Alston & Bird Privacy, Cyber & Data Strategy Blog

CMMC Phase II is Suspended, but Defense Contractors’ Cybersecurity Obligations are Not

By , , and

The Department of Defense (“DOD”) has announced the immediate suspension of the Cybersecurity Maturity Model Certification (CMMC) Phase II requirements, which were scheduled to take effect on November 10, 2026. This announcement is significant because, as we noted in our prior advisory, Phase II was expected to move CMMC toward more formal assessment requirements for many defense contractors and subcontractors. But the suspension of Phase II should not be read as a suspension of defense … [Read more] about CMMC Phase II is Suspended, but Defense Contractors’ Cybersecurity Obligations are Not

EU Regulators Outline GDPR Requirements for AI Web Scraping

By , and

On July 8, 2026, the European Data Protection Board (“EDPB”), the body that coordinates the EU’s national data protection authorities, published its first draft of Guidelines 03/2026 on web scraping in the context of generative AI (the “Guidelines”). … [Read more] about EU Regulators Outline GDPR Requirements for AI Web Scraping

The White House’s Gold Eagle Initiative Signals a New Phase in AI Enabled Cyber Defense

By and

The White House has launched “Gold Eagle,” a new cybersecurity vulnerability coordination clearinghouse designed to use advanced AI capabilities to accelerate how the government and industry identify, prioritize, verify, and remediate software … [Read more] about The White House’s Gold Eagle Initiative Signals a New Phase in AI Enabled Cyber Defense

DROP Is Coming Due: What California’s Delete Act Means for Data Brokers in August

By

Beginning August 1, 2026, data brokers must begin accessing California’s Delete Request and Opt-Out Platform (“DROP”) at least once every 45 days to retrieve and process consumer deletion requests, as the consumer-facing launch transitions to … [Read more] about DROP Is Coming Due: What California’s Delete Act Means for Data Brokers in August

GSA Seeks Input on Revised AI Data Safeguarding Clause for Government Contracts

By and

On July 14, 2026, the General Services Administration (“GSA”) held a public listening session to gather stakeholder feedback on a revised draft General Services Administration Acquisition Regulation (“GSAR”) clause addressing the basic safeguarding … [Read more] about GSA Seeks Input on Revised AI Data Safeguarding Clause for Government Contracts