How the Medical Device Regulations will impact manufacturers’ processing of personal data
Find out more
Information Commissioner v Clearview AI Inc: UK GDPR applies to overseas provider of facial recognition tech
Find out more
Neural Network - November 2025
In this edition of the Neural Network, we look at key AI developments from October and November.
In regulatory developments, the European Commission (“Commission”) has proposed a pause in the application of the EU Artificial Intelligence Act (“AI Act”), following mounting pressure from tech companies. The Commission has also issued guidance on the interplay between the AI Act and Cyber Resilience Act and has commenced investigations into companies combining customer data with AI services.
In AI enforcement and litigation news, Universal Music Group and Udio have settled copyright infringement claims and announced an AI music platform and ChatGPT faces claims in the United States for author infringement. More details on each of these developments is set out below.
Regulatory and Government updates
- Commission proposes to pause AI Act amid tech company pressure
- Commission to launch guidance on AI Act and Cyber Resilience Act interplay
- Commission launches investigations into companies combining data for AI services
Enforcement and Civil Litigation
- Universal Music Group and Udio settle copyright infringement claims and announce AI music platform
- ChatGPT faces claims in the United States for author infringement
Regulatory and Government Updates
Commission proposes to pause AI Act and changes to GDPR to facilitate AI data use, amid pressure
The Commission has proposed a pause and simplification to provisions in the AI Act, in response to mounting pressure, including from technology companies and the US government.
The Commission’s reported proposed changes include offering a one-year “grace period” for companies that have already placed certain AI systems onto the market, giving them more time to adapt to the AI Act’s onerous high-risk AI provisions. Additionally, the Commission is considering delaying the imposition of fines for violations of new AI transparency rules until August 2027.
The potential proposal also aims to reduce compliance burdens for companies and centralise enforcement through a dedicated EU AI office. Major tech firms, such as Meta, have warned that overly strict regulations could isolate Europe from the latest AI innovations.
The detail of the proposed changes is planned to be presented as part of a draft “digital simplification” package, and any changes to law would need to be approved by EU Member States and the European Parliament.
A leaked version of the proposals also included amendments to the GDPR to facilitate the use of personal data for the “development and operation” of AI Systems, in reliance on the “legitimate interests” lawful ground. The leaked version even proposed to permit special category data to be used for AI systems’ development and operation, subject to safeguards.
It remains to be seen whether these proposals will be carried through to the detailed omnibus package when it is published, which is scheduled for 19 November.
Commission to launch guidance on EU AI Act and Cyber Resilience Act interplay
The Commission is preparing to issue guidance clarifying how the AI Act interacts with the Cyber Resilience Act (“CRA”) for connected devices. To facilitate this guidance, the CRA expert group and a working group of the European AI Board will collaborate.
The CRA already confirms that connected devices featuring embedded high-risk AI systems will be considered to have met the AI Act’s requirements if they comply with the requirements in the CRA (thereby avoiding potentially duplicative regulation).
The further guidance is likely to address more practical issues, such as how the conformity assessment procedures under both laws will work together, and how authorities will monitor and enforce compliance with their respective obligations.
The first meeting between the CRA experts and the working group is scheduled for 26 November. Participants have been invited to provide input through an online questionnaire, including practical use cases and questions for clarification.
Commission launches investigations into companies combining data for AI services
The Commission has increased scrutiny of tech giants as they roll out AI-driven services, issuing questionnaires to firms including Apple, Microsoft, Google, TikTok, Amazon and Meta on how they handle user data across platforms under the Digital Markets Act (“DMA”). The review focuses on compliance with the DMA’s ban on combining personal data from core services with other services without explicit user consent. It also asks for details on when consent prompts are served, opt-in and refusal rates, deferral options, and the frequency and wording of warnings that certain functions may not work without consent.
With AI features increasingly integrated into existing products and reliant on pooled data, the Commission’s enquiries signal that companies must carefully consider data practices to ensure DMA compliance as they scale new tools across the EU.
Enforcement and Civil Litigation
Universal Music Group and Udio settle copyright infringement claims and announce AI music platform
On 29 October 2025, Universal Music Group (“UMG”) and AI music company, Udio, reached a landmark settlement, ending their copyright infringement litigation in the United States. They also announced an agreement for a new, licensed AI-powered music platform set to launch in 2026. The agreement marks the first licensing deal of its kind in the music industry, enabling Udio to train its AI on authorised and licensed music.
This move follows lawsuits filed by UMG, Sony Music Entertainment, and Warner Music in June 2024, which alleged that generative AI platforms Udio and Suno used copyrighted material without consent. While the Suno litigation remains ongoing, UMG and Warner Music Group are reportedly finalising licensing agreements with, amongst others, Suno and Stability AI.
ChatGPT faces claims in the United States for author infringement
On 27 October 2025, OpenAI's motion to dismiss claims in the United States by book authors, who alleged that AI-generated outputs infringed their copyright due to substantial similarity, was denied.
In April 2025, the Judicial Panel of Multidistrict Litigation consolidated twelve cases against Open AI and Microsoft. These cases involve allegations of copyright infringement that stem from the downloading and reproduction of original works, and use of the plaintiffs’ material to train OpenAI’s LLM’s. This judgment for dismissal only focused on the copyright allegations pertaining to the AI-generated outputs and not the other allegations that form part of this class action.
The judge held that whilst not replicating the plaintiff’s work in the outputs, the ChatGPT summaries “are most certainly attempts at abridgment or condensation of some central copyrightable elements of the original works”, noting that the AI generated outputs were able to convey the overall feel and tone of original writing, including the plot and characters.
The litigation follows recent landmark decisions in the United Kingdom and Germany on copyright and AI training; with the High Court considering a claim between Getty Images and Stability AI [2025] EWHC 2863 (Ch) for copyright infringement in the context of Stability AI’s Stable Diffusion model (refer to our July update: Neural Network - July 2025) and GEMA bringing an action before the Munich Regional Court in GEMA v OpenAI (case no. 42 O 14139/24), alleging that the company had used protected song lyrics when training its LLMs without obtaining a licence (refer to our October update: Neural network - October 2025). Our thoughts on the judgments in both of these cases, which were handed down at the beginning of this month, will follow in due course.