Skip to content
KisunoAI
Self-host for free Get started
Pricing Docs Blog Get started Self-host for free

Law and deadlines

2 December 2026 and 12 January 2027: three workflows that stand up to both deadlines

The regulation that postponed the AI Act’s high-risk deadlines in July 2026 places two obligations on 2 December 2026 at the same time. A good six weeks later, every charge for switching provider comes to an end. This article puts both dates in context, shows three workflows that go with them and says precisely who the obligations reach and who they do not.

Law and deadlines Reading time: 12 minutes

In brief

  • Regulation (EU) 2026/1744 of 8 July 2026 moved the AI Act’s high-risk deadlines to 2 December 2027 and 2 August 2028.1 Almost everywhere that was read as the all-clear.
  • The same regulation places two obligations on 2 December 2026. Providers of systems that generate synthetic content and were placed on the market before 2 August 2026 have until then to meet the machine-readable marking required by Article 50(2).2 And two newly inserted prohibitions apply from exactly that day.3
  • A good six weeks later, on 12 January 2027, providers of data processing services may no longer charge anything for a switch, data egress charges included.4
  • According to Eurostat, 19.95% of EU enterprises with ten or more employees used artificial intelligence in 2025.5 For most of them, 2 December 2026 reaches their supplier and not them, and that distinction is exactly what the later part of this article works out.

What changed in July, and what got lost in the noise

On 8 July 2026 Parliament and Council adopted Regulation (EU) 2026/1744, the Digital Omnibus Regulation on artificial intelligence. It was published on 24 July 2026 and has been in force since 27 July 2026.1 The headline was the same everywhere: the obligations for high-risk systems are coming later. That is true, and it is half the news. The other half sits in the same two articles that carry the postponement, and it points in the opposite direction.

The new Article 111(4) reads, in substance: providers of AI systems, including general-purpose AI systems, that generate synthetic audio, image, video or text content and that were placed on the market before 2 August 2026 shall take the necessary steps to comply with Article 50(2) by 2 December 2026.2 Article 50(2) requires the outputs of such a system to be marked in a machine-readable format and detectable as artificially generated or manipulated. The qualifier, as far as technically feasible and measured against the generally acknowledged state of the art, belongs not to the marking itself but to the technical solutions that produce it. The obligation falls away to the extent the system performs an assistive function for standard editing or does not substantially alter the input data or their meaning.6 Article 111(4) is a transitional rule for existing systems, and it runs out in three months.

The new Article 113(3), point (a), sets two newly inserted prohibitions to 2 December 2026, while the rest of Chapter II has applied since 2 February 2025.3 Point (ba) prohibits AI systems that generate or manipulate realistic content depicting the intimate body parts of an identifiable person, or an identifiable person engaged in sexually explicit conduct, without that person’s express consent. Point (bb) covers the generation or manipulation of material within the meaning of Directive 2011/93/EU on combating the sexual abuse of children.7 Fines for infringing Article 5 reach up to €35 million or 7% of worldwide annual turnover, and for infringing the transparency obligations in Article 50 up to €15 million or 3%.8

The second date sits in a different law and is named even less often. Under Article 29(1) of the Data Act, providers of data processing services may no longer impose switching charges from 12 January 2027.4 Switching charges mean more than the words suggest: every charge for the actions involved in switching, expressly including data egress charges, but not the standard service fees and not the early termination penalties.9 On 25 June 2026 the European Commission reached the preliminary view that two large cloud services should be designated as gatekeepers, and expressly based that on lock-in and high switching costs.10 How deep the dependency runs shows in the official statistics: in 2025, 52.74% of EU enterprises with ten or more employees bought paid cloud services, and 77.53% of them count as highly dependent under the Eurostat classification, because they buy sophisticated cloud services.11

  1. 8 July 2026: the high-risk deadlines are postponed
  2. 2 December 2026: marking for existing systems, two new prohibitions
  3. 12 January 2027: no more switching charges
  4. 2 December 2027 and 2 August 2028: high risk under Annex III and Annex I
Four dates on one line. The postponement concerns the two at the back; the ones usually missing from the calendar are the two at the front.

Who it reaches, and how you can tell

The first question is not what to do, but which role your company is in. The AI Act knows providers and deployers, and it means two different sets of obligations by that. A provider is anyone who develops an AI system, or has one developed, and places it on the market or puts it into service under their own name or trade mark. A deployer is anyone who uses an AI system under their own authority.12 The 2 December 2026 deadline in Article 111(4) is addressed to providers. Buy a model and use it inside your own company, and you are a deployer to begin with.

The line does not run along the purchase receipt, though. Anyone who makes a bought-in system available under their own name, say as an enquiry service on their own website or as a tool for customers, puts it into service under their own name and thereby becomes a provider within the meaning of the regulation.12 That is the route by which a deployer slips into a provider’s obligation, and it happens more often than project plans say. So check first whose name a system carries towards the outside world, and only then which deadline applies.

The second question is who carries the assessment work. A survey by Bitkom Research on data protection under the GDPR, among 603 companies in Germany with 20 or more employees interviewed by telephone, records that for 77% the roll-out of new tools sets the assessment going all over again, that 82% see uncertainty about the exact requirements and that 54% complain of inconsistent interpretation within the EU.13 That survey comes from an industry association, and we present it as what it is. The counter-figure from the same survey belongs next to it: 53% consider European data protection an advantage for developing AI in international comparison, 36% a disadvantage.14

Who What triggers the deadline What Kisuno contributes there
Companies that make an AI system available under their own name Article 50(2) applies directly; only for systems placed on the market before 2 August 2026 does Article 111(4) give time until 2 December 2026 A log entry for every call with model, time and person, exportable; the machine-readable marking itself is delivered by the provider of the model
Communications, marketing and editorial work Article 50(4): disclosure for deepfakes and for published text on matters of public interest History and source references for each draft, so that human review and editorial responsibility stay demonstrable
Procurement and IT management Data Act: no switching charges from 12 January 2027, plus exit clauses that already have to be in the contract today MIT licence, source code coming soon, self-hosting without licence costs, export of knowledge bases, conversation histories and audit log
Legal, data protection and compliance Article 5(1), points (ba) and (bb) from 2 December 2026, with fines of up to €35 million or 7% of worldwide annual turnover Permissions per tool and per model in the order user, role, group, server default, every call in the audit log
Public administration and its suppliers Tender documents ask about the processing location, exit and subprocessors, often ahead of the statutory deadline Operation in Green’s ISO 27001 certified data centres in Lupfig or on your own server, where the certification covers the data centres and not us, plus subprocessor list and data processing agreement

The dependency is not a feeling either. In the DIHK digitalisation survey 2026, an association survey with 4,686 responses, 68% of companies rate themselves as largely or completely dependent when it comes to artificial intelligence, and 55% for cloud services.15 Among the companies without AI in use, only a small share have ever considered it, namely 14.21%, and only within that group do missing expertise at 70.89%, unclear legal consequences at 52.52% and data protection concerns at 48.83% come out on top.16 Those shares hold for that group and for nobody else. The table above assigns the two dates to five groups.

Use case 1: showing what was generated when and by which model

A customer notice goes out; three weeks later somebody asks whether the text came from a model and from which one. Today the answer is a reconstruction from memory and mailbox. In the AI workspace it sits in the audit log, the running record of every call: which model, which access, which time, which person, which knowledge base. You export the section that belongs to the case and put it on file.

That is not just tidiness, it is the evidence one of the exceptions in Article 50(4) hangs on. Anyone publishing text in order to inform the public on matters of public interest has to disclose that it was artificially generated, unless the content underwent human review or editorial control and a natural or legal person holds editorial responsibility for it.17 That exception is not a claim, it is a question of fact. Anyone relying on it should be able to show who reviewed it and when.

  1. Query, chosen model and chosen knowledge base
  2. A log entry on every call, on your server
  3. Export of the section that belongs to the case
The evidence comes about while the work happens, not once somebody goes looking for it.

The limit here, plainly stated: a log entry is not a machine-readable marking within the meaning of Article 50(2). That marking has to sit on the output content itself, and producing it is the business of the provider of the respective model and not ours. The audit log also only sees what runs through Kisuno. It does not build an inventory of the AI systems in your company and it finds nothing that is used alongside.

Use case 2: assess once instead of afresh with every tool

The sequence almost every company knows: a department wants a new tool, and the assessment starts from the beginning. Data processing agreement, technical and organisational measures, subprocessors, processing location, deletion periods, roles and permissions. With the next tool, the same again. In the association survey on data protection named above, for 77% of companies the roll-out of new tools sets the assessment going all over again.13

The workflow instead: you assess the instance once, meaning the one installation operated for your company, and after that only the additions. Kisuno offers the current models from OpenAI (ChatGPT) and Anthropic (Claude); they run in the AWS data centre in Frankfurt. AWS is a US company, so the US CLOUD Act applies even with servers in Frankfurt, and we say so openly. For customers with higher data-protection requirements, open frontier models such as GLM, Kimi and DeepSeek are available, operated by European companies on servers in Europe; the CLOUD Act does not apply there. External systems join through MCP, the Model Context Protocol, an open standard for connecting external systems. Every connector, meaning each single link to such an external system, brings permissions per tool with it, and every call lands in the log. Which software can be connected today is listed on the Integrations page.

  1. One instance, assessed once
  2. Models and connectors as additions, each with its own permissions
  3. One set of contracts, one subprocessor list, one log
Many full assessments turn into one assessment and a series of small additions.

The limit: the assessment does not fall away, it gets smaller and it moves. Every new model in the catalogue and every new connector still has to be assessed, and responsibility for the use stays with the deployer. We supply the documents in one place, in the data processing agreement and in the subprocessor list. Anyone who reads that as meaning the requirements are settled is reading it wrong.

Use case 3: preparing the exit before it is needed

Take the contract for your current cloud or AI service and read it against Articles 23 and 25 of the Data Act. Does it state a maximum notice period for the initiation of the switching process of no more than two months? A transitional period of no more than 30 calendar days? An exhaustive list of the data that can be exported? A retrieval period of at least 30 calendar days after the transition?18 Wherever one of those points is missing, you have already found your question for 12 January 2027.

The second part is an exercise and not a clause. You export knowledge bases, conversation histories, accounts and the audit log, set up a second instance and read everything back in there. Kisuno is under the MIT licence, self-hosting costs nothing beyond your own infrastructure, and that is exactly why this route can be rehearsed without negotiating with us, as soon as the release repository is published. Until then, the full installation guide is available under Self-hosting. Anyone who has rehearsed the exit once negotiates differently.

  1. Read the contract against Articles 23 and 25
  2. Export of knowledge bases, histories, accounts and log
  3. Reading it back in on a second instance, under the MIT licence
The exit gets rehearsed while nobody needs it.

The limit: a successful export is a technical statement and not a legal one. The Data Act prohibits charges, it does not prohibit effort, and it does not turn two systems into the same functionality. What a switch really costs is counted in working days and not in a line on an invoice.

Limits, counterarguments and what does not stand here

First the distinction this article would fail on if it did not draw it cleanly. Article 50(2) is a provider obligation, and so is paragraph 1. The deployer obligations sit in paragraphs 3 and 4.17 The 2 December 2026 deadline in Article 111(4) therefore reaches providers of existing systems and not the companies that use those systems. The two new prohibitions also reach deployers only in one narrow case: under Article 5(1a), point (b), the use is prohibited only where the deployer uses the system for the purpose of generating or manipulating such material.7 Anyone blurring that difference is selling fear instead of information.

Second, against the grain of most pieces on this subject: the AI literacy obligation in Article 4 was weakened and not tightened. Providers and deployers take measures to support the development of AI literacy among their staff, and since July 2026 the legal text says expressly that this obligation does not oblige anyone to guarantee a particular level of AI literacy for any person.19 Anyone selling you a hard training obligation with compulsory proof is quoting a version that no longer applies. Measures stay sensible; the legal position is simply a different one from the one advertised.

  1. Provider: marking under Article 50(2)
  2. Deployer: disclosure under Article 50(4)
  3. Put a system into service under your own name and you become a provider yourself
  4. The new prohibitions reach deployers only where the use serves that purpose
Two roles, two sets of obligations. 2 December 2026 reaches one of them, not both.

Third the Data Act, and here the same holds in the other direction. What is prohibited from 12 January 2027 is charges, not effort. The transitional period of 30 calendar days is not absolute: where it is technically unfeasible, the provider reports that within 14 working days, gives reasons and states an alternative period of no more than seven months.20 Article 31 exempts from the charging ban those services whose main features have been largely built for a single customer and that are not offered at broad scale in the provider’s catalogue.21 And whether a pure language model service is a data processing service within the meaning of Article 2, point (8), at all is judged differently in the specialist literature and has not been settled.22 We do not claim the opposite.

Fourth, what nobody knows and what we do not deliver. A further Digital Omnibus proposal, running under procedure 2025/0360(COD), would release providers of data processing services that are small or medium-sized enterprises from the switching obligations for contracts up to 12 September 2025. The ban on switching charges under Article 29 of the Data Act is expressly excluded from that exemption and continues to apply. It has not been adopted, and we predict neither that it will come nor that it will fail.23 On our side: Kisuno does not build an AI inventory by itself, it only sees what runs through its own instance. It does not create human oversight, it makes it demonstrable. Source references do not prevent hallucinations, they make them checkable. And managed operation does not meet a requirement that calls for customer-held keys without access by the provider; only self-hosting leads there.

Fifth the most uncomfortable point, and it belongs in every article that deals with sovereignty. The Ontario Court of Justice ordered a French cloud company to hand data over to the Canadian federal police.24 The company challenged the order before the Ontario Superior Court of Justice; in January 2026 the proceedings were still open. A European base is therefore no immunity against access by foreign authorities. That holds for us too: the Anthropic models run on Amazon Bedrock, and AWS is a US company, so the CLOUD Act applies. Where the servers stand does not protect against that, and encryption does not help at the moment of processing. Article 32 of the Data Act requires providers to take adequate measures against unlawful access from third countries and makes decisions of third-country courts enforceable only on the basis of an international agreement. It covers only non-personal data held in the Union, though, and it does not resolve the conflict.25 What stays effective is what we say everywhere: give away less and know where things are held. This article is no substitute for legal advice.

Frequently asked questions about 2 December 2026 and 12 January 2027

What exactly applies from 2 December 2026?

Two things. First, providers of AI systems that generate synthetic audio, image, video or text content and that were placed on the market before 2 August 2026 have to meet Article 50(2) by that day, meaning they mark their outputs in machine-readable form as artificially generated. Second, from that day two newly inserted prohibitions from Article 5(1) apply, points (ba) and (bb), together with the accompanying paragraphs 1a and 1b. Both sit in the same regulation that postponed the high-risk deadlines in July 2026. This section is no substitute for legal advice.

Does Article 50(2) concern us if we only use AI?

As a rule, no. Paragraph 2 is addressed to providers, that is, to whoever develops a system or has one developed and places it on the market or puts it into service under their own name. Anyone using a bought-in system inside their own company is a deployer and has the obligations from paragraphs 3 and 4. The role can change, though: anyone who makes a system available under their own name, say as an enquiry service for customers, becomes a provider themselves. Check that system by system and not in one sweep for the whole company.

Have the high-risk obligations really been postponed?

Yes. For systems under Annex III, Sections 1 to 3 of Chapter III apply from 2 December 2027, for systems under Annex I from 2 August 2028. The postponement concerns neither the prohibitions in Article 5 nor the transparency obligations in Article 50, which have had to be applied since 2 August 2026. That is exactly why the reading that everything has been postponed is wrong.

Do we now have to train all our staff?

There is no training obligation with a guaranteed outcome, and since July 2026 that stands expressly in the legal text. Article 4 requires measures to support AI literacy and at the same time records that nobody has to guarantee a particular level for any person. Anyone selling you something else is quoting the old version. Measures are sensible all the same, just as an effort and not as an owed result.

What changes in practice on 12 January 2027?

From that day a provider of data processing services may no longer charge anything for the switching process, and data egress charges are expressly included. Standard service fees and early termination penalties are untouched by this. Anyone renewing contracts today should check whether the exit clauses under Article 25 are in them at all, because that obligation already applies. This section is no substitute for legal advice.

Does a language model service fall under the Data Act at all?

That is open. The Data Act defines a data processing service through on-demand network access to a shared pool of configurable, scalable computing resources. Whether pure model access falls under it is judged differently in the specialist literature and has not been settled. We therefore do not build our statements on the answer turning out in one particular direction, and we recommend the same for your contract planning.

What does the provisional gatekeeper designation of the large cloud providers mean?

Provisional means first of all: there is no designation decision. On 25 June 2026 the Commission reached the preliminary view that two large cloud services should be designated as gatekeepers, and in doing so made lock-in and high switching costs the reason itself. Which concrete obligations follow from that depends on the further procedure, and we do not predict its outcome. What counts in practice is the finding behind it: switching is expensive today, and from 12 January 2027 it may no longer be so where charges are concerned.

What does Kisuno do here, and what does it not do?

It makes three things demonstrable: which model was called when and by whom, which permissions per tool applied and what can be exported. It does not build an inventory of your AI systems, it does not produce machine-readable marking on other providers’ model outputs, and it does not meet any requirement in your place. The managed instance costs CHF 7 (EUR 7.50) per person per month, through the end of the current month with 50 percent off on a twelve-month term, that is CHF 3.50 (EUR 3.75). Testing is free and not limited in time: every new account starts with a starting credit of CHF 50 (EUR 55) for model usage, with no payment details. All the details are on the pricing page. Anyone who needs customer-held keys without access by the provider gets there only through self-hosting.

Put the two dates next to your own contracts

Bring a cloud or AI contract along and a list of the tools in use at your place. We go through together which role you are in for each system and what actually sits with you by 2 December 2026 and by 12 January 2027. Or you sign up and try the workspace out yourself.

Book a live demo Get started

Sources

All the dates, wordings and figures in this article come from the sources below, last checked in September 2026. The legal texts are cited in the version that has applied since 27 July 2026. Where a survey comes from an industry association, the text says so.

  1. Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 (Digital Omnibus Regulation on AI), published on 24 July 2026, in force since 27 July 2026; it sets the start of application for high-risk systems under Annex III at 2 December 2027 and under Annex I at 2 August 2028: eur-lex.europa.eu
  2. Regulation (EU) 2024/1689 (Artificial Intelligence Act), consolidated version of 27 July 2026, Article 111(4): providers of AI systems, including general-purpose AI systems, that generate synthetic audio, image, video or text content and were placed on the market before 2 August 2026 shall take the necessary steps to comply with Article 50(2) by 2 December 2026: eur-lex.europa.eu
  3. Regulation (EU) 2024/1689, Article 113(3), point (a), in the version of 27 July 2026: Chapters I and II apply from 2 February 2025, with the exception of Article 5(1), first subparagraph, points (ba) and (bb) and of Article 5(1a) and (1b), which apply from 2 December 2026: eur-lex.europa.eu
  4. Regulation (EU) 2023/2854 (Data Act), Article 29(1): from 12 January 2027 providers of data processing services shall not impose switching charges on the customer for the switching process: eur-lex.europa.eu
  5. Eurostat, Use of artificial intelligence in enterprises, reference year 2025, data extracted in December 2025: 19.95% of EU enterprises with ten or more employees used at least one of the AI techniques surveyed: ec.europa.eu
  6. Regulation (EU) 2024/1689, Article 50(2): providers shall ensure that the outputs of the AI system are marked in a machine-readable format and detectable as artificially generated or manipulated; the qualifier, as far as technically feasible and taking into account the generally acknowledged state of the art, sits in the wording with the technical solutions and not with the marking obligation itself. The obligation does not apply to the extent the system performs an assistive function for standard editing or does not substantially alter the input data provided by the deployer or the semantics thereof: eur-lex.europa.eu
  7. Regulation (EU) 2024/1689, Article 5(1), first subparagraph, points (ba) and (bb) and Article 5(1a) and (1b) in the version of 27 July 2026; under paragraph 1a, point (b), the use is prohibited only where the deployer uses the system for the purpose of generating or manipulating such material: eur-lex.europa.eu
  8. Regulation (EU) 2024/1689, Article 99(3) (fines of up to €35 million or 7% of total worldwide annual turnover for non-compliance with the prohibitions in Article 5) and Article 99(4), point (g) (up to €15 million or 3% for infringements of the transparency obligations in Article 50): eur-lex.europa.eu
  9. Regulation (EU) 2023/2854 (Data Act), Article 2, point (36): switching charges are charges other than the standard service fees and the early termination penalties, imposed for the switching actions prescribed by the Data Act, including data egress charges: eur-lex.europa.eu
  10. European Commission, preliminary view of 25 June 2026 that the market-leading cloud services of Amazon and Microsoft should be designated as gatekeepers under Regulation (EU) 2022/1925 on digital markets, based on lock-in and high switching costs: ec.europa.eu
  11. Eurostat, Cloud computing, statistics on the use by enterprises, reference year 2025: 52.74% of EU enterprises with ten or more employees bought paid cloud services, 77.53% of them count as highly dependent under the Eurostat classification, because they buy sophisticated cloud services such as security software, database hosting or development platforms; the enterprises are not asked about this: ec.europa.eu
  12. Regulation (EU) 2024/1689, Article 3, point (3) (provider) and point (4) (deployer), together with Article 3, point (11) (putting into service): eur-lex.europa.eu
  13. Bitkom Research, Datenschutz in der deutschen Wirtschaft, survey on the effort of implementing the General Data Protection Regulation, computer-assisted telephone survey of 603 companies in Germany with 20 or more employees, fieldwork in calendar weeks 30 to 35 of 2025, statistical margin of error plus or minus 4 per cent: according to figure 2, for 77% the roll-out of new tools sets the assessment going all over again, 82% see uncertainty about the exact requirements, 54% inconsistent interpretation within the EU: doi.org. At this point the running text of the report gives 80%; that is the value shown in figure 2 for 2024.
  14. Bitkom Research, the same survey, base all companies surveyed (n equals 603): 53% consider European data protection an advantage for the development of artificial intelligence in international comparison, 36% a disadvantage: doi.org
  15. DIHK digitalisation survey 2026, fieldwork from 10 to 28 November 2025, 4,686 responses from companies of all size classes, as at January 2026: 68% rate themselves as largely or completely dependent when it comes to artificial intelligence, 55% for cloud services: dihk.de
  16. Eurostat, Use of artificial intelligence in enterprises, reference year 2025: 14.21% of the enterprises without AI in use had ever considered using it; only within that group did 70.89% name missing expertise, 52.52% unclear legal consequences and 48.83% concerns about data protection and privacy as the reason for leaving it: ec.europa.eu
  17. Regulation (EU) 2024/1689, Article 50(1) to (4): paragraphs 1 and 2 are addressed to providers, paragraphs 3 and 4 to deployers; paragraph 4 contains the exception for content that has undergone human review or editorial control and for which a natural or legal person holds editorial responsibility: eur-lex.europa.eu
  18. Regulation (EU) 2023/2854 (Data Act), Articles 23 and 25(2): maximum notice period for the initiation of the switching process of no more than two months under point (d), binding transitional period of no more than 30 calendar days, exhaustive specification of the data and digital assets that can be exported, retrieval period of at least 30 calendar days after the end of the transitional period: eur-lex.europa.eu
  19. Regulation (EU) 2024/1689, Article 4 in the version of 27 July 2026: providers and deployers take measures to support the development of AI literacy among their staff; the text goes on to say, word for word, that this obligation does not oblige providers or deployers to guarantee a particular level of AI literacy for any person: eur-lex.europa.eu
  20. Regulation (EU) 2023/2854 (Data Act), Article 25(4): where the binding transitional period is technically unfeasible, the provider informs the customer within 14 working days of the switching request, gives reasons for the technical unfeasibility and states an alternative transitional period of no more than seven months: eur-lex.europa.eu
  21. Regulation (EU) 2023/2854 (Data Act), Article 31(1): Article 23, point (d), Article 29 and Article 30(1) and (3) do not apply to data processing services whose main features have largely been tailored to the needs of a single customer and that are not offered at broad scale through the provider’s service catalogue: eur-lex.europa.eu
  22. Regulation (EU) 2023/2854 (Data Act), Article 2, point (8), the notion of a data processing service: a digital service enabling ubiquitous and on-demand network access to a shared pool of configurable, scalable and elastic computing resources: eur-lex.europa.eu
  23. European Commission, proposal COM(2025) 837 final of 19 November 2025, Digital Omnibus, Article 1 point 15, new Article 31(1b) of Regulation (EU) 2023/2854: providers of data processing services that are small or medium-sized enterprises or small mid-cap enterprises are exempted, for contracts up to 12 September 2025, from the obligations of Chapter VI and of Article 34, expressly with the exception of Article 29; the exemption covers only services other than those referred to in Article 30(1), so not plain infrastructure services, and contractual clauses to the contrary are deemed null and void: europarl.europa.eu; state of play under file reference 2025/0360(COD), the procedure has not been concluded: oeil.europarl.europa.eu
  24. heise online of 26 November 2025 on the proceedings of the Royal Canadian Mounted Police against the OVH Group: production order of the Ontario Court of Justice of 19 April 2024 under section 487.014(1) of the Canadian Criminal Code, dismissal of the application to set it aside by Justice Heather Perkins-McVey on 25 September, deadline for handing over the data on 27 October, challenge at the end of October before the Ontario Superior Court of Justice: heise.de; on the state of play, The Register of 27 November 2025 with an update of 26 January 2026 stating that the proceedings are ongoing: theregister.com. The decision has not been officially published and is not available on CanLII.
  25. Regulation (EU) 2023/2854 (Data Act), Article 32: providers take adequate technical, organisational and legal measures to prevent access and transfer to third-country authorities where this conflicts with Union law; decisions of third-country courts are enforceable only on the basis of an international agreement. The article covers non-personal data held in the Union: eur-lex.europa.eu