Federation Against Software Theft

As we move into the heart of spring 2026, this newsletter brings together a number of legal and regulatory developments, starting on the legislation front with a provisional agreement on the EU AI Act's Digital Omnibus. We then cover a number of policy changes, including the Government's announcement of a new Fundamental AI Research Lab, and new vulnerability monitoring service (VMS). We then dive into the NCSC’s new cross-domain architecture guidance. Finally, we turn to the courts, looking further at the decisions in Edozo v Valos and Emotional Perception AI Ltd v Comptroller-General of Patents.

In this edition, we bring you the latest updates on the Cyber Security and Resilience (Network and Information System) Bill and the UN Convention against Cybercrime. We’re also covering the EU’s new digital omnibus package, plus some important case law updates – Getty Images v Stability AI, and JJH Enterprises Limited (trading as ValueLicensing) v Microsoft Corporation and Others.

In this bulletin will look back at this summer’s developments in the legal sphere. We’ll revisit the latest legislative updates in the UK, on (a) the Artificial Intelligence (Regulation) Bill and (b) the Data (Use and Access) Act 2025. We also explore the recent Wikimedia judgment, various Codes of Practice published by the UK Government, and consider the consultation on enterprise connected devices. Finally, we consider the recent prevalence of cyber-attacks in the UK, along with the CMA’s accusations towards Microsoft and Amazon on cloud competition.

In this bulletin, we will explore the latest legislative updates in the UK in the form of the Artificial Intelligence (Regulation) Bill, and we will provide a progress update on the Data Use and Access Bill which we covered in our last edition.

In this bulletin we delve into a variety of topics, including the outcome of the King’s Speech in the form of two new bills: the Cyber Security and Resilience Bill, and the Digital Information and Smart Data Bill. This issue also covers recent cyber incidents, including the high-profile CrowdStrike outage and the cyberattack against the NHS. Finally, we turn to a recurring focus of these updates, namely developments in the artificial intelligence space; we consider potential action that may take place following DSIT’s call for evidence and the EU AI Act now having entered into force.