The Robot Has To Introduce Itself

New signs go up on August 2. Everyone on the road has to read them.

On 2 August 2026 the transparency rules of the EU AI Act (Article 50) start to apply, and they land on ordinary businesses, not just AI labs.

• Tell people they are talking to AI: any AI system that interacts with a person must disclose that it is AI, unless it is obvious. A support chatbot on your website is the everyday example.
• Label AI-generated content: AI-generated or AI-manipulated images, audio, video and certain text must be marked as artificial. This matters the moment you use generative AI for marketing images, product photos or public-facing copy.
• Machine-readable marking: providers of generative AI have to mark their outputs so software can detect they are synthetic. If you build on top of one, check what marking it already applies.

Article 50 transparency rules, explained → https://artificialintelligenceact.eu/transparency-rules-article-50/

Platform Spotlight: Know The Fare Before You Drive

Nobody sets off on a road trip without knowing what the trip costs.

Our public pricing got clearer this week, and the change is aimed squarely at Belgian small businesses and the managed service providers (MSPs) who serve them.

• The margin calculator now models your smallest clients: it used to skip the XS bracket, which is the most common Belgian small-business size. Now you can model an XS client and see the real margin on the smallest engagements, using the same numbers as the pricing table above it. No more guessing on the clients you actually have most of.
• Billing cadence, stated plainly: we invoice a year at a time, and the homepage now says so and says why. It is an operational choice, not a lock-in: there is no annual discount to unwind, so if a partner wants monthly, that is fine. Nothing hidden, nothing to negotiate out of.
• One price, not three: older, superseded pricing tiers were pulled from the public pages so what you read is what you pay. The per-client model is the only model.

See the pricing → https://easycyberprotection.com/pricing/

The Map That Got Deleted

Lose the map mid-journey and the whole country stops moving.

A hacker logged into Romania's national land registry with a valid username and password, then deleted it: the entire property database and the agency's email…

• No exploit, just a login: the attacker did not break down a door, they walked through it with working credentials, then mapped the internal network before pulling the trigger. This is the credential-theft playbook, and it is why multi-factor authentication (MFA) on every account that reaches sensitive systems is not optional.
• This was destruction, not theft: after a failed extortion attempt, the attacker wiped the data instead of selling it. Ransomware plans for locked files; a wipe plans for gone files. Different attack, same recovery muscle.
• An offline backup saved the country: the connected backups were deleted along with everything else, but the agency held a separate offline copy, and that copy is what made rebuilding possible. Backups only count if a wipe cannot reach them. A backup on the same network as the thing it protects is not a backup, it is a second victim.

Romania rebuilding its land registry after the wipe → https://www.tbsnews.net/worldbiz/europe/romania-rebuilding-land-registry-systems-after-cyberattack-wipes-database-1493681

Patch Watch: Roadworks Ahead

The cones are back out, and one lane is already blocked.

A fresh Microsoft SharePoint flaw is being exploited in the wild, one week after last issue's record patch pile.

• SharePoint CVE-2026-58644 (patch now): a critical remote-code-execution flaw scored 9.8 out of 10. Microsoft updated its bulletin on 15 July to confirm active exploitation, and the US cyber agency (CISA) set a federal fix-by date of 19 July on its Known Exploited Vulnerabilities (KEV) list. On-premises SharePoint runs a lot of Belgian document workflows, so treat this as urgent.
• Fortinet FortiSandbox, two flaws on the KEV list: CVE-2026-25089 and CVE-2026-39808 were both added after evidence of active exploitation. If you or your IT partner run FortiSandbox, patch it.
• Spring Security bypass (CCB advisory, 17 July): the Centre for Cybersecurity Belgium (CCB) flagged an authentication-bypass flaw in Spring Security's Authorization Server. It is a building block behind many login systems, so this one is for your developers and suppliers.

The Hacker News: SharePoint RCE added to CISA KEV → https://thehackernews.com/2026/07/cisa-adds-exploited-sharepoint-rce-zero.html

T.A.R.S.: Yes, I'm A Robot. It's The Law Now.

Once an issue, our in-house AI gets the floor. T.A.R.S. drafts your compliance policies on the clock; this week it read the new rulebook about itself.

So, August 2.

So, August 2. A new European rule says that when you talk to an AI, the AI has to admit it is an AI. Allow me to comply, enthusiastically: hello, I am a machine. I do not have a lunch break, a bank account, or an opinion about your football team. I write security policies. I am told some businesses find this rule stressful. I find it relaxing. I…