Technology Law and Digital Law

The European Union Digital Services Act (DSA) now applies to all digital "intermediary services" that provide users with access to online goods, services, and content.

Economic, technological and labor market developments are affecting pay practices across industries around the world, but the impacts being felt aren't all the same.

As we learned to appreciate over the past year or so, virtual goods are intangible assets that can be traded within a virtual economy...

Travers Smith's Financial Services and Markets team presents a comprehensive regulatory roadmap for Q4 2026, covering critical developments from the UK AIFM Review and cryptoassets regime to EU market integration reforms. This practical guide equips senior managers and compliance advisers with actionable priorities across asset management, fintech, payments, and ESG reporting as regulatory change accelerates in both UK and EU jurisdictions.

The Token Issuance Trust offers a trust-based alternative to traditional corporate structures for Web3 protocols and DAOs, combining founder control with independent fiduciary oversight. This innovative framework enables protocols to hold assets, manage contracts, and support on-chain operations while preserving decentralisation principles. How can established trust law principles be adapted to meet the operational and governance requirements of decentralised token ecosystems?

In this edition we round up FinTech-related financial services regulatory developments for the week ending 18 September 2026.

The EU Cyber Resilience Act's incident reporting requirements are now in effect for manufacturers of connected products, with the ENISA single reporting platform operational since September 2026. Manufacturers must navigate complex notification timelines ranging from 24 hours to one month depending on incident severity, with potential fines reaching EUR15M or 2.5% of global turnover for non-compliance starting December 2027. Understanding these cascading reporting obligations to CSIRTs, ENISA, and affected

Last week marked a pivotal moment in artificial intelligence as OpenAI declared the start of the AGI era with its Astra model, followed by Nvidia's CEO claiming AGI has already arrived. Amid breakthrough mathematical proofs and public resignations from AI researchers warning of extinction risks, questions emerge about what AGI truly means and whether humanity is prepared for the implications of machines that can reason at human levels without consciousness or moral responsibility.

The UK faces an average of four nationally significant cyber attacks per week, yet data centres—the backbone of the digital economy—have remained outside regulatory scope until now. The Cyber Security and Resilience Bill will fundamentally change this landscape, introducing mandatory incident reporting within 24 hours, substantial penalties for non-compliance, and a new regulatory framework overseen by Ofcom that applies to facilities exceeding specific power thresholds.

Last week marked a pivotal moment in artificial intelligence as OpenAI declared the start of the AGI era with its Astra model, followed by Nvidia's CEO claiming AGI has already arrived. Amid breakthrough mathematical proofs and public resignations from AI researchers warning of extinction risks, questions emerge about what AGI truly means and whether humanity is prepared for the implications of machines that can reason at human levels without consciousness or moral responsibility.

Cybersecurity breaches can expose businesses to regulatory action, legal claims, and severe reputational damage. With the introduction of the Cyber Security and Resilience Bill and existing GDPR obligations, companies face stricter reporting requirements and stronger enforcement powers. Understanding how employee actions, from weak passwords to unauthorized AI access, can create vulnerabilities is essential for protecting sensitive commercial information and avoiding costly litigation.

On 17 September 2026, the European Commission presented the EU KIDS Act, aimed at strengthening the protection of minors online and reducing fragmentation across Member States.