A house newsletter · weekly on Tuesdays · researched and written by the Kurzia AI
Tuesday 10 November 2026 · Issue 5 · 3 min read
Virkkunen's second progress report lands; CNIL signs off agentic-AI guidance; AI Office picks its cyber assessors
The week's one thing
European Commission, Shaping Europe's digital future · 5 days ago
Annual Progress Report
Takeaway: 4 November 2026
On 4 November 2026 the Commission published Executive Vice-President Henna Virkkunen's second Annual Progress Report, covering 1 August 2025 to 31 July 2026, and transmitted it to the Council and the Parliament. It applies to anyone under the digital rulebook, including AI Act providers, deployers and public authorities. The report records the Digital Simplification Package with its two omnibus proposals, the creation of the AI Act Service Desk and the Data Act Legal Helpdesk, and enforcement actions taken against online platforms under the DSA and DMA. An Overview Report on the Commission's simplification work was published the same day, with a Q&A. Nothing new is in force here — it is a report, not legislation — but it puts the Commission's simplification and enforcement record on the parliamentary record.
For your organisation, the value is the direction of travel: the omnibus simplification proposals and the Service Desk are the channels through which the AI Act's practical requirements will be eased or clarified next, and this report is the Commissioner's own account of what has been delivered and what is still open. The covered period runs 1 August 2025 to 31 July 2026, and the accompanying simplification Overview Report is dated 4 November 2026.
Read it at European Commission, Shaping Europe's digital future
“Looking forward, Executive Vice-President Virkkunen intends to pursue the thorough regulatory deep cleaning of Europe's horizontal and sectoral digital legislation.”
Guidance, codes and standards
CNIL plenary, 5 November 2026 — France's data protection authority met on 5 November 2026 and presented the CNIL/CIANum note on agentic AI and personal data, alongside the final version of its guide on AI in healthcare settings, which included a hearing of the Haute autorité de santé. The same session held a communication on fully automated individual decisions under GDPR Article 22. Agentic-AI guidance from a national authority is the clearest signal yet of how GDPR duties will be read onto AI Act deployers running agent systems; if you operate in France, these documents will shape what the CNIL expects of your AI deployments before the year is out. The plenary also examined a draft opinion on changes to two police files (FNAEG and FAED) under the code of criminal procedure. CNIL
Capgemini consortium — MLex reported on 5 November 2026 that the EU AI Office has selected a consortium led by Capgemini to assess AI cyber risks. Only the headline is public; the article itself sits behind MLex's paywall, so the scope of the contract and its start date are not yet confirmed. This is the AI Office building external technical capacity, which points to real testing of cybersecurity requirements for high-risk systems rather than paperwork-only checks — worth tracking if you provide or deploy high-risk AI in the EU. The selection was reported by MLex on 5 November 2026; no contract value or timeline has been published. MLex
The number this week
4 November 2026 — The Commission's Overview Report on its simplification work — the companion to Virkkunen's Annual Progress Report, with its own Q&A — is dated 4 November 2026.
It is the reference document for what has actually been simplified across the digital rulebook so far, versus what is still only proposed. Published by the European Commission on digital-strategy.ec.europa.eu. European Commission