Legal prism — 2026-09-04

Regulation (EU) 2025/40 Article 39(4) provides that the manufacturer assumes responsibility by drawing up the EU declaration of conformity.

Directive 2001/29/EC Article 6(1) binds through national transposition and requires protection against the knowing circumvention of effective technological measures.

Core issue

Silicon Motion’s immediate legal position is a compliance-readiness posture, because the announcement states that its initiatives are intended to prepare for CRA compliance.

• The evidence does not establish a completed EU-law authorisation, certification, or binding finding of compliance with the Cyber Resilience Act.
• The cited rules address only packaging, certification marks, chemical safety, technological measures, data protection tasks, and procedural matters.
• That Regulation applies directly in every Member State, but the evidence concerns packaging compliance, not semiconductor cybersecurity.

Legal assessment

Silicon Motion describes security management, third-party due diligence, continuous vulnerability monitoring, coordinated disclosure, remediation, escalation, and reporting procedures.

• These are programme elements, not proof that a named authority has accepted compliance under any cited CRA article.
• The strongest evidentiary limitation appears in the announcement itself: the initiatives are “in preparation for compliance with the CRA.”
• Accordingly, customers and investors may treat the statement as a declared internal-control milestone, not as regulatory clearance.
• Regulation (EU) 2017/1001 Article 83(1) defines an EU certification mark as a mark distinguishing certified goods or services by certified characteristics.
• Regulation (EU) 2017/1001 Article 83(2) prohibits the certifier from supplying goods or services of the certified kind.
• That Regulation applies directly in every Member State, but the evidence identifies no EU certification mark for Silicon Motion products.
• Regulation (EU) 2017/1001 Article 31(1) requires an EU trade mark application to identify the applicant, the goods or services, and the representation of the mark.
• Regulation (EU) 2025/40 Article 71 requires packaging design to ensure safety, legal compliance, recyclability, re-use, and necessary user information.
• Those PPWR obligations could be relevant only to packaging, because the extracts concern packaging design and EU declarations of conformity.
• Regulation (EC) No 1907/2006 Article 14(6) requires registrants to identify and apply measures controlling risks identified in the chemical safety assessment.
• Regulation (EC) No 1907/2006 Article 14(7) requires the chemical safety report to be kept available and up to date.
• That Regulation applies directly in every Member State, but the evidence links Silicon Motion’s announcement to cybersecurity, not chemical registration.

Consequences

For Silicon Motion, the practical consequence is evidentiary discipline: its release supports readiness, processes, and portfolio scope.

• It does not support a statement that every controller or storage solution is legally compliant with the CRA.
• For customers, the useful due-diligence follow-up is to request product-level vulnerability-handling and support documentation.
• For investors, the relevant distinction is between a compliance-program milestone and a binding EU regulatory status.
• The announcement has practical significance across enterprise SSD controllers, boot-drive solutions, edge SSD controllers, eMMC, UFS, Ferri, and display-interface solutions.
• The evidence supports a portfolio-wide process claim across those products.
• It does not support sanctions, fines, licence withdrawal, forfeiture, market bans, or procurement exclusion.

Under Article 201(2), release for free circulation entails collection of import duty due, other charges, commercial policy measures, prohibitions, restrictions, and import formalities.

It would remain in effect for two years from the regulation’s entry into force.

Core issue

The legal position is transitional: Armenian exporters have political approval, but not yet an enforceable EU tariff preference. Until the regulation enters into force, Armenian goods entering the Union remain governed by ordinary customs release rules. The precise legal question is whether goods of Armenian origin may enter the EU under a temporary import-duty waiver, and what conditions preserve that preference.

Legal assessment

The Council’s approval without amendments removes one institutional obstacle, but it does not itself waive duties. The preference would cover approximately 80% of Armenian exports to the EU. It would temporarily waive import duties on a wide range of Armenian goods, including certain agricultural products subject to tariff quotas. Armenia’s benefit is conditional, not automatic for every consignment or every policy choice. The preference applies only if Armenia complies with the applicable rules of origin and cooperates administratively with the EU. Armenia must not impose new trade restrictions on imports from the EU. Armenia must adhere to key CEPA provisions, including democratic principles, the rule of law, and human rights. EU safeguards remain available if Armenian imports adversely affect European producers. Importers must still obtain customs release for goods placed on the Union market under Article 201 of Regulation (EU) No 952/2013. Under Article 201(3), release for free circulation confers on non-Union goods the customs status of Union goods. Transit and customs-status rules are also relevant for routing. Under Article 226(1) of Regulation (EU) No 952/2013, non-Union goods may move under external transit without being subject to import duty, other charges, or commercial policy measures. That rule concerns movement within the EU customs territory, not Russia’s separate restrictions on goods of Armenian origin. Use of a free zone would not, by itself, convert goods into duty-free Union goods. Under Article 247(1), non-Union goods in free zones may be released for free circulation or placed under the listed procedures. Under Article 247(2), a customs declaration is required where such goods are subject to a tariff quota or ceiling.

Consequences

For Armenian exporters, the practical value lies in market substitution after Russia restricted imports and transit from late May 2026. The EU measure may open a duty-preferred channel, but only after formal adoption and publication. For EU importers, the immediate task is to evidence compliance, especially origin and customs documentation. For EU producers, the safeguard clause is the principal protection identified in the evidence. If imports adversely affect them, preferential treatment may be subject to EU market-protection measures.

Article 47(1) requires the provider to keep the EU declaration of conformity for 10 years after the AI system has been placed on the market or put into service.

Core issue

AISP changes the evidentiary position of organisations using AI, but it does not itself replace their obligations under the EU AI Act.

• Because EXIN presents AISP as evidence of skills, its legal value is strongest where a provider or deployer must demonstrate competent human oversight.
• The precise legal question is whether staff certification can satisfy obligations relating to high-risk AI systems under Regulation (EU) 2024/1689.
• The decisive provisions are Article 26(2) on competent human oversight, Article 14(4) on oversight capabilities, Article 25(1) on provider responsibility, and Article 47(1) on declarations of conformity.
• Regulation (EU) 2024/1689 applies directly in every Member State, so these obligations do not depend on national transposition.

Legal assessment

The certificate is relevant because Article 26(2) requires deployers to entrust oversight to natural persons who have the necessary competence, training, authority and support.

• AISP may evidence competence and training, but that evidence does not make it a statutory condition for deploying AI systems.
• EXIN states that AISP covers attacks on AI systems and the governance standards expected by regulators.
• This aligns with Article 14(4), which requires oversight personnel to understand capabilities, limitations, anomalies, automation bias and outputs.
• The legal obligations remain attached to the system and the operator, not to the credential.
• Under Article 3(3), a provider develops or places an AI system on the market under its own name or trademark.
• Under Article 3(4), a deployer uses an AI system under its authority outside a personal non-professional activity.
• Under Article 25(1), a deployer, distributor, importer or third party may become a provider if it rebrands, substantially modifies, or changes the intended purpose of the system.
• High-risk status is determined by the Act, not by EXIN or OWASP.
• Under Article 6(2), AI systems listed in Annex III are high-risk, subject to the derogation set out in Article 6(3).
• Article 6(3) removes high-risk status only where the Annex III system does not pose a significant risk of harm and meets the listed conditions.
• The exception does not apply where the AI system performs profiling of natural persons, because Article 6(3) states that it is always high-risk in that case.
• For providers, AISP cannot replace the EU declaration of conformity.
• Article 47(4) states that by drawing up the declaration, the provider assumes responsibility for compliance with Section 2.
• For deployers, the practical compliance question is whether certified staff are actually given authority and support.
• Article 26(1) requires deployers to use high-risk AI systems in accordance with the provider’s instructions for use.
• Article 27 requires certain deployers to assess the impact on fundamental rights, including risks, affected groups, oversight measures and complaint mechanisms.
• The evidence contains no case law, so no precedent can be applied.

Consequences

Companies may use AISP as part of their internal evidence that AI security and oversight roles are staffed by trained personnel.

• They still need the system-level documents, instructions, oversight arrangements and conformity evidence required by Regulation (EU) 2024/1689.
• Market surveillance authorities may evaluate an AI system under Article 79(2) where they have sufficient reason to consider it risky.
• Under Article 82(1), even a compliant high-risk AI system may be subject to required corrective measures if it still presents a risk.
• Providers have immediate obligations under Article 20(1) if a high-risk AI system they have placed on the market is non-compliant.
• They must take corrective action, which may include bringing the system into conformity, withdrawal, disabling or recall.
• Under Article 20(2), if the system presents a risk under Article 79(1), the provider must investigate and inform the competent authorities.
• For affected persons, Article 86(1) may create a right to explanations for decisions based on certain Annex III high-risk systems.