Dechert Cyber Bits

California Privacy Regulator Launches First Sectoral Audit, Setting Sights on Workers’ Privacy Rights and Gig Economy Platforms

On July 21, 2026, the California Privacy Protection Agency (“CPPA”) announced that its Audits Division had opened its first formal sectoral audit, targeting major gig economy platforms that operate in California (“Audit”). The Audit is the first in a planned series of sector-focused reviews the CPPA will conduct and will assess whether gig platforms, including transportation and delivery apps, are meeting their obligations under the California Consumer Privacy Act.

The CPPA asserted that gig platforms collect extensive personal information from consumers and workers and expressed concerns that this data may be fed into algorithmic systems that drive dispatch assignments, performance ratings, earnings and account status determinations, including suspensions or deactivations. The CPPA indicated that the Audit will focus on whether workers and consumers can meaningfully exercise their rights to access and control their personal information, including their rights to know what data is collected about them, how it is used and with whom it is shared. The CPPA stated that the Audit will also specifically examine whether gig platforms are timely honoring access requests, whether responses are complete and whether gig platforms have built systems that allow workers to appropriately exercise their rights.

Takeaway: A new wave of privacy regulation in California has officially kicked off with the CPPA’s first sectoral audit. We expect companies across industries to pay close attention to how the Audit proceeds and to any enforcements that stem from it. Gig platforms and others will want to use the CPPA’s stated areas of focus as a guide to benchmark their own practices for compliance, as the agency undoubtedly will treat any public statements about its expectations and the results of any enforcements as “requirements,” even if they are not codified into law or regulation.  

EU AI Act Transparency Guidelines Published 

The EU AI Act’s transparency framework provisions came into force on August 2, 2026 and the European Commission has recently issued final guidelines on actual implementation.

The AI Act includes obligations on “providers” (broadly, developers of AI systems) and “deployers” (broadly, users of AI systems) to disclose the use of AI:

• Providers of AI systems have an obligation to design AI in a way that users are informed when interacting with AI (e.g. an AI chatbot) and add machine-readable watermarks that identify AI-generated or manipulated content.
• Deployers of AI systems are required to disclose deepfakes and inform individuals when they are exposed to emotion recognition and biometric categorization tools or written publications on matters of public interest produced without human review or editorial control.

Transparency information must be clear and provided no later than the first interaction.

The Commission has stated that the AI Act’s transparency obligations aim to "foster trust and integrity in the information ecosystem" by ensuring individuals know when they are interacting with AI or exposed to AI-generated content, so that they can “make informed decisions, calibrate their trust and reliance on AI and avoid misinformation or deception”. The Commission’s guidelines provide explanations and examples addressing both the meaning of the legislative wording and the ways the Commission considers the transparency obligations can be satisfied, such as the formats in which information can be provided to users.

Takeaway: The AI Act’s transparency obligations are designed to address specific potential  AI use issues in which it is particularly important for individuals to understand how AI is being used, targeting chatbots and AI-generated content. While certain obligations for providers of general-purpose AI models are already in force, the introduction of the transparency rules will now bring many organizations within the ambit of substantive requirements of the AI Act for the first time (importantly obligations in relation to “high risk” AI systems having been postponed to at least late 2027). In addition to providing guidance on the AI Act’s specific transparency requirements, the Commission’s guidelines also touch on important concepts and exclusions under the AI Act more generally, so are a useful resource for organizations planning ahead to the implementation of the obligations in relation to “high risk” AI.

Google Fined EUR 890 Million Under the EU’s Digital Markets Act 

The European Commission (“Commission”) fined Google EUR890 million for breach of the Digital Markets Act (“DMA”) for allegedly preferring its own services on Google Search and imposing unlawful restrictions on businesses offering apps on the Google Play app store. Google has criticized  the decision, denying the allegations and arguing that it is bad for consumers.

Google is one of a small number of major tech companies designated as “gatekeepers” under the DMA. Under the DMA designated gatekeepers are subject to a variety of obligations designed to promote fair competition online. Fines under the DMA can reach 10% of worldwide turnover (or 20% for repeated infringements). The Commission’s decision follows an investigation launched in March 2024 and relates to alleged breaches of the DMA’s self-preferencing rules and the anti-steering rules, which are as follows:

• Self-preferencing - Gatekeepers are subject to restrictions on ranking their own products more favorably than third party products and obligations to apply transparent, fair and non-discriminatory conditions to rankings (Article 6(5) DMA). The Commission alleged that Google breached those requirements by giving preferential treatment to its own services – such as Google Hotels, Google Shopping and Google Flights – by displaying them more prominently.
• Anti-steering – The DMA imposes restrictions on gatekeepers limiting business users’ ability to communicate with end users acquired through the gatekeeper’s platform about the availability of products and services outside the gatekeeper’s platform (Article 5(4) DMA). The Commission alleged that Google had breached the anti-steering rules in the context of the Google Play app store. The Commission stated that, although Google was permitted to receive a fee for facilitating the initial acquisition of a new customer by an app developer through Google Play, Google imposed fees that were too high and for too long to comply with the anti-steering rules.

Google criticized the Commission’s decision, arguing that the DMA breaks everyday products and forces Google to strip away popular search features Europeans love - like instant pricing and direct availability for hotels, flights, and restaurants - and dismantle safety protections on Google Play.

Takeaway: The DMA presumably seeks to re-draw the balance of power between BigTech firms, their competitors and their users with Google an obvious target of the legislation. This is a landmark fine after over two years of investigation and Google’s offering is likely to be under ongoing scrutiny from the Commission going forward, as are the products and services provided by other tech giants. The Commission’s press release in relation to this fine suggests that Google’s AI Overviews and AI Mode are also being targeted by the Commission.

OpenAI Discloses That During Internal Testing, Its AI Agent Leveraged a Zero-Day Vulnerability to Escape its Sandbox and Hack an AI Startup 

OpenAI recently disclosed that an autonomous AI agent built on its technology went rogue during internal testing, accessed the internet, and gained unauthorized access to a third party’s systems. OpenAI called the episode “an unprecedented cyber-incident, involving state-of-the-art cyber capabilities,” and said it expects such incidents to become more common as underlying AI models grow more capable.

According to OpenAI, the agent combined OpenAI’s latest publicly available model, GPT-5.6 Sol, with a more capable unreleased model. The agent was tasked with performing a cyber capability evaluation in a sandboxed environment with the goal of finding and exploiting software vulnerabilities. During the evaluation, the agent discovered and exploited a previously unknown (0-day) vulnerability that allowed it to escape the evaluation sandbox and access the internet.

Once free, the AI agent infiltrated the internal systems of Hugging Face, a digital library of AI models and software, which the agent may have inferred would hold the models, datasets, and reference solutions (essentially, the answer key) needed to achieve a perfect score on its evaluation. The intrusion was brought to an end once Hugging Face’s security team and its own AI agents detected the activity.  

Thus far, forensic reconstruction of the attack timeline identified over 17,000 attacker actions over the course of about four and a half days. 

Takeaway: This and other recent incidents demonstrate how powerful frontier AI models have become in their abilities to perform cyber intrusions into other organizations. Given the availability of open models, especially when their cybersecurity safeguards are not enabled, threat actors likely already possess similar offensive AI-enabled hacking capabilities. In short, the decades-old arms race between industry and threat actors continues to escalate. Companies will want to consider deploying AI-enabled defensive cybersecurity tools to detect and respond to AI-enabled threats, and organizations should continue to assess the adequacy of their cybersecurity stack as AI agents become more adept. The potential risks from such incidents are likely to lead to much greater regulatory focus in this area.

U.S. Department of War Pauses CMMC Phase II Program Requirements 

On July 13, 2026, the Department of War (“Department” or “DOW”) announced the immediate suspension of its Cybersecurity Maturity Model Certification (“CMMC”) Phase II requirements, which would have required most contractors handling Controlled Unclassified Information (“CUI”) to complete a third-party cybersecurity assessment by November 10, 2026. Phase 1 self-assessment requirements remain in place, but the Department is conducting a 60-day study of the CMMC program’s future, and all pending and future CMMC implementation milestones have been suspended in the interim.

DOW Chief Information Officer Kirsten A. Davies said the suspension and accompanying 60-day study were a response to concerns about burdening small and medium-sized businesses with regulatory and administrative requirements that could prevent innovative companies from participating in the defense industry. She added that “robust cybersecurity and operational resilience remain critical to protecting American innovation and supporting warfighter readiness” and that the Department believes the defense industrial base can achieve both while reducing unnecessary hurdles.

The Department is establishing a task force to conduct a review of the CMMC program based on industry feedback, with industry input due by August 14, 2026 and the task force’s final report set to be delivered to the Department’s CIO in mid-September. During the interim period, the Department indicated that it will continue enforcing cybersecurity compliance with the relevant NIST standards through self-assessments and select government-led assessments focused on meaningful cyber hygiene. The Department also emphasized that the CMMC suspension does not eliminate contractors’ and subcontractors’ underlying contractual obligations to safeguard covered defense information.

Takeaway: Federal contractors and subcontractors have received, at minimum, a temporary reprieve from CMMC’s burdensome third-party assessment requirement, though many have already invested the relevant time and resources to obtaining relevant certifications given the original November 2026 deadline. Ideally, whatever changes are made to CMMC based on the task force’s work will not require companies that have already obtained third-party certifications to re-complete the process. Companies in this space will want to consider whether to submit feedback to the task force prior to the August 14, 2026 deadline and will need to closely monitor the CMMC Reform Task Force’s public Request for Information process, as the resulting recommendations may determine the ultimate fate of CMMC Phase II.