regulation

Tiers are decided by use, not by model. And for high-risk providers, Article 15 makes AI security a legal requirement.

Location of the office is not the test. Where the system is placed, used, or where its output is used, is.

There is no single 'AI incident' notification rule. The incident is usually a personal-data, contractual or sector incident that happens to involve AI, and the clock may already be running.

Frontier labs promise to add safeguards when models cross capability thresholds. A large share of those safeguards are security controls, and someone has to build and prove them.