GRC Report Staff

The legal fight over Bunnings may be over, but the Office of the Australian Information Commissioner is making sure its lessons are not left behind in a tribunal ruling. The regulator on Tuesday published updated guidance for organizations covered by the Australian Privacy Principles that are considering deploying facial recognition technology in busy, publicly accessible spaces such as retail storefronts. The revisions are not a change in the law. They are a statement of how the Office of the Australian Information Commissioner (OAIC) intends to apply it after the Administrative Review Tribunal's March 2026 decision in the long-running Bunnings case.

The President of the Office of Competition and Consumer Protection (UOKiK) has opened proceedings against Columbus Energy, one of Poland's best-known renewable energy installers, over allegations that the information consumers received before signing a contract, the way the company described their right to withdraw, and the time some customers waited to recover their money after exercising that right.

Anthropic’s Mythos did not merely find a weakness in a computer network. In testing, it followed the weakness through. The frontier artificial intelligence model identified vulnerabilities, developed exploits and carried an attack across multiple stages, adjusting its approach with limited human oversight. In some attempts, it completed a full network takeover. OpenAI’s GPT-5.5, released weeks later, showed similar capabilities and performed slightly better on a benchmark of expert-level cybersecurity tasks.

The UK's audit watchdog has fined Ernst & Young £1,197,000 after concluding the firm failed to obtain sufficient audit evidence in critical areas of its 2021 audit of online furniture retailer Made.com Group, shortcomings the regulator said stemmed from an inadequate challenge of management's forecasts.

Since May, regulators, banks and financial infrastructure operators in Singapore have been sitting around the same table, confronting a problem that is becoming harder to dismiss with each new generation of artificial intelligence. On Tuesday, that quiet collaboration acquired a name. The Monetary Authority of Singapore (MAS) and the Association of Banks in Singapore (ABS) formally launched the AI-Driven Cyber and Technology Risk Taskforce, or ACT, an industry-wide initiative intended to strengthen the financial sector's defenses against threats created by frontier AI models.

On Tuesday, the Australian Federal Court ordered Harvey Norman Holdings and Latitude Finance Australia to pay a combined $35.9 million (AUD $55 million) after finding they engaged in misleading conduct and made false or misleading representations in a nationwide advertising campaign that ran between January 2020 and August 2021. Harvey Norman was ordered to pay $22.8 million (AUD $35 million), while Latitude was ordered to pay $13.1 million (AUD $20 million). According to the Australian Securities and Investments Commission (ASIC), the combined penalty is among the largest it has secured in a case involving misleading conduct related to financial products and services.

The European Central Bank has spent the past year teaching its collateral framework a new habit. First it learned to look at corporate bonds through the lens of climate-related transition risk. Now it will do the same for a broader class of assets that sit behind the Eurosystem's lending operations.