The Cyber Resilience Act's vulnerability reporting duties are already in force, well before the December 2027 date that governs most of the regulation, and they sit alongside five other disclosure regimes whose clocks start differently.
Perspective Coverage
5 publishers
- Builder
- Builder 36%
- Operator
- Operator 50%
- Investor
- Investor 14%
Reality
- Evidence80
- Adoption
- Insufficient
- Hype gap+15
- Incentives55
- Confidence72
A developer's GraphRAG build turns Thailand's 96-section PDPA into a 190-node graph so an agent can walk from Section 26 to the fines that cite it. The published part argues the vector-search gap from vocabulary and reports no measured recall figures.
Reality
- Evidence40
- Adoption
- Insufficient
- Hype gap+15
- Incentives25
- Confidence45
Cloudflare is adding EuroLLM, which covers all 24 official EU languages, and Switzerland's fully open Apertus model to Workers AI. Both come from public universities and research institutions, so teams with sovereignty requirements now have hosted models built outside the frontier labs.
Reality
- Evidence40
- Adoption12
- Hype gap+25
- Incentives80
- Confidence45
BH Consulting launched BH Haven, a four-tier SME service in which a proprietary AI tool drafts findings and consultants approve them. CEO Brian Honan said using AI internally does not move the firm's contractual responsibility for a missed gap onto the software.
Reality
- Evidence35
- Adoption
- Insufficient
- Hype gap+10
- Incentives70
- Confidence40
Ireland's DPC takes a median 6.2 years to decide a cross-border GDPR case, a LessWrong analysis finds. The AI Act gives the Commission five years from a violation to fine, and it requires the same investigation and response steps that take up most of the Irish cases.
Reality
- Evidence55
- Adoption
- Insufficient
- Hype gap+25
- Incentives
- Insufficient
- Confidence45
The DoJ split the payment, holding a quarter of it against the removal of a legacy consent decree, and credited TikTok's later fixes without discounting the bill for the earlier ones.
Perspective Coverage
5 publishers
- Builder
- Builder 23%
- Operator
- Operator 55%
- Investor
- Investor 22%
Reality
- Evidence66
- Adoption
- Insufficient
- Hype gap+15
- Incentives55
- Confidence70
The Dutch regulator's fine against Uber turns the rules on automated decisions into a build order: meaningful review before the action lands, and a contest route the driver can actually find.
Perspective Coverage
3 publishers
- Builder
- Builder 28%
- Operator
- Operator 45%
- Investor
- Investor 27%
Reality
- Evidence68
- Adoption
- Insufficient
- Hype gap+15
- Incentives55
- Confidence65
The charging case does the real listening, and it uploads to the cloud for transcription. That makes the September ship date a consent-policy deadline for whoever owns acceptable use, not a gadget review.
Perspective Coverage
3 publishers
- Builder
- Builder 37%
- Operator
- Operator 41%
- Investor
- Investor 22%
Reality
- Evidence55
- Adoption
- Insufficient
- Hype gap+30
- Incentives65
- Confidence55
More than 11,000 UK claimants, two named analytics providers and no admission of liability have produced a hard figure for what one app's pre-2020 profile data was worth, payable in two £13m tranches.
Perspective Coverage
5 publishers
- Builder
- Builder 23%
- Operator
- Operator 51%
- Investor
- Investor 26%
Reality
- Evidence72
- Adoption
- Insufficient
- Hype gap+12
- Incentives60
- Confidence74
Three separate IDs and one Postgres row per retry let an investigator list every attempt for a tenant in order, according to a dev.to design. Adopting it means carrying an operation ID into every enqueue call, and its sample redactor lets bearer tokens through.
Reality
- Evidence40
- Adoption
- Insufficient
- Hype gap+15
- Incentives
- Insufficient
- Confidence45
A federal judge granted LinkedIn's motion to dismiss for lack of standing and gave the plaintiffs leave to amend, while writing in the same order that he doubts they can allege a privacy violation at all. LinkedIn never denied the scanning.
Reality
- Evidence60
- Adoption
- Insufficient
- Hype gap+15
- Incentives70
- Confidence66
The Data Protection Commission's EUR 403m penalty, its fourth-largest under GDPR, covers 620 days of location processing that ended in February 2020. Against Alphabet's reported revenue that is about 0.15 percent.
Perspective Coverage
5 publishers
- Builder
- Builder 19%
- Operator
- Operator 49%
- Investor
- Investor 32%
Reality
- Evidence78
- Adoption
- Insufficient
- Hype gap+10
- Incentives50
- Confidence75
Ireland's Data Protection Commission found lawfulness, fairness and retention failures in Web & App Activity and Location History, and transparency failures in all three location features it examined. One of them runs for Android users who never signed in.
Perspective Coverage
12 publishers
- Builder
- Builder 22%
- Operator
- Operator 53%
- Investor
- Investor 25%
Reality
- Evidence80
- Adoption
- Insufficient
- Hype gap+5
- Incentives40
- Confidence75
Republicans and Democrats on the Senate crime subcommittee both objected that plate reader vendors leave abuse detection to the police departments buying the cameras, and the four invited chief executives did not appear.
Reality
- Evidence52
- Adoption61
- Hype gap+28
- Incentives74
- Confidence56
Writing for the Forbes Tech Council, Phenomenon Studio co-founder Polina says fintech apps can adapt insights and notifications while navigation, balance placement and transaction buttons stay fixed. Her readiness test starts at a thousand monthly active users.
Reality
- Evidence32
- Adoption
- Insufficient
- Hype gap+15
- Incentives68
- Confidence55
Keeping the Iceberg table format governance-unaware was a deliberate call. That leaves the catalog as the only thing standing on the path of every read. A dev.to guide lists six pieces an operator has to source above it.
Reality
- Evidence42
- Adoption25
- Hype gap+22
- Incentives74
- Confidence45
An OECD survey of 6,047 employers found this software in most workplaces on both continents. The countries split over what firms are allowed to do with it, and most of these tools are not AI at all.
Reality
- Evidence68
- Adoption82
- Hype gap+8
- Incentives30
- Confidence62
The EU AI Act wants AI system logs kept for six months and the GDPR wants personal data dropped when it stops being necessary. A challenge project stores the workflow that settles that gap as content both an agent and a person query.
Reality
- Evidence62
- Adoption8
- Hype gap+8
- Incentives70
- Confidence60
Paris prosecutors have opened at least one criminal case over street videos of women filmed without consent. The data regulator has fewer than ten workplace complaints on file and a growing queue of employers asking about bans.
Reality
- Evidence45
- Adoption55
- Hype gap+10
- Incentives60
- Confidence50
The $5.08 million average comes from IBM and the $139,875 median from Verizon, one a mean and one a median across different samples, so 36 to 1 is an order of magnitude. Even discounted, the money sits in downtime.
Reality
- Evidence45
- Adoption
- Insufficient
- Hype gap+35
- Incentives92
- Confidence55
Earlier coverage
- A GDPR breach filing in Spain credits the entire intrusion to an LLM agent
Security · September 16, 2026 · 1 publisher
- Benioff says the war destroyed both of Salesforce's UAE backup data centres
Product · September 16, 2026 · 1 publisher
- Swansea audit of all 624 UK-licensed gambling sites puts 86% in breach of GDPR
Science · September 16, 2026 · 1 publisher
- General Catalyst led Complir's $11M seed after three meetings and a phone call
Invest · September 15, 2026 · 1 publisher
- The EU AI Act pushes training-data provenance down into the crawler
Build · September 15, 2026 · 1 publisher
- Aeon needs nearly 10,000 individual consents before Aware Health's records can move
Invest · September 14, 2026 · 1 publisher
- A $300 solver bill leaves CAPTCHA at 5% of a credential run's cost of goods
Build · September 13, 2026 · 1 publisher
- An unquantized model on the main thread cost a health app its screening feature
Build · September 13, 2026 · 1 publisher
- LG's rebuttal shrinks the TV spying story to a wake-word question
Product · September 12, 2026 · 3 publishers
- Kiteworks buys Bonfy.AI to decide on sensitive data in the instant it leaves
Invest · September 12, 2026 · 1 publisher
- Three of Four Append-Only Leak Notes Trace to the Same Actor Class
Build · September 11, 2026 · 1 publisher
- Running costs overtake a $1,500 automation build in seven and a half months
Build · September 11, 2026 · 1 publisher
- Kiteworks buys Bonfy.AI to move data classification into the send path
Security · September 11, 2026 · 2 publishers
- Stadtwerke Landsberg names eight service lines that stayed up while its office IT was encrypted
Security · September 10, 2026 · 2 publishers
- A weekend inside KYC pushes the funded-deposit event to the edge of Meta's seven-day window
Build · September 10, 2026 · 1 publisher
- Trust3 AI's co-founder puts four runtime agent controls outside the governance committee's remit
Leadership · September 10, 2026 · 1 publisher
- The AI Act's top fine stays at 35 million euros until turnover passes 500 million
Build · September 10, 2026 · 1 publisher
- The EUDI Wallet hands your KYC pipeline a signature instead of a document photo
Build · September 10, 2026 · 1 publisher
- Berlin published the staffing plan for refusing a ransom
Product · September 6, 2026 · 1 publisher
- Swansea study puts 86% of licensed British gambling sites in breach of cookie consent rules
Leadership · September 6, 2026 · 1 publisher
- AWS ships one TTL knob for agent memories its own guidance gives three different clocks
Build · September 4, 2026 · 1 publisher
- CNIL puts €500,000 on the control gaps behind a 727,113-record hospital breach
Security · September 3, 2026 · 1 publisher
- Krebs traced 153 million leaked driver's licence scans to a single Louisiana ID verifier
Product · September 3, 2026 · 1 publisher
- A Lenovo ID registered with a stranger's email opened 5,000 Dropbox accounts
Product · September 2, 2026 · 1 publisher
- Chatbot Logs Are Entering Discovery. OpenAI's User-Content Disclosures Quadrupled.
Security · September 2, 2026 · 1 publisher
- The AI Act turns your hosting choice into an audit artifact
Build · September 2, 2026 · 1 publisher
- The CRA's 24-hour exploitation clock starts 456 days before its engineering rules do
Security · September 1, 2026 · 1 publisher
- A 12-pixel threshold is what keeps every scroll out of this cookieless tap dataset
Build · September 1, 2026 · 1 publisher
- GDPR's portability right stops at the embeddings your vendor built from your prompts
Build · August 30, 2026 · 1 publisher
- Team-scoped gateway keys tag org, team and user identity for AI spend dashboard
Build · August 30, 2026 · 1 publisher
- The low bid prices one fifth of the software
Leadership · August 29, 2026 · 1 publisher
- An atomic claim on one flow record makes a duplicate OAuth callback harmless
Build · August 28, 2026 · 1 publisher
- Pre-filtering strands AI detection on a fifth of the environment's telemetry
Security · August 27, 2026 · 1 publisher
- Google's legal AI play is a connector list, and Harvey is on it
Product · August 26, 2026 · 1 publisher
- Brazil fined ByteDance for data it took from users who never logged in
Product · August 25, 2026 · 1 publisher
- Uber's 825 million euro lesson: the missing human is the violation
Security · August 25, 2026 · 2 publishers
- NIST's multi-cloud tally: one resilience win against 23 new problems
Security · August 24, 2026 · 1 publisher
- Erasure assumes a row you can find. A trained model does not have one.
Build · August 24, 2026 · 1 publisher
- Encrypted, then readable: Korea's startup platform shipped the key inside the API
Security · August 24, 2026 · 1 publisher
- 150 Jenkins masters, one control plane: the fix for CI sprawl was not a migration
Product · August 24, 2026 · 1 publisher