Tech policy 2025–2026: what happened and why it matters

The period shows European and British regulators moving from drafting rules to imposing penalties. The European Commission preliminarily accused Temu of breaching the Digital Services Act by failing to mitigate sales of illegal products; Ofcom fined 4chan for not delivering a risk assessment required by the Online Safety Act; and Italy's AGCOM hit Cloudflare with what was described as a record fine for refusing to block piracy sites on its public DNS. The cases differ, but they share a pattern: the supervisor demands data and concrete measures, and the companies answer with technical or free-speech arguments.

At the same time, Brussels eased its own pace. The Digital Omnibus package proposed delaying key AI Act obligations and relaxing the use of personal data to train models; civil society groups read it as a setback for digital rights, and the article covering it disputes that regulation explains Europe's lag. The later political deal moved the deadlines for high-risk systems to December 2027 and for AI embedded in regulated products to August 2028, and added a ban on systems that generate intimate images without consent. Meanwhile, the Digital Markets Act did not by itself guarantee competition: Setapp Mobile closed its alternative EU app store on 16 February 2026, citing complex business terms.

Tension with the United States turned sovereignty into a political agenda. Washington barred visas for five European figures tied to the regulation of big tech, among them former commissioner Thierry Breton, and European leaders, Macron included, branded it coercion and intimidation. In parallel, the Commission is studying a technology sovereignty package that would require the most sensitive data in sectors such as finance, justice and health to be hosted on European cloud, and it presented EURO-3C, a pan-European digital public infrastructure whose components sit in data centers located and controlled in Europe.

The underlying diagnosis is one of dependence. One analysis puts the share of Europe's cloud market held by the three big American providers at up to 70% in 2026 and recalls that laws such as the CLOUD Act let Washington access data held by its companies wherever it is stored, which clashes with the GDPR. Another piece locates the turning point in the American restriction on foreign access to its most advanced AI models, which forced them to be switched off globally, European users included, and stresses that the European response revolves mostly around Mistral.

In the United States, political impulse prevailed over a stable framework. Senator Ted Cruz proposed the SANDBOX Act, which would let companies request temporary exemptions from federal laws to test AI products and give the White House science office power to overrule independent agencies; critics fear a route around consumer protection. The administration warned states that they would lose a $42 billion broadband fund if they set rates for subsidized providers, and the FTC told big tech that yielding to foreign governments on encryption or data security could break the law.

Over time, industry itself began asking for rules. One analysis argues that executives who backed the promise of less intervention now want a formal framework after chaotic export controls, and the White House sent Congress a framework with six principles covering safety, privacy, non-discrimination, transparency, oversight and innovation. Another front was defense: memorandum NSPM-11 seeks to speed up the adoption of advanced AI in the military and intelligence agencies, and bars vendors from disabling or altering critical systems without government authorization.

Courts became the de facto regulator of generative AI. Warner Bros. Discovery sued Midjourney for using its works to train models and reproduce protected characters; a group of authors led by John Carreyrou sued six AI companies for training on pirated copies, recalling that in an earlier case against Anthropic a judge considered training could be lawful under certain readings without legalizing piracy. Liability for harm also reached the courtroom: a new wrongful-death suit against Character AI joins similar ones, and a San Francisco judge let Workday face a class action over algorithmic discrimination in hiring.

Courts also set limits on the use of AI within the justice system itself. India's Supreme Court reacted angrily to fake AI-generated court orders submitted by a lower-ranking judge and opened an inquiry. In China, judges ruled it unlawful to dismiss someone solely because an AI can do their job, treating AI adoption as a business decision, and ordered compensation in one case. Proctorio's five-year lawsuit against a librarian also illustrates the use of litigation against someone who criticized an exam-monitoring tool.

China regulates from the top down. It banned the OpenClaw tool on government computers and issued security guidelines for AI adoption; according to reports, it plans to require state approval before its leading tech firms and AI startups accept American capital; and it created a national registry with a 29-character code for each humanoid robot, with more than 28,000 robots already identified. The underlying logic is the technological self-sufficiency that the Communist Party reiterated as it prepared its five-year plan.

The rivalry also uses materials and export controls. Beijing is slow to issue export licenses for indium phosphide, essential for the optical chips in AI data centers, and American prosecutors suspect a Thai company was used to divert servers carrying Nvidia chips to China. Both episodes show that technology policy is no longer limited to rules of use but now covers supply chains and capital.