UK law
Financial Stability Board consults on financial institutions’ responsible AI adoption
The Financial Stability Board is consulting on responsible AI adoption by financial institutions. Its report highlights the benefits and risks associated with AI use in the financial system. To facilitate responsible AI adoption by financial institutions, the report proposes a menu of 12 sound practices that financial institutions could apply in their organisation-wide AI governance and management of the relevant stages of AI development and deployment, referred to as the AI lifecycle. The report includes case studies drawn from real-world AI implementation practices by financial institutions. These illustrate how the sound practices may be applied in practice and, where relevant, proportionately. The sound practices aim to help the board and senior management of financial institutions as they consider business strategy, technology adoption and risk management in an increasingly AI-enabled environment. The consultation ends on 22 July 2026.
UK government launches consultation on automated vehicles
The UK government is seeking views on the draft statement of safety principles for automated vehicles. The statement is required under section 2 of the Automated Vehicles Act 2024 and forms part of the safety framework designed to ensure automated vehicles are safe to deploy and remain safe once deployed. The statutory statement will guide the Secretary of State for Transport in decisions on whether an automated vehicle can be deployed on UK roads. It may also be used for the ongoing monitoring of authorised self-driving vehicles. It will provide guidance on the behaviours the Secretary of State expects to see from vehicles in meeting the self-driving test of travelling safely and autonomously. The consultation ends on 9 September 2026.
ICO makes statement about conclusion of criminal investigation regarding disclosure of medical information
The ICO has concluded its criminal investigation into the unlawful obtaining and disclosure of medical information to a third party without the consent of the data controller, relating to a breach reported by the London Clinic in March 2024. Following a full assessment under the Code for Crown Prosecutors and the ICO’s Prosecution Policy, the ICO issued a now former healthcare professional from London with a formal caution in relation to an offence under section 170(5) of the Data Protection Act 2018. The conduct involved the deliberate misuse of highly sensitive personal information and an offer to disclose it for financial gain, representing a clear breach of trust. The ICO considers the available evidence and the public interest in every criminal investigation. In this instance, it concluded that a caution was the appropriate and proportionate enforcement response. The ICO also considered whether there were any wider organisational issues arising from the healthcare provision in this matter. Based on the evidence available, it did not identify any failings that would meet the threshold for regulatory enforcement.
EU law
European Parliament approves AI Act simplification measures
The European Parliament has given its final approval to measures in the Digital Omnibus package amending the AI Act. Before the law can enter into force, it still needs to be formally adopted by the Council. Most of the AI Act’s provisions will start to apply on 2 August 2026. The Parliament is currently working on two other proposals: one amending data use and data protection laws, and another establishing European business wallets.
Commission will engage with industry following European Citizens’ Initiative on videogames
The European Commission has announced that it will explore ways to improve industry standards in response to a European Citizens’ Initiative. Modern video games often rely on publishers’ servers to function. Publishers may stop supporting these servers, causing games to become partially or entirely unplayable. The initiative therefore invited the Commission to propose legislation ensuring that players can continue to play video games after publishers stop providing commercial support. The Commission considers that, at this stage, it cannot propose a legal obligation to keep video games playable after they stop being provided commercially, including because of existing intellectual property rights. It says that consumer law already provides important safeguards protecting consumers’ economic interests. Video game providers must inform consumers about the duration and conditions for terminating the contract before consumers sign up for the video game. The Directive on digital content and digital services provides consumers with remedies when the content or service provided does not conform with the contract and what consumers could reasonably expect. Consumers may be entitled to a proportionate refund of their purchases. However, the Commission will aim for an industry code of conduct on managing video games’ “end of life”. It will also work to raise awareness of the applicable rights that protect consumers, including safeguards protecting their economic interests. The Commission will report on the application of the Directive on digital content and digital services before the end of the year. Active enforcement of these existing consumer rights may also provide incentives for providers to offer video games with longer lifespans and explore solutions for meeting consumer expectations.
