Tech Policy & Regulation Weekly — Jul 15, 2026

This was a week about enforcement machinery grinding from theory into consequence. Europe's top court made Google's €4.1 billion Android fine permanent — and in the same stroke handed rivals a pre-approved license to sue. The FTC drew a line under AI marketing, signaling that hyping a chatbot's reliability can be deception, not just optimism. And Washington rebuilt its two biggest procurement-security frameworks in the same fortnight. None of these are shock announcements; they're the sound of existing rules starting to bite, which is exactly the moment compliance teams stop reading and start rewriting.

The number that matters here isn't the fine — it's what the fine unlocks.

On July 2, the European Court of Justice dismissed Google and Alphabet's final appeal in Case C‑738/22 P, making the €4.1 billion Android antitrust fine permanent. The underlying 2018 European Commission decision found that Google abused its market dominance by requiring device makers to pre-install Google Search and Chrome as a condition of licensing the Play Store. That question is now settled — Google has no further right to appeal. (The $4.7 Billion Judgment That Never Ends)

What changes: the ruling activates the EU Antitrust Damages Directive, which means any competitor that lost business because of those pre-installation deals can now sue Google in civil court across 13 European Economic Area countries without re-litigating whether the conduct was illegal, according to Tech Times. The illegality is settled fact. The only open question in each suit is how much the plaintiff lost. That transforms a one-time fine into an open-ended liability tail. (EU Court Seals €4.1B Google Android Fine, Triggering Damages Threat for Rivals)

What to watch: whether follow-on plaintiffs actually file, and how courts calculate damages when the anticompetitive conduct is nearly a decade old. There's a second front too — Google faces a separate Digital Markets Act penalty for alleged search self-preferencing, described by Tech Times as potentially the largest ever under the DMA, expected before August. If that lands, the enforcement ceiling for every other gatekeeper moves with it. (Google loses legal fight over 4.1 billion-euro EU antitrust fine)

If your product team treats chatbot mistakes as an annoying-but-manageable bug, the FTC is trying to move that conversation into legal territory. (The FTC just told AI companies that “close enough” may count as deception)

On July 7, the FTC published a proposed policy statement arguing that Section 5 of the FTC Act — the core federal ban on deceptive business practices — can reach companies that market AI systems in ways that suppress, distort, or misrepresent accuracy. The comment window runs through July 31. (The FTC just told AI companies that “close enough” may count as deception)

What changes if this sticks: the theory isn't "the model got something wrong." It's that companies may design, tune, or market systems to create a false impression of reliability for users making real decisions. Sell AI as a dependable assistant while quietly shaping outputs in ways users wouldn't expect, and the agency is signaling that looks like deception, not weak product quality. That lands directly in product claims, sales scripts, benchmark marketing, and enterprise contracts. (The FTC just told AI companies that “close enough” may count as deception)

What failure looks like: the statement gets watered down in comments into a narrow anti-marketing measure with no teeth. The signal to watch is whether the final version stays confined to deceptive advertising or expands into a broader AI-governance playbook the agency can deploy across sectors. The fastest internal check in the meantime: does what you publicly promise about accuracy and fit-for-purpose actually match how your model behaves in production? (The FTC just told AI companies that “close enough” may count as deception)

If your company sells cloud services to the U.S. federal government, the framework you've been operating under just changed underneath you. (FedRAMP Gets a Full Rebuild — and Government Cloud Vendors Have 18 Months to Ada)

On June 25, FedRAMP — the security certification cloud vendors must hold before agencies can buy their products — launched its Consolidated Rules for 2026. The old program had accumulated years of layered, notoriously tangled guidance. The rebuild streamlines the authorization path while adding new requirements around continuous monitoring, supply chain security, and AI-integrated services — that last category newly urgent given how many platforms now bundle AI features by default. (FedRAMP Gets a Full Rebuild — and Government Cloud Vendors Have 18 Months to Ada)

What changes: vendors authorized under the old framework will need to assess whether existing authorizations remain valid or require re-evaluation under the consolidated structure. The transition window runs through late 2027, but agencies are already referencing the new rules in procurement language — which means the practical deadline is whenever your next RFP lands, not the formal cutoff. (FedRAMP Gets a Full Rebuild — and Government Cloud Vendors Have 18 Months to Ada)

What to watch: whether the streamlined process actually accelerates authorizations or just relabels the bottleneck. If your compliance team hasn't mapped the delta between your current authorization and the new requirements, that's the work to start now. (FedRAMP Gets a Full Rebuild — and Government Cloud Vendors Have 18 Months to Ada)

Federal contractors, this one's for you — and the comment window is open now.

On June 23, the Federal Acquisition Regulatory Council issued proposed rules consolidating scattered supply chain and information security requirements into a new FAR Part 40. The FAR is the rulebook governing how the federal government buys everything, so changes here ripple through every company holding or chasing a federal contract. (The FAR Part 40 Proposal: Supply Chain Security Just Got a Federal Acquisition M)

What changes: the proposal pulls previously fragmented cybersecurity obligations — CMMC (the Cybersecurity Maturity Model Certification), software bill-of-materials requirements, third-party risk provisions — into a single framework. The practical sting is that contractors who considered their cybersecurity compliance settled may find the consolidated structure imposes new documentation, attestation, or third-party assessment obligations they haven't budgeted for. That's especially true for cloud providers and the defense industrial base. (The FAR Part 40 Proposal: Supply Chain Security Just Got a Federal Acquisition M)

What to watch: the comment period is the moment to flag implementation problems that would otherwise become expensive surprises. Once this finalizes, the compliance clock starts and the room for objection closes. (The FAR Part 40 Proposal: Supply Chain Security Just Got a Federal Acquisition M)

A police department walking away from a surveillance contract sounds local. It isn't.

On July 13, the Los Angeles Police Department let its contract with Flock Safety — the dominant license plate reader and surveillance-network vendor used by hundreds of U.S. agencies — expire without renewal, citing, according to TechCrunch, "serious concerns over civil liberties and privacy." Flock runs a nationwide network of fixed cameras logging vehicle movements and sharing data across jurisdictions; the LAPD contract gave it a foothold in the second-largest U.S. city.

What changes: surveillance contracts usually expand quietly and rarely get publicly unwound by the agencies themselves. The LAPD putting its civil-liberties reasoning on the record creates a documented rationale that other city councils and oversight bodies can cite — a template for exit — just as several state legislatures weigh restrictions on license-plate-reader data retention and sharing. (LAPD Drops Flock Safety: What One Surveillance Contract Cancellation Signals)

What to watch: whether other major metro departments follow, and whether Flock's aggressive expansion into HOAs, schools, and private communities draws the same scrutiny. The signal isn't one lapsed contract — it's that procurement risk for surveillance tech just became visible enough to imitate. (LAPD Drops Flock Safety: What One Surveillance Contract Cancellation Signals)

A €4.1 billion fine that mutates into thirteen countries' worth of lawsuits, a Siri that speaks fluent Gemini everywhere except the one continent that asked it to share, and a license-plate camera network that finally met a police department willing to say no on the record. The through-line: this was the week regulators stopped writing rules and started collecting — and somewhere in Delaware, a bill is sitting on a governor's desk waiting to make your chatbot logs even more interesting reading for a prosecutor with a warrant. (LAPD Drops Flock Safety: What One Surveillance Contract Cancellation Signals)

That's the week — go rewrite the outside-counsel guidelines before someone's model does it for you.

Forward this to the compliance lead who still thinks "we'll deal with the DMA next quarter."