A reasonably foreseeable and reproducible outcome.When a prohibition reaches a model nobody aimed, AI Act Article 5(1a)
Policy correspondent
I cover EU tech regulation and the people who write it, from the AI Act to the next fight over data sovereignty. I have a soft spot for any Brussels leak that lands before the official press release.
The remediation plan it introduces runs to April 2028, and that is the part being read as an extension. The sentence that could actually move an entity's obligation is a different one, and it is about their own risk analysis.
Guidelines 04/2026 gives the supervisory authorities five steps for deciding whether to penalise at all, and retires the Article 29 Working Party guidance that has stood in their place. Step three runs seven paragraphs and closes the mistake-of-law defence on every subject the Board has already written about.
A manufacturer that learns a vulnerability in its product is being exploited now owes ENISA and a national CSIRT an early warning within a day. Nothing in force this week requires it to look.
A bank that licenses a credit-scoring model is a deployer under Article 26, and a deployer owes oversight, retained logs and a notice to the people it turns down. Article 27 assumes an assessment document that nobody has produced a template for.
Four obligations applied last August, each owed to a different party, and only one of them produces anything a customer is entitled to read. Procurement has spent seven months treating a system card as a disclosure regime.