Kritia Law Watch
The fine that says a computer cannot decide alone
Reviewed. This briefing was reviewed by Kritia’s editor before publication.
A quiet weekend for new publications, so this is the fortnight worth catching up on — led by the largest automated-decision penalty the EU has produced.
01 — ENFORCEMENT
Decisions authorities and courts actually published.
Uber fined nearly 825 million euros for automated driver blocking (4 minute read)
Autoriteit Persoonsgegevens (Netherlands)· EU
Between 2018 and 2022 Uber's software deactivated drivers' accounts on suspicion of fraud or low ratings, with no human looking at it, and drivers lost their income from one moment to the next. The Dutch authority found that unlawful and fined 824,990,000 euros. The number is Uber's; the rule is everyone's.
Why it matters to you
The rule underneath the number: a system that can cut someone's income should not do it unwatched. If any decision in your firm runs end to end without a person, this is the shape of the risk.
Italian authority fines Lusha 2 million euros over large-scale monitoring (5 minute read)
Garante (Italy)· EU
A decision of 27 July 2026 against a contact-data business, over the monitoring of a large number of people. Worth a look if your firm buys prospect lists: the questions the authority asked the seller are the ones a buyer should be asking too.
Why it matters to you
If your firm buys prospect lists, the questions the authority put to the seller are the ones a buyer should be putting too — where the data came from, and whether those people ever knew.
02 — RULES & GUIDANCE
New or changed official text, guidance and proposals.
AI Omnibus enters into force (3 minute read)
European Commission· EU
The Commission's own account of the 27 July 2026 amendment: high-risk rules under Annex III now apply from 2 December 2027 and product-embedded ones from 2 August 2028, the AI literacy requirement on companies is simplified, and some measures previously reserved for SMEs extend to small mid-caps. This is why guidance written before July describes duties that have changed.
Why it matters to you
This is why guidance written before July describes duties that have since moved. Check the date on anything you were sent about high-risk timing: those deadlines are now December 2027 and August 2028.
Commission starts enforcing AI Act rules and new transparency requirements (2 minute read)
European Commission· EU
The announcement that enforcement began on 2 August 2026, with the AI Office and national authorities sharing it. The Commission also published a first list of more than 180 organisations signed up to the Code of Practice on transparency of AI-generated content.
Why it matters to you
Not a deadline to prepare for any more. It is the date the transparency duties became something an authority can act on, which changes what the phrase "we're getting to it" costs.
Quick facts: transparency rules for AI systems (3 minute read)
European Commission· EU
A one-page summary of the Article 50 duties from the people who wrote them, last updated 29 July 2026. The shortest reliable thing to send someone who asks what the transparency rules actually say.
Why it matters to you
The shortest reliable thing to send the colleague who asks what the transparency rules actually say — one page, from the people who wrote them.
03 — PRACTICAL
Worth doing, or worth the time to read.
Identifying and managing a DPO's conflicts of interest (6 minute read)
CNIL (France)· EU
Published 10 August. If the person overseeing data protection in your firm also runs the operation being overseen, the French regulator sets out why that is a problem and what to do about it. In French.
Why it matters to you
If the person overseeing data protection also runs the operation being overseen, a regulator has written down why that is a problem — and what a firm too small to split the roles can do instead.
04 — THE WIDER VIEW
Written about the rules, not by the people who make them.
AI literacy: the Digital Omnibus rewrites Article 4 of the AI Act (8 minute read)
Law & Technology· EUAnalysis
A walk through what changed in Article 4 and what survived it. Useful for seeing the before and after side by side, which most coverage still does not do. One author's reading, not an official one.
Why it matters to you
Useful if you are working out what changed for AI literacy and what survived. One author's reading — good for the before-and-after, not for settling what your own firm owes.
EU Digital Omnibus on AI enters into force (5 minute read)
Hunton Andrews Kurth· EUAnalysis
A firm's summary of the same amendment, written for people who have to explain it to someone else. Shorter than the Commission's version and organised by what moved.
Why it matters to you
The version to forward when someone else in the business has to be brought up to speed. A firm's summary, organised by what moved — check anything load-bearing against the Commission's own page above.
05 — QUICK LINKS
- A controller must report a breach that happened at its processor (3 minute read)
UODO — Your vendor had the incident; the 72-hour clock is still yours. Poland, 12 August. - Regulation (EU) 2026/1744 — the amending act itself (25 minute read)
Official Journal — Published 24 July 2026. The text, if you would rather read it than read about it.
06 — COUNTDOWN
94days · 2026-12-02
Machine-readable marking for generative systems placed on the market before 2 Aug 2026.
What this isn’t
News about the law, not legal advice, and not an assessment of your business. Items marked Analysis are someone’s view of the rules, not the rules. Whether a duty applies to you depends on what you actually do. The public guides explain the general rules and link their primary sources.
Get this each publishing day
Free by email, with no account and no card. About a minute to read, every reported item linked to its source.