G&D Monthly Digest August 2026

This news overview has been compiled by Gernandt & Danielsson’s specialist team and is updated month by month. Added news for this month are highlighted in beige. For this month, we have included an in-depth analysis at the end.

Please click here if you are interested in subscribing to the G&D Monthly Digest.

Data & Tech

ARTIFICIAL INTELLIGENCE

• On 31 July 2026, the European Commission announced that its AI Office, together with national authorities, will begin enforcing Regulation (EU) 2024/1689 (the AI Act) (Sw. AI-förordningen) from 2 August 2026, when new transparency requirements also start to apply. Under the new rules, chatbots and other interactive AI systems must inform users that they are interacting with AI rather than a human, deepfakes must be labelled, and AI-generated or altered content must carry machine-readable marks to facilitate detection. The measures aim to reduce deception and manipulation, help individuals make informed choices, and provide businesses with clearer obligations and a practical means of demonstrating compliance. In connection with the announcement, the Commission published a first list of more than 180 organisations that have signed the Code of Practice on transparency of AI-generated content, which operationalises these transparency rules.
• On 27 July 2026, Regulation (EU) 2026/1744 (the AI Omnibus) entered into force across the EU, delivering a targeted simplification of the AI Act while preserving safeguards for safety and fundamental rights. Originally proposed on 19 November 2025 as part of the Digital Omnibus Package, the AI Omnibus extends certain SME simplifications to small mid-cap companies, expands regulatory sandboxes (including a new EU-level sandbox), and confirms that rules for high-risk AI systems under Annex III will apply from 2 December 2027 and for high-risk AI embedded in physical products under Annex I from 2 August 2028. It also simplifies the AI literacy requirement and EU database registration obligations, allows processing of special categories of personal data to detect and correct bias, and extends the AI Office’s enforcement powers.
• On 8 July 2026, the European Data Protection Board (EDPB) (Sw. Europeiska dataskyddsstyrelsen) adopted guidelines on web scraping for the training of generative AI, with the Swedish Authority for Privacy Protection (IMY) (Sw. Integritetsskyddsmyndigheten) acting as lead rapporteur. The guidelines apply both to organisations that scrape data themselves and those that obtain pre-scraped datasets from third parties, and confirm that scraping of special categories of personal data (such as health data or data revealing political opinions or ethnicity) may be permissible provided the controller implements a number of safeguards before, during and after the scraping. The guidelines further address other challenging data protection requirements in this context, including data minimisation and the conditions for relying on legitimate interest as a legal basis. The guidelines are subject to public consultation until 30 October 2026.

PRIVACY

• On 9 July 2026, the Court of Justice of the EU (CJEU) rendered its judgment in case C-199/24 ND v Legal Newsdesk Sweden, concerning a Swedish online database (Lexbase) that provided the public with access to criminal judgments in return for payment. The operator had refused to erase a data subject’s personal data, invoking a Swedish constitutional publication licence on the basis that Regulation (EU) 2016/679 (the GDPR) (Sw. dataskyddsförordningen) did not apply. The CJEU held that the GDPR only permits Member States to derogate from its provisions for processing carried out for journalistic, academic, artistic or literary purposes, and that data subjects must retain access to the GDPR’s full range of remedies rather than being limited to defamation proceedings. The CJEU further held that publishing unedited criminal judgments online for payment, without an editorial line or fact-checking, does not qualify for the “journalistic purposes’ exemption”. The case demonstrates how Swedish constitutional law may conflict with data protection law.
• On 9 July 2026, the European Data Protection Board (EDPB) (Sw. Europeiska dataskyddsstyrelsen) adopted guidelines on anonymisation, clarifying the concept of anonymised data in light of the CJEU’s judgment in Case C-413/23 P, EDPS v SRB on 4 September 2025, and other relevant case law. The guidelines set out a practical three-part framework for assessing whether anonymisation has been achieved, requiring that no individual can be singled out, that the data cannot be linked to other datasets, and that no inferences can be drawn about an individual. If any criterion is not met, further analysis is required. The guidelines are subject to public consultation until 30 October 2026.
• On 3 July 2026, the US Supreme Court ruled in Trump v. Slaughter that a US president may remove a member of the Federal Trade Commission (FTC) without cause. As the FTC is one of the independent oversight bodies underpinning the EU-US Data Privacy Framework (DPF), on which the European Commission’s 2023 adequacy decision for the US is based, the ruling raises questions over the bodies’ continued independence and the decision’s validity. The EDPB, with the Swedish Authority for Privacy Protection (IMY) (Sw. Integritetsskyddsmyndigheten) participating, initiated an assessment of the judgment’s implications for transfers to the US. The adequacy decision remains in force but could ultimately be amended, withdrawn, or invalidated by the CJEU.

Employment & Incentives

• On 8 June 2026, the Swedish government tasked the Swedish Equality Ombudsman (DO) (Sw. Diskrimineringsombudsmannen) with continuing preparatory measures for the implementation of Directive (EU) 2023/970 (the Pay Transparency Directive) (Sw. lönetransparensdirektivet). The assignment includes carrying out promotional initiatives regarding employers’ pay mapping work, with the aim of increasing knowledge of how such work is conducted and identifying what support employers need in their efforts to prevent pay discrimination. DO is to report on the assignment to the Government Offices no later than 1 November 2027. For a more in-depth analysis of the Directive and its implications for Swedish employers, please see the accompanying In-Depth article.
• On 2 June 2026, the Swedish government adopted a new work environment strategy for 2026–2031, titled En god arbetsmiljö i ett föränderligt arbetsliv. The strategy sets out four sub-objectives aimed at promoting a sustainable, healthy, safe and innovative working life. The government emphasises that a good work environment is essential for both individual health and long-term societal sustainability and competitiveness, with particular focus on gender equality, equity and inclusion, and differences in working conditions between groups such as women and men, older workers, persons with disabilities and foreignborn individuals. The strategy also addresses how digitalisation, globalisation, demographic change, the green transition and the security situation place new demands on flexible work environment practices. The Swedish Work Environment Authority (Sw. Arbetsmiljöverket) is tasked with coordinating the national implementation of the strategy in collaboration with other authorities and social partners.
• On 26 May 2026, the Swedish Competition Authority (Sw. Konkurrensverket) announced the initiation of a review to assess whether authorities are imposing mandatory labour law conditions in public procurement to the extent required under applicable legislation. The review follows indications in recent years that procuring authorities are not consistently complying with these provisions, which are designed to ensure that work performed under publicly procured contracts is carried out in accordance with workers’ fundamental rights and in compliance with statutory or collective bargaining agreement requirements. The Competition Authority regards such conditions as important both for the equal treatment of tenderers and for maintaining sound competition by preventing suppliers with substandard employment terms from gaining an unfair advantage. In its first phase, the review will examine whether a sample of seven municipalities, ten municipal housing companies, and four state authorities have imposed labour law conditions in procurement exercises within high-risk sectors, including construction and civil engineering, taxi services, and cleaning.

Environmental, Social & Governance

• On 3 July 2026, the European Commission adopted revised European Sustainability Reporting Standards (ESRS) and a voluntary reporting standard for smaller companies outside the scope of Directive (EU) 2022/2464 (the Corporate Sustainability Reporting Directive, CSRD). Building on the Omnibus I simplification package, the revised ESRS are shorter and clearer. The number of mandatory datapoints is reduced by more than 60 % and the total number of datapoints by more than 70 %. The measures are expected to lower reporting costs by more than 30 % per company. The voluntary standard provides a proportionate reference framework for non-CSRD companies responding to information requests from larger counterparties, and introduces a value chain cap preventing CSRD companies from requiring more information than the voluntary standard covers. Both measures are now subject to a two-month scrutiny period before the European Parliament and the Council, extendable by a further two months.
• On 2 July 2026, Regulation (EU) 2024/3005 (the ESG Ratings Regulation) started to apply, introducing a common framework for providers of environmental, social and governance (ESG) ratings. Providers must now be authorised, comply with organisational and governance requirements, and be transparent about their rating methodologies. The European Securities and Markets Authority (ESMA) is responsible for authorisation and the bulk of supervision, while the Swedish Financial Supervisory Authority (FI) (Sw. Finansinspektionen), as the competent national authority, will assist ESMA and supervise the transparency requirements applicable to regulated financial entities marketing their own ESG ratings.
• On 22 June 2026, the European Securities and Markets Authority (ESMA) published the register of firms authorised to act as external reviewers of European Green Bonds under Regulation (EU) 2023/2631 (the European Green Bond Regulation, EuGB). As of that date, registered external reviewers are subject to ESMA supervision and must fully comply with the EuGB Regulation’s requirements, including senior management accountability, robust and transparent methodologies, effective internal controls and a comprehensive framework for managing conflicts of interest. The transitional regime under Articles 69 and 70 of the EuGB Regulation has ended, and external reviewers listed under that regime must cease their external review activities. Issuers planning to issue a European Green Bond are advised to consult ESMA’s register to select a registered reviewer for their preissuance, post-issuance and, where applicable, impact report reviews.

To view the full article click here