EU AI Act Regulatory Brief — Week of 12 October 2026

EUR 824.99 million GDPR fine for fully automated worker decisions

The Dutch Data Protection Authority (DPA) fined Uber B.V. EUR 824,990,000, published on the EDPB national news feed on 8 October 2026 (underlying Dutch DPA announcement: 21 August 2026). The fine covers Uber's driver-account deactivation system as operated between 2018 and 2022. The system automatically suspended or permanently deactivated driver accounts — based on suspected fraud or low customer ratings — without meaningful human review of individual cases. The authority found two violations. First, Article 22 of the GDPR prohibits solely automated decisions that produce significant effects on individuals; Uber's deactivations removed drivers' income without human involvement. Second, Article 13 of the GDPR requires organisations to clearly inform people whose data they collect about any automated decision-making affecting them; Uber had not done this adequately. The case arose from complaints filed by 171 French drivers and was handled under the EU's one-stop-shop mechanism, with the Dutch DPA as lead authority. Uber has appealed.

It is the second-highest GDPR fine to date.

What it means for you

If your organisation uses any automated or AI-assisted system that makes or substantially influences decisions about individual workers, job candidates, contractors, or platform participants — including systems that allocate shifts, score performance, manage access, or handle terminations — the Uber case confirms that GDPR Article 22 applies now, with real enforcement at scale. "Automated decision-making" under Article 22 does not require the word "AI" to appear anywhere in the system's documentation; what matters is whether a machine-produced output produces significant effects on a person without meaningful human review before that effect is applied.

Under the EU AI Act (Regulation EU 2024/1689, as amended by Regulation EU 2026/1744), AI systems used for employment and workers management — including recruitment, performance evaluation, shift allocation, and access to work — are classified as high-risk under Annex III, point 4. The obligation to conform to high-risk requirements applies from 2 December 2027 (the date that obligation begins applying under Regulation EU 2026/1744). You face a two-layer exposure: GDPR Article 22 today, and AI Act conformity by December 2027.

Sources

1. Dutch DPA fines Uber EUR 824 990 000 for unlawful automated decision-making and insufficient information on profiling — EDPB (08.10.2026)
2. Automated decisions: UBER fined nearly EUR 825 million — CNIL
3. Dutch DPA Fines Uber Over Automated Decisions Affecting Drivers — Hunton Andrews Kurth (10.09.2026)

EDPB web-scraping-for-AI consultation closes 30 October 2026

The European Data Protection Board (EDPB) adopted draft Guidelines 03/2026 on web scraping for generative AI on 7 July 2026 and opened a public consultation on 8 July 2026. The consultation closes 30 October 2026. The guidelines establish the first comprehensive GDPR framework for large-scale automated extraction of publicly available data to train generative AI models.

Key positions in the draft: legitimate interest under Article 6(1)(f) is the legal basis the draft examines for scraping at scale, and it is not straightforwardly available: it requires a documented three-part balancing test covering the interest, necessity, and the rights of data subjects. Technical signals — including robots.txt, ai.txt, and CAPTCHAs — affect the outcome of that balancing test because they communicate data subjects' expectations. Special-category data collected incidentally requires safeguards across the full model lifecycle, including filtering, extraction-resistance testing, and output monitoring. Transparency obligations under Article 14 apply to scrapers, though the "impossibility" exception in Article 14(5)(b) may apply in limited circumstances.

These guidelines apply primarily to organisations that scrape the web to build AI training datasets. If you use a third-party foundation model, ask your provider for its training-data transparency documentation and check whether its stated data-collection practices are consistent with the EDPB's framework as it develops.

What it means for you

If you train, fine-tune, or provide a generative AI model whose training data includes web-scraped content, these draft guidelines set out how the EDPB proposes to assess whether that collection was lawful under the GDPR. They are a consultation draft and are not binding; the GDPR itself, and ultimately the courts, decide lawfulness. Under EDPB Opinion 28/2024, models trained on unlawfully obtained data may need to be deleted in their entirety, not just patched at the data level. The "contaminated model" risk applies at the point of initial training. If you deploy a third-party model, your exposure is indirect but real: verify your provider's stated approach to training-data collection and ask whether it is defensible under the EDPB's emerging framework. The consultation closes in 18 days — if you operate AI training pipelines or manage large-scale data processing for AI purposes, consider whether to submit observations.

Sources

1. EDPB Web Scraping Guidelines for AI: Making the Impossible Possible? — Reed Smith (14.07.2026)
2. What Do the EDPB's Web Scraping Guidelines Mean for AI Training Datasets? — Sidley Austin (23.07.2026)
3. Caught in the Web: EDPB Guidelines on Scraping for Generative AI — Slaughter and May
4. EDPB Guidelines 03/2026 consultation event — Digital Policy Alert (08.07.2026)

ISO/IEC 42105 and 24970 reach final ballot; ISO 22989 generative-AI amendment near publication

Two standards in the ISO/IEC 42000 series reached the Final Draft International Standard (FDIS) ballot stage in late August 2026.

ISO/IEC 42105 addresses human oversight in AI systems. It specifies governance mechanisms for ensuring that people retain meaningful review and control over AI outputs and decisions. This standard fills a practical gap that ISO/IEC 42001:2023 (the AI Management System standard) leaves open: 42001 establishes what an AI governance program must contain but does not specify how human-oversight processes should be designed or operated.

ISO/IEC 24970 addresses AI system logging. It sets minimum requirements for recording AI system activity in a way that supports post-incident investigation, ongoing auditing, and regulatory oversight. EU AI Act Article 12 requires high-risk AI systems to maintain logs automatically, but the Act does not itself specify technical logging requirements. ISO/IEC 24970 is a candidate technical reference for that obligation. An ISO/IEC standard gives no presumption of conformity on its own: that needs a harmonised European standard cited in the Official Journal (Article 40).

At stage 50.20 (FDIS), both standards have completed substantive technical development. Publication is expected in late 2026 or Q1 2027.

Separately, the generative-AI amendment to ISO/IEC 22989 (AI Concepts and Terminology) registered its final text on 18 September 2026. The amendment extends the established ISO/IEC AI vocabulary to cover generative models, providing shared definitions that all other 42000-series standards reference. Publication is expected within weeks.

On ISO 42001 and the EU AI Act: The European adoption of ISO/IEC 42001 — EN ISO/IEC 42001:2026 — was approved by CEN in March 2026, with national bodies required to adopt it by September 2026. This European adoption does not modify the technical content of the 2023 ISO edition. Crucially, EN ISO/IEC 42001:2026 has not been cited in the Official Journal of the EU. Under Article 40 of Regulation EU 2024/1689, presumption of conformity with the AI Act applies only to harmonised standards cited in the Official Journal. An ISO/IEC 42001 certificate does not confer that presumption. These are two different claims that should not be treated as equivalent.

What it means for you

Once published, ISO/IEC 42105 and 24970 will be technical references for the AI Act's human-oversight requirement (Article 14) and logging requirement (Article 12) for high-risk systems. Organisations building compliance documentation now can use the FDIS texts as a forward signal, structuring human-oversight and logging evidence in a way that will map cleanly onto the final standards.

If your organisation holds an ISO/IEC 42001 certificate, make sure your board and legal counsel understand what the certificate actually establishes: alignment with AI management-system governance practice, not legal presumption of conformity with the EU AI Act. These two things are distinct and should not be conflated in regulatory filings, contract representations, or public disclosures.

Sources

1. ISO/IEC 42000 Series: Status of Each AI Standard in 2026 — GAICC (05.10.2026)
2. ISO 42006 Raises the Bar for ISO 42001 Certifiers — Bright Defense (14.09.2026)

EU AI Act — no new guidelines or harmonised standards this week

No new delegated acts, implementing acts, official guidelines, or harmonised standards were published or cited in the Official Journal this week. The EU AI Office has not announced any formal enforcement investigation. Two deadlines are 51 days away: the obligation for providers of generative AI systems placed on the market before 2 August 2026 to implement machine-readable marking of synthetic content (Article 50(2) obligation applies date: 2 December 2026); and the application date for two new prohibited practices added by Regulation EU 2026/1744 — AI systems that generate non-consensual intimate imagery of identifiable people, and AI-generated child sexual abuse material (both apply from 2 December 2026).

What it means for you

Nothing changed in the rulebook this week, so the work is the dated work already on the calendar. If you provide a generative AI system that was on the market before 2 August 2026, its outputs must carry machine-readable marking under Article 50(2) by 2 December 2026. If you provide or use a system that can generate images, video or audio of identifiable people, the two new Article 5 prohibitions apply from the same date, and a provider is caught where such output is a reasonably foreseeable, reproducible result of the system without adequate safeguards.

Sources

1. Regulation (EU) 2026/1744 — Digital Omnibus on AI — artificialintelligenceact.eu (27.07.2026)
2. EU AI Act Update: Digital Omnibus Finalizes 8 Compliance Changes — Orrick (29.07.2026)
3. EU AI Act News: Digital Omnibus on AI, New Guidance on Risk Classification, GPAI, and Transparency Obligations — Mayer Brown (30.07.2026)

What to do this week

• Inventory any AI or automated system your organisation uses to make or influence decisions about individual workers, candidates, or contractors. For each system, confirm whether a person reviews the AI's output before it takes effect, and whether affected individuals are informed about automated processing under GDPR Article 13 or 14.
• If a system affecting individuals currently operates without meaningful human review before outcomes are applied, conduct or refresh a Data Protection Impact Assessment and consider how to introduce a human-review step.
• If your organisation trains, fine-tunes, or provides a generative AI model whose training data includes web-scraped content, obtain your training-data transparency documentation and assess it against EDPB Guidelines 03/2026's legitimate-interest balancing requirements. The consultation closes 30 October 2026.
• If you deploy a third-party foundation model, request the provider's Article 53(1)(b) model documentation or equivalent contractual disclosure and review its stated approach to training-data sourcing.
• If your organisation holds an ISO/IEC 42001 certificate, verify that no internal or external communication claims the certificate establishes EU AI Act conformity — it does not, as EN ISO/IEC 42001:2026 has not been cited in the Official Journal.
• If you are the provider of a generative AI system that was placed on the market before 2 August 2026, confirm its synthetic audio, image, video or text outputs will carry machine-readable marking under Article 50(2) by 2 December 2026 (a system placed on the market since 2 August 2026 must already). If you deploy a system that generates deep fakes, or publishes AI-generated text on matters of public interest, confirm your Article 50(4) disclosure to the audience is in place; that duty is the deployer's and has no December transition.

Quick reference

Every source in this issue

1. Dutch DPA fines Uber EUR 824 990 000 for unlawful automated decision-making and insufficient information on profiling — EDPB (08.10.2026)
2. Automated decisions: UBER fined nearly EUR 825 million — CNIL
3. Dutch DPA Fines Uber Over Automated Decisions Affecting Drivers — Hunton Andrews Kurth (10.09.2026)
4. EDPB Web Scraping Guidelines for AI: Making the Impossible Possible? — Reed Smith (14.07.2026)
5. What Do the EDPB's Web Scraping Guidelines Mean for AI Training Datasets? — Sidley Austin (23.07.2026)
6. Caught in the Web: EDPB Guidelines on Scraping for Generative AI — Slaughter and May
7. EDPB Guidelines 03/2026 consultation event — Digital Policy Alert (08.07.2026)
8. ISO/IEC 42000 Series: Status of Each AI Standard in 2026 — GAICC (05.10.2026)
9. ISO 42006 Raises the Bar for ISO 42001 Certifiers — Bright Defense (14.09.2026)
10. Regulation (EU) 2026/1744 — Digital Omnibus on AI — artificialintelligenceact.eu (27.07.2026)
11. EU AI Act Update: Digital Omnibus Finalizes 8 Compliance Changes — Orrick (29.07.2026)
12. EU AI Act News: Digital Omnibus on AI, New Guidance on Risk Classification, GPAI, and Transparency Obligations — Mayer Brown (30.07.2026)

Compiled by Relay Labs Ltd from the sources above, which remain the authoritative text. General information about EU law, not legal advice.