The Guardrail

Article 73 gives you 2, 10 or 15 days. Which clock runs?

Marta Lindqvist — Sat, 12 Sep 2026 00:00:00 GMT

Article 73 runs three deadlines, not one: 15 days as standard, 10 days where a death may be involved, and 2 days for widespread infringement or serious disruption of critical infrastructure.
The clock starts when the provider becomes aware of the incident, not when the cause is proven. Article 73(5) expressly allows an incomplete first report.
The duty sits on the provider of a high-risk system. A deployer that puts its own name on a system, or substantially modifies one, can become the provider under Article 25.
Substantive high-risk obligations now begin on 2 December 2027 for Annex III systems and 2 August 2028 for Annex I products, after the amendments approved on 16 June 2026.
Article 73 is rarely the first duty to fire. GDPR gives 72 hours and NIS2 an early warning inside 24 hours, so the AI Act report is often the third notification, not the first.

Four regimes, four clocks. Which one fires first after an incident?

Owen Castellanos — Sat, 12 Sep 2026 00:00:00 GMT

Cyber Resilience Act reporting has been mandatory since 11 September 2026, on a 24, 72 and 14 day cadence for actively exploited vulnerabilities.
NIS2 also opens at 24 hours with an early warning, followed by a fuller notification at 72 hours.
GDPR gives 72 hours from awareness of a personal data breach, and the AI Act gives 2 to 15 days depending on the harm.
The same event can engage all four. The AI Act clock is almost always the slowest, which is why an AI specific incident process is the wrong place to start.
Four regimes means four recipients: a CSIRT and ENISA, a data protection authority, a market surveillance authority, and in NIS2 cases the national competent authority.

16 more months for high-risk. Which duties still bind you now?

Marta Lindqvist — Fri, 11 Sep 2026 00:00:00 GMT

The amendment approved on 16 June 2026 moved exactly two dates: Annex III high-risk obligations from 2 August 2026 to 2 December 2027, and Annex I from 2 August 2027 to 2 August 2028.
That is a deferral of 16 months for standalone high-risk systems and 12 months for AI embedded in regulated products. Nothing else in the timetable moved.
Article 50 transparency duties have applied since 2 August 2026. Generative systems already on the market got a short extension to 2 December 2026 for machine-readable marking, and only for that.
A new prohibition covering AI generated intimate imagery and child sexual abuse material carries its own date of 2 December 2026 and applies whether or not you run anything high risk.
Breaches of the transparency duties can reach EUR 15 million or 3% of worldwide annual turnover, so the duties that did not move are not the cheap ones.

Article 50 has applied since 2 August. What must you label?

Marta Lindqvist — Thu, 10 Sep 2026 00:00:00 GMT

Article 50 has applied since 2 August 2026. It splits across 4 substantive paragraphs: two bind providers, two bind deployers.
Article 50(2) requires synthetic audio, image, video and text to be marked in a machine-readable format. Generative systems already on the market before 2 August 2026 have until 2 December 2026.
That extension covers the marking duty only. The deployer duties in Article 50(3) and 50(4) had no transitional period and applied from day one.
Disclosure must reach the person at the latest at the time of the first interaction, in a clear and distinguishable manner, and must meet accessibility requirements.
Penalties for transparency breaches run to EUR 15 million or 3% of worldwide annual turnover, whichever is higher.

AI API keys are production credentials. What does that change?

Owen Castellanos — Wed, 09 Sep 2026 00:00:00 GMT

Anthropic's report covering December 2025 to August 2026 documents stolen AI API keys being used to fund further operations, and a fraudulent reseller built specifically to harvest them.
One tracked group dumped 2,100 cloud token sets across 40 corporate tenants in 34 hours, which is the speed a credential control has to survive.
Another maintained a standing fleet of 13 collection agents and produced 12 possible zero-day findings in a single month against roughly 50 organisations.
The keys are harvested from the places code lives: repositories, container images, mobile app bundles and vendor sandboxes. Only one of those is covered by a typical secret scanning policy.
Anthropic's own recommendation is the short version of this article: treat AI keys and agent integrations with the same seriousness as production credentials, and buy access only through authorised channels.

The agent was persuaded. What is it authorised to do next?

Owen Castellanos — Tue, 08 Sep 2026 00:00:00 GMT

Prompt injection has sat at LLM01, the top entry of the OWASP list for generative AI, since the 2025 edition. No control removes it, so the design question is what follows a successful one.
Anthropic's September 2026 report describes agents running unattended for hours or days. Any authorisation granted to that agent is exercised at that speed.
Scope, not detection, is the control that degrades gracefully. A detector that is 99% effective still fails on the 1%, and the blast radius on that attempt is set entirely by permissions.
Article 14 of the AI Act requires human oversight for high-risk systems to be effective, which for an autonomous agent means an approval gate on the specific actions that cannot be undone.
Four questions bound the damage: what can it read, what can it write, who can it act as, and what cannot be reversed.

Your agent caused the incident. Can you reconstruct what happened?

Owen Castellanos — Mon, 07 Sep 2026 00:00:00 GMT

Article 12 requires high-risk systems to allow automatic recording of events across their lifetime. Articles 19 and 26(6) set the retention floor at at least 6 months for providers and deployers.
The Act sets duration, not content. A log that satisfies the 6 month floor and records nothing about which tool was called cannot answer the first question an investigator asks.
Article 73 gives as little as 2 days to notify, and Article 73(6) requires an investigation afterwards. Both assume the evidence already exists.
The reconstruction needs 5 things: the input that arrived, the identity that acted, the tools called, the output returned, and the version of everything involved.
Model version is the field teams forget. Without it, a finding from March cannot be tested against the system running in September.

ISO 42001 or the NIST AI RMF? Only one gives you a certificate

Ruth Abiola — Sun, 06 Sep 2026 00:00:00 GMT

ISO/IEC 42001 is a certifiable management system standard. Its Annex A lists 38 reference controls across 9 control areas.
The NIST AI Risk Management Framework 1.0 is voluntary guidance built on 4 functions, Govern, Map, Measure and Manage, elaborated into 72 subcategories in the companion Playbook.
No body certifies conformance to the NIST framework. If a customer questionnaire asks for a certificate, only one of these two answers it.
The frameworks are complements, not alternatives: the 4 NIST functions describe how to reason about risk, the 38 ISO controls describe what to have in place.
Neither one discharges the EU AI Act. Conformity there runs through Chapter III and the technical documentation in Annex IV, whatever certificates sit alongside it.

Three ways a deployer becomes the provider under Article 25

Marta Lindqvist — Sat, 05 Sep 2026 00:00:00 GMT

Article 25 lists 3 triggers that turn a deployer, distributor or importer into a provider of a high-risk system.
Putting your own name or trademark on a high-risk system already on the market is trigger 1, and it catches white labelled products routinely.
Changing the intended purpose of a system that was not high risk, so that it becomes high risk, is trigger 3. It applies to general purpose models too.
The consequence is the full provider set: Annex IV technical documentation, conformity assessment, and the Article 73 reporting duty with its 2 to 15 day clocks.
A contract cannot move a statutory obligation. Article 25(2) requires the original provider to cooperate and hand over information, which is the clause worth negotiating instead.

What an AI audit asks to see, and what closes each finding

Ruth Abiola — Fri, 04 Sep 2026 00:00:00 GMT

Annex IV of the AI Act lists 9 numbered points of technical documentation. Point 2 alone breaks into 7 sub-points covering development method, architecture, data and validation.
Article 18 requires providers to keep that documentation for 10 years after the system is placed on the market or put into service.
ISO/IEC 42001 adds 38 reference controls in 9 areas, each of which an auditor will ask to see evidence for, not a policy describing it.
The recurring finding is not a missing control. It is a control that cannot produce an artefact with a date on it.
Point 4 of Annex IV asks why your performance metrics are appropriate, which is a question most model cards do not answer.

Prompt injection is not solved. What actually lowers the rate?

Owen Castellanos — Thu, 03 Sep 2026 00:00:00 GMT

Prompt injection has been LLM01, the leading entry of the OWASP list for generative AI applications, since the 2025 edition, and it is still there.
Anthropic's September 2026 report documents an actor injecting instructions into a vendor sandbox and obtaining production API keys from multiple providers at once.
No published control removes the class. Instructions and data arrive on the same channel, so every mitigation lowers a rate rather than closing a hole.
Of 4 control classes in common use, only 2 keep working when the model has already been convinced.
Article 15 of the AI Act requires high-risk systems to be resilient against attempts to exploit vulnerabilities, which is a legal reason to document what you chose and why.

Who has to run a fundamental rights impact assessment?

Ruth Abiola — Wed, 02 Sep 2026 00:00:00 GMT

Article 27 binds three groups: bodies governed by public law, private entities providing public services, and deployers of the Annex III point 5(b) and 5(c) uses.
Those two points are creditworthiness assessment and risk assessment and pricing in life and health insurance, which puts most of the private sector burden on financial services.
The assessment has 6 required elements, including the categories of person affected and the specific harms likely to reach them.
Article 27(3) requires the deployer to notify the market surveillance authority of the results, using the template the Article provides for.
Article 27(4) lets you reuse a DPIA where it already covers an element, but a GDPR assessment does not discharge the duty on its own.

You only use foundation models. Which GPAI duties reach you?

Marta Lindqvist — Tue, 01 Sep 2026 00:00:00 GMT

Chapter V duties have applied since 2 August 2025, and the Commission's enforcement powers over general purpose models since 2 August 2026.
Article 53 places 4 duties on model providers: technical documentation, information for downstream providers, a copyright policy, and a public summary of training content.
Article 51(2) presumes systemic risk above 10^25 floating point operations of training compute, which brings the additional Article 55 duties.
A company that only calls an API is not a provider of the model. Fine tuning it, or shipping it under its own name, is how that changes.
The duty that matters most to a downstream user is the one owed to them: Article 53(1)(b) requires the model provider to supply the information they need to comply.

Twelve questions to ask an AI vendor before the contract

Ruth Abiola — Mon, 31 Aug 2026 00:00:00 GMT

12 questions, grouped in 4 areas: documentation, incident cooperation, credentials, and change notice.
Article 25(2) obliges an original provider to cooperate if you become the provider, which is the hook for asking about the Annex IV pack before signing.
Article 73 gives as little as 2 days to notify. A vendor whose support SLA is 5 business days cannot help you meet it.
The September 2026 threat report documents production API keys stolen from a vendor sandbox, which makes the credential storage question a security question rather than an administrative one.
NIS2 Article 21 already requires supply chain security measures of essential and important entities, so for many buyers this is an existing duty rather than a new one.

AI literacy has been mandatory since February 2025. What counts?

Marta Lindqvist — Sun, 30 Aug 2026 00:00:00 GMT

Article 4 has applied since 2 February 2025 and binds both providers and deployers, with no size threshold and no sector carve out.
The duty covers staff and other persons operating AI systems on your behalf, which reaches contractors and outsourced teams.
The standard is calibrated: sufficient literacy given technical knowledge, experience, education, training and the context of use. There is no fixed curriculum.
Article 4 carries no penalty of its own in Article 99. Its practical weight is evidential, because a literacy failure is what an oversight failure under Article 14 looks like from the inside.
A defensible record is 3 things: who was trained, on what, and when, per role rather than per headcount.