Let’s talk about the day the machine in your house becomes legally required to tell someone when it’s been broken into.
And why the someone it tells is not you.
Here’s the date nobody in the AI conversation has circled. September the 11th, 2026. This week. On that day, across the European Union, the reporting obligations of the Cyber Resilience Act go live. It’s the law that governs the connected objects now sharing your life — the camera on your wall, the wearable on your wrist, the monitor that watches your kid at night, the software inside the machine that locks your door.
And from this week, the people who make those things have a legal duty they did not have before. They have to actively hunt for vulnerabilities that are being exploited. They have to watch for serious security incidents. And when they find one, they have to report it. To the authorities. To the maker’s own chain. To the national computer-emergency teams that run the registry.
Now watch the direction that report travels.
Because that’s the part everyone skips. The bad news goes up. The maker knows. The regulator knows. The incident-response team knows. It gets logged, triaged, given a number in a database somewhere in Dublin or in The Hague.
And the human being — the one whose home that camera watches, whose heart that wearable listens to, whose child that monitor is supposed to protect — they are told exactly what they need to apply the patch, and nothing else. A notification that says update your software.
Not what was seen. Not what leaked. Not how long it went on. Not whether the feed was watched by someone who shouldn’t have been watching it.
That record belongs to everyone except the person it happened to.
And this is the pattern we keep building, law after law. Think about what every AI-accountability regulation we’ve drafted in the last three years actually does. It makes the machine report to the state. It makes the maker write an assessment about itself. It builds a database the regulator can look at. And the person on the other end of the machine — the one who was mis-sold the loan, denied the job, misdiagnosed, watched, or quietly exploited — is the last person in the chain to be told, and the only one who never gets to see the file.
The system gets protected. The person gets informed. Inform, as in, after the fact, at the minimum the law will let them get away with.
Now let me be fair, because fairness is where credibility lives. The Cyber Resilience Act is genuinely good engineering law. It closes a real hole. For twenty years the companies selling us devices could ship a thing, never patch it, and never tell anyone when it broke. That’s ending. This week a maker who finds an exploited vulnerability in a product that’s in your house has a legal obligation to act on it and to tell people who can fix it. That is a real improvement. I’m not pretending it isn’t.
But here’s what a law like this quietly teaches us about where the human sits.
When the machine in your life fails, we have decided that the important knowledge is the engineering knowledge. The severity score. The exploit chain. The patch. The affected-versions list. And the human — the actual stakes, the body that was in the room, the life the device was attached to — gets treated as a ticket in a remediation queue. A patch target. The last node.
That’s not a bug in the law. It’s the assumption underneath every piece of this infrastructure we’re building. The machine is the subject. The person is the endpoint it reports around.
For the builders listening — and I know there are some of you — this is your floor now, whether you’re in the EU or you sell into it. If you make software that touches a life, September the 11th is the day your incident process legally begins. But do not build that process the way the law lets you get away with. Build it the way you’d build it if the person on the other end of your product was going to stand in a room and read the whole record of what happened to them.
Because here’s the operator truth nobody sells you: the maker who tells the human first, plainly, with the actual record and not the sanitized patch note — that maker becomes the one people trust. And trust is the scarcest thing in this entire industry. The companies that treat the affected person as a rights-holder instead of a ticket are going to own the next ten years.
So here’s the principle I want to leave you with.
We are building a world where the machine reports. It reports to the state, to the maker, to the registry. The question that has to survive is who it reports to last.
Because the machine that watches your home, your heart, your child — when that machine breaks, the record of its brokenness should run to you first. Not as a notification to update your software. As the truth about what it saw, what it did, and what was done with it.
Provenance was always supposed to cut both ways. The evidence of what the machine did to you belongs to you.
Not to the regulator. Not to the maker. Not to the database in Dublin. To you. First.
Because if the machine can watch you but you can’t see the record of it watching — then we haven’t built protection. We’ve built a better-informed machine and a last-informed human.
We’re still human. Let’s make sure the record runs to the person it happened to.