You staffed the deadline that moved
The news: The EU AI Act's transparency rules took effect Sunday. Five days earlier, a second law moved the high-risk deadline everyone tracked from August 2, 2026 to December 2, 2027.
Why it matters: Article 50 binds deployers, not just model vendors. Any EU-facing chatbot, voice agent, or AI-generated content you run is in scope today, with no high-risk classification required. Fine-tune a model on your own data and you requalify as a provider, exposed to €15M or 3% of global revenue.
What to do: List every EU-facing AI touchpoint this morning and confirm each one says it is AI.
The backdoor that survives re-imaging
Proofpoint found a campaign that turns opening an email in Outlook Web Access into code execution. No click required. TA488 exploits CVE-2026-42897 to drop a JavaScript implant called OWAReaper. It hides in browser localStorage and grants mailbox permissions to the Default user. That means it survives credential rotation and a full device re-image. Confirm your July Exchange updates are applied. Then query every mailbox for permissions granted to Default.
Nobody exploited anything. They just logged in.
The FBI and EPA warned Thursday that water utilities in at least seven states lost control of internet-facing PLCs. Attackers changed the controllers' IP addresses and passwords. Effects included loss of pressure and flooding. One operator found altered ladder logic in its project files. No exploit was used, so patching does not close this. Sweep your facilities, building management, and campus networks for any controller or HMI reachable from the internet.
Your hardware quote expires September 1
Qualcomm told customers on July 24 that prices rise by double digits on anything delivered after September 1. Samsung named the cause the same week. DRAM average selling prices rose by the mid-40 percent range last quarter. NAND rose by the high-60 percent range. Demand is outpacing supply, and Samsung guided the second half to stay short. Ask your VAR for firm-priced quotes with written expiry dates. Then read your hardware contract for a component pass-through clause.
Watch This
Seagate said this week that most of its nearline capacity is committed into calendar 2028. AWS reported a $496 billion backlog and said capacity is short. Microsoft said Azure demand exceeds supply. Your 2027 infrastructure negotiation will be about securing allocation, not winning a discount.
Three of the four items above are decisions with a date attached, and the DoGood network is full of people working the same dates. If you run IT or security at a $100M+ company, a peer who already signed the 2027 allocation is worth more than another vendor briefing.
Know a CIO who needs this? Forward it and they can subscribe here.
Enterprise IT leader at a $100M+ company? Apply to join DoGood.