Welcome to Euractiv’s Tech Brief, your weekly update on all things digital in the EU. You can subscribe to the newsletter here.  

“Will chairs and vice-chairs [drafting general-purpose AI guidelines] be selected, appointed and publicly announced by the time of the kick-off plenary on 30 September?”

• wrote MEPs Axel Voss (Germany, EPP), Svenja Hahn (Germany, Renew) and Kim van Sparrentak (Netherlands, Greens) in a letter to the Commission.

Story of the week: Three influential MEPs are questioning how the European Commission is appointing key positions in drafting guidelines for general-purpose AI (GPAI) on the same day the EU executive is inviting organisations to participate in the process. Read more. 

Also this week:

• Irish DPC fines Meta €91 million over password management lapse
• Institutional fight over EU telecoms rules laid bare at Brussels conference
• Google accuses Microsoft of stifling cloud competition in fresh antitrust complaint 
• Largest EU telcos shift focus on green transition in renewed call for investments 
• MEPs question appointment of leader for general-purpose AI code of practice 
• Iran ran a special cyber op in Sweden last year, local authorities confirm 
• Commission approves the acquisition of European telecom company by UAE firm 
• AI has a ‘special place’ in the French government, says new AI and digital minister 

Code of Practice. The first plenary on the code for GPAI will take place on Monday afternoon. Wavestone, a consortium with Intellera and CEPS, is the consultancy firm supporting the process, MLex reported on Thursday.

AI Pact gets some signatures. The European Commission said on Wednesday that 115 organisations signed its AI Pact, voluntary commitments that pave the way for compliance with the AI Act, but according to Euractiv’s reporting, its significance has waned. Meta and Apple didn’t sign the Pact. Read more. 

D9 meeting. Ministers from Belgium, Czechia, Denmark, Estonia, Finland, Ireland, Luxembourg, the Netherlands, Poland, Portugal, Spain and Sweden, are meeting today in Copenhagen, to discuss competitiveness and resilience, digital wallets, and protection of children online.  

AI’s special place. “AI will take on a very special place in my work” as a member of the new French government, said Clara Chappaz, newly-appointed secretary of state for AI and digital technologies, on Monday. Speaking at a handover ceremony before an audience of officials on Monday, Chappaz referenced the upcoming Paris AI Action Summit in February 2025, focusing on shaping global AI governance. Read more. 

OpenAI goes for-profit. ChatGPT-maker OpenAI is working on a plan to scrap the non-profit board that currently controls the company, according to people familiar with the matter, Reuters reported on Wednesday. The company is trying to remove caps on returns for investor returns, and CEO Sam Altman will, for the first time, receive equity in the company, they said. On the same day, CTO Mira Murati, research chief Bob McGrew and research VP Barret Zoph left OpenAI. Altman denied receiving a giant equity stake at an all-hands company meeting, CNBC reported on Thursday. OpenAI Chairman Bret Taylor confirmed discussions on Altman’s equity but said there are “no specific figures are on the table”, CNBC reported on Thursday. The company is in the middle of closing a $6.5 billion funding round at a $150 billion evaluation, which, according to sources with direct knowledge of the matter, is contingent on the for-profit change, Reuters previously reported.  

Blackstone’s £10 billion AI data center, in the UK. Private equity behemoth Blackstone is investing £10 billion (€12 billion) in a data centre for AI in the northern UK, the Prime Minister’s office said on Wednesday, according to Reuters. 

Bigger is not better. A study published in Nature on Thursday found that some of the latest gargantuan large language models found are more likely to give wrong answers than admit ignorance.

Commission approves the acquisition of European telecom company by UAE firm. The European Commission approved on Tuesday the acquisition of Amsterdam-based PPF Telecom by United Arab Emirates firm e&, under the Foreign Subsidies Regulation, according to a Tuesday (24 September) press release. Read more.

Google takes on Microsoft. Google is accusing Microsoft of anti-competitive licensing practices in cloud computing contracts in an antitrust complaint lodged with the European Commission, according to a press release on Wednesday (25 September). The accusations are similar to a complaint filed with the Commission in November 2022 by Cloud Infrastructure Service Providers in Europe (CISPE), a trade association that includes Amazon’s AWS and Italy’s Aruba. The complaint was eventually settled.  

Iran’s cyber op in Sweden. Iran’s security service carried out a special cyber operation against targets in Sweden last year, the country’s prosecutor and security services revealed on Tuesday. The special operation was carried out in August last year as hackers hijacked an SMS service and sent 15,000 messages urging Swedes to “take revenge” on people who had burned Qurans in the country. “We have managed to link it to the Revolutionary Guard”, said Fredrik Hallström, head of operations at the Swedish Security Service. Read more. 

EP unavailable. On Tuesday, some elements of the European Parliament’s internet environment were unavailable, but the services were restored the same day, a Parliament spokesperson confirmed to Euractiv. 

GDPR timelines. The GDPR trilogue negotiations could be delayed due to procedural hurdles, with the earliest possible start on 4 November, several sources from the European Parliament told Euractiv this week. Files need confirmation from the Conference of Presidents (COP) to be reactivated in the new Parliament, however, this approval cannot happen until the plenary session on 2 October. Most discussions will be on the technical level, with new rapporteurs involved, except for the returning Axel Voss, Euractiv learned. 

No corrective powers necessary. The Court of Justice shared in a press release on Thursday that data protection authorities are not required to impose corrective measures, such as fines, in every case of a data breach under the General Data Protection Regulation (GDPR). Authorities may refrain if the controller has already taken necessary actions to address the breach. In the Court’s case, a German savings bank disciplined an employee who improperly accessed customer data and notified the authorities. The supervisory authority chose not to impose a fine, which the customer challenged in court. The Court left the final decision to the German court to ensure proper enforcement of GDPR. 

Ireland fines Meta. The Irish Data Protection Commission (DPC) fined Meta €91 million for "inadvertently" storing user passwords without cryptographic protection or encryption, closing a five-year-old case, according to a Friday press release.

Noyb vs. Mozilla. Noyb filed a complaint against Mozilla on Wednesday for enabling a "Privacy Preserving Attribution" (PPA) feature in its Firefox browser without user consent. This feature allows Firefox to track users' ad interactions, shifting tracking control from websites to the browser itself.  

EU cloud certification: "We are going to war, in gladiator mode," said the vice-president of EU affairs at France's largest employer federation, Médef Fabrice Le Saché, at an event about the EUCS cloud certification at the European Economic and Social Committee on Thursday. According to Le Saché, there is still time for EU companies to convince their governments to include sovereignty requirements within the EUCS voluntary scheme and turn the tide against Big Tech lobbying. The negotiations started five years ago and are currently at a stalemate. 

Parties unite for Eurostack. The EPP, the Greens, the Left, S&D, and Renew joined forces at an event at the Parliament this week to discuss building a “Eurostack,” digital public infrastructure that powers growth whilst upholding European values.  

The US wants Chinese tech out of the car industry. The US Commerce Department suggested on Monday to ban Chinese software and hardware from vehicles, which would de facto ban Chinese car manufacturers from the US market, reported the Financial Times. This comes after the US raised tariffs on Chinese cars by 100% this year. The software ban would kick in in 2027, and the hardware ban is foreseen for 2029 or 2030. 

CSAM open letter. A group of 168 scientists and researchers from 29 countries have signed an open letter, published on Thursday, expressing strong objections to the latest draft of the online child sexual abuse material. They argue that the regulation’s requirement for client-side scanning of encrypted communications compromises privacy, undermines encryption, and poses risks of government misuse. They stress that the technology remains ineffective and could lead to false positives, invading user privacy.  

Amsterdam for CSAM? The Netherlands is expected to officially announce its support for the CSAM proposal as early as today, sources close to the matter told Euractiv. This move would not be entirely unexpected, as the Dutch maintained that their primary concern lies with combating known CSAM—a focus that aligns with the scope of the latest proposal. 

Sánchez against disinformation. Spanish Prime Minister Pedro Sánchez wants to make the fight against disinformation a priority with a plan for “democratic renewal”, though the country’s conservative opposition has blasted it as an attempt to censor critical media. Sánchez met with Brazilian President Luiz Inácio Lula da Silva to discuss the issue with other diplomats on Tuesday on the sidelines of the UN General Assembly in New York. 

X is back in Brazil. After a three-week blackout, X is complying with a Brazilian court order to restore access to 21 million users, CNN reported on Monday. The platform had been banned for failing to block accounts spreading hate speech and undermining democracy. X now faces a $1 million fine and finalise legal representation. This dispute mirrors global concerns about regulating online content, aligning with efforts like the EU's Digital Services Act (DSA) to curb misinformation and protect democratic institutions. 

OpenAI’s X account hacked. OpenAI's @OpenAINewsroom account on X was compromised on Monday, with unauthorised posts promoting a fake crypto token linked to the AI company, Bloomberg reported on Monday. The breach follows a broader trend of rising cyberattacks, with OpenAI warning employees in a memo about increased hacking attempts, as both company and employee accounts have been targeted for scam posts in recent weeks, the article said. 

Robocalls fine is final. The US Federal Communications Commission finalised a $6 million fine on Steve Kramer, a political consultant who used AI-generated version of President Biden’s voice to spread election misinformation, according to a Thursday press release.  

Telegram to provide user data. Telegram CEO Pavel Durov announced in a post on Monday that Telegram will share users' IP addresses and phone numbers with authorities holding valid legal requests, marking a shift from its previous stance on privacy. Durov called it his “personal goal to ensure” improvements. Durov remains under formal investigation in France. 

X to allow blocked accounts to view public posts. X will soon allow blocked accounts to view public posts, changing how the platform's block feature operates, TechCrunch reported on Monday. Previously, blocked users could not see posts unless they logged out.  

Institutional fight over EU telecoms rules laid bare at Brussels conference. The future of EU telecoms rules had national regulators, the European Commission’s competition directorate (DG COMP) and the EU executive’s connectivity directorate (DG CNECT) battling it out at an event in Brussels on Wednesday (25 September). Read more. 

Largest telco lobby shifts focus. The EU’s largest telecom operators are taking up sustainability as part of their call for more investments in their industry, according to a policy agenda published by lobby Connect Europe on Wednesday. The lobby’s goal is for the Commission to include telecom networks, such as 5G and fibre, in the list of sustainable industries, making it more attractive as investors are certified that their investment aligns with upcoming regulatory requirements. Read more. 

The Commission approves. The European Commission approved the acquisition of Amsterdam-based PPF Telecom by United Arab Emirates firm e&, subject to conditions, according to a Tuesday press release. The Commission found that e& received foreign subsidies through “an unlimited state guarantee,” grants, and loans. However, these “did not lead to actual or potential negative effects on competition in the acquisition process,” said the press release. Read more. 

UN declaration on submarine cables security. On Wednesday, the EU endorsed a multilateral UN joint statement on the security and resilience of under cables during a UN general assembly in New York. The signatories recognise principles for securing submarine cables, including selecting low-risk vendors, improving cybersecurity and enhancing route diversity. The UN statement is “in line with the Commission recommendation” on the security and resilience of submarine cables, wrote the Commission and is non-binding. 

• The US Invented GPS. It Risks Losing Its Way (Bloomberg Opinion) 
• Is Math the Path to Chatbots That Don’t Make Stuff Up? (The New York Times) 
• Shein Workers Have Had It—and They’re Going Public (Wired) 

[Edited by Rajnish Singh]

Thanks for reading. Be sure to spread the word and come and say hello on X.