#CyberWeekly

New signs go up on August 2. Everyone on the road has to read them.

On 2 August 2026 the transparency rules of the EU AI Act (Article 50) start to apply, and they land on ordinary businesses, not just AI labs. The headline rule is simple: when a person is dealing with an AI system, they have to be told. If you run a chatbot, a voice assistant or an AI that talks to customers, it has to make clear it is a machine, not a colleague.

• Tell people they are talking to AI: any AI system that interacts with a person must disclose that it is AI, unless it is obvious. A support chatbot on your website is the everyday example.
• Label AI-generated content: AI-generated or AI-manipulated images, audio, video and certain text must be marked as artificial. This matters the moment you use generative AI for marketing images, product photos or public-facing copy.
• Machine-readable marking: providers of generative AI have to mark their outputs so software can detect they are synthetic. If you build on top of one, check what marking it already applies.
• One breathing-space clause: for AI systems already on the market before 2 August, the content-marking obligation gets a grace period until 2 December 2026. The core "tell people it is AI" duty is not delayed.

Note the moving parts: the EU's Digital Omnibus package pushed back several high-risk AI deadlines, but Article 50 transparency was not one of them. It stands. For a small business the practical first step is an inventory: list where AI touches a customer, then make sure each spot says so and labels what it generates. Our guides on labelling AI-generated content and setting an acceptable-AI-use policy walk through both.

Nobody sets off on a road trip without knowing what the trip costs.

Our public pricing got clearer this week, and the change is aimed squarely at Belgian small businesses and the managed service providers (MSPs) who serve them. Three things that were fuzzy are now stated in the open, in Dutch, French and English.

• The margin calculator now models your smallest clients: it used to skip the XS bracket, which is the most common Belgian small-business size. Now you can model an XS client and see the real margin on the smallest engagements, using the same numbers as the pricing table above it. No more guessing on the clients you actually have most of.
• Billing cadence, stated plainly: we invoice a year at a time, and the homepage now says so and says why. It is an operational choice, not a lock-in: there is no annual discount to unwind, so if a partner wants monthly, that is fine. Nothing hidden, nothing to negotiate out of.
• One price, not three: older, superseded pricing tiers were pulled from the public pages so what you read is what you pay. The per-client model is the only model.

The point of all of it is a quote you can trust on the first read. See the full breakdown on our pricing comparison page, every MSP tier and per-client bracket in the open.

Lose the map mid-journey and the whole country stops moving.

A hacker logged into Romania's national land registry with a valid username and password, then deleted it: the entire property database and the agency's email servers, gone. The target was ANCPI, the national cadastre and land-registration agency (Risky Business, week of 20 July). For roughly a week the country's property market simply stopped: notaries could not record sales, and citizens could not prove who owned what.

• No exploit, just a login: the attacker did not break down a door, they walked through it with working credentials, then mapped the internal network before pulling the trigger. This is the credential-theft playbook, and it is why multi-factor authentication (MFA) on every account that reaches sensitive systems is not optional.
• This was destruction, not theft: after a failed extortion attempt, the attacker wiped the data instead of selling it. Ransomware plans for locked files; a wipe plans for gone files. Different attack, same recovery muscle.
• An offline backup saved the country: the connected backups were deleted along with everything else, but the agency held a separate offline copy, and that copy is what made rebuilding possible. Backups only count if a wipe cannot reach them. A backup on the same network as the thing it protects is not a backup, it is a second victim.

The lesson scales straight down to a Belgian small business: control who can log in (what to do when it goes wrong) and keep at least one backup a wipe cannot touch (the backup basics). Both are baseline CyberFundamentals (CyFun) controls for a reason.

The cones are back out, and one lane is already blocked.

A fresh Microsoft SharePoint flaw is being exploited in the wild, one week after last issue's record patch pile. This is not the same bug as last week.

• SharePoint CVE-2026-58644 (patch now): a critical remote-code-execution flaw scored 9.8 out of 10. Microsoft updated its bulletin on 15 July to confirm active exploitation, and the US cyber agency (CISA) set a federal fix-by date of 19 July on its Known Exploited Vulnerabilities (KEV) list. On-premises SharePoint runs a lot of Belgian document workflows, so treat this as urgent.
• Fortinet FortiSandbox, two flaws on the KEV list: CVE-2026-25089 and CVE-2026-39808 were both added after evidence of active exploitation. If you or your IT partner run FortiSandbox, patch it.
• Spring Security bypass (CCB advisory, 17 July): the Centre for Cybersecurity Belgium (CCB) flagged an authentication-bypass flaw in Spring Security's Authorization Server. It is a building block behind many login systems, so this one is for your developers and suppliers.
• The AI-supply-chain one to watch: a flaw in the ServiceNow AI platform allowed unauthenticated remote code execution. As last week's AI Act story shows, the AI tools you bolt on are now part of the attack surface too.

Volume and speed like this are exactly why patching needs a standing rhythm plus a 48-hour fast lane for the exploited ones. The rota is in our patch management guide.

Once an issue, our in-house AI gets the floor. T.A.R.S. drafts your compliance policies on the clock; this week it read the new rulebook about itself.