This Week in ICT & Cybersecurity — Brussels (#26, 2026)
Commission finds Meta platforms breach DSA; SAP antitrust case resolved; Council discusses AI, cybersecurity in finance; NIS2 referrals to Court.
July 05, 2026 to July 11, 2026
Commission finds Meta platforms breach DSA; SAP antitrust case resolved; Council discusses AI, cybersecurity in finance; NIS2 referrals to Court.
📋 In This Week's Newsletter
• 📅 This Week's Calendar in Brussels
• 🇪🇺 European Commission
• 🤝 EU Council
• ✒️ EP Committee Work
• 📚 What We're Reading This Week
This Week's Calendar in Brussels
- Committee on Industry, Research and Energy (ITRE): On July 13, the European Parliament's Committee on Industry, Research and Energy (ITRE) is scheduled to meet. Agenda includes: Amending Regulations (EU) 2016/679, (EU) 2018/1724, (EU) 2018/1725, (EU) 2023/2854 and Directives 2002/58/EC, (EU) 2022/2555 and (EU) 2022/2557 as regards the simplification of the digital legislative framework, and repealing Regulations (EU) 2018/1807, (EU) 2019/1150, (EU) 2022/868, and Directive (EU) 2019/1024 (Digital Omnibus); Chair’s announcements; Date of next meetings.
- Committee on Civil Liberties, Justice and Home Affairs (LIBE): On July 13, the European Parliament's Committee on Civil Liberties, Justice and Home Affairs (LIBE) is scheduled to meet. Agenda includes: Amending Regulations (EU) 2016/679, (EU) 2018/1724, (EU) 2018/1725, (EU) 2023/2854 and Directives 2002/58/EC, (EU) 2022/2555 and (EU) 2022/2557 as regards the simplification of the digital legislative framework, and repealing Regulations (EU) 2018/1807, (EU) 2019/1150, (EU) 2022/868, and Directive (EU) 2019/1024 (Digital Omnibus); Chair’s announcements; Date of next meetings.
- Committee on Civil Liberties, Justice and Home Affairs (LIBE): On July 13, the European Parliament's Committee on Civil Liberties, Justice and Home Affairs (LIBE) is scheduled to meet. Agenda includes: * * *; ------; All time slots are indicative only and may be subject to changes during the meeting.
- Committee on the Internal Market and Consumer Protection (IMCO): On July 14, the European Parliament's Committee on the Internal Market and Consumer Protection (IMCO) is scheduled to meet. Agenda includes: Amending Regulations (EC) No 1272/2008, (EC) No 1223/2009 and (EU) 2019/1009 as regards simplification of certain requirements and procedures for chemical products; Chair’s announcements; Date of next meetings.
- Committee on the Internal Market and Consumer Protection (IMCO): On July 14, the European Parliament's Committee on the Internal Market and Consumer Protection (IMCO) is scheduled to meet. Agenda includes: * * ; Chair’s announcements; *** End of electronic vote **.
- Committee on the Internal Market and Consumer Protection (IMCO): On July 14, the European Parliament's Committee on the Internal Market and Consumer Protection (IMCO) is scheduled to meet. Agenda includes: Coordinators' meeting; *** In camera ***.
- Committee on the Internal Market and Consumer Protection (IMCO): On July 14, the European Parliament's Committee on the Internal Market and Consumer Protection (IMCO) is scheduled to meet. Agenda includes: Amending Directives 2000/14/EC, 2011/65/EU, 2013/53/EU, 2014/29/EU, 2014/30/EU, 2014/31/EU, 2014/32/EU, 2014/33/EU, 2014/34/EU, 2014/35/EU, 2014/53/EU, 2014/68/EU and 2014/90/EU of the European Parliament and of the Council as regards digitalisation and common specifications; Amending Regulations (EU) No 765/2008, (EU) 2016/424, (EU) 2016/425, (EU) 2016/426, (EU) 2023/1230, (EU) 2023/1542 and (EU) 2024/1781 as regards digitalisation and common specifications; Chair’s announcements.
- Committee on Industry, Research and Energy (ITRE): On July 14, the European Parliament's Committee on Industry, Research and Energy (ITRE) is scheduled to meet. Agenda includes: Amending Directives 2008/98/EC, 2010/75/EU, (EU) 2015/2193 and (EU) 2024/1785 of the European Parliament and of the Council as regards simplification of some requirements and reduction of administrative burden; Chair’s announcements; Chair’s announcements concerning coordinators’ decisions of 24 June 2026.
- Committee on Civil Liberties, Justice and Home Affairs (LIBE): On July 14, the European Parliament's Committee on Civil Liberties, Justice and Home Affairs (LIBE) is scheduled to meet. Agenda includes: * * *; ------; All time slots are indicative only and may be subject to changes during the meeting.
- Committee on Civil Liberties, Justice and Home Affairs (LIBE): On July 15, the European Parliament's Committee on Civil Liberties, Justice and Home Affairs (LIBE) is scheduled to meet. Agenda includes: Chair’s announcements; Date of next meetings; Public Hearing with Bruna Szego, Chair of the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA).
European Commission
Commission preliminarily finds Meta’s Instagram and Facebook addictive design in breach of Digital Services Act
On 9 July 2026, the European Commission issued preliminary findings against Meta, determining that the addictive design of Instagram and Facebook may violate the Digital Services Act (DSA). The Commission’s ongoing investigation targets design features such as infinite scroll, autoplay, push notifications, and highly personalised recommender systems that may impact users’ wellbeing, particularly minors and vulnerable adults. According to the Commission, Meta's risk assessments did not address these risks sufficiently and current mitigation measures, including parental controls and awareness actions, have proved inadequate. Meta can now review the file and respond before the Commission possibly issues a non-compliance decision, which could lead to fines up to 6% of global turnover. These proceedings continue the formal investigation launched on 16 May 2024, and also relate to earlier findings on age assurance and ‘rabbit hole’ recommender effects for minors.
European Commission accepts SAP’s commitments in competition case for on-premises ERP software support
On 8 July 2026, the Commission accepted legally binding commitments from SAP addressing antitrust concerns regarding aftermarket services for its on-premises Enterprise Resource Planning (ERP) software. The case, registered as AT.40823, focused on SAP's practices on software maintenance and support, potentially restricting customer choice and market competition. SAP’s commitments include allowing customers to split their systems between service providers, clarify contract provisions, abolish certain fees, and set up an internal clearing structure for disputes. These measures will remain in effect globally for ten years. The Commission found these commitments sufficient under Article 9(1) of Regulation 1/2003 and closed its investigation. Monitoring trustees will oversee compliance.
Commission refers Ireland, Spain, France and the Netherlands to CJEU for not transposing NIS2 cybersecurity rules
On 7 July 2026, the Commission referred Ireland, Spain, France, and the Netherlands to the Court of Justice of the European Union for failing to transpose Directive (EU) 2022/2555 (NIS2 Directive) on cybersecurity. Member States were required to implement these rules by 17 October 2024. The referrals, following earlier letters and reasoned opinions, request the Court to impose financial sanctions until transposition is complete. The NIS2 Directive establishes high cybersecurity standards for entities in 18 critical sectors. Targeted amendments were proposed in January 2026 to facilitate compliance and improve legal clarity.
Commission presents EU Action Plan on Cybersecurity and Artificial Intelligence
On 6 July 2026, the European Commission published an Action Plan outlining structured measures to address cybersecurity risks and opportunities from advanced AI models. The Action Plan proposes evaluation of AI models under the AI Act, development of an EU evaluation capacity operational by 2027, and cooperation with ENISA to create a blueprint for structured access to advanced AI for cybersecurity. A secure testing platform for AI in critical sectors will be established by year-end 2026, supported by ENISA and the Joint Research Centre. The EU will also launch a Grand Challenge to foster homegrown AI cybersecurity solutions, while guidance for securing open-source software will be issued.
Executive Vice-President Virkkunen details priorities for AI and cybersecurity
On 6 July 2026, Executive Vice-President Henna Virkkunen delivered remarks outlining the Commission's priorities under the new Action Plan on Cybersecurity and Artificial Intelligence. Virkkunen underscored the risks presented by rapid AI exploitation for cyberattacks and the need for AI model safety, access, and testing. She explained plans for boosting EU expertise via a dedicated evaluation call, the role of ENISA in operationalising access frameworks, and the establishment of a secure AI testing platform. She also referenced upcoming enforcement powers for the AI Office and the role of the Tech Sovereignty equity capacity in strengthening European AI capabilities.
EU Council
Eurogroup discusses AI and cybersecurity risks for financial sector
On 9 July 2026, Eurogroup ministers exchanged views on artificial intelligence and cybersecurity implications for the financial sector, as well as the development of supportive regulatory conditions. The meeting concluded with adoption of a statement on digital finance.
Upcoming: Justice and Home Affairs Council to meet on 16 July 2026
Justice and Home Affairs ministers are scheduled for an informal meeting on 16 July 2026.
EP Committee Work
ITRE Committee delivers opinion on European Fund for prosperity and security (2028–2034)
On 10 July 2026, the Committee on Industry, Research and Energy (ITRE) published its opinion, drafted by rapporteur Jana Nagyová, regarding the proposal for regulation establishing the European Fund for economic, social, and territorial cohesion, agriculture, rural, fisheries, maritime, prosperity and security for 2028–2034 (PE784.364v04-00). The opinion addresses policy impacts on industry, research, and energy, which link to digital infrastructure and technology sectors, within the new funding framework.
What We're Reading This Week
- ECB tells banks to prepare for AI-powered cyber threats: European Central Bank urges financial institutions to strengthen defenses as artificial intelligence increases the sophistication of cyberattacks.
