IMC Newsdesk

Europe: Security & Public Policy Index

  • August 20, 2026
  • William Payne

EC publishes Practical Guidance for Cyber Resilience Act

July 27, 2026

The European Commission has released guidance to assist manufacturers in complying with the Cyber Resilience Act, which mandates security-by-design for all digital products. The 80-page document clarifies the scope for IoT devices, defines “substantial modifications” that require re-certification, and provides 67 practical use cases for SMEs.

For more information:

EU: AI Act Enforcement and Transparency Rules

August 2, 2026

The European Commission’s AI Office has begun enforcing transparency and risk-management rules under the EU AI Act. This will directly affect deployment of AI-driven IoT in critical infrastructure, smart cities, and healthcare. High-risk AI systems integrated into smart devices, such as biometric sensors, autonomous urban management platforms, or remote health monitoring tools, must now adhere to strict documentation and oversight standards to ensure safety and accountability. This phase also establishes the regulatory infrastructure for evaluating systemic risks in foundation models employed in edge analytics, smart city, transportation, and energy grid digital twins.

For more information:

UK: DSIT merges with Business, AI moves to Cabinet Office

July 21, 2026

The British Government has moved AI Strategy to the Cabinet Office, the central department of Government, and merged the Department for Science, Innovation and Technology (DSIT) into Business and Trade as the new Department for Business, Innovation, Science and Trade (DBIST), which will focus on the commercial application of emerging technologies. The move will accelerate Smart Health and mHealth integration across the UK, underpin security hardening of UK critical IoT infrastructure, and likely boost significantly funding for smart city developments, as all these areas now come directly under the Office of the Prime Minister (OPMC).

For more information:

Germany: National Deep Tech Start-up Strategy

July 22, 2026

The German Federal Government has launched a strategy comprising over 150 initiatives to support high-growth companies in deep tech, IoT, and digital health. The “Deutschlandfonds” will be expanded to mobilise institutional capital, specifically targeting the transition of research-based IoT prototypes into marketable industrial products.

For more information:

EU: Mandatory Second-Generation Smart Tachographs

July 1, 2026

As of July, all commercial vehicles between 2.5 and 3.5 tonnes performing international transport within the EU must be equipped with Gen2/V2 smart tachographs. This IoT-driven regulation aims to improve road safety and ensure compliance with driver working time through automated GPS tracking and remote communication with enforcement authorities.

For more information:

Italy: 2026–2028 Strategy for Technology Transfer

June 24, 2026

The Italian Ministry of Enterprises and the Ministry of Universities signed a new strategic framework to bridge the gap between research and industrial application. A key pillar of this strategy is the “Digital Health Hub,” which will fund the large-scale deployment of telehealth and mHealth solutions across regional health authorities using PNRR funds.

For more information:

EU Announces Embedded System Reliefs to AI Bill

June 29, 2026

The EU has delayed implementation and announced reliefs for embedded systems affecting Industrial IoT, Smart Cities, port automation, and smart energy infrastructure. The delay and reliefs, inserted into the AI Omnibus Bill, are due to delays by European standards bodies CEN and CENELEC. The main benefit is to industrial machinery and manufacturing industrial systems.

For more information:

EU Action Plan on Cybersecurity, IoT and AI

July 7, 2026

The European Commission has unveiled a nine-point plan to secure EU critical infrastructure, including connected IoT devices, against advanced AI risks. The initiative establishes a secure ENISA/Joint Research Centre testing platform to run “cyber ranges” for transport, energy, and health sectors, and accelerates the implementation of the Cyber Resilience Act (CRA) and the NIS2 Directive.

For more information:

UK ICO Finalises Guidance on Consumer IoT

June 11, 2026

The UK’s Information Commissioner’s Office (ICO) has published guidance for consumer Internet of Things (IoT) products and services. The guidance mandates a strict “privacy-by-design” approach, details specific rules for processing multi-user data on shared smart home devices, and requires Data Protection Impact Assessments (DPIAs) for products likely to process children’s data. It also introduces the concept of “positive friction” to prevent users from mindlessly consenting to data sharing.

For more information:

EU Rolling Plan for IoT, ICT Standardisation 2026

May 15, 2026

The EU has updated its ICT Standardisation plan to incorporate three new chapters: “Trusted and Secure Chips”, covering hardware-level security for IoT and trusted digital infrastructure; “Internet”, foundational open protocols, and “Trust in Media”. The Rolling Plan update coordinates EU policy priorities with technical standardisation requests in support of the Data Act, governing IoT data sharing, and the Cyber Resilience Act.

For more information:

EU Ministers Joint Declaration on Cross-Border AV Testbeds

June 8, 2026

18 EU Member States have signed a Joint Declaration of Intent to accelerate deployment of autonomous vehicles (AVs) across European borders. Supported by the European Automotive Action Plan, the countries will coordinate permitting and safety approvals for AVs in public transit, freight, and logistics. To support this, the Connecting Europe Facility (CEF) 2026 work programme has announced a €20 million call in June 2026 specifically for digital and smart road infrastructure.

For more information:

UK-Japan Frontier Technology Partnership

June 14, 2026

Japan and the UK have signed a Frontier Technology Partnership that will see the two nations collaborate on development of advanced technology, including embedded, advanced cybersecurity, and next generation technologies. The Partnership will develop technologies for next generation networks and build on cybersecurity and GCOT agreements between the two countries.

For more information:

Madrid greenlights 20 Sandbox smart city projects

July 14, 2026

Madrid City Council has selected the first 20 urban innovation projects to participate in the Sandbox Madrid programme, an initiative that will allow technological solutions to be tested in real-world city spaces under controlled conditions. The selection follows a three-month evaluation of 71 submitted applications.

For more information:

Municipal Sandbox proposed for Alcorcón

June 18, 2026

A municipal sandbox has been proposed for the Spanish city of Alcorcón that will create a regulated environment for companies and start-ups to develop new smart city technologies. The proposed municipal sandbox will likely be modelled on Madrid’s highly successful urban sandbox.

For more information:

EU: Cloud and AI Development Act (CADA)

3 June 2026

The European Commission has proposed the Cloud and AI Development Act (CADA) to scale EU-based cloud and AI infrastructure. The regulation introduces a single EU-wide assessment framework for “sovereign” cloud services and aims to triple European data centre capacity by 2035 through fast-tracked permitting and “Cloud and AI Leadership Initiatives.”

For more information:

EU: Launch of the Chips Act 2.0

3 June 2026

Building on the 2023 framework, the Chips Act 2.0 has been introduced to reinforce the EU’s semiconductor ecosystem, specifically targeting advanced AI chip design and manufacturing. The legislation aims to mobilise €120 billion in investment by 2035 and introduces “Grand Challenges” to incentivise the development of next-generation IoT and edge computing processors.

For more information:

EU Open Source Strategy for Digital Autonomy

3 June 2026

As part of the sovereignty package, the Commission has adopted a new Open Source Strategy to promote European open-source alternatives to proprietary software in critical sectors. The strategy focuses on scaling up “digital commons,” investing in open-source skills, and mandating “Open Source First” principles in public administration procurement to prevent vendor lock-in.

For more information:

EU Strategic Roadmap for Digitalisation and AI in Energy

3 June 2026

The Commission released a strategic roadmap to accelerate the digital transformation of the European energy grid. The plan focuses on integrating IoT-enabled data centres into the energy system to provide flexibility and developing secure, sovereign AI models to manage smart grids and optimise renewable energy distribution.

For more information:

Finland: National Provisions Supplementing the EU Cyber Resilience Act Approved

28 May 2026

The Finnish Government approved national legislation to supplement the EU’s Cyber Resilience Act, improving the cybersecurity of smart devices. The provisions, which entered into force on 1 June 2026, establish the domestic framework for market oversight of IoT products.

For more information:

France: Decree Regulating Agricultural Drone Applications

19 May 2026

The French Government published a decree specifying plant protection products authorised for application via remotely piloted aircraft. This regulation completes the legal framework for drone-based smart farming and autonomous application systems.

For more information:

UK’s Digital Standards Strategy (2026 to 2030)

June 17, 2026

The strategy outlines how the UK will lead the development of international technical standards for emerging technologies including quantum, advanced connectivity, and semiconductors. It seeks to support domestic economic growth, reduce administrative red tape, and ensure that international standards reflect democratic values and national security priorities.

For further information:

UK Cyber Security and Resilience Bill SME Support

June 16, 2026

A new legislative clause debated in the House of Commons mandates the Secretary of State to establish a dedicated cybersecurity support service for small and medium-sized enterprises. The service will provide technical assistance and recovery guidance to critical suppliers, digital service providers, and operators of essential services following cyber incidents.

For further information:

ICO Finalised Guidance on Consumer Internet of Things

June 11, 2026

The Information Commissioner’s Office published strict privacy-by-design standards targeting the consumer smart device industry. The guidance rebukes dense, legalistic disclosure notices, mandates child-friendly explanations, and endorses “positive friction” in user-experience design to slow users down when making critical data consent choices.

For further information:

ECCC Call for Cybersecurity Experts

May 18, 2026

The European Cybersecurity Competence Centre announced an open recruitment drive for independent cybersecurity professionals to join its pool of experts. Selected specialists will evaluate funding applications and monitor projects under the Digital Europe and Horizon Europe programs.

For further information:

UK Energy Sector Cyber Security Strategy

May 28, 2026

Jointly published by four government and regulatory bodies, this strategy sets out a comprehensive four-year roadmap to protect Great Britain’s energy infrastructure to 2030. The policy focuses on securing clean energy supply chains, addressing legacy operational technologies, and implementing mandatory Cyber Essentials requirements for Ofgem licensees.

For further information:

UK Energy Security ESNZ Committee Chris Few Paper

June 3, 2026

A technical paper submitted to the Energy Security and Net Zero Parliamentary Committee details specific grid vulnerabilities associated with renewable energy configurations. The research stresses that generic security frameworks are insufficient and calls for publicly funded standards to assess high-impact cyber-physical threat scenarios.

For further information:

UK MHRA Regulatory AI Sandbox Launch

June 9, 2026

The Medicines and Healthcare products Regulatory Agency established a controlled regulatory sandbox to test how clinical AI tools predict drug safety. This initiative allows developers to generate pharmacokinetics evidence in a safe environment, supporting the goal of building an AI-enabled healthcare system.

For further information:

UK ORR Safe AI Innovation Action Plan

May 29, 2026

The Office of Rail and Road published its safe AI action plan for the 2026-27 period to guide technology deployment across transport networks. Key actions include updating safety management systems and establishing regulatory sandboxes to support autonomous rail and road operations.

For further information:

Germany Cybersecurity Strengthening Bill

May 27, 2026

The Federal Cabinet adopted a draft law to substantially increase Germany’s cybersecurity posture and resilience. The legislation provides national security authorities with expanded administrative powers to actively prevent, stop, and mitigate incoming severe cyber threats in real time.

For further information:

Spain Public Sector IT & Cyber Hiring Program

June 3, 2026

Spain’s General State Administration approved its 2026 Public Employment Offer, designating 1,700 positions specifically within technology and communications corps. The recruitment drive is intended to address critical public challenges across climate change, cybersecurity, and artificial intelligence.

For further information:

Spain AEE NIS2 Space Sector Guidelines

May 2026

The Spanish Space Agency (AEE) deployed priority guidelines aligning national space programs with the European NIS2 Directive. The lines of action focus on cybersecurity by design, national governance coordination, and real-time threat reporting through the National Cyber-Incident Notification Platform.

For further information:

France Sovereign Cloud Choice for national Health Database

May 21, 2026

The French Interministerial Digital Directorate (DINUM) announced the selection of Scaleway as the sovereign public cloud host for the Health Data Platform. This decision, based on over 350 criteria, supports France’s “Cloud au centre” doctrine to protect highly sensitive public datasets.

For further information:

Go to Europe: Security & Public Policy Archive