> ## Content Index > Fetch the complete content index at: https://www.thedecisionlayer.online/llms.txt > Use this file to discover other available public pages before exploring further. # Regulatory Radar™ — Regulation Is Redrawing the Decision Boundary. - URL: https://www.thedecisionlayer.online/regulatory-radar-issue-03/ - Published: 2026-10-27T15:46:52.000Z - Updated: 2026-10-27T15:46:52.000Z - Description: Regulation does more than change the rules. It changes which decisions must be made, who may make them, what evidence must exist and when an existing approval deserves to be reopened. - Author: Maman Ibrahim - Tags: Regulatory Radar, Decision Infrastructure, AI Governance, #decision-layer-compass, #intelligence-edition Regulatory Radar · Issue 03The Decision Layer™ · Week 4 # Regulation Is Redrawing the Decision Boundary. Thirty-six days remain to the AI Act's 2 December transition point. The first harmonised standard supporting the AI Act is now published in the Official Journal. Cyber Resilience Act reporting is live. The board question is no longer only what the rules require. It is which decisions must now be classified, evidenced, reported, stopped or reopened. **Scheduled**27 October 2026 **Read time**9 minutes **Cycle**Week 4 of 4 **DI focus**Boundaries + Evidence + Reopening 01 · The 36-day clock ## The next deadline is an engineering decision, not merely a legal date. Article 50 transparency obligations under the EU AI Act have applied since **2 August 2026**. A limited transitional period applies only to the marking and detection obligation in Article 50(2) for systems placed on the market before that date. Those providers must comply from **2 December 2026**. On 27 October, that is thirty-six days away. The practical work is not a sentence in a policy. Someone must determine which outputs are in scope, which systems need machine-readable marking, where exceptions apply, how evidence will be retained, who can approve an exception, and what happens when a provider changes the capability underneath the service. The Commission's enforcement framework also makes another 2 December boundary visible: additional prohibited-practice provisions relating to the generation or manipulation of non-consensual intimate material and child sexual abuse material begin to apply on that date. > A regulatory deadline becomes a Decision Infrastructure problem when compliance depends on who is authorised to make the call before the clock runs out. Decision boundary For every in-scope system, identify who may decide that content is subject to marking, who may approve an exception, who can stop release when marking fails, and what change would reopen the classification. 02 · What moved since the last radar ## The AI Act now has its first harmonised standard. On **14 October 2026**, Commission Implementing Decision (EU) 2026/2274 published the reference to **EN 18286:2026, Artificial intelligence – Quality management system for EU AI Act regulatory purposes**, in the Official Journal. The consequence is practical. Providers of high-risk AI systems that implement the standard can benefit from a **presumption of conformity with the Article 17 requirements covered by the standard**. The Commission describes EN 18286 as lifecycle-based and designed to sit on top of existing management systems such as ISO/IEC 42001, ISO 9001 or sector-specific quality systems rather than requiring a parallel architecture. Classify ### Does Article 17 apply? Determine the provider role, high-risk classification and the requirements the organisation must satisfy. Choose ### Which conformity route? Decide whether EN 18286 will be adopted, integrated with an existing QMS or used as the benchmark for gap assessment. Evidence ### Can the QMS prove operation? The decision is not complete when the standard is selected. Scope, ownership, lifecycle evidence and exceptions still need to be defensible. Decision Infrastructure implication A harmonised standard does not outsource the decision. It changes the evidence available to support it. Boards should ask which AI systems rely on the presumption-of-conformity pathway, which Article 17 obligations are actually covered, and who owns the residual gap. 03 · Cyber Resilience Act ## Reporting is live, and the reporting route is now operational. Since **11 September 2026**, manufacturers of products with digital elements have been required to report actively exploited vulnerabilities and severe incidents. The CRA Single Reporting Platform is operational, giving manufacturers one reporting route for the notification workflow. The clock is now more specific than the original draft captured: an **early warning is due within 24 hours**, followed by a **full notification within 72 hours**. For an actively exploited vulnerability, the final report is due no later than 14 days after a corrective or mitigating measure is available. For a severe incident, the final report is due within one month of the 72-hour notification. Detect ### Technical teams identify the signal. Telemetry, vulnerability intelligence and incident handling establish what may have happened. Decide ### Someone must classify the event. The clock does not pause while Legal, Security, Product and Compliance debate whether the threshold has been met. Act ### The report must leave the organisation. Authority to submit, amend, escalate and complete the final report must exist before the incident occurs. The reporting clock exposes a familiar weakness: organisations often define accountability after an incident, when regulation expects the decision path to exist before one. 04 · NIS2 still demonstrates jurisdictional drift ## A European obligation can still produce different operational decisions by country. On 8 July 2026, the European Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice for failing to notify full transposition of NIS2, and requested financial sanctions. The Commission's transposition pages remain a state-of-play exercise based on Member State notifications. For groups operating across Europe, the governance mistake is to treat “NIS2” as one operational instruction. The directive establishes a common framework. The organisation still needs to know which national rule, competent authority, and local process governs the decision in each jurisdiction. Decision consequence Cross-border compliance needs a jurisdiction-specific decision map. Who decides whether an incident is reportable, who owns the notification, and which local evidence must be preserved cannot be left to a generic EU policy. 05 · Regulatory radar | Regime | Position at 24 Oct 2026 | Decision affected | Reopening implication | | ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------- | | EU AI Act · Article 50 | Transparency duties apply from 2 Aug 2026\. The limited Article 50(2) transition for pre-existing systems ends 2 Dec 2026. | Which content and systems require disclosure, machine-readable marking, or technical changes. | Reopen classification when model capability, output type, provider, or deployment context changes. | | EU AI Act · EN 18286:2026 | Reference published in the Official Journal on 14 Oct 2026 through Implementing Decision (EU) 2026/2274, creating a presumption-of-conformity route for covered Article 17 QMS requirements. | Whether and how the provider integrates the harmonised AI QMS into its existing governance and quality architecture. | Reopen the conformity decision when high-risk classification, provider role, system design or QMS scope changes materially. | | EU AI Act · enforcement | AI Office and national-authority enforcement powers apply progressively. Additional Article 5 prohibitions identified by the Commission apply from 2 Dec 2026; Annex III high-risk rules follow on 2 Dec 2027 and Annex I product-linked rules on 2 Aug 2028. | Which systems must be prohibited, redesigned, escalated or brought into the high-risk compliance programme. | Reopen approval when a system enters a new legal category or its intended purpose changes. | | Cyber Resilience Act | Reporting obligations live since 11 Sep 2026 through the Single Reporting Platform: 24-hour early warning, 72-hour full notification, plus event-specific final reporting. | Who may classify, submit, amend and close a regulatory report under time pressure. | Reopen incident authority when product ownership, reporting routes, supplier responsibilities or material facts change. | | NIS2 | Transposition remains uneven. Ireland, Spain, France and the Netherlands were referred to the CJEU on 8 Jul 2026 for failure to notify full transposition. | Which national reporting and management obligations apply to each entity and jurisdiction. | Reopen the local compliance decision when national implementing law or competent authority changes. | 06 · What regulation is really changing ## External rules are becoming internal authority and evidence maps. A deadline does not implement itself. A harmonised standard does not decide its own scope. A reporting obligation does not choose its owner. A transparency rule does not determine which engineer may block a release. Regulation increasingly reaches the exact questions Decision Infrastructure asks. Regulatory change→Decision affected→Owner→Evidence→Reopening trigger The useful unit of regulatory intelligence is not the rule alone. It is the decision that the rule changes. 07 · Actions before the next cycle | Action | Test of completion | Owner | | ------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------- | | Close the Article 50 marking decision | Every potentially in-scope system has a named classification owner, technical action, and exception path before 2 December. | AI Governance / Legal / Product | | Decide the EN 18286 route | Each relevant high-risk AI programme has documented whether EN 18286 will be adopted, integrated or used as a gap benchmark, with a named QMS owner and residual obligations mapped. | AI Governance / Quality / Risk | | Test the 2 December prohibited-practice boundary | Relevant product and content teams have confirmed whether the new Article 5 prohibitions affect any existing or planned capability and have a stop path where required. | Legal / Product / Trust & Safety | | Pre-authorise CRA reporting decisions | The 24-hour, 72-hour and final-report workflow names who can classify, submit, amend and escalate without waiting for a new committee. | CISO / Product Security / Legal | | Map NIS2 by entity | Each in-scope European entity knows the applicable national rule, competent authority, and reporting owner. | CRO / Legal / CISO | | Add regulation to reopening triggers | Material legal, supervisory, or harmonised-standard changes automatically cause affected AI decisions to be reconsidered. | Company Secretary / Risk | 08 · Board questions 1. Which regulatory deadline in the next 90 days still depends on an unresolved management decision? 2. Which high-risk AI systems will use EN 18286:2026 as part of their Article 17 conformity evidence, and who owns what the standard does not cover? 3. Which AI systems need an Article 50 marking decision before 2 December? 4. Who can make a CRA reportable-event classification and submit through the Single Reporting Platform without waiting for a committee? 5. Where are we using one group policy for an obligation whose operational decision varies by jurisdiction? 6. Which regulatory or standards change would automatically reopen an existing AI approval? Decision Infrastructure View Primary components **BOUNDARIES + EVIDENCE + REOPENING** Decision affected Which actions AI systems, operational teams, and accountable executives may take, which conformity path they rely on, and when regulatory change invalidates an earlier approval. Accountable owner The executive owner of the affected decision, supported by Legal, Compliance, Quality and Security. Not those functions by default. Evidence required System classification, Article 50 status, EN 18286 applicability and gap map, jurisdiction map, CRA reporting authority, technical marking status, exception rationale and decision record. Reopening implication Regulatory changes, new harmonised standards and material system changes should be explicit reopening triggers when they alter authority, evidence, classification or autonomy assumptions. Sources European Commission, [Transparency obligations under Article 50 of the AI Act](https://digital-strategy.ec.europa.eu/en/faqs/transparency-obligations-under-article-50-ai-act?ref=thedecisionlayer.online), revalidated 24 October 2026\. European Commission, [First harmonised standard supporting the AI Act published in the Official Journal](https://digital-strategy.ec.europa.eu/en/library/first-harmonised-standard-supporting-ai-act-published-official-journal?ref=thedecisionlayer.online), 19 October 2026\. European Commission, [Commission Implementing Decision (EU) 2026/2274](https://eur-lex.europa.eu/eli/dec%5Fimpl/2026/2274/oj?ref=thedecisionlayer.online), published 14 October 2026\. European Commission, [The enforcement framework of the AI Act](https://digital-strategy.ec.europa.eu/en/policies/enforcement-ai-act?ref=thedecisionlayer.online), revalidated 24 October 2026\. Regulation (EU) 2026/1744, [Digital Omnibus on AI](https://eur-lex.europa.eu/eli/reg/2026/1744/oj?ref=thedecisionlayer.online), 24 July 2026\. European Commission, [Cyber Resilience Act reporting obligations](https://digital-strategy.ec.europa.eu/en/policies/cra-reporting?ref=thedecisionlayer.online), revalidated 24 October 2026\. European Commission, [NIS2 referral of Ireland, Spain, France and the Netherlands](https://digital-strategy.ec.europa.eu/en/news/commission-refers-ireland-spain-france-and-netherlands-court-justice-failing-transpose-rules?ref=thedecisionlayer.online), 8 July 2026\. European Commission, [NIS2 transposition state of play](https://digital-strategy.ec.europa.eu/en/policies/nis-transposition?ref=thedecisionlayer.online), revalidated 24 October 2026\. The line to remember Regulation is not only changing the rules. It is redrawing who must decide, and what evidence must survive the decision. The strongest regulatory radar does not end with “what changed?”. It continues to: **which decision changed, who owns it, what evidence is now required, and should an existing approval be reopened?** Decision Infrastructure · Authority · Evidence · Boundaries · Traceability · Challenge · Reopening **Next cycle:** Board AI Risk Intelligence, 3 November 2026\. *Approval Is Not Evidence.*