The EU AI Act’s enforcement date was August 2, 2026. Most of the coverage this week focused on what was delayed: the postponement of the high-risk obligations for employment decisions, credit scoring, and access to public services to December 2027.
From 11 September 2026, every software manufacturer selling into the EU has to report an actively exploited vulnerability within 24 hours of becoming aware of it. Not 24 business hours. Twenty-four hours.
When a QA team at a bank evaluates AI testing tools, the conversation tends to start with the same set of questions that any engineering team would ask: how many test cases does it generate, how accurate is the generation, how well does it handle test maintenance, what frameworks does it support. These are legitimate questions. They’re also the wrong starting point, because they treat the problem of AI-assisted QA at a regulated financial institution as though it were the same problem as AI-assisted QA at a SaaS startup. It isn’t.
Most conversations about digital identity start from an assumption that’s rarely said out loud: that internet connectivity is stable, that service counters are close by, that population density turns infrastructure distribution into a problem solved by default. That’s a reasonable assumption in many European contexts. It simply doesn’t hold for a country like Cabo Verde — ten islands scattered across the Atlantic, where the distance between a citizen and the nearest public service can mean a boat trip, not a walk into town.
Most conversations about digital identity start from an assumption that’s rarely said out loud: that internet connectivity is stable, that service counters are close by, that population density turns infrastructure distribution into a problem solved by default. That’s a reasonable assumption in many European contexts. It simply doesn’t hold for a country like Cabo Verde — ten islands scattered across the Atlantic, where the distance between a citizen and the nearest public service can mean a boat trip, not a walk into town.
Two days. Dozens of conversations. One consistent theme: the distance between policy ambition and operational reality is still significant and the organisations closing that gap are the ones worth watching.
In 2026, the Cyber Resilience Act (CRA) is no longer a future deadline, it is the operational reality for every organization in the European market. With mandatory security requirements for products with digital elements, compliance has shifted from a “nice-to-have” to a fundamental license to operate.