Regulatory Watch Wednesday — EU General/Consumer Protection

March 25, 2026

AI Act: Omnibus Amendments Advance

The EU is advancing "Omnibus" amendments to postpone high-risk AI system rules:

• Parliament position (March 2026): MEPs voted 101-9-8 to delay high-risk rules to December 2, 2027 (biometrics, employment, law enforcement) and August 2, 2028 (sector-specific). Plenary vote scheduled for March 26, 2026.
• Council mandate (March 13): Aligns on timelines and bans AI "nudifier" systems creating non-consensual sexually explicit deepfakes.
• Watermarking: Extension proposed to November 2, 2026.
• Consumer protection: New bans on "nudifier" deepfakes directly protect dignity and privacy.

Civil society groups urge retaining strict standards and rejecting changes that could weaken GDPR data definitions or AI literacy obligations.

GDPR

No major new developments this week. The AI Act amendments aim to preserve GDPR standards without weakening personal data definitions or automated decision-making rules.

DSA/DMA Enforcement Ramping Up

DMA Updates: - March 10: First non-compliance decisions against Apple (App Store steering) and Alphabet (Android self-preferencing) — proposing €1.2B combined fines. - February 10: Amazon investigated for Prime bundling. - February 28: Meta appeals rejected. - March 20: Booking.com added as potential gatekeeper for hotel bookings.

DSA Updates: - March 17: TikTok fined €225M for child safety breaches (inadequate age verification). - January 15: X (Twitter) fined €100M for disinformation transparency failures. - Ongoing: 12 active DMA cases; DSA systemic risk reports due April 17.

Cumulative fines: DSA >€1.8B; DMA >€3B since 2024.

European Accessibility Act

The EAA transposition deadline was June 28, 2025 — enforcement is now active. Key points:

• Full applicability to new products/services since June 28, 2025
• Standards align with EN 301 549 (harmonized with WCAG 2.2)
• Market surveillance targeting non-compliant businesses in banking, e-commerce, transport
• Pre-2025 contracts have transitional period until June 2030

Businesses should prioritize accessibility audits and publish remediation roadmaps.

What to Watch

• March 26: AI Act Omnibus plenary vote
• April 17: DSA systemic risk reports due from VLOPs
• Q2 2026: Additional DMA fines expected (potential €5B+)

Questions or suggestions? Reply to this email.

Regulatory Watch — EU General/Consumer Protection