REGULATORY WATCH

Moderate Guidance Announced United States (federal) · Oct 16, 2026

FFIEC Extends Regulatory Capital Reporting Collection (FFIEC 101) for Three Years

The Federal Financial Institutions Examination Council (FFIEC) announced a three‑year extension of the Regulatory Capital Reporting collection for institutions subject to the Advanced Capital Adequacy Framework (FFIEC 101). No public…

Federal Financial Institutions Examination Council (FFIEC) · Paperwork Reduction Act of 1995

Moderate Guidance Published European Union · Oct 14, 2026

AI adoption more than doubles in EU strategic sectors, JRC report shows

A Joint Research Centre analysis finds AI use in EU strategic sectors rose from 7% in 2021 to 18% in 2025, driven mainly by large language models. The report highlights sector‑specific barriers, especially lack of expertise and regulatory…

European Commission

Moderate Guidance Proposed United States (federal) · Oct 14, 2026

Agency limits programmatic access to FederalRegister.gov and eCFR.gov, requiring API use and CAPTCHA verification

The agency states that due to aggressive automated scraping, programmatic access to FederalRegister.gov and eCFR.gov is restricted to its developer APIs. Users must complete a CAPTCHA to verify they are human and may request a wider IP…

U.S. Federal Government · Paperwork Reduction Act

Moderate Guidance Published United States (federal) · Oct 14, 2026

DoD establishes new matching program to compare TRICARE pharmacy records with Treasury's Do Not Pay system

The Department of Defense announced a new computer‑matching program that will compare its TRICARE Pharmacy Program records with the Treasury's Do Not Pay Working System. The program is established under the Privacy Act of 1974 and the…

Department of Defense · Privacy Act of 1974

Moderate Guidance Proposed United States (federal) · Oct 14, 2026

Federal Register proposes reorganization limiting programmatic access to its sites

The Division of Program Coordination, Planning, and Strategic Initiatives issued a notice proposing a reorganization that will limit programmatic access to FederalRegister.gov and eCFR.gov due to aggressive automated scraping. Access will…

Division of Program Coordination, Planning, and Strategic Initiatives, Office of the Director

Moderate Guidance Published European Union · Oct 13, 2026

CEPD issues guidance on data protection challenges of smart glasses

The European Data Protection Board adopted a declaration on connected glasses and released a report outlining privacy risks. It clarifies when users act as data controllers under the GDPR and stresses that manufacturers and service…

European Data Protection Board (CEPD) · RGPD

Moderate Guidance Published European Union · Oct 13, 2026

EDPB issues guidance on privacy challenges of smart glasses

The European Data Protection Board adopted statement 1/2026 on smart glasses, highlighting serious privacy concerns and the need for transparency. It clarifies when users act as data controllers and stresses that manufacturers and service…

European Data Protection Board · General Data Protection Regulation

Moderate Guidance Signed European Union · Oct 13, 2026

EU and Ukraine sign administrative arrangement between CERT-EU and CERT-UA at 5th Cyber Dialogue

During the 5th EU‑Ukraine Cyber Dialogue on 9 October, the EU and Ukraine signed an administrative arrangement to enable information exchange between CERT‑EU and its Ukrainian counterpart, CERT‑UA. The dialogue also covered alignment with…

CERT-EU · NIS2 Directive

Moderate Guidance Published France · Oct 9, 2026

CNIL hosts 2nd Rencontres Informatique & Libertés on connected glasses and data‑sanctions

The French data‑protection authority CNIL held its second Rencontres Informatique & Libertés on 29 September 2026, featuring panels on the privacy impact of connected glasses and the role of sanctions under the GDPR. The event gathered…

CNIL · RGPD

Moderate Guidance Published European Union · Oct 9, 2026

EU AI Scientific Panel holds special meeting on frontier AI safety and loss-of-control incidents

On 9 October 2026 the European Commission’s AI Scientific Panel met to discuss recent loss-of-control incidents and technical developments that reduce model monitorability. The panel presented recommendations to strengthen EU capabilities…

European Commission · EU AI Act

Moderate Guidance Published Spain · Oct 8, 2026

AEPD publishes second issue of scientific journal “Privacy, Innovation and Technology”

The Spanish Data Protection Agency released the second issue of its scientific journal PIT, dedicated to the 10th anniversary of the GDPR. The monograph examines proactive responsibility, the right to explanation in automated decisions…

Agencia Española de Protección de Datos (AEPD) · Reglamento General de Protección de Datos (RGPD)

Moderate Guidance Published United States (federal) · Oct 5, 2026

EPIC analysis links pixel‑tracking litigation under ECPA and CIPA to upcoming Supreme Court VPPA case

EPIC outlines how recent court decisions using the Electronic Communications Privacy Act (ECPA) and California Invasion of Privacy Act (CIPA) address non‑consensual pixel tracking and its privacy harms. The analysis cites multiple…

HHS OCR · HIPAA Privacy, Security and Breach Notification Rules

Moderate Guidance Published France · Oct 2, 2026

CNIL explains when data‑breach victims can claim compensation under the GDPR

The CNIL outlines that individuals can seek damages only if a GDPR breach caused a real material or moral injury, and they can prove a causal link. Compensation is awarded by a judge, not the CNIL, and the regulator may only impose…

CNIL · RGPD

Moderate Guidance Published United States (federal) · Oct 1, 2026

Federal Register limits automated access; CAPTCHA required for flagged requests

The Federal Register website warns that programmatic requests are flagged as potentially automated and must complete a CAPTCHA to proceed. Users are directed to the FederalRegister.gov and eCFR.gov API documentation for legitimate…

Moderate Guidance Published United States (federal) · Sep 29, 2026

Federal Register restricts automated scraping; requires API use and CAPTCHA verification

The Federal Register warns that programmatic access to FederalRegister.gov and eCFR.gov is limited to its developer APIs due to aggressive automated scraping. Users must use the APIs or complete a CAPTCHA to verify they are human. The…

Privacy Act of 1974

Moderate Guidance Proposed United States (federal) · Sep 29, 2026

Agency seeks comment on proposed information collection for protection of human subjects

The agency announced a proposed collection of information related to the protection of human subjects and Institutional Review Boards and is requesting public comment. The notice also notes that programmatic access to FederalRegister.gov…

Food and Drug Administration · Paperwork Reduction Act of 1995

Moderate Guidance Published United States (federal) · Sep 28, 2026

Federal Register restricts automated scraping, requires CAPTCHA and API use

The Federal Register warns that aggressive automated scraping of its sites is limited to access via developer APIs. Human users must complete a CAPTCHA to continue, and may be asked to do so repeatedly as a security measure.

Department of Defense · Privacy Act of 1974

Moderate Guidance Published United States (federal) · Sep 25, 2026

DoD updates SORN for DON Child and Youth Program to align with cybersecurity policies

The Department of Defense is modifying and reissuing the system of records titled "DON Child and Youth Program" (NM01754-3) under the Privacy Act of 1974. The updates incorporate DoD standard routine uses A through J, expand the collection…

Department of Defense · Privacy Act of 1974

Moderate Guidance Published United States (federal) · Sep 24, 2026

SBA seeks comments on modified matching program under Privacy Act

The U.S. Small Business Administration issued a Federal Register notice requesting public comment on a Privacy Act notice for a revised computer‑matching program. The program will compare SBA benefits records with the Treasury Department’s…

U.S. Small Business Administration · Privacy Act of 1974

Moderate Guidance Announced United States (federal) · Sep 22, 2026

WBUR reports driver’s license data appearing on dark web, raising AI‑enabled fraud risks

WBUR discussed a breach where images of driver’s licenses have been posted on the dark web. The episode highlighted risks of new account fraud, especially when combined with AI tools that can synthesize voice, images, or video. It also…