This Week in ICT & Cybersecurity — Brussels (#18, 2026)
EU adopts Council of Europe AI Convention; cyber-attack sanctions extended; EU Talent Pool Regulation enters into force; satellite navigation agreement with Switzerland takes effect.
May 10, 2026 to May 16, 2026
EU adopts Council of Europe AI Convention; cyber-attack sanctions extended; EU Talent Pool Regulation enters into force; satellite navigation agreement with Switzerland takes effect.
📋 In This Week's Newsletter
• 🇪🇺 European Commission
• ⚖️ EU Legislation
• 🤝 EU Council
• ✒️ EP Committee Work
• 📚 What We're Reading This Week
European Commission
Von der Leyen Addresses AI, Child Protection and Social Media Regulation
European Commission President Ursula von der Leyen delivered a keynote address at the European Summit on Artificial Intelligence and Children in Copenhagen on 11 May 2026. She outlined the Commission's ongoing investigations into major technology firms including TikTok, Meta, and X regarding their compliance with the Digital Services Act (Regulation (EU) 2022/2065), particularly related to addictive design and the enforcement of age limits. Von der Leyen referenced the establishment of a Special Panel of Experts on Child Safety Online and signaled the potential for a legal proposal on a social media minimum age, expected in summer 2026. The Commission has also developed an age verification app, to be rolled out in Denmark by mid-2026, designed with high privacy standards and open-source code for integration into Member States' digital wallets. The address linked the Commission's digital policy to the forthcoming Digital Fairness Act, which will address harmful design practices in digital products. These efforts are positioned within the broader context of the AI Act (Regulation (EU) 2024/1689) and the Digital Markets Act (Regulation (EU) 2022/1925).
Commission Approves €2.62 Billion Payment to Romania for Digital and Energy Reforms
On 13 May 2026, the European Commission issued a positive preliminary assessment for Romania's fourth payment request under the Recovery and Resilience Facility (RRF), part of NextGenerationEU. The €2.62 billion disbursement is tied to 38 milestones and 24 targets, including deployment of governmental cloud infrastructure, decarbonisation measures in transport and energy, and reforms in tax administration and digitalisation. Over 30 public institutions are now connected to Romania's governmental cloud. The funds also support health and social infrastructure and anti-corruption policies. The Economic and Financial Committee will provide its opinion within four weeks, after which the Commission will take the final payment decision. This request brings Romania's total RRF receipts to €12.97 billion, covering 60.6% of its plan.
EU Legislation (Official Journal)
Council Decision (EU) 2026/1080: EU Concludes Council of Europe AI Convention
On 13 May 2026, Council Decision (EU) 2026/1080 approved the conclusion of the Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law, on behalf of the European Union. The Convention, signed on 5 September 2024 and published in OJ L 2026/1081, aligns with Regulation (EU) 2024/1689 (AI Act). The Convention establishes binding principles to ensure AI activities respect human rights and the rule of law.
Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law Published
The text of the Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law was published in the Official Journal (OJ L 202601081) on 13 May 2026. The Convention defines obligations for Parties to implement measures safeguarding human rights, democracy, and the rule of law throughout the AI system lifecycle and includes a mechanism for follow-up and international cooperation.
EU Talent Pool Regulation Enters into Force
Regulation (EU) 2026/1047 establishing an EU Talent Pool was published on 12 May 2026. The Regulation creates a Union-wide platform to facilitate recruitment of third-country nationals in shortage occupations, with provisions for data protection, fair recruitment, and cooperation between Member States. The Regulation references interoperability with the ESCO classification and relevant provisions of the AI Act (Regulation (EU) 2024/1689).
Sanctions for Cyber-attacks Threatening the EU Extended and Updated
Council Decision (CFSP) 2026/1079 of 11 May 2026 amends Decision (CFSP) 2019/797, extending restrictive measures against cyber-attacks threatening the Union or its Member States until 18 May 2027 for listed individuals and entities. Annexes were updated to reflect changes in the reasons for listing certain persons.
Council Implementing Regulation (EU) 2026/1078: Cyber-attack Sanctions List Updated
Council Implementing Regulation (EU) 2026/1078 of 11 May 2026 amends Annex I to Regulation (EU) 2019/796, updating the list of natural and legal persons subject to restrictive measures for cyber-attacks against the Union or its Member States. The updates concern four persons and one entity.
EU-Switzerland Satellite Navigation Agreement Now in Force
A notice published on 13 May 2026 (OJ L 2026/1090) confirms the entry into force, as of 1 December 2025, of the Cooperation Agreement between the EU, its Member States, and the Swiss Confederation on the European Satellite Navigation Programmes. The agreement was originally signed in Brussels on 18 December 2013.
Council Decision (EU) 2026/1069: Personal Data Exchange on Vehicle Registration with UK
Council Decision (EU) 2026/1069 of 12 May 2026 sets the EU position on the supply of personal data relating to vehicle registration to the United Kingdom under Article 540(2) of the EU-UK Trade and Cooperation Agreement. Following evaluation, Member States may begin supplying such data to the UK as of 15 June 2026.
EU Council
Education and Youth Ministers Discuss AI and Digital Skills in Schools
The Education, Youth, Culture and Sport Council (Education and Youth) met on 11 May 2026. Ministers reviewed Erasmus+, the role of teachers in the era of AI, and the EU Youth Dialogue.
EP Committee Work
SEDE Recommendation on EU-Canada SAFE Instrument Procurement Agreement
The Subcommittee on Security and Defence (SEDE) adopted a recommendation on 12 May 2026 regarding the draft Council decision for an agreement with Canada on participation of Canadian legal entities and products in procurement under the SAFE Instrument. Rapporteur: Borys Budka.
INTA Opinion on EU-Switzerland Bilateral Relations Package
On 12 May 2026, the Committee on International Trade (INTA) issued an opinion on the draft Council decision for a broad package of agreements with the Swiss Confederation to enhance bilateral relations. Rapporteur: Željana Zovko.
What We're Reading This Week
- Britain's NHS to grant Palantir contractors 'unlimited access' to patient data, FT reports: Palantir contractors will reportedly receive unrestricted access to NHS patient records, raising privacy and data security concerns.
- Hackers pushing innovation in AI-enabled hacking operations, Google says: Google reports that cybercriminals are rapidly adopting AI tools to enhance the scale and sophistication of their attacks.
- Exclusive: France probes whether Israeli firm BlackCore interfered in local elections, sources say: French authorities are investigating allegations that Israeli cybersecurity company BlackCore meddled in recent French elections, according to sources.
