A reasonably foreseeable and reproducible outcome.When a prohibition reaches a model nobody aimed, AI Act Article 5(1a)
The authorities get 24 hours, then 72, then a final report. You get the words shall inform, with the timing left to a CSIRT's judgement if your supplier does not get round to it.
The essay does not say whether that means marketing or pricing, and for an insurer the difference between those two readings is Annex III of the AI Act. Seven of the figures underneath it come from research Ageas has not published, which its own reference list says plainly.
It also draws a line between two kinds of information request that Article 101 does not draw, and a provider working out whether it is obliged to answer has to decide which document to believe.
Between a payment firm and its central bank the pilot agreement answers only for wilful misconduct or gross negligence, and what an end user is owed is whatever their own provider's terms happen to say.
The remediation plan it introduces runs to April 2028, and that is the part being read as an extension. The sentence that could actually move an entity's obligation is a different one, and it is about their own risk analysis.
The Key Principles the nine are being measured against carry a footnote saying they bind nobody and that ignoring them cannot automatically be considered unlawful.
The company presents it as growth, and a network like this takes years to build, so it is not an answer to one soft quarter. Nothing has been said about Europe, where the new single app platform reaches France this year and ten owned markets by the end of 2028.
The IEEE amendment is drawn for carrier frequencies up to 7250 MHz. Europe's unlicensed share of 6 GHz stops at 6425, and the Commission's own advisers have recommended that most of the band above it goes to mobile.
Apple, Google and Microsoft all expect the party that sold you the hardware to write a record about it before your console can see the thing. Microsoft's documentation says an administrator cannot remove an OEM's authorisation at all, and gives an email address instead.
The Netherlands asked the Commission on 23 September to ready the instrument against wider US sanctions on the International Criminal Court. A European court has already ruled on the step after that: the Commission may licence a German depository to freeze a German company's dividends, and the company has no right to be heard about it.
Article 22 keeps the report for as long as the working relationship; Article 21 keeps the names until the reported breach is time-barred. Every product here offers a period you configure, which is a different shape of answer.
Guidelines 04/2026 gives the supervisory authorities five steps for deciding whether to penalise at all, and retires the Article 29 Working Party guidance that has stood in their place. Step three runs seven paragraphs and closes the mistake-of-law defence on every subject the Board has already written about.
The amended settlement discipline standards replace two allocation deadlines with one, 23:00 CET on the day of the trade. For a client in the same time zone that is a relaxation. For one in Tokyo it is thirteen hours.
The design duty is real and narrower than the coverage suggests: it stops at raw data, qualifies its most useful word with 'technically feasible', and says nothing about how long the access lasts. That last part is the contract's job, and most contracts have not been asked to do it.
Both declarations are signed, both promise five years, and they count from different days. The same sheet that says so gives the phone 1.00 out of 5 for the length of its software support.
Several instruments now want a version of the same list, each with its own fields and no shared spine. Two or three days of one person's time for a first pass at a couple of hundred staff, six weeks if the first decision anybody makes is to buy a tool.
We rank three products against third-party risk requirements and put first the one our own publisher operates. The criteria come before the verdict so you can reweight them, and the vendor with the best design here has the thinnest assurance file of the three.
The monthly podcast
Once a month, the argument the first opinion did not have time for.
The first episode has not been recorded. There is nothing to listen to yet, and this says so rather than inventing one.
A manufacturer that learns a vulnerability in its product is being exploited now owes ENISA and a national CSIRT an early warning within a day. Nothing in force this week requires it to look.
Two delays, a $298 million annual loss and a thirteen-year-old predecessor that added forty million copies while the sequel slipped. The provocation is real, and so is the sofa.
Article 48 of the GDPR says a foreign court's order is not, on its own, enforceable here. It does not say the company may not comply, and most of this market sits in that gap.
The rest splits into lists you were sold onto and messages sent by criminals, and the action that fixes one of those makes another worse. Ninety minutes for the first pass, and it never stays done.
Common Criteria paperwork is turning up in device tenders as though it closed the question. It closes a narrow one, about software that stopped existing on the day the lab finished, in a configuration the vendor scoped itself.
A bank that licenses a credit-scoring model is a deployer under Article 26, and a deployer owes oversight, retained logs and a notice to the people it turns down. Article 27 assumes an assessment document that nobody has produced a template for.
A composite savings bank, two part-time privacy staff and two hundred and forty thousand hours of call recordings. This page sets the criteria and the weights; the ranked verdict follows the testing.
Ten seconds, any hour, irrevocable. The name-check that is supposed to hold the line has a third answer — close match — and the text does not say what happens after it.
Moving a processing activity from one lawful basis to the other changes nothing the user can see. It changes who has to move first, and almost nobody moves.
The connector was settled in a directive years ago and arrived on schedule. Nobody settled which of the four identical black cables in the drawer will charge the machine at full speed.
Article 28 lets a customer object when a platform adds a new supplier. It does not say how much notice, what an objection does, or whether anybody has to answer one.
The credit is measured per service, per region, claimed by you, and named the only thing you get. The postmortem that follows commits the provider to nothing with a date on it.
A regional water utility, nine hundred staff, eleven control sites and three people in security. The criteria and the weights are here; the ranking waits for testing that starts in January.
The Court of Justice struck down public access to beneficial ownership data in November 2022, on privacy grounds, and it was right to. The consequence is that the question now gets answered by the only party with no interest in answering it.
Microsoft prints one price and one rule — sixty-one dollars a device, doubling every consecutive year, three years maximum. What it does not print in the same place is that each year carries its own activation ID, so the invoice renews itself and nothing else does.
Removability is decided, down to a ban on glue that needs a heat gun. Who holds spares, at what price and for how long is still being argued, and that is the half that decides year four.
Zero retention, no training on your inputs, enterprise tier, residency, a certification, a trust centre: some of those are undertakings you could enforce and some are pages that can be edited on a Tuesday. Nothing in the datasheet tells you which is which.
The Digital Services Act tells providers they need not collect extra data to work out whether a user is a child. On a family console the answer was typed in by a parent, on purpose, on the first evening, and nothing in the text says what that obliges.
This week’s seven is chrome. Hardware and review weeks. The wordmark never changes; the seven changes every Monday, and out of cycle when the news demands it.
