The Network and Information Security Directive (EU) 2022/2555) (NIS 2 Directive) is a significant new law enacted to bolster cybersecurity across the European Union. It is an update of the original NIS Directive (Directive (EU) 2016/1148), which was adopted to address the increasing threats to network and information security. The aim of the NIS 2 Directive is to further harmonize, benchmark, and enhance cybersecurity measures that apply to network and information systems across the EU. The NIS 2 Directive seeks to create a more robust cybersecurity regulatory framework.

These new cybersecurity rules have been introduced as a directive, meaning that each Member State must enact laws reflecting these new rules and empowering regulators in their countries to supervise and enforce these laws. Individual countries can add to the NIS 2 Directive rules, provided any additional rules or requirements introduced are consistent with the Directive. The specific requirements and enforcement mechanisms can and do vary between Member States.

In this Insight article, Deirdre Kilroy, from Bird & Bird LLP, discusses the key elements of the NIS 2 Directive and how in-scope entities can ensure compliance.

In this Insight article, Mark Lubbock and Ellen Keenan-O'Malley, from EIP, explore the EU's regulatory challenges with artificial intelligence (AI), highlighting new laws and concerns over data, competition, and innovation. It also examines the risks of overregulation on Europe's tech competitiveness.

The EU Artificial Intelligence Act (the AI Act) is set to become a landmark regulation governing artificial intelligence (AI). It introduces requirements and responsibilities for providers (and those treated as providers) of general-purpose AI (GPAI) models. With respect to GPAI models, a provider is a natural or legal person or body that develops or has a GPAI model developed and places that model on the market under its own name or trademark, whether for payment or free of charge. This includes organizations that outsource the development of a GPAI model and then place it on the market.

The concept of GPAI models was not in the original text of the AI Act when it was first proposed in 2021. But articles and soon a chapter on GPAI models were added after the proliferation of models like OpenAI's GPT-3, generating much debate during negotiations for the Act.

In this Insight article, Katie Hewson and Eva Lu, from Stephenson Harwood LLP, examine the definition of GPAI models under the Act, as well as the sub-category of GPAI models with systemic risk and the obligations of providers of these models.

The discipline of marketing and advertising has received quite some attention from data protection practitioners over the years. The marketing and advertising sector was critically examined for its use of profiling, followed by big data and, most recently, real-time bidding. Despite all this, many may wonder why companies, and, in particular, their marketing departments, are still keen on engaging in this highly controversial activity of personalizing advertising messages.

In this Insight article, Dr. Sachiko Scheuing, from Acxiom, examines recent regulatory developments affecting personalized advertising and how organizations can ensure they are compliant.