Cybersecurity

Prime Minister Modi promotes human-centred AI governance at G7

Prime Minister Narendra Modi called for a human-centric approach to AI development while addressing a G7 Summit outreach session focused on the safe, rapid and efficient deployment of AI.

Modi said AI has the potential to reshape human civilisation but should be guided by principles of inclusivity, security and the public good. He highlighted India’s human-centric ‘MANAV’ vision for AI and referenced the country’s recent AI Impact Summit as part of its broader efforts to promote responsible AI development.

The Prime Minister of India said democratic countries should have access to advanced AI models capable of protecting critical information infrastructure and supporting responses to cybersecurity threats. He also called for an integrated approach that addresses safety, speed and efficiency together.

He argued that AI systems should be safe by design, supported by common standards and regulatory frameworks, and reinforced through international cooperation to address challenges such as deepfakes, misinformation and cyber fraud. The remarks were delivered at the G7 Summit in Evian, France.

Why does it matter?

Modi’s remarks reflect a growing international effort to shape AI governance around principles of safety, trust and public benefit. As governments seek to harness AI’s economic and societal potential, questions around security, misinformation, critical infrastructure protection and equitable access are becoming central to global policy discussions.

The intervention also highlights the increasing role of middle and emerging powers in AI governance debates. By promoting a human-centric approach and calling for common standards and international cooperation, India is positioning itself as an active participant in efforts to shape global norms for AI development and deployment.

Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot! 

Ireland strengthens AML framework with focus on crypto-asset risks

Ireland has launched a new National Risk Assessment and a 30-point action plan aimed at strengthening its response to money laundering, terrorist financing, and proliferation financing risks. The framework identifies crypto-assets as a significant emerging vulnerability, reflecting their increasing use in complex and cross-border financial crime schemes.

The action plan introduces enhanced safeguards for digital finance, including stricter due diligence requirements when crypto-assets are used as a source of funds. The Gambling Regulatory Authority of Ireland has been tasked with developing standards to ensure firms verify the legitimacy and origin of crypto-related funds, with implementation expected by 2027.

Authorities also plan to strengthen supervisory powers, improve transparency around beneficial ownership and enhance coordination between financial crime and tax enforcement bodies. The approach targets evolving criminal methods combining cash-based laundering with digital tools, including crypto-assets and cross-border layering techniques.

The initiative also forms part of Ireland’s preparation for its 2028 international anti-money laundering evaluation.

Why does it matter?

The new framework reflects a broader regulatory shift toward treating crypto-assets as embedded components of financial crime risk rather than isolated instruments. By integrating digital asset controls into its AML framework, Ireland is improving detection of hybrid laundering schemes combining cash flows with blockchain transfers and aligning with international assessments.

Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our chatbot!

Meta expands AI-powered teen safety protections across its platforms

Meta has announced new teen safety updates across Instagram, Facebook, and Messenger, including expanded age-appropriate content settings, AI-powered age detection, and new parental notification tools.

Meta said the updates are designed to ensure teens receive appropriate protections by default, give parents greater visibility into online activity and strengthen safeguards that support young people’s well-being.

Meta said its 13+ default content setting, recently introduced in India, is now rolling out globally across Instagram, Facebook, and Messenger. The setting is designed to limit exposure to age-inappropriate content by default, drawing on established content-rating principles and parent feedback.

On Facebook, the 13+ default setting is intended to hide content considered inappropriate for teens in areas such as Feed and Reels. It also limits teens’ ability to interact with Profiles, Pages, Groups, and Events that primarily post inappropriate content.

On Messenger, the 13+ default setting limits teens’ ability to view links to inappropriate Facebook content or chat with accounts that primarily share it.

Meta is also expanding its use of AI-powered age estimation systems to identify accounts that may belong to underage users. The company said the system analyses profile context, including birthday celebrations, school-grade mentions, posts, comments, bios, and captions, to assess whether an account is likely to belong to someone underage.

The company said it is adding visual analysis as another detection technique. According to Meta, the technology analyses photos and videos for general indicators associated with age, such as physical characteristics, but does not identify individuals and does not use facial recognition.

Meta said combining visual signals with text and interaction analysis could increase the number of underage accounts it identifies and removes. The technology will be expanded across additional parts of its apps, including Instagram Reels, Instagram Live, and Facebook Groups.

Instagram will also notify supervising parents if a teen repeatedly searches for terms related to suicide or self-harm within a short period, subject to supervision settings. Meta said the feature has been rolled out to supervising parents in the EU, Brazil, and India, with parents and teens receiving notifications that the alerts are on the way.

Parents using supervision can now manage their teens’ activity through Meta’s Family Center across Instagram, Meta Horizon, Facebook, and Messenger. Meta said parents will also be able to see a more holistic view of teen activity across its apps in the coming months, including aggregated time spent.

Why does it matter?

The announcement reflects a broader shift towards age-appropriate design, where platforms increasingly rely on default protections and automated systems rather than expecting young users or parents to configure safety settings themselves. AI-based age detection is becoming a central tool in efforts to identify underage users and enforce platform safeguards at scale.

The update also highlights ongoing debates about the balance between child protection, privacy and platform accountability. While automated age-estimation technologies may help improve online safety, regulators and civil society groups continue to scrutinise their accuracy, transparency and potential impact on users’ rights. As governments around the world consider stricter child online safety requirements, platform approaches such as Meta’s may influence future regulatory expectations.

Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our Diplo chatbot!

EDPS and EU data protection officers focus on AI, cybersecurity and compliance

The European Data Protection Supervisor (EDPS) and data protection officers (DPOs) from EU institutions, bodies, offices and agencies met in Brussels on 18 June to discuss emerging data protection priorities and compliance challenges.

The 58th meeting of the EDPS-DPO network was hosted by the Executive Agencies of the European Commission. The meeting brought together DPOs from across the EU administration at a time of significant regulatory and technological change.

European Data Protection Supervisor Wojciech Wiewiórowski opened the meeting by emphasising the importance of safeguarding DPO independence in practice. He pointed to recent EDPS action, guidance, and procedures intended to safeguard the role of DPOs across EU institutions.

Wiewiórowski also reviewed key developments from 2025, including the closure of the EDPS investigation into the European Commission’s use of Microsoft 365, a rise in complaints, and the growing impact of AI-generated submissions. He noted that regulatory simplification should reduce unnecessary administrative burdens without undermining fundamental rights protections.

Thomas Zerdick, Head of the EDPS Supervision and Enforcement Unit, introduced a follow-up tracker designed to maintain continuity between EDPS-DPO meetings. The first tracker focused on EDPS supervisory guidance on the role of DPOs in EU institutions and the EDPS decision on prior consent to DPO dismissal.

Zerdick also presented recent developments in supervision and enforcement, including complaint handling, compliance issues affecting several EU institutions, and practical guidance on international transfers and data protection impact assessments. The update also covered work linked to the Area of Freedom, Security and Justice, including audits, opinions, and preparations for upcoming systems.

Luis Velasco, Head of the EDPS Technology and Privacy Unit, outlined initiatives to help EU institutions meet compliance requirements for automated systems and AI. He announced that an updated version of the EDPS guidance on risk management for AI systems is expected to be published later this summer.

Velasco also referred to a practical checklist on human intervention, intended to help organisations establish effective safeguards for automated systems. He warned that cyberattacks targeting EU institutions pose a growing threat and pose serious risks to individuals’ personal data.

The discussion also addressed the response to a personal data breach. Velasco stressed that individuals affected by a personal data breach should be informed without undue delay when a breach is likely to pose a high risk to their rights and freedoms.

A practical workshop focused on developing a common data protection impact assessment template under the EU Data Protection Regulation. Participants tested a draft template through a case study and discussed issues, including necessity, proportionality, and risk assessment.

The afternoon sessions included a discussion of the 2024 data breach at the European Agency for Law Enforcement Training. The CEPOL DPO and the EDPS Data Breach Notification Team shared lessons with the wider DPO community, highlighting that major data breaches create organisational and human challenges as well as compliance obligations.

The meeting also included a session on privacy and data protection case law, presented by Zerdick. The session focused on the EDPS’s interpretation of recent judgments and their practical implications for supervisory work and controllers.

Participants also received an update on the EDPS Website Compliance Awareness Campaign. Following pilot phases in 2024 and 2025, the Technology and Privacy Unit presented preliminary findings from the first wave of the campaign’s second phase, which involved automated scans of public-facing websites of EU institutions.

The EDPS said the meeting demonstrated the value of bringing together the EU’s DPO community to address shared challenges, exchange practical experience and strengthen compliance across institutions. The discussions focused on practical cooperation, support for compliance, and stronger data protection safeguards across the EU administration.

Why does it matter?

The meeting highlights how data protection within EU institutions is evolving beyond traditional compliance issues toward broader challenges involving AI governance, cybersecurity, automated decision-making and digital service oversight. As public administrations increasingly adopt AI-enabled systems and process larger volumes of personal data, data protection officers are playing a more strategic role in managing operational and regulatory risks.

The discussions also illustrate a growing emphasis on practical implementation. Common templates, coordinated guidance and shared lessons from data breaches can help institutions apply data protection rules more consistently across the EU administration. This is particularly important as regulators seek to align privacy requirements with emerging frameworks governing AI, cybersecurity and digital public services.

Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our Diplo chatbot!

Sweden warns of growing criminal exploitation of digital payment systems

Sweden’s financial regulator, Finansinspektionen, has warned that organised criminal networks are increasingly exploiting weaknesses in payment systems and digital banking infrastructure. The assessment points to a more challenging risk environment driven by faster transactions, cross-border financial flows and increasing technological complexity.

Financial institutions across the Nordic region are expected to adopt more proactive and intelligence-led compliance approaches.

Retail banks remain primary targets because of their high transaction volumes and role in the initial placement of illicit funds. Criminals rely on shell companies and layered ownership structures to conceal beneficial ownership and bypass standard due diligence.

Regulators now expect stronger analytical capabilities and more robust identity verification processes, particularly within automated onboarding systems that may be vulnerable to fraud and mule-account creation.

Payment service providers and crypto-asset platforms are facing increased scrutiny because they enable the rapid movement of funds across jurisdictions. Authorities stress that real-time screening is now essential, as post-transaction analysis is no longer sufficient.

Crypto-related risks are amplified by mixing tools and decentralised systems, requiring strict origin-of-wealth checks and full compliance with travel rule standards.

Supervisory findings also highlight risks from professional enablers and compromised SMEs used to bypass controls. Insider involvement and distressed businesses can mask illicit activity through seemingly legitimate operations.

Finansinspektionen said stronger sanctions screening, continuous monitoring, and executive-level compliance oversight are essential to address evolving money laundering and illicit financing risks.

Why does it matter? 

The warning reflects a broader shift in financial crime, where criminal organisations increasingly exploit the speed, scale and interconnected nature of modern financial systems. As digital payments, instant transfers and crypto-assets become more widely used, traditional compliance approaches based on retrospective reviews may struggle to keep pace with rapidly moving illicit funds.

The assessment also highlights the growing convergence of financial regulation, cybersecurity and digital governance. Financial institutions are increasingly expected to deploy advanced analytics, real-time monitoring and stronger identity verification controls to detect criminal activity before transactions are completed. Similar regulatory trends are emerging across Europe and other jurisdictions as authorities seek to strengthen resilience against money laundering, fraud and sanctions evasion.

Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our chatbot!  

Japan and Australia deepen cybersecurity cooperation through policy dialogue

Japan and Australia held their seventh Cyber Policy Dialogue in Tokyo on 18 June, bringing together senior government officials to discuss cybersecurity strategy, emerging technologies and bilateral cooperation.

The whole-of-government meeting was co-chaired by Miyake Fumito, Japan’s Ambassador in charge of Cyber Policy and Deputy Director-General of the Foreign Policy Bureau at the Ministry of Foreign Affairs, and Jessica Hunter, Australia’s Ambassador for Cyber Affairs and Critical Technology at the Department of Foreign Affairs and Trade.

Officials from Japan’s Ministry of Foreign Affairs, National Cybersecurity Office, National Police Agency, Ministry of Defence, Ministry of Internal Affairs and Communications, and Ministry of Economy, Trade and Industry took part in the dialogue.

Australia was represented by officials from the Department of Foreign Affairs and Trade, the Department of Industry, the Australian Signals Directorate’s Australian Cyber Security Centre and the Department of Home Affairs.

The dialogue followed Japan’s enactment of the Cyber Response Capability Strengthening Act and the adoption of a new national Cybersecurity Strategy, providing an opportunity for both sides to exchange views on evolving cyber policy frameworks. Both sides exchanged views on their respective cybersecurity strategies and policies, as well as cooperation at bilateral and multilateral levels.

The meeting also built on the Japan-Australia Strategic Cyber Partnership, which Japanese Prime Minister Takaichi Sanae and Australian Prime Minister Anthony Albanese agreed to launch during their May summit.

Discussions covered defence and deterrence against cyber threats, capacity-building initiatives, public-private partnerships, AI-related security challenges and broader cybersecurity cooperation. Both governments reaffirmed their commitment to continued cooperation on cyber issues through bilateral mechanisms, including the Japan-Australia Cyber Policy Dialogue.

Why does it matter?

The dialogue reflects the growing strategic importance of cybersecurity in the Indo-Pacific region. As cyber threats increasingly target governments, critical infrastructure and advanced technologies, countries are placing greater emphasis on international cooperation to strengthen resilience, share expertise and coordinate responses to emerging risks.

The inclusion of AI alongside traditional cybersecurity issues also highlights the changing nature of digital security. AI is becoming both a tool for cyber defence and a potential source of new threats, making policy coordination increasingly important. Closer cooperation between Japan and Australia may help strengthen regional cybersecurity governance while supporting broader efforts to address technological and security challenges in multilateral forums.

Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our Diplo chatbot!

NCSC urges action after Fortinet firewall and VPN credential leak

The UK National Cyber Security Centre has urged organisations using Fortinet services to investigate whether they have been affected by a global campaign targeting firewalls and VPN gateways.

The NCSC said Fortinet firewalls and VPN gateways have been targeted globally, with some indications of potential impact in the UK. A threat actor has leaked a database of credentials following brute-force, dictionary and credential stuffing attempts against internet-facing FortiGate and VPN portals.

UK organisations using Fortinet edge devices with SSL VPN enabled have been advised to check whether their domains may be affected and to investigate potentially malicious activity on their devices.

The NCSC said organisations should review logs for indicators of compromise, including unauthorised account creation and unexpected activity. Where evidence of compromise exists, affected devices should be isolated from the internet and internal networks.

The agency also warned that changing credentials alone may not be sufficient if attackers have gained persistence on a device. It recommends factory resetting compromised devices after collecting logs, configurations and other investigation artefacts.

Organisations are also advised to investigate other edge devices that share credentials with compromised systems and to monitor reachable devices for signs of onward compromise.

The NCSC said organisations should harden recommissioned systems by ensuring management interfaces are not exposed to the internet, updating to the latest version, removing unsupported systems, changing default or reused administrator passwords and enforcing multi-factor authentication on VPN and device management logins.

Why does it matter?

The alert highlights how stolen or reused credentials can compromise perimeter security infrastructure. Firewalls and VPN gateways are high-value targets because a successful compromise can give attackers a route into internal networks. The NCSC guidance also shows why basic cyber hygiene matters: exposed management interfaces, reused passwords, unsupported systems and missing multi-factor authentication can turn credential leaks into wider network compromise.

Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!

AI reshapes capital markets as efficiency gains meet governance challenges

AI is rapidly transforming capital markets, moving beyond experimental pilots and into core financial infrastructure. Trading systems, cloud-native platforms and machine-learning tools are reshaping liquidity formation, price discovery and operational workflows.

International institutions increasingly view AI adoption not only as a driver of productivity but also as a governance challenge affecting market integrity, transparency, and trust.

The European Stability Mechanism reports a sharp rise in electronic trading across sovereign and supranational bond markets, with electronic volumes reaching around 60% and executed trades accounting for up to 80% of activity. The European Securities and Markets Authority (ESMA) highlights AI’s role in enhancing market intelligence through the analysis of unstructured data, including news flows and market sentiment signals.

Meanwhile, the European Central Bank (ECB) estimates that AI could reduce trading execution costs by 20% to 30%. Despite efficiency gains, risks persist, including amplified volatility, reduced explainability of trading decisions, and increased exposure to cybersecurity threats.

The World Bank Group demonstrates how AI can be embedded across treasury functions through in-house systems such as SHASTRA and ASTRA, which automate bond data processing, investor targeting, and validation workflows.

Developed using existing infrastructure, these tools reduce operational costs, improve accuracy and allow staff to focus on higher-value activities. The approach also reflects a broader institutional preference for maintaining human oversight in all high-impact decisions.

Looking ahead, capital markets are expected to become increasingly automated, with AI-driven trading, distributed ledger technologies and advanced compliance systems operating within more stringent regulatory frameworks. Frameworks such as the European Union AI Act are reinforcing expectations around data governance and model transparency.

Why does it matter? 

AI is becoming a foundational technology in financial markets, influencing how assets are traded, priced and monitored. By improving data analysis, automating workflows and reducing transaction costs, AI has the potential to increase market efficiency and liquidity while helping institutions process growing volumes of information.

However, the shift also creates new governance challenges. As financial decisions become more dependent on complex AI models, regulators and market participants must address issues related to transparency, explainability, cybersecurity and systemic risk. The evolution of AI in capital markets therefore raises broader questions about how innovation can be balanced with financial stability, accountability and trust in increasingly automated financial systems.

Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our chatbot!

Spain’s data protection authority issues privacy guidance for video game industry

The Spanish Data Protection Agency (AEPD) has published a new guide outlining data protection recommendations for the video game industry, urging companies to embed privacy safeguards throughout the entire game lifecycle.

According to the AEPD, modern video games have evolved into complex digital ecosystems that collect, analyse and process significant volumes of personal data. This may include account information, gameplay activity, behavioural data and other user-generated information, creating potential privacy and security risks.

The guide notes that AI-enabled and online gaming services increasingly rely on data-driven business models, making compliance with the General Data Protection Regulation (GDPR) particularly important. The agency emphasised that privacy protections are especially important for children and other vulnerable groups, given their significant participation in online gaming environments.

The recommendations span the entire development process, from pre-production and design to post-launch operations, covering transparency obligations, data minimisation, profiling controls and cybersecurity measures. Privacy and responsible data practices should be integrated into games from design through to end-of-life in Spain.

Why does it matter?

The guidance reflects the growing importance of data protection in the gaming industry as video games increasingly function as connected digital platforms rather than standalone entertainment products. Online services, in-game economies, AI-powered features and behavioural analytics have expanded the volume and sensitivity of personal data processed by game developers and publishers.

The recommendations also highlight broader regulatory concerns around children’s privacy and responsible data use. As gaming platforms become more immersive and data-driven, regulators are placing greater emphasis on privacy-by-design principles, transparency and user control. The AEPD’s guidance signals that compliance with data protection rules is becoming an integral part of game development, not simply a legal requirement applied after products are launched.

Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot! 

Ottawa strengthens role in quantum computing and cybersecurity research

Researchers and technology experts in Ottawa are contributing to advances in quantum computing, a technology that could transform fields such as drug discovery, clean energy and space exploration by solving highly complex problems beyond the reach of many conventional computers.

Researchers said quantum computing could accelerate scientific discovery and enable breakthroughs that may eventually translate into practical applications across a range of industries. However, the technology also presents significant cybersecurity challenges, as sufficiently advanced quantum computers could eventually undermine widely used encryption methods that protect digital communications and online services.

The University of Ottawa is conducting research into quantum communications and cryptography aimed at developing security technologies capable of withstanding future quantum-enabled threats. Researchers are working to better understand the fundamentals of quantum mechanics and future security systems.

Industry representatives said Ottawa’s concentration of cryptographic expertise has helped establish this city in Canada as an important centre for quantum cybersecurity research and innovation.

Why does it matter?

Quantum computing has the potential to become one of the most transformative technologies of the coming decades. Its ability to process certain types of complex calculations far more efficiently than conventional computers could accelerate advances in areas such as materials science, pharmaceuticals, energy systems and scientific research.

At the same time, quantum technologies present a major cybersecurity challenge. Many of today’s encryption systems were designed for classical computers and could become vulnerable to future quantum attacks. As a result, governments, universities and technology companies are investing in quantum-safe cryptography and secure communications. Ottawa’s growing role in quantum research reflects a broader international effort to prepare for both the opportunities and security implications of the quantum era.

Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot! 

Diplo chatbot can make mistakes. Consider checking important information.