Privacy & Cybersecurity #65

This roundup summarizes recent national and subnational laws and regulatory guidance shaping data, AI, and communications security across Germany, the UK, Poland, multiple U.S. states, and the FCC. Key developments include Germany’s Data Act Implementation (DADG) with BNetzA enforcement, updated ICO ADM guidance, Poland’s KRiBSI AI supervision draft, California’s Executive Order N‑5‑26 on AI procurement, Utah’s SB 73 age‑verification and SEDI initiatives, New York’s S8828 frontier model rules, and the FCC’s addition of foreign‑made consumer routers to its Covered List. #DADG #ICO

Keypoints

Germany adopted the Data Act Implementation Act (DADG), designating BNetzA as the central enforcement authority with a tiered fines regime.
The ICO published updated ADM guidance aligned with the DUAA and new Articles 22A–22D, emphasizing decision‑specific explanations, meaningful human intervention, and mandatory DPIAs.
Poland’s draft AI law would create the Commission for the Development and Safety of Artificial Intelligence (KRiBSI) to enforce the EU AI Act, handle complaints, and oversee conformity assessments.
California’s Executive Order N‑5‑26 mandates AI procurement reforms including vendor certification, risk screening, contractual safeguards, and watermarking guidance for AI‑generated content.
Utah’s SB 73 requires mandatory online age verification, new taxes and enforcement powers under SEDI, while the FCC has added foreign‑made consumer routers to its Covered List, blocking new imports.