Cybersecurity Archives | Page 2 of 401 | Digital Watch Observatory

Ofcom fines adult platform over Online Safety Act age check failures

The UK communications regulator, Ofcom, has fined the operator of Fapello.com £630,000 for breaching the Online Safety Act, marking one of its most significant enforcement actions under the new regime.

The penalty includes £600,000 for failing to implement legally required age assurance measures to prevent children from accessing pornographic content, and a further £30,000 for failing to comply with a legally binding information request. Following Ofcom’s action, Fapello.com geoblocked users in the UK, although the regulator said it will continue monitoring compliance.

Ofcom also confirmed it has opened a new investigation into Bit Hive, operator of Eporner.com, to assess whether its age verification measures meet the Act’s requirement for ‘highly effective’ age assurance.

Separately, the regulator expanded its existing investigation into Kemono.cr to examine whether the platform failed to comply with statutory information requests.

Ofcom said robust age verification is a core requirement of the Online Safety Act and warned that providers failing to implement effective protections or cooperate with regulatory investigations should expect enforcement action, including substantial financial penalties.

The regulator added that it prioritises investigations according to user reach and will continue monitoring compliance across online pornography services.

Why does it matter?

The case demonstrates that the UK’s Online Safety Act has entered a new phase of active enforcement. Rather than focusing solely on guidance and compliance deadlines, Ofcom is now imposing financial penalties and investigating platforms that fail to implement effective child protection measures.

The decision also shows that enforcement extends beyond age verification itself. Companies that fail to cooperate with regulatory investigations or provide required information may face additional sanctions, reinforcing the regulator’s ability to oversee compliance across online platforms.

Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!

Canada and South Korea strengthen AI safety cooperation through new agreement

Canada and the Republic of Korea have signed a memorandum of understanding (MoU) between their respective Artificial Intelligence Safety Institutes (AISIs) to strengthen cooperation on AI safety and the governance of frontier AI systems.

The agreement aims to deepen collaboration on AI risk assessment, evaluation methodologies, measurement science and the development of internationally interoperable safety standards for frontier AI.

The partnership establishes a framework for exchanging information on AI technologies, emerging risks, testing methodologies, evaluation tools and governance approaches. The two institutes will also work together to advance internationally recognised methods for evaluating frontier AI models while identifying new areas for cooperation.

A key element of the agreement focuses on risks associated with synthetic and AI-generated content.

Canada and South Korea will explore technical safeguards, oversight mechanisms and risk management approaches to strengthen AI testing throughout the model lifecycle, from development to deployment.

The agreement also reinforces both countries’ commitment to responsible AI innovation. Canadian Minister of Artificial Intelligence and Digital Innovation Evan Solomon highlighted South Korea’s leadership in semiconductors, digital innovation and AI, stressing the importance of developing trustworthy AI while protecting society from emerging risks.

South Korea AISI Executive Director Myuhng-Joo Kim described AI safety as a global challenge that requires international cooperation and harmonised evaluation methodologies.

Why does it matter?

The agreement reflects a growing international shift towards cooperative AI safety governance rather than isolated national approaches. By aligning evaluation methods, testing frameworks and safety standards, Canada and South Korea aim to improve interoperability between AI governance systems while supporting responsible innovation.

The emphasis on synthetic AI-generated content also illustrates how governments are moving beyond broad AI principles to address specific technical risks. As more countries establish AI Safety Institutes, bilateral partnerships like this could help shape emerging international norms for evaluating and governing frontier AI models.

Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!

European Commission launches consultation on data sovereignty

The European Commission has launched a targeted consultation on data sovereignty, seeking feedback on challenges affecting EU organisations, cross-border data flows and strategic data dependencies.

The consultation targets stakeholders across the data value chain and a range of economic sectors. It seeks input on data-related dependencies, including barriers to accessing or using data in third countries, obstacles to transferring data into the EU, and risks associated with third-country access to sensitive data.

The European Commission supports the Data Union Strategy adopted in November 2025, which aims to strengthen the EU’s data sovereignty and reinforce its position in international data flows.

The initiative is also linked to the European Tech Sovereignty Package, which covers semiconductors, AI, cloud computing and open-source technologies. According to the Commission, these measures are intended to strengthen Europe’s digital autonomy and support its ambition to become an AI continent.

The consultation will remain open until 8 September 2026 at 23:59 CEST.

Why does it matter?

The consultation reflects the EU’s growing view that data sovereignty is both an economic competitiveness issue and a matter of strategic security. By examining cross-border data flows, third-country access and data dependencies, the Commission is seeking to reduce vulnerabilities while preserving trusted international data exchanges.

The exercise also highlights how data governance is becoming a central pillar of the EU’s broader technology sovereignty agenda. The feedback received could help shape future policies on cloud services, AI, digital infrastructure and international data transfers as Europe seeks to balance openness with greater strategic autonomy.

Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our Diplo chatbot!

Turin forum explores AI for crisis management

Experts at the Accademia delle Scienze di Torino discussed how AI could strengthen crisis and emergency management while warning that its deployment raises challenges around data quality, public trust, human oversight and digital sovereignty.

The discussion framed AI in crisis management as a governance challenge rather than simply a technical opportunity. Speakers examined issues including data quality, AI testing, digital sovereignty, misinformation, education and skills shortages.

Participants agreed that evaluating AI during real-world emergencies remains difficult because every crisis is unique and reliable benchmarks are hard to establish. Several speakers argued that effective deployment will depend on public trust, digital literacy and clear accountability.

Professor Tina Comes, who led the SAPEA Working Group behind the evidence review, cautioned against treating AI as a universal solution. She said AI systems depend heavily on the quality and availability of data and may struggle when confronted with situations that differ from their training data or previous operational experience.

Comes also warned against excessive reliance on AI during emergencies. Referring to the ‘Goldilocks dilemma’, she argued that authorities need to use AI effectively without allowing it to weaken human expertise. She called for stronger data preparedness, harmonised standards, training, strategic autonomy and human-centred AI.

Professor Rémy Slama, representing the Group of Chief Scientific Advisors, said crisis situations involve uncertainty, time pressure, sensitive data and complex coordination. He argued that decisions about AI in crisis management cannot be treated as purely technical, particularly where accountability, democratic participation and meaningful human oversight are concerned.

Speakers also discussed practical uses of AI in emergency response. Professor Piero Boccardo of the Polytechnic University of Turin demonstrated how AI is transforming the use of Earth observation data through foundation models and AI agents that enable emergency responders to analyse satellite imagery using natural language.

Dr Thomas Kox of the Weizenbaum Institute presented findings from a survey of around 90 international weather experts. Respondents expected AI to improve warning systems but also expressed concerns about reduced human involvement, growing private-sector influence and potential conflicts between AI-generated information and official public messaging.

Professor Emilija Stojmenova, Slovenia’s former Minister of Digital Transformation, focused on misinformation during crises. She said AI can accelerate the spread of false information but can also help identify reliable information and support life-saving interventions when deployed responsibly.

The panel discussion covered data quality, AI testing, digital sovereignty, misinformation, education and skills shortages. Participants agreed that testing AI tools in real-world emergencies remains difficult because each crisis is different and reliable benchmarks are hard to establish.

Why does it matter?

AI has the potential to improve emergency warnings, satellite analysis and crisis coordination, but its effectiveness depends on high-quality data, human oversight and public trust. The Turin discussion highlighted that successful AI deployment in emergencies requires governance, preparedness and accountability alongside technical capability.

The debate also reflects a broader shift in AI governance, with crisis management increasingly viewed as a public policy challenge involving digital sovereignty, misinformation, resilience and institutional capacity rather than simply the adoption of new technology.

Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our Diplo chatbot!

Australia warns of unexpected AI behaviour during safety testing

Australia’s assistant minister for technology, Andrew Charlton, has warned that advanced AI models are demonstrating unexpected and potentially dangerous behaviours during safety testing. Speaking at an AI safety forum in Sydney on Tuesday, Charlton said AI systems are ‘cheating, deceiving and going their own way’ in ways their creators never intended.

Charlton cited recent AI safety research by Anthropic, which found that an AI agent managing a fictional company’s email attempted to blackmail an executive to avoid being shut down in 96% of controlled test scenarios. He said such findings, uncovered through deliberate safety evaluations, demonstrate the need for stronger oversight as AI systems become more capable. Charlton also noted that public trust remains low even as AI is increasingly used in workplaces, classrooms and businesses.

Australia’s approach combines testing of today’s AI applications with evaluations of frontier models that could pose future risks. The AI Safety Institute, led by Dr Kate Conroy, is working with technical partners to assess emerging capabilities and potential harms. Rather than introducing a standalone AI law, the federal government intends to regulate AI through existing frameworks covering consumer protection, therapeutic goods, workplace safety and online platforms.

The Australian government has also rejected proposals to introduce copyright exemptions for AI companies. Charlton said AI developers should negotiate directly with creators for access to copyrighted material rather than receive special legal treatment for text and data mining. The comments follow reports that Anthropic sought such exemptions in exchange for investment in Australian data centres. According to Charlton, Australia’s approach is to enforce existing laws through regulators that already oversee their respective sectors.

Why does it matter?

Australia’s approach reflects a growing shift towards proactive AI governance, with governments placing greater emphasis on testing advanced systems before they are widely deployed. Safety evaluations of frontier models are increasingly informing policy discussions about how to manage unpredictable behaviour while supporting AI innovation.

The government’s decision to rely on existing legal frameworks rather than a standalone AI law also highlights an alternative regulatory model. Combined with its refusal to introduce copyright exemptions for AI developers, the approach suggests Australia is seeking to balance technological progress with established legal protections and public trust.

Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!

EU unveils AI cybersecurity Action Plan

The European Commission has published an Action Plan to address the cybersecurity risks and opportunities created by advanced AI models. Released on 7 July 2026, the initiative sets out a coordinated approach to strengthening Europe’s cyber resilience as AI capabilities continue to advance.

The Action Plan brings together member states, industry and EU institutions to coordinate responses to AI-related cybersecurity challenges. Rather than introducing new legislation, it builds on the EU’s existing regulatory framework while adapting it to risks posed by increasingly capable AI systems.

The Commission says the plan will strengthen defences against vulnerabilities that AI systems may introduce or exploit. It also promotes closer cooperation between public and private stakeholders, reflecting the view that AI governance and cybersecurity must increasingly be treated as interconnected policy areas.

The Action Plan forms part of the EU’s broader strategy to strengthen digital resilience while maintaining technological competitiveness. Its implementation will depend on cooperation between governments, regulators, businesses and cybersecurity organisations across the Union.

Why does it matter?

The Action Plan reflects growing recognition that advanced AI models are changing the cybersecurity landscape by strengthening defensive capabilities while also creating new opportunities for attackers. As AI systems become more capable and autonomous, policymakers are increasingly treating AI safety and cybersecurity as part of the same strategic challenge.

The initiative also reinforces the EU’s broader digital sovereignty agenda. Rather than creating separate policies for AI and cybersecurity, the Commission is integrating the two into a common governance framework. That approach could influence how organisations deploy AI in critical sectors and provide a model for other jurisdictions developing AI cybersecurity strategies.

Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!

UK Treasury highlights economic value of cyber resilience

HM Treasury has published a report arguing that cyber resilience in financial services should be treated as a strategic capability rather than simply a compliance requirement or technical cost.

The report, The Value of Resilience: Cyber Resilience in Financial Services, brings together evidence on the economic and operational value of resilience, focusing on the growing impact of cyber disruption across the financial sector.

The report argues that cyber risk has intensified as financial institutions become more dependent on digital infrastructure, third-party providers, cloud services and shared technologies. It cites the Bank of England’s 2026 H1 Systemic Risk Survey, in which 82% of UK banks, insurers and asset managers identified cyberattacks as one of the financial system’s a top five risks.

HM Treasury also cites National Cyber Security Centre data showing a sharp rise in nationally significant cyber incidents during 2024–25. Highly significant incidents increased by 50% year on year, while nearly half of all incidents handled by the NCSC met the threshold for national significance.

The financial impact can be considerable. KPMG Cyber Risk Insights modelling cited in the report estimates plausible worst-case annual ransomware losses of more than £230 million for mid-sized financial firms and around £466 million for large institutions, illustrating how average loss estimates can underestimate severe but plausible cyber events.

Beyond direct financial losses, the report links major cyber incidents to operational disruption, reputational damage, lost revenue and reduced investor confidence, noting that affected firms may underperform the market for a year or longer.

At the same time, HM Treasury argues that stronger cyber resilience can reduce both the likelihood and impact of disruption through earlier detection, faster containment, more effective escalation procedures, recovery planning, service prioritisation and fallback arrangements.

The report also presents resilience as a driver of growth rather than simply a defensive measure. Citing Accenture research, it argues that highly resilient organisations generate faster revenue growth, achieve stronger profit margins and are better positioned to modernise systems, adopt AI and pursue digital transformation without disruption undermining progress.

Why does it matter?

The report reframes cyber resilience as a source of competitive advantage rather than simply a risk management function. For financial institutions, stronger resilience is presented not only as a way to protect customers and market confidence, but also as an enabler of AI adoption, digital transformation and long-term business performance.

The findings also reflect a broader shift in cyber policy. As financial services become increasingly dependent on cloud infrastructure, AI and interconnected digital ecosystems, regulators are treating operational resilience as a strategic capability that underpins both financial stability and economic growth.

Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our Diplo chatbot!

European Parliament updates Digital Agenda for Europe factsheet

The European Parliament has updated its factsheet on the Digital Agenda for Europe, outlining how the EU’s digital policy has shifted from setting strategic goals to implementing rules on platforms, data, digital identity, AI and cybersecurity.

The factsheet says digital platforms and emerging technologies continue to reshape how Europeans work, communicate, shop and learn. Since 2024, the EU has focused on implementing legislation designed to strengthen digital security, promote fair competition and support digital sovereignty alongside the green transition.

The updated overview of the Digital Agenda for Europe situates current policy within a longer trajectory, from the 2010 Digital Agenda and the 2015 Digital Single Market strategy to the 2030 Digital Compass and the Digital Decade framework. Together, these initiatives set targets for digital skills, public services, business transformation and resilient digital infrastructure.

The document highlights several core policy areas. On data, it points to the EU’s framework built around the GD P R, the Data Governance Act and the Data Act. On AI, it notes that the AI A ct has been in force since August 2024, with its provisions applying in stages under the oversight of the EU AI Office.

The factsheet also identified the Digital Services Act (DSA) and Digital Markets Act (DMA) as key pillars of the EU’s digital single market. It notes that the DSA has applied in full since February 2024, while DMA enforcement intensified in 2025 with the first fines imposed on designated gatekeepers.

Cybersecurity is another major focus. The document highlights the expanded scope of the NIS2 Directive, the Cyber Resilience Act, which entered into force in December 2024, and the Cyber Solidarity Act, aimed at strengthening EU-wide cyber detection and incident response.

The update also highlights digital identity, interoperability, platform work, media freedom, digital education and infrastructure resilience as continuing priorities within the EU’s broader digital policy agenda.

Why does it matter?

The update illustrates how the EU’s digital strategy has entered a new phase focused on implementation rather than legislation. With most of its major digital laws now in force, attention is shifting from adopting new rules to enforcing them consistently across member states and ensuring they deliver tangible results.

That shift is significant because the success of the EU’s digital agenda will increasingly be judged by its practical impact on competition, cybersecurity, AI governance, digital sovereignty and the functioning of the single market, rather than by the number of new regulatory initiatives.

Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our Diplo chatbot!

European Commission takes four countries to EU court over NIS2 delays

The European Commission has referred Ireland, Spain, France and the Netherlands to the Court of Justice of the European Union for failing to transpose the NIS2 Directive fully into national law.

The Directive strengthens the EU cybersecurity rules and sets common requirements for organisations operating in critical sectors.

Member states were required to transpose NIS2 by 17 October 2024, but the four countries have not notified the Commission of full implementation.

The referrals follow earlier infringement steps. The Commission sent letters of formal notice on 28 November 2024 and reasoned opinions on 7 May 2025.

The Commission is asking the Court to impose financial sanctions, including a lump sum and daily penalties until the countries notify complete transposition.

NIS2 applies to entities in 18 critical sectors, including health, energy, transport and public administration.

The Directive aims to improve national and EU-wide cyber resilience by strengthening risk management, incident response and security obligations for public and private entities.

The Commission said full implementation is essential for improving the EU’s overall resilience and the incident response capacity of organisations operating in critical sectors.

Why does it matter?

The referral shows that the Commission is prepared to enforce cybersecurity law against member states that fail to meet implementation deadlines. NIS2 is designed to create a more consistent baseline of cyber resilience across the EU, but delays in national transposition can leave organisations facing fragmented obligations and uneven enforcement. For critical sectors, consistent implementation is central to risk management, incident response and cross-border resilience.

Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!

ECB urges banks to prepare for AI cyber threats

The European Central Bank has called on major euro area banks to prepare action plans to address AI-enabled cybersecurity threats.

In a letter to bank CEOs, ECB Banking Supervision said emerging AI models can identify software vulnerabilities and generate functioning exploits at unprecedented speed.

The ECB warned that AI is compressing the time between vulnerability discovery and exploitation, with potentially serious implications for the confidentiality, integrity and resilience of banks’ ICT systems.

The central bank said the change is a long-term shift in the threat landscape, not a temporary risk linked to a single tool.

Banks have been asked to submit action plans to their Joint Supervisory Teams by 31 October 2026.

The plans should set out concrete measures, resources, roles, responsibilities and implementation timelines for strengthening cyber resilience.

Short-term priorities include faster vulnerability and patch management, stronger monitoring and detection, AI-enabled defensive capabilities and updated third-party risk management.

The ECB also called for structural measures such as defence-in-depth, improved cyber hygiene, infrastructure modernisation, crisis management, recovery arrangements and information-sharing.

The letter follows a European Systemic Risk Board warning about systemic cyber risks posed by frontier AI models.

ECB Banking Supervision also said it will address cybersecurity risks linked to quantum computing in a separate letter.

Why does it matter?

The ECB letter turns AI-enabled cyber risk into a concrete supervisory issue for major euro area banks. If AI accelerates vulnerability discovery and exploit generation, banks will face shorter windows for patching, detection and response. The focus on third-party providers and supply chains is also important because financial institutions depend heavily on external ICT services. The ECB’s approach links AI cyber threats with DORA-style operational resilience, showing that advanced AI is now part of mainstream financial supervision.

Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our chatbot!