Earlier this month, the U.S. Cybersecurity and Infrastructure Security Agency (“CISA”) announced a series of public town hall meetings to solicit additional stakeholder input on the Notice of Proposed Rulemaking (“Proposed Rule”) implementing the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (“CIRCIA”), which CISA published in April 2024.
Background
CIRCIA established two
The Ninth Circuit partially reversed an order certifying multiple state‑law classes in litigation alleging that certain Ford Super Duty trucks suffer from a steering defect. See Lessin et al. v. Ford Motor Co., No. 25‑2211 (9th Cir. Feb. 11, 2026). While the Ninth Circuit affirmed parts of the class certification order, it held that the
On February 18, 2026, the European Data Protection Board (“EDPB”) published its Report on Stakeholder Event on Anonymisation and Pseudonymisation of 12 December 2025 (the “Report”). The Report summarises feedback from a remote stakeholder event convened to inform the EDPB’s ongoing work on Guidelines 01/2025 on Pseudonymisation (version for public consultation available here
The Connecticut Office of the Attorney General (“OAG”) issued an updated Enforcement Report (“Enforcement Report”) under the Connecticut Data Privacy Act (“CTDPA”). The Enforcement Report discusses the OAG’s enforcement actions in 2025 and suggests some areas of focus from the regulator, summarized below.
On January 23, 2026, the Office of Management and Budget (OMB) issued Memorandum M-26-05 “Adopting a Risk-based Approach to Software and Hardware Security,” which rescinds a previous Biden Administration’s requirement for all federal agencies to obtain a self-attestation from software producers in the “Common Form” developed by the Cybersecurity and Infrastructure Security Agency
Although an uncommon step, defendants in putative class actions in some jurisdictions may move to deny class certification before discovery begins if the complaint’s proposed class is facially deficient. A successful motion forces plaintiffs to proceed individually, reducing a defendant’s exposure and eliminating costly discovery into issues of class certification. But district courts have yet
The UK Medicines and Healthcare products Regulatory Agency (“MHRA”) has published a targeted consultation on the indefinite recognition of the CE-mark for medical devices placed on the market in Great Britain (“GB”) (i.e., England, Scotland and Wales) (the “Consultation”), which will run until 10 April 2026. The Consultation aims to complement wider planned reforms to
In a recent addition to the EU’s evolving digital rulebook, the European Commission has published a set of Guidelines under the European Media Freedom Act (“EMFA”). The Guidelines advise very large online platforms, as defined under the Digital Services Act (“DSA”), on how to set up a functionality that lets media organisations identify themselves—and, in
In June 2025, the European Parliament (“EP”) published its draft report on “Copyright and generative artificial intelligence – opportunities and challenges” (available here). The draft report calls on the European Commission to make a series of changes to the way that copyright is protected in the age of generative AI (“GenAI”). The EP notes
On February 11, 2026, the European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) (jointly, the Authorities) issued a Joint Opinion on the European Commission’s proposed Digital Omnibus Regulation (Digital Omnibus). This follows their Joint Opinion of January 20, 2026 on the Digital Omnibus on AI.
The Digital Omnibus, as with