Alston & Bird Privacy, Cyber & Data Strategy Blog

European Commission Publishes New Guidelines and Code of Practice on GenAI Transparency

By , and

On July 20, 2026, the European Commission (EC) published new Guidelines on Transparency of AI-Generated Content (available here) to complement the Code of Practice on Transparency of AI-Generated Content it released on June 10, 2026 (available here). The materials arrive just weeks before the AI Act’s transparency obligations take effect on August 2, 2026, and give businesses clearer direction on how to identify, label, and disclose AI-generated content in practice. For companies with EU … [Read more] about European Commission Publishes New Guidelines and Code of Practice on GenAI Transparency

CMMC Phase II is Suspended, but Defense Contractors’ Cybersecurity Obligations are Not

By , , and

The Department of Defense (“DOD”) has announced the immediate suspension of the Cybersecurity Maturity Model Certification (CMMC) Phase II requirements, which were scheduled to take effect on November 10, 2026. This announcement is significant … [Read more] about CMMC Phase II is Suspended, but Defense Contractors’ Cybersecurity Obligations are Not

EU Regulators Outline GDPR Requirements for AI Web Scraping

By , and

On July 8, 2026, the European Data Protection Board (“EDPB”), the body that coordinates the EU’s national data protection authorities, published its first draft of Guidelines 03/2026 on web scraping in the context of generative AI (the “Guidelines”). … [Read more] about EU Regulators Outline GDPR Requirements for AI Web Scraping

The White House’s Gold Eagle Initiative Signals a New Phase in AI Enabled Cyber Defense

By and

The White House has launched “Gold Eagle,” a new cybersecurity vulnerability coordination clearinghouse designed to use advanced AI capabilities to accelerate how the government and industry identify, prioritize, verify, and remediate software … [Read more] about The White House’s Gold Eagle Initiative Signals a New Phase in AI Enabled Cyber Defense

DROP Is Coming Due: What California’s Delete Act Means for Data Brokers in August

By

Beginning August 1, 2026, data brokers must begin accessing California’s Delete Request and Opt-Out Platform (“DROP”) at least once every 45 days to retrieve and process consumer deletion requests, as the consumer-facing launch transitions to … [Read more] about DROP Is Coming Due: What California’s Delete Act Means for Data Brokers in August