Insight on how cyber risk is being mitigated and managed across the globe.
By: Cameron Abbott, Rob Pulham, and Emre Cakmakcioglu
The Office of the Australian Information Commissioner (OAIC) has published updated guidance for entities considering using facial recognition technology (FRT) in high-volume, publicly accessible physical spaces, like retail shopfronts.
Read MoreBy: Sarah Pearce and Sophie Verstraeten
The European Data Protection Board (EDPB) has called on the European Commission to assess the implications of the recent US Supreme Court decision in Trump v. Slaughter for the EU-US Data Privacy Framework (DPF), the mechanism that facilitates transfers of personal data between the EU and participating US organisations.
Read MoreBy: Sarah Pearce and Thomas Nietsch
The EU has adopted its first substantive amendment to the AI Act. Regulation (EU) 2026/1744, commonly referred to as the AI Omnibus, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. While the legislation postpones certain aspects of the AI Act’s compliance timetable, it would be a mistake for organisations to view the Omnibus as a broad pause on AI regulation in Europe.
Read MoreBy: Sarah Pearce and Veronica Muratori
On 20 July 2026, the European Commission published its final Guidelines on the transparency obligations under Article 50 of the EU AI Act. Although non-binding, the Guidelines provide important practical clarification ahead of the application of these obligations. Article 50 is not limited to high-risk AI systems and may apply to a broad range of AI solutions, including chatbots, generative AI tools, emotion recognition systems, biometric categorization tools, and deepfake technologies.
Read MoreBy: Cameron Abbott and Emre Cakmakcioglu
An artificial intelligence research organisation has released a statement detailing how two of its cybersecurity models escaped from an internal testing sandbox to hack AI research platform Hugging Face.
Read MoreBy: Sarah Pearce and Veronica Muratori
One of the more practically significant outcomes of the European Data Protection Board (EDPB)’s June 2026 plenary session, was the adoption of a common template for personal data breach notifications under the GDPR.
Read MoreBy: Cameron Abbott, Daniel Knight, Rob Pulham, Alex Parker, Madison Jeffreys, Emre Cakmakcioglu and Annaliese Filippis
In a key decision against an Australian financial services licence (AFSL) holder, the Federal Court of Australia has ordered the AFSL holder to pay AU$2.5 million in penalties for inadequate cybersecurity measures. The Australian Securities and Investments Commission (ASIC) took action following a cyberattack on the AFSL holder’s IT systems, resulting in approximately 385GB of data being downloaded from its servers.
Read MoreBy: Dr. Thomas Nietsch and Noirin M. McFadden
The UK’s data protection regulator, the Information Commissioner’s Office (ICO) has published guidance for charities to use the new charitable purposes soft opt-in for electronic marketing.
Read MoreBy: Nicole H. Buckley and Whitney E. McCollum
Washington State Governor Bob Ferguson recently signed House Bill 2225 (the Chatbot Disclosure Act) into law, effective 1 January 2027. The Chatbot Disclosure Act requires people and entities who operate AI “companion” chatbots to provide clear and ongoing disclosure to Washington consumers that they are interacting with an automated system and not a human being.
Read MoreBy: Cameron Abbott and Rob Pulham
The Administrative Review Tribunal of Australia (Tribunal) has partially overturned the findings of the Privacy Commissioner on Bunnings’ use of facial recognition technology (FRT) in its stores.
Read MoreCopyright © 2026, K&L Gates LLP. All Rights Reserved.