Britain will put cyber duties on company boards by regulation, not in the bill. A letter to peers names four. The consultation promised for this year has not appeared, and clause 42(3) says it need not.

https://www.yeandel.co.uk/22-q3-2026-updates/board-duty-not-in-the-bill.html #TechSovereignty

Twenty four EU governments signed the Dublin Declaration on sovereign AI. Croatia, Greece and Slovenia did not. The only numerals in it are the seven section numbers and the date.

https://www.yeandel.co.uk/22-q3-2026-updates/three-did-not-sign.html #TechSovereignty

The minister told peers regulators must publish how the charges were used. The bill requires three numbers, and that is not one of them. A charge also need not relate to work done on the payer.

https://www.yeandel.co.uk/22-q3-2026-updates/charge-for-somebody-elses-inspection.html #TechSovereignty

Peers asked if anyone has assessed Britain's dependence on foreign firms holding NHS data. The answer runs to 47 words and never says foreign. The one above it, on exam boards, runs to 301.

https://www.yeandel.co.uk/22-q3-2026-updates/forty-seven-words-on-dependence.html #TechSovereignty

Should good-faith security researchers get a defence under the Computer Misuse Act 1990? The Home Office asked in 2021, consulted in 2023, and left the answer out of its own next steps. A peer wants it back.

https://www.yeandel.co.uk/22-q3-2026-updates/the-answer-never-given.html #TechSovereignty

A minister can order a British firm under national security direction to hire a cyber expert, and GCHQ supplies the list. Two Lords amendments would narrow it to a register of a thousand people.

https://www.yeandel.co.uk/22-q3-2026-updates/a-register-of-a-thousand.html #TechSovereignty

CADA's one corporate ownership test asks whether a European provider controls its foreign subsidiary. Every firm it is aimed at is the foreign subsidiary. And the level three escape hatch cites Article 19.

https://www.yeandel.co.uk/22-q3-2026-updates/ownership-test-backwards.html #TechSovereignty

Europe's cloud sovereignty ladder has four rungs. At every one of them, including the top, a public body can still explicitly require customer data, metadata and telemetry to leave the Union.

https://www.yeandel.co.uk/22-q3-2026-updates/waiver-that-never-closes.html #TechSovereignty

Industry priced Europe's cloud sovereignty law at 115 billion euros, six times the Commission's estimate. Most of it rests on CADA Article 31, voluntary in paragraph one, compulsory by delegated act in three.

https://www.yeandel.co.uk/22-q3-2026-updates/six-times-the-estimate.html #TechSovereignty

One peer wants ransomware reported inside 24 hours, with rolling updates to customers. Another wants an amnesty where reporting triggers no duty, no investigation and no liability. Same bill, same paper.

https://www.yeandel.co.uk/22-q3-2026-updates/amnesty-or-the-clock.html #TechSovereignty

Three peers, three benches, six days: three amendments give the AI Security Institute power to set standards, inspect frontier AI and order a system suspended. The Institute does not exist in law.

https://www.yeandel.co.uk/22-q3-2026-updates/regulator-by-amendment.html #TechSovereignty

Britain's National Cyber Action Plan was due on 7 July and has never appeared. Two Conservative peers have now made publishing it the condition for the whole Cyber Security and Resilience Act coming into force.

https://www.yeandel.co.uk/22-q3-2026-updates/no-plan-no-act.html #TechSovereignty

Broadcom, an American company, are telling Europeans not to use #OpenSource to achieve #TechSovereignty, due to the risk of "depending on Open Source maintainers", and instead tells you to *checks notes* use their proprietary solutions, the same proprietary solutions they recently locked users […]

Yay for #techsovereignty

Page 132 of the Council's Digital Omnibus text inserts a GDPR article letting AI developers train on personal data as a legitimate interest. Page 31 inserts a recital saying it is not one. Same document.

https://www.yeandel.co.uk/22-q3-2026-updates/page-132-says-yes.html #TechSovereignty

Europe's biggest rewrite of data law since the GDPR was due to be agreed on Sunday. It came off the ambassadors' agenda instead, no new date, no revised text. The blockage is trade secrets, not privacy.

https://www.yeandel.co.uk/22-q3-2026-updates/off-the-agenda-no-new-date.html #TechSovereignty

The AI minister says Britain cannot leave tech firms to police their own models. The bill that would stop them hits report stage in a fortnight. All 38 amendments on the paper belong to backbenchers.

https://www.yeandel.co.uk/22-q3-2026-updates/britain-did-not-sign.html #TechSovereignty

Britain's new cyber bill runs to 226,591 characters on reporting cyber incidents. The word voluntary never appears, and nor does near miss. One peer has written the missing clause. Nobody has co-signed.

https://www.yeandel.co.uk/22-q3-2026-updates/near-miss-no-one-reports.html #TechSovereignty

The Met's blocked two-year Palantir contract is in court. Its one published Palantir purchase, a three-month trial at 489,999 pounds, has just ended a police career. That contract expired on 30 April.

https://www.yeandel.co.uk/22-q3-2026-updates/the-trial-that-ended-in-april.html #TechSovereignty