As we reach the end of the third quarter of 2026, we present a roundup of the most notable news stories, rulings, case law and trends in the technology sector from the past three months. THE CODE, Pérez-Llorca’s technology newsletter, is a joint effort by the firm’s teams in Spain, Portugal, Mexico, Colombia and Peru.
EU| The European Commission presents the EU Kids Act proposal: Brussels has put forward the EU Kids Act proposal to protect minors from social media, video games and AI chatbots.
SPAIN | Pending legislative initiatives in the audiovisual sector lapse following the dissolution of the Spanish Parliament: The dissolution of the Spanish Parliament leaves the tech and audiovisual legislative agenda in limbo.
PORTUGAL | Use of AI in public procurement: Portugal is reforming its Public Contracts Code to integrate AI throughout the process, whilst maintaining human oversight.
MEXICO | The Secretariat for Anti-Corruption and Good Governance announces two ex officio investigations into possible mass data breaches: Two massive data breaches are putting the new data protection authority to the test.
COLOMBIA | Colombia passes the Music Act: It creates a free register for artists, exempts musical instruments and works from VAT, and tightens measures against fraudulent licences.
PERU | Transparency and governance obligations under the Artificial Intelligence Regulation come into force: The first deadline for implementing certain transparency and human oversight obligations in AI has passed.
EUROPEAN UNION
The European Commission presents the proposal for the EU Kids Act: On 17 September 2026, the European Commission adopted the proposal for the EU Kids Act, which aims to strengthen the protection of children in the digital environment through gradual access to certain services, age verification safeguards and ‘security by design’ requirements. The initiative covers, among other services used by minors, social media, video platforms, video games and certain companions and chatbots based on artificial intelligence. You can read the proposal here.
Furthermore, on 2 October 2026, the Commission launched a specific feedback period on the proposal, aimed at children, parents and guardians, teachers and the platforms concerned, among others, with the aim of gathering information for the subsequent legislative debate in the European Parliament and the Council. The deadline for submitting feedback is 26 November 2026. You can give feedback here.
Pérez-Llorca has published a legal briefing containing further information on the proposal. You can read the briefing prepared by the firm here.
The European Commission publishes guidelines on transparency obligations under Article 50 of the AI Act: On 20 July 2026, the European Commission published the final Guidelines on the transparency obligations set out in Article 50 of the Artificial Intelligence Act (“AI Act”), aimed at providers and those responsible for the deployment of artificial intelligence systems (“AI”). The Guidelines set out obligations to provide information when a person interacts with certain AI systems, the machine-readable labelling of artificially generated or manipulated content, and the information requirements applicable to deepfakes, emotion recognition systems, biometric categorisation and certain AI-generated texts on matters of public interest, among other issues. These obligations have been applicable since 2 August 2026. You can read the guidelines here.
The European Commission sets out the procedure for the imposition of penalties for general-purpose AI models: Commission Implementing Regulation (EU) 2026/1755 of 20 July 2026, published in the Official Journal of the European Union on 21 July 2026, lays down detailed provisions for two types of procedures which the Commission may conduct under the AI Act: (i) assessments of general-purpose AI models (including the conditions for access to the model and the involvement of independent experts) and (ii) enforcement procedures targeting the providers of these models. With regard to evaluations, the Commission may require access to the model via an API, the source code, the model weights or the infrastructure hosting it, and may appoint independent experts through a call for expressions of interest, subject to strict requirements regarding independence and confidentiality. With regard to penalties, the Regulation governs the initiation and conclusion of proceedings for the imposition of fines, the possibility of ordering urgent interim measures, the right of the supplier concerned to be heard and to have access to their file (subject to the protection of trade secrets), and the limitation periods for both the imposition and enforcement of fines. You can read the Regulation here.
The European Commission publishes guidance to facilitate the implementation of the Cyber Resilience Act: On 27 July 2026, the Commission published new non-binding guidance to facilitate the implementation of the Cyber Resilience Act (“CRA”). The document contains 67 practical examples designed to clarify the scope of the Act, the treatment of free and open-source software, the concept of substantial modification, support periods, notification obligations and the assessment of cybersecurity risks, among other matters. The guidance is intended to help manufacturers, developers and other operators affected by the phased implementation of the CRA to prepare for it. You can read the guidance here.
Furthermore, on 30 September 2026, ENISA updated the Frequently Asked Questions page relating to the CRA Single Reporting Platform, incorporating practical guidance on its purpose, obligated entities, and the procedures for registration, submission and management of reporting. You can read the questions here.
The European Commission is seeking feedback on challenges and way forward in the area of the effect of technology on copyright: On 29 September 2026, the Commission began gathering feedback on challenges posed by technology, and in particular artificial intelligence, to the European intellectual property system. The targeted consultation covers four areas: the use of copyright-protected content in AI systems; the fight against online piracy of content, including live events; the application of the single equitable remuneration right of music performers and producers; and the copyright of scientific research. The deadline for submitting comments is 3 November 2026. You can see the public consultation here.
Guidelines 3/2025 on the interplay between the DSA and the GDPR: On 17 September 2026 the European Data Protection Board (“EDPB”) adopted the final version of its Guidelines on the interplay between Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a single market for digital services (the “DSA”) and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the “GDPR”). The document analyses how the two frameworks should be applied in conjunction when the obligations imposed by the DSA involve the processing of personal data, and provides guidance on how to avoid conflicting interpretations, paying particular attention to the obligations of online platforms and the need to fully comply with the principles and safeguards of the GDPR. You can read the guidelines here.
SPAIN
Lapse of pending legislative proposals in the audiovisual sector following the dissolution of the Spanish Parliament: By Royal Decree 806/2026 of 5 October, the Congress of Deputies and the Senate were dissolved and a general election was called for 29 November 2026. This has caused all draft and preliminary draft bills pending approval to lapse, meaning they must be resubmitted and undergo the parliamentary process anew following the constitution of the new Parliament if they are to be taken up again. The lapse of draft national legislation does not, however, mean that substantive obligations arising from European legislation with direct effect, such as regulations, are no longer binding, as these remain fully applicable in Spain.
Among the initiatives affected that have the greatest impact on the audiovisual sector, and which may also affect other sectors, are:
Although these initiatives have been shelved, this does not mean they have disappeared for good; depending on the election results, much of their content could be taken up again by the next Spanish government, and it is therefore advisable to actively monitor the new parliamentary term. You can read the legal briefing prepared by Pérez-Llorca on this matter here.
The AEPD highlights the safeguards for using AI in CV analysis: The Spanish Data Protection Agency (“AEPD”) published a briefing on 7 October 2026 regarding algorithmic systems in the workplace. Previously, the AEPD had issued a warning (Resolution AI-00009-2026) to a company that was considering implementing an artificial intelligence system to screen and score applications in recruitment and internal mobility processes. The warning, which does not constitute a confirmed infringement or a penalty, involves the exercise of the preventive power provided for in Article 58(2)(a) of the GDPR. The briefing notes that the use of AI in recruitment processes must incorporate data protection safeguards from the design stage and before the system is put into operation, paying particular attention to risk assessment, the quality and suitability of the data, and ensuring that human intervention is effective. The briefing links this warning to the new Royal Decree 723/2026 of 9 September, which transposes Directive (EU) 2019/1152 of the European Parliament and of the Council of 20 June 2019 on transparent and predictable working conditions in the European Union, in force since 5 October 2026, which requires workers to be informed in writing of the existence and operation of any algorithmic systems that affect their working conditions. You can read the AEPD’s briefing here (only available in Spanish).
Further amendment to the Circular governing the Alias Register: Circular 3/2026, dated 8 September, issued by the National Commission on Markets and Competition (“CNMC”), amends Circular 1/2026, dated 18 March, governing the Alias Register, thereby completing the adaptation of the system prior to its entry into force, on 15 September 2026, of the blocking obligations set out in Order TDF/149/2025. From that date, service providers must block SMS, MMS and RCS messages sent using alphanumeric aliases that are not correctly registered or that do not originate from authorised providers, although Circular 3/2026 introduces a transitional pre-registration scheme for aliases for which a registration application was submitted before 15:00 on 14 September 2026 and was still pending validation. The system aims to reduce fraud involving identity theft and to enable verification that trade names, trademarks and other identifiers used as senders do indeed belong to their rightful owners. You can read the Circular here and the Royal Decree here (only available in Spanish).
The AEPD is investigating offensive AI following the first data breach caused by an AI agent in Spain: On 28 September 2026, the AEPD published an analysis on the use of artificial intelligence agents to accelerate cyber-attacks and exploit vulnerabilities, warning that the “window of exposure” between the discovery of a vulnerability and its exploitation was disappearing, with intrusion times being reduced to a matter of minutes. The AEPD noted that reports of personal data breaches have risen by 150% in 2026 compared with 2025, and attributes the risk to structural weaknesses in ICT systems, such as a lack of segmentation, reliance on external suppliers and insufficient supply chain auditing.
This analysis is closely linked to the first notification received by the AEPD on 14 September 2026 concerning a personal data breach carried out by an artificial intelligence agent using a well-known language model. The agent independently searched for vulnerabilities in the application, gained access to the system and exploited the breach to alter personal data and access invoices. The AEPD emphasises that, although this initial report does not allow us to identify a statistical trend, it does constitute a significant indication that AI-enabled attacks are no longer a theoretical risk, meaning such scenarios should be explicitly incorporated into risk analyses and incident response times must be reviewed. You can read the AEPD’s analysis here and an article on the data breach here (only available in Spanish).
PORTUGAL
Use of AI in public procurement: Decree-Law No. 177/2026 of 4 September, which entered into force on 1 October, amends the Public Contracts Code (Código dos Contratos Públicos) and expressly establishes a legal framework for the use of digital systems, including artificial intelligence, throughout the entire public procurement cycle. The reform combines this deployment with safeguards regarding interoperability, data protection and human oversight, whilst preserving the authority of the competent bodies to review and validate outcomes. It further provides for the possibility of reserving certain contracts for start-ups and testing technological solutions prior to initiating procurement procedures. You can read the Decree-Law here (only available in Portuguese).
High Council for the Judiciary prioritises AI training: The High Council for the Judiciary (Conselho Superior da Magistratura – CSM), sitting in plenary on 8 September, approved a new Training Regulation designating artificial intelligence, digital evidence, cybersecurity and data protection as priority areas for professional development. Published on 17 September, the regulations create a CSM Training Unit tasked with assessing training needs, planning and evaluating initiatives, preparing annual programmes and maintaining a repository of training materials. While participation in supplementary training is generally optional, the CSM may mandate attendance for specific programmes under the circumstances expressly set out in the regulations. You can read the Regulation here (only available in Portuguese).
LATAM
MEXICO
Mexico issues a decree for the protection of children and adolescents in the digital environment: On 14 October 2026, following recent incidents of student violence in Mexican schools, the President of Mexico issued the Decree on Safe Digital Environments for Children and Adolescents, which expressly covers video games and prohibits digital platforms from allowing children and adolescents to access, be exposed to, or be recommended content that generates or promotes harassment, abuse, sexual violence, hate speech, mass violence, glorification of crime, pornography, suicide, self-harm, and eating disorders. The Decree regulates access to content rather than the content itself, imposing age verification, parental supervision, evidence preservation and enhanced default privacy obligations on platforms, together with a dedicated point of contact for the authorities. It sets out no specific penalties, leaving enforcement to secondary regulations, and entered into force on 14 October 2026, with platforms required to report the compliance measures adopted by 12 November 2026. You can read the Decree here (only available in Spanish).
COLOMBIA
Colombia passes the Music Act: Through Act 2615 of 2026, published on 29 July 2026, Colombia recognises, promotes and strengthens the music sector, with a particular focus on non-mainstream artists. The legislation establishes the Music Information System (“SIMUS”), a free and voluntary register of agents, organisations and musical instruments, and the Special Account Fund for the Music Sector, an autonomous fund attached to the Ministry of Culture, the Arts and Knowledge. It also exempts musical instruments and works by non-mainstream artists from VAT and establishes an obligation to disclose when the broadcast of musical works on digital media and platforms is in return for payment or sponsorship. In relation to copyright, it regulates the individual and collective management of the right of public communication in respect of musical works and phonograms, and introduces the concept of a “Fraudulent Manager” – defined as anyone who licences the use of such works without being the rights holder, an accredited representative or a legally recognised collective management organisation; authorisations issued by such a person are invalid and give rise to an obligation to compensate for any damages caused. You can read the Act here (only available in Spanish).
Decree 769 of 2026 to promote, protect and guarantee healthy and safe digital environments for minors: This Decree implements Act 2489 of 2025 to promote, protect and guarantee healthy and safe digital environments for children and adolescents, in the face of risks such as cyberbullying, online sexual exploitation and abuse, and breaches of personal data. It establishes a principle of shared responsibility between the state, families, schools and digital platforms, under which, within 12 months, platforms must incorporate privacy by design and report half-yearly to the Ministry of Information and Communications Technologies (MinTIC), while schools must include the prevention of digital risks in their Institutional Educational Projects. The Decree mandates the formulation of a national public policy on healthy and safe digital environments and the creation of an inter-institutional monitoring system, specifying that the measures must not result in prior censorship or the weakening of encryption. You can read the Decree here (only available in Spanish).
Acts to regulate artificial intelligence: Various initiatives to regulate AI in Colombia are continuing to be considered in Congress. Act 065 of 2026 proposes a general framework for promotion and governance, with a National Council for Artificial Intelligence led by the Ministry of Science, but without a detailed system of penalties. Act 025 of 2026 adopts an approach more closely aligned with the European AI Regulation, classifying systems by risk level (critical, high —with specific transparency obligations—, minimal or none), with a national AI authority and a penalty regime comprising fines of up to 3,000 times the minimum wage, suspension for up to 24 months and closure of the offending system. Act 138 of 2026, for its part, regulates AI with a focus on promotion and governance: it establishes the National Council for Artificial Intelligence (CON-IA), which is advisory in nature and lacks a penalty regime, focusing on technical recommendations and regulatory sandboxes. You can read Act 065 of 2026 here, Act 025 of 2026 here and Act 138 of 2026 here (only available in Spanish).
PERU
Implementation of the transparency and governance obligations under Peru’s Artificial Intelligence Regulations begins: In September 2026, the first implementation deadline for the obligations set out in the Regulations under Act No. 31814, approved by Supreme Decree No. 115-2025-PCM, expired. This first stage covers public sector entities belonging to the executive, legislative and judicial branches, and autonomous constitutional bodies; and, in the private sector, developers or implementers using AI systems in the health, education, justice, security, economic and financial sectors (subject to different deadlines for micro and small enterprises).
Key requirements that entered into force include: (i) informing users about the purpose, functionalities and decisions of high-risk systems; (ii) establishing security, privacy and transparency policies and procedures; and (iii) implementing human oversight mechanisms for certain high-risk decisions. The timetable provides for subsequent phases covering other sectors and entities. You can read the Regulations here (only available in Spanish).
The Presidency of the Peruvian Council of Ministers sets out the conditions for the use of artificial intelligence tools in administrative penalty proceedings: Through Report No. D000006-2026-PCM-SSPRD-AST, dated 1 July 2026, the Presidency of the Council of Ministers (“PCM”) issued a statement on the use of AI tools by public administration bodies, particularly in the context of administrative sanctioning proceedings. The statement notes that it is the responsibility of each body to assess the implementation of these tools within the scope of its powers, ensuring compliance with the applicable provisions and respect for the rights of those subject to administrative proceedings. You can read the PCM report here (only available in Spanish).
INDECOPI incorporates AI tools into its enforcement activities: In April 2026, the National Institute for the Defence of Competition and the Protection of Intellectual Property (“INDECOPI”) reported that it had used AI and data science tools to analyse recordings of sales calls as part of an investigation into breaches of consumer protection regulations, the results of which were subsequently reviewed by the authority’s staff. These developments highlight the growing use of AI in state enforcement work and the importance of ensuring mechanisms for human oversight, transparency and respect for due process. You can read the INDECOPI press release here (only available in Spanish).
An analysis of the use of artificial intelligence as a key factor in due diligence processes: In the context of acquisitions or investment transactions, it is becoming increasingly important to analyse in detail how the target company utilises AI systems in the course of its business, particularly in the creation, management and use of intellectual property assets.
This analysis makes it possible to identify legal risks that may have a direct impact on the valuation of the transaction, such as the use of content protected by third-party rights for model training, uncertainty regarding the ownership of results generated by AI, or reliance on licences from third-party technology providers. In particular, the inappropriate or undocumented use of AI tools may lead to a significant devaluation of the intellectual property portfolio held by the target, as it compromises the originality, ownership or defensibility of the intangible assets against third-party claims. Therefore, assessing the extent to which AI is integrated into the target’s production and creative processes must form an essential part of the scope of due diligence processes, alongside the verification of internal policies governing the use of these tools and contracts with technology providers.
You can read an article on the matter in Expansión written by Andy Ramos, partner of Pérez-Llorca’s Intellectual Property and Technology practice area, here (only available in Spanish).
EUORPEAN UNION
CJEU
Protection of short texts published on social networks and the exception for reporting on current events (Case C-598/24, Gândul Media Network, 3 September 2026): The CJEU has ruled that a short text published on a social network may constitute a ‘work’ protected by copyright where it is original – that is to say, where it reflects the author’s personality through free and creative choices and constitutes an intellectual creation in its own right – and that the short length of the text does not in itself preclude its protection. The Court also states that the exception relating to reporting on current events set out in Article 5(3)(c) of Directive 2001/29/EC must comply with the three-stage test in Article 5(5): the use must be limited to certain special cases, must not conflict with the normal exploitation of the work, and must not unreasonably prejudice the legitimate interests of the copyright holder. You can read the judgment here.
Law applicable to the formal validity of the assignment of copyright (Case C-176/25, Steizer, 24 September 2026): The CJEU clarified the scope of application of the Rome I and Rome II Regulations where, in the context of a copyright infringement claim brought against a third party, that third party challenges the formal validity of the contract by which the author assigned the rights in question to the claimant. The Court considers that the question of the formal validity of the assignment contract constitutes a contractual matter and must be determined in accordance with the Rome I Regulation, even though it arises incidentally in the context of a copyright infringement dispute brought, as a non-contractual obligation, to the Rome II Regulation, thereby distinguishing between the law applicable to the contractual assignment relationship and the law governing liability arising from the infringement of exclusive rights. You can read the judgment here.
SPAIN
The Spanish Supreme Court rules on the termination of three record contracts on the grounds of breach of contract and infringement of the artist’s moral rights (Supreme Court Judgment 3347/2026, of 21 July 2026): The Civil Chamber of the Spanish Supreme Court has ruled on a dispute between an artist and a record company concerning three contracts under which the artist granted exclusive rights to the recording, reproduction and distribution of their performances in exchange for remuneration proportional to sales. The Court confirmed that, once the recording period had ended, the contracts remained in force while the record company continued to exploit the recordings; consequently, the repeated failure to pay remuneration constitutes a fundamental breach justifying the termination of the contracts. With regard to the moral rights of the performing artist, the Court distinguishes between karaoke versions, which do not infringe those rights as they merely omit the artist’s performance without modifying or distorting it; and remix and Latin versions, which do constitute unauthorised manipulation capable of damaging the performer’s artistic reputation and identity by altering their characteristic style. The Supreme Court upheld the appeal, declared the three contracts terminated and revoked the company’s right to continue using the recordings. You can read the judgment here (only available in Spanish).
LATAM
MEXICO
The Secretariat for Anti-Corruption and Good Governance announces ex officio investigations into possible mass data breaches: In September 2026, the Secretariat for Anti-Corruption and Good Governance announced two ex officio investigations arising from its active monitoring of potential security incidents. The first relates to a database allegedly linked to Aeroméxico, which is said to contain more than 15 million records. The second concerns more than 12.9 million records allegedly originating from various call centres and is said to include contact details, tax information, residential addresses and bank details. The investigations are ongoing and the authority has not yet determined who is responsible.
These actions demonstrate a more proactive approach by the new Mexican data protection authority, which can initiate investigations based on information obtained through its own monitoring. Organisations should review their incident detection and response procedures, evidence retention, access controls and the supervision of data processors, call centres and other service providers that process personal data. You can read the investigation relating to Aeroméxico here and the investigation relating to call centres here (only available in Spanish).
COLOMBIA
The Court of Justice of the Andean Community rules that Colombia is in breach of its obligations regarding the retransmission of television signals (joined cases 01-AI-2018 and 02-AI-2018): On 25 August 2026, the Court of Justice of the Andean Community (“TJCA”) handed down its judgement in joined cases 01-AI-2018 and 02-AI-2018, brought by Caracol Televisión S.A. and RCN Televisión S.A. against Colombia, and partially upheld the claim for non-compliance with Andean Decision 351 of 1993 on Copyright and Related Rights. The TJCA concluded that Colombia had breached Articles 21, 39(a), 42 and 54 of Decision 351, holding that the right of retransmission has an economic dimension and encompasses both the power to authorise or prohibit retransmission and the power to make it subject to remuneration, so that the fact that free-to-air broadcasts are provided to the public free of charge does not mean that their retransmission by a third party must also be free of charge. The Court clarified that classifying the Colombian regime as a “must-carry” or “must-offer” scheme does not exempt it from complying with Andean law, and that the exception in Article 22(k) does not cover retransmission by pay-TV operators. It also concluded that Preliminary Ruling 225-IP-2015 had been misapplied by the Superior Court of Bogotá. You can read the judgement here (only available in Spanish).
The Constitutional Court sets limits on the retention of biometric data when renewing passports (Judgement T-208 of 2026): In this judgement, the Constitutional Court ruled on a constitutional complaint brought by a citizen against the Ministry of Foreign Affairs and the National Registry, in which she challenged the requirement to update her biometric data (fingerprints and facial recognition) in order to renew her passport, arguing that it was disproportionate. The Court concluded that the collection of biometric data serves legitimate purposes (verifying identity, preventing identity theft, protecting national security) and constitutes an appropriate and necessary means of achieving them; it therefore upheld the lower court decisions which had dismissed the application for constitutional protection. However, it concluded that biometric data is retained indefinitely, without clear criteria or time limits for retention, which disregards the principle of temporality in the processing of sensitive data, and urged the Ministry of Foreign Affairs to amend its policies to establish explicit criteria and time limits. This precedent is significant, because while it validates the use of biometrics for identification purposes, it sets a clear limit by stating that the indefinite retention of sensitive data without justification is unconstitutional – a criterion that any private entity collecting biometric data in Colombia should also observe. You can read the judgement here (only available in Spanish).
PERU
The Peruvian data protection authority clarifies the oversight duties of personal data controllers regarding their profiling service providers that utilise artificial intelligence: Through Directorial Resolution No. 813-2026-JUS/DGTAIPD-DPDP, the National Personal Data Protection Authority imposed a penalty on an entity in the financial sector for processing personal data without consent and unlawfully collecting personal data from potential customers. The organisation had engaged a supplier to provide services for the identification and profiling of potential customers. However, the authority found that the processing went beyond merely obtaining contact details to request consent and included the analysis of data relating to individuals who were not customers, with a view to identifying commercial opportunities.
The ruling specifies that the data controller must be aware of and verify the sources and means of collection used by its supplier, and that having a generic contractual clause on regulatory compliance is not sufficient to exclude its liability. This approach is particularly significant when contracting services that incorporate AI, as it requires an understanding of how the supplier obtains and processes the personal data used, without outsourcing replacing the data controller’s duties of due diligence and oversight. You can read the decision here (only available in Spanish).
Major AI tech firms agree to self-regulate in response to the White House: In September 2026, senior executives from Anthropic, OpenAI, Google, xAI, Meta and Nvidia signed a joint document with the President of the United States, Donald Trump, in which they committed to establishing sufficient internal and external controls to ensure the safety of their artificial intelligence models; the document was entitled the “Joint Commitment on Frontier Responsibilities”. Following the meeting, Sundar Pichai (Google), Dario Amodei (Anthropic), Mark Zuckerberg (Meta), Greg Brockman (OpenAI), Elon Musk (xAI) and Jensen Huang (Nvidia) signed the agreement, committing to establish robust internal processes and controls to ensure their technology behaves as intended. Furthermore, the agreement includes four layers of controls and audits: internal controls focusing on cybersecurity and the prevention of chemical and biological threats, internal monitoring, external auditing and an independent oversight committee. The text provides that, over time, these measures may be enshrined in legislation or regulations, thereby positioning self-regulation as the first step towards a potential regulatory framework for artificial intelligence. You can read an article on the subject here (only available in Spanish).
The European Commission promotes reusable generative AI for public administrations: In July 2026, the European Commission launched EuropAI, an initiative aimed at developing, procuring and testing sovereign and reliable generative artificial intelligence solutions that can be reused and scaled across European public administrations. The project brings together public authorities and technical partners from the Netherlands, Denmark, Belgium and Luxembourg, and will focus on three areas: legal and administrative simplification, urban analysis and spatial planning, and digital assistants to support interaction with the public. Furthermore, EuropAI will establish a shared framework that will enable participating public authorities to jointly procure, test and deploy European generative AI solutions, including common technical components, implementation plans and regulatory compliance documentation. The initiative reflects the European Union’s drive towards sovereign artificial intelligence, which is also being applied to the legal and administrative spheres. You can read about the initiative here.
OpenAI launches a version of its artificial intelligence designed for lawyers: In September 2026, OpenAI launched Astra for the legal sector, a new version of its artificial intelligence designed to enable law firms and legal tech companies to create their own tools and workflows, combining its most advanced model, GPT-6 Astra, with fine-tuning and specialist knowledge tailored to legal work. Suppliers such as Harvey and Legora will be able to build their own solutions based on this technology and integrate it into their products. Astra for the legal sector, meanwhile, will initially be offered to a limited group of law firms before being made available to a wider audience. This development reflects how major technology companies are continuing to develop artificial intelligence tools that are increasingly geared towards research and the drafting of legal documents. You can read the announcement here.
Second phase of the AMALIA Project: Council of Ministers Resolution No. 178/2026, published on 15 September, approved the second phase of AMALIA’s development through to the end of 2026, backed by a €1.8 million investment funded under the Recovery and Resilience Plan (“RRP”). This phase encompasses further model training, the development of “agentification” tools for integration into internal processes and public administration services, and the enhancement of image and speech processing capabilities.
The Agency for State Technological Reform (Agência para a Reforma Tecnológica do Estado – ARTE) is providing the funding and participating in the management and deployment of the project alongside the Foundation for Science and Technology (Fundação para a Ciência e a Tecnologia – FCT), or its statutory successor. The resolution entered into force on 16 September, with retroactive effect to 1 July, and provides for continued development throughout 2027 under the terms to be established by ministerial order (despacho). You can read the Resolution here (only available in Portuguese).
Mexico drives forward its AI strategy with Coatlicue, the country’s future public supercomputer: In line with the National Artificial Intelligence Plan, the Mexican Government continues to drive forward technological infrastructure projects to strengthen the country’s AI capabilities. Among these is Coatlicue, a Mexican public supercomputer designed to support scientific research, modelling, simulation and the development of advanced artificial intelligence systems, as part of the country’s technological sovereignty strategy. The project involves a public investment of approximately US$325 million/€290.67 million and aims to provide Mexico with high-performance computing infrastructure for applications in strategic sectors. You can read the article here (only available in Spanish).
The Government presents the Colombia ICT Plan 2026–2030, “the technological miracle”: The Ministry of Information and Communications Technologies presented the proposal for the Colombia ICT Plan 2026–2030, entitled “Colombia: the technological miracle”, which, rather than measuring progress solely by coverage and the number of connections, sets out that the focus will shift to assessing the real impact of technology on businesses, regions and the state, including variables such as the reduction of the digital divide, technological adoption, employability, business productivity and the use of artificial intelligence. To achieve this, the plan is organised into five missions: (i) connecting the country with high-quality infrastructure; (ii) equipping the workforce with digital skills; (iii) boosting production and the digital economy through AI and data; (iv) modernising the state through interoperability and GovTech; and (v) safeguarding cybersecurity and digital trust. Furthermore, the plan targets sectors such as applied AI, GovTech, FinTech, HealthTech, AgroTech and cybersecurity, with the aim of ensuring that Colombia moves beyond being merely a consumer of technology and establishes itself as a creator and exporter of digital solutions. You can read more about it here (only available in Spanish).
Latest News
In the 2025 Video Game Industry Yearbook (available here in Spanish only), published by the Spanish Video Game Association (“AEVI”), we analyse the potential decapitalisation of video game companies resulting from the integration of generative AI into their creative processes, and how the lack of legal protection for assets generated entirely by AI may erode their intangible assets, which are the sector’s main source of value. Below, we set out the main conclusions of the analysis:
Sign up for our newsletter here.