The window brought a new UK regulator structure, California's end-of-session AI and privacy signings, and live EU deadlines on GDPR fining and the Digital Omnibus. I found no new item this week tied to your HS 8471 imports; that topic is outside this tracker's scope.
01Council Presidency / Agence Europe · Oct 5EU states aim for Digital Omnibus mandate on October 7
Stage: legislative negotiation, not law. The Irish Presidency updated its compromise text on the Digital Omnibus after a September 25 preparatory meeting, and member-state ambassadors (Coreper) are due to examine it on October 7 to adopt a negotiating mandate with the European Parliament. This is secondhand: Agence Europe reported it, and the compromise text itself was not opened.
Per that report, the text shortens the wait before re-asking for cookie consent for the same purpose from six months to four months. It also does not include Germany's proposed 'low-risk controllers' GDPR exemption, though it provides for a future review of GDPR obligations by risk level. It adds a strengthened Data Act 'handbrake' under which data holders may refuse access requests that pose a high risk of unlawful use or disclosure by entities under third-country jurisdiction. Nothing here binds anyone yet.
For you: Treat this as a signal; check how your cookie-consent re-prompt timing and Data Act access handling would change, and calendar the October 7 outcome.
02EDPB · Sep 21EDPB draft guidelines on GDPR fines open for comment to November 13
The European Data Protection Board published Guidelines 04/2026 on the application of the power to impose administrative fines in relation to other corrective powers under the GDPR. They are version 1, a draft for public consultation, not final guidance. The feedback period runs from September 21 to November 13, 2026 (23:59 CET), and comments are submitted through the EDPB form and published on its website.
The guidelines concern how supervisory authorities choose between fines and other corrective powers, so they will shape enforcement exposure for any controller or processor under the GDPR. I read the consultation page but did not review the PDF text, so check it for specifics before relying on any position.
For you: Have counsel read the draft against your EU processor and controller roles, and decide whether to file a comment before November 13.
03Governor of California · Sep 30Newsom signs AI transparency, worker-AI and CIPA bills on September 30
On September 30 the Governor's office listed signed bills including SB 947 (employment: automated decision systems), SB 1000 and AB 2713 (California AI Transparency Act), SB 951 (technological displacement notice) and AB 1883 and AB 1331 (workplace surveillance). Per the press release, SB 947 bars employers from relying only on AI for discipline or termination decisions. Per WilmerHale (law-firm commentary, not the bill text), SB 1000 removes the 1,000,000 monthly-user threshold for covered providers and takes effect immediately.
Per Covington, SB 690 was signed September 30 and takes effect January 1, 2027: it leaves website, app and mobile pen-register CIPA claims to the Attorney General alone and applies to pending claims in actions commenced on or after January 1, 2025. WilmerHale also reports SB 923, which expands the CCPA right to delete to data collected 'from or about' a consumer (signed September 27), and the September 27 veto of AB 1542. Effective dates beyond those stated were not verified.
For you: Check whether California staff or AI-generated content in your product fall under SB 947 and SB 1000, and review your CCPA deletion workflow against SB 923.
04DSIT / ICO · Sep 30Information Commission replaces the ICO as UK regulator
The Information Commission took over the ICO's functions on September 30, 2026, under the Data (Use and Access) Act 2025. It is a body corporate led by executive and non-executive members with collective decision-making, replacing the single Information Commissioner. DSIT says the regulator's role, responsibilities and powers do not change.
Paul Arnold is interim Chief Executive, seven non-executive members have been appointed, and Chair recruitment is ongoing. The ICO said on September 15 (updated September 17) that it will continue to be known as the ICO. The transition was brought in by the Data (Use and Access) Act 2025 (Commencement No. 9 and Transitional and Saving Provisions) Regulations 2026.
For you: Update UK GDPR references, registration and DPIA templates naming the Information Commissioner, and expect enforcement decisions to come from the Commission's collective board.
05CNIL · Sep 9CNIL fines EXTIA €300,000 over ignored erasure requests
CNIL published on September 9 that its restricted committee fined IT staffing firm EXTIA €300,000 on July 21, 2026 (deliberation SAN-2026-010). The breaches concerned GDPR Articles 12 and 17: of 265 erasure requests received in 2024, mostly from job candidates, over three-quarters were not handled or not handled satisfactorily.
CNIL found 12 requests unprocessed, 166 people never told of the outcome and 27 told after the one-month legal deadline. It counted the number of people affected and two earlier reminders against the company, and noted automatic deletion does not remove the duty to inform. The check was part of the EDPB-coordinated action on the right to erasure.
For you: Audit how HR, candidate and customer erasure requests are logged, answered within one month and confirmed to the requester, including after automatic deletion.
Enable JavaScript to read this edition.