What changes for the people who publish documents: accessibility rules for PDFs, e-invoicing and Peppol, privacy and redaction, and local AI that works on documents without uploading them. Every link below was opened before it was published; headlines are copied as printed by the source.
28 stories
Privacy13 Oct 2026 • European Data Protection Board (EDPB)
During its October plenary the EDPB adopted a statement on smart glasses and published the report 'The connected gaze. Video recording, surveillance and administering evidence in the age of smart glasses'; the statement gives preliminary guidance to users, manufacturers and service providers, notes that users become data controllers when they share recordings or use the glasses professionally, that producers and providers cannot transfer their own obligations to users, and that risks are greater in sensitive environments such as hospitals, schools and workplaces and for children.
Why it matters: Privacy officers should expect questions about camera-equipped wearables at work and in public-facing services, and should decide whether house rules need to address them.
Local AI12 Oct 2026 • paperless-ngx (GitHub release)
Paperless-ngx v3.3.1 is a bug-fix release of the self-hosted, open-source document management system; the fixes include using a root document's effective content for the LLM index, indexing and authorising document versions by their root document, and clearer error messages for invalid JSON.
Why it matters: Teams running a local document archive with the LLM index or with document versions should install this release to fix indexing and permission behaviour.
Accessibility9 Oct 2026 • veraPDF project (GitHub release)
Release 1.30.3 of the veraPDF PDF/UA validation library fixes security issues: excessive resource consumption when recursively validating nested embedded files, an XML parser configuration that prevented security settings from applying, and a potential excessive memory allocation when parsing CFF font INDEX structures with corrupted data sizes.
Why it matters: Anyone who validates PDFs against PDF/UA should update veraPDF, because these are security fixes in the validator itself.
Since 8 October 2026 the number 0 806 807 807 is the national telephone helpline for companies, served by 14 professional contact centres; before that date the number was dedicated to electronic invoicing assistance, and e-invoicing assistance is maintained through a dedicated option in the number's voice menu.
Why it matters: Companies and their accountants in France now have one phone channel for tax questions, with e-invoicing support kept as a menu option during the mandate's roll-out.
Privacy9 Oct 2026 • Autoriteit Persoonsgegevens (AP)
The Dutch DPA is preparing for AI supervision with a new directorate, Toezicht en Coördinatie AI/Algoritmes (TCA), which continues the coordinating supervision of AI and algorithms the AP has carried out since 2023 and prepares AI market supervision together with the Rijksinspectie Digitale Infrastructuur, including an 'AI sandbox' and a joint AI coordination centre; the AP is the intended market supervision authority for AI but cannot use those powers until the Dutch implementing act for the AI Regulation is in force, and the deadline for designating supervisors was 2 August 2025.
Why it matters: Organisations deploying AI in the Netherlands should follow the Dutch implementation of the AI Regulation, because the AP is being built up as the supervisor they will deal with.
Privacy8 Oct 2026 • European Data Protection Board (EDPB)
The Dutch DPA fined Uber EUR 824 990 000 for fully automated decisions about drivers - accounts were automatically deactivated temporarily when fraud was suspected or customer reviews were too low, and permanently after persistent low reviews - and for not sufficiently informing drivers about automated decision-making, under GDPR Articles 22 and 13; the case followed complaints from 171 French drivers via the Ligue des droits de l'Homme and the CNIL, concerned incidents between 2018 and 2022, and Uber has appealed the fine.
Why it matters: Any organisation that makes automated decisions about people should check it complies with GDPR Article 22 and informs them properly; the fine is under appeal but shows the scale of enforcement.
The name KOOP disappears on 1 January 2027 and the service continues under the name Logius in the Publicatie domain; koopoverheid.nl will be integrated with logius.nl in January 2027, and little changes for users apart from names and web addresses. From the Publicatie domain Logius keeps publishing legislation and official publications for the whole Dutch government and helps organisations prepare, manage and publish information, including active disclosure under the Wet open overheid (Woo).
Why it matters: Organisations that publish official information or find government publications through KOOP should update links and contacts before January 2027.
Accessibility6 Oct 2026 • NV Access (GitHub release)
NVDA 2026.3beta4 is the fourth beta of the free NVDA screen reader for Windows in the 2026.3 cycle; the release notes link to a release blog post with highlights and publish the installer's SHA-256 checksum and VirusTotal scan results.
Why it matters: Accessibility officers and document authors who test PDFs and websites with a screen reader can see what the next NVDA release will change.
Privacy5 Oct 2026 • Autoriteit Persoonsgegevens (AP)
The Dutch cabinet is working on privacy-friendlier rules for credit registration and a new bill would for the first time anchor the role of the BKR credit register in law; the AP welcomes improvements such as shorter and less frequent retention of credit history, a clear threshold from which registration is mandatory, and easier requests to delete data, but says the bill must still clarify which personal data may feed the risk score, limit the 'other statutory purposes' for which register data may be used, and restrict the use of archived data.
Why it matters: Lenders, telecom providers and anyone using BKR data should follow the bill, because the AP wants clearer limits before it becomes law.
Local AI5 Oct 2026 • Stirling PDF (GitHub release)
Stirling-PDF 3.1.0 enables group signing, called Stirling Sign, by default for new users with a new signing interface, ships a beta embedded conversion tool called Stirling Office Convert, and adds text-editor support for editing tables and OCRed image PDFs, plus attachment handling improvements.
Why it matters: Organisations that prefer a self-hosted PDF toolchain should note the new default group signing and test the beta conversion tool before relying on it.
The OpenPeppol Managing Committee approved the OpenPeppol Security Policy, an updated framework for security across the Peppol Network that will replace Section 6 of the Internal Regulations Part II, and also approved a list of certifications accepted as equivalent to ISO/IEC 27001: BSI IT Grundschutz, CyFun Essential and eIDAS QTSP.
Why it matters: Companies sending invoices over Peppol and the software vendors serving them should review the approved security policy and check which equivalent certifications their access point holds.
OCRmyPDF 17.13.0 validates PDF/A files produced without Ghostscript using pikepdf's PDF/A support instead of veraPDF, validates the final output again after metadata and optimisation steps, supports speculative PDF/A-1b conversion with repairs such as replacing other output intents with sRGB and removing hidden annotations PDF/A does not allow, and adds a new --pdfa-backend option (auto, ghostscript, internal).
Why it matters: Anyone building a local OCR pipeline for accessible or privacy-sensitive PDFs should test the new PDF/A backend option, which no longer needs Ghostscript or veraPDF for that path.
Accessibility25 Sep 2026 • W3C Web Accessibility Initiative (WAI)
W3C WAI reports that WAI Director Shawn Lawton Henry has written a W3C blog post covering some of the stakes and challenges in developing W3C Accessibility Guidelines (WCAG) 3.
Why it matters: Accessibility teams can read where WCAG 3 is heading, but today's legal baseline is still EN 301 549.
AccessibleEU reports that many accessibility organisations receive very few formal complaints even though websites and mobile apps still present widespread barriers, and lists reasons such as users abandoning a service, switching provider, lacking time or confidence, or not wanting to disclose a disability; it cites a list of possible reasons published by the Swedish consultancy Metamatrix.
Why it matters: Accessibility officers should not treat a low number of complaints as evidence that their documents and services are accessible, and should test proactively instead.
The DigiD app can now be downloaded directly on a computer, so the roughly one million people in the Netherlands without a smartphone can use it; the app works only on the computer where it is activated, requires the personal PIN, and can now be used with assistive tools such as eye-controlled software.
Why it matters: Government and public-sector teams should design digital services and documents for people who do not use smartphones, including users of assistive technology.
Accessibility22 Sep 2026 • W3C Web Accessibility Initiative (WAI)
The French authorized translations of the Web Content Accessibility Guidelines were updated: the WCAG 2.2 translation is now based on the 12 December 2024 publication of WCAG 2.2 and the WCAG 2.1 translation on the 6 May 2025 publication of WCAG 2.1.
Why it matters: French-speaking organisations in Belgium and France can now cite a current official translation in accessibility statements and audit reports.
The AP warns that people who film or photograph others with camera glasses may not simply use, share or publish those images, because recognisable bystanders are protected by the GDPR; the small recording light most manufacturers fit is not enough to inform people, and the AP advises organisations to ban camera glasses in their house rules where needed and is examining further measures against camera glasses and other camera wearables.
Why it matters: Organisations in privacy-sensitive settings such as hospitals, courts and offices should consider a house rule on camera glasses and brief staff on what is allowed.
Privacy21 Sep 2026 • European Data Protection Board (EDPB)
The EDPB adopted guidelines on how data protection authorities decide whether to impose an administrative fine alongside other corrective powers, setting out a five-step methodology and 14 practical examples, open for public consultation until 13 November 2026; it also adopted the final version of its guidelines on the interplay between the Digital Services Act and the GDPR after public consultation.
Why it matters: Privacy officers and their advisers should read the five-step methodology to understand how fines are decided, and can still comment before 13 November 2026.
On 14 September the AP held its first Maatschappelijk Overleg with a broad group of civil-society organisations including Amnesty International, the VNG, VNO-NCW, the Nationale Ombudsman and TNO, to gather experiences and concerns for its strategy towards 2027; the discussion focused on artificial intelligence, resilient and trustworthy digital services, and mass surveillance, and the AP will hold the consultation twice a year from now on.
Why it matters: Organisations that want to influence how the Dutch DPA prioritises its supervision can join future consultation rounds on these themes.
Accessibility10 Sep 2026 • W3C Web Accessibility Initiative (WAI)
The W3C Accessibility Guidelines (WCAG) 3.0 Working Draft has been updated; the September 2026 draft and the review questions on the conformance model are listed on the WCAG 3 status page for in-progress drafts.
Why it matters: Organisations tracking future accessibility requirements can review and comment on the draft conformance model now; WCAG 3 is still a draft, not a requirement.
Privacy9 Sep 2026 • European Data Protection Board (EDPB)
The CNIL fined Hôpital Privé de la Loire EUR 500 000 (decision of 3 September 2026) after an attacker reached the hospital's computerised patient summary in summer 2025 and accessed the data of 524 867 patients and 202 246 people registered as trusted third parties; the authority found the authentication for external users lacked VPN and multifactor authentication, access control did not work per care team, there was no real-time detection of suspicious activity, and the trusted third parties were never informed of the breach.
Why it matters: Organisations holding large document repositories should check authentication for external users, per-team access limits, detection of unusual access, and that breach notifications cover everyone affected, including third parties.
EN 301 549 version 4.1.1 was published on 3 September; its main change is the reference to WCAG 2.2, with six new success criteria and one removed, and these criteria apply to websites, documents and software (mobile apps). The user-preference requirements now also cover websites and documents; the Netherlands will not enforce those clauses until better test criteria exist, and the European Commission still has to harmonise the new version with the Web Accessibility Directive and the European Accessibility Act.
Why it matters: Anyone producing PDFs and other documents for Dutch or EU public-sector audiences should prepare for testing against WCAG 2.2, while noting that current legal testing still follows the harmonised version.
WCAG-EM 2.0, the new version of the international methodology for evaluating the accessibility of digital products, was published on 29 July 2026; the 2014 version covered only websites, while the new version applies the same method to websites, mobile apps and other digital interfaces such as kiosks and ticket machines, and Logius staff contributed to its development.
Why it matters: Accessibility audits and tenders can now use one method for websites, apps and other digital products, which makes results more comparable.
The Dutch login solution eHerkenning has been included in the European Commission's Interoperable Europe Portal, which makes the Dutch system for digital mandates visible to governments and organisations across the European Union; eHerkenning is person-bound and requires an authorisation for each person acting on behalf of a company.
Why it matters: Businesses and software vendors that log into Dutch government services with eHerkenning can follow how the mandate model is being reused at EU level.
The AP published two practical documents for SMEs: a template for a record of processing activities and a template for a privacy statement; the templates contain example tables for 10 sectors - education, hospitality, retail, IT, logistics, production, services, real estate, care and construction - and organisations only need to remove what does not apply and fill in the rest.
Why it matters: Small firms in real estate, accounting and services can use the free templates to set up their processing register and privacy statement.
Almost four months after the switch to Rabobank, 9 out of 10 payments to the Belastingdienst arrive on the new account number; a small part of citizens, businesses and other organisations still uses the old account number, and the Belastingdienst asks them to check their payment details.
Why it matters: Bookkeepers and accountants should check the payment details in their templates, standing orders and client instructions against the Belastingdienst's new account number.
From 1 September, businesses can choose to receive post from the Belastingdienst digitally only; they then receive more and more letters in Mijn Belastingdienst Zakelijk, starting with messages about VAT, and the Belastingdienst will digitalise other post for businesses in the future.
Why it matters: Businesses and their accountants should decide whether to switch to digital-only tax post, so that VAT letters keep reaching the right person in Mijn Belastingdienst Zakelijk.
Privacy27 Aug 2026 • Autoriteit Persoonsgegevens (AP)
Vulnerabilities found in WordPress are being actively abused, causing data leaks, and the AP says affected organisations do not always assess the risks well or inform the people whose data leaked; it advises users to check their WordPress version, update immediately, investigate whether the vulnerability was abused (with help from their hosting party or IT supplier), start their incident response plan, report the leak to the AP - a provisional report is allowed - and inform victims, assuming the worst when it is unclear whether data was accessed.
Why it matters: Any organisation running a WordPress site should update and check for compromise now, and should report and inform victims if personal data may have been exposed.
Worth knowing
The facts behind the headlines
Rules for accessibility of products and services (EAA)
Under the European Accessibility Act, products and services covered by the Act must be accessible, and documents published on a website before 28 June 2025 do not have to be made accessible.
Nieuwe versie van EN 301 549 aanstaande, met update naar WCAG 2.2
EN 301 549 version 4.1.1, published on 3 September 2026, refers to WCAG 2.2 and its criteria apply to websites, documents and software; the European Commission still has to harmonise this version with the Web Accessibility Directive and the European Accessibility Act.
Peppol BIS Billing 3.0 is the OpenPeppol specification for invoices and credit notes on the Peppol network; the specification listed on the page has a publishing date of 20 May 2026 and a mandatory date of 17 August 2026.
In the Netherlands it is not mandatory for businesses to accept e-invoices, except that e-invoicing is mandatory when supplying the Dutch central government, which must be able to receive and process e-invoices.
France's electronic invoicing regime started on 1 September 2026: large companies and intermediate-sized companies must issue their invoices via an approved platform, and all companies must be able to receive electronic invoices.
The ViDA package was adopted on 11 March 2025 and entered into force on 14 April 2025; digital reporting requirements for cross-border B2B transactions start on 1 July 2030, and by 1 January 2035 Member States with domestic real-time reporting must align with the EU model.
