AI Security Weekly
Issue #16 — July 2026
The Sixteen-Month Asymmetry
The Council of the EU formally adopted the Digital Omnibus on AI on June 29, 2026. August 2, 2026 stands as the live date for market surveillance authorities, Article 50 transparency, Article 4 AI-literacy compliance, and GPAI penalties. Standalone Annex III applicability stands at December 2, 2027 — sixteen months the authorities will spend reading evidence before the new clock starts.
The June KEV Cluster and the Developer-Surface Cluster
The June KEV additions — SimpleHelp (CVE-2026-48558), SharePoint (CVE-2026-45659), Kemp LoadMaster (CVE-2026-8037), Chrome V8 (CVE-2026-11645) — form a concrete boundary-breach payload landing directly into the sixteen-month window. Alongside the enterprise cluster, the TeamPCP FBI advisory and the Cursor DuneSlide (CVE-2026-50548) disclosure reveal the developer surface the authorities will now read as evidence of the risk environment before Annex III applies.
Market Index W27 — The Regulatory Pulse Registers on the Deterministic Ranker
Market Index W27: 38.5 ↑ +0.9 from W26’s 37.6 — the composite recovers the June softness and the deterministic ranker lands the Signal of the Week on the regulatory pulse the horizon card was already built around. Per-signal VSS 55.1, TSS 51.5, AIRS 38.8. The v3.1 EWMA aggregation now reads two consecutive weeks against the same regulatory center of gravity.