GRC Report Staff

On Aug. 2, the European Commission's AI Office, working alongside national authorities, began enforcing key provisions of the AI Act. The same date also marked the start of new transparency obligations requiring certain AI systems to disclose when users are interacting with artificial intelligence rather than a human being. AI-generated or AI-altered content must now carry machine-readable markers that make it easier to detect, while deepfakes (images, audio, or video) must be clearly labeled.

Italy's data protection authority has fined telecommunications provider TIM €9.516 million, concluding that failures in the company's telemarketing operation extended well beyond nuisance calls. According to the regulator, unauthorized call centers funneled unlawfully obtained customer information into TIM's legitimate sales network, exposing weaknesses in the company's oversight of third-party partners and turning illegally obtained contacts into apparently valid customer contracts.

For two years, according to federal prosecutors, the business model at Access DX Laboratory rested on finding more patients, ordering more genetic tests, and billing the government. The methods, the Justice Department alleges, included paying marketers for referrals, compensating telemedicine providers for fraudulent physician orders, breaking genetic tests into separately billable components, and sending Medicare and Medicaid the bill for testing that was not medically necessary. That alleged scheme has now produced a $36.4 million resolution.

The European Commission said that it has reached preliminary findings that TikTok's default account settings for minors do not meet the child protection standards required under the Digital Services Act, accusing the platform of exposing young users to unnecessary risks from the moment they create an account. The findings stop short of a final decision, but they mark another significant step in the Commission's increasingly broad scrutiny of TikTok's design.

Eight years after promising regulators it would fix persistent weaknesses in its anti-money laundering controls, UBS is paying for what those regulators say it failed to finish. Four regulators announced coordinated enforcement actions Monday imposing a combined $173 million in penalties against the firm, concluding that deficiencies identified years earlier continued to undermine transaction monitoring, customer due diligence, and suspicious activity reporting. The actions were brought by the Treasury Department's Financial Crimes Enforcement Network (FinCEN), the Securities and Exchange Commission, the Commodity Futures Trading Commission, and the Financial Industry Regulatory Authority.

The European Banking Authority (EBA), European Insurance and Occupational Pensions Authority (EIOPA), and European Securities and Markets Authority (ESMA) published a joint statement that is not warning that frontier artificial intelligence will eventually reshape cybersecurity. They are arguing that it already has.

In a 6-3 decision, the court ruled that President Donald Trump lawfully removed Federal Trade Commissioner Rebecca Kelly Slaughter in March 2025 without citing any statutory cause, overturning the core holding of Humphrey's Executor v. United States, the 1935 decision that had long shielded members of independent commissions from at-will dismissal. The ruling dramatically expands presidential authority over agencies that Congress intentionally designed to operate with a degree of independence from the White House.