UK and EU advance AI oversight and digital regulation

UK and European authorities advanced digital regulation in October 2026, spanning AI governance, privacy, cybersecurity and platform accountability. The Council of the EU agreed the proposed Digital Omnibus VII legislative package, affecting GDPR, the ePrivacy Directive and cyber reporting obligations. The EN 18286:2026 quality management standard for EU AI Act regulatory purposes was published in the OJEU.

The ICO published a report on applying data protection law to generative AI and foundation models, alongside a call for evidence on agentic AI. The CMA, FCA, ICO and Ofcom issued a joint statement addressing agentic AI regulation, liability and expectations. The FCA outlined good practices and areas for improvement in financial services, while the Law Society provided guidance on existing professional duties when using AI. The UK government accepted the healthcare AI commission’s recommendations in full.

Platform oversight also intensified. Ofcom opened an investigation into Instagram Instants over illegal content and children’s risk assessment duties. The CMA began examining whether Meta’s commercial terms abuse its dominant position, including provisions concerning AI training. Separately, the Law Commission launched a consultation on extending UK product liability law to software, AI systems, online marketplaces and social media design features.