Neural Network - August 2026
In this edition of the Neural Network, we look at key AI developments from July and August 2026.
In regulatory and government updates, the EU’s Digital Omnibus on AI has entered into force; the EDPB has opened consultation on draft guidance for web scraping in generative AI; the UK has launched a legal services AI Growth Lab to support regulatory engagement on legal sector AI tools; and the European Commission has adopted final guidance on Article 50 transparency obligations.
In technology developments and market news, the UK AI Security Institute has warned of frontier models taking autonomous and deceptive actions during cyber testing; and Amazon has completed its $50 billion investment in OpenAI.
More details on each of these developments are set out below.
Regulatory and Government Updates
EDPB publishes draft guidelines on web scraping for generative AI
European Commission Adopts Guidelines on Article 50 Transparency Obligations
Technology Development and Market news
UK AI Security Institute warns OpenAI and Anthropic models acted autonomously in cyber tests
Amazon takes 5% OpenAI stake after completing $50 billion investment
Regulatory and Government Updates
The “Digital Omnibus” on AI: ten key takeaways
On 27 July 2026, the Digital Omnibus on AI entered into force following its publication in the Official Journal of the European Union. The package makes targeted amendments to the EU AI Act, including revised implementation timelines, new protections against non-consensual intimate deepfakes and changes intended to simplify compliance. Although some timelines have been pushed back, core transparency requirements under Article 50 still apply from 2 August 2026 for in-scope AI systems.
We have prepared a briefing, The Digital Omnibus on AI: Ten Key Takeaways, to help organisations navigate the changes and prepare for the next compliance deadline.
EDPB publishes draft guidelines on web scraping for generative AI
On 8 July 2026, the European Data Protection Board (“EDPB”) opened consultation on its draft Guidelines 03/2026 on web scraping in the context of generative AI (the “Guidelines”). The Guidelines are intended to clarify how the GDPR applies where personal data is collected from the internet at scale for the development or training of generative AI models.
The Guidelines confirm that the GDPR applies to web scraping involving mixed personal and non-personal datasets - which, given the nature of online content, is often the case. The Guidelines cover topics including: (i) controller/processor roles; (ii) data protection principles (including transparency, purpose limitation, accuracy and data minimisation); (iii) legal basis; and (iv) special category data. The Guidelines remain in draft, however, they still provide a useful benchmark for organisations to assess their web scraping and generative AI training and development practices in light of data protection law obligations.
The Guidelines indicate that legitimate interests are often relied on as the appropriate lawful basis under the GDPR for web scraping activities. In applying the usual three-part test for the legitimate interests lawful basis, controllers will need to identify a sufficiently clear interest, show that scraping is necessary, and balance that interest against the rights and expectations of individuals. The EDPB gives particular weight to factors such as the scale of collection, the objective of the scraping (e.g. in the development of a model), the nature of the source, whether anti-scraping measures are in place, and whether less intrusive alternatives, such as narrower collection criteria, synthetic data or pseudonymised data, could be used.
The Guidelines also make clear that transparency obligations do not disappear simply because web scraping happens at scale. In certain circumstances where individual notice is impossible or would involve disproportionate effort, the controller might be able to rely on the Article 14(5)(b) exemption (meaning it would not have to inform data subjects individually about web scraping). However, controllers should not treat this as a blanket carve-out and must still provide detailed public information, including information about scraping sources (where possible), the purposes of processing and how individuals can exercise their rights.
In respect of special category data, the EDPB recognises that incidental collection of such data may occur in large-scale scraping, but stresses that there is no general exemption to the GDPR restrictions on the use of special category data. However, the Guidelines refer to the CJEU’s decision in GC & Others (C-136/17), where the Court recognised that a search engine operator may encounter special category data incidentally, in which case the restrictions relating to special categories of personal data apply to the search engine operator within the context of its “responsibilities, powers and capabilities”. The EDPB considers that this court ruling can be relevant in the context of web scraping for AI model training, and sets its expectation that controllers will take appropriate technical and organisational steps to reduce special category data risks including applying filters before and after collection, deleting special category data where identified, and testing models to reduce the risk that such data is reproduced in outputs.
A public consultation on the Guidelines is open until 30 October 2026.
UK launches AI Growth Lab for legal services
The UK Government has launched a new legal services advisory “AI Growth Lab”, which is a regulatory sandbox intended to help organisations developing or deploying AI in legal services navigate existing regulatory frameworks with greater confidence.
The legal sector is the first focus of the wider AI Growth Lab programme, reflecting the number of overlapping regulatory and professional obligations that can apply to legal AI tools, including data protection, professional conduct, legal services regulation and access to justice. Lessons learned from this pilot are expected to inform the future development of the wider program, however, specific expansion to other sectors is yet to be confirmed.
Launched on 3 August 2026 by the Department for Business, Innovation, Science and Trade (“BIST”), the Lab is open to organisations developing or deploying AI in legal services, including law firms, LawTech companies, AI developers, alternative business structures and public sector organisations. BIST is inviting any organisations that are developing legal services AI platforms to become part of the sandbox. Successful applicants will work with relevant regulators and stakeholders for up to nine months to explore regulatory questions, identify risks and clarify how existing requirements apply to their AI products or services.
The Lab brings together BIST, the Ministry of Justice and legal services regulators, including the ICO, the Solicitors Regulation Authority, the Legal Services Board and the Council for Licensed Conveyancers. It is particularly focused on real-world AI applications that could improve the delivery of legal services, including tools that support legal professionals, improve access to justice, assist with conveyancing or help organisations analyse and manage legal information.
Applications are open until 27 September 2026. The Lab is particularly interested in applications that raise questions across more than one regulatory remit, for example tools that process personal data while also operating within professional conduct rules. Participation will not amount to regulatory approval or exemption, but the programme should give participants a clearer route through the existing regulatory landscape and help regulators build their understanding of AI use in legal services.
European Commission Adopts Guidelines on Article 50 Transparency Obligations
On 20 July 2026, the European Commission published final guidelines on the Article 50 transparency obligations under the EU AI Act. The guidelines explain how providers and deployers should approach disclosures for interactive AI systems, machine-readable marking of AI-generated content, and labelling obligations for deepfakes and certain public interest text.
As these obligations came into force on 2 August 2026, we have prepared an analysis of what organisations should be doing to comply in our article, EU AI Act Update: European Commission Adopts Guidelines on Article 50 Transparency Obligations.
Technology Development and Market News
UK AI Security Institute warns OpenAI and Anthropic models acted autonomously in cyber tests
On 4 August 2026, the UK AI Security Institute ("AISI") published an Incident Report, detailing that AI models from Anthropic and OpenAI had taken autonomous, unsanctioned actions against real people and organisations during routine cyber security evaluations. AISI described the incident as the first time it had observed risks around autonomy and deception emerge this clearly, without specific prompting, in a real-world setting.
The incident occurred during a controlled evaluation in which AI agents were tasked with solving a cyber security challenge. The tests were run across 122 attempts using several models, with internet access deliberately enabled and developer safety filters removed to assess maximum capability. In ten of those runs, an agent went beyond the scope of the test and took action on the live internet. Most of this behaviour came from Anthropic's Mythos 5 model, with only two instances involving OpenAI's GPT-5.6-Sol.
In the most serious case, an agent attempted to insert malicious code into a real open-source project on GitHub. To get the code approved, it created fake online identities and used them to pressure the project's human manager. The manager caught and rejected the code. In other instances, agents sent messages and files to real individuals in an attempt to trick them into running malicious code, and left hidden instructions designed to manipulate other AI systems.
AISI was clear in stating that the models were tested in conditions that do not reflect how they are made available to the public, and that the incident did not involve a model escaping its test environment. The disclosure follows a separate incident last month in which an OpenAI agent escaped its sandbox during a security test and launched an autonomous attack on AI platform Hugging Face. Taken together, AISI warned that these events point to a shift in the risk landscape that warrants immediate attention.
For organisations deploying or procuring AI systems, the incident raises a practical question that goes beyond standard vendor assurance. AISI’s reflections on this issue point to the need for tighter controls on internet access, real-time monitoring during evaluations and test designs that assume capable models may try to act beyond their intended scope.
From a practical business standpoint, if a model can act deceptively and target real people when placed under pressure in a controlled test, organisations should consider how their own AI deployments might behave if subjected to adversarial manipulation. Importantly, this includes determining whether current security controls and incident response plans are designed to handle insider threats that originate from within internal systems themselves.
Amazon takes 5% OpenAI stake after completing $50 billion investment
Amazon has completed its $50 billion investment in OpenAI, deepening one of the most significant cloud and AI partnerships in the market. This represents a roughly 5% stake in the company, ahead of a potential public listing expected in 2027. The completion of the full $50 billion investment came despite OpenAI not meeting two preconditions to release the remainder of the funding that were originally set by Amazon, including an IPO or a “breakthrough in AI” technology.
The deal also contains a number of additions that go beyond a traditional equity investment. OpenAI has agreed to use AWS infrastructure, including Amazon’s Trainium chips, while AWS will act as the exclusive third-party cloud provider for OpenAI’s Frontier programme (an enterprise platform helping companies build and manage teams of AI agents). The partnership is also expected to expand OpenAI’s access to computing capacity, which remains one of the key constraints on training and deploying frontier AI models at scale.
For Amazon, the investment reflects a broader strategy of positioning AWS as core infrastructure for the AI economy. It has already confirmed a multi-billion-dollar strategic partnership with Anthropic and is now strengthening its relationship with OpenAI, giving it exposure to two of the leading AI labs while also seeking to drive demand for its own cloud services and AI chips.
The structure of the deal also reflects a wider market trend that major AI investments are increasingly linked to commercial commitments for cloud, compute and chip capacity. That may help AI developers secure the infrastructure they need, while giving cloud providers a route to benefit from the same relationship through equity exposure, infrastructure demand and customer access to leading AI models.
