US federal data consolidation is accelerating unlawfully, and the EU AI Act's data governance rules are starting to look like a competitive advantage.
elcome to issue twenty-four. This week the story is not a single court ruling or a new fine, it is a pattern: the US federal government has spent two years hoovering up citizens' private data in three distinct waves, and the EFF has now laid out the full shape of that consolidation in uncomfortable detail. We also look at age-verification laws that risk locking out the people they claim to protect, and what both stories tell EU operators about why the AI Act's data governance chapters exist in the first place.
Let’s go.
yours, Flux
Flux Weekly is a 6-minute briefing for people who have to actually make AI work in Europe. Sole traders to enterprise, one issue every Friday morning.
- New We added a data-provenance checklist to the compliance scan this week, prompted by the EFF's breakdown of how US federal agency data-sharing chains can contaminate upstream datasets.
- Updated The high-risk system countdown ticker now shows working hours remaining alongside calendar days, because 412 days sounds manageable until you count the sprints.
- ICYMI Last week's anchor story on government social media surveillance of labour unions is worth re-reading alongside this week's data consolidation piece as the two together describe the same regulatory gap from different angles.
EFF Maps Two Years of Unlawful US Federal Data Consolidation, and the Contrast with EU Rules Could Not Be Starker
Three waves, one pattern. The EFF this week published a detailed account of how the US federal government has consolidated citizens' private data across two years in three phases: first through DOGE, then through agency-to-agency sharing with immigration enforcement, and finally through attempted data-driven purges of state voter rolls. Each wave built on the last, and the EFF describes the whole process as unlawful.
Why EU operators should pay attention. The AI Act's data governance rules in Title III exist precisely to prevent this kind of accumulation. If you are building or deploying a high-risk AI system that processes personal data, you are already operating inside a statutory fence that the US plainly does not have. That is not a compliance burden, it is a selling point. Your customers can point to an actual legal framework. US operators cannot.
Does your AI inform a decision that affects a person's job, credit, education, or essential service?
- ✓412 days remain until high-risk AI system rules apply on 2 December 2027, making Q4 2026 the last comfortable planning window before implementation pressure sharpens.
- ✓Age verification debates in EU member states are echoing EFF's global warning: ID-gated internet access disproportionately excludes marginalised users, a concern directly relevant to AI systems used in public services.
- ✓Turkey's court-ordered blocking of LGBTQ+ and feminist organisations' websites is a live example of what the AI Act's prohibited remote biometric and social-scoring provisions are designed to prevent inside EU borders.
- ~US federal data consolidation entered a third wave with attempted voter-roll purges driven by algorithmic data-matching, according to the EFF's timeline published this week.
- 1EFF's Surveillance Self-DefenceGuide
A practical guide from the Electronic Frontier Foundation covering how data is collected, stored, and shared by governments and platforms.
Why we like it. Understanding the threat model the EFF describes this week helps you explain to clients why your EU-compliant data practices are materially different.
- 2EDPB Guidelines on AI and Data ProtectionRegulatory
The European Data Protection Board's published guidance on how GDPR interacts with AI system development and deployment.
Why we like it. If your AI system touches personal data, this is the document that bridges GDPR obligations to your AI Act compliance work.
- 3AI Act Explorer (Future of Life Institute)
Three Waves of Chaos Is Not a Bug, It Is the Argument for the AI Act
By John Ferguson
Reading the EFF's breakdown of how US federal data consolidation happened in waves, I kept thinking: this is exactly the scenario the AI Act's data governance chapters were written to prevent. Not because the EU legislature is smarter, but because they had more time to look at what can go wrong.
The pattern is always the same. A new capability appears. It gets deployed before any rules exist. The rules then have to be written in response to harms that have already happened to real people. The EU tried to break that cycle by writing the rules before full deployment. It is messy and imperfect, but the alternative is what the EFF is documenting this week.
For those of us doing compliance work right now, the takeaway is practical: your data provenance documentation is not just a box-ticking exercise. It is the thing that lets you say, with evidence, that your system did not inherit any of that chaos.
Four hundred and twelve days. Use them to get your data house in order, because that is the foundation everything else sits on.
John Ferguson · Founder, Agentic Fluxus
Short answer.Potentially yes. The AI Act requires high-risk system operators to document data provenance and ensure training datasets meet quality and representativeness standards. If your vendor cannot tell you where their data originated, you cannot make that documentation. Start with a written request to your vendor asking them to confirm whether any data derives from US federal agency sources, and get that answer in writing before your next conformity assessment.
How confident are you that your AI vendor can tell you exactly where their training data came from?
The EFF this week documented that the US federal data grab did not happen in one chaotic burst but in three deliberate waves, each targeting a different pool of sensitive records. By wave three, algorithmic data-matching was being used to challenge state voter rolls.
Age verification proposals in multiple jurisdictions now risk creating a class of people who simply cannot access the internet, because they lack the government-issued ID the law requires. The EFF's analysis flags undocumented residents, domestic abuse survivors, and homeless people as the groups most likely to be locked out.