May and June saw continued movement across the EU’s digital policy agenda, with institutional work progressing on several fronts. Consultations on the upcoming Digital Networks Act gained pace, with a call for evidence launched on 6 June and open until 11 July, for which EuroISPA has prepared its own submission. Data protection also remained high on the agenda, as the GDPR enforcement package advanced through the legislative process and preparations began for a dedicated implementation dialogue with stakeholders. Work on data retention is also ongoing, with the Commission seeking input from stakeholders throughout the summer.
Among content-related developments, the Commission requested clarification on Italy’s Piracy Shield, raising concerns about its alignment with the DSA and the risk of overblocking. Other developments included continued parliamentary discussions on generative AI and copyright, and the presentation of the EU’s International Digital Strategy, which emphasised the importance of global partnerships in key areas such as cybersecurity, AI and connectivity.
The EuroISPA Secretariat has been closely monitoring these developments and continues to gather input from members to ensure their engagement across key consultation processes, with all relevant deadlines listed in the “Recent and ongoing activities” section at the end of this newsletter.
Finally, an important highlight for EuroISPA in the past month was also the second General Meeting of the year, hosted by FFT in Paris.
ONLINE CONTENT
Denmark publishes its new CSAR compromise text
In their compromise text from 1 July, to be discussed during the Law Enforcement Working Party of 11 July, the Danish Presidency introduced several key changes, the most significant one regarding the removal of the voluntary detection from the long-term Regulation, shifting responsibility entirely onto detection orders issued through judicial or administrative processes. At the same time, the Regulation significantly strengthens safeguards around encryption, detection technologies, and user rights. On E2EE particularly, the new draft clearly prohibits any requirement to decrypt or weaken encryption and introduces consent-based pre-transmission scanning as a condition for detection in encrypted environments. More precisely on encryption, orders may only apply to encrypted services if detection occurs before transmission and with the explicit consent of the user. Providers must allow non-consenting users to continue using parts of the service that do not involve the transmission of visual content or URLs. Overall, the proposal resembles strongly the Belgian one – including reinforced procedural checks and a narrower detection scope.
Commission questions legality of Italy’s Piracy Shield under the DSA
In a letter dated 13 June to the Italian Communications Authority (AGCOM), the European Commission raised concerns about Italy’s anti-piracy tool, the Piracy Shield, requesting further clarification. The Commission argued that the DSA does not provide a legal basis for national authorities to issue content removal orders, nor does it specify how such orders should be enforced. It also warned that the current Italian framework could lead to overblocking. Additionally, the Commission stressed third parties affected by the streaming of illegal online content and users of the services must be involved in tackling the issue.
Implementing regulation on harmonised transparency reporting under the DSA now in effect
On 1 July the Commission’s implementing regulation on harmonised transparency reporting under the Digital Services Act entered into force. It sets a standard format and schedule for transparency reports by intermediary services, covering content removals, automated moderation, and account suspensions. Intermediary services must publish annual reports by February, while very large platforms and search engines must report twice a year, in February and August, starting in 2026.
European Parliament report on Generative AI & Copyright published
The long-awaited own initiative report by MEP Axel Voss (EPP, DE) “Copyright and Generative artificial intelligence – opportunities and challenges” is set to be presented and discussed next week in the JURI committee, on 15 July (deadline for amendments: 12 September). The report, although discouraging the reopening of the Copyright Directive, affirms that the TDM Exception is not applicable to Generative AI systems, suggesting therefore an additional legal act to solve the impartiality that this creates between creators and AI developers. It also acknowledges the importance of AI for innovation, and therefore asks for more transparency when it comes to the training of AI systems with the intention to create a fairer remuneration system. This includes a standardised and machine-readable way for artists to opt-out from the training as well as the creation of quick mechanism of remuneration. The EUIPO is suggested as a mediator in this process, including the management an opt-out registry.
Parliament focuses on strengthening minors’ protection: key amendments
The European Parliament’s draft INI report on minors’ protection has attracted over 460 amendments, signaling a push to toughen rules. Major themes include stronger action against addictive social media features, calls for platform bans and personal liability for executives, and demands for greater transparency on advertising revenues targeting children. The Digital Fairness Act is frequently referenced as a key tool to address these harms. Lead MEP Christel Schaldemose (S&D, DK) plans to increase the report’s ambition based on this broad input. The CULT committee will hold an expert hearing in July to support the debate.
Digital Fairness Act consultation still in the waiting
The imminent consultation on the so-called DFA will include questions on topics like dark patterns, influencer marketing, advertising, vulnerable consumers and simplification and will be open for three months.
For the stakeholders who would like to share their thoughts already, a good option is to submit some ideas via the Consumer Agenda 2025-2030 consultation, open until 31 August and which will also feed into the DFA.
DSA Guidelines on Minors likely delayed until summer break
Guidelines on the protection of minors under the Digital Services Act, initially expected in Q1 2025, are now likely to be finalised before the summer break, Commission officials said during a workshop on June 6. However, due to the high volume of stakeholder responses, officials acknowledged that further delays remain possible.
Preparations on the European Democracy Shield resume
In the draft Council conclusions “on access to reliable news as part of the European Democracy Shield,” Member States call for levelling the playing field between traditional media and digital platforms. In the document, EU countries invite the European Commission to examine how competition law can be used to make the advertising market more accessible to editorial media, to standardise prominence requirements under the Audiovisual Services Media Directive for digital platforms and gatekeepers to uniformly boost reliable journalism and to include “media-like actors,” i.e. influencers and content creators, into editorial accountability regimes. The draft conclusions will be discussed by the Council’s Audiovisual Working Party on Friday. As a reminder, the European Parliament is also working on an own-initiative report meant to feed into the European Commission proposal, set to be presented in the autumn.
DATA ECONOMY
Commissioner McGrath organises implementation dialogue with stakeholders
On 16 July, Commissioner Michael McGrath will host an implementation dialogue on the application of the GDPR with civil society and business organisations. The discussion will be structured around four themes, namely simplification, compliance, interaction with other legislation and increasing legal certainty.
European Commission presents Roadmap for effective and lawful access to data for law enforcement
On June 25, the European Commission unveiled a new Roadmap aimed at improving law enforcement’s ability to access digital data in a lawful and efficient manner. This initiative is part of the ProtectEU Internal Security Strategy and responds to rising digital evidence needs in criminal investigations. The Roadmap outlines six priority areas: updating data retention rules, improving cross-border lawful interception, enhancing digital forensic capabilities, developing lawful decryption tools, standardising security practices, and supporting AI-driven evidence analysis. Key actions are scheduled between 2025 and 2030. The Commission invited Member States to discuss the Roadmap during the Informal Justice and Home Affairs Council on 22 and 23 July.
Last draft of the Code of Practice on General Purpose AI models on the way
On 7 July, the AI Office held a workshop to encourage Big Tech firms to endorse the voluntary Code of Practice on general-purpose AI. While industry welcomed the code’s alignment with the AI Act, civil society groups criticized their exclusion from the drafting process and raised concerns about missing provisions on transparency, whistleblower protections, and safety.
The Commission is expected to publish the final draft on 10 July. It is also consulting Member States via the AI Board, which must confirm the code’s adequacy. A joint assessment by the Commission and AI Board is due by mid-August. The next AI Board meeting is set for 18 September.
Henna Virkkunen launches first implementation dialogue on data policy
At the beginning of July, the Finnish Commissioner launched her first implementation dialogue, a restricted consultation format focused on data policy (Data Act, the Data Governance Act, and the Open Data Directive). The objective of this dialogue was to identify solutions to streamline and simplify regulations. These results should inform discussions on the digital simplification omnibus and the new Data Union strategy, both expected at the end of the year.
Negotiations on GDPR enforcement rules see the end
On 16 June the European Parliament and the Polish Presidency of the Council reached a provisional agreement to clarify and speed up cross-border enforcement of the GDPR. The new rules set deadlines for investigations (15 months for complex cases and 12 months for simpler ones, with possible extensions), and introduce a streamlined cooperation process to resolve straightforward cases faster. The agreement also strengthens complainants’ rights by improving their access to information and ensuring they can be heard before decisions are made. The law encourages early consensus-building among data protection authorities to foster consistent GDPR enforcement across the EU.
The European Parliament committee LIBE is set vote on the text on 14 July, while the plenary vote is planned to take place in October.
European Data Union Strategy consultation published
The Commission published the Call for Evidence and a Public Consultation for the Data Union Strategy, open for eight weeks until 18 July. The initiative presents three objectives: 1) stimulating investments into data technologies and make available certain data assets through voluntary measures or funding to scale-up data use and availability, for example, in the development of generative AI, 2) to simplify and consolidate the current framework and 3) to develop and ‘international data strategy’, which should include actions to safeguard the export of EU data, as well as actions to stimulate data import into the EU.
The consultation is based on a questionnaire divided into sections asking for the potential review of the Data Governance Act, the Free Flow of Non-Personal Data Regulation and the Open Data Directive. Finally, it includes questions about the potential future EU actions when it comes to consolidation of data legislation, data availability in the EU, administrative burden reduction through data, international dimension, and data sharing standards.
CYBERSECURITY & INFRASTRUCTURE
Plum publishes study on negative impact of legally mandated dispute resolution in IP interconnection
On 4 July, Plum Consulting published a CCIA-commissioned study warning against legally mandated dispute resolution in IP interconnection, arguing it is largely unnecessary and unworkable due to the technical complexity of interconnection and the prevalence of amicable commercial agreements. The study cautions that such mandates could normalise network fees, encourage strategic disputes by large ISPs, and lead to a “Sending Party Network Pays” model, increasing paid peering. This would disproportionately harm smaller content providers and ISPs, raise costs, reduce competition, fragment the EU digital market, and ultimately undermine innovation, SMEs, and consumers.
Commission to present Data Centre Energy Efficiency Package in early 2026
The European Commission will present a data centre energy efficiency package in Q1 2026, as part of a broader push to curb rising electricity use driven by AI and digitalisation. Indeed, Energy Commissioner Dan Jørgensen cited that data centres now account for nearly 3% of the EU’s total electricity demand. The initiative will be released alongside the Strategy Roadmap on Digitalisation and AI and forms part of a wider set of energy efficiency actions. For now, it remains unclear whether the package will include legislative proposals. In parallel, the Commission is working on a labelling scheme under the Energy Efficiency Directive and is considering fast-track permitting for highly efficient data centres under the forthcoming Cloud and AI Development Act.
Germany rejects cloud protectionism, urges competition with U.S. providers
Germany’s new digital minister Karsten Wildberger has called for a competitive, not protectionist, approach to cloud sovereignty in the EU. In an interview with Politico, he stressed that technological independence should not come from excluding U.S. hyperscalers, which currently dominate over two-thirds of the European market, but from building competitive European alternatives. In parallel, several Member States – including Germany, Poland, the Baltic States, the Czech Republic and Spain – are actively vying to host AI gigafactories, seen as a cornerstone of Europe’s ambition to boost computing power and strategic tech autonomy.
EVP Henna Virkunnen and MEPs issue Joint Declaration at the 2025 IGF
Henna Virkkunen and five Members of the European Parliament (from EPP, S&D and ECR) in a joint declaration support of a multistakeholder, rights-based approach to internet governance. They called for the IGF to become a permanent, UN-funded body with inclusive participation from developing countries. The statement highlighted the need to address digital divides, adapt governance to technologies like AI, and align WSIS+20 efforts with the Sustainable Development Goals and the Global Digital Compact. The signatories opposed intergovernmental control and internet fragmentation, advocating innovation-friendly tools such as governance sandboxes.
ENISA’s NIS2 issues Technical Implementation Guidance
On 26 June, ENISA published its NIS2 Technical Implementation Guidance. The non-binding document covers 13 key concepts and cybersecurity practices and provides guidance and examples of evidence for each. Concepts of interest for EuroISPA include recommendations around security policy, risk management, incident handling and supply chain security.
MISCELLANEOUS
Denmark starts chairing the Council Presidency
On 1 July, the Danish Presidency of the Council of the European Union kicked off. Under the Danish Presidency, several progress reports are expected, including on the digital aspects of the post-2027 Multiannual Financial Framework (MFF), scheduled for presentation on July 16. Other issues expected by end of year will be subject to mere “information” from the Presidency, such as the Digital Networks Act, the regulation on the development of cloud computing and AI, or the “omnibus” digital simplification package. While awaiting legislative initiatives, the Danes will also work on non-binding conclusions, notably on technological sovereignty. Finally, interior ministers will draw up a state of play on the issue of data access by law enforcement in mid-October.
The European Commission is still aiming for an agreement with the United States by July 9
Washington has now announced that, in the absence of an agreement, customs surcharges will apply starting August 1, suggesting that the negotiation window could still be extended. For the Europeans, the dilemma remains unchanged: either accept an “asymmetrical” deal that preserves U.S. tariffs or risk a confrontation that could lead to even higher duties. This choice was discussed at an ambassadors’ meeting on July 4. Aiming to remain conciliatory, the Commission has temporarily put on hold a list of retaliatory measures prepared in May and June, which currently excludes actions targeting services. “There are no immediate plans to act on this list, but that may change,” a Commission spokesperson noted.
European Commission’s DG CONNECT gets a makeover
The European Commission published the new organigramme of its Directorate-General for Communications Networks, Content and Technology (DG Connect) on 1 July. The new structure establishes the division into two separate directorates of the former “Platforms” directorate, previously responsible for the application of the DMA and DSA Regulations. Rita Wezenbeek, who takes over the new directorate responsible for the online platform economy, is also acting as head of the new “e-commerce” unit. Prabhat Agarwal, head of unit responsible for the DSA (“Risk Assessment and User Rights”) will be acting as head of his new directorate dedicated to the societal aspects of online platforms, as well as the new unit on the protection of minors.
International Digital Strategy unveiled
At the beginning of June, High Representative Kallas and EVP Virkkunen unveiled the International Digital Strategy: it stresses the EU’s necessity to collaborate with global players, such as U.S. companies, recognising the importance of international partnerships and remaining open to like-minded countries.
It includes objectives such as deepening the existing Digital Partnerships and Dialogues, broadening the existing cooperation network and expanding the network of digital trade agreements, strengthening Security & Defence Partnerships as regards digital issues through Digital Trade Agreements.
The strategy includes actions on secure connectivity, emerging technologies, artificial intelligence, 5G/6G, cybersecurity, digital identity and Digital Public Infrastructure (DPI), online platforms, internet governance.
Trilogue talks begin on EU Foreign Direct Investment Screening EU institutions launched trilogue negotiations on June 17 to revise the EU’s foreign investment screening framework, a key component of Commission President von der Leyen’s economic security strategy. The proposal would make screening mechanisms mandatory across all Member States and further harmonise rules on sensitive sectors. Tensions are expected between Parliament and Council: Member States seek a narrower list of critical technologies (e.g. semiconductors, AI), while Parliament- led by MEP Raphaël Glucksmann (S&D, FR) – advocates for a broader scope including aerospace, rail, and automotive. Another point of friction is the Commission’s role, with Parliament supporting greater oversight by the EU executive, which the Council opposes. The first trilogue served as an introductory meeting, with substantive negotiations set to follow. An agreement is targeted by year-end.
