Thierry Breton

Rule Changes

Departed European Commission in September 2024

For decades, software companies shipped code with security flaws and faced little legal consequence, but on September 11, 2026, that changes for any product sold in Europe. The Cyber Resilience Act requires manufacturers to report actively exploited vulnerabilities within 24 hours, maintain software bills of materials listing every component in their products, and provide security updates for the product's lifespan.

Updated May 27

Rule Changes

Banned from U.S., called sanctions a 'witch hunt'

On December 23, 2024, Secretary of State Marco Rubio banned five Europeans from entering the United States—including the EU's former top tech regulator and leaders of anti-disinformation groups. The charge: pressuring American tech companies to censor lawful speech. One sanctioned figure, Imran Ahmed, holds a U.S. green card and now faces potential arrest and deportation.

Updated May 16

Rule Changes

Early enforcer who escalated pressure on X over disinformation risks

On December 5, 2025, the European Commission issued its first non‑compliance decision under the Digital Services Act, fining X €120 million for misleading users with paid blue checkmarks, failing to provide a transparent advertising repository, and obstructing researcher access to public data. Regulators concluded the subscription-based 'verified' badge is deceptive because anyone can buy it without meaningful identity checks, and the platform's ad library and data-access rules prevent independent scrutiny of scams, influence operations, and systemic online risks.

Updated May 9