Regulatory Watch – April 2026

European Commission awards tender for sovereign cloud

Four companies have been awarded tenders to provide sovereign cloud services to the EU for a six year period. The tender was launched in October 2025 as part of a drive to reduce the bloc’s dependency non-EU technology. The companies selected – Luxembourg’s Post Telecom, Germany’s StackIT, French ​Iliad’s data centre unit Scaleway and Belgium’s Proximus – are all European. Each had to demonstrate their alignment to the commission’s cloud sovereignty framework which includes ensuring that non-EU entities have limited control over the technologies of the services they provide. (Reuters)

Mythos AI model raises security concerns

The development of Anthropic’s Claude Mythos model has led to crisis meetings among finance ministers after it found vulnerabilities in many major operating systems. Experts say it potentially has an unprecedented ability to identify and exploit cyber-security weaknesses, though others caution that further testing is needed to properly understand its capabilities. Mythos was revealed in early April and found by developers to be “strikingly capable at computer security tasks”. As a result Anthropic held back its release and instead made the model available privately to tech companies including Crowdstrike, Microsoft and Nvidia. However, testing by the UK’s AI Security Institute indicated that it while was a powerful tool able to find many security holes in undefended environments, Mythos was not dramatically better than Claude’s predecessor, Opus 4. (BBC)

Delays to US datacentres threaten AI expansion

The Financial Time reports that data provided by satellite and analytics group SynMax shows that 40 per cent of datacentre projects are behind schedule and likely to miss completion dates by more than three months. Industry executives complained of projects hampered by permitting hurdles and chronic shortages of labour, power and equipment. Hyperscalers are seeking to build ever bigger datacentres, many drawing 1 Gigawatt of power – equivalent to the output of a nuclear reactor. But bottlenecks are a key constraint on companies’ ability to generate returns on investment in AI. Meanwhile Maine is expected to become the first US state to ban the construction of datacentres. States including Georgia, Oklahoma and Virginia have also put forward proposals for temporary datacentre bans amid growing concerns over the energy costs and environmental impacts of such projects. (Financial Times)

EU’s verification app is ready as momentum for under 16 social media ban grows

The EU’s age verification app for online platforms is ready and will shortly be available to use, said European Commission President Ursula von der Leyen. The app will be compatible with both mobile devices and computers and require users to upload their passport or ID card to confirm their age. It is recognised that the app can be bypassed by the use of virtual private networks but is intended to be a barrier that “avoids unintended exposure of kids” rather than “a policing mechanism”, according to a spokesman. The commission has also stated that it is pushing ahead with an EU-wide coordination mechanism to ensure that age verification is universally adopted by nation states. (Reuters)

Meta AI access fee challenged by EU

The European Commission has threatened to force Meta-owned WhatsApp to reverse a move that effectively limits rival AI chatbots from accessing the platform. Meta had attempted to solve an antitrust investigation in which competing AI firms were banned from accessing WhatsApp by replacing it with a fee. The commission is arguing that this will have similar effect and will issue an order re-instating access for third party chatbots until a final decision is reached. Meta said the commission’s decision means that the company will have to provide its service for free and would amount to subsidising select companies rather than clearing the way for more competition. (AP News)

Australian teenagers avoiding social media ban

Four months after the Australian social media ban took effect, 61 per cent of teenagers who previously held accounts still have social media access, equating to half of all 12-15 year olds. A small proportion of children have opened accounts on new restricted platforms since the ban came into force. The research was commissioned by the Molly Rose Foundation, a charity dedicated to preventing online harm, and was conducted online among 12-15 year old Australians by YouthInsight. The charity says that its findings are consistent with those of Australia’s eSafety commissioner, who conducted research among parents. More details of the foundation’s research here.