LONDON — The U.K.’s data protection watchdog has opened a formal investigation into Elon Musk’s companies X and xAI, over the use of personal data by the Grok AI system to generate a flood of sexualized deepfakes. In a statement on Tuesday, the Information Commissioner’s Office said the “reported creation and circulation of such content raises serious concerns under U.K. data protection law and presents a risk of significant potential harm to the public.” “These concerns relate to whether personal data has been processed lawfully, fairly and transparently, and whether appropriate safeguards were built into Grok’s design and deployment to prevent the generation of harmful manipulated images using personal data,” it said. The formal investigation follows an announcement last month that the ICO was seeking urgent information from X and xAI, amid widespread reports that Grok had been used to generate sexualized images of children and adults. William Malcolm, executive director for regulatory risk and innovation at the ICO, said the reports about Grok “raise deeply troubling questions about how people’s personal data has been used.” “Losing control of personal data in this way can cause immediate and significant harm. This is particularly the case where children are involved,” Malcolm said. “Where we find obligations have not been met, we will take action to protect the public.” While the ICO’s investigation will focus on X and xAI’s compliance with U.K. data protection law, Malcolm said it would work closely with other regulators in the U.K. and abroad that are also investigating the issue. Ofcom, the U.K.’s communications regulator, opened a formal investigation into X last month under the Online Safety Act. That investigation is ongoing, Ofcom said on Tuesday. It is progressing “as a matter of urgency” but could take “months,” Ofcom added, noting that it must follow a “fair process” and “it would not be appropriate to provide a running commentary.” Ofcom also said it is not currently investigating xAI, which provides the standalone Grok AI tool, noting that “it can only take action on online harms covered by the [OSA].” The act does not apply to AI tools which do not involve searching the internet, interacting with other social media users, or generating pornography, it said. The U.K.’s Technology Secretary Liz Kendall has previously said she is assessing options to address “gaps” in the OSA. The European Commission announced its own probe into X last month, while French authorities searched X’s offices in Paris on Tuesday as part of their own criminal investigation into Grok, POLITICO reported. X did not immediately respond when contacted for comment.

BRUSSELS — The European Union is pressing ahead with talks to grant United States border authorities unprecedented access to Europeans’ data, despite growing concerns about American surveillance. The European Commission is brokering a deal to exchange information about travelers, including fingerprints and law enforcement records, so the U.S. can determine if they “pose a risk to public security or public order,” according to official documents. Commission officials flew to Washington last week for the first round of negotiations, according to two people familiar with the matter. The Trump administration’s request for deeper access comes after the U.S. border agency in December proposed reviewing five years of social media history. Talks are happening as the U.S. Immigration and Customs Enforcement (ICE) service is under heavy scrutiny for its use of surveillance technology against protesters in cities such as Minneapolis. The negotiations should be “put on hold” until the security and privacy of citizens in the EU and U.S. can be guaranteed, liberal European Parliament member Raquel García Hermida-van der Walle said in an interview. Romain Lanneau, a legal researcher with surveillance watchdog Statewatch, said police databases in Europe could contain information on anyone from protesters to journalists who might be considered a “threat,” and that — under the deal being discussed — this information would be at the fingertips of U.S. border authorities who could refuse those people entry to the United States or even detain them. European regulators are “very cautiously looking at what’s happening in the United States,” Wojciech Wiewiórowski, the EU’s in-house data protection supervisor, told POLITICO. Europe “has to be careful” about how it allows the data of Europeans to flow to the U.S., he said.  Hermida-van der Walle in January co-signed a letter by six prominent lawmakers calling on the Commission to stand down given the “current geopolitical context,” despite Washington’s admonition that failure to reach a deal will mean Europeans lose access to its visa waiver program. UNPRECEDENTED ACCESS The U.S. is seeking access to information including biometric data such as fingerprints that is stored on national databases in European countries, according to an explanatory note sent to national experts. The data would be used to “address irregular migration and to prevent, detect, and combat serious crime and terrorist offences,” the note said. In an earlier opinion on the deal, the European Data Protection Supervisor (EDPS) — a watchdog that advises the Commission on privacy policies — noted the deal would be the first of its kind to enable “large-scale sharing of personal data … for the purpose of border and immigration control” with a non-EU country. The Commission would negotiate a framework deal that would serve as a template for bilateral agreements called Enhanced Border Security Partnerships (EBSPs), which national governments agree with Washington. EU countries in December signed off on the Commission’s request to start talks with the U.S. Washington is pressuring its EU counterparts by imposing a deadline for the bilateral deals to be agreed by the end of 2026. If countries fail to reach a deal with the U.S. they risk being cut from the latter’s visa waiver program. The U.S has made it mandatory for all countries that are part of the visa waiver program to have an EBSP in place. “The pressure which the United States is extorting on our member states, the threats that if you don’t agree with this we will cancel your access to the visa waiver program, that is an element of blackmail that we cannot let go,” Hermida-van der Walle said. The EDPS watchdog has cautioned that the scope of data sharing should be as narrow as possible, with clear justifications for every query; transparency around how the data is used; and judicial redress available in the U.S. for any person. Commission spokesperson Markus Lammert emphasised at a recent press briefing that the framework being negotiated will involve “clear and robust safeguards on data protection,” and will ensure “a non-systematic nature of the information exchange and that the exchange is limited to what is strictly necessary to achieve the objectives of this cooperation.”  US PRIVACY UNDER PRESSURE Access to the data is the latest issue putting pressure on a troubled relationship between the U.S. and the EU on data privacy. Since whistleblower Edward Snowden in 2013 revealed U.S. mass surveillance practices affecting Europeans, the EU has tightened controls on how Washington handles Europeans’ data. Since the return of Donald Trump as president last year, officials and rights groups have deplored a move by the U.S. administration to gut a key privacy watchdog tasked with overseeing privacy safeguards in place to protect Europeans. The Trump administration has also been ramping up mass surveillance of citizens by federal agencies like ICE, including through contracts with Israeli spyware company Paragon, surveillance giant Palantir and other firms. Capgemini, a prominent French IT firm, on Sunday said it was selling off its American activities after it faced political backlash from the French government that its software was being used by ICE authorities. Civil rights groups, lawmakers and other watchdogs fear the new EU-U.S. data sharing deals would add to backsliding on privacy rights.    “The current initiatives are being presented as toward counter-terrorism, but a lot of them are actually adopted for the chilling effect [on political activism],” Statewatch’s Lanneau said. Hermida-van der Walle, the liberal lawmaker, warned: “If people have to go to the United States, if it’s not a choice but something that they have do, there is a risk of self-censoring.”  “This comes from an administration who claims to be the biggest defender of free speech. What they’re doing with their actions is curtailing the possibility of people to express themselves freely, because otherwise they might not get access into the country,” she said.

China’s foreign ministry on Wednesday said a new European Commission proposal to restrict high-risk tech vendors from critical supply chains amounted to “blatant protectionism,” warning European officials that Beijing will take “necessary measures” to protect Chinese firms. Beijing has “serious concerns” over the bill, Chinese foreign ministry spokesperson Guo Jiakun told reporters, according to state news agencies’ reports. “Using non-technical standards to forcibly restrict or even prohibit companies from participating in the market, without any factual evidence, seriously violates market principles and fair competition rules,” Guo said. The European Commission on Tuesday unveiled its proposal to revamp the bloc’s Cybersecurity Act. The bill seeks to crack down on risky technology vendors in critical supply chains ranging across energy, transport, health care and other sectors. Though the legislation itself does not name any specific countries or companies, it is widely seen as being targeted at China. 5G suppliers Huawei and ZTE are in the EU’s immediate crosshairs, while other Chinese vendors are expected to be hit at a later stage. European Commission spokesperson Thomas Regnier responded to the Chinese foreign ministry, saying Europe has allowed high-risk vendors from outside the EU in strategic sectors for “far too long.” “We are indeed radically changing this. Because we cannot be naive anymore,” Regnier said in a statement. The exclusion of high-risk suppliers will always be based on “strong risk assessments” and in coordination with EU member countries, he said. China “urges the EU to avoid going further down the wrong path of protectionism,” the Chinese foreign ministry’s Guo told reporters. He added the EU bill would “not only fail to achieve so-called security but will also incur huge costs,” saying some restrictions on using Huawei had already “caused enormous economic losses” in Europe in past years. European telecom operators warned Tuesday that the law would impose multi-billion euro costs on the industry if restrictions on using Huawei and ZTE were to become mandatory across Europe. A Huawei spokesperson said in a statement that laws to block suppliers based on their country of origin violate the EU’s “basic legal principles of fairness, non-discrimination, and proportionality,” as well as its World Trade Organization obligations. The company “reserve[s] all rights to safeguard our legitimate interests,” the spokesperson said. ZTE did not respond to requests for comment on the EU’s plans.

A clash between Poland’s right-wing president and its centrist ruling coalition over the European Union’s flagship social media law is putting the country further at risk of multimillion euro fines from Brussels. President Karol Nawrocki is holding up a bill that would implement the EU’s Digital Services Act, a tech law that allows regulators to police how social media firms moderate content. Nawrocki, an ally of U.S. President Donald Trump, said in a statement that the law would “give control of content on the internet to officials subordinate to the government, not to independent courts.” The government coalition led by Prime Minister Donald Tusk, Nawrocki’s rival, warned this further exposed them to the risk of EU fines as high as €9.5 million. Deputy Digital Minister Dariusz Standerski said in a TV interview that, “since the president decided to veto this law, I’m assuming he is also willing to have these costs [of a potential fine] charged to the budget of the President’s Office.” Nawrocki’s refusal to sign the bill brings back bad memories of Warsaw’s years-long clash with Brussels over the rule of law, a conflict that began when Nawrocki’s Law and Justice party rose to power in 2015 and started reforming the country’s courts and regulators. The EU imposed €320 million in penalties on Poland from 2021-2023. Warsaw was already in a fight with the Commission over its slow implementation of the tech rulebook since 2024, when the EU executive put Poland on notice for delaying the law’s implementation and for not designating a responsible authority. In May last year Brussels took Warsaw to court over the issue. If the EU imposes new fines over the rollout of digital rules, it would “reignite debates reminiscent of the rule-of-law mechanism and frozen funds disputes,” said Jakub Szymik, founder of Warsaw-based non-profit watchdog group CEE Digital Democracy Watch. Failure to implement the tech law could in the long run even lead to fines and penalties accruing over time, as happened when Warsaw refused to reform its courts during the earlier rule of law crisis. The European Commission said in a statement that it “will not comment on national legislative procedures.” It added that “implementing the [Digital Services Act] into national law is essential to allow users in Poland to benefit from the same DSA rights.” “This is why we have an ongoing infringement procedure against Poland” for its “failure to designate and empower” a responsible authority, the statement said. Under the tech platforms law, countries were supposed to designate a national authority to oversee the rules by February 2024. Poland is the only EU country that hasn’t moved to at least formally agree on which regulator that should be. The European Commission is the chief regulator for a group of very large online platforms, including Elon Musk’s X, Meta’s Facebook and Instagram, Google’s YouTube, Chinese-owned TikTok and Shein and others. But national governments have the power to enforce the law on smaller platforms and certify third parties for dispute resolution, among other things. National laws allow users to exercise their rights to appeal to online platforms and challenge decisions. When blocking the bill last Friday, Nawrocki said a new version could be ready within two months. But that was “very unlikely … given that work on the current version has been ongoing for nearly two years and no concrete alternative has been presented” by the president, said Szymik, the NGO official. The Digital Services Act has become a flashpoint in the political fight between Brussels and Washington over how to police online platforms. The EU imposed its first-ever fine under the law on X in December, prompting the U.S. administration to sanction former EU Commissioner Thierry Breton and four other Europeans. Nawrocki last week likened the law to “the construction of the Ministry of Truth from George Orwell’s novel 1984,” a criticism that echoed claims by Trump and his top MAGA officials that the law censored conservatives and right-wingers. Bartosz Brzeziński contributed reporting.

WARSAW — Poland’s nationalist President Karol Nawrocki on Friday sided with his ally U.S. President Donald Trump to veto legislation on enforcing the EU’s social media law, which is hated by the American administration. Trump and his top MAGA officials condemn the EU’s Digital Services Act — which seeks to force big platforms like Elon Musk’s X, Facebook, Instagram to moderate content — as a form of “Orwellian” censorship against conservative and right-wingers. The presidential veto stops national regulators in Warsaw from implementing the DSA and sets Nawrocki up for a a clash with centrist pro-EU Prime Minister Donald Tusk. Tusk’s parliamentary majority passed the legislation introducing the DSA in Poland. Nawrocki argued that while the bill’s stated aim of protecting citizens — particularly minors — was legitimate, the Polish bill would grant excessive power to government officials over online content, resulting in “administrative censorship.”  “I want this to be stated clearly: a situation in which what is allowed on the internet is decided by an official subordinate to the government resembles the construction of the Ministry of Truth from George Orwell’s novel 1984,” Nawrocki said in a statement — echoing the U.S.’s stance on the law. Nawrocki also warned that allowing authorities to decide what constitutes truth or disinformation would erode freedom of expression “step by step.” He called for a revised draft that would protect children while ensuring that disputes over online speech are settled by independent courts. Deputy Prime Minister and Digital Affairs Minister Krzysztof Gawkowski dismissed Nawrocki’s position, accusing the president of undermining online safety and siding with digital platforms.  “The president has vetoed online safety,” Gawkowski told a press briefing Friday afternoon, arguing the law would have protected children from predators, families from disinformation and users from opaque algorithms.  The minister also rejected Nawrocki’s Orwellian comparisons, saying the bill explicitly relied on ordinary courts rather than officials to rule on online content. Gawkowski said Poland is now among the few EU countries without national legislation enabling effective enforcement of the DSA and pledged that the government would continue to pursue new rules. The clash comes as enforcement of the social media law has become a flashpoint in EU-U.S. relations.  Brussels has already fined Elon Musk’s X €120 million for breaching the law, prompting a furious response from Washington, including travel bans imposed by the Trump administration on former EU Commissioner Thierry Breton, an architect of the tech law, and four disinformation experts. The DSA allows fines of up to 6 percent of a company’s global revenue and, as a measure of last resort, temporary bans on platforms. Earlier this week, the European Commission expanded its investigation into X’s AI service Grok after it started posting a wave of non-consensual sexualized pictures of people in response to X users’ requests. The European Commission’s digital spokesperson Thomas Regnier said the EU executive would not comment on national legislative procedures. “Implementing the DSA into national law is essential to allow users in Poland to benefit from the same DSA rights, such as challenging platforms if their content is deleted or their account suspended,” he said. “This is why we have an ongoing infringement procedure against Poland. We have referred Poland to the Court of Justice of the EU for failure to designate and empower the Digital Services Coordinator,” in May 2025, Regnier added. Gawkowski said that the government would make a quick decision on what to do next with the vetoed bill but declined to offer specifics on what a new bill would look like were it to be submitted to parliament again. Tusk four-party coalition does not have enough votes in parliament to override Nawrocki’s vetoes. That has created a political deadlock over key legislation efforts by the government, which stands for reelection next year. Nawrocki, meanwhile, is aiming to help the Law and Justice (PiS) political party he’s aligned with to retake power after losing to Tusk in 2023. Mathieu Pollet contributed reporting.

The Dutch government has quietly removed Google tracking tools from job listings for its intelligence services over concerns that the data would expose aspirant spies to U.S. surveillance. The intervention would put an end to Google’s processing of the data of job seekers interested in applying to spy service jobs, after members of parliament in The Hague raised security concerns. The move comes at a moment when trust between the Netherlands and the United States is fraying. It reflects wider European unease — heightened by Donald Trump’s return to the White House — about American tech giants having access to some of their most sensitive government data. The heads of the AIVD and MIVD, the Netherlands’ civilian and military intelligence services, said in October that they were reviewing how to share information with American counterparts over political interference and human rights concerns. In the Netherlands, government vacancies are listed on a central online portal, which subsequently redirects applicants to specific institutions’ or agencies’ websites, including those of the security services. The government has now quietly pulled the plug on Google Analytics for intelligence-service postings, according to security expert Bert Hubert, who first raised the alarm about the trackers earlier this year. Hubert told POLITICO the job postings for intelligence services jobs no longer contained the same Google tracking technologies at least since November. The move was first reported by Follow the Money. The military intelligence service MIVD declined to comment. The interior ministry, which oversees the general intelligence service AIVD, did not respond to a request for comment at the time of publication. In a statement, Communications Manager for Google Mathilde Méchin said: “Businesses, not Google Analytics, own and control the data they collect and Google Analytics only processes it at their direction. This data can be deleted at any time.” “Any data sent to Google Analytics for measurement does not identify individuals, and we have strict policies against advertising based on sensitive information,” Méchin said. ‘FUTURE EMPLOYEES AT RISK’ Derk Boswijk, a center-right Dutch lawmaker, raised the alarm about the tracking of job applicants in parliamentary questions to the government in January. He said that while China and Russia have traditionally been viewed as the biggest security risks, it is unacceptable for any foreign government — allied or not — to have a view into Dutch intelligence recruitment. “I still see the U.S. as our most important ally,” Boswijk told POLITICO. “But to be honest, we’re seeing that the policies of the Trump administration and the European countries no longer necessarily align, and I think we should adapt accordingly.” The government told Boswijk in February it had enabled privacy settings on data gathered by Google. The government has yet to comment on Boswijk’s latest questions submitted in November. Hubert, the cybersecurity expert, said the concerns over tracking were justified. Even highly technical data like IP addresses, device fingerprints and browsing patterns can help foreign governments, including adversaries such as China, narrow down who might be seeking a job inside an intelligence agency, he said. “By leaking job applications so broadly, the Dutch intelligence agencies put their future employees at risk, while also harming their own interests,” said Hubert, adding it could discourage sought-after cybersecurity talent that agencies are desperate to attract. Hubert previously served on a watchdog committee overseeing intelligence agencies’ requests to use hacking tools, surveillance and wiretapping.  One open question raised by Dutch parliamentarians is how to gain control over the data that Google gathered on aspiring spies in past years. “I don’t know what happens with the data Google Analytics already has, that’s still a black box to me,” said Sarah El Boujdaini, a lawmaker for the centrist-liberal Democrats 66 party who oversees digital affairs. The episode is likely to add fuel to efforts to wean off U.S. technologies — which are taking place across Europe, as part of the bloc’s “technological sovereignty” drive. European Parliament members last month urged the institution to move away from U.S. tech services, in a letter to the president obtained by POLITICO. In the Netherlands, parliament members have urged public institutions to move away from digital infrastructure run by U.S. firms like Microsoft, over security concerns. “If we can’t even safeguard applications to our secret services, how do you think the rest is going?” Hubert asked. The country also hosts the International Criminal Court, where Chief Prosecutor Karim Khan previously lost access to his Microsoft-hosted email account after he was targeted with American sanctions over issuing an arrest warrant for Israeli Prime Minister Benjamin Netanyahu. The ICC in October confirmed to POLITICO it was moving away from using Microsoft Office applications to German-based openDesk.

The European Union’s law enforcement agency wants to speed up how it gets its hands on artificial intelligence tools to fight serious crime, a top official said. Criminals are having “the time of their life” with “their malicious deployment of AI,” but police authorities at the bloc’s Europol agency are weighed down by legal checks when trying to use the new technology, Deputy Executive Director Jürgen Ebner told POLITICO. Authorities have to run through data protection and fundamental rights assessments under EU law. Those checks can delay the use of AI by up to eight months, Ebner said. Speeding up the process could make the difference in time sensitive situations where there is a “threat to life,” he added. Europe’s police agency has built out its tech capabilities in past years, ranging from big data crunching to decrypting communication between criminals. Authorities are keen to fight fire with fire in a world where AI is rapidly boosting cybercrime. But academics and activists have repeatedly voiced concerns about giving authorities free rein to use AI tech without guardrails. European Commission President Ursula von der Leyen has vowed to more than double Europol’s staff and turn it into a powerhouse to fight criminal groups “navigating constantly between the physical and digital worlds.” The Commission’s latest work program said this will come in the form of a legislative proposal to strengthen Europol in the second quarter of 2026.  Speaking in Malta at a recent gathering of data protection specialists from across Europe’s police forces, Ebner said it is an “absolute essential” for there to be a fast-tracked procedure to allow law enforcement to deploy AI tools in “emergency” situations without having to follow a “very complex compliance procedure.” Assessing data protection and fundamental rights impacts of an AI tool is required under the EU’s General Data Protection Regulation (GDPR) and AI Act. Ebner said these processes can take six to eight months.  The top cop clarified that a faster emergency process would not bypass AI tool red lines around profiling or live facial recognition. Law enforcement authorities already have several exemptions under the EU’s Artificial Intelligence Act (AI Act). Under the rules, the use of real-time facial recognition in public spaces is prohibited for law enforcers, but EU countries can still permit exceptions, especially for the most serious crimes. Lawmakers and digital rights groups have expressed concerns about these carve-outs, which were secured by EU countries during the law’s negotiation. DIGITAL POLICING POWERS Ebner, who oversees governance matters at Europol, said “almost all investigations” now have an online dimension.   The investments in tech and innovation to keep pace with criminals is putting a “massive burden on law enforcement agencies,” he said. European Commission President Ursula von der Leyen has vowed to more than double Europol’s staff and turn it into a powerhouse to fight criminal groups. | Wagner Meier/Getty Images The Europol official has been in discussions with Europe’s police chiefs about the EU agency’s upcoming expansion. He said they “would like to see Europol doing more in the innovation field, in technology, in co-operation with private parties.”  “Artificial intelligence is extremely costly. Legal decryption platforms are costly. The same is to be foreseen already for quantum computing,” Ebner said. Europol can help bolster Europe’s digital defenses, for instance by seconding analysts with technological expertise to national police investigations, he said. Europol’s central mission has been to help national police investigate cross-border serious crimes through information sharing. But EU countries have previously been reluctant to cede too much actual policing power to the EU level authority.  Taking control of law enforcement away from EU countries is “out of the scope” of any discussions about strengthening Europol, Ebner said. “We don’t think it’s necessary that Europol should have the power to arrest people and to do house searches. That makes no sense, that [has] no added value,” he said.   Pieter Haeck contributed reporting.

The “anonymous” location data of EU officials in Brussels is up for sale, according to a joint investigation by European media outlets. Three senior officials working for the EU were identified as part of an investigation into phone location data being sold by data brokers. Other phones were located in NATO sites and Belgian military bases. The European Commission has recognized the “worrying conclusions” of the investigation and, as a result, told investigating outlets that it has “issued new guidance to its staff regarding ad tracking settings on business and home devices, and has informed other Union entities.” The investigation was conducted by L’Echo, Le Monde, German public broadcasters (BR / ARD), Netzpolitik.org and BNR nieuwsradio. Journalists posed undercover as employees at a marketing company, and were able to obtain hundreds of millions of location data points from phones in Belgium through data brokers. Data brokers collect and sell aggregated databases of personal information, often gathered from mobile apps or online web trackers. The data is bundled and resold to advertisers, or even law enforcement and governments. Location data is supposed to be anonymous, but it can be used to paint a picture of someone’s daily movements, and combining a few anonymous data points together can lead to re-identifying a person. Investigating publications were able to use the data to figure out surnames, first names and lifestyle habits of at least five people who work or have worked for the EU, three of whom “hold positions of high responsibility.” Two confirmed that the data collected corresponded to their home, workplace and travel. Under the EU’s General Data Protection Regulation (GDPR), it is legal to collect this kind of data from mobile phone users if they consent, but users must be clearly informed about how their data will be used. The Google Play Store and Apple App Store have requirements for apps to disclose the information they gather, but analysis by investigating outlet Netzpolitik has revealed that some apps still gather information such as location data without disclosing this in their policies. A similar undercover investigation by Ireland’s public broadcaster in September spurred Ireland’s Data Protection Commission to suspend the activities of an Irish data broker. The Irish DPC has said it has also identified two data broker companies in other EU member countries, and is engaging with data protection authorities responsible for regulating them.

When voters went to the polls to elect Ireland’s next president, some of them may have been surprised to see Catherine Connolly’s name on the ballot. Just days before, a deepfake video showing the eventual winner withdrawing from the race had circulated, imitating Connolly and multiple journalists within its fake reality. In the Netherlands, two far-right members of parliament were found to be behind a Facebook page promoting deepfake images of their left-wing rival ahead of Sunday’s tight election, prompting apologies and recrimination. This was the week that artificial intelligence hit two European electoral campaigns in a major way and exposed significant gaps in ongoing efforts to curb undue influence on voters. There are concerns about what that means for European politics and for its voters, as politicians and regulators wake up to the arrival of AI-generated text and video content that has been part of U.S. political life for some time. “The normalisation of such practices is worrying,” said Hannes Cools, assistant professor on the human factor in new technologies at the University of Amsterdam. The Dutch election “is one of the first elections in Europe where we see that [the technology] has become an integral part in electoral campaigns in various ways,” said Claes de Vreese, a professor of artificial intelligence and society at the University of Amsterdam. SHOCK JOCK In a study of some 20,000 election-related posts in the Netherlands, researchers from the University of Amsterdam and the University of Mainz found that over 400 posts were AI-generated. The party of far-right leader Geert Wilders, the Party for Freedom (PVV), came out on top in its use of AI. More than a quarter of the AI posts (120 in total) could be traced back to PVV-linked accounts. Wilders kicked off the PVV’s campaign with an AI-generated video depicting a fictional future Netherlands living under Sharia law. Dutch weekly De Groene Amsterdammer reported that the video was made with OpenAI’s video generator Sora.  When asked about the dominance of extremist or fringe parties in the use of AI, researcher Fabio Votta said, “There’s still a normative aspect of using AI.” “For the far-right, a lot of their modus is norm-breaking and shocking. They don’t fear the reputation hit.” Yet Wilders took the rare step on Monday of apologizing to Frans Timmermans, a former European Commission heavyweight and the leader of the GreenLabor-Left ticket, after it emerged through the Dutch press that two PVV members of parliament were behind a Facebook page spreading incendiary, AI-generated depictions of him.  In one of the images, shown by Dutch daily De Volkskrant, Timmermans could be seen being led away by police in handcuffs. In another, he had his hands on a pile of money. The party of far-right leader Geert Wilders, the Party for Freedom, came out on top in its use of AI. | Laurens Van Putten/EPA In Ireland, the fake video that saw Connolly announce her withdrawal from the presidential election was branded by the candidate as a “disgraceful attempt to mislead voters and undermine our democracy.” Through a fake bulletin of Irish national broadcaster RTÉ, the video saw a deepfake version of Connolly declaring: “It is with great regret that I announce the withdrawal of my candidacy and the ending of my campaign,” with deepfake versions of two well-known TV presenters validating the news and discussing the impact. Both Meta and Google-owned YouTube removed the Connolly video from their platforms without specifying how long it had been online. The Irish left-wing independent candidate won the election convincingly with 63 percent of the vote. Depicting fictional events or attacking or discrediting other candidates are only two ways in which AI-generated content is being deployed to sway minds.  Researchers also warn against a third, arguably more direct, method in which AI could influence election outcomes: users asking AI chatbots who to vote for. With a large majority of voters typically undecided until the final days of the election, the Dutch data protection authority on Oct. 21 warned voters not to ask AI chatbots for voting advice, since these give a “highly distorted and polarized image of the Dutch political landscape.”  “Chatbots are full of mistakes,” said de Vreese, adding that “they attribute various party positions to the wrong parties, and they also seem to have a kind of a suction effect” in a specific political direction. An experiment showed that chatbots favored the GreenLeft-Labour ticket for voters on the left, while voters on the right were mainly directed to the far-right PVV.  “People with a low literacy are particularly vulnerable to AI-generated disinformation,” said Cools. DISCLAIMER Regulators in Brussels have made election integrity, AI risks and online disinformation major priorities, a patchwork of ongoing efforts left them watching as the elections played out. As the technology to generate AI content and the platforms to distribute them is mostly U.S.-based, all eyes are on Brussels for a bloc-wide response. The EU’s powerful Digital Services Act puts some responsibility on platforms to tackle risks to elections, and both Meta and Google have recognized generative AI as a major risk factor — likely contributing to their decision to take down the Connolly video. But the requirements are driven mainly by concerns about misinformation, rather than by efforts to regulate how European political parties use generative AI to spread their messages.  Labeling is also a big part of the response, as required by a separate EU law specific to artificial intelligence. Researchers at the University of Amsterdam flagged that a majority of the posts they tracked for the Dutch election lacked an AI-labeling disclaimer. For those who did, it was the platform that added it, not the political parties. More laws that could deal with the matter are on their way. The European Commission is drafting guidance for so-called high-risk AI systems that can pose a risk to people’s fundamental rights, which will enter into force in August 2026 at the earliest. “These guidelines will include a section on AI systems intended to influence election outcomes or referendums,” said Commission spokesperson Thomas Regnier.  Developers of the most complex AI models, such as OpenAI’s GPT or Google’s Gemini, have already had to comply with a series of obligations since August, including mitigating “systemic risks” to democratic processes.  Next month, Brussels will unveil another proposal, meant to support EU countries in upholding the fairness and integrity of election campaigns against foreign manipulation and interference. That is not expected to contain any binding legal requirements. Eliza Gkritsi contributed reporting.

BRUSSELS — The European Commission said it is “not empowered to take action” amid concerns about the appointment of a former tech lobbyist to Ireland’s privacy regulator. The Irish Council for Civil Liberties — a non-profit transparency campaign group — on Tuesday filed a complaint calling on the Commission to launch an inquiry into how Niamh Sweeney was appointed to co-lead the Irish Data Protection Commission. Citing reporting from POLITICO, the complaint alleges the appointment process “lacked procedural safeguards against conflicts of interest and political interference.” It’s the first formal challenge to the decision after Sweeney took up her role as one of three chief regulators at Ireland’s top data regulator this month. Her prior experience as a lobbyist for Facebook and WhatsApp reignited concerns that the regulator is too close to Big Tech. In response to the complaint, Commission spokesperson Guillaume Mercier said that “it is for the member states to appoint members to their respective data protection authorities.” The Commission “is not involved in this process and is not empowered to take action with respect to those appointments,” Mercier told a daily press briefing Tuesday. He emphasized that countries do need to respect requirements set out in EU law — that the appointment process must be “transparent,” and that those appointed should “have the qualifications, the experience, the skills, in particular in the protection of personal data, required to perform their duties and to exercise their powers.” The complaint asked the Commission to look into the appointment as part of its duties to oversee the application of EU law, claiming these responsibilities had not been met by Ireland. Sweeney was appointed by the Irish government on the advice of the Public Appointments Service, the authority that provides recruitment services for public jobs, which has previously expressed its full confidence in the process.