A reasonably foreseeable and reproducible outcome.When a prohibition reaches a model nobody aimed, AI Act Article 5(1a)
Procurement and devices
I report on banking, fintech and the compliance tech reshaping how European financial institutions actually operate. I'm happiest when a quarterly earnings call turns into a regulatory subplot.
The framework defines that floor as leaving material non-EU dependencies in place, with the service under indirect control of non-EU third parties. The press release calls it abiding by EU law.
Apple, Google and Microsoft all expect the party that sold you the hardware to write a record about it before your console can see the thing. Microsoft's documentation says an administrator cannot remove an OEM's authorisation at all, and gives an email address instead.
The design duty is real and narrower than the coverage suggests: it stops at raw data, qualifies its most useful word with 'technically feasible', and says nothing about how long the access lasts. That last part is the contract's job, and most contracts have not been asked to do it.
Common Criteria paperwork is turning up in device tenders as though it closed the question. It closes a narrow one, about software that stopped existing on the day the lab finished, in a configuration the vendor scoped itself.
Microsoft prints one price and one rule — sixty-one dollars a device, doubling every consecutive year, three years maximum. What it does not print in the same place is that each year carries its own activation ID, so the invoice renews itself and nothing else does.