September 28, 2026

Federal inaction on privacy is actively reshaping the U.S. compliance landscape: with comprehensive legislation assessed as having no realistic path to passage in 2026, state-level rulemaking is accelerating to fill the void. That structural gap now runs in parallel with a surge of congressional attention to specific AI and surveillance technologies — a combination that reflects less a coherent federal strategy than a fragmented response to rapidly advancing capabilities.

The European Commission's adoption of Implementing Regulation (EU) 2026/2099 marks the most consequential development in digital identity policy this week, embedding the EUDI Wallet and eIDAS frameworks directly into the MyHealth@EU cross-border health data infrastructure. Member states must begin issuing healthcare-specific electronic attestations to citizen wallets by March 2029, with authentication assurance requirements escalating through 2032. This sectoral expansion of the EUDI Wallet — from general identification into credentialed health data access — arrives precisely as the broader EUDI rollout remains fractured: Italy, France, and Finland are leveraging existing infrastructure while Sweden has deferred to 2028 and Greece and Slovakia remain in private testing. Health-sector compliance teams and digital identity vendors should treat the March 2027 phased implementation start as an active planning horizon, not a distant deadline.

Watch level: PREPARE (EU member state health authorities, eIDAS-aligned digital identity vendors, health-sector compliance counsel)

U.S. Senate Judiciary Subcommittee scrutiny of Flock Safety's automated license plate reader network raises the prospect of federal legislative action on commercial surveillance infrastructure that has operated with minimal oversight. Flock's written testimony acknowledged that it conducts little oversight of how law enforcement clients search its system, and that non-ALPR cameras can identify individuals by visible characteristics beyond vehicle data — a significant disclosure. A documented physical breach exposed encryption vulnerabilities and revealed software tracking pedestrians and cyclists, compounding the accountability picture. Lawmakers are actively weighing warrant requirements, federal funding restrictions, and deployment limits. Agencies operating within the Flock network face material exposure if federal restrictions advance, and procurement teams across law enforcement should begin auditing their ALPR contractual arrangements now.

Watch level: PREPARE (law enforcement agencies with Flock Safety contracts, municipal counsel, civil liberties compliance functions)

NIST's latest Face Analysis Technology Evaluation on age estimation reinforces a structurally important procurement caution: no single algorithm leads across all conditions, and benchmark rankings shift depending on demographic weighting, image resolution, and population composition. The evaluation, incorporating submissions from Incode, ROC, Neurotechnology, and first-time entrant tsight, found that equal-age weighting favors Regula-000 and Idemia-001 while image-weighted scoring elevates ROC-003 — differences driven by test-population composition rather than absolute capability gaps. For compliance teams deploying age-assurance systems under the UK Online Safety Act, Australia's Age-Restricted Material Codes, or the advancing EU KIDS Act framework, this finding warrants direct mapping of NIST benchmark conditions to actual user distributions before citing headline accuracy figures in regulatory filings.

Watch level: MONITOR (age-assurance vendors, platform compliance teams, regulatory counsel in UK, AU, and EU jurisdictions)

Two U.S. House bills at early committee stage point to emerging legislative vectors for AI governance. HR 10567, the mandatory human shutdown controls bill referred to the House Committee on Science, Space, and Technology, would require all entities deploying AI systems to incorporate human-controlled shutdown mechanisms — a broad scope that would reach across sectors if enacted. The SCREEN Act of 2026 (HR 10554), referred to the House Judiciary Committee, addresses screening-related regulatory frameworks, though substantive committee action has not been scheduled for either bill. Both reflect a wider congressional pattern of attempting to impose structural AI accountability requirements independent of the sector-specific approach that has dominated prior legislative cycles. Neither bill is proximate to enactment, but their framing warrants tracking for in-house counsel modeling federal AI compliance obligations.

Watch level: MONITOR (AI system developers and deployers, technology counsel, federal affairs teams)

Labcorp's $2.3 million settlement with U.S. regulators over cybersecurity deficiencies underscores that third-party vendor oversight has become a core, directly enforceable element of U.S. data security obligations — not a background expectation. The settlement mandates a formal incident response plan for vendor-related failures, data minimization restrictions on third-party sharing, and a dedicated vendor risk management function. For healthcare and diagnostics organizations, this action confirms that regulators will treat vendor governance gaps as primary organizational failings rather than mitigating circumstances. Separately, Astrana Health's SEC disclosure of a personnel impersonation breach illustrates the layered regulatory exposure now facing health-tech firms: mandatory SEC reporting requirements stack atop HIPAA breach notification obligations, doubling enforcement surface area for a single incident.

Watch level: PREPARE (healthcare data processors, third-party vendor compliance functions, health-tech counsel with SEC reporting obligations)

Still developing: OpenAI agent breach of Australian government health files: no material change since last reported; Australian authorities have not disclosed the scope of exposed data or confirmed formal regulatory proceedings. Ofcom investigation into Aylo's device-level age assurance under the Online Safety Act: no material change; investigation remains active and Aylo faces potential fines of up to £18 million or 10 percent of qualifying worldwide revenue. ICE ERO ONE $100 million biometric intelligence contractor procurement: no material change since last reported; Request for Information remains under review. ACLU and Innocence Project litigation against Reno PD over live facial recognition: no material change; discovery ruling by magistrate judge scheduled for October 14.