Incidents

Post-incident analysis of AI failures that reached production, with the telemetry gaps that delayed detection.

In forceEU

Four regimes, four clocks. Which one fires first after an incident?

CRA reporting went live on 11 September 2026. With NIS2, GDPR and the AI Act, one event can start four clocks, and the fastest gives you 24 hours.

IncidentsSep 12, 20267 min

Evidence gapEU

Your agent caused the incident. Can you reconstruct what happened?

The AI Act sets a six month floor on log retention and says nothing about content. What you record decides whether an investigation takes hours or weeks.

IncidentsSep 7, 20267 min

Compliance clock

EU AI Act, Article 50 transparency duties In force

EU AI Act, AI Office enforcement powers over GPAI In force

EU AI Act, Article 50(2) compliance for systems placed on the market earlier Dec 2, 2026

Colorado AI Act, as revised by SB 26-189 Jan 1, 2027

EU AI Act, high-risk obligations under Article 6(2) and Annex III Dec 2, 2027

EU AI Act, high-risk obligations under Article 6(1) and Annex I Aug 2, 2028

Verified against primary sources on 2026-09-12. How we check.

Start here

Article 73 gives you 2, 10 or 15 days. Which clock runs?

Action requiredEU

Article 50 has applied since 2 August. What must you label?

In forceEU

AI API keys are production credentials. What does that change?

Action requiredGlobal

ISO 42001 or the NIST AI RMF? Only one gives you a certificate

ReferenceGlobal