Andy Burnham and Ursula Van der Leyen give speeches in New York on AI and child online safety
The Prime Minister and European Commission President have given speeches in New York. Andy Burnham presented AI and disinformation as increasingly interconnected national-security and democratic-resilience challenges, describing how bots, fake websites, falsified media and other techniques spread disinformation and deepen social divisions, and that AI will “multiply the threat”. In response, the UK government will establish a National Centre for Information Defence to detect, attribute and disrupt hostile-state information operations, while aiming to strengthen public resilience and international cooperation. More broadly, his speech characterised frontier AI as both a major opportunity and a “multiplier of risk”. The UK plans an AI defence partnership with the US to protect critical national infrastructure and will put AI at the heart of its 2027 G20 Presidency, seeking agreement on global principles and standards covering transparency, access, preparedness and safe AI development. The Prime Minister also stressed that fundamental decisions about AI should remain with elected governments and said the UK would legislate if necessary to protect the public.
In her speech on protecting children’s rights in the age of AI, European Commission President Ursula von der Leyen argued that stronger safeguards are needed to protect children from the risks associated with social media and attention-driven algorithms. Pointing to high levels of screen use and growing medical evidence of harm, she outlined the EU KIDS Act, which would prohibit social media use for children under 13 and personal accounts for under-15s, while allowing 13- and 14-year-olds access through restricted, parent-supervised accounts subject to a default 60-minute daily limit. A key feature would be requiring platforms to demonstrate that their services and algorithms are safe for children rather than leaving the European Commission to establish that they are harmful through lengthy investigations under the DSA and DMA. Von der Leyen summed up the approach as shifting the debate away from when children should be allowed to access social media towards how and when social media is permitted to access children.
UK law
TikTok withdraws two appeals in children’s privacy action and accepts £12.7 million fine
The ICO has announced that TikTok has agreed to pay a £12.7 million fine imposed by the ICO in 2023 after withdrawing its appeal of the underlying penalty notice. TikTok failed to carry out adequate checks to identify and remove underage children from its platform and failed to provide users with clear information about how their data was being collected, used and shared meaning users (especially children) were unlikely to be able to make informed decisions. TikTok also failed to obtain parental consent even though it ought to have been aware that under 13s were using its platform. It has also dropped its appeal against the ICO’s information notice requiring it to provide certain documents and details for a separate investigation into TikTok’s use of children’s data in its recommender systems.
Ofcom launches investigation into Pornhub’s age checks
Ofcom is investigating if Aylo, the service provider of Pornhub, to decide if it has complied with its duties under the Online Safety Act 2023 to use highly effective age assurance to prevent children from encountering pornographic content. In May 2026, Pornhub deployed a new age assurance process for some users. This process relies on signals from a third party, in this case Apple, that suggest UK users trying to access Pornhub may have completed Apple’s age checks. Ofcom is concerned that Aylo may not have conducted sufficient due diligence and testing before implementing its new age assurance process and so it may not be highly effective at preventing children from seeing pornography. Consequently, Ofcom has decided to open a formal investigation to establish whether Aylo has failed to comply with legal obligations under the Online Safety Act, in particular to use highly effective age assurance to prevent children from seeing pornography; and complete a suitable and sufficient children’s access assessment. It will consider how Aylo implemented its age assurance process, and whether it conducted the necessary due diligence before deployment. Its investigation will not cover how Apple operates its age checks. Ofcom’s first step is to gather and analyse evidence to determine whether a breach has occurred. If, based on that evidence, it considers that a compliance failure has taken place, it will issue a provisional decision to Aylo, who will then have an opportunity to respond to the findings in full, as required by the Act, before Ofcom makes its final decision.
Ofcom announces publication of CCUK guidance on telecoms data sharing to combat fraud
Ofcom has recently been working closely with Comms Council UK (CCUK), the Information Commissioner’s Office and the Home Office to help produce guidance for communications providers on sharing data to help combat telecoms-enabled fraud. CCUK has now published this guidance. Ofcom encourages communications providers to take account of it, so that they can confidently and lawfully share data about fraud and scams with relevant organisations (such as law enforcement, industry partners and fraud prevention organisations) and support efforts to combat fraud.
Ofcom launches engagement on the role of AI in cyber defence
Ofcom is responsible for the security and resilience of the UK’s telecommunications and digital infrastructure sectors, and so wants to work with industry to better understand how advances in AI can support cyber defence across critical communications networks and services. Its engagement will explore both the opportunities and challenges associated with AI-enabled cyber security tools, including questions around trust, assurance, accountability and compliance with existing cyber security requirements. Ofcom is also keen to ensure current regulatory frameworks do not include unintended or perceived barriers to the adoption of technologies that could improve security and resilience outcomes. Ofcom plans to carry out a series of discussions with industry, technical experts and vendors during autumn 2026. Insights from this engagement will inform Ofcom’s understanding of how emerging AI technologies interact with existing cyber security principles and regulatory requirements. Ofcom’s aim is to support innovation while maintaining high standards of security and resilience, reflecting its principal duty to further the interests of citizens and consumers by ensuring that trust, assurance and accountability remain central to the protection of critical communications infrastructure. Ofcom expects to publish findings in early 2027.
Alan Turing Institute launches report on frontier AI
The Alan Turing Institute has published a report on frontier AI risks, which argues that policymakers do not need to resolve the disputed question of whether AI poses a long-term existential threat before acting on more immediate and evidence-based risks. It identifies five priority areas: cybersecurity, democratic instability, misalignment of autonomous AI systems, loss of meaningful human control and oversight, and chemical and biological threats. The paper stresses that these risks are actionable because they arise from observable AI behaviours and harms, and calls for a shift from simply evaluating individual models to assuring and verifying whole AI systems, including the technology, people and processes surrounding them. It is cautious about seemingly simple solutions such as AI “kill switches”, arguing that effective safeguards need to be engineered into systems from the outset, including containment, monitorability and meaningful human oversight. The broader message is that managing frontier AI will require a combination of scientific research, robust assurance, regulation, multidisciplinary expertise and international cooperation, with the UK well placed to contribute through institutions such as the Turing, AISI and NCSC.
EU law
EDPB holds latest plenary meeting
The European Data Protection Board (EDPB) has adopted new guidelines aimed at harmonising how national data protection authorities decide whether to impose administrative fines for GDPR infringements, alongside final guidelines on the interaction between the Digital Services Act (DSA) and the GDPR. The fining guidelines set out a five-step methodology covering whether an infringement is finable, who may be held liable, whether the breach was intentional or negligent, relevant aggravating or mitigating factors, and whether a fine would be effective, proportionate and dissuasive. They indicate that minor infringements will generally attract a reprimand rather than a fine, while there is a strong presumption in favour of a fine for non-minor infringements. The guidance includes 14 practical examples illustrating how authorities should select appropriate corrective measures. The guidelines are open for consultation until 13 November 2026. The EDPB has also finalised its separate guidelines on the interplay between the DSA and the GDPR following consultation, which are intended to promote consistent application where DSA obligations involve processing personal data.
European Commission enhances energy efficiency and sustainability of data centres in the EU
The European Commission proposed a common rating scheme for data centres aimed at increasing transparency on their energy use and supporting their sustainable integration into Europe’s energy system. It says that data centres are essential to Europe’s digital future. Increasing computing capacity in Europe is important for strengthening Europe’s technological independence and digital sovereignty. The EU wants to triple its data centre capacity over the next five to seven years, but this growth brings challenges which need to be addressed. In addition to using more energy, an increase of data centres could put extra pressure on electricity grids and the use of natural resources, such as water, and contribute to increase carbon emissions. To limit these impacts, the Commission says that it is essential that data centres are highly energy- and water-efficient and sustainably integrated in the energy system. With the common rating scheme, the Commission will help ensure that there is transparent information about the actual use of resources (energy, water) by data centres.
AI Board holds its ninth meeting
The EU AI Board has reported on its ninth meeting at which Member States reviewed progress on implementing and enforcing the EU AI Act and wider European and international AI policy. Discussions covered the European Commission’s enforcement priorities, recent developments and incidents involving frontier AI, AI safety and cybersecurity, strengthening European AI capabilities and uptake, and coordination between Member States. The Board also considered practical aspects of AI Act implementation, including recommendations on AI literacy, measures supporting the transparency obligations that took effect on 2 August 2026, cooperation between market surveillance authorities and conformity assessment arrangements. Members were also briefed on the Commission’s Action Plan on Cybersecurity and AI, including work to develop testing infrastructure and prepare Europe’s cyber ecosystem for frontier AI risks and opportunities. The next AI Board meeting is expected to take place on 18 November 2026, alongside the Apply AI Summit in Brussels.
