Dispatch from Brussels: Updates on EU tech policy

GPAI Guidelines: On 22 April, the EU Commission opened a public consultation to help prepare its upcoming guidelines on GPAI models under the AI Act. The consultation, which will close on 22 May, aims to clarify the definition of GPAI, and the difference between a GPAI provider and a downstream provider. As a reminder, these guidelines are different from the code of practice, but both aim to facilitate AI Act implementation by giving companies further clarity. Both are expected to be released together.

GPAI Code of Practice timeline: The Code of Practice, which aims to detail the AI Act rules for providers of general-purpose AI models and general-purpose AI models with systemic risks will be released alongside the GPAI Guidelines as discussed above. However, in the timeline announcements it was shown that the Code and the Guidelines could be expected at some point in May or June 2025 (as opposed to the May 2025 deadline previously communicated).

Simplification

Cybersecurity Act: On 11 April, the EU Commission opened a consultation on revising it 2019 Cybersecurity Act. The initiative is part of the EU Commission’s ongoing efforts to simplify its rules. The review of the act will focus on the mandate of the EU agency for cybersecurity (ENISA), the EU Cybersecurity Certification Framework, and addressing ICT supply chain security challenges.

Data protection and AI Act: The European Data Protection Board (the independent European body tasked with ensuring that the GDPR and the Law Enforcement Directive) announced in its April plenary that it would closely cooperate with the EU AI Office in relation to the drafting of the guidelines on the interplay between the AI Act and EU data protection legislation.

Platforms

Digital Markets Act: On 25 April, the EU Commission published its 2024 annual report on the implementation of the Digital Markets Act (the regulation which aims to prevent large digital platforms from abusing their market power). The report provides a useful summary of the Commission’s activities throughout the year, and an overview of the information provided by “gatekeepers”.

Data Privacy

European Data Protection Supervisor (EDPS) Annual Report: The EDPS (the EU’s independent data protection authority) which is tasked with supervising EU bodies and advising on new legislative proposals, published its 2024 annual report on the work it conducted as part of its 2020 to 2024 work programme. The report gives interesting insights on the work done by the supervisor so far (such as how it prepared itself to assess conformity with the EU AI Act) and its upcoming plans. The EDPS future plans can be found in these 20 initiatives.

European Data Protection Board (EDPB) Annual Report: The EDPB, the independent European body tasked with ensuring that the GDPR and the Law Enforcement Directive are applied consistently in different countries, has also recently published its annual 2024 report. The report covers the EDPB’s work throughout 2024 and more interestingly, the opinions it has released on issues such as the use of personal data to train AI models, the use of “consent or pay” models (which is currently a very relevant issue with Meta being fined for using such a model).

EDPB guidelines on blockchain: On 14 April the EDPB, during its plenary, adopted guidelines on how to process personal data through the use of blockchain technologies. The guidelines will be subject to public consultation until 9 June 2025.

techUK International Policy and Trade Programme activities

techUK supports members with their international trade plans and aspirations. We help members to understand market opportunities, tackle market access barriers, and build partnerships in their target market. Visit the programme page here.