The AI Act sets three serious incident deadlines, not one. Which applies depends on the harm, and the fastest gives a provider two days to notify.
What do AI assistants say about your organisation?
Model answers are becoming a channel your communications team does not control. EntityRise audits how assistants describe your company and whose name they give instead. From $19.
CRA reporting went live on 11 September 2026. With NIS2, GDPR and the AI Act, one event can start four clocks, and the fastest gives you 24 hours.
The AI Act amendment moved two dates and left the rest untouched. Prohibitions, GPAI duties and Article 50 transparency all apply today, delay or no delay.
Four duties, two on providers and two on deployers. Machine-readable marking, deepfake disclosure, and a 2 December 2026 cutoff for legacy systems.
Anthropic's September 2026 report shows stolen AI keys funding attacks and a fake reseller harvesting them. The controls for these keys lag a decade.
Prompt injection defences fail sometimes. Scope decides what happens then. Four permission questions that bound the damage when the model is convinced.
The AI Act sets a six month floor on log retention and says nothing about content. What you record decides whether an investigation takes hours or weeks.
38 controls in nine areas against four functions and 72 subcategories. One is certifiable, one is not, and procurement asks for the certificate.
Put your name on it, modify it substantially, or change its purpose so it becomes high risk. Any of the three moves the provider obligations onto you.
Annex IV runs to nine points and point two alone has seven sub-points. The evidence either exists as an artefact or the control exists only in the policy.
Top of the OWASP list since 2025, and used against a vendor sandbox in the September 2026 threat report. Four control classes, honestly rated.
Article 27 binds public bodies, private providers of public services, and two Annex III uses. A DPIA can be reused, but it does not replace the assessment.
Chapter V binds providers of general purpose models, not their users. Fine tuning and rebranding are the two routes by which a user acquires those duties.
Most AI vendor questionnaires test whether a supplier has a policy. These test whether it can hand you the artefacts your own obligations will require.
Article 4 binds providers and deployers alike and has no threshold, no exemption for small firms and no template. It also has no penalty of its own.