Practical notes on IP and technology law. Updated 7 November 2026.
AI transparency in 2026: reviewing chatbots and generated content
Published 7 November 2026.
Article 50 AI Act transparency duties apply from 2 August 2026. The requirements depend on the business’s role and the particular use case.
Separate user notices from technical marking
The Commission distinguishes notices for interaction with AI from technical marking and disclosure requirements for certain synthetic content. It describes a limited transition until 2 December 2026 for the marking obligation affecting certain systems placed on the market before 2 August 2026.
A procurement and deployment checklist
Identify supplier and deployer roles, affected functions and responsibility for notices, marking and documentation. For a customer-service assistant, test the start of the dialogue, human escalation and error handling. These are practical implementation considerations; supplier terms should also address reuse of inputs and model changes.
Related advice: Artificial intelligence and governance
Source: Official authority guidance
EU design reform 2026: reviewing representations and filing strategy
Published 7 November 2026.
The second stage of the EU design reform applies from 1 July 2026. Applicants should review their representations and filing practices against the updated framework.
Clarity matters at filing
The EUIPO’s updated examination guidelines took effect on 1 July 2026. A sufficiently clear representation is a filing-date requirement. Product families and digital interfaces therefore need careful definition of what is claimed.
Preparing an application
Align views, variants and disclosure dates with the design team. Review whether an existing portfolio covers a redesigned product. For a device with a new housing and interface, consider the distinct subject matters when preparing representations. Registration does not replace assessment of novelty, individual character or third-party rights.
Related advice: Design and product appearance protection
Source: Official authority guidance
Cyber Resilience Act: reporting processes from September 2026
Published 7 November 2026.
Certain Cyber Resilience Act reporting duties apply to manufacturers from 11 September 2026. They concern actively exploited vulnerabilities and severe incidents affecting the security of products with digital elements within the legislation’s scope.
Prepare responsibility and timing
The Commission describes early warning within 24 hours and a full notification within 72 hours of awareness. Final-report timing depends on the reporting trigger. Reporting uses the Single Reporting Platform. This should not be confused with the CRA’s full application.
Supplier coordination
For a connected industrial device, a component vulnerability may require rapid information about affected versions, consequences and remediation. Agree escalation, information and assistance duties with suppliers. Outsourcing technical work does not automatically remove the manufacturer’s own statutory obligations.
Related advice: Cybersecurity and digital products
Source: Official authority guidance
Data Act in practice in 2026: data access and cloud switching
Published 7 November 2026.
The Data Act generally applies from 12 September 2025. In 2026, many businesses are implementing data-access arrangements and reviewing contract models, while checking the relevant transitional provisions.
Describe data access precisely
For connected products, review data categories, access methods, eligible users and third-party disclosure. Personal data and trade secrets require separate consideration; a blanket statement that the manufacturer owns all data is not sufficient.
Make an exit plan usable
For cloud services, specify export formats, interfaces, assistance and timing. For independent predictive maintenance, map product data and the parties’ roles before drafting access and use provisions. These are practical contract-review steps; mandatory duties depend on the service and applicable rules.
Related advice: Data rights and privacy
Source: Official authority guidance