EU AI Act Article 50 has been in force since 2 August 2026. It imposes four transparency duties: tell people when they are interacting with an AI system, mark AI-generated output so machines can detect it, disclose emotion recognition and biometric categorisation, and label deepfakes and AI-generated public-interest text. The Commission finalised the Code of…

The short answer There is no such thing as an “EU AI Act compliance certificate.” Regulation (EU) 2024/1689 (the EU AI Act) creates no certificate, seal or scheme that certifies an organisation, a product or a person as “AI Act compliant.” No regulator, notified body or private company can issue one. What the AI Act…

Article 50 of the EU AI Act has been enforceable since 2 August 2026. It requires disclosure whenever a person interacts with AI or is exposed to AI-generated or manipulated content. This page sets out what it requires, who it binds, the real deadlines, and how compliance looks in practice.

“GDPR policy” is not a single document. Organisations searching for a GDPR policy template are usually looking for one of six distinct instruments, and downloading the wrong one produces a document that satisfies nothing. The six are a privacy notice for individuals, an internal data protection policy for staff, a cookie policy, a data retention…

The Cyber Resilience Act is a regulation, applying directly across all 27 member states without national transposition. CRA enforcement is not centralised. Member states designate their own authorities, and a manufacturer placing products across the EU may deal with several of them. Four distinct roles in CRA enforcement exist and they are frequently confused. Market…

The NIS2 Directive in practice: scope, the ten mandatory security measures, incident reporting clocks, management liability, and what UK organisations need to know.

Where the Cyber Resilience Act and the AI Act apply to the same product, which obligations duplicate, which conflict, and how to build one compliance programme instead of two.

ENISA’s Single Reporting Platform goes live on 11 September 2026. What it does, who registers, what the 24-hour clock actually requires, and what you can prepare before the URL is published.

What the EU Cyber Resilience Act is, when it takes effect, and why Brexit does not put UK software and hardware companies outside its scope.

What Annex I actually requires, why the September 2026 reporting deadline makes SBOMs urgent before they are legally mandatory, and how to build a compliant component inventory.