AI Policy & Governance, European Policy
CDT Europe’s AI Bulletin: June 2026
After various months of delays in the AI Act implementation, June saw major milestones in the constitution of oversight bodies and publication of guidance, as well as the publication of the European Union’s long-awaited tech sovereignty strategy.
AI Act Oversight Bodies Constituted, Transparency Guidance Finalised
After significant delays, the European Commission announced the members of the Advisory Forum and Scientific Panel, two key oversight bodies set up by the AI Act consisting of external experts. Each of these two bodies has different roles in the AI Act implementation ecosystem: while the Scientific Panel – with 60 members in total – is expected to act independently and play an active role in the oversight of General-Purpose AI (GPAI) models, the Advisory Forum – currently at 172 members – was conceived as a bipartisan forum of technical experts with balanced representation of commercial and non-commercial representation to provide targeted advice to the European Commission and the AI Board.
In another implementation development, the European Commission published the final Code of Practice on marking and labelling of AI-generated content, which operationalises the AI Act’s transparency requirements. The Code is split into two sections: one includes rules for marking and detection of AI-generated and manipulated content for providers of generative AI systems. The other includes rules for labeling deep fakes and AI-generated and manipulated published text for deployers. The Code is split into: measures that are mandatory to ensure compliance with the AI Act; measures that are voluntary but recommended; and purely voluntary measures. OpenAI has been the first actor to publicly announce that it will sign the Code.
European Commission Publishes its much awaited Tech Sovereignty Package
The European Commission published its Tech Sovereignty Package, headlined by two policy documents – the Communication on European Tech Sovereignty and EU Open Source Strategy, and a Strategic Roadmap for Digitalisation and AI in Energy – and two legislative initiatives, the Cloud and AI Development Act (CADA) and the Chips Act 2.0. The policies identify the key challenges faced by Europe, including technological dependencies, heavy reliance on foreign providers, high market concentration and vendor lock-in. The Commission proposes a three-pronged approach to address its sovereignty challenges: promoting European alternatives across the technology stack, building trust in the European digital ecosystem, and managing technological interdependencies.
The legislative proposals showcase this change in direction. The CADA proposes a staggered scheme to determine the sovereignty needs for specific instances of cloud service procurements and proposes to triple the EU’s data center capacity within the next 5-7 years, including by speeding up environmental assessments. The Chips Act seeks to boost and diversify the supply of chips, aiming to increase European demand for and build up a shock-resilient European semiconductor supply chain.
Forthcoming Irish presidency programme to focus on Omnibus
Starting July 1st, Ireland will take over the Presidency of the Council of the European Union after Cyprus. Their publicly released programme aims to strengthen the EU’s capacities in cloud computing and artificial intelligence, and announces a forthcoming AI Summit to take place in Dublin on 14 October 2026, bringing together “EU and global leaders, heads of government, CEOs, investors, innovators and academics” to discuss harnessing AI to revolutionise Europe’s competitiveness.
While explicit discussion of data is absent from the programme, a major area of focus for the presidency will be the Digital Omnibus proposal – a draft law seeking to amend various digital laws including the General Data Protection Regulation – after member states failed to agree on a common position during the latest round of negotiations fostered by the Cypriot presidency in Council. The ongoing interdependencies between Ireland and the tech industry, combined with its historical poor enforcement of data protection rules and the recent scandal surrounding the appointment of a former Meta lobbyist as its chief data regulator are feared to play a significant role in the development of this file, which among others seeks to relax data processing rules in the development and operation of AI systems.
In other news:
- Cate Blanchett unveiled in Brussels a novel tool that would enable artists to provide or withhold permission for their image to be used by artificial intelligence. The “Human Consent Registry” would turn these permissions into a signal AI can read, allowing AI developers to check the registry before using protected rights.
- Norway moved to restrict the use of generative AI by primary school students in the classroom. The announcement follows a documented drop in students’ basic skills, including findings that one in four Norwegian students reads below the OECD minimum threshold for qualification for further education and work.
- Germany announced the establishment of an AI Security Institute, following confirmation that Anthropic would expand the range of actors with access to its Mythos frontier model under Project Glasswing to include eight EU countries, including Germany. Anthropic has since disabled foreign access to this AI model after an export control directive by the US government which suspended access to Anthropic frontier models Fable 5 and Mythos 5, effectively shutting down European Union access to these models. At the time of writing, Mythos 5 has been partially released to handpicked American firms.
- Over a dozen MEPs (none of them involved in the negotiations of the AI Act) called for the establishment of a European Parliament Standing Committee on AI and Robotics. The letter raises concerns about the EU’s ongoing lack of competitiveness as well as risks related to AI and proposes a dedicated Committee for the systematic monitoring of technological developments, the strengthening of parliamentary oversight, the development of a coherent strategy and the timely adaptation of the regulatory framework.
- After reports by Investigate Europe about the Commission’s word-by-word inclusion of industry lobby positions related to the confidentiality of information on individual data centres in the delegated act on the rating scheme for data centres, 35 MEPs urged the Commission to delete the relevant text and ensure transparency regarding the environmental impact of individual data centres.
- The full judgment of the Court of Rome’s annulment of the fine imposed by the Italian data protection authority on OpenAI due to violations of the General Data Protection Regulation (GDPR) is now public after the decision was announced in March. The Court annulled the fine purely on procedural grounds, finding that the Garante was not the competent authority under the GDPR one-stop-shop mechanism, which designates as a responsible authority the one established in the country where the entity under investigation is headquartered.
- The European Commission’s appointment of the Chairman of Siemens as industrial AI envoy sparked concern by 40 Members of the European Parliament and corporate lobby watchdogs alike, who raised potential conflicts of interest and underscored Siemens’ active lobbying against EU AI rules including in the context of the omnibus package.
- A regional court in Germany ruled that Google can be held directly liable for incorrect answers created by its AI overview tool. The court argued that contrary to the traditional liability exemption applicable to search engine operators when presenting third-party content, the AI overview created new and independent content attributable to Google. The Court also rejected the argument that general awareness of the unreliability of AI-generated content protected the defendant from liability. Google will appeal the decision.
- OpenAI published its Frontier Governance Framework which serves as its Safety and Security Framework under the General Purpose AI Code of Practice. Under its obligation to identify systemic risks arising from its models, OpenAI lists the four compulsory risk categories under the Code of Practice — cyber offence, chemical, biological, radiological and nuclear attacks or accidents, harmful manipulation and loss of control. It does not identify any further systemic risks, for example related to fundamental rights. The Framework does not define risk tiers for the risk of harmful manipulation, stating that the risk is nascent and may be better addressed at system-level.
Content of the Month 📚📺🎧
CDT Europe presents our freshly curated recommended reads and works for the month. For more on AI, take a look at CDT’s work.
- The Guardian, AI absolutism is breaking our brains. The apocalyptic future we’re being sold isn’t inevitable
- Amnesty International, Unlawful by design: Exposing the human rights costs of generative AI
- Access Now, Joint statement on AI in warfare