NIS 2: in October the 18-month deadline for the adoption of basic security measures by NIS registered and registered subjects in 2025 expires.

WIPO - International trademarks: Saudi Arabia in the Madrid System, it is now possible to des-ignate Saudi territory in registration applications.

EU Court of Justice: in payment services, gross negligence of the customer does not exempt the payment service provider from immediate reimbursement of the amount of an unauthor-ised payment transaction.

AI Act: the first harmonised standard for high-risk AI systems, dedicated to quality management, has been published.

The Italian Data Protection Authority reminds the deadline of 29 October regarding pixel track-ing in emails.

Italian Data Protection Authority: debt collection, the updated version of the vademecum is online. Stop invasive practices such as text messages or pre-recorded phone calls.

European Supervisory Authorities: Q&A on DORA to clarify the classification of incidents related to successful malicious accesses.

Cyber Resilience Act: ENISA FAQs clarify how to report vulnerabilities and incidents through the single European platform.

AI Act in Italy: Decree 179/2026 defines controls, penalties and rules for the use of AI in companies.

Trade secrets: the new Art. 98 IPC includes AI data and training methods.

European Data Protection Board (EDPB): smart glasses require effective transparency even towards passers-by.

White House Accord on “Super Intelligence” and new federal terminology for AI.

AI and Employee Monitoring: New Guidance from the Italian Labour Consultants’ Studies Foundation.

EDPB Guidelines 04/2026: when supervisory authorities should impose gdpr administrative fines and when other corrective measures may apply.

EDPB: Guidelines 3/2025 on the interplay between DSA and GDPR definitively adopted.

EU KIDS Act: New Rules on Age Verification, Safety by Design and Online Protection of Minors.

Artificial Intelligence and Liability: Legislative Decree No. 160/2026 Introduces New Obligations and Risks for Businesses.

National Cybersecurity Agency: NIS Handbook Now Available Online.

Data Act: “Access by Design” Requirements for Data Generated by Connected Products Apply from 12 September 2026.

Cyber Resilience Act: Vulnerability and Severe Incident Reporting Obligations Apply from 11 September 2026.

Negative criminal record certificates and the GDPR: according to the Spanish courts, they do not automatically constitute data relating to criminal convictions and offences under Article 10 GDPR.

European Commission: Cyber Resilience Act – operational guidance published; first reporting obligations apply from 11 September.

Court of Justice of the European Union: freedom of political expression does not automatically justify the use of a reputed trade mark.

Italian National Cybersecurity Agency: document on the transition to post-quantum cryptography.

Supreme Court of Cassation: consent from heirs may not be required for television dramas depicting well-known public figures.

Italian Supreme Court: in proceedings concerning complaints and sanctions before the Italian Data Protection Authority, the Supreme Court clarifies which time limits apply and when they begin to run.

Supreme Court of Cassation: a blog administrator may be held liable for defamation if he or she fails to remove offensive content of which he or she is aware.

Court of Justice of the European Union: corporate transparency and privacy – the Court sets limits on the indiscriminate publication of shareholders’ personal data.

European Commission: first AI Act compliance checks launched, with re-quests for information sent to more than 30 companies.