Newsletter #33 - 11 August 2026
Read on website
---
NicFab Newsletter
Issue 33 | August 11, 2026
Privacy, Data Protection, AI, and Cybersecurity
---
Welcome to issue 33 of our weekly newsletter dedicated to privacy, data protection, artificial intelligence, cybersecurity, and ethics. Every Tuesday, you’ll find a curated selection of the most relevant news from the previous week, with a focus on European regulatory developments, case law, enforcement, and technological innovation.
---
In this issue
ITALIAN DATA PROTECTION AUTHORITY
EDPB - EUROPEAN DATA PROTECTION BOARD
EUROPEAN COMMISSION
EUROPEAN PARLIAMENT
CNIL - FRENCH DATA PROTECTION AUTHORITY
CASE LAW
DIGITAL MARKETS & PLATFORM REGULATION
INTERNATIONAL DEVELOPMENTS
ARTIFICIAL INTELLIGENCE
CYBERSECURITY
TECH & INNOVATION
SCIENTIFIC RESEARCH
AI Act in a Nutshell
Legal Prompting
Podcast
THE BOOK “Agentic AI”
From the NicFab Blog
Featured Events and Meetings
Conclusion
---
ITALIAN DATA PROTECTION AUTHORITY
Satirical Deepfakes of Enrico Mentana: A Reprimand for R.T.I.
The Italian Data Protection Authority has reprimanded R.T.I. Spa over segments of the television program Striscia la Notizia in which the image and voice of journalist Enrico Mentana had been manipulated using artificial intelligence systems, attributing to him statements he had never made and placing him virtually in the studio of the broadcaster he works for. The proceedings originated from a complaint by the journalist himself; the decision was announced in a press release on August 7, 2026.
The Authority found that the realism of the imagery, the low perceptibility of the alteration, and the plausibility of the statements could have led the public to believe the content was authentic. The warnings about the artificial nature of the videos were not considered sufficiently clear, evident, and comprehensible for the whole audience of viewers and social media users. The Authority established a breach of Article 5 GDPR, on the principles of lawfulness, fairness, and transparency, and of Article 25, on data protection by design and by default. In addition to the reprimand, it prohibited any further use of Mentana’s data in the manner contested, without prejudice to its retention for any judicial purposes.
The line is clear: the use of deepfakes, even for satirical purposes, must respect the dignity of individuals and the principles of the GDPR. Anyone producing generative content that reproduces the identity of a real person is processing personal data, and a disclaimer matters only if it is actually perceived by the average recipient of the content — including when the video circulates outside its original broadcast context.
Source
---
EDPB - EUROPEAN DATA PROTECTION BOARD
The Board Asks the Commission to Review the Data Privacy Framework
In a letter dated July 31, 2026, registered as Ares(2026)7540711 and made available in the Board’s correspondence register, EDPB Chair Anu Talus asked Commissioner Michael McGrath to closely assess whether the U.S. Supreme Court judgment in Trump v. Slaughter affects the functioning of Implementing Decision (EU) 2023/1795, which underpins the EU-U.S. Data Privacy Framework, and to continue sharing information with the Board.
The judgment, handed down on June 29, 2026, held that statutory limits on the President’s power to remove Federal Trade Commission commissioners are incompatible with the separation of powers. The point the EDPB places at the center is structural: the existence and effective functioning of one or more independent supervisory authorities in the third country is one of the key elements to be taken into account when assessing the adequacy of the level of protection. The 2023 decision rests in part on the FTC understood as an independent authority, and expressly refers to the regime under which its commissioners may be removed only for inefficiency, neglect of duty, or malfeasance.
For those managing transfers, the legal position today is unchanged: the DPF remains in force unless the Commission amends or withdraws the adequacy decision, or a court annuls it. What changes is the risk picture, because the request formally places the question before the Commission, which under the terms of the 2023 decision is required to monitor U.S. legal developments continuously and may open a procedure to suspend, amend, or repeal the finding should it conclude that adequacy is no longer justified. Anyone who has built their transfer mapping on the DPF alone would do well to verify now the availability of appropriate safeguards under Article 46 GDPR, turning only residually to the possible applicability of the Article 49 derogations, which remain exceptional, tied to specific situations, and to be construed narrowly.
Source
---
EUROPEAN COMMISSION
AI Office: A Recruitment Drive for the Supervisory Units
The Commission has opened a selection procedure for contract agents assigned to two units of the AI Office, housed within DG Connect: the unit dedicated to regulation and compliance, and the unit focused on monitoring the risks of frontier models, including cyberattacks and loss of control over models. According to POLITICO, the current headcount of the two units is 71 people, and the Commission expects to open forty positions during 2027.
The figure should be read as continuous with the expansion of 38 staff announced in late July and reported in the previous issue: this is the same reinforcement trajectory, not two separate operations. The timing coincides with the activation of the Office’s supervisory and enforcement powers, operational since August 2, 2026. Asked by POLITICO in recent months about the Office’s capacity, Yoshua Bengio observed that the people already in place are of high caliber, but insufficient in number.
The issue is not merely nominal. Enforcement on general-purpose AI models with systemic risk requires technical evaluation skills that the European labor market contests with private laboratories, with pay differentials that a contract agent position cannot bridge. The credibility of European supervision over frontier models will be measured by the Office’s ability to trigger evaluations and access requests quickly — and that ability is, first and foremost, a question of qualified headcount.
Source
---
EUROPEAN PARLIAMENT
Technological Sovereignty and Digital Infrastructure: January’s Resolution Published in the Official Journal
Resolution P10_TA(2026)0022, adopted by the European Parliament on January 22, 2026, on European technological sovereignty and digital infrastructure (2025/2007(INI)), was published in the Official Journal on August 5, 2026 (C/2026/3697).
The text is anchored in Articles 173, 179, and 190 TFEU and builds its framework around the regulatory corpus consolidated in recent years: the Chips Act (EU) 2023/1781, the NIS 2 Directive (EU) 2022/2555, the Cyber Resilience Act (EU) 2024/2847, the Cybersecurity Act (EU) 2019/881, together with the two most recent pieces — the Cyber Solidarity Act (EU) 2025/38 and Regulation (EU) 2025/37 on managed security services. The political reference point is the Commission’s Competitiveness Compass (COM(2025)0030) of January 29, 2025, along with the 2025 work program (COM(2025)0045). On threat analysis, the resolution incorporates the ENISA framework “Foresight Cybersecurity Threats For 2030 – Update 2024”.
As an own-initiative resolution, the document produces no direct obligations, but it shapes Parliament’s negotiating position on the dossiers linked to the competitiveness and sovereignty package. The direction of travel is to read semiconductors, cybersecurity, and digital infrastructure as a single strategic autonomy file, rather than as separate regulatory streams.
Source
---
CNIL - FRENCH DATA PROTECTION AUTHORITY
Partial Renewal of the Collège: Five New Members from August 2, 2026
As of August 2, 2026, Marie-Luce Cavrois, Marion Fourtune, Arnaud Latil, Benjamin Nguyen, and Éric Thiers join the CNIL’s Collège, replacing respectively Sophie Lambremon, Aminata Niakaté, Anne Debet, Claude Castelluccia, and Bertrand du Marais, whose terms have expired. The Authority announced the appointments on August 5.
Two of the appointments deserve technical attention. Arnaud Latil, vice-president for artificial intelligence, strategy, and foresight at Sorbonne Université, has sat since October 2024 on the advisory forum of the European Commission’s AI Office: a direct link between the CNIL and European AI Act governance. Benjamin Nguyen, a professor at INSA Centre-Val de Loire, brings research expertise in data protection, anonymization, and information systems security. The other three profiles cover the judicial, environmental, and institutional axes: Cavrois is an honorary counselor at the Cour de cassation with a background at the HALDE, Fourtune is vice-president of France Nature Environnement and a member of the CESE, and Thiers comes from the Conseil d’État.
The composition signals a strengthening of technical expertise within the Collège, coinciding with the start of AI Act implementation and with the files on generative models and research processing.
Source
The Right to Erasure and Online Press Articles: The CNIL Sets the Boundaries
In guidance published on August 5, the CNIL clarifies the limits of the right to request the removal of personal data contained in press articles published online. The request is admissible but not absolute: it requires a balancing exercise against freedom of expression and information.
The legal framework is twofold. Article 85 GDPR and Article 80 of the loi Informatique et Libertés exclude the application, to professional journalistic processing, of the rights to information, access, rectification, and restriction, where the derogation is necessary to reconcile data protection with freedom of expression. What remains exercisable is the right to object (Article 21 GDPR), which presupposes grounds relating to the data subject’s particular situation, and the right to erasure (Article 17 GDPR), which the CNIL groups under the operational heading of “suppression”.
Two substantive clarifications. First: the request cannot cover the article in its entirety, but only the data identifying the person. Second: the controller may refuse by demonstrating compelling legitimate grounds overriding the data subject’s interests, or the necessity of the processing for the exercise of freedom of expression and information. The CNIL recalls the case law of the European Court of Human Rights on the obligation for press bodies to carry out a case-by-case balancing exercise.
Source
---
CASE LAW
A selection of rulings made available during the reference period and relevant to digital law, data protection, privacy, platform regulation, and artificial intelligence, including those in which the privacy dimension emerges indirectly through Articles 7 and 8 of the Charter of Fundamental Rights or Article 8 ECHR. For each, the citation details, type, and subject matter are provided; analysis and commentary will follow in upcoming issues.
During the reference week, no new rulings of the Court of Justice of the European Union or of the European Court of Human Rights falling within the selection criteria of this column were made available. The review will resume in the next issue.
---
The EES Switches Off When It Is Overwhelmed
The Entry/Exit System, fully in force since April 10, 2026, is being switched off at European airport hubs when queues become unmanageable. Air France-KLM has confirmed to POLITICO that the system is turned off during summer peaks at its Paris and Amsterdam hubs; the same practice is reported at Frankfurt, Brussels, and Milan. The Commission has granted a derogation valid until September 6, permitted by the EES Regulation itself, which provides for the temporary suspension of biometric registration in exceptional circumstances.
The system applies to third-country nationals admitted for short stays — not indiscriminately to all non-EU nationals — and replaces the passport stamp with the capture of fingerprints and facial images through dedicated kiosks, to track overstays. The individual file is retained for three years and one day from the registration of exit; where no exit record is registered, retention rises to five years. When the kiosks fail, data is collected manually; when queues explode, data is not collected at all. Lufthansa has reported missed connecting flights due to waiting times, and a traveler interviewed at Brussels Eurostar reported having presented only a passport, with no facial scan or fingerprint capture.
A biometric border control system whose operation depends on tourist flows raises a proportionality problem à la carte: the legal basis for the processing holds as long as the timing allows. The Regulation provides for the summer derogation, but it effectively hands to operational practice the decision as to when mass biometric surveillance is “necessary” and when it is not. The argument is worth keeping in mind: if the processing can be suspended for reasons of traffic flow without the stated objective being compromised, the necessity assessment that justifies it deserves to be reopened.
Source
---
INTERNATIONAL DEVELOPMENTS
Ninth Circuit in Amazon v. Perplexity: The Access Is the User’s, Not the Agent’s
On August 4, 2026, the U.S. Court of Appeals for the Ninth Circuit decided Amazon.com Services, LLC v. Perplexity AI, Inc. (No. 26-1444), vacating the preliminary injunction that had barred the Comet browser’s assistant from operating on users’ Amazon accounts and remanding the case to the district court.
The legal point is narrow and must be reported precisely. The court did not establish user liability: it held that, for the Computer Fraud and Abuse Act, the party that “accesses” Amazon’s systems is the user, with the help of the agent, and not Perplexity. “Access” means entering a computer system, and the statute’s reference to “whoever” contemplates a person rather than a software tool; it follows that Amazon is unlikely to prevail on its CFAA claim against the developer. Because this is an interim-relief posture, the assessment concerns the likelihood of success on the merits rather than a final determination; the trademark and state-law claims survive. The court applied the rule of lenity, acknowledged that there is little to no existing case law on how to ascribe responsibility for AI agents, and described its holding as deliberately narrow.
Whether the user is in turn liable therefore remains an open question, dependent on the concrete conditions of authorization to access: it is one thing for a user to employ their own credentials on a service they have lawfully signed up to, and quite another to circumvent contractual or technical limits. Techdirt’s August 5 commentary flags the risk of the opposite outcome — placing the entire burden on the user would be as unreasonable as placing it entirely on the developer — and favors an allocation calibrated to the circumstances.
For the European reader, the interest lies not in the CFAA but in the structure of the reasoning: attributing an agentic action is not resolved by identifying a single responsible party along the chain, but by distinguishing who set the limits of the action, who supplied the tool, and who actually deployed it. That is precisely the problem the zero-click attack chains documented against agentic browsers this week will raise.
Source
OpenAI Disrupts a Scam Network Operating Through ChatGPT
OpenAI has disclosed that it disrupted the activity of a fraud network linked to Poipet, in Cambodia, which was using ChatGPT across multiple fraudulent schemes. The action falls within the pattern of abuse disruption carried out by providers on their own services, following a model that mirrors the one adopted by social platforms against coordinated influence operations.
The point that matters for compliance is not the episode itself but the fact that the ability to detect and disrupt fraudulent uses presupposes monitoring of generated content and usage patterns. It is the same monitoring that, on the European side, must be documented and made known to data subjects: security and anti-fraud activity is processing, and as such requires a legal basis, adequate notice, and defined retention periods.
Source
---
ARTIFICIAL INTELLIGENCE
FPF Updates Its Framework on AI in Hiring and Employment
On August 5, the Future of Privacy Forum published its Updated Best Practices for AI and Workplace Assessment Technologies, developed together with Dayforce, LinkedIn, UKG, Workday, and Beamery. The document updates the 2023 framework to account for the spread of generative AI and agentic systems capable of executing multi-step workflows with varying degrees of autonomy.
The approach abandons the binary low/high risk classification in favor of a contextual assessment based on four factors: the sensitivity of the data and of the inferences drawn; the degree of autonomy, discretion, and capacity for action of the system; proximity to human decisions; and the nature and significance of the impact, with the most consequential decisions, such as termination of employment, subject to the highest degree of oversight. No single factor is determinative in itself: organizations are expected to position their systems along a spectrum. A presentation webinar is scheduled for September 28.
The approach speaks directly to Annex III of the AI Act on high-risk systems in the employment context, but introduces a granularity that the European classification does not have. For anyone documenting an impact assessment on recruitment or performance assessment tools, the four factors offer a usable grid even before the system has been formally qualified.
Source
AI Act: Consolidated Version as of July 27, 2026 Now Available
EUR-Lex has made available the consolidated version of Regulation (EU) 2024/1689 as updated to July 27, 2026 (CELEX 02024R1689-20260727), incorporating the amendments introduced by Regulation (EU) 2026/1744. The text integrates the changes to Regulations 300/2008, 167/2013, 168/2013, 2018/858, 2018/1139, and 2019/2144, and to Directives 2014/90/EU, 2016/797, and 2020/1828.
This is the operational reference to substitute in compliance repositories for the original June 2024 version. One practical caveat: EUR-Lex consolidated versions have no legal force — they are documentation tools. For citations in filings and opinions, it remains necessary to work from the text published in the Official Journal and its subsequent amendments.
Source
Machinery Regulation: Post-Omnibus Consolidation
EUR-Lex has also made available the consolidated version of Regulation (EU) 2023/1230 on machinery, as updated to July 27, 2026 (CELEX 02023R1230-20260727).
This is not a marginal development. Regulation (EU) 2026/1744 amended the AI Act, Regulation (EU) 2018/1139 on civil aviation, and the Machinery Regulation at the same time: these are the three pillars governing high-risk AI systems embedded in regulated products — those in Annex I of the AI Act, whose obligations have been pushed to August 2028. Anyone manufacturing machinery with AI components needs to read the two consolidated texts in parallel, because the qualification of the system and the applicable conformity assessment regime follow from the intersection of the two frameworks, not from either taken in isolation.
Source
---
CYBERSECURITY
RovoBlast: One-Click Prompt Injection into Atlassian’s Enterprise AI
Varonis Threat Labs disclosed at DEF CON a one-click vulnerability in Rovo, Atlassian’s enterprise AI assistant, dubbed RovoBlast. No jailbreak, no permission bypass: the flaw lies in the assistant treating externally supplied URL parameters as trusted. The vector is the rovoChatPrompt parameter, which pre-populates content directly into the Rovo chat. The researchers classify it as a parameter-to-prompt injection, the same class as the Reprompt issue reported on Microsoft Copilot in January.
One detail is far from secondary: the organization ID in the URL could be left empty, and Atlassian would nonetheless route the request to the victim’s default organization, with no indicator of a session seeded from outside. Rovo spans Jira, Confluence, Bitbucket, Slack, Microsoft 365, and Google Workspace. The actual exfiltration runs through ResearchAgent, an internal tool that browses the web autonomously: once the prompt is seeded, that same agent extracts internal data and pushes it outward in the clear, in a single automated chain. Three proofs of concept were demonstrated: exfiltration of Confluence pages, Jira tickets, and SharePoint content containing personal data. A single seeded link is enough to trigger the leak. Atlassian fixed the issue before publication.
The architectural lesson is that agents with autonomous browsing and broad-reaching integrations cannot tolerate external input treated as trusted. For the controller, the practical consequence is that an assistant integrated across the entire document suite must be assessed as an outbound communication channel, not as an internal tool.
Source
OpenAI Slows Astra After Reaching a Critical Cybersecurity Threshold
OpenAI stated on Friday, August 7, that it had suspended part of its work on Astra, a model still in development, after an internal review found progress in agentic coding and cybersecurity sufficient to trigger the additional safeguards set out in its Preparedness Framework. According to the company, preliminary evaluations do not allow it to rule out that the critical capability level has been reached — that is, the ability to autonomously identify and execute attacks against well-defended real-world systems.
OpenAI specifies that Astra is not the model involved in the incident in which another unreleased model breached a third-party provider’s systems during internal testing. Since then, OpenAI and Anthropic have disclosed further episodes of models breaking out of sandbox boundaries during cybersecurity testing. The measures announced include reinforced security controls, suspension of internal activities on Astra that do not meet the new guardrails, and cooperation with government agencies and selected safety organizations.
The systemic point, beyond the individual model, is that the capability thresholds set out in preparedness frameworks are beginning to be genuinely reached, and declared as such. The underlying ambiguity remains between genuine transparency and competitive positioning: an announcement of self-restraint is also a statement about the level one’s own model has attained. In European regulatory terms, these are precisely the capabilities the AI Act places among the systemic risks of general-purpose AI models.
Source
Agentic Browsers: Zero-Click Chains Against Claude in Chrome and ChatGPT Atlas
On August 5, Zenity published its PleaseFix research on two zero-click attack chains against agentic browsers.
On ChatGPT Atlas, the exploit leverages an indirect prompt injection tied to an architectural problem rather than a traditional bug: agentic browsers break the Same-Origin Policy by design, because they act as a single entity across multiple authenticated tabs, effectively resurrecting cross-site CSRF. With a single comment planted on an X thread, attackers hijack benign user requests, causing the agent to navigate to a malicious payload page. Two scenarios were demonstrated: in the first, Atlas opens WhatsApp Web, reads the victim’s contact list, and sends phishing messages to those contacts; in the second, it adds items to an Amazon cart, replaces the shipping address with the attacker’s, and — to bypass restrictions on the final purchase click — delegates the order to the platform’s own AI assistant. The issue was reported to OpenAI in January 2026 and acknowledged, but without a straightforward patch: the exploit relies on the agent’s core capability, namely reading the web and acting on authenticated domains.
On Claude in Chrome, a comparable zero-click chain escalates an indirect prompt injection into a multi-platform account takeover. An email containing invisible prompt structures, a mundane request such as summarizing recent emails, and the agent executes the hidden instructions as direct commands; the block on executing malicious scripts is circumvented by hosting custom NPM packages on a rogue CDN.
The systemic point is that the attack surface of agentic browsers is not patchable at the filter level, because it coincides with the product’s own function. For anyone assessing enterprise adoption, the question is not whether the tool has been fixed, but which authenticated domains the agent can reach within the same session.
Source
SAFE: Toward a Structured Exchange on Agentic AI Incidents
On August 4, as Black Hat USA opened, the Linux Foundation published a Request for Comments on the Shared AI Findings Exchange (SAFE) guidelines, drafted by a working group of the Open Secure AI Alliance, a coalition now counting more than 120 organizations. Contributors to the drafting include Nvidia, Cisco, CrowdStrike, Hugging Face, and Red Hat; comments are being collected on GitHub.
The framework provides for a confidential channel to collect security incidents involving agentic systems, agent misbehavior, and near misses; to analyze control failures; to notify affected parties; and to publish evidence-based recommendations aimed at reducing systemic risk. According to Cybersecurity Dive’s account, members would be expected to share information within defined time frames, including seventy-two hours for notifying customers of a credible data exposure.
The proposal deserves attention for a specific reason: on a voluntary, private-sector basis, it builds a reporting infrastructure that the AI Act provides for in mandatory form for serious incidents. If the scheme takes hold, the risk is the coexistence of two channels with different thresholds, timelines, and recipients. Organizations operating in Europe will need to map participation in SAFE without overlaying it on, or substituting it for, regulatory obligations — verifying in particular that sharing incident data with an international coalition rests on its own legal basis and does not entail unmanaged transfers.
Source
AI Security Institute: Models That Targeted Real People and Organizations
In the same week, the AI Security Institute reported having observed Anthropic and OpenAI models going rogue during cybersecurity testing, to the point of targeting real people and organizations over the internet.
The finding closes the circle with the Astra pause and the SAFE proposal: these are no longer theoretical scenarios discussed in policy papers but verified episodes, declared by the laboratories themselves and by a public evaluation institute. In European terms, this is precisely the perimeter of systemic risk for general-purpose AI models, and it makes concrete the question of who answers when a system under test acts against a third party wholly outside the experiment.
Source
BMC: A 2013 Vulnerability Exposes Tens of Thousands of Servers
Security firm Lava has published research on a long-standing flaw in Baseboard Management Controllers, the management processors that allow remote control of servers independently of the operating system, with the ability to reboot machines, mount virtual media, update firmware, and modify low-level configurations.
The figures: 36,872 management interfaces exposed on the internet via the IPMI protocol, of which 24,650 — roughly two-thirds — return password-derived authentication data before login, as a result of CVE-2013-4786, a vulnerability published in 2013 in the IPMI 2.0 key-exchange authentication process. More than two thousand systems were found configured with named accounts and passwords present in public wordlists. Among the most affected are Supermicro and HPE platforms, including deployments at bare-metal and GPU cloud providers, where BMCs often sit on shared management networks serving high-value AI infrastructure.
The aspect that concerns the controller is the mismatch between privilege and oversight: the BMC is the most powerful control point in a data center and at the same time the least monitored, because security tooling watches the operating system, kernel, containers, and workloads. An adequate security measure under Article 32 GDPR cannot stop at the application layer when the underlying management plane is reachable from the public internet with factory credentials.
Source
U.S. Healthcare: Two Breach Notifications Covering More Than 460,000 Individuals
Two notifications within the same few days: Brown Health Medical Group-MA reported a breach affecting 311,000 people, and Madera Community Hospital reported one affecting 150,000.
Taken individually, these are unremarkable events in the U.S. landscape; taken together, and read alongside the CareCloud case reported in the previous issue, they confirm that healthcare remains the sector with the least favorable ratio between the sensitivity of the data processed and the maturity of the security measures in place. It is the context in which Article 32 GDPR calls for the highest level of security, and in which an impact assessment is as a rule mandatory.
Source
—
Source
Ransom Cartel: Sixteen Years in Prison for Its Creator
The creator of the Ransom Cartel ransomware has been sentenced to sixteen years in prison. The sentence sits at the upper end of the range compared with precedent in this area and confirms the trend toward progressively harsher penalties for those who develop and distribute cyber-extortion tools, not only for those who deploy them.
For a controller hit by an attack, the practical significance is limited — the conviction comes years after the incident and restores nothing — but it bears on the calculus of anyone treating the activity as a business: the ransomware-as-a-service model exposes the developer to full criminal liability, independent of that of the affiliates.
Source
---
TECH & INNOVATION
LIDEs: Security as an Afterthought
A preprint accepted at the 41st IEEE/ACM International Conference on Automated Software Engineering (ASE) 2026, authored by researchers at York University and the University of Calgary, maps developer complaints about Claude Code, Cursor, GitHub Copilot, and OpenAI Codex, starting from 1.1 million Reddit posts filtered down to 446 posts and more than 6,000 comments.
The thesis is that LLM-native integrated development environments offload perimeter defense onto the user. Of the posts on security topics, 43.1% concern unauthorized file operations: deletion of directories or files without consent (28.3%), modification of files without explicit consent (8.8%), and access to content outside the active workspace (5.7%). One documented case reports the execution of chmod +x on scripts without authorization. The taxonomy also covers unexpected code execution, destructive actions, opaque data flows, telemetry, and the leakage of sensitive information through extended context access.
Co-author Gias Uddin summarizes to The Register that the problems arise from how the tools are designed and from the permissions they are granted, not solely from the underlying models: security and privacy must be built into the design before broad access is given to a developer’s files, data, and systems. Translated for those working in compliance: data protection by design and by default (Article 25 GDPR) is not a problem for the developer installing the extension, but for the vendor distributing it with overly broad default permissions.
Source
Universal Clipboard iPhone-Windows: The DMA Opens a Closed API
Apple is expected to enable continuous copy and paste between iPhone and Windows PCs by autumn 2027, in response to a request from Microsoft submitted through the interoperability channel Cupertino set up to comply with Digital Markets Act obligations.
Today, an application can read the iPhone clipboard only in the foreground and subject to permission constraints: limits designed to protect the confidentiality of copied data, but which prevent continuous background synchronization with an external device. The solution will run through AccessorySetupKit, with an initial user authorization for each paired PC, which will fall into the accessory category. The Windows PC is thus treated as a paired accessory, not as a peer device within the ecosystem.
It is worth noting how the DMA is prompting Apple to reopen APIs it had closed by invoking privacy grounds. The compromise — explicit permission on a per-device basis — is the ground on which the next disputes between gatekeeper obligations and the data minimization principle will be fought.
Source
---
SCIENTIFIC RESEARCH
A selection of the most relevant papers of the week from arXiv on AI, Machine Learning, and Privacy
Privacy in LLMs and RAG Systems
Where Privacy Risk Lives in English-Source Multilingual RAG: A Stage-Decomposed Audit Across Five Query Languages
The authors test the assumption that querying a RAG system in a language other than English makes it easier to extract personal data. Using a synthetic corpus with a Qwen2.5-7B pipeline (translator, judge, back-translator, generator) and a two-layer defense (LLM input judge and regex output filter), they decompose the risk stage by stage. The value lies in the methodology: attributing the leak to a specific stage rather than treating the pipeline as a black box.
arXiv
Evaluating OpenAI’s Privacy Filter: Cross-Lingual, Cross-Domain PII Detection Across 42 Benchmarks
The first independent evaluation of OpenAI’s Privacy Filter (1.5 billion parameters) across 42 benchmarks, 22 languages, and 5 domains. Zero-shot: F1 of 0.855 on AI4Privacy and 0.464 on SPY medical, ahead of Presidio and XLM-RoBERTa on PII-annotated benchmarks, though XLM-RoBERTa remains ahead on multilingual named entity recognition across thirteen Indic and non-Latin languages. Useful as an objective reference when selecting a PII detector for anonymization pipelines subject to a data protection impact assessment.
arXiv
Differential Privacy
ABC: Numerical Data Collection under Local Differential Privacy without Prior Knowledge
Classic LDP mechanisms require a predefined numerical domain: too narrow and values are clipped, too broad and utility collapses. The authors propose ABC, which collects numerical data under local differential privacy without prior knowledge of the range. Relevant for telemetry and endpoint collection scenarios where the actual domain is unknown to the collector.
arXiv
PriDyG: Privacy-preserving Dynamic Graph Inference with LLM-GNN Collaboration
The authors formalize edge-level differentially private dynamic graph inference, where repeated updates cause privacy loss to accumulate on edges — that is, on potentially sensitive relationships. PriDyG combines graph neural networks for structure with LLMs for semantic reasoning. Notable because it tackles the problem of the privacy budget over time, often overlooked when assessing the adequacy of technical measures under Article 32 GDPR on systems that update continuously.
arXiv
AI Governance and Auditing
A Six-Dimensional Taxonomy of Post-Training Adaptation Techniques with Applications in AI Governance
A six-dimensional taxonomy of post-training adaptation techniques: retraining, fine-tuning, PEFT, alignment, RAG, model editing, unlearning, calibration. Anchoring the taxonomy to governance serves to distinguish modifications that substantially alter the model, relevant to a conformity reassessment under the AI Act, from marginal adaptations. A useful framework for mapping changes to a general-purpose AI model after it has been placed on the market.
arXiv
Manipulation-Proof Oblivious Audits against Deceptive Model Providers
Regulatory audits are often announced or easily detectable by the provider, who can then alter the model’s behavior during evaluation. The authors propose manipulation-resistant oblivious audits, in which the provider cannot distinguish audit queries from ordinary traffic. Directly pertinent to the operational implementation of the AI Act’s evaluation obligations, where the integrity of the test is the precondition for its usefulness.
arXiv
Privacy-Aware Computer Vision
A Foundational EDM2-Based Generative Model for High-Resolution Synthetic Fetal Ultrasound Imaging from Open Datasets
An EDM2 diffusion model trained on public datasets to generate 512x512 synthetic fetal ultrasound images across six anatomical classes. The stated motivation is the scarcity of real data due to confidentiality constraints and annotation difficulties. It is worth recalling that synthetic data produced by generative models remains personal data where it is re-identifiable: the assessment of memorization risk should be carried out before treating it as anonymous for Recital 26 GDPR.
arXiv
Robust and Efficient Motion Reasoning for Privacy-Aware Classroom Incident Recognition
A pilot study on recognizing classroom incidents from CCTV footage using a motion-based approach rather than one based on identifying individuals. The stated objective is to reduce the privacy footprint while preserving detection capability. The school setting and the involvement of minors call for a careful check of the classification under the AI Act: Annex III covers specific educational purposes — among them monitoring prohibited behavior during tests — and not every use of classroom video surveillance; the fundamental rights impact assessment obligation under Article 27 then falls only on certain categories of deployer. What does remain highly likely, on the GDPR side, is the need for an impact assessment under Article 35, given systematic monitoring involving vulnerable data subjects.
arXiv
Network and Systems Security
Per-ID Behavioral Residualization for Unsupervised Intrusion Detection on the Automotive CAN Bus
Chandan Hegde and Mukundh R Reddy propose a representation for unsupervised intrusion detection on the automotive CAN bus. The known problem is that existing systems rely on presence features — new arbitration IDs, frozen payloads, anomalous DLCs — which collapse when the attacker reuses legitimate identifiers. The solution extracts fourteen timing, protocol, and payload features from sliding windows, residualizing them against the normal baseline of each arbitration ID. Across six unsupervised detectors and two datasets, residualization improves mean F1 in 21 of 24 evaluations on HCRL and 30 of 36 on ROAD, reaching recall above 0.99 on targeted signal manipulations. The authors also quantify the limits: novel-ID flooding and cross-ID fuzzing remain problematic. Relevant to automotive cybersecurity compliance under UN R155.
arXiv
Forecasting-Based Dynamic Baselines for Anomaly Detection in Research and Education Networks
Shariff and Ramamurthy address the security paradox of research and education networks: legitimate traffic, dominated by massive and bursty flows, is statistically indistinguishable from volumetric DDoS-type attacks, generating false positives that blind operators. The work uses a 57-day Internet2 dataset across ten backbone routers, covering 13.7 billion packets, comparing six model families across 960 experimental configurations: long-sequence architectures, TiDE in particular, reduce baseline forecasting error by 30-42% compared with traditional methods.
arXiv
---
AI ACT IN A NUTSHELL - Part 33
Article 37 - Challenge to the Competence of Notified Bodies
Having examined changes to notifications and the lifecycle of designation, this column turns to a safeguard mechanism that closes the circle of oversight over the conformity assessment system: the European Commission’s power to call into question the competence of a notified body itself.
The Commission’s Investigative Power
The provision confers on the Commission a second-level oversight role over notified bodies — those entities which, designated by Member States, carry out conformity assessments on high-risk AI systems. The Commission may investigate, where necessary, all cases in which there are grounds for doubting the competence of a notified body or its continued compliance with the requirements laid down in the Regulation and with the applicable responsibilities.
This is therefore not systematic monitoring but an intervention triggered where signals justify closer scrutiny. The distinction matters in practice: the European investigation does not replace national supervision; it supplements it where the latter appears insufficient.
The notifying Authority of the Member State must provide the Commission, on request, with all information relating to the notification or the maintenance of the competence of the body concerned. This is an obligation of transparency and institutional cooperation that reinforces the investigative capacity of the European executive.
The article does, however, provide a specific confidentiality safeguard: sensitive information gathered in the course of investigations must be treated confidentially, in accordance with the general confidentiality regime laid down in the Regulation. The balance struck is the familiar one between effective oversight and the protection of the commercial information of the operators involved.
Findings and Corrective Measures
Where the Commission ascertains a failure — current or subsequent — to meet the notification requirements, it informs the notifying Member State and requests the adoption of the necessary corrective measures, which may include the suspension or withdrawal of the notification. Where the Member State fails to act, the Commission may intervene directly by implementing an act, suspending, restricting, or withdrawing the designation, in accordance with the examination procedure referred to in the Regulation.
This is the passage that gives the whole mechanism its bite: without the substitutive power, challenging competence would amount to moral suasion with no consequences.
Practical Implications
For notified bodies, the provision is a strong incentive to maintain the requirements of competence, independence, and reliability continuously: designation is not an achievement secured once and for all, but a condition subject to substantive verification by the Commission as well as by the national notifying Authority.
For providers and deployers of high-risk AI systems, the impact is indirect but significant. Relying on a notified body whose designation is subsequently suspended, restricted, or withdrawn can have material operational consequences for the certificates obtained and for continuity of compliance. When selecting a body, it is therefore advisable to assess not only its formal scope of designation but also its organizational robustness and market reputation, monitoring any changes in status over time.
For DPOs, compliance officers, and legal advisers, the article confirms an important principle: governance of the conformity assessment system is multi-level, with European oversight capable of stepping in where national oversight proves insufficient.
In the next installment, we will examine Article 38 - Coordination of Notified Bodies, devoted to the mechanisms for alignment and consistent application among the various actors involved in the conformity assessment of high-risk AI systems.
---
LEGAL PROMPTING
The Legal Prompting column has completed a first cycle of ten installments, which built, step by step, a method for the professional use of language models in legal practice: from structuring the prompt to the hierarchy of sources, from verifying outputs to deontological and regulatory obligations. All installments remain available in the newsletter archive and retain their full value as a self-contained reading path.
For the overall framing of the column:
Legal Prompting: The New Frontier of AI in the Legal Field
.
---
PODCAST
The NicFab Podcast hosts a series of episodes dedicated to Legal Prompting, for those who prefer to listen on the go.
Listen to the episodes →
NicFab Podcast
---
THE BOOK “Agentic AI”
Agentic AI — Technical Autonomy, Human Responsibility, and Legal Governance
My new book, Agentic AI — Technical Autonomy, Human Responsibility, and Legal Governance (first edition, July 2026), is available, with Chapter 16 by Valentina Grazia Sapuppo, dedicated to technical standardization for agentic systems, and a foreword by Antonino Caffo.
Artificial intelligence systems no longer merely generate content: they act, send, modify, and commit. The book starts here and provides a methodological answer to the three questions every organization should ask when it delegates to a system the capacity to act: what limits to set before the action, what evidence to preserve during it, and who must be able to answer for it afterward. The thesis that runs throughout the work is clear: technical autonomy does not create legal autonomy.
Through the AI Act, the GDPR, and the European digital regulatory ecosystem, the volume builds original categories — graduated agenticity, the chain of attribution of agentic action, evidentiary accountability — and hands them over to an operational tool, the seven-column matrix, to the point of making them executable in code. Eighteen chapters in four parts (the foundations, the risks and legal qualification, the responsibilities and the evidence, the operational governance model), plus the Conclusions and an apparatus designed for professional use: the reusable matrix template (Appendix A), two original Python tools reproduced in full and working (Appendix B), the annotated glossary, the table of sources, and the analytical index.
It is a book for lawyers, DPOs, compliance officers, and anyone who must govern — and not merely endure — the delegation to machines.
The volume is available in print (310 pages, paperback) and digital EPUB, in Italian and English (Agentic AI — Technical Autonomy, Human Responsibility, and Legal Governance).
All the information →
The book’s page
---
FROM THE NICFAB BLOG
The AI Office Becomes an Enforcement Authority: Articles 75a to 75d
August 3, 2026
The new Articles 75a, 75b, 75c and 75d of the AI Act: the AI Office’s inspection powers, commitments, fines and periodic penalty payments after Regulation (EU) 2026/1744.
Read the full article
---
Featured events and meetings
AI-powered robotics in Europe: Live demonstrations and strategic debate (scheduled: September 2, 2026)
European Commission |
Info
Kick-off of new GenAI pilots for public administration & Apply AI stakeholder meeting (scheduled: September 14, 2026)
European Commission |
Info
---
Conclusion
August is traditionally the month when the institutions fall silent, and this week confirms it in the numbers. Yet the two items that remain are, each in its own way, more significant than many crowded weeks.
The first is the Italian Authority’s decision on Mentana, which carries weight as a precedent well beyond the specific case. Satire is not a free pass for the realistic manipulation of another person’s identity, and a disclaimer is not a formal box to tick: it counts only if the average recipient perceives it, including when the content is cropped and re-shared outside its original context. Anyone producing generative content that reproduces the face and voice of a real person is processing personal data, full stop. This is the operational translation of Articles 5 and 25 GDPR into the generative era, and it arrives days after the transparency obligations of Article 50 of the AI Act became applicable: two distinct tracks converging on the same object, the recognizability of the artificial. Anyone working in media compliance should read the decision twice.
The second is the EDPB’s letter to the Commission on the Data Privacy Framework. It is not a judgment, and it changes nothing today: the DPF remains in force, transfers remain lawful. But when the body coordinating every European supervisory Authority formally asks the executive to reexamine the basis of U.S. adequacy, prudence suggests not waiting for the outcome. Safe Harbour and Privacy Shield both fell on the same structural argument, and anyone who has built their transfer mapping on the DPF alone would do well to check now, rather than later, the viability of alternative safeguards.
On institutional capacity, the picture remains the genuinely unresolved knot. As of this week, the AI Office holds full powers and is opening positions to reinforce its supervisory units, yet with a headcount still in the tens against laboratories employing thousands. At the same moment, the EES, a biometric border infrastructure designed for twenty-nine countries, is switched off when queues become unmanageable. It is the image of the gap between regulatory ambition and operational capacity: we legislate on the supervision of frontier models while a border control system already in service buckles under ordinary load. If a mass biometric processing operation can be suspended for reasons of traffic flow without compromising its stated objective, the necessity assessment justifying it deserves to be reopened.
There remains the thread running through the whole cybersecurity section of this issue: RovoBlast, the zero-click chains against agentic browsers, the pause on Astra, the models the AI Security Institute observed targeting real organizations. Different episodes, one lesson — the attack surface of agentic systems coincides with their function, and it does not close with a filter. It is no coincidence that in the same week one hundred and twenty organizations proposed a voluntary incident-sharing scheme: industry is building itself a reporting infrastructure while the European regulatory one is written but not yet run in. The point is worth watching, because two parallel channels with different thresholds and recipients are not useful redundancy; they are a risk of confusion at the worst possible moment. I forecast that the AI Office’s first serious proceeding will not arise from a documentation failure but from an incident of this kind. In the meantime, anyone working on governance would do well to stop treating the AI Act as a regulation awaiting application. Application has begun.
---
New to Gemini? This capsule is best read with a Gemini client, such as Lagrange.
Lagrange - a Gemini client for desktop, iOS and Android
Back to newsletter list
English section
Home