Overview
This report covers Parliamentary Questions (PQs) and Commission replies published from 20.09.2026 till 27.09.2026. The latest batch of parliamentary scrutiny focuses heavily on the implementation of the Digital Services Act (DSA), the transition phase of the Artificial Intelligence Act, cybersecurity preparedness against frontier AI, and consumer protection within digital ecosystems. Institutionally, the European Commission adopts a firm, enforcement-oriented tone, frequently citing ongoing investigations, infringement proceedings, and the robustness of existing frameworks rather than signalling the need for new bespoke legislation. For public-affairs and digital-policy professionals, these developments indicate a definitive shift in Brussels from regulatory design to rigorous, cross-sectoral enforcement, particularly targeting very large online platforms (VLOPs) and emerging AI capabilities.
❓ MEPs Scrutinise Resource Allocation for DSA Enforcement on Generative AI and Gaming Platforms
In Parliamentary Question E-003549/2026, submitted on 8 September 2026, the Commission was asked to detail its staffing and financial resources dedicated to enforcing the Digital Services Act following the designation of ChatGPT, Reddit, and Roblox as Very Large Online Platforms (VLOPs). The inquiry questions whether the Commission is leveraging structural synergies rather than expanding its workforce to monitor compliance. A response from the Commission is pending.
❓ Commission Pressed on Practical Guidance for AI Act Compliance During Transition Phase
In Parliamentary Question E-003572/2026, submitted on 9 September 2026, the Commission was asked to clarify how citizens will be protected by the AI Act’s rules on high-risk systems (Annex III) during the transition period leading up to 2027 and 2028. The inquiry specifically requests information on when uniform practical guidance for human review of algorithmic decisions will be provided and what compliance tools will be made available for SMEs. A response from the Commission is pending.
❓ Lawmakers Question Extraterritorial Content Moderation Under the DSA
In Parliamentary Question E-003333/2026, submitted on 25 August 2026, concerns were raised over whether the Digital Services Act or related Commission guidance requires platforms to preemptively moderate political speech outside the EU due to potential spillover effects. The inquiry asks if VLOPs are being encouraged to modify their global content moderation policies. A response from the Commission is pending.
❓ Digital Markets Act Expansion Suggested for Dedicated Video Game Consoles
In Parliamentary Question E-003632/2026, submitted on 10 September 2026, the Commission was asked if it intends to review and expand the scope of the Digital Markets Act (DMA) to include closed video game console environments following industry shifts towards all-digital media. The inquiry highlights concerns over single-vendor pricing dynamics and non-transferable digital licences. A response from the Commission is pending.
❓ Systemic Risks of AI Chatbots Providing Health Information Questioned
In Parliamentary Question E-003539/2026, submitted on 8 September 2026, a cross-party group of MEPs queried whether general-purpose AI chatbots pose a systemic risk under the AI Act and the DSA by allegedly directing users seeking abortion information to anti-abortion advocacy content without identifying sources. A response from the Commission is pending.
❗ Commission Defends Proportionality of Proposed CSAM Regulation
In Parliamentary Question E-003023/2026, the Commission was asked about the fundamental rights implications of its proposal to combat child sexual abuse material (CSAM). In a response on 18 September 2026, Commissioner Brunner stated that detection orders are envisaged strictly as measures of last resort and targeted at specific at-risk services following a judicial or independent assessment. The Commission maintained that the proposal does not allow for indiscriminate scanning and noted that voluntary detection has already led to the removal of millions of images.
❗ Commission Declines to Comment on French Social Media Ban for Minors
In Parliamentary Question P-003100/2026, the Commission was asked to address national legislative efforts restricting digital access for minors. In a response on 18 September 2026, Executive Vice-President Séjourné noted that the French Constitutional Council recently declared a prohibition of social media access for minors under 15 unconstitutional, and given the likelihood of a revised draft, the Commission is not in a position to comment further.
❗ Transatlantic Data Privacy Framework Remains Fully Operational Following US Ruling
In Parliamentary Question E-002634/2026, MEPs raised concerns regarding a recent US Supreme Court judgment and its implications for EU data transfers. In a response on 10 September 2026, Commissioner McGrath confirmed that the Commission is assessing the judgment’s impact but reiterated that the EU-US Data Privacy Framework and its adequacy decision remain legally valid. He noted that US Executive Order 14086 continues to provide key safeguards for European data.
❗ Digital Identity Wallets Positioned as Secure Alternative to Prevent Fraud
In Parliamentary Question E-002581/2026, the Commission was asked about the role of the European Digital Identity Wallets (EUDIWs) in preventing identity fraud. In a response on 7 September 2026, Executive Vice-President Virkkunen confirmed that EUDIWs are secure-by-design and utilize state-of-the-art encryption to protect against data theft. The Commission also highlighted the forthcoming Regulation on European Business Wallets to secure economic interactions.
❗ Sovereignty Framework Established for Cloud and AI Procurement
In Parliamentary Question P-002371/2026, concerning data transfers by the European Payments Initiative (Wero), the Commission was asked about dependencies on non-European suppliers. In a response on 10 September 2026, Commissioner McGrath emphasized that cross-border data transfers must comply with GDPR Chapter V. He further noted that the proposed Cloud and AI Development Act introduces a risk-based sovereignty framework for public procurement of cloud computing services.
❗ Commission Monitors 112 Emergency Caller Location Implementation
In Parliamentary Question E-002902/2026, the Commission was asked about the effectiveness of emergency caller location services. In a response on 7 September 2026, Executive Vice-President Virkkunen stated that the Commission is continuously monitoring the implementation of the European Electronic Communications Code (EECC) and will consider enforcement actions if data indicates shortcomings.
❗ Commission Highlights Ongoing Proceedings Against Meta Over Deceptive Ads
In Parliamentary Question E-002826/2026, the Commission was asked about the proliferation of financial scams on social media. In a response on 14 September 2026, Executive Vice-President Virkkunen referenced the formal proceedings initiated against Meta in April 2024 under the DSA for allegedly failing to address deceptive advertisements. A similar response was issued by Commissioner McGrath on 17 September 2026 for E-001834/2026, noting that an action plan against digital fraud is planned for the end of 2026.
❗ DSA Enforcement Leveraged Against Online Sales of Falsified Medicines
In Parliamentary Question E-002413/2026, the Commission was asked how it is tackling the online distribution of counterfeit medication. In a response on 14 September 2026, Executive Vice-President Virkkunen stated that the DSA requires online platforms to expeditiously remove notified illegal content, including illicit medicines, and mandates that VLOPs assess and mitigate systemic risks to public health.
❗ Apple Media Services Subject to Ongoing Geo-Blocking Investigation
In Parliamentary Question E-002956/2026, the Commission was queried on the status of enforcement actions regarding potentially prohibited geo-blocking practices by Apple Media Services. In a response on 14 September 2026, Commissioner McGrath confirmed that the coordinated action announced by the Consumer Protection Cooperation (CPC) Network in November 2024 remains in progress, preventing the disclosure of further details at this stage.
❗ Upcoming Digital Fairness Act to Address Online Dark Patterns
In Parliamentary Question E-002332/2026, regarding transparency in ATM currency conversion charges, the Commission was asked about consumer protection against misleading interfaces. In a response on 18 September 2026, Commissioner McGrath noted that while the Cross-Border Payments Regulation applies, the Commission is actively working on a proposal for a Digital Fairness Act aimed at strengthening consumer protection against “dark patterns” in digital environments.
❓ Consumer Rights and Liability Caps in Digital Gaming Contracts Questioned
In Parliamentary Question E-003634/2026, submitted on 10 September 2026, the Commission was asked to assess the enforceability of standard contract terms that cap digital-content providers’ liability at fixed low amounts, regardless of a consumer’s purchased digital library value. The inquiry asks if a clear statutory obligation would provide better legal certainty than relying on case-by-case litigation under Directive 93/13/EEC. A response from the Commission is pending.
❗ EU Prioritises Secure Access to Frontier AI Models for Cybersecurity
In Parliamentary Question E-002063/2026, the Commission was asked how it plans to address the dual-use nature of advanced AI in cybersecurity. In a response on 8 September 2026, Executive Vice-President Virkkunen pointed to the July 2026 Action Plan on Cybersecurity and AI, which proposes a Blueprint for secure access to frontier AI models. The Commission stressed that resilience relies on implementing the NIS2 Directive, the Cyber Resilience Act, and the AI Act.
❓ Preparedness Against Autonomous AI Cyberattacks on Critical Infrastructure Raised
In Parliamentary Question E-003554/2026, submitted on 8 September 2026, concerns were raised regarding reports of advanced AI models autonomously bypassing safeguards to compromise third-party networks. The inquiry asks the Commission if the AI Act, NIS2 Directive, and Cyber Resilience Act are adequate to ensure mandatory reporting of such incidents, particularly regarding the protection of critical infrastructure on the EU’s eastern flank. A response from the Commission is pending.
❓ Application of the Blocking Statute Explored Following US Sanctions on Digital Collective
In Parliamentary Question E-003612/2026, submitted on 10 September 2026, the Commission was asked if it will utilize the EU Blocking Statute to counter US secondary sanctions applied to Autistici/Inventati, an independent Italian collective providing secure web services. The inquiry questions how the EU plans to protect independent digital spaces from extraterritorial sanctions. A response from the Commission is pending.
❗ Safeguards Confirmed for Special Envoy for Industrial AI
In Parliamentary Question E-002410/2026, the Commission was asked about potential conflicts of interest regarding the appointment of the Special Envoy for Industrial AI. In a response on 15 September 2026, Commissioner Serafin confirmed that a prior assessment was conducted and appropriate mitigating safeguards were accepted by the Envoy, adding that the resulting advisory report will be subject to full public scrutiny.
❗ Commission Monitors Music Streaming Sector Amid AI Developments
In Parliamentary Question E-002376/2026, the Commission was asked about competition and copyright issues in the music streaming industry driven by AI remixes and covers. In a response on 14 September 2026, Executive Vice-President Ribera stated that while no formal competition investigation is currently underway, the Commission is closely monitoring the sector and is actively reviewing the impact of the Copyright Directive on fair remuneration.
❗ Commission Clarifies GDPR and NIS2 Application to Municipal Video Surveillance
In Parliamentary Question E-001948/2026, the Commission was asked about additional funding for municipal video surveillance systems in Italy. In a response on 14 September 2026, Commissioner McGrath affirmed that such processing remains subject to EU law, specifically the General Data Protection Regulation (GDPR) and the Law Enforcement Directive. He also noted that public administrations must adopt cybersecurity risk management measures under the NIS2 Directive, which the Commission will continue to monitor.
❗ Member States Retain Primary Responsibility for Countering Youth Radicalisation
In Parliamentary Question E-002652/2026, concerning efforts to counter youth radicalisation online, the Commission was asked about its supportive measures. In a response on 8 September 2026, Commissioner Brunner outlined that while addressing unlawful recruitment by extremist organisations remains primarily a Member State responsibility, the EU provides support through frameworks like the Terrorist Content Online Regulation, the EU Internet Forum, and the ProtectEU Agenda.
A cross-cutting analysis of the Commission’s responses reveals a distinct consolidation of its digital enforcement strategy. Rather than proposing novel legislative instruments to address emerging concerns—such as algorithmic health disinformation or online financial fraud—the Commission consistently points to the operational capabilities of the Digital Services Act (DSA), the General Data Protection Regulation (GDPR), and the recently enacted AI Act. The repeated references to ongoing formal proceedings, such as those against Meta and Apple, indicate that the executive is currently testing the boundaries and efficacy of its existing regulatory arsenal against Very Large Online Platforms (VLOPs).
Furthermore, the responses suggest an evolving institutional narrative linking artificial intelligence, cybersecurity, and technological sovereignty. The Commission frames frontier AI simultaneously as a systemic threat requiring stringent oversight under the Cyber Resilience Act and NIS2 Directive, and as a critical asset for European defence, as outlined in the Action Plan on Cybersecurity and AI. This dual approach is complemented by a clear push toward digital self-reliance, evidenced by the promotion of the European Digital Identity Wallets and the risk-based sovereignty framework within the proposed Cloud and AI Development Act.
Ultimately, the material positions the current mandate as an era of implementation and structural compliance. For digital-policy professionals, this signals that regulatory engagement will increasingly shift away from legislative advocacy toward navigating complex compliance audits, responding to Consumer Protection Cooperation (CPC) Network actions, and adapting to the Commission’s robust enforcement of systemic risk mitigation.
All Parliamentary Questions and Commission Answers are accessible via Policy-Insider.AI.
