This Week in ICT & Cybersecurity — Brussels (#28, 2026)
Digital Markets Act: Google fined €890m; DSA: AliExpress fined €550m; AI Act Omnibus (Regulation (EU) 2026/1744) simplifies high-risk AI rules; Key eIDAS digital wallet standards updated; New Russia tech export restrictions.
July 19, 2026 to July 25, 2026
Digital Markets Act: Google fined €890m; DSA: AliExpress fined €550m; AI Act Omnibus (Regulation (EU) 2026/1744) simplifies high-risk AI rules; Key eIDAS digital wallet standards updated; New Russia tech export restrictions.
📋 In This Week's Newsletter
• 🇪🇺 European Commission
• ⚖️ EU Legislation
European Commission
Commission fines Google €890 million for Digital Markets Act breaches
On 22 July 2026, the European Commission issued two non-compliance decisions against Google for breaching obligations under the Digital Markets Act (DMA), notably self-preferencing its own services in Google Search and imposing unlawful restrictions on app developers in Google Play regarding steering users towards alternative purchase channels. Fines amounted to €460 million and €430 million respectively. The decisions followed non-compliance investigations initiated on 25 March 2024 and extensive engagement with Google. Google has 60 days to comply or risks further penalty payments. Commission Executive Vice-Presidents Teresa Ribera and Henna Virkkunen commented on the enforcement. Google retains the right to appeal.
Commission fines AliExpress €550 million for DSA breaches
On 19 July 2026, the Commission announced a €550 million fine against AliExpress for failing to meet Digital Services Act (DSA) obligations, specifically in assessing and mitigating risks related to the dissemination of illegal, unsafe, or counterfeit products. The Commission identified systemic failures in risk assessment, moderation, recommendation systems, and enforcement against traders of illegal goods. AliExpress is required to submit a remediation plan by 20 October 2026. The investigation relied on risk assessment reports from 2023 and 2024, data requests, third-party information, and Commission-led testing. The Commission took into account the novelty of the DSA as a mitigating factor.
Interim Regulation on child sexual abuse detection online reinstated
On 22 July 2026, the Commission welcomed the Council’s adoption of the renewed Interim Regulation permitting voluntary detection and reporting by online service providers of child sexual abuse, following expiry of the previous derogation in April. The new regulation, which incorporates amendments from the Parliament, extends voluntary detection until 3 April 2028. End-to-end encrypted interpersonal communications remain outside the scope. The measure responds to sharp increases in reported abuses, much of it driven by misuse of artificial intelligence. Negotiations continue on a permanent legislative framework to combat child sexual abuse online.
Commission preliminary finds TikTok in DSA breach over child safety
On 23 July 2026, the Commission issued preliminary findings to TikTok, indicating likely non-compliance with the Digital Services Act in relation to account safety for minors. The investigation found TikTok’s default settings for minors’ accounts insufficient to protect privacy and safety, exposing them to risks of contact from strangers and cyberbullying. TikTok is invited to respond to the findings before a final decision is made. This action follows earlier proceedings launched in February 2024 covering addictive design and data access for researchers.
Commission publishes guidelines on transparency obligations for AI systems under the AI Act
On 19 July 2026, the Commission published guidelines clarifying transparency obligations under the AI Act for providers and deployers, effective from 2 August 2026. The guidance addresses which AI applications must disclose their artificial nature, defines requirements for labelling AI-generated content (including deepfakes), and provides compliance examples. Guidance covers information provision, exemptions, and marking standards, with reference to a new Code of Practice and the planned AI Act Service Desk.
Commission concludes eligibility checks on European Citizens' Initiatives on digital ID and age-verification
On 21 July 2026, the Commission completed eligibility checks on two European Citizens' Initiatives (ECI). The initiative 'Stop Killing The Internet: No Digital ID & No Age Verification' was registered as legally admissible, calling for voluntary, privacy-preserving digital identity and age-assurance systems. A second initiative, seeking a moratorium on non-Western migration, was found inadmissible as contrary to Treaty and Charter values.
EU Legislation (Official Journal)
Regulation (EU) 2026/1744 (Digital Omnibus on AI) simplifies high-risk AI system implementation
Published on 24 July 2026, Regulation (EU) 2026/1744 amends prior AI regulations (notably Regulation (EU) 2024/1689, 2018/1139, and 2023/1230) to address implementation challenges under the AI Act. It introduces measures including staggered timelines for compliance (2 December 2027 and 2 August 2028 for different categories of high-risk systems), clarifications on SME/SMC obligations, revised prohibitions on harmful AI-generated content, streamlined conformity assessment procedures, and updates to governance frameworks. CELEX: 32026R1744.
Council Regulation (EU) 2026/1848: New restrictive measures in response to Russia’s actions in Ukraine
On 23 July 2026, Council Regulation (EU) 2026/1848 was published, amending Regulation (EU) No 833/2014. The regulation adds 51 entities to the export ban lists, including those in third countries supporting Russia’s military technology, and expands technical export controls covering semiconductors, microelectronics, and dual-use items. Further import bans cover critical raw materials and nickel, copper, and lead ores. New restrictions are imposed on LNG services, Russian oil refineries, and crypto-asset platforms; additional due diligence and reporting obligations for LNG tanker sales are included. The new rules take effect upon publication.
Commission Implementing Regulation (EU) 2026/1730 updates digital wallet relying party standards
Commission Implementing Regulation (EU) 2026/1730 amends Implementing Regulation (EU) 2025/848 to align with current standards for European Digital Identity Wallets. Updates affect technical and procedural requirements for wallet-relying party registration certificates, automating certificate issuance and harmonising certificate policies across the EU. Entry into force is 20 days after publication, with direct applicability.
Commission Implementing Regulation (EU) 2026/1731 updates eIDAS digital wallet core standards
Published 22 July 2026, Implementing Regulation (EU) 2026/1731 updates standards in four prior eIDAS implementing acts (2024/2977, 2024/2979, 2024/2980, 2024/2982) to ensure the interoperability, security, and privacy of European Digital Identity Wallets. Updates include the mandatory introduction of an EU Digital Identity Wallet Trust Mark, explicit protocols for image (portrait) sharing security, and extension of compliance timelines until August 2028.
Commission Implementing Regulation (EU) 2026/1735 updates requirements for qualified electronic attestations of attributes
On 22 July 2026, the Commission adopted Implementing Regulation (EU) 2026/1735 amending Regulation (EU) 2025/1569. The new rules address revocation processes for electronic attestations of attributes, set standards for privacy-preserving revocation mechanisms, and specify obligations for the signing and sealing of verification results. Key provisions apply from 1 January 2027.
Commission Implementing Regulation (EU) 2026/1755 clarifies AI Act general-purpose model evaluation and fines procedures
On 21 July 2026, the Commission published Implementing Regulation (EU) 2026/1755 detailing procedures for evaluations of general-purpose AI models under the AI Act (2024/1689) and proceedings relating to fines. The regulation sets out procedures for Commission access to models and technical components, engagement with independent experts, and the opening, conduct, and closure of proceedings against model providers.
