Without undue delay and in any event within 24 hours.The clock that points at the authorities, Cyber Resilience Act Article 14(2)
DORA and the Digital Services Act contribute nothing. Three deadlines in wide circulation are not in the instruments credited with them, and the accessibility one is three years out.
SEAL-4 is defined as complete EU control with no critical non-EU dependencies, and it was awarded to nobody. The exposure is still genuinely smaller than a US hyperscaler's European region, for reasons the STACKIT page does not give.
Its commercial terms put a European customer under French law before the courts of Paris, exclusively. The four layers of control the company publishes do not mention a court at all.
Two prohibitions on generating intimate imagery and child sexual abuse material land on 2 December, and one of them reaches a provider who never intended the output. A breach of Article 5 costs 35 million euro or seven per cent of worldwide turnover, whichever is higher.
The exemption asks for a process of human review or editorial control and a person who holds editorial responsibility. It lifts one of the few obligations in the Act pointed at readers rather than at regulators.
The authorities get 24 hours, then 72, then a final report. You get the words shall inform, with the timing left to a CSIRT's judgement if your supplier does not get round to it.
The essay does not say whether that means marketing or pricing, and for an insurer the difference between those two readings is Annex III of the AI Act. Seven of the figures underneath it come from research Ageas has not published, which its own reference list says plainly.
It covers e-bike, industrial and electric vehicle batteries, and even there the dismantling information a repairer would want sits in the tier you need a legitimate interest to read.
Member States notify the Commission, the Commission compiles and publishes. Every one of the six pages where those lists are meant to appear says the first one is in preparation.
The framework defines that floor as leaving material non-EU dependencies in place, with the service under indirect control of non-EU third parties. The press release calls it abiding by EU law.
It also draws a line between two kinds of information request that Article 101 does not draw, and a provider working out whether it is obliged to answer has to decide which document to believe.
Between a payment firm and its central bank the pilot agreement answers only for wilful misconduct or gross negligence, and what an end user is owed is whatever their own provider's terms happen to say.
The remediation plan it introduces runs to April 2028, and that is the part being read as an extension. The sentence that could actually move an entity's obligation is a different one, and it is about their own risk analysis.
The Key Principles the nine are being measured against carry a footnote saying they bind nobody and that ignoring them cannot automatically be considered unlawful.
The company presents it as growth, and a network like this takes years to build, so it is not an answer to one soft quarter. Nothing has been said about Europe, where the new single app platform reaches France this year and ten owned markets by the end of 2028.
The IEEE amendment is drawn for carrier frequencies up to 7250 MHz. Europe's unlicensed share of 6 GHz stops at 6425, and the Commission's own advisers have recommended that most of the band above it goes to mobile.
Apple, Google and Microsoft all expect the party that sold you the hardware to write a record about it before your console can see the thing. Microsoft's documentation says an administrator cannot remove an OEM's authorisation at all, and gives an email address instead.
The Netherlands asked the Commission on 23 September to ready the instrument against wider US sanctions on the International Criminal Court. A European court has already ruled on the step after that: the Commission may licence a German depository to freeze a German company's dividends, and the company has no right to be heard about it.
Article 22 keeps the report for as long as the working relationship; Article 21 keeps the names until the reported breach is time-barred. Every product here offers a period you configure, which is a different shape of answer.
Guidelines 04/2026 gives the supervisory authorities five steps for deciding whether to penalise at all, and retires the Article 29 Working Party guidance that has stood in their place. Step three runs seven paragraphs and closes the mistake-of-law defence on every subject the Board has already written about.
The amended settlement discipline standards replace two allocation deadlines with one, 23:00 CET on the day of the trade. For a client in the same time zone that is a relaxation. For one in Tokyo it is thirteen hours.
DAHNIN treats the model as a fast, confident junior with no memory, and gives it written context, hard limits and two reviews. Four of its citations check out. One of them does not cover what it is cited for, and the rule that reads most like a control is not one.
DORA's first report is due four hours after an incident is classified as major and never later than a day after anyone knew. The GDPR's seventy-two hours start from a different moment, and the person who owns that moment is usually in another meeting.
The monthly podcast
Once a month, the argument the first opinion did not have time for.
The first episode has not been recorded. There is nothing to listen to yet, and this says so rather than inventing one.
Firms that already demand two-factor logins must accept it a year later, on request, and small ones not at all. The handset list will come out of national certification schemes, and the regulation says nothing about year four.
The design duty is real and narrower than the coverage suggests: it stops at raw data, qualifies its most useful word with 'technically feasible', and says nothing about how long the access lasts. That last part is the contract's job, and most contracts have not been asked to do it.
The revised directive compensates people for injury, private property and private data, and no contract can cap what they are owed. Between businesses, the loss still lands where the indemnity clause puts it.
We read five providers' published switching terms against Article 29 of the Data Act on 22 September. Of the two that write no switching charges into the contract, one bills the rest of the term as a termination fee.
1,294,188 verified signatures bought a voluntary code of conduct and an awareness campaign. They also bought the clearest official statement yet on what a buyer is owed when a seller switches off software that was paid for up front.
Editing the contract takes notice, a countersignature and a diary entry. Editing what the software does when nobody touches it takes a release note.
Residency is a claim about bytes at rest. Identity, build artefacts, telemetry and the break-glass rota are four separate systems, and most datasheets give them one row.
The health service decision landed on 2 September with a reprimand, €645,000 and a set of orders. The money is the part that moves between two accounts of the same exchequer.
Both declarations are signed, both promise five years, and they count from different days. The same sheet that says so gives the phone 1.00 out of 5 for the length of its software support.
Several instruments now want a version of the same list, each with its own fields and no shared spine. Two or three days of one person's time for a first pass at a couple of hundred staff, six weeks if the first decision anybody makes is to buy a tool.
We rank three products against third-party risk requirements and put first the one our own publisher operates. The criteria come before the verdict so you can reweight them, and the vendor with the best design here has the thinnest assurance file of the three.
A manufacturer that learns a vulnerability in its product is being exploited now owes ENISA and a national CSIRT an early warning within a day. Nothing in force this week requires it to look.
Two delays, a $298 million annual loss and a thirteen-year-old predecessor that added forty million copies while the sequel slipped. The provocation is real, and so is the sofa.
Article 48 of the GDPR says a foreign court's order is not, on its own, enforceable here. It does not say the company may not comply, and most of this market sits in that gap.
The rest splits into lists you were sold onto and messages sent by criminals, and the action that fixes one of those makes another worse. Ninety minutes for the first pass, and it never stays done.
Common Criteria paperwork is turning up in device tenders as though it closed the question. It closes a narrow one, about software that stopped existing on the day the lab finished, in a configuration the vendor scoped itself.
A bank that licenses a credit-scoring model is a deployer under Article 26, and a deployer owes oversight, retained logs and a notice to the people it turns down. Article 27 assumes an assessment document that nobody has produced a template for.
A composite savings bank, two part-time privacy staff and two hundred and forty thousand hours of call recordings. This page sets the criteria and the weights; the ranked verdict follows the testing.
Ten seconds, any hour, irrevocable. The name-check that is supposed to hold the line has a third answer — close match — and the text does not say what happens after it.
Moving a processing activity from one lawful basis to the other changes nothing the user can see. It changes who has to move first, and almost nobody moves.
The connector was settled in a directive years ago and arrived on schedule. Nobody settled which of the four identical black cables in the drawer will charge the machine at full speed.
Article 28 lets a customer object when a platform adds a new supplier. It does not say how much notice, what an objection does, or whether anybody has to answer one.
The credit is measured per service, per region, claimed by you, and named the only thing you get. The postmortem that follows commits the provider to nothing with a date on it.
A regional water utility, nine hundred staff, eleven control sites and three people in security. The criteria and the weights are here; the ranking waits for testing that starts in January.
The Court of Justice struck down public access to beneficial ownership data in November 2022, on privacy grounds, and it was right to. The consequence is that the question now gets answered by the only party with no interest in answering it.
Microsoft prints one price and one rule — sixty-one dollars a device, doubling every consecutive year, three years maximum. What it does not print in the same place is that each year carries its own activation ID, so the invoice renews itself and nothing else does.
Removability is decided, down to a ban on glue that needs a heat gun. Who holds spares, at what price and for how long is still being argued, and that is the half that decides year four.
Zero retention, no training on your inputs, enterprise tier, residency, a certification, a trust centre: some of those are undertakings you could enforce and some are pages that can be edited on a Tuesday. Nothing in the datasheet tells you which is which.
The Digital Services Act turned account enforcement into a procedure with a paper trail and a public record. What the procedure costs you is still decided entirely by the terms.
The Digital Services Act tells providers they need not collect extra data to work out whether a user is a child. On a family console the answer was typed in by a parent, on purpose, on the first evening, and nothing in the text says what that obliges.
This week’s seven is jade. Legislation weeks. The wordmark never changes; the seven changes every Monday, and out of cycle when the news demands it.
