Eduardo Ustaran

@eustaran.bsky.social

Privacy, data protection and digital regulation lawyer, pragmatic thinker and author

Among the 166 pages of the UK Government Budget 2026, there are some visible clues of what matters from a digital regulation perspective. Some thoughts on what the proposed AI investment, digital sovereignty measures and cybersecurity focus signal. Mini-🧵

Bild

As a runner, I don’t interpret “pacing” as slowing down even if pacing oneself correctly means going more slowly than one could possibly run. As every marathon runner knows, getting the pace right is probably the single most important aspect of a successful outcome. The same principle applies to AI.

BildBild

Doing some domestic filing, I came across this article I wrote as a newly qualified lawyer in June 1996 for the internal newsletter of the first law firm I worked for. Aside from being a blast from the past, the similarities with how we approach the use of AI at law firms today are pretty striking.

Bild

Data protection is not just about compliance. It is also about demonstrating compliance, and this is particularly important for regulatory investigations, we hear at #IAPPIntensive26. Transparency is therefore key alongside the ability to maintain confidentiality.

Bild

Not getting the wider strategy right when faced with a regulatory investigation is regarded as the most critical mistake. It sounds obvious but when operating in crisis mode, having the space to think is lacking precisely when it is most important. Wise views at #IAPPIntensive26.

Bild

On a fleeting visit to San Francisco, local companies are very keen to know how far the European digital regulatory simplification will go. You could call that part of the “Brussels Effect”.

Bild

A few reflections on AI Governance.👇 A very common pattern I keep seeing is businesses feeling under pressure to implement AI tools and those with responsibility for AI governance becoming sidelined by those businesses for fear that they will slow things down. We need to change this dynamic.

Bild

One of the ways in which the UK is expected to specifically regulate #AI is in relation to live facial recognition for law enforcement purposes. Not a bad idea given the level of privacy intrusiveness, but very unlikely to become a “prohibited AI practice” as in the EU.

BildBild