AI Security Weekly
Issue #17 — July 2026
The Voluntary Conformity File, Twenty Days Out
Article 50 of the EU AI Act binds August 2, 2026. What sits between Article 50 and Annex III’s December 2, 2027 date is the voluntary conformity file — a document nothing yet requires but that market surveillance authorities, procurement desks, and reinsurance underwriters will read starting now. The file becomes the market’s first legible high-risk artifact before any statute forces it into existence.
The July CISA Cluster and the Industrial Control Surface
The July CISA cluster — OpenPLC v3, Schneider PowerChute, Schneider Easergy, and four additional ICS advisories — forms the industrial control surface the voluntary conformity file cannot ignore. Seven advisories in a single wave, landing at the intersection of the Article 50 window and the Annex III lead time, become the concrete evidence base authorities will read as they interpret the transparency obligations that bind next month.
Market Index W28 — The Flattest Motion Since Ship
Market Index W28: 38.4 ↓ -0.1 from W27’s 38.5 — the flattest single-week motion under v3.1 since ship. The composite holds against a week where the regulatory center of gravity, the ICS advisory wave, and the Claude Code disclosure dispute each pulled in different directions. Per-signal VSS 55.1, TSS 51.5, AIRS 38.8. Two consecutive weeks the deterministic ranker has read the same regulatory pulse.