EU AI regulation

The Oldest AI Law Is Already Being Enforced: GDPR and the Automated Decision

June 14, 2026 by Basil C. Puglisi 1 Comment

Most organizations treat GDPR as a cookie-banner problem settled years ago. It is the oldest law on the books that directly governs automated decisions about people, and in 2026 it is one of the most active. This unit maps the Article 22 exposure, the SCHUFA ruling, the 2026 enforcement action, and the records that turn the risk into a defensible position.

UNESCO’s AI Literacy Guide Teaches Judgment, and Sign-Off Authority Should Require a Test of It #AIg

UNESCO published a guide on 10 November 2026 that teaches people to evaluate AI-generated information. Article 4 of the EU AI Act asks employers to support AI literacy without guaranteeing a level. A recorded competence check for each sign-off holder closes the gap.

An AI Agent’s Test Scope Needs a Named Signer Before the First Run #AIg

The Australian Signals Directorate’s new guidance on securing AI testing environments asks for human decisions on scope, changes and stopping. This column maps those decisions to named signers, records and measures.

Australia’s Planned Frontier AI Incident Reporting Still Depends on a Decision Inside Each Company #AIg

Australia announced mandatory protections for frontier AI companies, including a regulator, independent evaluation, and rapid incident notification. Each obligation still depends on a named person inside the company who classifies, signs, and decides whether to continue.

Courts Are Ordering AI Chat Histories Produced, and Deletion Logs Are Now in Dispute #AIg

A Florida federal court allowed discovery of a defendant’s AI conversations in a damages dispute and then ordered consent for providers to release deletion logs. Retention tools are Responsible AI, and the records decision belongs to a named human under AI Governance.

A Draft Taxonomy of Attacks on AI Agents Leaves Risk Tolerance to Each Organization #AIg

NIST’s November 9 draft taxonomy of attacks on AI agents says guardrails must face adaptive attackers, yet it sets no risk tolerance. Each organization needs a named human to sign the residual risk decision for every relevant attack type.

A UK Bill Clause on AI Agent Loss of Control Assumes Someone Held the Control. Can You Show Who? #AIg

The UK government tabled a clause letting regulations give ministers investigatory and enforcement powers when a regulated system’s compromise traces to loss of control of an AI agent. A loss-of-control rule assumes someone held control, so operators should be able to show who held stop authority before any incident.

Europe Plans to Assess AI Literacy in 15-Year-Olds. Who Holds the Checkpoint at School? #AIg

The European Commission will pilot an AI Literacy Certificate for 15-year-olds in the 2027/2028 school year. The framework behind it teaches pupils to set their own checkpoints; the school still needs a named person who signs which AI tools pupils use.