The EU AI Act’s provisions have started to apply, including those relating to prohibited AI systems and general-purpose AI models (GPAIM). The bulk of the remaining obligations take effect on 2 August 2026, and authorities...more
The Italian Law No. 132/2025 on rules applicable to AI systems and models (‘Italian AI Law’) took effect October 10, 2025. It aims to integrate and implement the broader European AI regulatory framework (EU AI Act) by...more
10/16/2025
/ Artificial Intelligence ,
Clinical Trials ,
Cybersecurity ,
Data Protection ,
EU ,
Healthcare ,
Intellectual Property Protection ,
Italy ,
New Legislation ,
Popular ,
Regulatory Requirements ,
Research and Development
This Essential Guide is part of Orrick’s Cybersecurity & Privacy Compass Series. The Cybersecurity & Privacy Compass is your global guide to the evolving cybersecurity and privacy regulatory landscape.
...more
10/13/2025
/ Cloud Computing ,
Cybersecurity ,
Data Privacy ,
Data Protection ,
EU ,
European Commission ,
General Data Protection Regulation (GDPR) ,
Information Technology ,
Internet of Things ,
New Legislation ,
Regulatory Requirements ,
SaaS
In this guide, we answer key questions about the European Data Act, which became applicable on 12 September, including what the Data Act covers, who is impacted and what businesses should do to comply....more
9/12/2025
/ Cloud Computing ,
Cloud Service Providers (CSPs) ,
Connected Items ,
Critical Infrastructure Sectors ,
Cybersecurity ,
Data Management ,
Data Privacy ,
Data Protection ,
Data-Sharing ,
EU ,
Information Technology ,
Internet of Things ,
Regulatory Requirements ,
SaaS
When a downstream actor modifies or fine-tunes a general-purpose AI model (GPAIM), who bears the burden of complying with the EU AI Act — the original provider, the modifier or both? ...more
9/11/2025
/ Artificial Intelligence ,
Compliance Management Systems ,
Contract Terms ,
EU ,
European Commission ,
Innovative Technology ,
Machine Learning ,
New Legislation ,
Open Source Software ,
Regulatory Oversight ,
Regulatory Requirements ,
Risk Management
The European Commission published guidelines concerning the definition of “general-purpose AI models” (GPAI) under the AI Act and the scope of the Chapter V obligations imposed on providers of these models. The final...more
In our continuing coverage of the EU Artificial Intelligence Act, co-hosts Jerry Buckley and Caroline Stapleton are joined by Orrick partners Shannon Yavorsky and Julia Apostle. The conversation explores how companies can...more
The UK’s Data (Use and Access ) Act 2025 (“DUA Act”), which received royal assent on 19 June 2025, represents a significant reform to UK data law and reflects Britain’s ambition to spur tech innovation by freeing up the flow...more
The EU Commission has adopted Directive (EU) 2024/2853, which implements a comprehensive overhaul of the 1985 Directive 85/374/EEC on defective product liability (“New PLD”). The new framework, which complements Regulation...more
6/17/2025
/ Artificial Intelligence ,
Consumer Protection Laws ,
Corporate Counsel ,
Digital Goods ,
EU Directive ,
Liability ,
Manufacturers ,
New Legislation ,
Product Defects ,
Regulatory Reform ,
Software
The European Commission published guidelines that clarify the definition of AI systems under the AI Act, analyzing each component of the definition of AI system, providing examples and specifying which systems should be...more
The European Data Protection Board's (EDPB) Opinion 28/2024 provides valuable insights into the intersection of artificial intelligence and data protection, particularly in the context of compliance with the EU General Data...more
The European Data Protection Board (EDPB) has issued an opinion on certain data protection aspects related to processing personal data in AI models. The opinion came after the Irish supervisory authority raised questions to...more
Country Status Legislation* Commentary Austria Available here Austria has submitted the “Network and Information Security Act” for Parliament’s consideration. It is anticipated that the “Network and Information Security Act”...more
This update is part of our EU AI Act Series. Learn more about the EU AI Act here. Developers and users of AI systems subject to the EU AI Act must adopt AI literacy measures by 2 February 2025. The Act requires them “to...more
A court in Hamburg, Germany, has decided a copyright infringement case in a way that sheds light on how European courts may apply the text and data mining (TDM) exemption to AI model developers. The exemption is contained in...more
This update is part of our EU AI Act Series. Learn more about the EU AI Act here. Like other companies, startups that develop, use or commercialize AI systems or general-purpose AI models (GPAIMs) that people in the EU use...more
This update is part of our EU AI Act Series. Learn more about the EU AI Act here. The EU AI Act has been formally adopted and the countdown to the start of enforcement has begun. Here are six steps you can take to jump start...more
This update is part of our EU AI Act Series. Learn more about the EU AI Act here. The EU AI Act imposes obligations on providers, importers, distributors and deployers of AI systems and General-Purpose AI Models (GPAIMs). ...more
This update is part of our EU AI Act Series. Learn more about the EU AI Act here. The EU AI Act only regulates certain covered AI-related technologies — AI systems and General-Purpose AI Models (GPAIMs)....more
This update is part of our EU AI Act Series. Learn more about the EU AI Act here. The European AI Act has been formally adopted and the countdown to the start of enforcement has begun. ...more
This update is part of our EU AI Act Series. Learn more about the EU AI Act here. Life sciences and digital health companies face obligations under the AI Act that vary depending on how they use AI – and the level of risk...more
This update is part of our EU AI Act Series. Learn more about the EU AI Act here. The EU AI Act has been formally adopted and the countdown to the start of enforcement has begun. ...more
What’s Happening? The European AI Act has been formally adopted and the countdown to the start of enforcement has begun. The AI Act sets out general principles regarding when its provisions become effective. Still, there are...more
This Essential Guide to the European Data Act is part of Orrick's Cybersecurity & Privacy Compass Series. The Cybersecurity & Privacy Compass is your global guide to the evolving cybersecurity and privacy regulatory...more
For more information about France’s SREN law, see our update that provides five key takeaways for businesses. Two new laws impose an array of obligations and restrictions on cloud providers in France. First, the European...more