On April 15, 2026, the European Data Protection Board (EDPB) adopted guidelines on the processing of personal data for scientific research purposes.[1] The guidelines aim to clarify GDPR compliance requirements for scientific research involving personal data.
On March 18, 2026, the UK government published its report (the Report) and impact assessment on the use of copyright works in the development of AI systems, following the UK Government’s consultation on Copyright and AI which launched in December 2024.
The Consultation
The Consultation aimed to explore how copyright could best support the potential
The following is part of our annual publication Selected Issues for Boards of Directors in 2026. Explore all topics or download the PDF.
The U.S. regulatory and enforcement landscape for digital assets and distributed ledger technology changed dramatically in 2025. Virtually overnight, U.S. regulators shifted from an enforcement-heavy crypto-skepticism that effectively outlawed the participation of
The following is part of our annual publication Selected Issues for Boards of Directors in 2026. Explore all topics or download the PDF.
Over the last nine years, during which I served as Cleary Gottlieb’s Managing Partner, there have been significant, often unexpected, changes in global politics, global markets and the legal industry.
The following is part of our annual publication Selected Issues for Boards of Directors in 2026. Explore all topics or download the PDF.
Overview of AI Copyright Litigation
In 2026, we can expect important developments in the legal landscape of generative AI and copyright. Dozens of copyright infringement lawsuits targeting the training and development
As states continue to grapple with establishing regulatory frameworks for the most powerful artificial intelligence (“AI”) systems, New York has joined California in targeting frontier AI models with the Responsible AI Safety and Education Act (the “RAISE Act” or the “Act”).[1] Signed into law on December 19, 2025 by Governor Hochul, the Act creates
CJEU ruling heralded as “landmark” GDPR judgment turns on a specific set of facts and requires careful interpretation in the post-DSA regulatory reality.
Background
On 19 November 2025, the European Commission presented its much-anticipated Digital “Omnibus” package[1] intended to ease the administrative and compliance burden facing European businesses. Executive Vice-President of the Commission Henna Virkkunen stated that “[f]rom factories to start-ups, the digital package is the EU’s answer to calls to reduce burdens on our businesses.”[2]
On November 4, 2025, the UK High Court handed down judgment in Getty Images v. Stability AI,[1] a case emphasized for its significance to content creators and the AI industry and “the balance to be struck between the two warring factions”.[2] Despite significant public interest in the lawsuit, the issues that remained before
On 10 October 2025, Law No. 132/2025 (the “Italian AI Law”) entered into force, making Italy the first EU Member State to introduce a dedicated and comprehensive national framework for artificial intelligence (“AI”). The law references the AI Act (Regulation (EU) 2024/1689) and grants the government broad powers to implement its principles and establish detailed operational rules.
