To help organisations stay on top of the main developments in European digital compliance, Morrison Foerster’s European Digital Regulatory Compliance team reports on some of the main topical digital regulatory and compliance developments that have taken place in the third quarter of 2026.
This report follows our previous updates on European digital regulation and compliance developments for 2024 (Q1, Q2, Q3, Q4), 2025 (Q1, Q2, Q3, Q4), and 2026 (Q1 and Q2)
In this issue, we cover a busy quarter for digital regulation across the EU, UK, and Germany, with a focus on AI, online safety, cybersecurity, and consumer protection. On the AI front, we examine the EU’s new AI Act transparency obligations and revised compliance timelines under the Digital Omnibus, alongside the Commission’s consultation on copyright and AI. In online safety, we explore the proposed EU KIDS Act, which introduces age restrictions and safety-by-design requirements for digital platforms, AI chatbots, and other online services. We also track key developments in cybersecurity and data governance, including new reporting obligations under the EU Cyber Resilience Act, data accessibility requirements under the EU Data Act, and expanding operational resilience and third-party risk oversight in the EU and UK. Finally, we cover Germany’s proposed Digital Media State Treaty, introducing new rules for AI-generated information and media platforms, as well as growing scrutiny of in-game virtual currencies under EU consumer law and the UK’s accelerated implementation of new subscription rules.
EU
4. EU Data Act: Design Obligations for Connected Products and Related Services
5. European Commission Consults on Potential Changes to EU Copyright Rules
7. DORA and Beyond: Third-Party Risk Widens as AI Raises the Stakes
UK
8. UK Operational Resilience: Cloud Giants Overseen, Frontier AI Tests Firms
9. UK DMCCA Update: Subscription Rules Accelerated
Germany
10. Digital Media State Treaty
On 17 September 2026, the European Commission announced its proposal for the EU KIDS Act, a directly applicable Regulation aimed at creating safer online spaces for minors, less fragmentation across the Digital Single Market, reduced compliance burdens, and legal certainty for providers. The proposal follows the Commission’s Special Panel and report on child safety online and complements the Digital Services Act (DSA), including Article 28.
Public feedback on the proposal is open until 3 December 2026 and will feed into legislation discussions in the EU Council and Parliament. Adoption is not expected to occur before 2028.
In relation to the various draft Member State laws now overlapping with the EU KIDS, the European Commission announced on 29 October 2026 that they have postponed any such national initiative for 12 months by applying the notification mechanism for new Member State legislation affecting digital services under Directive (EU) 2015/1535. Exceptions have been made for France and Greece, who notified their legislation prior to the Commission’s proposal. All other Member State national initiatives with legislation covered by the KIDS Act have been delayed for a year to avoid fragmentation. Still, some Member States plan to continue preparing their own legislation to implement at the end of the 12-month pause.
The Digital Omnibus on AI is in force since 27 July 2026. Besides adjusting the AI Act’s compliance timeline, it also introduces substantive changes to the obligations under the AI Act. See our December 2025 analysis for background and our Q2 Update for the final text.
The transparency obligations took effect on 2 August 2026:
The Omnibus also eases implementation, extending simplified compliance with quality management system requirements from microenterprises to SMEs (including start-ups) without partner or linked enterprises and extending selected SME privileges like simplified technical documentation to small mid-caps (SMCs).
Article 5’s prohibited practices have applied since 2 February 2025. The Omnibus adds two further prohibitions, applicable only from 2 December 2026: AI systems generating or manipulating non-consensual intimate material or child sexual abuse material. Providers may not place such systems on the market or put them into service where relevant outputs are intended or reasonably foreseeable without adequate safeguards; deployers may not use AI systems for such purposes.
Further AI Act provisions will enter into force following a staggered approach: From 2 December 2027, high-risk AI requirements will apply to the catalogue of high-risk AI systems in Annex III. From 2 August 2028, the corresponding obligations will also apply to AI systems qualifying as high-risk due to their specific connection with products that subject to any of the EU product rules listed in Annex I.
On 27 July 2026, the European Commission published practical guidance on the implementation of the Cyber Resilience Act (CRA; Regulation (EU) 2024/2847). The CRA establishes mandatory cybersecurity requirements for products with digital elements, including hardware and software. While the Regulation entered into force on 10 December 2024, its obligations apply progressively, with mandatory vulnerability and incident reporting requirements taking effect on 11 September 2026 and most other substantive obligations becoming applicable on 11 December 2027 (see also our Q1 2026 update and our Data Decoded blog post).
Mandatory Vulnerability and Incident Reporting: Since 11 September 2026, manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents affecting the security of their products to the designated Computer Security Incident Response Team (CSIRT) and the European Union Agency for Cybersecurity (ENISA). Importantly, these obligations also apply to all legacy products already placed on the EU market, unlike most other CRA requirements, which generally apply only to products placed on the market from December 2027.
Manufacturers must submit an early warning within 24 hours of becoming aware of a reportable vulnerability or incident, followed by a more detailed notification within 72 hours. Final reporting deadlines differ: for actively exploited vulnerabilities, a final report is generally due within 14 days after a corrective or mitigating measure becomes available; for severe incidents, the deadline is generally one month after the initial notification.
Commission Guidance on Implementation: The Commission’s non-binding guidance addresses several practical questions concerning the CRA’s scope and implementation. In particular, it clarifies when modifications to existing products qualify as “substantial modifications” triggering renewed compliance obligations, how the CRA applies to remote data-processing solutions and free and open-source software, and how manufacturers should determine appropriate product support periods.
The CRA’s substantive obligations will become applicable on 11 December 2027, including cybersecurity risk assessments, product life cycle obligations, technical documentation, conformity assessments, CE marking, and supply-chain obligations. These requirements generally do not apply retroactively to products already placed on the market, subject to certain exceptions, including substantial modifications to software. For physical products however, “placing on the market” occurs separately for each individual unit, rather than for a product line as a whole. Non-compliance may result in fines of up to EUR 15 million or 2.5% of global annual turnover.
Manufacturers should make sure that they have put operational vulnerability and incident reporting procedures in place and use the remaining transition period to assess product coverage, prepare technical documentation and software bills of materials, establish vulnerability-handling processes, and identify applicable conformity assessment requirements.
On 12 September 2026, the design obligations under Article 3 of the EU Data Act (Regulation (EU) 2023/2854) became applicable to connected products and related services placed on the EU market from that date. These requirements aim to ensure that users can access data generated through their use of connected products, such as smart devices, industrial machinery, and connected vehicles, facilitating data sharing and reducing dependence on manufacturers (see also our previous alerts in Q1 2025, Q3 2025, and Q4 2025).
Article 3(1) of the Data Act introduces a “data accessibility by design” obligation, requiring manufacturers to design and manufacture connected products, and providers to design and provide related services, in a manner that makes product data, related service data, and the metadata necessary to interpret and use that data accessible to users. Such data must be made available by default, free of charge, in a comprehensive, structured, commonly used, and machine-readable format. Where relevant and technically feasible, users must be able to access the data directly, continuously, and in real time.
Importantly, the obligation covers both personal and non-personal data generated through the use of connected products and related services, but does not generally extend to inferred or derived data resulting from proprietary analytics. The Data Act also introduces pre-contractual transparency obligations under Article 3(2) and (3), requiring users to be informed about the types and volumes of data generated, how they can access and retrieve that data, and whether data holders intend to use or share it.
The Article 3(1) design obligations apply to connected products and related services placed on the EU market after 12 September 2026, while the Data Act’s broader data access and sharing framework has already applied since September 2025 (see our answers to the “Top 10 Questions About the EU Data Act”). Manufacturers and related service providers should review their product designs, data access mechanisms, and user information to ensure compliance. In January 2026, the EU Commission issued an FAQ on the Data Act—however, as national authorities begin enforcing the new requirements, further guidance on their practical application may emerge.
On September 29, 2026, the European Commission (the “Commission”) launched a targeted consultation on copyright challenges arising from technological and market developments, particularly AI. It follows a May 2026 call for evidence as part of the Commission’s review of the Copyright in the Digital Single Market Directive (Directive (EU) 2019/790) and considerations regarding a potential modernisation of EU copyright rules.
The Commission seeks feedback on four areas:
The consultation also draws on a July 2026 feasibility study recommending an EU-wide register for text and data mining (TDM) rights reservations, combining a central interface with sector-specific registries to let copyright holders register AI-training restrictions and developers check for such restrictions.
Stakeholders, including AI providers, copyright holders, digital intermediaries, and researchers, can submit feedback until 3 (or 10) November 2026 (both dates have been circulated). The Commission will then consider legislative changes, with a potential proposal tentatively scheduled for Q1 2027.
On 30 September 2026, the Consumer Protection Cooperation (CPC) Network, the network of national consumer authorities coordinated by the European Commission, launched coordinated actions in relation to nine video game companies over commercial practices relating to in-game virtual currencies that, in the Network’s view, may breach EU consumer law. In this context, the Network adopted a Joint Statement on stronger consumer protection in video games, which sets out a common approach to protecting gamers’ consumer rights across the EU/EEA market. The actions follow the Network’s March 2025 Key Principles on in-game virtual currencies.
The actions concern the use of in-game virtual currencies in nine games. They aim to ensure that providers show prices in real-world money, avoid practices that obscure costs or push consumers to buy more currency than they need, give clear pre-contractual information, honor the 14-day withdrawal right, use fair and clear terms, and protect vulnerable consumers, particularly minors.
In the Joint Statement, the Network says it will continue to take joint enforcement action where appropriate and calls on all providers in the sector to review their practices. It signals particular attention to variable reward systems, such as loot boxes, especially where children are concerned.
In parallel, the Network is pursuing a separate action against another provider concerning the sale of virtual currencies as well as data collection, addictive design, and marketing to minors, among other issues. According to a press release of the Italian Competition Authority (AGCM) of 8 October 2026, the action seeks to establish whether a “widespread infringement” within the meaning of the CPC Regulation (EU) 2017/2394 has occurred. Broadly, this requires either conduct that has harmed, harms, or is likely to harm the collective interests of consumers in a sufficient number of at least two Member States (excluding the one in which the conduct originated, the trader is established, or evidence or assets are located) or concurrent conduct with common features by the same trader in at least three Member States.
By way of background, the Key Principles cover virtual currencies that consumers buy with real money and use to pay for in-game content or services. They are not binding. They reflect how the Network reads the Unfair Commercial Practices Directive, the Consumer Rights Directive, and the Unfair Contract Terms Directive, as implemented nationally. The current actions grew out of an industry dialogue opened in 2025, which, according to the Commission, did not produce satisfactory results. The games affected by these actions were selected as part of a broad market compliance check, based on their reach, cross-device accessibility, and varied age ratings.
According to the Commission, the Network has opened a dialogue with each of the nine companies; if the concerns are not addressed, national authorities may take enforcement measures. The Commission’s announcements do not specify response deadlines. In the Network’s March 2025 action concerning practices toward minors, the company concerned had one month to respond and propose commitments.
Eighteen months into DORA, EU supervisors spent the third quarter of 2026 widening the operational resilience lens beyond ICT services, while sharpening it on AI-enabled cyber threats.
On 18 September 2026, the European Banking Authority (EBA) published its final Guidelines on the sound management of third-party risk (EBA/GL/2026/09) to replace the existing 2019 Guidelines on outsourcing arrangements. DORA continues to govern ICT services; the Guidelines capture all other third-party arrangements, not just outsourcing, for credit institutions, payment and e-money institutions, and certain investment firms. A single register must cover both regimes, and firms will need to decide where increasingly common “mixed” ICT/non-ICT services fall (see our client alert).
On 7 July 2026, the European Central Bank (ECB) asked all significant institutions for action plans on AI‑enabled cyber threats, alongside a European Systemic Risk Board warning on systemic cyber risk from frontier AI models. Faster patching, enhanced monitoring, and third-party risk management feature among the ECB’s near-term priorities.
The EBA Guidelines’ application date is still to be set, with a two-year transition contemplated for existing arrangements supporting critical or important functions. Firms should start mapping non-ICT suppliers now and reusing their DORA contract remediation playbooks, and suppliers should expect a wave of information requests and contract amendments.
Significant banks have had to meet a 31 October 2026 deadline for their AI action plans, and the ECB has said it will analyse the submitted plans across the sector and share its conclusions.
UK regulators are delving further into financial services supply chains. Four global cloud and technology providers became the first critical third parties subject to direct regulatory oversight. The Financial Conduct Authority (FCA) also reported on how frontier AI is putting pressure on firms’ cyber defenses.
The third quarter of 2026 brought further developments under the UK Digital Markets, Competition and Consumers Act 2024 (DMCCA), with the UK government accelerating implementation of the new subscription contracts regime and signalling additional regulation of misleading pricing practices.
In August, the government announced that the DMCCA’s new subscription contracts regime will come into force in January 2027, bringing implementation forward from the previously expected spring 2027 timetable. The regime will require businesses to provide clearer information before consumers subscribe, issue renewal reminders, and make cancellation straightforward. Consumers will also benefit from a new 14-day cooling-off period following the renewal of certain trial or long‑term subscriptions.
The government also announced plans to consult on adding certain misleading discount practices—including fake “was” prices, invented discounts, and misleading recommended retail prices—to the DMCCA’s list of commercial practices that are automatically prohibited.
Businesses offering consumer subscriptions should prioritise implementation ahead of January 2027, including reviewing sign-up and renewal journeys, reminder mechanisms, cooling-off processes, and cancellation functionality. Secondary legislation and further government guidance are still expected ahead of commencement. More broadly, CMA enforcement activity indicates that pricing transparency, subscription practices, and online consumer journeys remain priority areas for the CMA (see Microsoft: consumer protection enforcement case and Trainline, Virgin Atlantic and RED Driving School investigated for drip pricing). With the CMA now able to impose fines of up to 10% of worldwide turnover or GBP 300,000 (whichever is higher) for DMCCA infringements, businesses should continue to test their customer-facing practices against the DMCCA.
Germany is moving forward with a major update to its media regulation. On 28 September 2026, the Broadcasting Commission of the German federal states published a discussion draft of the new Digital Media State Treaty.
The proposal introduces a new regulatory category for “AI information systems”, covering services that generate individualised content for users based on editorial third-party offers. The draft establishes that providers of such systems are responsible for generated content. Systems reaching at least one million monthly users in Germany would face additional journalistic and transparency obligations, including requirements to explain how the system works, disclose sources, indicate the likelihood of accuracy of statements concerning news and political information, provide for a right of reply, and refrain from discriminating against third-party journalistic content.
In implementation of the European Media Freedom Act, the draft also comprehensively reforms media concentration rules. Currently limited to television and bound to audience shares, the rules would expand to distributors across private media. Advertising and sales revenues of at least EUR 4 billion would trigger a review of a provider’s dominant influence on public opinion, and mergers and ownership changes in the media market reaching this threshold collectively would require prior notification and approval.
Further proposals include:
The public consultation runs until 13 November 2026. Once it closes, the submissions will be assessed by the governments of Germany’s 16 federal states. Once the federal states have agreed on the treaty’s final text, it will be signed by all heads of government and subsequently submitted to their respective state parliaments for ratification.
The current German Interstate Media Treaty (Medienstaatsvertrag) is, in principle, governed by the country-of-origin principle, which is firmly established in EU law. Accordingly, many of its provisions apply only to service providers established in Germany. However, the treaty already provides for significant exceptions by applying the market-location principle to media intermediaries, media platforms, and user interfaces. The proposed DMStV would extend this approach to the newly introduced category of “AI information systems”. These services would therefore fall within the scope of the relevant provisions even if their providers were established outside Germany, provided that the services were intended for use in Germany.
The EU Commission has previously taken the view that the Interstate Media Treaty’s departure from the country-of-origin principle is incompatible with the E-Commerce Directive. Whether the proposed extension will draw further objections remains to be seen.
Leon Feldman (Singapore Trainee Solicitor) and Rayna Malhotra (Berlin Intern) contributed to the drafting of these alerts.