A reasonably foreseeable and reproducible outcome.When a prohibition reaches a model nobody aimed, AI Act Article 5(1a)
What is being written into law, and what it will cost to comply with it.
Between a payment firm and its central bank the pilot agreement answers only for wilful misconduct or gross negligence, and what an end user is owed is whatever their own provider's terms happen to say.
The remediation plan it introduces runs to April 2028, and that is the part being read as an extension. The sentence that could actually move an entity's obligation is a different one, and it is about their own risk analysis.
The company presents it as growth, and a network like this takes years to build, so it is not an answer to one soft quarter. Nothing has been said about Europe, where the new single app platform reaches France this year and ten owned markets by the end of 2028.
Guidelines 04/2026 gives the supervisory authorities five steps for deciding whether to penalise at all, and retires the Article 29 Working Party guidance that has stood in their place. Step three runs seven paragraphs and closes the mistake-of-law defence on every subject the Board has already written about.
The amended settlement discipline standards replace two allocation deadlines with one, 23:00 CET on the day of the trade. For a client in the same time zone that is a relaxation. For one in Tokyo it is thirteen hours.
The design duty is real and narrower than the coverage suggests: it stops at raw data, qualifies its most useful word with 'technically feasible', and says nothing about how long the access lasts. That last part is the contract's job, and most contracts have not been asked to do it.
A manufacturer that learns a vulnerability in its product is being exploited now owes ENISA and a national CSIRT an early warning within a day. Nothing in force this week requires it to look.
Common Criteria paperwork is turning up in device tenders as though it closed the question. It closes a narrow one, about software that stopped existing on the day the lab finished, in a configuration the vendor scoped itself.
A bank that licenses a credit-scoring model is a deployer under Article 26, and a deployer owes oversight, retained logs and a notice to the people it turns down. Article 27 assumes an assessment document that nobody has produced a template for.
Moving a processing activity from one lawful basis to the other changes nothing the user can see. It changes who has to move first, and almost nobody moves.
Article 28 lets a customer object when a platform adds a new supplier. It does not say how much notice, what an objection does, or whether anybody has to answer one.
Four obligations applied last August, each owed to a different party, and only one of them produces anything a customer is entitled to read. Procurement has spent seven months treating a system card as a disclosure regime.