Welcome to Carver's European Union Regulatory Updates for May 17, 2026.

In France, multiple security vulnerabilities have been disclosed affecting specific versions of the Spring and Cloud Function products. These vulnerabilities pose significant risks including unauthorized code execution and data breaches. Organizations using the affected Spring products are required to refer to and apply patches from the Spring security bulletins to update to the fixed releases.

The French National Commission on Informatics and Liberty, or CNIL, has issued a call for vigilance regarding connected glasses. CNIL highlights privacy and ethical risks due to these devices’ ability to discreetly capture images and audio, potentially infringing on individual freedoms. The CNIL has launched an action plan and issued good practice recommendations, including informing people nearby when using connected glasses, disabling capturing functions when not needed, and turning off the glasses when requested, similar to mobile phone etiquette.

In the United Kingdom, the Financial Conduct Authority, or FCA, has emphasized a strategic shift towards greater openness, adoption of advanced technology, and deeper joint working across the financial crime ecosystem. The FCA calls for enhanced information sharing between private and public sectors, use of advanced analytics for earlier detection of financial crime, and strengthening authorization gateways to prevent harm before it starts. Additionally, the FCA has published a warning that SandStone FX is not authorized to provide or promote financial services in the UK. Consumers are advised to avoid dealing with SandStone FX, verify firm authorization using the FCA Firm Checker, and report any suspected unauthorized firms to the FCA.

Turning to the European Union, the European Commission has updated the benchmark values under the EU Emissions Trading System. The updates reflect the performance of the most efficient installations and include an extension of free allocation to indirect emissions for 14 product benchmarks. The Commission also plans to introduce sector-specific fallback benchmarks in the upcoming ETS revision. Industry participants are required to adopt the updated benchmark values by the end of June 2026, allocate free allowances timely for 2026 emissions, and prepare for the sector-specific fallback benchmarks following the July 2026 review.

The European Union is also proposing a recommendation to establish early detection and screening programs for cardiovascular diseases across Member States. The proposal encourages Member States to organize evidence-based screening programs tailored to national and regional health system situations. Population-based screening is recommended for specific age groups based on national risk levels.

On May 8th, 2026, a workshop was organized within the European Union to explore a risk-based approach for the use of generative and adaptive artificial intelligence models in Good Manufacturing Practice applications. The workshop focused on potential control and mitigation measures, including guardrails, to ensure patient safety and compliance with quality standards. Key principles discussed included data governance, model evaluation, transparency, accountability, and human oversight. Controls for validation, lifecycle management, cybersecurity, and outsourced activities related to AI use were also considered.

An updated framework for advice on the systemic risk buffer, or SyRB, applicable in the European Union and the European Economic Area, clarifies principles, information basis, and assessment criteria for advising the SyRB rate. The framework requires consideration of structural vulnerabilities, other macroprudential measures, banks’ overall capital needs, and their responses to SyRB changes. The SyRB can be applied generally or sectorally, with a 12-month adjustment period normally required for rate increases. Changes to the SyRB rate should be gradual or accelerated depending on circumstances.

The Foreign Affairs Council of the European Union, during a press conference by High Representative Kaja Kallas, agreed to enhance the European Defence Agency with innovation and experimentation structures and advance joint procurement efforts. The Council also approved a €90 billion loan to Ukraine focusing on drones, discussed mobilizing €6.6 billion blocked in the European Peace Facility, and considered expanding naval operations in the Red Sea and Strait of Hormuz.

Finally, in Greece, Yannis Stournaras delivered a speech highlighting challenges for the Greek insurance market and supervisors. He noted the ongoing transformation of the market, the implementation of the Digital Operational Resilience Act since January 2025, and the upcoming national transposition of the revised Solvency II Directive by January 2027. Compliance with the Insurance Recovery and Resolution Directive is also emphasized. Key focus areas include monitoring investment-linked products, closing the insurance protection gap, digital transformation, and addressing climate change impacts.

That wraps up today's regulatory updates. Visit carveragents.ai for more information.