EU Geopolitical Risk Update - Key Policy & Regulatory Developments No. 122

COMPETITION & STATE AID

European Commission launches first review of Forei Subsidies Regulation (see here)

On 12 August 2025, the Commission opened its first public consultation on the 2022 Foreign Subsidies Regulation (FSR), which became applicable on 13 July 2023.

To recall, the FSR affords the European Commission with extensive new powers to counteract alleged distortive effects of subsidies granted by non- EU countries and which fall outside of the existing EU State aid and Trade Defense framework (see also Jones Day EU Emergency Response Update No. 105 of 31 August 2023 and Jones Day Alert, "EU Foreign Subsidies Regulation Filings Mandatory Starting in October 2023" of December 2022).

First review. The Commission seeks feedback from interested parties in view of preparing its first FSR review report to the European Parliament and the Council, to be delivered by 13 July 2026.

The FSR requires the Commission to review its practice of implementing and enforcing the Regulation every three years, accompanied, if appropriate, by relevant legislative proposals. The Commission notes, in particular, that since the FSR is a new instrument with new requirements for businesses based on novel legal concepts, the Commission must aim to maintain high standards of transparency regarding its actions.

The review report will focus on areas such as:

- Application of the balancing test (i.e., whether positive effects of the foreign subsidy counterbalance its distortive effects);

- Notification thresholds; and

- The level of complexity of the rules and the costs incurred by businesses.

Next steps. Interested parties may provide feedback until 18 November 2025. A summary of the online public consultation will be published on the Commission's "Have your say" website.

European Commission updates on NextGeneration disbursements its anticipated closure in 2026 (see here)

On 8 August 2025, the Commission reported on recent disbursements of nearly €43 billion to Member States under the Recovery and Resilience Facility (RRF), the cornerstone of the unprecedented €800 billion

EU NextGenerationEU package created in December 2020 to support Europe's

and pandemic recovery.

The RRF will disburse up to €650 billion in grants and loans to EU Member States, which must allocate a significant part of RRF funding to measures for Europe's green and digital transitions.

The Commission highlighted latest disbursements to five Member States under the RRF, based on implementation of reforms and investments outlined in each country's recovery and resilience plan:

- Cyprus: €76 million disbursement (out of total allocated RRF funding of €1.22 billion), e.g., for expanding online government services and digitalizing health care services, notably in cross-border contexts.

- Italy: €18.3 billion disbursement (out of total allocated RRF funding of

€194.4 billion), e.g., for building and modernizing substations to enhance the grid's ability to distribute clean energy.

- Malta: €48.7 million disbursement (out of total allocated RRF funding of €328 million), e.g., for boosting sustainable mobility by signing contracts for the procurement of electric vehicles for use in the public sector.

- Portugal: €1.34 billion disbursement (out of total allocated RRF funding of €22.2 billion), e.g., for key reforms and investments in healthcare, housing, forest fire management, and renewable energy.

- Spain: €23.1 billion disbursement (out of total allocated RRF funding of €163 billion), e.g., for boosting the uptake of and investment in renewable energy, ensuring that clean energy sources are better connected to the power grid, and reinforcing cybersecurity resilience by supporting the cybersecurity industry and innovative companies.

Looking ahead. The Commission released a Communication on NextGenerationEU - The road to 2026 on 4 June 2025, which assesses the RRF's implementation and provides guidance to Member States in view of ensuring its successful closure in end-2026.

- Status of disbursements. According to the Communication, by end- May 2025, disbursements had reached €315 billion (some 49% of total) comprising 1073 investments and 1145 reforms, e.g., for cleaner and safer energy supply, improved public transport networks, better public services, and greater digitalization of businesses. However, over €335 billion in RRF funding is still available to Member States.

- Revising national recovery plans. The Communication emphasizes that Member States must accelerate the RRF's implementation by promptly revising their national recovery plans in view of ensuring that all milestones and targets can be implemented by 31 August 2026.

Revised national plans should notably replace measures that cannot be timely achieved, and instead takes actions such as scaling up existing measures and supporting the creation of financial instruments to spur private investment.

- Last payment requests. Member States must submit their last payment requests for assessment by 30 September 2026. The Commission must make payments by 31 December 2026. No payments will be made in 2027.

European Commission approves second IPCEI in healthcare sector (see here)

On 22 July 2025, the Commission approved Tech4Cure, the second Important Project of Common European Interest (IPCEI)* in the healthcare sector.**

Tech4Cure, involving 10 projects from 10 companies, aims at creating innovative medical devices with advanced and novel digital/AI solutions, towards further building the concept of predictive, preventive, and personalized medicine (so-called 3P medicine).

The five Member States that notified this project (France, Hungary, Italy, Slovakia and Slovenia) will provide up to €403 million in public funding, which is anticipated to unlock a further €826 million in private investments.

Tech4Cure is the 11th integrated IPCEI approved under EU State aid rules. Looking ahead. The completion of Tech4Cure is planned for 2036.

The non-confidential versions of the IPCEI Tech4Cure decisions will be available on the Commission's State Aid Register once any confidentiality issues are resolved, under the case numbers SA.113212 (France), SA.117899 (Hungary), SA.117859 (Italy), SA.117793 (Slovakia), and SA.117849 (Slovenia).

* The EU's IPCEI rules (Communication on Important Projects of Common European Interest) seek to enable Member States and industry to jointly invest in ambitious pan-European projects in a transparent and inclusive manner, where the market alone appears unable to deliver and particularly where the risks are deemed as too large for a single Member State or company to assume (see also Jones Day EU Emergency Update No. 107 of 29 September 2023).

** For the first IPCEI in healthcare, Med4Cure, see Jones Day EU Emergency Update No. 115 of 9 August 2024).

European Commission adopts Communicati Clean Indust Deal State Ai Framework ( here)

On 25 June 2025, the Commission adopted its Communication on the Clean Industrial Deal State Aid Framework (CISAF), a key component of the Commission's Clean Industrial Deal: A joint roadmap for competitiveness and

decarbonization of 26 February 2025, which aims to support the EU manufacturing industry's competitiveness and resilience, while accelerating decarbonization.

The CISAF replaces the Temporary Crisis and Transition Framework (TCTF)* and sets out streamlined rules for the simplified and swifter approval of priority State aid measures aimed at accelerating Europe's competitiveness and green transition goals, including for:

- Accelerating renewable energy rollout (e.g., supporting renewable energy, low-carbon fuels, and electricity storage).

- Facilitating industrial decarbonization and energy-efficiency projects, regardless of the technology used (e.g., electrification, hydrogen, carbon capture utilisation and storage).

- Ensuring sufficient EU manufacturing capacity for net-zero technologies (e.g., supporting projects to produce, including with critical raw materials, batteries, solar panels, wind turbines, and heat pumps).

- Easing private investment risk (e.g., through aid in the form of equity, loans, and/or guarantees provided to a dedicated fund or special purpose vehicles (SPVs)).

The Framework complements the 2024 Net-Zero Industry Act and the 2022 Climate, Energy & Environmental Aid Guidelines (CEEAG).

Looking ahead. The CISAF, applicable since 25 June 2025, will remain in force until 31 December 2030.

For further details, see also remarks announcing the CISAF by Executive Vice-President Teresa Ribera for a Clean, Just and Competitive Transition (here).

* The TCTF was established in 2022 to support the EU economy in the context of Russia's invasion of Ukraine and in sectors key to accelerating the green transition and reducing fuel dependencies.

European Commission releases State aid Scoreboard 2024 (see here)

On 8 April 2025, the Commission published the latest State aid Scoreboard, its benchmarking tool for State aid. The annual Scoreboard, launched in 2001, offers transparency on the Commission's State aid control activities and how Member States support industries and sectors through public funding. The Scoreboard also highlights the EU's evolving policy priorities, and notably towards fulfilling the EU's commitment to a green and digital transition.

The 2024 Scoreboard, based on State aid expenditures by the Member States in 2023, identified key developments, such as:

- Reduction in crisis aid, with total State aid expenditure by EU Member States decreasing by 23% in 2023 to €186.78 billion (from

€243.27 billion in 2022), reflecting the phase-out of COVID-19 and Ukraine crisis measures;

- Focus on non-crisis objectives, which accounted for 73% of total State aid spending in 2023, with environmental protection, renewables and energy savings as the leading policy objectives, reaching €55.3 billion, a 20% increase compared to 2022;

- Increased support for innovation, with State aid for research, development, and innovation rising by 33% in 2023 to €15.95 billion;

- Direct grants remain the main instrument, accounting for 59% of total State aid expenditure, followed by tax advantages and guarantees; and

- Sustained increase in streamlined procedures, with the majority of new aid measures implemented under block exemption regulations for simplified approval (General Block Exemption Regulation (GBER); Agricultural Block Exemption Regulation (ABER); and Fishery Block Exemption Regulation (FIBER)).

For additional details on the State aid Scoreboard 2024, as well as past Scoreboards, see here.

* For the State aid Scoreboard 2023 see Jones Day EU Emergency Response Update No. 114 of 6 May 2024.

TRADE / EXPORT CONTROLS

EU and US release Joint Statement on Framework on Agreement on Reciprocal, Fair, and Balanced Trade (see here)

On 21 August 2025, the EU and US released a Framework on an Agreement on Reciprocal, Fair, and Balanced Trade (Framework), which redefines the parameters for the EU-US trade relationship and seeks to restore an important measure of stability and predictability in EU-US trade.

The transatlantic relationship is the world's most valuable economic relationship. EU-US trade has doubled over the last decade, exceeding €1.6 trillion in 2024 (€867 billion of trade in goods and €817 billion of trade in services). Total bilateral investment reached $5.6 trillion in 2022.

The Framework's key commitments notably include:

- A US tariff regime that applies a maximum, all-inclusive 15% tariff ceiling for EU products;

- A US commitment to apply the 15% ceiling to EU exports of cars, pharmaceuticals, semiconductors, and lumber;

- Exemptions to the 15% tariff ceiling (US commits to apply only Most Favored Nation (MFN) tariffs, which are effectively zero or close to zero) to the following EU products: unavailable natural resources (including cork), all aircraft and aircraft parts, generic pharmaceuticals and their ingredients and chemical precursors. The EU and US will work on expanding this list further in the future;

- Strengthened cooperation in the area of economic security, including cooperation on investment screening and export controls; and

- Increased supply chain resilience, cooperation on critical minerals and transatlantic purchases, notably concerning energy and AI chips.

Next steps: The EU and US intend this Framework to be a first step in a process that can be further expanded over time to cover additional areas and continue to improve market access and increase their trade and investment relationship.

Both sides now aim to rapidly engage to implement key commitments contained in the Framework. The EU and US will also engage in negotiating an Agreement on fair, balanced and mutually beneficial trade with the US, in line with the Framework.

The Commission's Q&A provides further details on the Framework (see here).

Council of the European Union extends sanctions against Russia (see here)

The EU employs restrictive measures, commonly known as sanctions, as a key instrument to advance its Common Foreign and Security Policy (CFSP) objectives. These objectives include safeguarding the EU's values, fundamental interests, and security; preserving peace; and supporting democracy and the rule of law.

Sanctions encompass a range of measures, including travel bans that prohibit entry or transit through EU territories, asset freezes, and restrictions on EU citizens and companies from providing funds and economic resources to listed individuals and entities. Additionally, sanctions may include bans on imports and exports, such as prohibiting the export to Iran of equipment that could be used for internal repression or telecommunications monitoring, as well as sectoral restrictions.

Russia: Among recent developments:

(i) On 18 July 2025, the Council adopted the 18th package of sanctions,* focusing on measures such as:

· Diminishing Russia's energy revenues, e.g.:

- Introducing an import ban on refined oil products derived from Russian crude that are processed abroad and delivered into the EU.

- Imposing a full transaction ban on the Nord Stream 1 and 2 gas pipelines (built by Russia's state-controlled Gazprom), including for the provision of goods or services, thus preventing the completion, maintenance, operation, and any future use of Nord Stream 1 and 2.

• Intensifying financial sector measures , g.:
  • A full transaction ban from doing any business with listed banking entities (now also expanded from 23 to 45 Russian banks), which widens the ban on providing EU-based specialized financial messaging services to certain Russian banks.
  • Key types of banking software are now included in the prohibition on provision of services and software to the Russian Government and to Russian companies.
• Expanding measures against military industry, g.:
  • Addition of 26 entities to the list of those providing direct or indirect support to Russia's military industrial complex or engaging in sanctions These comprise 15 entities established in Russia and 11 in other third countries (4 in Turkey and 7 in China/Hong Kong).
  • Broadened transit ban to cover selected economically critical goods used for construction and transport, including certain of direct relevance to the energy industry. Such goods can no longer transit the territory of Russia when exported from the EU to third
• On 15 July 2025, the Council imposed additional restrictive measures against nine individuals and six entities responsible for Russia's destabilizing actions abroad (see here), including through Foreign Information Manipulation and Interference (FIMI).

The new measures target, for example, the BRICS Journalists Association (BJA) and the Foundation to Battle Injustice (R-FBI), both created by the late Yevgeny Prigozhin and former head of the Wagner Group, which have been involved in many FIMI operations targeting France and Ukraine.

Altogether, EU restrictive measures in view of Russia's destabilizing activities now apply to 47 individuals and 15 entities.

• On 30 June 2025, the Council renewed EU restrictive measures for another six months (until 31 January 2026) in view of Russia's continuing actions destabilizing the situation in Ukraine (see here). These economic measures encompass a wide array of sectoral measures, notably including limitations on trade, finance, energy, technology and dual-use goods, industry, transport, and luxury goods, as well as further enabling the EU to counter the circumvention of sanctions.

Altogether, EU restrictive measures in respect of actions undermining or threatening the territorial integrity, sovereignty and independence of Ukraine now apply to over 2,500 individuals and entities.

The Council's overview of EU sanctions against Russia over Ukraine (since 2014) is also available here. To recall, EU restrictive measures taken against Russia, as first introduced in 2014 in response to Russia's actions destabilizing the situation in Ukraine, have significantly expanded following Russia's military aggression against Ukraine, starting on 23 February 2022 in adopting the so-called first package of sanctions (see here).

* An in-depth analysis of the 18th package is available from the authors of the EU Geopolitical Risk Update (see contact details below for Nadiya Nychay (Brussels) and Rick van 't Hullenaar (Amsterdam)).

European Commission releases proposed Regulation on phasing out Russian gas imports (see here)

On 17 June 2025, the European Commission published its proposed Regulation on phasing out Russian gas imports and improving monitoring of potential energy dependencies.

Backdrop. Russia's war against Ukraine exposed the severe repercussions of the EU's overdependencies on Russian energy imports, especially gas. The war has heavily disrupted global supply chains and triggered significant increases in energy prices and market volatility.

In response, the EU has significantly reduced dependencies and energy imports from Russia under the REPowerEU Plan launched in 2022 (see also Jones Day COVID-19 Update No. 98 of 1 March 2023). For instance, the share of gas imports into the EU from Russia (both LNG and pipeline) has fallen significantly from 45% in 2021 to 19% in 2024.

Key provisions. Under the proposed Regulation, the EU will phase out the import of Russian gas and oil by end-2027, while pursuing the clean energy transition and limiting impacts on prices and markets. Notable provisions include:

· For Russian gas imports:

- Prohibition on new contracts as of 1 January 2026.

- Halting of imports under existing short-term contracts by 17 June 2026 (except those for pipeline gas delivered to land-locked countries and linked to long-term contracts, which may continue until end-2027).

- Stopping imports under long-term contracts by end-2027.

· For LNG terminal services for customers from Russia or controlled by Russian undertakings

- Prohibition on long-term contracts as of 1 January 2026.

- For long-term contracts signed before 17 June 2025, the prohibition would apply as of 1 January 2028.

These prohibitions would ensure that terminal capacity can be re- oriented to alternative suppliers, in view of strengthening energy market resilience.

Member State diversification plans would be required by 1 March 2026, with precise measures and milestones for the progressive elimination of Russian gas and oil imports.

Next steps. The proposed Regulation will be discussed and negotiated between the European Parliament and the Council for its adoption.

The Commission's Q&A provides further details on the proposed Regulation (see here).

European Commission launches new import surveillance to to combat harm trade diversion (see here)

On 5 June 2025, the European Commission announced the launch of a new import surveillance tool to identify and address sudden and potentially disruptive surges in imports caused by trade diversion, which occurs when large volumes of goods are redirected into the EU when they cannot enter other markets due to high tariffs and other restrictions.

By providing fact-based information based on customs data, the surveillance tool will facilitate the Commission's efforts to swiftly identify import surges and to take early and effective action to protect the EU market from adverse impacts (e.g., through discussions with concerned third countries or appropriate imposition of trade defence measures).*

The new surveillance tool builds on the earlier creation of a task force for import surveillance in April 2025 (see here) to address the challenges to EU markets and industries caused by trade diversion, particularly following recent upheaval in the global trading system. The task force's work is focused on providing timely and informed insights to support the Commission in its decision-making process.

Looking ahead. To further bolster this import surveillance initiative, the Commission encourages EU manufacturers, industry associations, and Member States to review import trends available on the surveillance tool website (see here) and to provide further market intelligence and data on the industry's economic situation (see here). This input will support the Commission's efforts to identify specific products facing potential risk due to significant import increases.

* The Commission's 43rd Annual Trade Defence Report, released in July 2025, notes that the Commission initiated 33 new investigations in 2024, the highest number of new cases in a calendar year since 2006.

MEDICINES AND MEDICAL DEVICES

European Commission furthers Preparedness Union Strategy (see here and here)

On 9 July 2025, in furtherance of its Preparedness Union Strategy of March 2025, the Commission launched two initiatives to safeguard the continuity of essential goods and lifesaving medical supplies, in particular during crises such as natural disasters, major energy blackouts, conflicts or pandemics:

(1) The Medical Countermeasures Strategy seeks to accelerate the development, production, deployment, and accessibility of lifesaving medical tools, particularly in the context of geopolitical challenges and climate change, which aggravate four identified threats:

(i) respiratory or contact-based viruses with pandemic potential;

(ii) vector-borne or animal-reservoir viruses with epidemic potential;

(iii) antimicrobial resistance; and

(iv) armed conflict related threats and chemical, biological, radiological and nuclear threats.

The Strategy focuses on vaccines, therapeutics, diagnostics and protective equipment. In this respect, it sets out key actions such as:

- Advancing next-generation flu vaccines, new antibiotics for antimicrobial resistance, and antivirals for vector-borne diseases:

- Investing in scalable production through EU FAB's "ever-warm" manufacturing capacity of 325 million vaccine doses that can be rapidly activated to make the required quantity of selected vaccines for the EU in case of an emergency, and

- Expanding surveillance for emerging threats, such as through EU/global wastewater sentinel systems.

The Medical Countermeasures Strategy is also reinforced by the EU Strategy for Life Sciences (see below summary), which aims to advance innovation in medicinal products and health technologies (e.g., by supporting developing effective medical countermeasures, such as vaccines).

For further details on the Medical Countermeasures Strategy, see also its Annex (here).

(2) The EU Stockpiling Strategy, the first-ever EU comprehensive approach to stockpiling, aims at securing essential goods (e.g., medicines, food, water, fuel) in the event of a crisis. It is intended to remedy gaps exposed during crises like the COVID-19 pandemic or supply chain disruptions.

Key actions include, in particular:

- Establishing an EU Stockpiling Network with Member States to share best practices, coordinate stocks, and develop joint recommendations.

- Identifying stock gaps and duplications through information sharing and reinforcing cooperation among Member States and with the EU.

- Strengthening transport and logistics for rapid crisis response.

- Fostering civil-military, public-private, and international partnerships to maximize timely and efficient resource use.

Going forward, the Commission will engage with Member States, the EEAS (European External Action Service), the European Parliament and stakeholders to discuss and implement the initial actions set out in this Strategy.

European Commission releases Communication o Choose Europe fo Life Sciences – A Strategy to position the EU a the world's most attractive place fo life sciences by 2030 (see here)

On 2 July 2025, the Commission unveiled its Communication on Choose Europe for Life Sciences – A Strategy to position the EU as the world's most attractive place for life sciences by 2030. The Strategy sets out a broad roadmap for strengthening the EU's life sciences ecosystem, with a focus on key elements such as:

· Optimizing the ecosystem for research and innovation, e.g., through:

- support for Advanced Therapy Medicinal Products (ATMPs);

- funding for multi-country clinical trials;

- harmonized ethics and regulatory standards (e.g., MedEthicsEU);

- better alignment between trials for medicines and for devices (COMBINE program); and

- strengthening the capacities of European biotech clusters* to better leverage their capacities and attract private capital and spur entrepreneurship.

· Facilitating smooth, rapid market access for life science innovations, e.g., through:

- The upcoming EU Biotech Act (anticipated by ~2026) that aims at creating a more innovation-friendly framework across biotech sectors; and

- The Commission's launch of "matchmaking" to connect startups, industry and investors, notably by leveraging the European Innovation Council (EIC), which has built portfolios of start-ups and technologies since 2021 in Europe's key strategic areas, including investing €625 million in biotechnology and biomanufacturing.

· Boosting uptake and use of life science innovations, e.g., through:

- The Commission's mobilization of €300 million, through Horizon Europe and EU4Health, to stimulate the procurement of life sciences innovation in areas such as next-generation vaccines and affordable cancer solutions; and

- The Commission's planned Life Sciences Coordination Group to foster innovation-friendly policies, including by creating a stakeholder forum to encourage broad dialogue and engagement.

* A biocluster, is a geographic concentration of interconnected companies, research institutions and organizations focused on biotechnology and life sciences, fostering collaboration and innovation.

European Commission adopts Implementin Regulation (E 2025/1466

updating EU pharmacovig framework (se here)

On 22 July 2025, the Commission adopted Implementing Regulation (EU) 2025/1466, updating the EU's pharmacovigilance (PV) framework. PV is the system for monitoring the safety of medicines after they enter the market, ensuring that risks are detected, assessed and managed promptly.

The Implementing Regulation revises rules first set out in 2012.

Key changes include, in particular:

· Reducing administrative burdens on Marketing Authorization Holders (MAHs) and competent authorities by requiring only major or critical deviations from PV procedures to be documented in the Pharmacovigilance System Master File (PSMF); *

· Stricter oversight of subcontracting rules, according to which contracts between MAHs and third party subcontractors for specific PV activities will need to ensure that (i) each party's role and responsibilities are clearly defined; and (ii) third parties agree to be audited by or on behalf of MAHs and inspected by competent authorities.

· Clarified rules on monitoring safety signals, according to which MAHs must monitor data available in the Eudravigilance database and use it together with data from other available sources; and

· Reporting is also tightened, whereby MAHs' Periodic Safety Update Reports must, e.g., demonstrate the effectiveness of risk-minimization measures and electronically register all post-authorization safety studies.

Improved crisis response. With a stronger and streamlined PV system, the EU aims at being better prepared to manage health emergencies. In this respect, during crises, when new medicines or vaccines may be authorized rapidly, this enhanced PV system aims to ensure that adverse effects are

identified early, responsibilities remain clear even in complex supply chains, and safety data can be shared quickly across borders.

Looking ahead. The Implementation Regulation is applicable as from 12 February 2026, although certain provisions already apply since 12 August 2025 (e.g., the above-referred requirement for MAHs to monitor data available in the Eudravigilance database and to use it together with data from other available sources).

* The PSMF is a detailed description of the pharmacovigilance system used by the MAH with respect to one or more authorized medicinal products.

CYBERSECURITY, PRIVACY & DATA PROTECTION

European Commission publishes ProtectEU: a European Intern Security Strateg (see here)

On 1 April 2025, the Commission published a Communication on ProtectEU: a European Internal Security Strategy ("Strategy").

Backdrop / objectives. The Strategy sets out key priorities and concrete al actions to build a safer Europe in the face of new and evolving security y threats and a shifting geopolitical landscape.

The Strategy will support Member States and bolster the EU's ability to anticipate, prevent, and respond to threats to Europe's internal security. A central priority, in particular, is to foster resilience against hybrid threats and hostile acts by enhancing the protection of critical infrastructure, securing transport hubs and ports, reinforcing cybersecurity and combatting online threats.

Key actions. The Strategy's targeted measures focus, in particular, on cybersecurity and secure supply chains:

- Introducing a revised and more robust Cybersecurity Act; *

- Preparing new initiatives to enhance the security of cloud computing and telecommunications networks;

- Ensuring that Member States fully implement the Critical Entities Resilience (CER) ** and NIS2 *** Directives; and

- Reducing reliance on single foreign suppliers and de-risking critical supply chains from high-risk suppliers, including by re-assessing procurement rules and promoting diversification, including through strengthened trade ties with trusted partners.

Looking ahead. The forthcoming European Democracy Shield will complement the Strategy. Together with the Preparedness Union Strategy and the European Defense White Paper, both released in March 2025, these initiatives will form a comprehensive framework for a safer and more resilient EU.

The Commission's Q&A, released alongside the Strategy, provides further details on it (see here).

* Directive (EU) 2022/2555 of 14 December 2022 on measures for a high common level of cybersecurity across the Union.

** Directive (EU) 2022/2557 of 14 December 2022 on the resilience of critical entities.

*** Regulation (EU) 2019/881 of 17 April 2019 on ENISA (the European Union Agency for Cybersecurity) and on information and communications technology cybersecurity certification.

Council Recommendation published on revised EU Blueprint for cy crisis managem (see here)

On 20 June 2025, the Council Recommendation on an EU Blueprint For cyber crisis management ("Blueprint") was published. This Blueprint revises and builds on the earlier 2017 EU Cyber Blueprint, which it is intended to replace. *

The necessity for a revised Blueprint, a non-binding instrument, was driven by the evolution of the cybersecurity threat landscape and the growing impact of geopolitics, which have accelerated the need for stronger cyber crisis management as anticipated in the ENISA study on Best Practices for Cyber Crisis Management and outlined in the EU's first-ever Report on the State of Cybersecurity in the Union.

Objectives. The revised Blueprint seeks to further improve coordination between EU institutions and national authorities at technical, operational and political levels during major cyber incidents.

In this respect, the revised Blueprint clarifies the interactions and processes among the growing number of actors involved (both in the public and private sectors), supports the implementation and reinforcement of existing and emerging cybersecurity initiatives, and enhances crisis management capabilities across the entire cyber crisis lifecycle.

ENISA (European Union Agency for Cybersecurity) will support the Blueprint's objectives, in particular, by:

- Providing direct assistance to Member States and key EU bodies – including the European Commission, CERT-EU (the Computer Emergency Response Team for EU institutions, bodies, and agencies), and Europol – in responding effectively to cyber crises;

- Enhancing operational capacity of networks such as EU-CyCLONe (the network supporting coordinated management of large-scale cybersecurity incidents in the EU) and the CSIRTs Network (comprising the Computer Security Incident Response Teams (CSIRTs) appointed by EU member states and CERT-EU), improving information sharing and incident response;

- Advancing the development of a common cybersecurity taxonomy to promote interoperability and seamless integration across EU networks and stakeholders.

Next steps. ENISA will leverage past incident experience to sharpen its contribution to the Commission's annual cyber exercises, focusing on stronger coordination and streamlined EU governance. This approach will help create a clear blueprint for effective responses to future cyber challenges.

This Recommendation on the revised Blueprint should be reviewed by the Commission, in cooperation with the Member States, at least every four years following its publication.

* Commission Recommendation (EU) 2017/1584 of 13 September 2017 on coordinated response to large-scale cybersecurity incidents and crises

EU AI Act –

Provisions o General Purp models beco applicable (se here)

As of 2 August 2025, the provisions of the EU AI Act (Regulation (EU)

2024/1689 of 13 June 2024) laying down harmonized rules on artificial

ose AI intelligence on general-purpose AI (GPAI) models became applicable (further details on the AI Act provided in the below summary of other recent developments).

These GPAI rules seek to increase the transparency, safety and accountability of AI models on the market (e.g., clearer information on how AI models are trained, stronger enforcement of copyright protections, and more responsible AI development).

Definitions. According to the EU AI Act, GPAI models are defined as models trained on very large datasets – often through self-supervision – that demonstrate broad generality, are capable of performing a wide range of tasks, and can be integrated into diverse downstream applications.

Within this category, certain GPAI models are considered to pose systemic risks due to their scale and potential impact. Currently, a GPAI model is classified as systemic-risk if its training requires more than 10^25 FLOPs, * although this threshold is currently under review by the Commission.

Providers' obligations. Depending on the risk posed by the GPAI model, providers face different obligations. Notably:

· Providers of all GPAI models must:

- Draw-up and keep up to date the technical documentation of the model, including its training and testing process and the results of its evaluation;

- Prepare, maintain, and make available to AI system providers intending to integrate the GPAI model documentation that includes a general description of the model, its key components, and the development process;

- Adopt a copyright policy to ensure that training datasets respect EU copyright law; **

- Prepare and publish a sufficiently detailed summary about the content used for the training of the GPAI model, using the official template issued by the Commission.

· Providers of systemic-risk GPAI models, in addition to the obligations listed above, must:

- Perform an AI model evaluation, including by conducting an adversarial testing of the AI model to identify and mitigate systemic risks;

- Assess and mitigate possible systemic risks at EU level;

- Keep track of, document and report any serious incident (and any corrective measures to address such incident) to the EU AI Office and, as appropriate, to relevant national authorities; and

- Ensure an adequate level of cybersecurity protection for the GPAI model and the physical infrastructure of the model.

Guidelines and Code of Practice. To assist providers of GPAI models in meeting their obligations under the EU AI Act, the Commission has issued several recent measures:

· On 18 July 2025, the Commission published interpretative guidelines clarifying key aspects of the GPAI provisions, including the definition of GPAI models, classification of systemic-risk models, exemptions for open-source GPAI models, and enforcement modalities.

· On 1 August 2025, the Commission assessed the GPAI Code of Practice as an adequate tool to demonstrate compliance. This Code is divided into three chapters – Transparency, Copyright, and Safety & Security – and offers detailed measures that GPAI model providers can adopt to demonstrate conformity with their obligations under the EU AI Act (see also Jones Day Commentary, EU AI Act: European Commission Publishes General-Purpose AI Code of Practice, 6 August 2025).

Enforcement. Full enforcement of the EU AI Act's GPAI obligations will begin on 2 August 2026, with breaches subject to substantial penalties, including fines of up to €15 million or 3% of global annual turnover. GPAI models already placed on the market before 2 August 2025 have a two-year grace period, with full compliance required by 2 August 2027.

* Floating point Operations Per Second (FLOPS) is a unit of measurement used to quantify the computing power of a computer or a processor.

** Directive (EU) 2019/790 of 17 April 2019 on copyright and related rights.

EU AI Act – Other recent developments

The EU AI Act, which entered into force on 1 August 2024, aims to guarantee that AI systems placed on the European market and used in the EU are safe and respect fundamental rights and EU values (see also Jones Day Commentary, EU AI Act: First Rules Take Effect on Prohibited AI Systems and AI Literacy, 28 February 2025).

Key Developments. Since our earlier update (see Jones Day EU Geopolitical Risk Update No. 120, 1 February 2025), new developments on applying the EU AI Act notably include:

- Report on AI Privacy Risk and Large Language Models (LLMs*). The report, published by the European Data Protection Board on 10 April 2025, offers a risk management methodology to help organizations identify, assess and mitigate privacy risks linked to LLMs. It explains their uses across industries, clarifies the roles of different stakeholders under the EU AI Act and GDPR, and highlights the importance of continuous monitoring throughout the AI lifecycle.

- FAQs on AI Literacy. The EU AI Act requires providers and deployers of AI systems to ensure a sufficient level of AI literacy of their staff and other persons dealing with AI systems on their behalf. The FAQs, published by the Commission on 7 May 2025, emphasize that AI literacy should match an individual's technical knowledge and context of AI use, without mandating formal assessments. Organizations are also encouraged to promote tailored training initiatives, helping users to understand both the opportunities and risks associated with AI systems.

- Study on Generative AI and Copyright. The study, published by the European Parliament's Committee on Legal Affairs on 9 July 2025, examines how generative AI challenges core principles of EU copyright law, including the CDSM Directive.** With respect to the EU AI Act, the Study notes that the Act introduces another regulatory layer specifically addressing AI systems, which further complicates the already complex intersection with copyright. Also, while the EU AI Act's transparency obligations may support oversight, they do not resolve core copyright challenges.