anyone making a "frontier model" – as defined by a set of benchmarks – would be considered a "frontier lab", and be "encouraged" to adopt certain best practices.

This would include publishing technical details, ensuring internal security is up to standard, vetting key personnel, and adequate resourcing safety research.

Non-frontier models, such as those made by startups or academia, would not be expected to take part.

Hassabis also called for frontier labs to share new modes with the standards body 30 days before release, something the US government has pushed key developers to do with their AI models.

"Once the assessment protocol is shown to be effective and robust, formalisation could quickly follow, meaning that Frontier Models would be required to pass it to be deployed in the US market," Hassabis said. "Labs would also work with the Standards Body to address any critical post-release vulnerabilities."

Assessments conducted by the standards body would evaluate security, biological, and other threats, and check how well they withstood attempts to dodge guardrails. The tests would be regularly updated.

"The strength of this approach is it would be technically focused, while at the same time supporting innovation and incentivising responsible behaviour," he said.

FOLLOW US ON SOCIAL MEDIA

Stronger powers could be needed to regulate the use of AI in financial services as consumers flock to the technology for advice, according to the Financial Conduct Authority (FCA).

Following an investigation into the technology and its impact on consumer finance activities, the regulator has recommended a formal review into how to regulate the use of general-purpose LLMs across the industry.

The FCA report – known as the Mills Review after its author – noted that companies and consumers are increasingly delegating decisions about finances to AI and AI-powered systems.

A survey by the regulator found that one-in-five adults were already open to the idea of general-purpose AI tools – such as Claude, ChatGPT, or Gemini – making financial decisions on their behalf, in particular around debt advice, pensions, and investments.

While that could help reduce existing challenges such as "advice gaps" and friction around switching services, the FCA warned about risks including fraud and scams, as well as disrupting market structure and competition.

"AI offers a once-in-a-generation chance to close the information asymmetries and frictions that have long left people making poor financial decisions," said FCA executive director and report author Sheldon Mills in the forward to the review.

"The right spur, in retail financial services, is ensuring consumers can make healthy ones; regulation, whether supportive or restrictive, should serve that outcome."

The FCA noted that many consumers may not be aware that they have no formal recourse if something goes wrong, and said some assume they receive equal protection akin to traditional sources of advice.

Emma Banymandhub, CEO of The Payments Association, agreed that the gap in understanding could cause issues and urged caution on the part of consumers.

"Consumers may be increasingly comfortable using AI agents for routine tasks such as weekly shopping, but AI-driven savings and investment decisions present a very different set of challenges," Banymandhub commented.

"While AI can increasingly explain investment concepts and analyse financial information, personalised investment recommendations remain subject to important regulatory constraints."

AI gains traction in financial services

The financial services sector has rapidly emerged as one of the key growth spaces in terms of the use of AI, with a host of major providers across the UK ramping up adoption of the technology.

As ITPro previously reported, high street lenders such as Nationwide, Lloyds Banking Group, and Yorkshire Building Society have all made significant strides on this front over the last six months.

A parliamentary inquiry into the use of AI in financial services, published in January 2026, found that the sector “substantially outpaces” others with regard to AI adoption.

Indeed, around 75% of UK-based financial services firms are now using the technology, with insurers and large banks among the most aggressive in their pursuit of AI adoption.

Running parallel to this, the use of AI by consumers is also surging, according to research from Lloyds Banking Group. The firm’s 2025 Consumer Digital Index found that AI has “rapidly become a financial tool for millions across the UK".

56% of adults – equivalent to around 28 million people – revealed they’d used AI over the preceding 12 months for financial advice. ChatGPT, for example, was referenced as the most popular platform in this regard, used by six-in-10 consumers.

What the Mills Review recommends

With this in mind, the Mills Review recommended that the existing "regulatory perimeter" needs to be secured and adapted to take in AI's impact on retail financial services – and that should come via a review within the next six months into how AI is affecting the market.

"The review should examine how consumers use AI including general purpose LLM tools for personal financial management across savings, investments, pensions, mortgages and debt management, and the implications for competition, innovation and growth," the Mills Review said.

"It should examine the risks of consumer harm, including how far its usage has or will move along the autonomy spectrum, and any impacts on market integrity and the potential for regulatory arbitrage."

Based on that review's guidance, the FCA could tweak regulation as necessary, the report said. Beyond that, the review called for the FCA to monitor for evidence of harm and new consumer models, engage with providers for better insight into changes, and be ready with intervention tools and mechanisms as necessary.

Frontier model monitoring in finance

In the longer term, the Mills Review called for the FCA to keep an eye on frontier model capabilities and AI adoption, considering its impact on its regulatory work, in particular where use of AI falls outside of existing protections and once AI agents start taking more action on behalf of consumers.

The review also called for stronger powers for the FCA so it can look at these issues more widely.

"As is clear in the report, we need to keep pace with a rapidly changing environment and the principles-based, outcomes focussed approach we’ve taken on AI – relying on the Consumer Duty and Senior Managers Regime – has been critical to us doing so," said Ashley Alder, chair of the FCA.

"The recommendations build on work the FCA has been doing – not least allowing firms to test their use of AI with us – and our own use of AI to be a smarter regulator, more efficient and effective."

Banymandhub added that walking that balance between enabling AI and protecting consumers and companies was key.

"The FCA’s Mills Review reinforces that firms should treat agentic AI as an accountability and governance issue now, while providing greater confidence to innovate responsibly as AI adoption accelerates," she said.

"AI has enormous potential for financial services, but realising that potential will depend on strong governance, clear accountability and maintaining consumer trust."

FOLLOW US ON SOCIAL MEDIA

Europe’s complex network of overlapping regulations is hitting startup founders hard and holding back business, according to a new research by startup support organization DutchBasecamp.

Some 79% of tech founders claim they've been hit by regulatory friction over the last year, according to the The Realities of Scaling in Europe report, which was launched in partnership with the Computer & Communications Industry Association (CCIA).

More than half (58%) said they'd delayed entering another EU market, 45% have paused or canceled features, and 44% have experienced delayed or lost deals.

As negotiations on the Digital Omnibus continue, the CCIA warned that many meaningful simplification measures could fall by the wayside, which has the potential to further compound challenges faced by startups.

Some member states are resisting a proposal allowing businesses to report a cybersecurity incident once, rather than separately under seven overlapping frameworks.

Meanwhile, a fix that would establish legitimate interest as a legal basis for responsible AI training has been stripped out.

While postponing certain deadlines has provided some breathing room, many simplifications have been rejected, leaving developers with limited implementation time while essential codes, guidance, and standards are still missing.

“We warned from the start that the Commission’s proposals to simplify the patchwork of EU tech and digital rules were only the bare minimum. Instead of going further, Parliament and Council are now weakening, rejecting, or delaying even the most basic fixes," said Daniel Friedlaender, senior vice president and head of CCIA Europe.

“Europe’s innovators have shown remarkable patience in navigating today’s regulatory maze, but that patience is running out. EU institutions and member states need to wake up: 2026 must bring real improvements for tech companies. Europe knows the problems. If we refuse to fix them, we can’t be surprised if our founders look outside the EU for success.”

Growing regulatory friction

Nearly a quarter of survey respondents said they'd spent more than 30% of their budgets on compliance costs, while 24% are considering or have already relocated their headquarters due to regulation.

In January, the European Investment Bank, with the European Commission, found that roughly one-in-ten EU scale-ups have relocated abroad, with around 85% of those moving to the United States.

The Commission’s Joint Research Center put the headquarters-relocation rate for venture-backed startups at between 3.3% and 4.3%, ten times the rate for comparable non-VC-backed firms.

More than half of founders said they'd steered clear of an EU country because of regulatory concerns, and only 21% said they'd seen no material impact from EU or national rules.

"Europe is already losing tech founders, products, and growth," said Masha Moisseyeva, managing director of DutchBasecamp.

"When 45% of those surveyed have paused or cancelled features, 58% have delayed entering another EU market, and 44% have lost or delayed deals in a single year, the urgent need for regulatory simplification is no longer a theoretical debate about EU competitiveness. The damage is happening now.”

Regulatory confusion is rife

Much of the cost, the researchers found, comes not from compliance itself but from not knowing what compliance will require.

Indeed, founders often cite uncertainty surrounding future EU AI Act obligations before any requirement has formally bound them.

“Founders are not asking the EU to lower its standards. They are asking for clear, workable rules they can rely on across the Single Market," said Moisseyeva.

"Instead, uncertainty and overlapping obligations are dictating what they build, who they serve, and how fast they grow.”

FOLLOW US ON SOCIAL MEDIA

People in the technology sector often joke that anything new in winter will be obsolete by spring. This is especially the case in cybersecurity, where hacker groups and cybersecurity teams are locked in an ever-escalating war of attrition.

The speed of obsolescence far outpaces the legislative process: it can take up to two years for government bills to be enacted into law. This is due to the parliamentary process, where various readings, committee hearings and reports are required to ensure that bills are adequately scrutinized.

An outdated system

“The legislative process in this country is essentially a Victorian process, in the sense it takes a long time,” says James Morris, chairman of CSBR, who spoke to ITPro earlier this month at InfoSecurity Europe in London.

“Meanwhile, the world is changing every day. How you deal with that is, I think, a question of not wanting to try and do everything at once.”

Legislation tends to lag behind technology as the speed of technical innovation far outpaces the law-making process. Therefore, cybersecurity legislation risks becoming redundant before it is enacted.

Compounding this challenge is the intensification of cyber threats, in particular the problem of state-sponsored hacker teams and organized crime groups repeatedly targeting national infrastructure for financial or political gain.

“The Cyber Security and Resilience Bill represents a step change to our national security that will protect the services people rely on every day - reducing the risk of disruption to public services and businesses, and ensuring a faster national response when threats emerge,” said a spokesperson for the government.

“The Bill gives government powers to update cyber regulations as risks evolve, so our defences can keep pace with evolving threats. But there is also a lot we can do, and are doing, outside legislation. For instance, we're urging organizations across the economy to boost their resilience by signing up to the Cyber Resilience Pledge.”

As few politicians have an in-depth understanding of cybersecurity, they hence rely on committee hearings in order to become informed on the subject. However, the expert speakers have purely an advisory capacity, so governments are not bound to abide by their guidance.

As a consequence, there is often friction between government regulators and private enterprise. The government regulators could perceive emerging technologies as a potential risk to the public, whilst technology companies might consider that regulatory guard rails hamper development and innovation.

Regulation vs innovation

“There's a tension between regulation and innovation, and wanting the UK to be a technological cyber power in its own right,” says Morris.

“That’s a constant tension in policy, and that applies to the Cybersecurity and Resilience Bill as well, because as that regulatory system starts to get embedded, it's going to have an impact on small and medium-sized companies. We don't want to over-regulate markets which present the UK with growth opportunities.”

Given the rate of progress in technology, acts of law set broad expectations, with associated government regulation intended to give specific minimum expected requirements. Regulations are far easier to revise than government acts, as they often incorporate the so-called Henry VIII powers.

Henry VIII powers are clauses within government regulation that bestow upon government ministers the authority to change secondary legislation (such as regulations) without oversight from Parliament. However, the lack of transparency in Henry VIII powers means they often have restrictions on the extent of their authority, in order to limit potential abuse.

In order to ensure accountability for Henry VIII powers, the authorising partner can be cross-examined before a parliamentary committee on the reasoning behind regulatory updates they actioned.

Organizations can help by engaging with the legislative process, through offering their expertise to parliamentary committees, which regularly seek expert views.

“Any responsible government needs to be engaging. One of my concerns around the Cybersecurity and Resiliency Bill has been it's a bit top down. It gives government a lot of power and doesn't really talk about consulting with business,” says Morris.

“I'd like to see more of that because you're not going to make progress in improving standards across the board if you just impose stuff top down.”

The role of AI

AI is one of the key areas of current focus and technological development. It is one of the most rapidly developing fields of technology, and there are growing calls from many sectors for regulation.

“The challenge is about timescale and the rapidity of innovation, because when the Cybersecurity and Resilience Bill was introduced 16 months ago, AI was being talked about,” says Morris.

“But in that period, if you think of all the different innovations and things that have happened around AI, it's become much more of a central focus in discussions about resilience and critical national infrastructure.”

In addition to this, data sovereignty is coming to the fore as one of the key issues surrounding the use of AI. “I think we should be developing more sovereign technological capability, because we are very dependent on US data processing, and so on,” says Morris.

Many state-run organizations are colossal institutions with massive amounts of data, which could potentially be used to train AI tools to help government departments become more efficient. For example, Microsoft’s Dragon Copilot is being trialled to transcribe patient consultations with a clinician and automate the associated note-taking and form-filling.

Also, with current geopolitics, there is a question regarding whether the government and national infrastructure should move towards using systems developed within the UK. The UK government has previously found itself reliant on external technology providers, such as Huawei, which could potentially cause security concerns and data sovereignty issues.

“We need to look at how the legislative process could be improved, as it not just affects cybersecurity, but lots of other aspects, particularly around infrastructure development,” Morris adds.

“In the age we're living in, we need to look at how we can speed up legislation, because parliament is still operating like it was on a very traditional model.”

Amazon has hit back at EU lawmakers after the European Commission signalled its intent to designate the hyperscaler as a “gatekeeper” under the Digital Markets Act (DMA).

In a statement on 25 June, the Commission noted that Amazon Web Services (AWS) and Microsoft “hold an entrenched and durable position” in the EU cloud computing sector, with both potentially harming competition across the region.

AWS and Microsoft have already been designated as gatekeepers in other business areas, and with cloud computing, lawmakers are equally concerned the duo could stifle competition.

“Their cloud computing services AWS and Azure have achieved significant turnover, and their operational capacity and investments seem to have significantly outpaced those of competitors,” the Commission said.

“They both have vast and entrenched user bases and appear to benefit from lock-in effects and high switching costs, in addition to a large ecosystem.”

The Commission also highlighted competition concerns regarding the influence of AI services on the broader market, noting that both firms’ AI tools have “become a decisive factor in cloud procurement”.

“Whilst AI is significantly increasing the demand for cloud-related services, AWS and Azure appear to retain a large proportion of this increased demand within their respective ecosystems.”

While the Commission noted that this is a “preliminary view”, the statement follows a seven month investigation into the influence of both companies.

If designated under the legislation, lawmakers could impose a series of obligations on both companies, such as the introduction of new interoperability and data portability features.

Teresa Ribera, the EU’s executive vice president for Clean, Just, and Competitive Transition, said both companies will have the opportunity to respond before “final decisions are taken”.

AWS hits back at EU claims

AWS has contested the claims made by the European Commission, with a spokesperson suggesting the preliminary findings “disregard the breadth of cloud services available to European customers”.

The spokesperson added that designation under the legislation could risk “deterring future European investment and innovation”.

“AWS faces healthy competition and customers across Europe have more choice, lower prices, and greater flexibility than ever before,” the spokesperson said.

“The EU already has comprehensive cloud regulation through the Data Act, and adding another heavy layer of overlapping regulation under the DMA undermines European competitiveness and access to cutting-edge information technology.”

AWS said it intends to work closely with the Commission to “reach the right outcome for customers”.

Long-running competition concerns

The move by the Commission comes as relations between US-based tech giants and the EU grow increasingly tense.

European regulators have made repeated attempts to limit the influence of US firms across the region, having been locked in a series of battles with Microsoft over its dominance in the productivity software market.

Geopolitical tensions, however, are adding fuel to the fire on this front, particularly with regard to data sovereignty.

Critics argue that European organizations have become over reliant on US technology services, prompting calls to seek alternative, home-grown options.

Earlier this month, the Commission unveiled the technological sovereignty package, a series of measures aimed at strengthening digital sovereignty capabilities across the EU - spanning areas such as AI, cloud computing, and semiconductor manufacturing.

Speaking at the time, Ursula von der Leyen, president of the European Commission, said the package comes in direct response to concerns about overreliance on foreign technology services.

“We cannot afford to depend on others for the technologies that keep our hospitals running, our energy grids stable, and our services secure,” she said.

FOLLOW US ON SOCIAL MEDIA

The European Commission has unveiled a series of measures aimed at strengthening digital sovereignty across the union, in a move that’s sparked mixed reaction from industry stakeholders.

The European technological sovereignty package will bolster the EU’s capabilities across a range of areas, including AI, cloud, open source, and semiconductor manufacturing.

Ursula von der Leyen, president of the European Commission, said the move comes in direct response to concerns over long-running reliance on foreign technology services.

“We cannot afford to depend on others for the technologies that keep our hospitals running, our energy grids stable, and our services secure,” she said.

“This is about protecting our citizens, defending our interests, and making our own choices. Europe has the talent, the research excellence, the industrial base and the Single Market. Together, we must turn these strengths into technological sovereignty.”

The technological sovereignty package will focus on four key areas, according to the Commission, and includes two legislative proposals – the Chips Act 2.0 and the Cloud and AI Development Act (CADA).

A new Open Source Strategy and a Strategic Roadmap for Digitalisation and AI in Energy is also included in the package.

The first of these is aimed at “securing the semiconductor base for Europe’s AI ambition” and will focus on building capacity for semiconductor manufacturing and investment.

The CADA legislation, meanwhile, will increase investment for research and development and improve support for data center build-outs across the region.

Notably, this legislative package will also introduce a single EU-wide framework to help organizations assess cloud and AI provider sovereignty credentials.

Jaap Templeman, head of digital business practice in the Simmons & Simmons Amsterdam office, said the package represents a “welcome and necessary boost” to the EU and “ward off a long-term technological dependence” on big tech.

“Sadly, geopolitical developments show how vulnerable transatlantic dependence can be. The strict sustainability and security framework around the development of data center, AI, and chips capabilities might appear counterproductive to improving the EU's ability to compete but is of course necessary,” he said.

Concerns over ‘trusted partner’ elements

While industry stakeholders have welcomed moves to bolster European sovereignty efforts, concerns have been raised over certain aspects of the package.

The CADA legislation outlines a series of trust tiers for cloud services used by public sector organizations. These are based on considerations such as ownership and control of infrastructure, data processing and protection, and cybersecurity.

According to the Commission, the four trust levels are:

• Level 1: where data is processed and stored in infrastructure located in the Union
• Level 2: where providers must demonstrate independence from third countries and transparency over their software supply chain
• Level 3: where providers must be owned and controlled from the EU and meet additional criteria, such as personnel citizenship. The Commission can recognize third-country providers
• Level 4: where providers have full transparency and control over their software supply chain and no interference from a third country

Essentially, this aspect of the legislation aims to bolster protection of sensitive public sector and national security-related data. Public sector organizations will be required to use services that meet the requirements of at least Level 1, for example.

More sensitive areas, such as defense, national security, or law enforcement, meanwhile, will require providers that adhere to higher tiers.

Trade groups have warned that there is potential for these requirements to limit access for foreign providers. The Computer & Communications Industry Association (CCIA) described the legislation as a “dangerous recipe for progressive market shutdown”.

“By requiring Member States to assess which use cases demand specific sovereignty levels – levels that non-EU vendors would be unable to meet by default – the CADA relies on an impractical Commission framework that no international provider could possibly satisfy,” the trade group claimed.

Open source focus welcomed

The Commission’s focus on open source is one aspect of the package that has drawn praise. Lawmakers specifically highlighted the region’s burgeoning open source community, which is now home to over three million contributors.

Under the Open Source Strategy, the Commission aims to capitalize on this growing market to accelerate the development of sovereign solutions. The Commission said it plans to “scale up” open source alternatives in areas such as cloud, AI, and cybersecurity.

“The strategy will also support greater use of open source in public administrations through procurement guidelines and practical best practice,” the Commission said. “It will encourage uptake of European solutions and support standards and interoperability, including through initiatives such as the Open Internet Stack.”

Amanda Brock, CEO of OpenUK, said the UK should take note of the Commission’s acknowledgement of open source’s potential.

"It has taken decades of work, which included many from the UK, to get the EU to the position of recognizing the role of open source in today’s strategy,” she said.

“There cannot be digital sovereignty today without open source. As Hugging Face have said, open source is the cornerstone of sovereignty. The UK, despite our policy being 15 years old, is way behind today, and we need to build the infrastructure for this,” Brock added.

“Despite the UK being Europe’s leader in open source software and AI, we still fail to recognize this in our policy.

Before adoption and entry into force, the European Commission said the package and legislative proposals will be negotiated by the European Parliament.

FOLLOW US ON SOCIAL MEDIA

Google could be facing a fine from the EU in the high hundreds of millions of euros, according to reports, following an investigation by the European regulator into its search.

The fine relates to a European Commission (EC) investigation into whether Google breached the Digital Markets Act by favouring its own search engine. Launched last year, the EC sent preliminary findings to the company, accusing it of preferential treatment of Google's own services in its search results, including shopping, hotels, finance, and more. Google was then given a chance to respond and suggest changes to address the problems.

A report in the German newspaper Handelsblatt reported that the EC is considering fines in the hundreds of millions of euros after failing to come to an agreed solution.

Next steps

However, an EC spokesperson told Reuters that the regulator was keen to get Google in line rather than issue a punitive fine, suggesting that the EC was more interested in securing compliance.

"Even with ‌our ⁠negotiations on future solutions, we will not hesitate to move to the next steps as soon as possible," spokesperson Thomas Regnier told Reuters.

The EC earlier this month gave Google more time to develop a proposal after its previous efforts to avoid a fine failed to win over the regulator. But Google said in response to Reuters that it had already made too many changes to its search tool. ITPro contacted Google for comment, but has yet to hear back at the time of publishing.

Last year, Google-owner Alphabet's profit topped $132 billion with revenue over $400bn. While this fine would be the largest under the 2022 Digital Markets Act, the company has been hit by much bigger fines than that proposed by the EC this time around. In 2017, it was fined €2.4 billion for antitrust complaints related to Google Shopping, and the next year was hit by a €4.3bn over Android and €1.4bn for a case relating to online advertising. Last year, the EC leveled a €‎2.95bn fine following an investigation into adtech, and started a fresh investigation into Google over its use of online content to train its AI.

Appeal in the US

The reports come days after Google filed an appeal in US courts against a decision in 2024 that saw the company deemed a "monopolist" for its search deals, which included paying billions of dollars annually to rivals, including Apple, to use Google as their default for search. Google was ordered to share some search data with rivals, among other remedies.

Such an appeal is no surprise, but Google is arguing that the judge in the case made legal errors and that its search engine dominated because it was technically "superior."

"Competition produces winners and losers," the company said in its filing. "And sometimes a firm – by innovating better, investing more, or just working harder – will leave its rivals behind."

Last week, Google unveiled significant changes to its search tool, heavily embedding AI into the financially lucrative service.

The European Commission has published its long-awaited draft guidance on the classification of high-risk AI systems and has opened a public consultation.

The guidelines aim to help assess whether an AI system should be classified as high-risk; either intended to be used as a safety component of a product, or carrying the potential to endanger health, safety or fundamental rights. If they do, they need different treatment under Article 6 of the AI Act.

"The guidelines are intended to support providers, deployers, and other relevant actors in determining whether an AI system falls within the high-risk category," the Commission explained.

"They offer clarifications on the relevant provisions of the AI Act and include practical examples to illustrate how the classification should be assessed in different areas and use cases."

The guide comes in two parts, with the first covering AI systems that are themselves products, or safety components of products, under sectoral harmonization legislation, including the Machinery Regulation, the Toys Safety Regulation, the Radio Equipment Directive, medical devices, and the automotive and aviation regimes.

The second, meanwhile, covers AI systems that can significantly affect people's health, safety, or fundamental rights in specific use cases listed in the AI Act.

Article 6(3), covering the significant risk of harm to health, safety, or fundamental rights, is where most providers will go wrong, said Patrick Sullivan, VP of Strategy and Innovation at compliance provider A-LIGN.

There's a carve-out with four conditions – that the AI performs a narrow procedural task, improves the result of a previously completed human activity, detects decision-making patterns or deviations without replacing or influencing the human assessment, and performs a preparatory task to an Annex III assessment.

But, said Sullivan, hard exception applies, with an Annex III system is always high-risk where it performs profiling of natural persons. "This matters enormously for HR systems, credit decisioning, and any system that builds individual-level predictive profiles," he warned.

The document has been significantly delayed, having been expected to be published back in February; and following the political agreement on the AI Omnibus, there's a new enforcement timeline.

Rules for systems used in certain high-risk areas – including biometrics, critical infrastructure, education, employment, migration, asylum and border control – will apply from 2 December 2027, while for systems integrated into products such as robotics and industrial machinery, they'll come into effect on 2 August 2028.

The Commission is now holding a consultation on the guidelines, aimed at anyone with an interest in the development, deployment, supervision or use of AI systems is invited to contribute.

"This includes AI providers and developers, organisations using AI systems, public authorities, researchers, civil society organisations, supervisory bodies and members of the public," it explained.

The consultation is open until 23 June.

The UK Competition and Markets Authority (CMA) has launched a strategic market status (SMS) investigation into Microsoft’s software licensing practices.

The probe, which the regulator touted in late March, aims to establish whether the tech giant’s position in the market has a negative impact on competition and consumer flexibility.

In a statement announcing the move, the CMA said the probe will primarily focus on business software products used by organisations across the country, including:

• Productivity software
• Personal computer and server operating systems
• Database management systems
• Security software

Microsoft business products, which include Windows, Word, Excel, Teams, and Copilot, are used by hundreds of thousands of firms and public sector organizations across the country, the CMA noted, with more than 15 million commercial users.

The regulator highlighted concerns that UK customers “may not always be able to effectively combine software from Microsoft with that of other providers”. This, it said, could limit their ability to access preferred products at competitive prices.

“The CMA’s investigation will examine whether Microsoft has SMS in business software and consider whether it can use that position to limit customer choice,” the CMA said.

“It will assess whether bundling of products, limits in interoperability or default settings can prevent customers switching and weaken the competitive constraints Microsoft faces from rivals.”

Notably, the CMA said its decision to launch the probe comes in the wake of a previous investigation into the UK cloud services market.

The regulator’s lengthy probe found the dominance of hyperscalers including Microsoft and Amazon Web Services (AWS) had a negative impact on competition in the UK market.

Microsoft has repeatedly faced scrutiny over its software licensing practices. Slack, for example, filed an EU complaint in 2020 amid claims the company had engaged in anticompetitive behavior with Teams bundling practices.

EU-based trade group, Cloud Infrastructure Services Providers in Europe (CISPE), filed a similar complaint in 2022, alleging that Microsoft imposed higher charges for customers running software on rival cloud platforms.

Microsoft and CISPE agreed to a settlement in mid-2025, which was met with criticism by other industry groups.

CMA seeks business feedback

This latest probe into Microsoft practices must be completed within nine months, according to the regulator. A decision on whether to designate the tech giant with strategic market status is expected by February 2027.

In the meantime, the CMA said plans to gauge the thoughts of businesses across the country using Microsoft products, as well as challenger companies, over whether product choices may be limited.

This includes concerns surrounding product bundling, lack of interoperability, and default settings used by the company.

“Our aim is to understand how these markets are developing, Microsoft’s position within them and to consider what, if any, targeted action may be needed to ensure UK organizations can benefit from choice, innovation and competitive prices,” said Sarah Cardell, chief executive of the CMA.

A spokesperson for Microsoft told ITPro: "We are committed to working quickly and constructively with the CMA to facilitate its review of the business software market."

FOLLOW US ON SOCIAL MEDIA

Changes made to the EU AI Act last week have been welcomed by industry stakeholders, but the move doesn’t mean enterprises can take their eye off the ball on AI governance.

Last week, a provisional agreement was reached between the European Parliament and EU Council on the Omnibus VII legislative package. This includes proposals which aim to simplify the union’s legislative landscape.

Under the deal, significant changes to the EU AI Act will be implemented, including a revised compliance timeline for AI systems deemed “high-risk” under the legislation, as well as extended exemptions for small-to-medium sized enterprises.

As part of the delayed high-risk rules, new application dates will be 2 December 2027 for stand-alone AI systems, and 2 August 2028 for high-risk AI systems embedded in products, according to the EU Council.

Similarly, agreement reinstates provider obligations to register AI systems in the EU database for high-risk systems.

Elsewhere, the provisional agreement also postpones the deadline for the implementation of AI regulatory sandboxes at a national level until 2 August 2027.

Henna Virkkunen, executive vice president for tech sovereignty, security, and democracy at the European Commission, said the changes will help streamline implementation of the legislation.

“Our businesses and citizens want two things from AI rules. They want to be able to innovate and feel safe,” she said.

“Today’s agreement does both. With simpler and innovation-friendly rules, we make it easier to innovate without lowering the bar on safety. We are also making sure the tools supporting EU companies for a smooth implementation of the AI Act are ready.

“Meaningful changes” to the EU AI Act

The changes made to the legislation have been welcomed by industry stakeholders as a positive step toward streamlined implementation.

Mark Weir, regional director for the UK & Ireland at Check Point Software, said the alterations represent a “meaningful evolution in EU AI governance” that balances stronger protections alongside a practical approach to compliance.

“By harmonizing implementation across member states and reducing overlapping administrative obligations, the legislation removes genuine friction for organizations operating across Europe,” he said.

“Without clear guidance, even well-intentioned organisations struggle to translate broad principles into consistent practice,” Weir added.

“This closes a gap that has caused real uncertainty in the market. Taken together, these changes point toward a regulatory framework that is not just ambitious, but workable."

Weir noted that provider registration requirements are also a welcome move, and one that will give European legislators “real enforceability” over the EU’s digital sovereignty plans.

Levent Ergin, chief strategist for agentic AI, regulatory compliance, and sustainability at Informatica, echoed Weir’s comments but noted that the changes “shouldn’t detract from the need for better AI governance”.

“Businesses still need to ensure the data feeding their AI systems is governed, explainable, and built on trusted data foundations,” he said.

“Compliance is only part of the enabler of safe AI. Stronger governance, human oversight, and trusted context will ultimately determine which businesses can scale AI confidently and which struggle to move beyond experimentation.”

Looking ahead, the European Parliament and EU Council must not formally adopt the agreement.

FOLLOW US ON SOCIAL MEDIA

Microsoft and Amazon have announced changes to cloud practices following a lengthy probe by the Competitions and Markets Authority (CMA), provoking mixed reactions from industry stakeholders.

While the regulator concluded in 2025 that both hold “positions of significant market power”, neither were given a Strategic Market Status (SMS) designation.

This is a label given to organizations that hold a disproportionate influence on markets and allows the CMA to impose “conduct requirements or introduce pro-competition interventions” under the Digital Markets, Competition, and Consumer Act (DMCC).

In the wake of the investigation, both hyperscalers have agreed to take action on key issues such as cloud egress fees, interoperability, and the ability of customers to switch providers.

In a statement, the CMA said this will “support greater choice” for businesses and public sector organizations across the country.

“These changes will reduce expense and effort for UK customers when using more than one cloud provider,” the regulator said.

As part of the announcement, the CMA revealed plans to launch a separate SMS probe into Microsoft’s software practices due to competition concerns. Expected to begin in May, the investigation will see the regulator examine the firm’s business software licensing practices.

In a blog post reacting to the cloud market decision, Microsoft president Brad Smith said the company is committed to working “quickly and constructively” to address the CMA’s concerns.

“We appreciate the opportunity we have had for direct and constructive conversations with the CMA and its staff and look forward to an ongoing dialogue in relation to relevant cloud issues in the future,” he wrote.

Amazon said it is working toward a “new UK Addendum that formalizes our commitment to customer choice through clear, comprehensive rights around multicloud adoption, data portability, and switching processes”.

Industry stakeholders aren’t sold

Experts have mixed reactions to Amazon and Microsoft’s moves to address issues flagged in the cloud market probe.

CCIA senior director Matthew Sinclair said the decision will avoid “overly broad and prescriptive interventions” that could harm UK cloud innovation.

“The regulator can focus its efforts on action to address specific issues, particularly restrictive software licensing terms for legacy software, which are costing UK users a fortune,” Sinclair noted.

Nicky Stewart, senior advisor at the Open Cloud Coalition, urged the regulator to take “swift action” against both organizations if they fail to meet commitments on egress fees and interoperability.

“Slow progress on these issues continues to hamper growth, innovation, and resilience in the UK cloud marketplace,” Stewart commented. “Decisive action will set a benchmark for competition authorities across Europe and beyond.”

In contrast, Mark Boost, CEO at UK-based cloud provider Civo, questioned whether the voluntary actions by both firms will deliver changes called for by industry stakeholders.

“Voluntary arrangements made with parties outside of the SMS framework will not provide real impact, and by delaying its final decision regarding Microsoft and excluding AWS altogether, there is a risk for CMA to unnecessarily prolong uncertainty and miss an opportunity to future-proof the UK’s digital infrastructure,” he said.

Boost added that the CMA’s decision does not provide “adequate solutions” to solve lingering concerns over the dominance of both hyperscalers in the UK market. Last year, the regulator found Amazon and Microsoft controlled a share of the market ranging between 30-40%.

“There needs to be a fair digital market in which domestic innovation is encouraged, alongside continuing to help build opportunities for international collaboration and trade,” he said.

“If the CMA is serious about delivering on this, it will need to adopt an integrated approach as opposed to only partially regulating these hyperscalers. If the same standards are not applied to both parties, the UK will jeopardize its objectives related to digital sovereignty and economic stability.”

FOLLOW US ON SOCIAL MEDIA

The UK government’s much-anticipated Cybersecurity and Resilience Bill (CSRB) had its first and second reading in Parliament and is now progressing through the necessary next stages to become law.

Designed to improve the cybersecurity and resilience of the UK’s most important services, while taking into account the evolving challenges impacting today’s increasingly interconnected digital world, the new legislation makes crucial updates to the 2018 Network and Information Systems (NIS) Directive.

It mandates stricter controls around cyber best practices, reinforces the importance of supply chain security, and brings more organizations into the scope of government oversight, including Managed Service Providers (MSPs).

MSPs under the CSRB

MSPs have largely remained free from government oversight and were not included in the 2018 NIS regulation.

NIS covered Operators of Essential Services (OES) and Relevant Digital Service Providers (RDSPs), and while the government did announce plans to include MSPs in its update to the regulation in 2022, this was never enforced.

However, under the CSRB, MSPs will also soon be mandated and obligated to meet strict new compliance requirements.

According to the regulation’s proposal, MSPs will soon be required to abide by the same requirements placed on RDSPs under the NIS 2018 regulation. The government also recently confirmed that MSPs who employ at least 50 people and have a turnover exceeding €10 million will be regulated under the bill, potentially placing approximately 1,100 MSPs within its scope.

When it comes to the requirements placed on MSPs, these include:

• Registering with the ICO
• Having appropriate and proportionate security measures in place to manage risks to the network and information systems that support their service
• Notifying incidents to the ICO, where those incidents have a substantial impact on the provision of their service

Understanding the cyber risk to MSPs

The inclusion of MSPs in the CSRB is an important step in improving cyber resilience across the UK, and it is essential given the important role they play in today’s digital landscape.

Over the last seven years, MSPs have evolved from providing IT and communications services into providers that form the digital backbone of a significant part of the UK’s economy.

MSPs are now integral to thousands of organizations across the country, delivering everything from connectivity to IT to cybersecurity.

However, this concentration has turned them into major targets for threat actors.

Today, MSPs are routinely targeted by threat actors to launch supply chain attacks, where they gain access to one MSP and then pivot across to customer environments, launching widespread breaches.

This was demonstrated in the recent attack on Ingram Micro, when the IT distributor suffered a ransomware attack at the hands of SafePay, and customer data was reportedly compromised.

These attacks can be highly dangerous, impacting hundreds of organizations at once, while causing mass financial damage and operational disruption.

These are some of the key reasons why MSPs will soon be covered by the CSRB.

The government clearly wants to mitigate this potentially systemic risk.

However, considering many MSPs don’t have the in-house skills required to meet the new requirements, the forthcoming regulation will be a concern.

So, how can they prepare for the legislation today, before it officially comes into force?

Adopting cyber best practices within MSPs

Despite delivering security services to their clients, many MSPs are not experts in the field of cyber defense.

The requirements for delivering security have largely escalated due to customer demand, rather than an increase in in-house expertise.

However, with the CSRB, MSPs are suddenly under pressure to not only enhance their internal security, but also the security of their clients.

This means many MSPs will want to know what they can do to meet these new requirements, but without having to build out entirely new functions of business.

Fortunately, this can be achieved by collaborating with vendors that are dedicated to supporting MSPs.

Vendors can offer support to MSPs through their expertise in cybersecurity, alleviating the burden on their own resources, while also improving internal and customer defenses.

Delivering platforms that offer market-leading defenses, vendors can enhance cyber resilience for both MSPs and their customers.

However, MSPs should look for partners that support them with this new opportunity without looking to override their relationships with their clients.

Ideally, MSPs should look to partner with vendors that can not only support security across their own environments, but ones that can also enable them to deliver new and advanced capabilities to their clients without significant resourcing overhead or financial investment.

The inclusion of MSPs in the CSRB will likely come as a concern for the sector.

Suddenly, these organizations that have largely remained free from government oversight are under the spotlight.

This adjustment will undoubtedly be challenging, but the MSPs that take action today will be ready to meet the new requirements they face tomorrow, enhancing resilience across both their internal and customer environments.

The European Commission (EC) has renewed a pair of rules that will allow data to continue flowing between the European Economic Area and the UK.

The adequacy decisions were agreed after the UK left the EU via "Brexit" in 2020 on the grounds that the UK legal framework for data protections were as good as those in Europe.

While that was welcome news for British companies dependent on the flow of data, the former government still complained that the decision should have been taken before the official Brexit withdrawal date.

That agreement ran out in June 2025, but was given a technical extension of six months to give the EC time to consider the impact of changes brought in via Labour's Data (Use and Access) Act.

This loosened up some data controls for research and charitable fundraising, while requiring companies to have a data protection complaints procedure.

The aim, said then technology secretary Peter Kyle, was to enable the government to make use of the "goldmine of data" it holds for policing, admin and more.

In particular, the EC was considering the impact of those changes on the General Data Protection Regulation (GDPR) and the Law Enforcement Directive.

Six-year renewal

Now, the EC has announced that the adequacy decisions have been given another six years until 2031, with the possibility of renewal again, with the Commission and European Data Protection Board reviewing the system and any changes in four years.

"The decisions ensure that personal data can continue flowing freely and safely between the European Economic Area (EEA) and the United Kingdom, as the UK legal framework contains data protection safeguards that are essentially equivalent to those provided by the EU," the EC said in a statement.

The renewal means data will be able to continue to flow between the UK and Europe, avoiding serious disruption for businesses if that were to stop.

Adequacy agreements

The EC's first adequacy decision with a non-EU country following the introduction of GDPR was with Japan, coming into force in 2019, though the European body had similar agreements in place for other countries including Canada before the regulation was introduced.

Other countries with adequacy decisions in place include the US, Switzerland, Argentina, and Korea.

"The European Commission has the competence to determine, on the basis of the General Data Protection Regulation, whether a country or international organisation outside the EU ensures an adequate level of data protection," the EC explained.

"Following this, the Commission might initiate the process for the adoption of an adequacy decision, which allows the free flow of personal data from the EU and the European Economic Area (EEA) to a third country or international organisation without further obstacles."

For the UK renewal, a wide range of opinions were sought. "The adoption of the renewal decisions follows the European Data Protection Board's opinion and the Member States' green light in the so-called comitology procedure," the EC said in a statement, referring to a system that enables the EC to implement rules under the review of national representatives from member states.

The UK adequacy agreement was approved despite the changes introduced by the Data (Use and Access) Act introduced by the Labour government – which were more limited than a data overhaul initially planned by the last Conservative government that may not have been seen in such a positive light by the EC and member states.

FOLLOW US ON SOCIAL MEDIA

There's huge uncertainty over the UK-US Tech Prosperity Deal, with reports that the US has pulled out.

The deal, signed in September, saw the two countries agreeing to establish joint R&D, and advance "pro-innovation AI policy frameworks". The plan also called for cooperation on quantum computing and nuclear energy.

At the time, US president Donald Trump said it would "ensure our countries lead the next great technological revolution side by side".

However, reports from the New York Times suggest that talks have stalled due to “broader disagreements”.

This is believed to be in part a reference to the UK's Digital Services Tax, levied at 2% on US tech giants including Google, Amazon, and Apple, and raising around £800 million per year.

Trump is reportedly not a fan of the Online Safety Act, which requires tech companies to protect users from harmful content.

According to the NYT, the US is also concerned about the Economic Prosperity Deal between the two countries. The MOU for the Technology Prosperity Deal made it dependent on “substantive progress” towards the Economic Prosperity Deal signed in May.

The US is reportedly unhappy with perceived trade barriers in sectors such as cars, pharmaceuticals, and steel.

The stalled talks on the deal may just be a tactic to put pressure on the UK, as implied by a statement on X by Trump's science adviser Michael Kratsios.

"In line with Section III of the US-UK Technology Prosperity Deal, we hope to resume work with the United Kingdom once the UK has made substantial progress in implementing its commitments under the Economic Prosperity Deal," he said.

"We look forward to continuing our productive collaboration across AI, quantum, nuclear, and other critical technology areas under the Deal."

Reports from the BBC on Tuesday noted that the deal is still very much alive and kicking. According to the broadcaster, the prime minister’s office said the UK remains in “active conversations with US counterparts at all levels of the government” on the deal.

Who benefits from the Tech Prosperity Deal?

The Tech Prosperity Deal has been widely seen as favorable to the US, Last month, experts told ITPro the agreement was a “strikingly unequal partnership” that allows big tech to expand its presence in the UK unchecked.

According to campaign group Global Justice Now, the UK should be wary of making any more concessions.

"For Trump, collaboration on trade and investment only appears possible if other countries give US corporate giants free reign over their economies – and give up their democratic right to regulate and tax them," said policy and campaigns manager Tim Bierley.

"The news that the US is seeking even more concessions should be a wake-up call for those in government who think we can appease our way out of tariff wars with Trump – the more we concede, the more corporate America will demand."

Broadly speaking, the tech industry is more favorable toward the deal. The Computer & Communications Industry Association (CCIA), which has called for the Digital Services Tax to be repealed, pointed out that other nations are scrapping similar taxes.

“The technology deal was good news for investment and innovation in both countries, and it is unfortunate that lack of progress in broader trade issues resulted in its implementation being suspended," said CCIA senior director Matthew Sinclair.

"The UK should do more to address barriers to trade in digital services, whether that is taxes that single out US multinationals or regulators wielding unprecedented powers without the guardrails that should protect companies against disproportionate or simply misguided attacks on their businesses.”

FOLLOW US ON SOCIAL MEDIA

US president Donald Trump has signed an executive order aimed at banning individual states from regulating AI in a move one expert said could create a “regulatory vacuum” in the country.

In a move welcomed by a host of AI companies, Trump said he plans to create a federal AI Litigation Task Force responsible for challenging states’ AI laws.

"State-by-state regulation, by definition, creates a patchwork of 50 different regulatory regimes that makes compliance more challenging, particularly for start-ups. Second, state laws are increasingly responsible for requiring entities to embed ideological bias within models," he said.

"My administration must act with the Congress to ensure that there is a minimally burdensome national standard — not 50 discordant state ones."

The order also calls for the Secretary of Commerce to publish an evaluation of state AI laws that conflict with national AI policy priorities - and withhold non-deployment Broadband Equity Access and Deployment (BEAD) funding from any offenders.

Trump is of course keen to encourage AI firms to invest in the US - something he believes state-by-state regulation will hamper.

States including Colorado and New York have already passed laws regulating AI, with California set to require the biggest AI firms to publish plans for limiting the risks.

The move has been welcomed by the National Association of Manufacturers.

"As the president demonstrates his commitment to both advancing American technological dominance and bolstering investment in manufacturing, he is rightly recognizing that winning the global race for AI hinges on getting AI policy right, which means avoiding a cumbersome 50-state patchwork of laws and regulations that would throttle interstate commerce, stifle innovation, limit AI adoption and erode America’s competitive edge," said president and CEO Jay Timmons.

However, the American Civil Liberties Union (ACLU) begs to differ.

"Although AI might bring substantial benefits, it also carries substantial risks, and America will not win the AI ‘race’ if the AI used by the government, employers, schools, and health care providers is hallucinatory, unreliable, and dangerous," said And, said ACLU senior policy counsel Cody Venzke.

The executive order doesn't allow for a complete free-for-all, with states still allowed to introduce AI regulations aimed at protecting children, addressing concerns around data centers, and governing states' own procurement and use of AI.

However, California governor Gavin Newsom said the plan is self-serving and will endanger the public.

"Today, President Trump continued his ongoing grift in the White House, attempting to enrich himself and his associates," he said. "President Trump and Davis Sacks aren’t making policy — they’re running a con. And every day, they push the limits to see how far they can take it."

Move could create a “regulatory vacuum”

Ilia Kolochenko, CEO at ImmuniWeb, said the executive order and subsequent disruption to state-level efforts to regulate the technology could risk leaving the country in a “regulatory vacuum”.

“While President Trump's Executive Order may prevent some US states from enacting or enforcing complex and sometimes contradicting AI state laws and regulations – thereby considerably simplifying business for tech companies in America – it might also have a possible drawback by leaving America in a regulatory vacuum,” Kolochenko commented.

Enterprises operating on both sides of the Atlantic already face a fractured regulatory landscape. The EU, for example, has taken a far more robust approach to legislation, marking a contrast to the US' approach.

Enforcement of the order may prove tricky, and attempts are already underway to push back against limitations to state-level regulation. A first shot at limiting state AI laws has been defeated in a landslide 99-1 vote in the Senate.

Similarly, some Democratic lawmakers have said they are planning legislative action against the White House.

MORE FROM ITPRO

• Big tech looks set to swerve AI regulations – at least for now
• The tech industry reacts to the UK’s AI Growth Lab
• AWS thinks global alignment on AI regulation is possible but must be risk-based

Three major international technical standardization bodies are working to introduce ethical considerations into their standards, with the release of four guiding principles.

The International Organization for Standardization (ISO), the International Electrotechnical Commission (IEC), and the International Telecommunication Union (ITU) last week launched the Seoul Statement at an event in South Korea.

This statement is aimed at advancing the development of safe, inclusive, and effective international standards for AI. These standards, the bodies revealed, should reflect global needs, support regulatory alignment, and foster interoperability, trust and inclusion.

"It places international standards at the heart of AI governance," said Sung Hwan Cho, president of the ISO.

"We must systematically include social and human rights considerations into our standards work. We must collaborate across government, industry and civil society and academia to ensure all voices are heard."

The guiding principles for trustworthy AI

The statement is based on four core principles covering key areas spanning development, deployment, and long-term maintenance of AI systems.

Standards should actively incorporate sociological dimensions as well as technical ones, for example. They should deepen the understanding of the interplay between international standards and human rights, recognizing both their importance and universality throughout the AI development lifecycle.

They should also help strengthen an inclusive, multi-stakeholder community to develop and apply international standards for the design, deployment, and governance of AI. Elsewhere, the organizations encouraged closer collaboration between public and private sector entities on AI capacity building.

"Standards are technical tools to uphold the principles we want to live by,” said Seizo Onoe, director of the ITU telecommunication standardization Bureau.

"The vision set out by this joint statement calls for diverse expertise and global commitment to collaboration and consensus – exactly what drives our standards work and exactly the spirit needed to create the future we want.”

Any regulatory framework will need to be forward-thinking and adaptable, the bodies noted, largely due to the rapid evolution of the AI landscape moving forward.

Ethical specifications will have to reflect related issues such as the poor provision of energy supply in developing countries for example, as well as the lack of compute power.

Research highlighted by the standards bodies indicates that the developing world houses less than 1% of global data center capacity, underlining the need for greater investment to broaden compute capacity.

These nations are also struggling with a shortage of chipsets and AI components, a lack of public-private data sharing, and a severe shortage of training.

Tackling AI safety concerns

Next steps for the organizations include the drafting of standards on the storage of sensitive data.

The trio are also planning to look at the issues of election interference, deepfakes, and misinformation. The latter of these areas is of particular interest, they noted, with most current deepfake detectors failing to adequately deliver.

Threat actors are already using deepfakes to dupe unsuspecting enterprise workers, with a recent study from Ironscales showing that 85% of cybersecurity and IT leaders have experienced at least one deepfake attack in the last year, marking a 10% increase on 2024 statistics.

"How is a deepfake coming about, and how do we give the technical tools to make detecting it easier?" asked Philippe Metziger, CEO and secretary general of the IEC.

"Our role is making things more transparent from a technical point of view."

The statement was created following a UN recommendation last year, with the hope that standards convergence can help reduce fragmentation and lower compliance burdens, while focusing on responsible AI development and deployment.

"Standards don't solve everything," said Metziger. "But we see ourselves as major contributors to AI governance."

MORE FROM ITPRO

• Enterprises are concerned about ‘critical shortages’ of staff with AI ethics and security expertise
• How do we make AI ethical?
• IT professionals are the new guardians of ethical tech

With the advent of early automobiles in the 19th century, the UK introduced legislation to protect existing transport industries such as rail networks and stagecoaches.

One of the most notorious of these laws was the ‘Red Flags Act’, restricted the speed of ‘horse-less’ vehicles to just 2mph in built-up areas and 4mph in the countryside. Worse still, the legislation required three vehicle operators: two in the vehicle itself, and another walking ahead carrying a red flag to inform oncoming traffic that an automobile was coming.

The result of this, according to Sasha Rubel, head of public AI policy at AWS, was a hammer blow to an industry during its critical embryonic stages.

Speaking to ITPro at AWS re:Invent 2025, held in Las Vegas, Rubel says this is a perfect analogy to describe the current challenge industry and governments alike face with generative AI.

Driving growth of the industry and delivering on the potential of the technology will require a delicate balancing act in the coming years. Yet conflicting regulatory positions on both sides of the Atlantic pose a serious risk to progress and often leave businesses confused.

“For me, this is a really important lesson from history, because it shows that we not only need to have a shared understanding of what risk and misuse of the technology is, but if you overregulate a technology mitigating for every single possible misuse, you actually miss out on the benefits that this technology represents,” she tells ITPro.

“We need to focus not only on the risks of misuse of the technology, we also need to focus on what it means if we miss out – the missed use of the technology – if we miss out on what this opportunity represents, not only in terms of the economic benefits to GDP and European competitiveness, but more fundamentally to the beneficial use of what this technology represents for everyday life of people in Europe,” Rubel adds.

Rubel says discussions on AI regulation, particularly in Europe in recent months, show there’s now a “growing consciousness” that a more aligned international approach to the technology will be needed.

Robust regulatory frameworks may have noble intentions, but there’s a risk that without clear communication some regions globally may be left behind in the ongoing AI race.

“We see that in the policy conversations that are happening that we need to simplify rules, and we need to align internationally on what those rules look like in order to make sure that Europe and the United Kingdom remain competitive in this space.”

Misalignment is costing businesses big

The impact of this misaligned approach to AI regulation is already being felt by both providers and enterprises alike, Rubel says. In a study conducted by Strand Partners on behalf of AWS, more than two-thirds (68%) of organizations in the EU don’t understand their obligations under the EU AI Act.

Further, the study found companies that aren’t sure about compliance typically invest up to 30% less in technology year on year. To add insult to injury, the sheer complexity of compliance means the function ends up accounting for around 40% of overall IT spend at some enterprises.

“They’re afraid that they don’t understand the rules and that they’ll be fined because of the complexity of rules,” she says. “I hear every day from customers saying, ‘can you explain to us the interplay between the EU AI Act and the GDPR and the EU Copyright Directive’.”

Ultimately, reducing complexity in this regard will have a positive downstream effect on compliance costs, Rubel says. When businesses know they’re compliant and operating within established rules, this is conducive to innovation.

“Reducing those compliance costs by mainstreaming rules is really essential,” she says. “It allows startups to be competitive at the global level, but it also allows for an approach that’s globally aligned.”

Responsibility builds trust; trust drives innovation

“Responsibility and innovation need to go hand in hand,” Rubel tells ITPro. This is a point AWS has been keen to emphasize and promote in recent years, and is a longstanding mantra at the company.

Development policies that are responsible at heart ultimately reduce risk, Rubel says. First and foremost, acknowledging the risks associated with the technology will be critical.

“Responsibility and innovation are not opposites,” she adds. “Responsibility drives trust, which is one of the biggest blockers to AI adoption beyond regulatory uncertainty. That trust drives adoption, and that adoption drives innovation.”

Secondly, bringing together relevant stakeholders from various domains to tackle these risks collectively will be equally crucial. In doing so, Rubel believes this will be the first key step toward fostering broader global alignment.

Going forward, she calls for a risk-based approach developed by industry, academia, government, and civil society to ensure alignment and enable innovation.

Is regulatory alignment a pipe dream?

Achieving global alignment is easier said than done, however. There are economic, social, and geopolitical considerations on both sides of the Atlantic.

The lack of alignment between the United Kingdom, United States, and European Union highlights this, with the latter pursuing a harder approach to the laissez faire style across the pond.

Discussions about AI legislation in the US have proved controversial in recent months, with a rift emerging over federal and state-based approaches to regulating the technology.

Business leaders themselves also appear conscious of geopolitical factors at present, particularly with regard to issues like data sovereignty and reliance on foreign infrastructure providers.

In a survey conducted by Civo, UK-based IT leaders voiced serious concerns about the influence of US cloud providers in the wake of tariffs imposed by the Trump administration. More than half (60%) of respondents said the UK government should go so far as to cut its use of US cloud services.

While that research came specifically in response to economic strategy in the US, it does point toward a growing sentiment of isolationist-style, sovereign AI approaches. Political unions like the EU want their data kept in-region, governments want their data kept in-country, and so do the enterprises operating in those individual regions and nations.

If an aligned approach on data storage is being called into account, it's even more important that industry and public bodies come together to define clear, reproducible standards that lock in safety and innovation.

Laws to regulate AI have hit a hurdle following pushback from big tech and US President Donald Trump.

In the US, Trump is considering using an executive order to ban regulations to rein in AI, according to Reuters, while in Europe, the European Commission said it wants to delay some aspects of the AI Act in response to complaints from big tech over bureaucracy.

With no federal laws regulating AI forthcoming in the US, some states have pushed to enact their own local legislation, including recent laws in California and Colorado.

The Trump administration has previously attempted to block such state-level AI laws by including a 10-year moratorium on local regulation in his "big, beautiful bill" over the summer, though that was thwarted by the Senate. Earlier this week, Trump backed plans to add a similar ban in the National Defense Authorization Act.

Now, the president is considering using an executive order in an attempt to discourage any state-level AI laws by threatening lawsuits or withholding federal funding, according to a draft of the document seen by Reuters.

As drafted, the order would establish an "AI Litigation Task Force" led by Attorney General Pam Bondi to challenge in court any state that implements AI regulation, on the grounds that "such laws unconstitutionally regulate interstate commerce" and are preempted by existing federal rules.

The order would also see the Department of Commerce refuse to allocate funding for broadband to states that don't comply.

Colorado recently approved a rule designed to prevent algorithmic discrimination – highlighting a long-running issue of bias in large-language models (LLMs), which the draft order seen by Reuters noted may force "AI models to embed DEI in their programming".

California has also wrangled with a series of AI laws, and recently passed a law around disclosure that would require companies tell the government how they plan to avoid serious risks and fess up to any critical safety incidents.

A White House official did not confirm the order to Reuters, and said it was speculation.

European regulation delays

Over in Europe, the European Commission has suggested delaying some aspects of the EU AI Act for 16 months and tweaking others as part of a move which sparked concerns it's responding to criticism from American tech giants.

The commission said the move was part of wider efforts to "simplify existing rules" on AI, cybersecurity, and data in its Digital Omnibus, which aims to streamline technology-focused laws to make them easier to manage for companies.

The EU’s economy commissioner, Valdis Dombrovskis, said the measures would save businesses and consumers alike €5bn in red-tape related costs by 2029.

He added: "Europe has not so far reaped the full benefits of the digital revolution and we cannot afford to continue to pay the price for failing to keep up with a changing world."

Criticism of delay

Critics disagreed on the value, however. Blue Duangdjai Tiyavorabun, Policy Advisor at European Digital Rights (EDRi), suggated the Digital Omnibus is a “full-on betrayal of Europe’s promise”.

"They are trading the protection of people from harmful AI systems for hollow promises of ‘innovation’. This is no shocker: when tech money flows like water in Brussels, guess who is steering the ship?"

A Commission official said during a briefing: "Simplification is not deregulation. Simplification means that we are taking a critical look at our regulatory landscape."

Alongside delaying the timeline for implementing "high-risk rules" by 16 months to December 2027 from August 2026, the Commission said it would extend some rule simplifications for small businesses and small mid-cap companies.

Elsewhere, it plans to extend compliance measures so more companies can use regulator sandboxes in core industries like automotive and centralize oversight on AI systems to help reduce governance fragmentation.

"Efficient implementation of the AI Act will have a positive impact on society, safety and fundamental rights," the EC said in a statement. "Guidance and support are essential for the roll-out of any new law, and this is no different for the AI Act."

Thierry Breton, former European commissioner for the internal market and digital affairs, wrote in the Guardian, that Europe should be proud of its AI laws.

"We should resist any attempt to unravel these laws, through 'omnibus' bills or otherwise, mere months after they have entered into force, under the pretext of simplification or remedying an alleged 'anti-innovation' bias," he said.

"No one is fooled over the transatlantic origin of these attempts. So let’s not be useful idiots."

MORE FROM ITPRO

• Is the UK falling behind the EU on AI regulation?
• The fractured regulatory landscape tech companies face in 2025
• Three things you need to know about the EU Data Act

In September, the UK welcomed the US president Donald Trump with open arms ahead of the signature of the landmark US-UK Technology Prosperity Deal. This $42 billion agreement, the UK government believes, will strengthen the strategic relationship between the two countries in a variety of key areas – including quantum computing, nuclear energy and, most eye-catching of all, AI.

There's no doubting the US as an unmatchable force when it comes to tech innovation, with its biggest companies ploughing headfirst into a turbocharged AI summer. This agreement represents a chance for the UK to carve out a slice of that action, with the memorandum of understanding (MOU) laying out a framework for co-operation. In short, UK organizations should, over time, be given access to critical technology and research, while US companies will get the chance to invest billions of dollars into new initiatives – and reap the eventual rewards.

The reaction to the broad and far-reaching agreement has been overwhelmingly positive, for the most part. It is, however, not a treaty but a non-binding MOU, with plenty of details still to be ironed out. Over time, what will it mean for the long-term prospects of technology sectors in the two nations and their respective businesses?

The prospects on both sides of the Atlantic

Although much of the UK press lauded the agreement, it overwhelmingly favors the US, says John Bates, CEO at SER Group and a former Cambridge University computer science and deep learning academic. In reality, he says, "this deal may not be the win it's being sold as" because hyperscalers get to expand their presence on UK soil while strengthening their footprint.

"We’re expected to applaud America’s generosity on chips, AI models, and data centers, yet the UK risks becoming little more than an outsourcing hub for hyperscalers and Nvidia rather than a genuine AI power in its own right," Bates tells ITPro. "True innovation remains concentrated in the US, while the UK still struggles to define its own AI ambitions. Instead of relying on access to American technology, Britain should be doubling down on backing local innovators and developing homegrown AI capabilities."

That isn't to say there are no benefits at all for UK businesses. Bates suggests the UK remains more attractive than the EU as a global hub for AI innovation, for example. There's also a real upside for businesses seeking to tap into emerging technologies much faster than they could have done previously, explains Adnan Masood, chief AI architect at UST and an AI researcher.

"This shrinks a decade of infrastructure build-out into a couple of years – if power and permitting cooperate," he says, but echoes Bates' views that it's a lop-sided deal. "Let’s be honest, the CapEx is overwhelmingly American. That concentrates leverage with US vendors and raises long-term sovereignty and switching cost questions for UK buyers."

Much of this comes from the fact the US heavily outspends the UK in terms of AI investment. Last year, US private investments hit $109.1 billion, which was nearly 24 times higher than the UK's $4.5 billion, according to Stanford University research.

Given the head start, it's no doubt that perhaps the path of least resistance for UK firms is a deal that would allow them to tap into the technological progress that counterparts across the pond have already forged ahead with. It’s an alternative to spending the necessary time and money – which could take a great many number of years – to reach anywhere close to the proficiency that US firms already boast with the tech that's needed.

Charting a long-term, albeit turbulent, path for AI growth

Bates is not necessarily an advocate for this agreement, suggesting it diminishes the UK as a true factor in the global equation. "For a nation that pioneered computing, it’s a strikingly unequal partnership," he says. "I’m pro-US, but this investment doesn’t make the UK a true player. And the environmental cost of these AI factories – from potential near-permanent data center hosepipe bans to local infrastructure strain – feels a high price to pay for becoming a kind of AI Airstrip One for America."

Other downsides to consider, Masood explains, include the fact that it opens up UK businesses to US vendor lock-in and potentially stifles the prospects for a true UK rival to emerge. "The model assumes a US tech stack for chips, cloud, and tooling. That’s efficient – but it’s also a lock-in risk for the UK and reduces bargaining power for local suppliers. The UK gets capacity; the U.S. gets the standard."

There are also very genuine concerns over the technology, whether a growing bubble around the AI industry could pop, creating massive ripples in its wake. The Bank of England, for example, warned in October that there is a growing risk of the bubble bursting, with a "sudden correction" resulting in a drying up of funds. Even Sundar Pichai, CEO at Alphabet and a huge proponent for adoption of AI such as Google’s Gemini, has warned that “irrationality” in AI hype could harm the markets over the long term.

Over time, says Jim Piazza, VP of AI and machine learning at Ensono, the agreement should pave the way for a much healthier environment in the UK where businesses can pursue the integration of various advanced US technologies.

"With shared standards in place, it’s easier for vendors to demonstrate compliance and for buyers to evaluate offerings," he says. "That kind of clarity creates more confidence, especially at the enterprise level. If you can document and pass these new standards, you’ll have stronger access to funding, markets, and customers. That’s true on both sides of the pond.

"Longer term, I see this as a standardization flywheel that should mature over time. As vendors begin to pass these shared tests and document their results, they’ll unlock access to enterprise buyers and funding. Over time, that creates momentum and the more standardized and validated the ecosystem becomes, the faster adoption can happen. Once we get the teeth in place, we’ll see more clarity post."

Legislation aimed at shoring up the UK’s national cybersecurity capabilities is set to be introduced in parliament today – but some security experts have questioned the scope and practicality of new rules.

The Cyber Security and Resilience Bill comes in direct response to growing cyber threats faced by private and public sector organizations, targeting stronger defenses in areas such as healthcare, energy, and transport networks.

The bill also comes at a critical time, with figures from the Office for Budget Responsibility (OBR) showing attacks on critical infrastructure could have a massive impact on the economy.

Analysis from the OBR found a major attack could result in a temporary increase in borrowing by over £30 billion, or equivalent to around 1.1% of GDP.

Elsewhere, the financial impact of attacks across both the public and private sectors has been growing. Research published this week shows the average cost of a “significant cyber attack” on the UK now stands at over £190,000.

“Cybersecurity is national security,” said technology secretary Liz Kendall. “This legislation will enable us to confront those who would disrupt our way of life. I’m sending them a clear message: the UK is no easy target.”

So what can we expect from the bill?

What’s covered under the bill?

Under the legislation, digital and essential services such as IT management for critical sectors will be regulated for the first time and subject to robust minimum security standards.

“Because they hold trusted access across government, critical national infrastructure, and business networks, they will need to meet clear security duties,” the government said in a statement.

“This includes reporting significant or potentially significant cyber incidents promptly to government and their customers, as well as having robust plans in place to deal with the consequences.”

Elsewhere, regulators and government ministers will be given sweeping new powers to ensure organizations meet these base requirements.

“The technology secretary gets new powers to instruct regulators and the organizations they oversee, like NHS trusts and Thames Water, to take specific, proportionate steps to prevent cyber attacks where there is a threat to UK national security,” the government added.

Does the bill go far enough?

The introduction of the bill has, by and large, been welcomed by security industry stakeholders as a positive step toward limiting the impact of cyber attacks on critical infrastructure.

In particular, new rules around incident reporting will play a vital role in bolstering collective defense against growing threats, according to Trevor Dearing, director of critical infrastructure at Illumio.

“The shift from reporting only successful breaches to reporting all cyber incidents is long overdue and will drive rapid improvements in how organizations protect their most critical assets and respond to attacks,” he said.

“Granting the technology secretary new powers to ensure that regulators and organizations monitor or isolate high-risk systems is a smart move,” Dearing added.

However, some industry stakeholders have questioned the scope of the legislation, arguing that it fails to address lingering issues in some key areas.

Chris Dimitriadis, chief global strategy officer at ISACA, suggested the sharpened focus on critical infrastructure fails to address the reality of the modern digital economy.

Moreover, omitting particular sectors, such as retail, is an oversight on the part of the government given the spate of attacks waged against high street brands this year.

“The era when cyber regulation could focus solely on critical national infrastructure is over,” he said. “Today, every major employer is part of the digital economy - and therefore part of the threat landscape.”

“Yet many remain outside the scope of meaningful legislative protections. Recent attacks on major retailers such as M&S and Co-op are perfect examples of how vulnerable our digital ecosystem is and the urgent need to take action.”

Matt Houlihan, VP of government affairs at Cisco, also questioned the practicality of compliance for organizations that fall under the scope of the legislation.

"The success of this bill will rely on clarity and practical timelines to help organizations implement necessary measures effectively,” he said.

“We'd also urge the government not to miss an important opportunity to tackle the growing risks from unsupported, end-of-life equipment – a persistent weak point in UK infrastructure that too often leaves organizations exposed.”

Dearing echoed Houlihan’s comments on reporting, again noting that support for organizations will be crucial.

“Whilst it is understandable that the government is introducing tougher penalties for poor security practices, it is equally important that sufficient support is provided to help organizations achieve compliance,” he said.

“The government must ensure that investment is made in supporting organizations, particularly those with limited budgets.”

MORE FROM ITPRO

• What the UK’s Online Safety Act means for IT companies
• Ransomware payments are banned in the public sector: should businesses still pay?
• Why the UK's "outdated" cybersecurity legislation needs an urgent refresh

Ensuring that any organization can withstand, respond effectively to, and recover quickly from IT disruptions is a strategic imperative. This is particularly true within the financial sector.

The Digital Operational Resilience Act (DORA), which became mandatory on 17 January this year, was put in place to serve as a robust standard for resilience. It doesn’t just need organizations in scope to implement sophisticated technological defences; it needs them to have a proactive, well-informed workforce that is ready to tackle cyber threats.

At its core, DORA is a five-pillar framework. These cover ICT risk management, incident reporting, digital operational resilience testing, third-party risk management, and information sharing. Technology is a critical component of all of these pillars; however, the human element is equally important. This is hardly surprising when you consider that various sources cite human errors as being responsible for between 70% and 95% of all cyber incidents. This means that even when the most robust technological safeguards are in place, the human element will be a significant source of vulnerability.

Regardless of the source of the incident, employees can also be the difference between a controlled breach and a full-scale disruption.

What is needed is highly targeted training and simulation exercises that help organizations ensure that their staff are equipped to identify emerging threats, report incidents promptly, and engage in effective remediation efforts.

Digital operational resilience testing and human risk

Digital operational resilience testing under DORA goes beyond merely identifying what the vulnerabilities are. It also involves actively testing the human layer.

Simulated phishing attacks and other real-world-based cyber threat exercises serve multiple purposes. They not only provide a practical measure of employee readiness, but they also help to build essential knowledge and skills for identifying genuine communications from deceptive ones.

By exposing staff to realistic threat scenarios, organizations are cultivating a security-first mindset. This is vital for mitigating risks before they escalate and disrupt business operations.

Awareness enhances incident reporting

The quick reporting of incidents is a cornerstone of DORA compliance. It mandates strict timelines, for example, notifying relevant authorities within four hours of classifying a major incident, as well as following up with detailed reports within set timeframes.

It is important to ensure employees are aware of this, so they are equipped to act as the eyes and ears of the organization and support compliance. Their ability and readiness to spot and report anomalies will help to reduce the time to containment and ensure that incidents are managed efficiently and effectively. This not only supports DORA compliance, but it also safeguards both financial and reputational assets.

Establishing a sharing culture

In addition to ensuring individual preparedness, training, and awareness initiatives will also help establish an environment where information is able to flow freely. By encouraging employees to share all of their observations on suspicious activities or emerging threats, an organization will get stronger collective intelligence.

Staff need to be able to actively participate in the reporting process through easy-to-use tools and transparent processes. This will enable them to contribute to a dynamic, organization-wide threat intelligence network. Not only does this type of collaborative approach support internal decision-making, but it will also help to enhance the overall resilience of the financial ecosystem when these insights are shared across the industry.

A more resilient organizational culture

Ultimately, investing in employee training and awareness is far more than a tick-box DORA compliance exercise. It is a strategic investment in any financial sector organisation’s future. Building a culture that prioritizes cybersecurity will ensure that every member of the team understands their critical role in safeguarding the organization and the financial industry as a whole.

The nature of cyber threats will always be evolving, so a well-informed and agile workforce is the most important line of defence because it can adapt to and mitigate risks before they get a chance to occur.

Organizations should also look at additional innovative strategies, such as cross-sector workshops, inter-company threat simulations, or advanced behavioral analytics, as next steps toward deepening their digital resilience. These initiatives not only further empower employees but also help build genuine expertise, creating a ripple effect that will improve security standards across the industry.

California has officially adopted a law requiring AI companies to disclose how they plan to avoid serious risks stemming from their models and admit any critical safety incidents.

The Transparency in Frontier Artificial Intelligence Act (TFAIA), previously known as Senate Bill 53 (SB53), is focused on AI safety.

It includes whistleblower protections, requirements to meet international standards, and a mechanism to report safety incidents. It will also establish a consortium that will work on a new computing cluster accessible in the public cloud to develop safe, sustainable, and ethical AI.

California is of course home to many of the companies developing these technologies, meaning local regulations could have an impact. Anthropic has publicly supported this version of the bill, though has also called for a federal law.

In adopting the new law, California becomes the first US state to legislate on AI safety, ahead of New York which has its own plan in the works. The move comes amid a wider failure to legislate around AI, with no federal AI laws as yet in place.

Indeed, California governor Gavin Newsom signed this new bill into law a year after vetoing a previous AI legislative attempt that was widely opposed and included safety testing for large models and the requirement for a kill-switch to be included in AI systems.

"California has proven that we can establish regulations to protect our communities while also ensuring that the growing AI industry continues to thrive," Governor Newsom said in a statement. "This legislation strikes that balance."

Newsom added: "AI is the new frontier in innovation, and California is not only here for it – but stands strong as a national leader by enacting the first-in-the-nation frontier AI safety legislation that builds public trust as this emerging technology rapidly evolves."

What the law includes

The TFAIA was written by Democratic Senator Scott Wiener, who also wrote last year's vetoed version.

To encourage transparency, the law requires large frontier developers to publish a framework describing how it incorporates national and international standards, in effect sharing their safety plans.

The law also sets up a new mechanism for companies and the public to report critical safety incidents to California’s Office of Emergency Services and creates protection for whistleblowers who disclose significant health and safety risks of frontier models, with a civil penalty for noncompliance.

However, it only requires reports in case of physical harm, with the San Francisco Public Press stating that's been watered down from last year's bill which required all incidents to be reported. The TFAIA also comes ahead of one planned by New York, which requires reporting of any potential risk of serious harm, even before an incident happens. Under the TFAIA, California will fine companies that injure or "contribute to the death of" more than 50 people, or cause $1bn in damage.

But the fine has been slashed from $10m to $1m for a company's first violation, with the larger amount now reserved only for subsequent infractions. New York plans to fine up to $30m for repeated offenses, the San Francisco Public Press report added.

The newly signed regulation also means California will support development of safe AI: first it has established a consortium called CalCompute within the state's Government Operations Agency to develop its own framework for creating a public computing cluster to "advance the development and deployment" of AI that is safe, ethical, equitable and sustainable, the statement from the governor's office said.

To enable the law to keep up with innovation, the California Department of Technology can annually recommend updates based on stakeholder feedback, changes to international standards, or tech developments.

"As artificial intelligence continues its long journey of development, more frontier breakthroughs will occur," said a trio of AI leaders who helped lead a report into AI for Newsom, in a statement released alongside the governor’s.

The trio consists of Fei-Fei Li, co-director at the Stanford Institute for Human-Centered Artificial Intelligence; Jennifer Tour Chayes, dean of the College of Computing, Data Science, and Society at UC Berkeley; and Mariano-Florentino Cuéllar, former California supreme court justice and former member of the National Academy of Sciences Committee on the Social and Ethical Implications of Computing Research.

"AI policy should continue emphasizing thoughtful scientific review and keeping America at the forefront of technology," the trio added.

California counters Trump administration moves on AI

The move puts Newsom further at odds with President Trump, who widely supports unfettered development of the technology.

The government attempted to force into an unrelated bill a provision to ban state-level AI legislation for ten years, though it was removed by Senate amendment in July. In January, President Trump issued an executive order "removing barriers to American leadership in AI" that ended a Biden order on developing safe and secure AI and followed this in July with the US AI Action Plan which aims to heavily deregulate AI.

A statement released from the governor's office notes: "This legislation is particularly important given the failure of the federal government to enact comprehensive, sensible AI policy. SB 53 fills this gap and presents a model for the nation to follow."

A host of key provisions in the EU Data Act will come into effect on 12 September, and there’s a lot for businesses to unpack.

The regulation came into force on 11 January 2024 and while a grace period has been running to ensure implementation, rules under the legislation will be applicable across the European Union (EU) from here onward.

At its core, the EU Data Act will introduce sweeping changes with regard to how data from connected devices and cloud services is accessed, managed, and shared across the union. This includes new rules on data access, service portability for organizations, and contractual fairness.

The potential long-term impact of the legislation cannot be understated, according to Soniya Bopache, VP and general manager for data compliance at Arctera.

“The EU Data Act has the potential to foster a more competitive and equitable data economy – largely thanks to its provisions on data access, fair contractual terms, and cloud switching,” she said.

“For businesses governed by the Act, this isn’t just a matter of compliance, it’s an opportunity to build a more transparent, efficient, and innovative digital ecosystem.”

So what can businesses expect with the EU Data Act?

What industries fall under the EU Data Act?

The legislation applies to a broad range of sectors, spanning areas such as manufacturing, cloud computing, transport, and consumer goods.

Moreover, it’s not limited to the private sector, with public sector organizations also expected to benefit from the legislation, according to Peter Grimmond, VP and head of technology at Cohesity.

“The EU Data Act has huge potential to deliver acceleration of both public and private sector innovation, through increased data democratization and access,” he said.

“For all enterprise and public sector organisations that have a robust, compliant, data classification processes already in place, the act will create an environment of collaboration and innovation where innovation can thrive without compromising corporate resilience or individual rights”

Data Access and Transparency

Data access and transparency is a key focus of the legislation, according to official EU materials on the Act.

Fundamentally, the regulations are designed to “enhance the EU’s data economy and foster a competitive data market” by making data more accessible and usable.

The move comes in the wake of an explosion of connected devices across the union in recent years. These IoT products collect vast volumes of data, which the legislation aims to capitalize on for reuse across the region.

To achieve this, new rules under the act will give users of connected devices - including businesses and individuals - greater control over the data they produce.

Similarly, the Act also includes rules on how enterprises can share data with other businesses. According to Grimmond, this aspect of the legislation could deliver positive long-term benefits for both businesses and consumers alike.

“It will speed the ability for data to be shared from more devices across more organisations, and opens the door for the development of new products, services, and ways of doing business,” he explained.

“Crucially, it does this without undermining the robust privacy standards that are the EU’s hallmark regulatory framework: building on GDPR’s global standard for privacy and aligning with DORA’s focus on digital operational resilience.”

Cloud service flexibility

As mentioned, another core aspect of the legislation centers around data portability, particularly with regard to cloud services. The Act aims to provide enterprises more flexibility in how they engage with cloud providers and, crucially, switching or opting for multiple options.

This aspect of the legislation comes in direct response to growing calls for a more fluid and competitive cloud computing industry in the EU, with enterprises having contended with “vendor lock-in” for several years now.

Running parallel to this frustration has been the rise of multi-cloud and hybrid cloud strategies, whereby enterprises host data on multiple providers, or through a combination of on-prem and cloud-based services.

Yet businesses with one particular cloud provider aiming to switch to another have faced significant costs transferring data. These “egress fees” have become a recurring point of contention and even prompted legal action against major industry providers.

With this in mind, the EU Data Act includes measures that ensure customers can switch from one data processing service to another in a more efficient manner.

Notably, the Act doesn’t specifically rule out vendors charging fees for data transfers. However, it obliges cloud providers to pass on these costs to the customer rather than charging excessive payments.

Some providers have taken steps to adhere to the new legislation. Google Cloud, for example, recently announced it would waive data transfer fees for customers switching to another provider.

MORE FROM ITPRO

• DORA and why resilience (once again) matters to the board
• Everything you need to know about the NIS2 Directive
• What businesses need to know about the General-Purpose AI Code of Practice

The US has injected fuel into the AI arms race with an Action Plan — a sweeping set of aggressively deregulatory and integrative measures that collectively aim to cement American dominance in the technology.

"Whoever has the largest AI ecosystem will set global AI standards and reap broad economic and military benefits. Just like we won the space race, it is imperative that the United States and its allies win this race," wrote Michael J Kratsios, assistant to the President for science and technology; David O Sacks, special advisor for AI and crypto; and Marco Rubio, assistant to the President for national security affairs, in the policy.

The plan itself is focused on three core pillars: accelerating AI innovation, building American AI infrastructure, and leading in international AI diplomacy and security. Beyond the age-old adage of cutting metaphorical "rad tape", the measures also include plans to strip out perceived pro-liberal bias from AI systems and remove guardrails from AI development. Adnan Masood, chief AI architect at UST, tells ITPro this is a "win the race" blueprint that is significant for its "pivot to permissionless innovation".

There will undoubtedly be repercussions for those domestically and abroad, as the plan pledges to change the global economic and trade outlook. That said, it is important to remember that this is merely a plan – not a self-effectuating document, according to Cobun Zweifel-Keegan, managing director, DC at the International Association of Privacy Professionals (IAPP).

"Some of the actions outlined in the plan have already seen progress through executive orders, but many remain just ideas on a page. Nevertheless, it is a very helpful document toward understanding the Administration’s full slate of expected actions on AI and it’s the first real preview we have had into the current thinking on AI policy within the White House."

But how exactly should businesses expect to adapt to the new framework?

What's the point of the AI Action Plan?

The AI Action Plan rolls back on the capacity for various bodies in the US to regulate AI or add core safeguards while the technology is being developed. It contains more than 90 policy recommendations focusing on innovation, infrastructure, and protecting national security. If implemented, the plan has the potential to significantly change what AI developers should expect to do from a compliance standpoint. In other words, it's a ‘shoot first, ask questions later’ approach to AI development. But the gamble may well pay off, according to experts.

"At its core, the plan treats AI not as just another tech sector, but as critical national infrastructure similar to energy or defense," Angeli Patel, executive director from UC Berkeley Law and Business and a practicing attorney, tells ITPro. "Its top priority is ensuring America, not authoritarian regimes, sets the global course for AI by doubling down on domestic strength and production while embedding democratic values of free speech into the systems shaping our future."

The Action Plan also elevates AI development by giving it the same importance as national infrastructure – positioning AI as 'protected' against foreign adversaries and domestic regulation. "That means more money, faster deployment, and a clear win for Big AI."

]Masood agrees that the thrust of the plan is around deregulating early, building fast and exporting American AI end-to-end, adding that it seems substantive enough to achieve these core aims both on paper and in its early implementation. "The plan is dense with agency tasks and the GSA [General Services Administration] vendor list is already live, signaling procurement intent. The crux is execution on permitting, grid, and fabs."

Big Tech companies are big winners

AI developers stand to gain vastly from the new measures, experts tell ITPro. With better access to compute, talent, and a mergers and acquisitions market that is heating up. Patel expects booms in privacy tech, cybersecurity and AI education: "For businesses generally, AI adoption will spread rapidly if it hasn't already – from backend ops to customer-facing products."

Masood believes the industry has plenty to look forward to, as an AI architect and practitioner himself. Promoting open-weight model development, where internal parameters used in the training of large language models (LLMs) are made public, is an exciting proposition in particular. This, combined with standardized evaluations and testbeds, as well as easier federal access and richer public scientific databases, will directly translate into faster time-to-pilot for new systems, more deployment options and clearer acceptance criteria in regulated industries.

The fact that the administration supports the rights of AI developers to use copyrighted materials in training AI models, under "fair use" conditions, is also a nod to developers, with some early district court decisions being favorable to AI developers, according to Arnold&Porter legal analysis. There are, however, some hesitations on whether these decisions will hold considering the Supreme Court has not weighed in, nor has Congress on deciding definitively which way the fair use question will fall.

"It’s been clear since February’s AI Summit in Paris – that also focused on Action – that the Trump administration was going to enable AI in an unencumbered way. So the copyright decision is no surprise," says Amanda Brock, CEO of the open source trade organization OpenUK.

"The content creators shouldn’t be too upset," Brock tells ITPro. "They haven’t won licensing fees for AI training but the reality is that supporting them is a long-term challenge, created by the digital age. This is not purely a consequence of AI and would never really be resolved by copyright. More appropriate long-term solutions are needed."

Meanwhile, the investment picture is looking particularly rosy as a result of the new AI policy recommendations. Masood highlights that, for the likes of Oracle and Microsoft, who are big government players, there will be higher public sector workloads. For chip makers, meanwhile, there will be a strong demand and a boost in sales toward allied and US markets, in light of export control tightening. The emphasis on domestic fabrication, too, supports long-term supply security.

Patel says that Oracle, Microsoft, Nvidia and data center providers like Equinix "stand to gain from expanded government procurement and strong policy tailwinds". She adds: "At minimum, they’ll benefit from favorable regulatory treatment. At best, they'd be able to bid for direct federal investment. One of the most significant benefits for these AI infrastructure giants is the streamlining, or outright removal, of environmental permitting for AI-related infrastructure."

What risks does the new approach to AI open up?

The biggest concern the experts have with the Action Plan is the additional risk that it might add. The Biden administration focused its AI policy on mitigating the risks of disinformation, among other areas. But the National Institute of Standards and Technology (NIST) will now remove any references to diversity, equity and inclusion (DEI) and climate change, as well as misinformation, from its AI risk management framework (RMF).

Patel notes that such disregard for issues like DEI risks narrowing the innovation pipeline in the long term. "The plan sidelines DEI-focused research, which is critical for addressing bias and underrepresentation in LLMs and threatens to withhold support from states or organizations that don’t align politically. That’s not just bad for equity; it’s bad for innovation. By rewarding compliance over creativity, the plan may accelerate dominance at the cost of resilience."

She adds that the biggest downside of the plan is its shortsightedness. "Investing in AI infrastructure while cutting corners on environmental protection and workforce development may help scale the technology over the next five to ten years, but at the cost of hollowing out our core," she explains.

"Job displacement is already underway, and misinformation is already costing billions. This plan accelerates both, with no meaningful guardrails in place. It’s also combative by design. By framing AI as an arms race with China, the plan treats AI as a geopolitical weapon rather than a global system that demands multilateral stewardship. It misses the opportunity to use interdependence as a tool for de-escalation and collective resilience."

Masood focuses on the possible risks in enterprise safety as well as the nightmare of dual compliance, where enterprises will have to invest resources into complying with both US policies as well as EU regulations. With fewer ex-ante rules, regulations devised to prevent disasters before they happen, there will be an uptick in policing failures, including critical bias, safety incidents and privacy breaches, after they occur through existing laws and torts.

In the coming months and years, states will react to the recommendations within the plan and act accordingly. The Trump administration has threatened to divert AI-related federal funding from states with "burdensome AI regulations" and this could have an effect on businesses within those states.

Though California's AI bill was quashed by state governor Gabin Newsom in 2024, Colorado's own AI bill targeting algorithmic discrimination comes into force from February 2026. Other states looking to introduce AI transparency legislation include New York – and IT leaders will need to closely follow how legislation develops in any state they operate within.

The second major enforcement deadline for the EU AI Act is approaching, meaning big tech firms will face a greater degree of scrutiny over AI model safety.

From August 2nd, new governance rules for general-purpose AI (GPAI) models will be introduced through a voluntary Code of Practice.

The deadline represents the second major enforcement date for the landmark legislation this year, following on from a February deadline which focused primarily on prohibited use cases.

Enza Iannopollo, VP principal analyst at Forrester, said that while the onus will be placed on providers, enterprise end-users will also likely feel the impact of the new rules.

“Whilst the first regulatory milestone on 2nd February focused on requirements, including those on prohibited use cases, this second deadline expands accountability and enforcement as it introduces critical provisions regarding general-purpose AI (GPAI) models,” she explained.

“Providers of generative AI models are directly responsible for meeting these new rules, however it’s worth noting that any company using genAI models and systems — those directly purchased from genAI providers or embedded in other technologies — will feel the impact of these requirements on their value chain and on their third-party risk management practices.” 

What the GPAI code of practice means for businesses

The GPAI code of practice will enforce more robust guardrails for training AI models, according to EU lawmakers, and is based on three key pillars.

This includes greater transparency, meaning AI model providers are required to document and disclose training processes and share information on models with regulators.

Safety and security are a key focus of the code, again focusing on whether GPAI models pose risks to the public or enterprises. Under the new rules, providers are required to assess and document potential harms and take appropriate action to reduce any risks.

Dirk Schrader, resident CISO (EMEA) and VP of security research at Netwrix, said security considerations in the act are welcomed and help create a more aligned approach to AI-related security risks.

“One of the most significant anticipated successes of the Act is the standardization of AI security across the European Union, creating a harmonized, EU-wide security baseline,” he said.

“A key strength of the proposed regulations is their emphasis on a security-by-design ethos, mandating a lifecycle approach that integrates security considerations from the outset and throughout an AI system's operational life.”

Security considerations do raise questions over compliance, however. Simply put, there isn’t a solid baseline for enterprises to work from with regard to AI-related security risks at this stage.

“The Act is the first major law to call out protections against data poisoning, model poisoning, adversarial examples, confidentiality attacks, and model flaws,” he said.

“The real compliance burden will be determined by technical specifications that don't yet exist, as these will define the practical meaning of 'appropriate level of cybersecurity' and may evolve rapidly as AI threats mature.”

Elsewhere, rules pertaining to copyright are also outlined in the code of practice, and this has been a major point of contention in recent months. For example, under the code, signatories must ensure training data is sourced lawfully.

A host of major tech companies have agreed to the code of practice, most recently Google and OpenAI. Some, however, have taken a harder stance.

Earlier this month, Meta revealed it won’t sign up for the code of practice amid what it described as concerns over “legal uncertainties”.

In a LinkedIn post clarifying the company’s stance on the code, Meta’s chief global affairs officer Joel Kaplan said the code will introduce measures which “go far beyond the scope of the AI Act”.

"Europe is heading down the wrong path on AI. We have carefully reviewed the European Commission’s Code of Practice for general-purpose AI (GPAI) models and Meta won’t be signing it," he said.

The risks of non-compliance

Organizations that fail to comply with the EU AI Act face serious repercussions, and while the new code of practice is voluntary, Iannopollo said it’s crucial that enterprises operating in the region pay close attention to the enforcement deadline.

“Like it or not, the EU AI Act will contribute to shape AI risk management and AI governance practices of most global companies,” she said. “Its requirements may not be perfect, but they are the only binding set of rules on AI with global reach, and it represents the only realistic option of trustworthy AI and responsible innovation.

“It’s crucial that companies operating AI technology in the EU, or using AI-generated insights within the EU market, pay attention to this enforcement milestone.”

The EU AI Act contains “significant fines” for non-compliance, including up to 7% of a company’s global turnover. Iannopollo noted that not all the authorities responsible for enforcement are up and running yet, but others are, including the EU AI Office.

“Companies, make no mistake: there will be action in the next few months,” she said.

MORE FROM ITPRO

• The EU just shelved its AI liability directive
• How the EU AI Act compares to other international regulatory approaches
• Everything you need to know about the EU AI Act

It’s been some time since the Network and Information Systems 2 (NIS2) Directive (NIS2) came into force in the EU but many organizations are still struggling to comply. So much so that the EU’s leading security agency ENISA has issued a stark warning after finding that six critical national infrastructure (CNI) sectors are failing in their implementation of the directive.

ENISA found a need to align requirements across borders in each NIS sector. It said that collaboration must be strengthened through community building events and cooperation at sector, national and EU level.

Some industries are more far behind others, according to the report, which calls out six sectors struggling to meet the expectations of NIS2: ICT service management, space, public administrations, maritime, gas and health.

So why is NIS2 compliance causing so many headaches and what can security leaders do about it?

Challenged sectors

Some sectors were not equipped to deal with NIS2’s cybersecurity requirements in the first place. Certain industries are struggling due to complex and outdated infrastructure, a lack of sector-specific guidance and “insufficient investment in cybersecurity measures”, says Matt Riley, director for information security at Sharp UK and Europe.

All the highlighted sectors in ENISA’s report share common challenges, says John Lynch, director at Kiteworks: “Complex supply chains with numerous third-party data exchanges, limited visibility into how sensitive data moves between entities, and difficulty implementing the governance controls required by NIS2 for secure data sharing across organizational boundaries.”

One of the most affected sectors is ICT service management, which faces difficulties due to its cross-border nature and the “vast number of diverse entities” involved, says Vincent Lomba, chief technical security officer at Alcatel-Lucent Enterprise. This complexity makes it challenging to implement uniform cybersecurity measures across all levels of the sector, he says.

Healthcare also faces obstacles in complying with the NIS2 Directive, because organizations tend to have complex, interconnected supply chains that introduce vulnerabilities. “Additionally, the widespread use of legacy systems and poorly secured medical devices increases the difficulty of compliance,” Lomba explains.

Adding to this, healthcare is often held back by tight budgets and a lack of resources, making it no surprise that compliance is challenging.

Small businesses also face budget constraints and are under “significant pressure” to manage operating costs while maintaining their service delivery, says Lomba.

In contrast, sectors such as electricity, telecoms and banking have shown “strong resilience and maturity” in their cybersecurity practices, says Riley.

These sectors benefit from long-term investments, robust regulatory oversight, and strong public-private partnerships. This “proactive approach to cybersecurity”, including regular risk assessments, continuous monitoring and “a culture of collaboration and information sharing” makes the sectors much more prepared than their peers in other industries, he points out.

Country-by-country regulation

There are issues with the regulation at a country level holding many firms back from NIS2 compliance. Only a handful of EU member states including Belgium, Croatia, Hungary, Italy, Latvia, and Lithuania have adopted national legislation to transpose the NIS2 Directive. Others remain at various stages of implementation, says Scott Hudson, principal consultant at Bridewell.

Governments are facing capacity constraints and competing priorities, which has delayed the process, he says. “The fact that many member states have not yet established the laws needed to implement NIS2 clearly makes compliance challenging.”

The UK is not directly regulated by NIS2 following Brexit, but the regulation does impact firms doing business in the EU. At the same time, the UK has its own NIS regulations, which are being strengthened to align with NIS2's principles.

The proposed UK Cyber Security and Resilience Bill is not expected to be as broad in its sector focus as NIS2. Yet it will align the UK more closely with the EU's approach, says Clare Reynolds, digital resilience specialist at Taylor Wessing UK. “The expectation is that the UK regime will be no more onerous than NIS2, with minimal additional policies required to comply with both.”

Compliance quick fixes and long term strategies

If the NIS2 Directive impacts you, it’s important to not bury your head in the sand, says Hudson. He recommends gaining “a clear understanding of your assets, systems, critical functions and cyber risk exposure”, which he says is “essential” to remaining compliant.

Ollie Gower, senior managing director in the cybersecurity practice at FTI Consulting thinks an “organization-wide, risk-based approach” that “considers the business, culture, technology and supply chain” is key. “With so many elements to take into account, a pragmatic approach based on quick wins and clear prioritization of the most prominent gaps is recommended.”

To boost compliance with NIS2, organizations can adopt both quick fixes and long-term strategies. For a quick fix, Gower recommends firms appointing a leader to take control of NIS2. At the same time, organizations should focus on visibility. “Map out your critical assets, ICT systems and suppliers. You can’t secure what you don’t fully understand.”

Riley concurs, advising firms to conduct “comprehensive risk assessments to identify your assets”.

At the same time, ensure you are implementing basic cybersecurity hygiene practices such as regular software updates and patch management, and providing awareness training to employees, he adds.

Long-term strategies involve developing a robust cybersecurity framework, aligned to recognized standards such as ISO27001, alongside continuous monitoring and regular audits.

Hudson also advises ensuring you have dedicated resources, either in-house or externally, with the right skills and capabilities to “assess risk, prioritize efforts and drive compliance forward”.

Supply chain risk is a major part of NIS2. Taking this into account, organizations — especially those in high-risk sectors with complex supply chains such as healthcare — need to start evaluating their third-party vendors more rigorously, says Gower. “Create a provider inventory, and ensure there are clear expectations in contracts with third parties around cybersecurity practices.”

Meanwhile, having a basic, well-communicated incident response plan in place can make “all the difference in a time of crisis”, says Gower. He recommends “getting leadership involved early” and “making sure they understand the stakes.”

Meta has said it won't sign up for the EU's code of practice for providers of general-purpose AI models, citing concerns over "legal uncertainties".

The voluntary guidelines form part of the EU AI Act, due to come into force next month. They ask companies to, amongst other things, refrain from training AI on pirated materials and comply with requests from content creators to omit their work from training data.

As part of the rules, providers are also required to issue regular updates on AI tools and services.

While the code is voluntary, the EU has said that AI providers who don't sign up will be expected to demonstrate compliance by other means, and might face more regulatory scrutiny.

Meta has hit back at lawmakers, however, accusing the EU of overreach.

"Europe is heading down the wrong path on AI. We have carefully reviewed the European Commission’s Code of Practice for general-purpose AI (GPAI) models and Meta won’t be signing it," wrote chief global affairs officer Joel Kaplan in a post on LinkedIn.

"This Code introduces a number of legal uncertainties for model developers, as well as measures which go far beyond the scope of the AI Act."

Meta has history with the EU

Meta has been complaining about the AI Act for a while. Last summer, Mark Zuckerberg and Spotify CEO Daniel Ek issued a joint statement saying that "Europe’s risk-averse, complex regulation could prevent it from capitalizing on the big bets that can translate into big rewards."

The tech giant has support from US president Donald Trump on the issue, who has called for the AI Act to be paused - although the EU appears to be standing firm.

Henna Virkkunen, the European Commission vice-president responsible for tech sovereignty, recently said lawmakers are "very committed to our rules when it comes to the digital world".

Earlier this month, companies including Google, Meta, Airbus, BNP Paribas, and TotalEnergies called for a two-year delay in implementation, claiming that as it stands, the AI Act will stifle innovation.

"Businesses and policymakers across Europe have spoken out against this regulation. Earlier this month, over 40 of Europe’s largest businesses signed a letter calling for the Commission to ‘Stop the Clock’ in its implementation," said Kaplan.

"We share concerns raised by these businesses that this over-reach will throttle the development and deployment of frontier AI models in Europe, and stunt European companies looking to build businesses on top of them."

OpenAI and Mistral have already signed the code - although the latter has voiced concerns about the impact of the legislation.

"Compliance with the Code and the AI Act’s risk based framework must be as simple and streamlined as possible for the homegrown start-ups and smaller businesses that will be the future leaders of Europe’s AI-first economy," said OpenAI in a statement.

"We have advocated⁠ for greater simplification and harmonization to support these next generation companies and will continue to back their concerns, as they are key to AI of, by and for Europe."

MORE FROM ITPRO

• The UK government is working with Meta to create an AI engineering dream team
• Meta faces new ‘open washing’ accusations with AI whitepaper
• Meta is working on a 5GW data center to supercharge AI infrastructure

The UK government’s Online Safety Act (OSA) comes into force on 25 July 2025, requiring technology platforms to implement processes and systems to prevent users – particularly children – from accessing “harmful and age-inappropriate digital content”.

The UK’s media regulator, Ofcom, which will be enforcing the new act, says that 59% of teenage children (aged 13-17) have encountered potentially harmful content online. It has determined that technology providers can do more to address this and has set out new codes of practice to which these providers must adhere.

“The Online Safety Act introduces a fundamental shift in how online services – both UK-based and international – must operate when accessible by UK users,” explains Dr. Loredana Tassone, Managing Consultant and Head of EU and UK Representative Services at GRCI Law. “Ofcom now holds wide-ranging investigatory and enforcement powers, making compliance not just a legal necessity, but an operational and ethical imperative.”

The legislation regulates operators of digital platforms in a number of new ways, making them more responsible for their users’ safety. And it includes the responsibility to implement systems and processes that reduce the risk of illegal activity, including the removal of illegal content when it does appear.

“The regulator, Ofcom, has the power to require the provision of certain information, to issue fines of up to the greater of 10% of global annual turnover or £18m and to impose various business disruption measures,” says Nick Harrison, senior associate at global law firm Taylor Wessing. “New criminal offences are also introduced for certain breaches or failures to comply.”

All tech businesses operating in the UK need to carefully consider whether their services comply with the law and keep it in mind when seeking to expand in the region.

Ofcom’s guidance

On 24 April 2025, Ofcom presented its codes of practice to the UK Parliament, publishing guidance on how providers should carry out risk assessments for evaluating the potential harm to children, with services given three months to complete their audits ahead of the 24 July deadline.

“The Act places significant demands on platform governance and user content moderation, especially for services likely to be accessed by children,” says Tassone. “Businesses will need to embed safety into their governance structures, assess and mitigate content risks proactively, and implement age assurance mechanisms that are effective yet privacy conscious.”

The OSA doesn’t just apply to UK businesses, either, or those with a physical presence in the United Kingdom; it applies to any service which has "links with the UK".

“This threshold can be met in a number of ways: if the number of UK users of the service is "significant" (this is deliberately not defined and will be context-dependent), if UK users are a target market of the service, or if content on the service presents a material risk of significant harm to users in the UK who can access the service,” Harrison tells ITPro.

The OSA sets out a range of duties and explains how providers should approach them. For example, one of the safety duties surrounding illegal content is to take proportionate measures to prevent users from encountering that content. And it also stipulates that this applies to how a service is designed, operated and used.

“It is simply not enough for a provider to say that it was happy with the original design of a service and the real-world operation of it was uncontrollable,” says Daniel Milnes, partner at Forbes Solicitors. “What happens to users, specifically including the effect of algorithms, is a provider’s responsibility. The existence of this specific set of duties, mandatory assessments and reporting, and dedicated enforcement powers, is certainly intended to make providers focus more on protecting users.”

Concerns from SMEs

Smaller companies, especially SMEs and startups, have expressed concerns that the Online Safety Act may place excessive pressure on them.

"Implementation of the Online Safety Act faces hurdles in cost and technical feasibility,” explains Jason Soroko, Senior Fellow at Sectigo, a leading provider of SSL certificates. “Platforms, especially smaller or independent operators, may struggle with the expense of robust age verification and content moderation tools.

“Enforcement also poses challenges due to varied jurisdictional reach and resource constraints. Regulators risk focusing on easily targeted platforms while larger, multinational sites exploit legal loopholes or inconsistent international cooperation.”

Kevin Quirk, director at AI Bridge Solutions, agrees that the Online Safety Act may result in smaller companies being disproportionately affected, whilst also facing greater scrutiny from Ofcom.

“While large tech firms have long had legal teams and compliance departments in place, the Act presents a real challenge for smaller companies like ours, particularly when trying to remain agile and cost-effective,” Quirk tells ITPro. “Since the Act came into force, our clients have become far more cautious when launching new platforms. We’re seeing delays in deployment timelines while legal teams reassess features. Others have asked us to rebuild or modify platforms to better align with safety-by-design principles.”

Quirk also claims that, whilst the Act requires “reasonable steps” to be taken, it doesn’t do a satisfactory job of defining what “reasonable” looks like for an SME. “That ambiguity creates risk,” he says. “We’re spending more time than ever on policy, legal consultations, and risk assessments; resources that would otherwise go toward development and innovation.”

Potential knock-on effects

Alongside the added pressure of cost and compliance, there have also been concerns raised about a lack of clarity around “harmful content”, which may further complicate compliance, as platforms concerned about incurring fines are forced to navigate the waters between the Scylla of harmful content and the Charybdis of excessive censorship.

“One consequence may be censorship,” says Boris Cipot, senior security engineer at Black Duck, which helps teams manage security and compliance risks. “In many cases, content will be removed or prohibited due to generic rules disregarding the context due to the fear of facing penalties. This may mean that different viewpoints might be disregarded.”

Nick Henderson-Mayo, Director of Learning and Content at compliance eLearning and software provider, VinciWorks, agrees that censorship needs to be addressed with consideration, as it could affect areas such as encryption, an issue that was raised by companies such as WhatsApp and Signal in 2023.

“Encryption could be at risk if scanning mandates go too far, and fear of fines might lead to over-censorship. Ofcom says it’ll act proportionately, but privacy-focused platforms are watching closely,” says Henderson-Mayo. “In fact, several chat app providers have warned that if compelled to scan private messages proactively, it would “nullify the purpose of end-to-end encryption”. Some secure messaging apps might even withdraw from the UK rather than compromise their encryption, but we will need to see if they are serious or just scaremongering.”

While the UK’s Online Safety Act will mirror the EU’s goal of making the internet safer, with both the UK and EU acting in concert, there are concerns that the OSA and the EU’s Digital Services Act (DSA) may dissuade companies from launching and operating in Europe.

But Cipot tells ITPro that while firms may be concerned about this, the long-term effect is likely to be beneficial.

“Some services might not be willing to enter the UK market as they do not want to implement the additional safeguards. On the other hand, would you be ok using a service that does not have the safeguards provided by the Act?,” says Cipot. “I believe the Act will be a good way to ensure online safety improves.”

Preparing for the Online Safety Act

To prepared for the OSA, IT companies will need to determine whether they are in-scope and, if so, familiarize themselves with the various duties under the OSA and related guidance from Ofcom. They should then begin carrying out risk assessments as soon as possible. “This is a significant task and should not be put off since the timelines are quite tight and many deadlines for compliance have already passed,” explains Harrison.

By 25 July, affected online services, which are likely to be accessed by UK children, need to complete their risk assessment and comply with Ofcom’s Protection of Children Codes.

“The July 2025 deadline to protect children from harmful content adds urgency,” says Tassone. “Organizations should act now—conducting gap analyses, assigning accountability, and building cross-functional governance—to meet expectations and reduce compliance risk.”

Apple is pushing back against new app store rules imposed by the European Commission (EC), claiming the EU body has taken changes and a €500 million (£430m) fine too far.

The EC levied the fine in April, arguing Apple was in breach of anti-steering obligations in the EU Digital Markets Act (DMA). That refers to Apple's long-running ban on alternative app stores and rules that stop developers from telling users about discounts or other offers outside of the Apple platform.

Apple previously took a cut of up to 30% on sales inside apps and has been locked in a war of words over the practice with developers.

The tech giant complied with the app store rule changes last month in order to avoid additional fines that could reach 5% of its average revenue globally.

That included a wider range of commission rates up to 13%, alongside user acquisition fees, with the costs dependent on what marketing support the developer wants in the App Store as well as technical aspects such as automatic updates.

Developers will also be able to promote alternative ways of purchasing services outside the app, though Apple would charge a commission on sales advertised via apps in its App Store.

Apple is baffled, the EC is standing firm

Key to Apple’s argument, and appeal, is that the company claims this new system is "confusing" to business users.

"Today we filed our appeal because we believe the European Commission’s decision – and their unprecedented fine – go far beyond what the law requires," said Apple in a statement.

"As our appeal will show, the EC is mandating how we run our store and forcing business terms which are confusing for developers and bad for users."

Apple has yet to reply to a request for comment from ITPro.

The Commission, meanwhile, is standing by its decision. In a statement responding to the appeal, it said: "We stand ready to defend our decisions in court.”

The EC previously said that Apple shouldn't charge developers for the right to "steer" customers, suggesting that a commission on sales promoted in-app wouldn't meet requirements.

Political battle

A legal expert told The Guardian that Apple may be employing delay tactics.

"The blunt truth is that it is worth spending a few million on legal fees in order to disrupt and delay the development of a more open app ecosystem, which is a market that is worth many billions a year to Apple," Tom Smith, a competition lawyer at Geradin Partners, told the publication.

The app store quarrel isn't the only ongoing battle between the EU and tech companies. In April, Meta was hit with a €200m fine for charging users to get rid of ads, while last year Apple was fined €1.8bn over music streaming competition.

The appeal comes ahead of US President Donald Trump's 9 July deadline to settle a trade deal with the EU or risk 50% tariffs. The Trump administration has repeatedly said the EU is targeting US tech companies in retaliation for trade disruption and other political concerns, with Trump trade advisor Peter Navarro calling it "lawfare".

EU action against tech giants stretches back well before even the first Trump administration, with a €497 million fine against Microsoft in 2004 over Windows Media Player bundling that was later increased to €899 million for non-compliance.

That was followed by cases against Intel in 2009, an investigation against Google on search that began in 2010, and investigations into taxes that pulled in Apple and Amazon beginning in 2014.

That said, things have accelerated since 2017 with a €2.42bn fine against Google over price comparison shopping services. In subsequent years, EU lawmakers imposed a €4.34bn for Android and €1.49bn over AdSense, with other cases targeting Apple, Amazon and Meta in recent years.

MORE FROM ITPRO

• Apple throws cold water on the potential of AI reasoning
• Apple is offering rewards of up to $1 million to find critical flaws in its private AI cloud systems
• Apple: Our AI data was gathered responsibly

The tech industry is known for its culture of long working days and employees putting in extra hours, either to get a project completed or because they’re collaborating with colleagues in another time zone.

The last thing tech workers want after logging out for the evening is to have to take a phone call or respond to an email about a non-urgent matter that could have waited until they’re in the office the next day.

This is why there are arguments for the US to adopt ‘right to disconnect’ legislation that would make it illegal for employers to contact their employees outside of working hours.

According to Tech.co's Impact of Technology on the Workplace Report 2025, 83% of employees feel obligated to respond to work-related emails and calls even when on holiday. The survey of 1,036 US-based senior leaders at companies with at least 10 employees found that 72% of senior leaders in the tech industry support the 'right to disconnect’ law, while 14% are against and the other 14% are on the fence.

So is the US likely to adopt a law like this any time soon? And how could it look to international examples for benefits and drawbacks?

How other countries have approached the issue

Different countries have taken different approaches to the ‘right to disconnect’.

Since 2017, companies in France with a headcount of at least 50 are required to draw up a charter in conjunction with union representatives setting out the hours that workers don’t have to send or respond to emails.

France is currently one of ten EU states that have introduced legislation. The others are Belgium, Croatia, Cyprus, Greece, Italy, Luxembourg, Portugal, Slovakia and Spain.

Australia adopted legislation last year that allows employees at companies with a headcount of at least 15 to refuse to monitor, read or respond to contact outside of working hours without fear of being punished. The onus is on employers to discuss with their workers what constitutes a reasonable refusal, according to the Fair Work Ombudsman, Australia’s workplace regulator.

Failure to comply with these laws can lead to sizable fines, though the severity of the penalty varies country to country.

On the other hand, Ireland adopted a code of practice in 2021 that encourages employers to engage with employees on how they can disconnect in conjunction with union representatives. The code is voluntary, not statutory, though, so there’s no legal requirement, and, as such, there are no penalties for companies that don’t adopt it.

The UK is also weighing up whether to introduce legislation. The Labour government has pledged to introduce a ‘right to switch off’ law where “working from home does not become homes turning into 24/7 offices”. This is backed by the Trades Union Congress, which highlighted the need for the 'statutory right to disconnect’ in its draft AI Bill published in April last year.

The reality of the US implementing legislation

California, known for its progressive politics, became the first US state to push for the ‘right to disconnect’ to be enshrined into law last year. But a bill that would have required employers to create boundaries for their workers was shelved last May.

The problem is labor laws in Europe have tended to focus on protecting workers, whereas US labor laws are more about protecting employer flexibility, Kelsey Szamet, partner at California-based employment law firm Kingsley Szamet Employment Lawyers, tells ITPro.

The US has also entered a period of deregulation across a number of industries, so it’s unlikely that the ‘right to disconnect’ will be legalized at the federal level during the current presidency.

If the US were to eventually adopt legislation, then the main takeaway from how other countries have implemented the ‘right to disconnect’, continues Szamet, is the need for explicit boundaries and to ensure sanctions are enforced on any company that fails to comply.

“There are some that will attempt to circumvent them by employing broad loopholes and ambiguous job definitions, such as labeling employees ‘exempt’ from overtime law,” she says. Tech workers, especially those at young, fast-paced startups that operate on a tight budget, may be considered ‘exempt employees’, meaning they’re not eligible for overtime pay as set out under the Fair Labor Standards Act.

To reduce resistance to the ‘right to disconnect’, there’s going to need to be a huge culture change.

“Countries like France and Belgium have made it clear that protecting personal time isn’t a luxury; it's essential to sustaining a healthy workforce. Implementing similar protections in the US would challenge existing norms, but it’s not impossible,” says Greg Davis, CEO at Oregon-based cloud connectivity firm Bigleaf Networks.

Davis suggests one way companies can prepare for future legislation is by giving employees structured time to disconnect.

Szamet agrees with this sentiment, adding that the next best thing until legislation is passed is unionization and companies voluntarily introducing corporate policies that support employees to switch off once their working day is over.

“This would allow workers to set reasonable boundaries without waiting for lawmakers to catch up,” she concludes.

The Data (Use and Access) Bill is the latest data protection legislation currently making its way through parliament and will apply to any organization operating in the UK. This bill aims to update the UK’s data policies, including UK GDPR, Investigatory Powers Act 2016 and Data Protection Act 2018, as well as relaxing the permitted uses of data processing for scientific research and streamlining data processing for public services.

There has been a growing expectation for some time that the UK’s data protection policies will be updated. The Data Protection Act 2018 was the previous such update and new technologies requiring legislative attention have emerged since then. A proposed update was planned earlier this year, but the Data Protection and Digital Information (DPDI) Bill was prorogued due to the change in government.

“My view is that the changes which have been proposed, even when taken together, won't threaten the UK's adequacy status,” says Anthony Lee, a partner specialising in information technology and data protection at gunnercooke LLP. “Whereas I felt with the DPDI, there were quite a few changes that might well have resulted in the UK losing its adequacy status.”

Those hoping for a simple and condensed approach to data protection may be disappointed. The Data (Use and Access) Bill is massive, at over 260 pages. However, the reason for the bill’s size is that it is revising and amalgamating a diverse array of legislation.

“The Data Use and Access Bill weakens our rights and gives companies and organizations more powers to use automated decisions,” said legal and policy officer Mariano delli Santi, in a statement from the Open Rights Group. “This is of particular concern in areas of policing, welfare and immigration where life-changing decisions could be made without human review. The Government says that this Bill will generate billions for the economy, but at what cost to the privacy, security and dignity of the British public?”

One of the key elements is Part 1, where the Data (Use and Access) Bill makes clear distinctions between business data and customer data.

Business data is defined as anything regarding goods, services and digital content supplied or provided by the trader. Meanwhile, customer data is information relating to goods, services and digital content supplied or provided by the trader to the customer, or to another person at the customer’s request.

Much like the previous DPDI, the Data (Use and Access) Bill attempts to establish the regulatory foundations for digital identities. Chapter 27, subsection 1 concerns the reliability of digital verification services and the Secretary of State would be expected to prepare and publish, in collaboration with the information commissioner, the “DVS trust framework” document. This would set out further rules and regulations regarding the provision of digital verification services.

The DVS trust framework would replace the UK’s current Electronic Identification, Authentication, and Trust Services (eIDAS) regulation. The bill would also abolish the Information Commissioner’s Office and replace it with the Information Commission, with the functions transferred to the new organization.

Part 5 of the bill updates the UK data protection and privacy. In particular, clause 67 expands the use of data processing for statistical and research purposes.

The same section also revises Article 4 of UK GDPR, explaining that references to the processing of personal data for scientific research now includes publicly and privately funded research as well as research carried out as part of a commercial or non-commercial activity. However, the bill reinforces that consent still needs to be given for the processing of personal data for scientific research.

Article 22B of the bill will be added to the UK GDPR, which restricts automated decision-making processes. The Article declares that a significant decision, based entirely or partly on the processing of special categories of personal data (such as faith ethnicity, genetic data or biometric data), may not be taken based solely on automated processing, unless one of a series of conditions is met.

These conditions include where the data owner has explicitly agreed to automated decision making, necessary for completing a contract agreed between the data subject and the data controller, or when the data processing is required by law.

The bill also outlines the appropriate safeguards for data processing. It states that the safeguards have not been met if the processing “is likely to cause substantial damage or substantial distress to a data subject.” Furthermore, the requirement is only satisfied if the safeguards include technical and organizational measures for the purpose of ensuring respect for the principle of data minimization, such as pseudonymization.

Overall, the bill as it currently stands is a lengthy document, but not all of it will be relevant to all businesses. It is also still making its way through parliament, and therefore changes may well occur – digital verification is especially controversial. However, there is an expectation that the UK’s data protection policies will evolve and it is therefore incumbent that stakeholders engage with legislators to ensure that they are prepared and fully aware of what is to come.

“The more the UK diverges from the GDPR and dilutes people’s rights and protections, the more likely it is that the UK will be regarded by the European Commission as not being a safe pair of hands from a privacy perspective,” concludes Lee.

“Whilst there are changes proposed which will result in some rights being diluted (such as making automated decision making more flexible than under the GDPR and having a list of legitimate interests where an assessment is not required, such as in emergencies), my sense is that changes will not result in the UK being considered to having inadequate privacy laws.”

He adds that there are controls in the bill to keep human oversight for sensitive data, with some wiggle room open for what does and doesn’t constitute the minimum amount of human participation in a given task.

“A decision will have been taken by solely automated means if there has been no meaningful involvement. It is going to be interesting to see the debates about what is meant by no meaningful human involvement.”

A proposed decade-long ban on US states implementing AI laws is a "terrible idea" that highlights the scale of big tech lobbying, according to critics.

Earlier this week, a Republican-led committee proposed a budget reconciliation bill which at the last minute tucked within its pages a clause that would ban state-level AI regulation for the next ten years. If approved, only the US Congress could legislate on AI, not state governments.

The bill included a line that said "no State or political subdivision thereof may enforce any law or regulation regulating artificial intelligence models, artificial intelligence systems, or automated decision systems during the 10-year period of this Act."

That would preempt efforts by California and other states looking to rein in AI using regulation. It remains to be seen if the section will be included in the final bill and whether that will be passed.

Following the move, the Electronic Frontier Foundation (EFF) published a statement strongly opposing the proposals, calling it a "terrible idea".

The EFF noted that it would override existing state laws designed to prevent people from harms caused by AI and would prevent other states from writing similar legislation — a problem as Congress is much slower at taking on new technologies.

Similarly, the non-profit said this risks no regulation being implemented at all for ten years during a critical time in the development of the technology.

"Even if Congress does nothing on AI for the next ten years, this would still prevent states from stepping into the breach," the EFF said in a statement. "Given how different the AI industry looks now from how it looked just three years ago, it’s hard to even conceptualize how different it may look in ten years."

"Congress does not react quickly and, particularly when addressing harms from emerging technologies, has been far slower to act than states,” the EFF added.

Wider criticism

An open letter signed by a series of state-level representatives — as well as frequent AI dissenter and New York University professor Gary Marcus — made a similar argument, calling the attempt to preempt AI laws "deeply problematic".

"If enacted, the statute would preempt states from acting — even if AI systems cause measurable harm, such as through discriminatory lending, unsafe autonomous vehicles, or invasive workplace surveillance," the letter added.

Other critics made it clear the move was seen as benefiting big tech. Lee Hepner, senior legal counsel at the American Economic Liberties Project, described the move as a “sweeping and reckless attempt” to shield large corporations from accountability.

Why ban AI laws?

A ten-year ban on AI laws may sound inherently extreme, but those in favor of it argue that AI regulation requires a national approach to minimize the costs and impact of regulation at a time when the US is battling China for dominance in this domain.

An article in Lawfare argued that the current “patchwork of parochial regulatory policies” could severely undermine US innovation in the AI space at a critical juncture.

But the open letter noted that presented a "false choice" between too many laws and a single set of federal laws, given there was effectively zero of the latter.

"If Washington wants to pass a comprehensive privacy or AI law with teeth, more power to them, but we all know this is unlikely," the letter added.

At a state-level, there are dozens of examples of AI laws — from Colorado's AI protection bill to California's attempts to rein in its own industry.

"It's specifically because of state momentum that Big Tech is trying to shut the states down," the letter added.

The EFF echoed that: "As the big technology companies have done (and continue to do) with privacy legislation, AI companies are currently going all out to slow or roll back legal protections in states."

MORE FROM ITPRO

• Is the UK falling behind the EU on AI regulation?
• American tech workers want AI regulation – but they might have to wait a while
• Why AI could be a legal nightmare for years to come

The European Commission has issued its first penalties under the EU Digital Markets Act (DMA), fining Apple €500 million and Meta €200m and requiring both to make changes to how they operate.

The DMA came into effect in 2023 and was created to regulate competition in the digital economy, in part by reining in abuse of power by larger platforms.

Apple was found to be in breach of "anti-steering obligations" over restrictions that ban apps from informing customers of offers outside the App Store, which the EC said limited customer choice.

The Commission has ordered Apple to remove that restriction, and the tech giant plans to appeal the fine.

Meta, meanwhile, was fined for its introduction of a model that would force users to pay for an ad-free service or consent to their data being used for advertising.

The Commission said that fell foul of an obligation under the DMA to give consumers the choice of a service that uses less of their personal data.

Apple and Meta respond

Both companies made it clear they disagreed with the fines. In a statement, Apple hit out at the Commission, suggesting the penalties show it is “unfairly targeting” the company.

The tech giant said the decisions are “bad for the privacy and security of our users, bad for products, and force us to give away our technology for free”.

"We have spent hundreds of thousands of engineering hours and made dozens of changes to comply with this law, none of which our users have asked for,” the statement added.

“Despite countless meetings, the Commission continues to move the goal posts every step of the way. We will appeal and continue engaging with the Commission in service of our European customers.”

Meta offered harsher criticism in its response, accusing the EC of treating US businesses unfairly.

"The European Commission is attempting to handicap successful American businesses while allowing Chinese and European companies to operate under different standards," Meta's Chief Global Affairs Officer, Joel Kaplan, said in a statement.

"This isn’t just about a fine; the Commission forcing us to change our business model effectively imposes a multi-billion-dollar tariff on Meta while requiring us to offer an inferior service," he added. "And by unfairly restricting personalized advertising the European Commission is also hurting European businesses and economies."

A ‘strong and clear’ message from the EU

Despite the complaints, Teresa Ribera, Executive Vice-President for a Clean, Just and Competitive Transition, said in a statement the fines send a "strong and clear message" to digital companies, adding that the legislation is a crucial tool to ensuring fair markets.

"Apple and Meta have fallen short of compliance with the DMA by implementing measures that reinforce the dependence of business users and consumers on their platforms," Ribera said. "As a result, we have taken firm but balanced enforcement action against both companies, based on clear and predictable rules."

"All companies operating in the EU must follow our laws and respect European values,” she added.

That reference to European values reflects geopolitical turmoil between the US and the rest of the world, according to Joe Jones, director of research and insights at IAPP.

"The fines land at a time of heightened scrutiny by the current US Administration on the application of EU laws to US companies," Jones said.

"The EU Digital Markets Act was even name-checked in an Executive Order issued by President Trump last February as facing scrutiny as part of the Administration’s work to “defend American companies and innovators from overseas extortion,” he added.

"Open questions include not only how will addressed companies respond to EU regulatory enforcement but how will overseas governments, including and especially the US, respond. The U.S. Administration has declared it will consider responsive actions like tariffs to combat certain foreign government policies levied against US companies."

Beyond the fines

As Meta noted, there's more to the decision than fines. Indeed, despite the seemingly large figures, the fines were much smaller than the EU could have levied, as high as 10% of their global annual turnover. Last year, Meta's earnings topped $165 billion and Apple's was $391 billion.

In a statement, the EC said that developers using Apple's App Store should be able to tell customers about alternative offers outside that store, such as discounted subscription offers. The EC added that Apple had failed to give a reason why such restrictions are "necessary and proportionate."

Beyond the fine, the EC has ordered Apple to remove such restrictions and not introduce similar restrictions in the future.

The EC also closed an investigation into Apple's tactic of not allowing its own pre-installed apps to be removed from its devices, such as its Safari web browser.

Following a "constructive dialogue", Apple made it easier to select a new default browser on iPhones, uninstall several Apple pre-installed apps, and change default settings for other tools such as keyboards and translation.

Alongside those two investigations, the EC also issued preliminary findings on Apple banning third-party app stores and requiring users to download apps via the official App Store.

The EC said that its preliminary view is that Apple isn't complying with the DMA by disincentivising developers from offering apps elsewhere via a new fee, the Core Technology fee, while also introducing strict eligibility requirements.

Apple can now respond to those findings ahead of a final ruling.

For Meta, it has been fined under DMA rules that mean "gatekeepers" must get user consent for combining personal data between services, and still offer an equivalent alternative service for any who refuse to consent.

This decision refers to Meta's "consent or pay" advertising model that was introduced in November 2023, which gave Facebook and Instagram users the option of consenting to their data being combined for personalized advertising or paying a subscription to opt out and receive an ad-free service.

The EC said that model didn't offer enough of an alternative service for those who opted out. A year later, Meta offered a new version that included a tier that used less personal data to display ads.

This particular fine applies only to the period up to November 2024 when those changes came into effect, as the regulator is still considering the changes.

Alongside the advertising data ruling, the EC also announced that Facebook Marketplace was small enough that it should no longer be designated under the DMA.

MORE FROM ITPRO

• How the EU AI Act compares to other international regulatory approaches
• DORA and why resilience (once again) matters to the board
• The fractured regulatory landscape tech companies face in 2025

Google has struck back against US regulators, claiming that plans to dismantle the company would "hurt the economy".

Last year, a court case brought by the US Department of Justice (DOJ) found Google had a monopoly in search. A trial that began this week seeks to decide the correct remedies, which could include breaking up aspects of Google, selling Chrome or spinning out Android.

The DOJ said in a filing that Google forces Americans to submit to "unbridled demands and shifting, ideological preferences" just to access a decent search tool.

Justice Department lawyer David Dahlquist said in court Monday: "This is the time for the court to tell Google and all other monopolists who are out there listening — and they are listening — that there are consequences when you break the antitrust laws."

Last week, in a separate case, a US judge found that Google has an illegal monopoly in advertising technology, and it faces a class-action style suit in the UK on the same subject.

Google breakup plans would harm the economy

While Google will get a chance to have its say in court, the company shared a blog post over the weekend ahead of the beginning of the trial, arguing its case to the public, and reiterating that it disagreed with the court's decision last year.

The post pointed to its own proposal for remedies that would allow multiple search agreements, de-link Google's apps in Android, and stressed that Google would appeal the ruling once the remedy was decided.

Penned by Lee-Anne Mulholland, vice president of regulatory affairs, the post said the case was "backwards looking" given the current level of intense competition in online search sparked by the rise of AI, pointing to ChatGPT and DeepSeek.

"At trial we will show how DOJ’s unprecedented proposals go miles beyond the Court’s decision, and would hurt America’s consumers, economy, and technological leadership," she wrote.

The post further argued the DOJ proposal would make it harder to access online services.

"People use Google because they want to, not because they have to," Mulholland wrote. "DOJ's proposal would force browsers and phones to default to search services like Microsoft’s Bing, making it harder for you to access Google."

She added that the proposal would prevent competition in search, raise prices and slow innovation, adding that it would damage Mozilla Firefox which relies on Google payments from search distribution.

Similarly, the move would force Google to share sensitive and private search data with "companies you may never have heard of".

On the topic of Android potentially being spun out, Google argued it would impact security, raise prices and hurt businesses.

"DOJ’s proposal to split off Chrome and Android — which we built at great cost over many years and make available for free — would break those platforms, hurt businesses built on them, and undermine security," she wrote.

AI a new front for case?

Google argued that the DOJ proposal would "hamstring how we develop AI" by requiring a government committee to regulate the design of its related products.

Mulholland suggested this would “hold back American innovation at a critical juncture” as the firm and its counterparts contend with rising competition from overseas developers.

At the trial, Dahlquist argued that the court's remedy should actively consider AI, saying Perplexity AI and OpenAI will both testify about the impact of Google's industry dominance on their own businesses.

"This court's remedy should be forward-looking and not ignore what is on the horizon," Dahlquist said.

MORE FROM ITPRO

• Google layoffs continue with "hundreds" cut from Chrome, Android, and Pixel teams
• Google DeepMind’s Demis Hassabis says AI isn’t a ‘silver bullet’
• Google Cloud announces UK data residency for agentic AI services

Google faces a "first of its kind" £5 billion lawsuit in the UK over accusations it has a monopoly in digital advertising that allows it to overcharge customers.

The suit was brought via law firm Geradin Partners but led by Or Brook, an associate professor of competition law at the University of Leeds, and filed at the UK Competition Appeal Tribunal on behalf of all affected UK businesses.

Google is accused of forcing mobile phone makers and network operators to preinstall Google's Search and Chrome on Android devices, as well as paying Apple billions of pounds to make Google Search the default on its Safari browser.

Those tactics, the suit alleges, solidified Google's default position and allowed the company to drive up prices for search advertising, costing its customers.

"Today, UK businesses and organizations, big or small, have almost no choice but to use Google ads to advertise their products and services," said Brook in a statement.

"Regulators around the world have described Google as a monopoly and securing a spot on Google’s top pages is essential for visibility."

Last year in the US, a judge ruled that Google had a monopoly in search, with the Department of Justice considering breaking up the wider company. In 2018, Google was fined €4.3 billion for abusing the dominance of the Android OS by requiring mobile makers to install Chrome and Search.

Similarly, earlier this year the UK's Competition and Market Authority launched an investigation into Google's search market share, noting that it holds 90% of all search queries.

In a LinkedIn post, Brooks said the lawsuit was unique because it sought to represent businesses, rather than individuals.

"We have now filed the first collective action of its kind in the UK that seeks redress for the direct harm caused to businesses (rather than consumers) who have been forced to pay sub-competitive prices for advertising space on Google pages," she wrote.

Google is contesting the claims

A Google spokesperson dismissed the case, said the company would fight the allegations, and that customers weren't forced to use Google advertising.

"This is yet another speculative and opportunistic case and we will argue against it vigorously," the Google spokesperson told The Guardian. "Consumers and advertisers use Google because it is helpful, not because there are no alternatives."

ITPro approached Google for comment, but had received no response at time of publication.

Suit claims Google is driving up prices

Brook said Google made use of its monopoly to raise prices due to lack of competition, noting that Google made £14 billion from search advertising in the UK alone last year.

"Google has been leveraging its dominance in the general search and search advertising market to overcharge advertisers," Brook added. "This class action is about holding Google accountable for its unlawful practices and seeking compensation on behalf of UK advertisers who have been overcharged.

Beyond ensuring Search was the default on mobile devices, the lawsuit alleges that Google's Search Engine Management Platform had better access to advertising than rivals.

The action seeks compensation for overcharges from 2011 to 2015, which is estimated to be in the region of £5 billion. Any payouts would depend on the settlement if the case is won, and calculated based on how much a company spent during the time period. The case is expected to take up to three years.

Companies that advertised via Google search in the indicated time frame will be automatically included in the class action, though they can choose to opt-out.

MORE FROM ITPRO

• Google settles $5 billion privacy lawsuit ahead of cookie phase-out
• DoJ mulls potential Google services breakup in monopoly lawsuit
• Google forced to delete billions of incognito browsing records after privacy controversy

UK organizations are pulling ahead of EU competitors in implementing AI, new research suggests, and a key factor lies in their confidence about regulatory compliance.

Almost a quarter of UK CEOs told AI firm Daikatu they have a formal roadmap for AI implementation over the next year, double the global average and nearly five times as many as in Germany.

And while four-in-ten CEOs in France and a third in Germany said they'd cancelled an AI project due to regulatory uncertainty, only one-in-five UK CEOs said the same.

Florian Douetteau, CEO and co-founder of Dataiku, said the contrasting regulatory landscapes on both sides of the English Channel are enabling British firms to capitalize on the AI ‘boom’.

"The market research in our report suggests reduced regulatory uncertainty is giving UK businesses the clarity to act — accelerating innovation and adoption, even as AI evolves at a relentless pace," Douetteau said.

"Working with our enterprise customers, we have seen first-hand that when CEOs have confidence in compliance and control over governance, they can move faster, scale smarter, and fully capitalize on AI’s potential."

Hesitation over AI regulation is a global issue, the study noted, with eight-in-ten CEOs concerned that the EU AI Act could slow adoption in their organizations.

The Act brings with it a common regulatory and legal framework for AI, and is aimed at ensuring AI development and deployment in the EU is carried out responsibly.

However, there's been plenty of room for confusion and uncertainty, with the latest draft of the General-Purpose AI Code of Practice published only recently, and potentially set for more changes before it comes into force in May.

"The EU AI Act has raised more questions than it answered, and in the process has seen businesses within its jurisdiction become increasingly cautious with their AI programmes," said Jacob Beswick, senior director of AI governance at Dataiku and former UK assistant director for AI adoption and regulation.

"Heavier regulations in the EU mean there are more restrictions on what you can and cannot operationalize and put on the market than in the UK, in turn arguably making the UK an attractive market for AI innovators."

Firms still conscious of AI governance

CEOs acknowledged that while AI is a critical competitive differentiator, their organizations often lack the governance, planning, and oversight needed to carry projects out successfully.

While eight-in-ten CEOs globally said they were confident in their company’s AI governance framework, or their ability to set rules around data access and privacy, only a third of these described themselves as extremely confident.

Overall, more than a third of CEOs said their AI projects had been delayed due to regulatory uncertainty, with 32% having canceled or abandoned them altogether.

However, Beswick noted that while regulatory considerations may slow down AI implementation, those without stricter guidelines must ensure they are creating AI products “with risk awareness in mind, as opposed to simply doing so because they can”.

MORE FROM ITPRO

• Regulatory uncertainty is holding back AI adoption
• A quarter of firms still don't have a formal AI strategy
• Only a handful of generative AI projects make it into production

The UK's Competition and Markets Authority (CMA) has dropped its probe into the partnership between Microsoft and OpenAI, saying the deal doesn't give Microsoft a controlling interest over the AI firm.

The competition regulator said that despite Microsoft's heavy investment in OpenAI and its exclusive deals for some products, the tech giant has only a 'material influence' over OpenAI, meaning that the tie-up doesn't meet the threshold for a full enquiry.

"Looking at the evidence in the round (including the recent changes), we have found that there has not been a change of control by Microsoft from material influence to de facto control over OpenAI," said Joel Bamford, executive director of the CMA, in a LinkedIn post.

"Because this change of control has not happened, the partnership in its current form does not qualify for review under the UK’s merger control regime."

However, he warned the decision is just a question of jurisdiction, and should not be read as the partnership being given a clean bill of health on potential competition concerns.

What concerned regulators?

The investigation examined a deal signed between the two companies in 2019, which saw Microsoft invest an initial $10 billion in OpenAI, with another $3 billion following.

But it was four years later that the CMA opened its investigation after Sam Altman was first sacked and then reinstated as OpenAI’s chief executive.

"In view of Microsoft's potentially important role in securing Sam Altman's re-appointment, the CMA believed there was a reasonable chance that an investigation would reveal that Microsoft had increased its control over OpenAI's commercial policy," the CMA said at the time.

This new decision is based partly on the shifts in the relationship between the two firms that have taken place over the last few years. In January, for example, Microsoft announced a change to its contractual rights in relation to supply of compute capacity, which reduced OpenAI’s reliance on Microsoft.

The CMA has faced criticism for the time it's taken to reach its conclusions - probes into other partnerships in the AI sector have taken just a matter of months.

"We are not blind to the length of time that this investigation has taken – particularly given the reforms we have launched recently which will considerably speed up and streamline the UK mergers process. We know pace matters to business confidence and investment," said Bamford.

However, Bamford added that simply hasn't been possible in this case.

"A combination of the degree of complexity, the changing nature of the arrangements and how they operate in practice, and the mutual desire for open dialogue between the CMA and the companies to ensure we understood these developments over time, has led to an exceptionally extended period of review," he said.

MORE FROM ITPRO

• Satya Nadella says Microsoft and OpenAI have a “pro-competition partnership"
• OpenAI and Microsoft's regulatory probes explained
• Microsoft is open to using a range of AI models in 365 Copilot, but OpenAI remains its go-to choice

The uncertainty around the impact of tariffs is stark right now, with those in the tech sector far from alone in wondering how they might be affected by sweeping taxes on imports.

First on the campaign trail and now in office, the Trump administration has repeatedly sung the praises of tariffs and, at time of publication, is in the process of levying 25% tariffs on imports from Canada and Mexico – the US’ largest trading partners. China is also facing a combined 20% rate, with President Trump having promised 25% tariffs on Europe in the immediate future.

While no one can predict the exact effects of these tariffs, the broad implications are a significant topic of discussion for the IT and broader tech industry. Steve Hall, chief AI officer at consultancy company ISG and president of its EMEA operations, has been producing the company’s index for a decade. Its Q4 2024 analysis projected that US tariffs would play a marked role in the sector’s overall growth rate.

“First of all, I think there's a general belief that the tariffs are going to increase inflation. Fed's [US Federal Reserve] going to fight inflation, so it' likely means that they're not going to be able to have the room that they need to do to lower the interest rates,” Hall tells ITPro, “So when that happens, as we've seen over the last couple years, large enterprises really pull back on discretionary spending.”

Hall says that the discretionary spending likely to be axed by companies, should the pain of tariffs be severe, could include budgets for digital transformation projects, with companies opting instead to focus on cost optimization opportunities. That doesn’t mean he expects all areas of the industry to contract, with the growth of the behemoth software as a service (SaaS) and hyperscale spending expected to continue, in large part due to the continued expansion of AI products and services. Companies that are focused on digital services are less likely to feel the full weight of tariffs as digital trade is, traditionally, not subject to the same types of customs measures.

Martin Balaam, the CEO and founder of SaaS product information and digital asset management firm Pimberly, says that though the vast majority of business expenses for companies like his are tied up in intellectual property and the human power to produce it, there are still aspects of the market place where IT companies can play a role in the mitigation of tariffs. He finds this particularly true when it comes to helping clients with supply chain oversight in all areas of the world, as Pimberly works to expand its market in the US.

“There are limited things that we can do, other than enable our customers to have more visibility in terms of where their products come from and which countries potentially are at a higher risk of some of these things actually happening to them.”

Balaam says that this keen eye on process has been ongoing since the first wave of the COVID-19 pandemic, with companies contemplating near shoring production to mitigate the supply chain crisis. But there is still concern across sectors that, despite the expressed hopes of the Trump administration, there just isn’t the ability to scale US production capabilities at the speed needed to entirely shield the domestic economy.

Balaam does see opportunities for innovation, particularly when it comes to a large disruption, like a tariff’s tendency to dislodge complacency amongst key company decision makers. One example given was the additional cost of computing power that could come from broad tariffs.

Still, Hall doesn’t see US manufacturing accelerating at the speed that tariff evangelists hope it will. This is of particular concern for those interested in tech innovation, with much of the materials required being way off shore. For example semiconductors, used in a vast number of modern devices, are largely imported from Taiwan and Taiwan Semiconductor Manufacturing Company (TSMC) produces 90% of the most advanced chips in the world, per The Economist.

In a speech to House Republicans on January 27, President Trump threatened to levy tariffs as high as 100% against Taiwan to spur further investment in US chip fabrication. Hall doubts whether the US can compete with Taiwan in the immediate future.

“It’s going to take years before the US has the chip manufacturing capability that comes out of Taiwan right now, and most of that is co[-produced].” Hall says, adding that US firms including Apple and Intel have a supply chain heavily integrated with Taiwan, which can make it hard to pinpoint the exact impact and severity of tariffs.

Nvidia, which has become one of the most valuable companies in the world off the back of record demand for its graphics processing units (GPUs) for generative AI training and inferencing, is highly reliant on manufacturing plants in Taiwan. On 3 March, its stock fell 9% against a backdrop of confirmed Mexico-Canada tariffs by the Trump administration.

Despite the general gloom over current prospects of American economic policy, Paul F. Magel, the president of the application solutions group at Computer Generated Solutions, suggests that the current administration is “saber-rattling” and that its motives and their eventual downstream consequences still aren’t entirely clear.

“From a Trump standpoint, he's utilizing, certainly, the size of the US market and the threat of tariffs to drive other initiatives that he's trying to accomplish,” Magel tells ITPro. Some early responses to tariffs may already be visible. Amid reports that the tariffs will be going ahead, TSMC announced a $100 billion investment in new US fabricating plants.

Magel counts himself amongst the portion of the sector who see technology as part of an effective tariff response as the US tries to bring more manufacturing home.

“Depending on the industry and the marketplace, we don't necessarily have the labor force anymore to bring all of the manufacturing back that we had 100 years ago or 50 years ago,” he tells ITPro. “So, some of that has to be balanced out. That's where things like… AI robotics automation will take place. There's this labour component in manufacturing that you've got to make sure is not going to be a constraint if you start bringing it back to the United States of America.”

The current landscape is incredibly hard to transparently assess. What will be key, according to those in the broader IT and tech industry, is the ability of tech companies to use technology to further streamline their processes and for their providers’ ability to respond to current market needs. The world’s supply chains have become more and more integrated over many decades – some trace Canada’s integral connection to the US market as far back as the great depression, for example – and that detangling does not, and cannot, happen overnight.

Ofcom has spelled out how it intends to use its powers under the Online Safety Act – and it plans to take a tougher stance with big tech.

The Online Safety Act applies to search firms and services that allow users to post content online or to interact with each other - everything from social media and consumer cloud storage and sharing sites to online forums and dating services.

It gives them new duties to put systems and processes in place to reduce the risk that their services are used for illegal activity, and to take down illegal content when it does appear.

Under the Act, Ofcom has the legal power to access information held by regulated companies and third parties, and said it will carefully scrutinize how effective tech firms’ safety measures are.

It will also demand data where it has specific concerns that the rules aren’t being followed.

This could include the power to remotely inspect how a platform’s algorithm works in real time, and the regulator said it will hold organizations to account over what they recommend to users, particularly children.

"As well as requesting information and data, we are also able to carry out an audit of a tech firm’s safety measures and features," said Ofcom.

"In exceptional cases, we can enter the UK premises of tech companies to access information they hold and examine their equipment."

It may do this in order to assess whether a provider is complying with the rules, or, if it isn't, to assess the nature and level of risk.

Ofcom eyes flexibility with new guidance

Ofcom said in the new guidance that it will try to be flexible, and that when deciding whether to disclose information it will carefully balance the need against any concerns or objections.

However, if tech firms fail to comply with a request for information in an accurate, complete, and timely way, there will be consequences - some very serious - Ofcom warned.

They could, for example, face fines of up to £18 million or 10% of their worldwide revenue, whichever is higher.

In the most extreme cases, there could be criminal liability for individual executives for breaches such as knowingly or recklessly providing false information, failing to provide information, or failing to take all reasonable steps to prevent other information offences.

Last year, Ofcom fined TikTok under separate rules governing video-sharing platforms, for failing to respond to a request for information about its parental controls.

Meanwhile it's currently investigating OnlyFans' compliance with the Act, through a request for information.

What to expect from the Ofcom rules

The new guidance is effective immediately. The act applies to sites and apps that publish user-made content to other users, as well as large search engines – covering more than 100,000 online services.

Under the act, firms will be required to nominate a senior executive to be accountable for compliance; have properly staffed and funded moderation teams that can swiftly remove illegal material, and implement robust testing of algorithms – which curate what users see on their feeds – to make it harder for illegal material to spread.

Similarly, organizations will be obligated to remove accounts operated by - or behalf of - terrorist groups.

Tech platforms are also expected to operate “easy to find” tools for making content complaints which acknowledge receiving a complaint and indicate when it will be dealt with.

The biggest platforms are expected to give users options to block and mute other accounts on the platform, along with the option to disable comments.

MORE FROM ITPRO

• Everything you need to know about Ofcom's cloud competition probe
• How the Online Safety Act affects end-to-end encryption
• Ofcom is being thrown under the bus with the Online Safety Act

Earlier this month reports emerged that the UK government issued an order to Apple to give it access to users’ encrypted data, reigniting the debate around digital privacy.

The issue centered around Apple’s Advanced Data Protection (ADP) tool, which is a feature that uses end-to-end encryption to ensure only users that are signed in on a trusted device can view their personal files, excluding even Apple from accessing the data.

The order issued by the government, which will not be published, would have required Apple to give authorities a backdoor through which it could access the encrypted data for UK users. Apple has consistently reiterated that it opposes creating any backdoors for its encryption because it defeats the entire purpose of encryption – so it opted to simply turn off ADP in the UK, meaning that not all customer data stored via iCloud will be fully encrypted.

I believe the UK government’s decision is a total travesty, both from the perspective of global privacy and cybersecurity, as well as its ability to compete in the global tech industry.

Firstly, from a consumer rights perspective this is an unquestionable loss. Though the government maintains that encryption backdoors are important for combatting crime this logic totally misses the myriad ways in which encryption protects citizens.

Modern cryptography techniques have been a huge leap forward in terms of protecting people’s private data. Encryption means you can access your bank account from your phone securely, or view medical records online without worrying about cyber criminals intercepting your communications.

The bottom line is that in the internet age encryption is vital for almost all digital services and the continued attempts by governments to ensure they have a master key not only violates privacy, but undermines the overall security of the internet.

UK demands could set privacy and security back decades

What the government fails to understand is that compromising the integrity of end-to-end encryption will introduce a raft of new harms for individuals and businesses alike.

As previously stated, introducing a backdoor to break encryption defeats the purpose of the entire exercise and gives malicious actors an easy target for compromising the most sensitive data.

The UK government has made similar attempts at circumventing encryption layers used by private companies in the past as noted in a 2015 paper published in the Journal of Cybersecurity looking at the security implications of requiring ‘exceptional access’ to information systems.

In the paper, researchers perfectly laid out why government efforts to access information would hinge on developers coming up with designs that minimized the impact of breaches, but that this is “unworkable in practice” and would set the global cybersecurity community back decades.

“The complexity of today’s Internet environment, with millions of apps and globally connected services, means that new law enforcement requirements are likely to introduce unanticipated, hard to detect security flaws,” the researchers wrote.

The UK government is setting a dangerous precedent by insisting its agencies be given a backdoor to private companies’ encryption systems. It frequently lambasts other governments such as China for privacy violations, but the latter still allows Apple’s ADP technology in the region.

I’m far from alone in my feelings of disappointment in the government for pushing ahead with its decision. Experts from across the tech sector have argued that undermining encryption is unacceptable.

In an unpublished letter shared on X, Meredith Whittaker, president of the Signal Foundation, which has warned it may have to quit the UK if it continues to undermineend–to-end encryption, wrote that the move puts sensitive information belonging to UK businesses and citizens at “grave risk from malicious actors”.

“Technically illiterate” request risks harming UK’s tech ambitions

The current government follows the last in citing its ambition for the UK to become a global tech hub and unlock AI opportunities. But by taking actions like this, it is seriously shooting itself in the foot.

Legal experts such as Will Richmond-Coggan, a partner specializing in cybersecurity and privacy disputes at Freeths LLP, said Apple’s decision to turn off ADP could have a domino effect on other major tech companies, warning “the UK may no longer be seen as a safe destination for personal data”.

“If that in turn results in the UK losing its adequacy status with the EU, every company doing business in Europe will be subject to additional costly compliance obligations, hampering the government's plans for growth, and a closer European political relationship.”

Whittaker described the move as “technically illiterate” restating that Signal would sooner stop operating in the UK than compromise its encryption.

“The UK's technically illiterate demand also undermines its ambitions to become a tech hub. You can’t be tech friendly while eroding the foundation of cybersecurity on which robust tech depends. Encryption is not a luxury – it is a fundamental human right essential to a free society that also happens to underpin the global economy,” she argued.

This furore all started with the UK government taking exception to an optional feature that the majority of users don’t have turned on – making a mountain of a molehill – but it could have major consequences.

The government should roll this back, and quickly, if it wants to send the right signals to global business and regain any credibility it has on discussions on privacy and cybersecurity.

The Advanced Research and Invention Agency (ARIA) is a UK-based research and development funding agency established to catalyze transformative scientific and technological breakthroughs.

The success of the UK's COVID response – exemplified by initiatives like the Vaccines Taskforce and Rapid Response Funds – has highlighted the importance of agile funding models. ARIA seeks to apply these lessons, operating as a flexible, independent body dedicated to high-risk, high-reward projects.

First announced in February 2021 and backed by a government investment of £800 million, the organization was inspired by the principles of the US Advanced Research Projects Agency (ARPA), now known as Defense Advanced Research Projects Agency (DARPA).

Since the 1950s, DARPA has been instrumental in funding transformative technological advancements, including developing the Internet (ARPANET), GPS technology, and early voice recognition systems. Other countries, such as Japan and Germany, have since established similar bodies, such as Japan's Moonshot R&D and Germany's SPRIN-D.

Funding and project support

Traditional research funding in the UK has often been characterized by cautious investment strategies, prioritizing projects with predictable outcomes. ARIA seeks to disrupt this paradigm by providing the autonomy and resources necessary for researchers to pursue bold ideas without the constraints of conventional funding mechanisms.

Overall, ARIA operates with a budget of £800 million allocated over five years, from 2023 to 2028. The UK government provides this funding through the Department for Science, Innovation and Technology (DSIT). As an independent agency, ARIA can allocate these funds toward projects that align with its mission of unlocking significant scientific and technological advancements. This financial structure is designed to provide ARIA with the agility to respond swiftly to emerging opportunities and support projects that may not fit the traditional funding frameworks.

"Our funding terms are designed to encourage inventor-led startups and stimulate science entrepreneurship in the UK," comments Antonia Jenkinson, chief finance and operating officer on the ARIA website.

The following core principles define ARIA’s approach:

• High-risk, high-reward research focus: ARIA exclusively supports projects that have the potential to create paradigm shifts in science and technology. While many funded projects may not succeed, those that do could profoundly impact society.
• Strategic and scientific autonomy: ARIA operates independently in selecting research programs, funding allocation, and institutional culture. Programme Directors have full discretion over the projects they support, with minimal government intervention.
• Empowering talented individuals: ARIA provides exceptional researchers and innovators the freedom to pursue their boldest ideas. Program directors are appointed based on their expertise and vision, allowing them to direct funding dynamically.
• Financial flexibility and operational freedom: ARIA is structured to minimize bureaucratic constraints and maximize efficiency. To encourage disruptive innovation, it employs various innovative funding mechanisms, including seed grants, equity stakes, and prize-based incentives.

The agency operates through two primary funding modes: programs and opportunity seeds. Programs are large-scale initiatives to advance complex ideas requiring coordinated investment across multiple disciplines and institutions, totalling between £50-80 million ($63-101 million). Program directors manage a portfolio of projects within these programs to drive significant breakthroughs.

Opportunity seeds of up to £500,000 ($631,700) support individual research teams exploring novel pathways that could inspire future programmes or evolve into standalone projects. This approach allows ARIA to fund diverse ideas and rapidly test their potential.

The agency does not retain intellectual property rights to the work it funds and generally does not require match funding. ARIA also does not take equity stakes in spinouts commercializing ARIA-funded IP. This approach is designed to encourage inventor-led UK startups and stimulate science entrepreneurship in the UK.

ARIA has identified several "opportunity spaces"—critically important but underexplored research areas ripe for breakthroughs. Each opportunity space is a foundation for multi-year programmes directed by the agency's Programme Directors. Notable opportunity spaces include:

• Mathematics for safe AI: This program aims to develop technical solutions to ensure that powerful AI systems interact as intended with real-world systems and populations. It combines scientific models and mathematical proofs to achieve ethical AI that can transform the tech sector while preventing user harm.
• Nature computes better: This research explores redefining how computers process information by exploiting natural principles, potentially leading to dramatically more efficient computing systems.
• Smarter robot bodies: Focusing on creating robots capable of operating independently in complex and dynamic environments, this program aims to develop smarter robotic systems to reduce the burden of physical labour.
• Scalable neural interfaces: This area focuses on developing minimally invasive technologies to interface with the human brain at scale, aiming to transform our understanding and treatment of neurological and neuropsychiatric disorders.
• Programmable plants: By programming plants, this initiative seeks to address challenges like food insecurity, climate change, and environmental degradation, ensuring a sustainable biosphere for future generations.

Through these initiatives, ARIA actively funds projects that challenge existing assumptions, open new research paths, and strive toward transformative capabilities. The agency's commitment to high-risk, high-reward research is designed to position the UK as a leader in scientific and technological innovation, with the potential to generate significant social and economic benefits.

Key ARIA personnel and relationships with public sector

ARIA's leadership comprises individuals with diverse science, technology, and innovation expertise. Ilan Gur serves as the CEO at ARIA, bringing a wealth of experience from his previous roles, including his tenure as a Program Director at ARPA-E and as the founder of Activate, an organization supporting early-stage scientists in transforming research into viable products and businesses.

Antonia Jenkinson, chief finance and operating officer at ARIA, supports Gur and oversees ARIA's financial and operational functions. The agency's strategic direction is further guided by its board, which includes notable figures such as the entrepreneur and government advisor Matt Clifford, who oversaw the UK’s recently-published AI Opportunities Action Plan, as well as Nobel laureate David MacMillan and Kate Bingham, the former head of the UK’s Vaccine Taskforce.

Its advisors also include Demis Hassabis, the co-founder and CEO of Google DeepMind. ARIA states that its board and advisors allow it to ground its high-risk, high-reward scientific exploration in diverse perspectives and expert-led governance.

ARIA operates as an independent public body under the Department for Business, Energy & Industrial Strategy (BEIS) sponsorship. While it has significant autonomy, the agency remains subject to national security oversight and financial transparency requirements, including an annual audit by the National Audit Office.

Unlike UK Research and Innovation (UKRI), which manages a broad research funding portfolio across multiple disciplines, ARIA focuses on a narrower range of projects. However, both agencies must collaborate to ensure alignment in the UK's research ecosystem. ARIA's distinct model allows it to take risks that traditional funding mechanisms cannot, complementing UKRI’s more structured approach.

Future development

ARIA represents a bold new approach to research funding in the UK, drawing inspiration from the world’s most successful innovation agencies. By embracing risk, minimizing bureaucracy, and providing top researchers with unprecedented autonomy, ARIA aims to unlock breakthrough discoveries that will shape the future of science, technology, and industry.

With an initial investment of £800 million and a leadership team committed to transformative research, ARIA has the potential to cement the UK’s status as a science superpower and drive economic growth through pioneering technological advancements.

In a world where technological advancements are accelerating, ARIA's establishment reflects a strategic commitment to ensuring that the UK remains at the cutting edge of scientific discovery and innovation. By empowering researchers to pursue visionary projects, ARIA hopes to deliver breakthroughs that could have profound and lasting impacts on not just the tech sector but wider society.

The Data Use and Access Bill is a piece of legislation introduced by the UK government to allow for a greater level of data sharing and data exchange within both public and private sector organizations.

Introduced to parliament towards the end of 2024, the government says this bill could save millions of hours for many public sector workers as well as add an estimated £10 billion to the UK economy over a period of 10 years. The bill can be divided into seven sections according to the government, with the first centered on the enablement of “smart data” use outside the finance sector.

It would regulate the provision of digital verification services, digitalize birth and death registrations, make changes to the UK’s data protection regime, and transfer the function of the Information Commissioner’s Office (ICO) to a new Information Commission.

The bill would also make further provisions about the use of or access to data in areas such as health and social care, smart meter communication services, public service delivery, and online safety.

"With laws that help us to use data securely and effectively, this Bill will help us boost the UK’s economy, free up vital time for our front-line workers, and relieve people from unnecessary admin so that they can get on with their lives," technology secretary Peter Kyle said at the time of the bill’s announcement.

Experts from the tech sector have broadly welcomed the legislation, commending its focus on improving efficiency. Alex Laurie, senior vice president at Ping Identity, said that any legislation of this kind is a positive step.

“From my perspective, anything that makes it easier for us to do business as a citizen is massively important,” Laurie tells ITPro. “If it takes time out of people's working day I think it's an important thing.”

How will the Data Use and Access Bill affect the public sector?

This legislation has the public sector at its core, with many of the bill’s benefits noted by the government relating to heightening efficiencies in the UK’s police force or the National Health Service (NHS).

Within the NHS, for example, administrative processes can be very lengthy and time consuming, having a negative impact on the organization and the customer. Laurie expressed his own understanding of this, referring to a study his firm undertook regarding disabled parking permits.

“We did an analysis a few years ago on how many agencies and individual units were involved in getting a blue badge for someone, and it was like 35 different steps, which all needed identification, verification, proof,” Laurie says.

This bill will likely hone in on a set concept of data portability, Laurie adds, which is an important step forward in speeding up these sorts of processes. Lauren Wills-Dixon, solicitor at Gordons, tells ITPro the bill will also lay out a more coherent, straightforward idea of what data can be used and for what purposes.

“The bill introduces this concept of recognized legitimate interest to give organizations certainty,” she says.

Wills-Dixon explains that it will recognize several legitimate interests including national security processing, emergency response, and safeguarding efforts.

It will also cut red tape in the public sector, according to Richard Fayers, data and analytics practice lead at Slalom, reducing the lengths that workers have to go to in recording personal data use.

How will the Data Use and Access Bill affect the private sector?

While there’s a huge opportunity in the public sector space, Fayers is keen to point out how elements of the bill – such as the smart data schemes – will likely drive innovation across the private sector landscape.

For example, he suggests the bill could introduce a greater level of openness for UK businesses and turn attention towards open standards akin to what has been seen in the finance sector with open banking. Fayers sees massive opportunities across sectors by building on this interoperability of data.

There may also be better forecasting of public demand through a pooling of company information, Fayers adds, as well as the potential for businesses to share data to offer collaborative schemes or experiences to customers. Businesses could then give customers a unified profile that works from company to company.

Bill Wright, global head of government affairs at Elastic, echoes some of these predictions for potential advantages to the private sector. The bill will allow firms in every sector to access and analyze consumer data more effectively, Wright tells ITPro.

“Simplifying the data sharing rules are going to, maybe, break down some of those silos between industries and create some opportunities for startups to compete with some of the more established players,” Wright says.

It may even increase foreign investment into the UK, Wright says finally, by showing those outside the UK that the country has a data processing environment both predictable and innovative.

What do IT leaders need to know about compliance?

As with any new piece of legislation, the data use and access bill will require some degree of reorganization from firms when it comes to ensuring compliance. That being said, Wills-Dixon predicts companies that are already compliant with GDPR don't face serious challenges to becoming compliant with the Data Use and Access Bill.

“If you're carrying out research, statistical use of data, or processing in the public interest and things like that, then it will help, but for most commercial organizations, your obligations are going to be very similar as drafted,” Wills-Dixon adds.

That said, Fayers warns the new Information Commission will have enhanced enforcement powers and businesses will also need to ensure they can demonstrate robust security and data governance. This will demand a greater focus on compliance certification and accountability frameworks, Fayers says.

“If you're seen to be transparent – if you're providing customers with assurance and visibility of how you're managing this risk as well – that could also be seen as a benefit, whilst there's a cost,” Fayers concludes.

MORE FROM ITPRO

• What is chaos engineering and how can it benefit businesses?
• What is quiet firing?
• Why magic links should be the default password replacement

Years after first identifying the potential risks of AI systems, world leaders are having to balance concerns with an acknowledgment of the gains achievable through certain AI systems and nowhere is this more true than the EU.

The Artificial Intelligence Action Summit in Paris has seen a number of high-profile announcements made on EU AI investments, on both a continental and regional basis. But it’s also highlighted the distance the EU has yet to go for true international AI competition – up against the likes of the US and China, can it continue to stand out?

In this episode, Jane and Rory welcome Nader Henein, Gartner VP analyst, Data Protection and AI Governance, to discuss the finer details of EU AI and how public-private partnerships balance with its strong legal requirements for the technology.

Highlights

"There's a fair bit of AI development having happening at the sectoral level in pharmaceutical development, for example, there's a lot have there's a lot happening in medicine. So there's a lot happening. It might not be as newsworthy as something like Mistral or it might not be a unicorn worth multiple billions of dollars or euros, I should say. But there's a lot happening in Europe, from an AI perspective."

"I need to reach, pick up the phone and speak to the vendor, because there's not a piece of software that can scan my SaaS solution and tell me that, 'Oh, this SaaS solution you're using, the CRM and the cloud that you're using, it has 26 AI-enabled features, of which six are high risk. So you better pay attention to those and get a bit more detail'. Nothing's going to do that for you. You have to pick up the phone and speak to the vendor."

"And Ursula [von der Leyen] said – it was very nuanced yesterday – she made a comment, a throwaway comment in her speech, that you have 27 countries with one piece of legislation, one set of rules. And the fact of the matter is, for any business and for any outsider looking in, the US is going to be one country with 50 different laws. Even if the federal government gets out of the way. In fact, the federal government federal government had introduced AI regulation from the very beginning, there's a good chance that most states would have said that's what I'm going to follow."

Footnotes

• UK and US reject Paris AI summit agreement as “Atlantic rift” on regulation grows
• Unraveling the EU AI Act
• The EU just shelved its AI liability directive
• A big enforcement deadline for the EU AI Act just passed – here's what you need to know
• Looking to use DeepSeek R1 in the EU? This new study shows it’s missing key criteria to comply with the EU AI Act
• How the EU AI Act compares to other international regulatory approaches
• UK regions invited to apply for ‘AI Growth Zone’ status

Subscribe

• Subscribe to The ITPro Podcast on Apple Podcasts
• Subscribe to The ITPro Podcast on Spotify
• Subscribe to the ITPro newsletter
• Subscribe to the ITPro Podcast on YouTube
• Join us on LinkedIn

Former Google CEO Eric Schmidt has hit out at EU AI regulation, suggesting overburdening rules put European companies at an inherent disadvantage compared to global counterparts.

Speaking on the BBC Radio 4Today program, Schmidt said a combination of factors are hampering AI innovation in the region, including restrictive regulation and the natural “structure” of European markets.

Reflecting on his time at Google, Schmidt said he worked for “at least 10 years to try to get Europe up to the bar”, noting that lucrative talent pools on both the continent and in the UK give enterprises a prime opportunity to compete.

Regulatory barriers, however, are preventing the region from making any headway in the global AI race.

“The system doesn't work, right? They can't build big enough companies. The markets are not integrated. Partly it's just the structure of Europe, but it’s also that Brussels, in addition to promising uniform markets, also regulates in a particularly strong way,” he said.

“The result of this is that the AI revolution, which is the most important revolution in my opinion since electricity, is not going to be invented in Europe, and that's to Europe's disservice,” Schmidt added.

“Europe could do it, but it's chosen not to do it, and I'm really quite brutal on this.”

Fair game in the US AI market

The situation is quite different across the Atlantic, Schmidt noted. The US’ approach to AI development stands in stark contrast to the European market, with lawmakers and enterprises alike engaged in a rabid race to the top.

With the Trump administration now in place in Washington DC, Schmidt pointed to a sense of burgeoning optimism among leading enterprises in the AI space, many of whom have invested billions of dollars thus far and intend to ramp up spending in the year ahead.

So far this year, Meta, AWS, Microsoft, and Google have all outlined plans to accelerate capital expenditure – and a key factor in this will be expanding AI infrastructure. Meta, for example, expected to spend upwards of $60 billion this year, marking a significant increase from $39 billion in 2024.

“When I looked at the swearing in with my friends behind the president I thought, ‘wow, we have arrived’ - and that doesn’t necessarily mean that we are going to be unregulated,” he said.

“It means the inverse in my view,” he added. “Everyone, starting with you, are watching what we're doing, which I view as a good thing.”

This doesn’t mean that the US will pursue a ‘Wild West’ approach to AI development, however. Instead, providing enterprises the regulatory flexibility to develop AI models and adopting a gentler approach is the ideal situation.

“The truth is that AI and the future is largely going to be built by private companies,” Schmidt said.

“It has to do with the incentives and the money, where the talent is, and how the world works, they're not going to be built in the equivalent of a Manhattan Project.”

Schmidt noted that it’s “really important that governments understand what we’re doing and keep their eye on us”.

“We’re not arguing that we should unilaterally be able to do things without oversight,” he added.

Schmidt has been highly vocal on the potential dangers posed by unchecked AI development in recent months, warning that systems could be used by bad actors for nefarious purposes ranging from biological warfare to cyber crime.

Britain has an opportunity to differentiate itself

While discussions over the potential barriers to AI innovation in Europe continue, Schmidt did point to the UK’s opportunity, suggesting it can differentiate itself from European counterparts.

The UK joined the US in refusing to sign an international agreement on sustainable AI development at this week’s global summit in Paris, prompting suggestions an ‘Atlantic rift’ is opening up on the topic of AI.

This decision was based on concerns that the declaration lacked 'practical clarity', officials said, particularly on the issue of global governance and national security.

The UK’s approach to AI has deviated from that in Europe, and the current government has made clear it hopes to position itself as a global leader on this front by attracting international investment and building out infrastructure.

Notably, Schmidt said the UK has success stories to champion that will stand it in good stead.

“So some credit to Britain,” he said. “Much of the path to general intelligence was pioneered in King’s Cross in a building occupied by a subsidiary of Google called DeepMind by - now a Nobel Prize winner - Demis Hassabis.”

“What they have done is so extraordinary it should be a point of national pride,” Schmidt added. “It may be the most important thing that Britain has done in the last five years, in my opinion.”

Schmidt further hailed the government’s apparent pursuit US-style regulation, which involves consultation and close collaborative ties with industry.

“It looks to me like the pairing of the US and the UK is a winning strategy,” he said. “And it looks to me like the Europeans, because of Brussels, are being held behind.”

MORE FROM ITPRO

• Salesforce thinks the UK is ready to lead the next wave of AI
• Why the UK needs to look inward on AI legislation
• Google says UK needs policy step change to embrace its AI potential

The European Commission has shelved plans to impose civil liability rules on enterprises using harmful AI systems in a move critics have described as a “strategic mistake”.

First proposed in 2022, the AI Liability Directive aimed to overhaul existing rules on harmful AI systems and protect consumers.

However, the publication of the Commission’s final work program shows plans to introduce the rules will now be scrapped, noting that “no foreseeable agreement” has been reached by lawmakers.

The documents add that the Commission will “assess whether another proposal should be tabled or another type of approach should be chosen”.

The move comes in the wake of the AI Action Summit, held in Paris, which saw industry stakeholders come together to discuss the future of AI innovation both across the European Union (EU) and globally.

During the summit, US vice president JD Vance voiced concerns over the EU’s supposed heavy handed regulatory approach to the technology. Vance urged European enterprises and lawmakers to view the “new frontier of AI with optimism and not trepidation”.

“We want to embark on the AI revolution before us with the spirit of openness and collaboration, but to create that kind of trust we need international regulatory regimes that foster creation," he told attendees.

The liability directive was originally tabled alongside the EU AI Act, but has since taken a backseat amid the push to impose the landmark legislation.

Some EU lawmakers have voiced their disapproval,. According to reports from Euronews, Axel Voss, the EU Parliament’s lead representative for developing liability rules, described the move as a “strategic mistake”.

Voss told the publication the decision will lead to “legal uncertainty, corporate power imbalances, and a Wild West approach to AI liability that only benefits big tech”.

"The reality now is that AI liability will be dictated by a fragmented patchwork of 27 different national legal systems, suffocating European AI startups and SMEs,” he added.

Liability directive move could “clean up” patchwork AI regulation

Peter van der Putten, director of Pegasystems’ AI Lab and assistant professor at Leiden University, said that while the move may raise consumer protection concerns, the “impact may be relative” given new regulations such as the EU AI Act.

“The idea was that if a customer, citizen or business was claiming to have suffered harm, they wouldn’t have to prove in-depth causality between the AI system and the damage caused,” he explained.

“This would be more on the public or private organization operating the AI system (and/or underlying vendors).”

Ultimately, consumers and entities will still be protected against AI-related harms through the legislation, he noted, and the decision to shelve the proposals will create a more aligned regulatory environment.

“So whilst it is tempting to frame this all as a move towards less consumer protection in the global AI rat race, it can also just be seen as a sensible move to clean up the patchwork of AI regulation a bit, and not incite all kinds of litigation that in the end could either be resolved by existing regulation, or would likely not have been successful for claimants anyway,” van der Putten said.

Betting on a blended approach

The decision to withdraw from the AI Liability Directive is being read by critics as the EU retreating on consumer protection in the face of AI companies.

While the EU AI Act contains protections for citizens and measures to monitor and control the harms of AI model deployment, it does not provide a direct route for consumers making claims against AI developers for damages such as algorithmic bias.

The AI Liability Directive was specifically designed to set out such a route, establishing concrete law on civil liability relating to AI and assisting consumers in making claims.

Timing is everything when it comes to the optics of a decision like this. In dropping the AI Liability Directive just one day after JD Vance’s warning that “excessive regulation” could kill AI innovation, the Commission could invite unwanted suggestions that it’s moving in lock-step with US approaches on AI.

But there’s every indication that rather than a reactive decision, this is more of a pragmatic move by the EU to maintain a handle on the AI sector. If it doesn’t keep its seat at the table by supporting EU-based AI developers and attracting investments from US tech giants, the EU Commission could lose any leverage it has over AI safety altogether.

The EU isn’t naïve and Vance’s statements on AI regulation wouldn’t have come as a surprise to anyone at the Paris Summit. As EU member states like France move to make the most of their established AI talent and the Commission gets more ambitious with its backing for AI infrastructure via its InvestAI initiative, there will be more pragmatic decisions to come.

Attracting US investment, alongside home-grown talent, will be a necessity for the time being.

For the EU Commission’s part, it has stated that it saw “no foreseeable agreement” on the terms of the directive, adding “the Commission will assess whether another proposal should be tabled or another type of approach should be chosen”.

As yet, an alternative approach has not been officially put forward.

Ultimately, the EU may have made the bet that any reduced consumer power in the short term can be balanced out by regional success at AI advancement. If it can carve out a space for innovative AI that doesn’t infringe on inviolable rights, it could beat the US at its own game.

But it still has significant ground to make up, especially in comparison to the US and China.

MORE FROM ITPRO

• A big enforcement deadline for the EU AI Act just passed
• Why regulatory uncertainty is holding back AI adoption
• AI is going to be a legal nightmare for years to come

The rise of data nationalism – when governments look to control data for security reasons – is leading to the creation of a patchwork of country or region-specific regulations that can add another layer of complexity to businesses’ global compliance.

The development of laws and regulations such as the EU AI Act and the UK’s Data Use and Access Bill reflects a growing recognition from governments that data is a critical asset, and has led to a growth in data sovereignty – where data is subject to the laws and regulations of the country where it’s collected or stored.

More often than not these new regulations mandate local data storage, but while being similar in their goals, there are often small differences in these laws’ data protection and cybersecurity frameworks.

Take a positive view

These new regulations may feel like yet another burden IT leaders must shoulder but they show a maturing of the cybersecurity landscape. And while there is room for interpretation, leaders will find the main nuances are in enforcement and penalties.

“The laws aim to enforce more robust data sharing and resilient infrastructure, which is a change for the better,” notes Christian Have, CTO at IT security services provider Logpoint.

There are multiple ways to look at this growth of regional data regulations, says James Hodge, group vice president and chief strategy advisor at Splunk and member of the TechUK AI Committee. He recommends taking the view that it’s a positive thing for business.

“These kinds of frameworks give us concrete ways of working, give us certainty on how we should go about doing business in a specific country. So, I think that overall, we should take it as a very positive thing.”

Complying with region-specific data residency requirements

Even so, it's impossible to ignore the new challenges organizations are facing due to this growth in data residency requirements.

New laws and policies may force organizations to fragment their data architecture, creating inefficiencies and redundancies notes Lauren Murphy, CEO of data consultancy Friday Initiatives, who also points to the challenge of aligning operations with varying legal definitions of data use, consent, and personal data and keeping up with evolving laws.

Then there’s the related cost burden. “Building localized infrastructure and hiring region-specific expertise increases operational costs significantly,” she says.

To meet the growing number of regional data regulations, forward-thinking companies are adopting dynamic, purpose-based frameworks, having acknowledged that traditional manual compliance programs no longer work.

These may include dynamic data profiling, which provides real-time visibility of data flows and use cases to ensure transparency and regulatory requirements, and purpose-based access controls that regulate data access and usage by aligning permissions with specific lawful purposes in different jurisdictions.

Murphy points to hybrid architectures that combine centralized and decentralized systems to balance operational efficiency and localization needs, and cross-functional teams to bring together legal, technical, and business stakeholders to develop holistic strategies. There are also a multitude of tools and services available to help businesses collect, store, and analyze their data in line with regional regulations, Hodge says.

“We’re seeing data residency in software and management platforms to help track where data is stored and processed, and data localization technologies, typically with multi-cloud architectures, the hyperscalers, and potential edge computing.

“I also think there’s a lot of opportunity in the automation and analytics spaces,” he adds.

Technologies like dynamic data mapping, AI-driven data governance tools and privacy-preserving methods like differential privacy streamline compliance with real-time insights and automation. Murphy champions context-aware governance tools that align data value with protection by integrating regulatory and business nuances in particular.

But while essential, experts agree that tools aren’t the full solution. They believe an organization’s data strategy should be about optimizing people, processes, and technology and gaining full visibility of your infrastructure to achieve the perfect balance between data value and protection.

Murphy advises focusing on starting small and scaling smart, integrated governance and human oversight.

“Pilot in critical areas before rolling out solutions broadly, and embed data policies and automation into daily workflows across departments," she says. "Don’t be naïve to think everyone in every role wants to be responsible for data governance because then it just won’t happen.

“Most tools can’t grasp legal nuances or adapt to business-specific rules, and even those that can you don’t want calling the shots; humans must drive strategic implementation.”

Shifting mindsets for evolving data laws

Many organizations are currently unequipped to handle the evolving data regulation landscape because of the way they approach compliance and require a shift in mindset.

Rather than approaching it as a checklist task, compliance should be integrated into any organization’s strategic priorities and treated as a driver of trust, operational efficiency, and value creation. This will be critical for long-term success says Murphy, as those organizations that adapt will not just comply but thrive in an increasingly complex regulatory environment.

“I don’t think you should look at regulation as a burden and compliance as a cost. It should be seen as just another project that needs to be done to address a market need. The most important thing is to ask what are the opportunities to come out of that compliance,” Hodge points out.

It’s also important for businesses to consider not only existing data laws and regulations but what’s also in the pipeline advises Will Richmond-Coggan, a partner in the data protection team at law firm Freeths.

“In the next couple of years, we expect to see new rounds of legislation focused both on updating data protection rules to reflect better understanding of the range and extent of the data that these should apply to; and increasing regulation of emerging technologies, such as AI, which is often used to process such data.”

“I think there’s one thing we can say with almost 100 percent certainty and that’s there will be more legislation in data, cybersecurity, and AI,” agrees Hodge. “The more prepared you are as a business the faster you can respond – you can’t become agile unless you’re resilient first.

“By putting the hard work into understanding your digital infrastructure and developing an effective data strategy you’re building for the future rather than reacting to the latest regulation that comes out,” he concludes.

The multi-billion governance, risk, and compliance (GRC) market is being driven by an increasingly complex regulatory environment, including GDPR, NIS2, and the Digital Operational Resilience Act (DORA) frameworks, among others.

At the same time, the growing integration of AI and automation technologies into GRC solutions is fueling adoption, as businesses see the benefits of applying digital transformation across their GRC strategies.

As we all know, the threat landscape continues to be extremely challenging. Cybersecurity and data protection breaches are increasingly followed by compliance enforcement action as authorities look to improve standards across the board.

Take GDPR, for example, where cumulative compliance fines burst through the €5 billion (£4.18 billion) barrier this year as part of a wider regulatory ecosystem where individual penalties can run into the millions.

In addition, there’s also the potential compliance risks brought about by the integration of AI technologies into business processes. Here, issues such as data privacy, lack of transparency, and advanced tools that simply outpace existing regulatory frameworks are increasing the emphasis on compliance and whether organizations are keeping pace with their responsibilities.

Put these factors together and the results point to strong growth across the global GRC sector. Already worth more than $43 billion (£34.53 billion) this year, it is expected to accelerate significantly to surpass $111 billion (£89.13 billion) by 2032, according to industry figures. It’s not surprising that this is translating into significant and rapidly growing interest from the channel.

The road ahead 

Clearly there is demand from customers across various sectors, many of whom share a sense of urgency around compliance and want to get a robust GRC strategy in place – or at least update the technologies and processes they’re already relying on.

This translates into a significant opportunity for the channel, especially for those who are already specialists in cybersecurity. Whilst these are specific specializations in their own right, GRC and cybersecurity are clearly complementary. These firms should be well-positioned to drive GRC growth, including GRC as a service and virtual CISO offerings as these can be tailored to the specific requirements set out by NIS2, GDPR, and DORA, for example.

For resellers, MSPs and SIs there is a golden opportunity to build a service and product portfolio around that knowledge of the various essential compliance frameworks, leading them to engage in conversations with a wide range of customers on how they are preparing to step up their GRC efforts.

The availability of centralized compliance platforms will also help MSPs offer continuous monitoring and reporting services across customers’ business functions. These tools integrate data from various systems, such as cybersecurity, ITSM, or ERP tools, to provide a unified view of performance and potential vulnerabilities. At the same time, automated compliance workflows are growing in importance and, in many businesses, are already playing a major role in managing risk assessments, policies, and compliance audits.

There is also an important role for channel partners who can customize vendor solutions to meet sector-specific or regional requirements. Post-Brexit, for example, UK organizations that trade within the EU remain subject to various compliance requirements and as such, must design their processes and technology stack to address their obligations. Many of these businesses need the kind of expert guidance and experience that channel specialists are ideally placed to offer.

For instance, there has been growing demand for compliance solutions and a marked increase in the number of channel partners being onboarded. This is a trend we can expect to see accelerate further as organizations prioritize their compliance strategies, focus their investments and work more closely with service providers who can meet their needs. Ultimately, there is an opportunity for leaders in the field of AI and automation to help steer channel partners to offer a risk-aware approach to compliance by harnessing the power of AI and automation.

Looking ahead to 2025 and beyond, the regulatory landscape will become even more complex. As a result, organizations will need to ensure their compliance efforts remain continually robust, in line with authorities moving from periodic to ongoing assessment. I anticipate that we’ll see a significant growth in channel partners focusing on their compliance offerings, including those who diversify their approach to help their clients integrate compliance tools seamlessly with other existing systems, streamline workflows, and ensure audit readiness.

The first of a number of enforcement actions for the EU AI Act have officially come into effect, and experts have warned firms should accelerate preparations for the next batch of deadlines.

Passed in March last year, the first elements of the EU’s landmark legislation came into effect on the 2nd February 2025, bringing with it a series of rules and regulations that AI developers and deployers must adhere to.

The EU AI Act employs a risk-based approach to assessing the potential impact of AI systems, designating them as being minimal, limited, or high-risk. High-risk systems, for example, are those defined as posing a potential threat to life, human rights, or financial livelihood.

These particular systems are in the crosshairs following the introduction of the new rules this month.

Speaking to ITPro ahead of the deadline, Enza Iannopollo, principal analyst at Forrester, said lawmakers specifically chose to target the most dangerous AI use cases with the first round of rules.

“Requirements enforced on this deadline focus on AI use-cases the EU considers pose the greatest risk to core Union values and fundamental rights, due to their potential negative impacts,” Iannopollo said.

“These rules are those related to prohibited AI use-cases, along with requirements related to AI literacy. Organizations that violate these rules could face severe fines — up to 7% of their global turnover — so it’s crucial that requirements are met effectively,” she added.

Iannopollo noted that fines will not be issued immediately, however, as details about sanctions are still a work-in-progress and the authorities in charge of enforcement are still not in place.

While there may not be any big fines in the headlines in the next few months, Iannopollo said this is still an important milestone.

Tim Roberts, UK country co-leader at AlixPartners, said the first set of compliance obligations will act similarly to GDPR, mainly in that they will apply to any organization doing business with AI models in Europe.

With this in mind, it’s critical that companies are aware of these first batch of rules, even if they are not EU-based.

“Naturally, this also reignites the debate about striking the right balance between innovation and regulation. But instead of seeing them as opposing forces, it’s more useful to think of them as two things we need to get right in parallel … because regulation can be a facilitator of innovation - not a blocker,” Roberts said.

“The speed at which AI is advancing has caused discomfort for some consumers, but strong safeguards can build trust and create a thriving (and fairer) environment for greater business innovation.

“The EU AI Act is an important first step in this journey, and its success will depend on how well it is applied and how well it evolves, with the end goal being smarter regulation that drives businesses to continue pushing boundaries for the benefit of all.”

EU AI Act: Firms should tighten up risk assessments

Due to the global reach of the Act and the fact that requirements span the entire AI value chain, Iannopollo said enterprises must ensure they adhere to the regulation.

“The EU AI Act will have a significant impact on AI governance globally. With these regulations, the EU has established the ‘de facto’ standard for trustworthy AI and AI risk management,” she added.

To prepare for the rules, enterprises are advised to begin refining risk assessment practices to ensure they’ve classified AI use cases in line with the designated risk categories contained in the Act.

Systems that would fall within the ‘prohibited’ category need to be switched off immediately.

“Finally, they need to be prepared for the next key deadline on 2nd August. By this date, the enforcement machine and sanctions will be in better shape, and authorities will be much more likely to sanction firms that are not compliant. In other words, this is when we will see a lot more action.”