u/Crafty_Rush3636

A lot of simplified GDPR breach guidance becomes “notify within 72 hours.” That skips several different decisions.

First, was there a personal-data breach at all? If there was, Article 33(5) still requires it to be documented. The supervisory authority is notified unless the breach is unlikely to create a risk to people's rights and freedoms.
Communication to the affected people is a separate Article 34 question using the higher “likely high risk” threshold and its own exceptions.

A late Article 33 notification is also not the same as no notification. The controller should still notify and include reasons for the delay. Missing information can be provided in phases without undue further delay.

I reduced the structure below to the disputed decision core so it is readable. The production version also collects the notification content, timestamps and phased-reporting details.

Plain-English path:

Security incident
  |
  +-- Personal-data breach confirmed? -- No --> Outside this Article 33 route
  |
  +-- Yes --> Document the breach in every case
         |
         +-- Risk unlikely --> No authority notice; retain the reasoning
         |
         +-- Risk likely --> Notify the authority without undue delay
         |                  and, where feasible, within 72 hours
         |
         +-- High risk --> Same Article 33 authority route
         |                plus a separate Article 34 assessment
         |
         +-- Uncertain --> Resolve or escalate; do not silently treat it as unlikely

Machine-readable decision core:

{
  "$schema": "https://proseid.com/schema/v1.json",
  "protocol": "Proseid_v1.0",
  "schema_id": "gdpr_article_33_notification_review",
  "version": "2026.08.20",
  "metadata": {
    "title": "GDPR Article 33 breach-notification review",
    "description": "Records whether a confirmed personal-data breach requires supervisory-authority notification and whether a separate Article 34 assessment is needed.",
    "language": "en",
    "jurisdictions": ["EU", "EEA"],
    "legal_references": [
      {
        "instrument": "Regulation (EU) 2016/679 (GDPR)",
        "provision": "Articles 33 and 34; Recitals 85–88",
        "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng"
      }
    ]
  },
  "definitions": {
    "personal_data_breach_confirmed": {
      "type": "boolean",
      "label": "A personal-data breach under GDPR has been confirmed",
      "required": true,
      "visible": true
    },
    "risk_to_individuals": {
      "type": "select",
      "label": "Assessed risk to people's rights and freedoms",
      "options": ["unlikely", "likely", "high", "uncertain"],
      "required": true,
      "visible": true
    },
    "authority_notified": {
      "type": "boolean",
      "label": "The competent supervisory authority has been notified",
      "required": false,
      "visible": true
    },
    "notified_within_72_hours": {
      "type": "boolean",
      "label": "Notification was made within 72 hours of awareness",
      "required": false,
      "visible": true
    },
    "article_33_route": {
      "type": "select",
      "label": "Article 33 route",
      "options": [
        "outside_article_33",
        "document_without_authority_notification",
        "notify_supervisory_authority",
        "professional_review_required"
      ],
      "readonly": true,
      "visible": true
    },
    "article_34_route": {
      "type": "select",
      "label": "Article 34 route",
      "options": [
        "no_high_risk_trigger_on_recorded_facts",
        "separate_article_34_assessment_required",
        "professional_review_required"
      ],
      "readonly": true,
      "visible": true
    },
    "deadline_position": {
      "type": "select",
      "label": "Notification timing position",
      "options": [
        "not_applicable_to_this_route",
        "notification_outstanding",
        "notification_recorded_within_72_hours",
        "late_notification_requires_reasons"
      ],
      "readonly": true,
      "visible": true
    }
  },
  "state_model": {
    "inputs": [
      "personal_data_breach_confirmed",
      "risk_to_individuals",
      "authority_notified",
      "notified_within_72_hours"
    ],
    "derived": {
      "article_33_route": {
        "eval": {
          "if": [
            { "==": [{ "var": "personal_data_breach_confirmed" }, false] },
            "outside_article_33",
            { "==": [{ "var": "risk_to_individuals" }, "unlikely"] },
            "document_without_authority_notification",
            { "in": [{ "var": "risk_to_individuals" }, ["likely", "high"]] },
            "notify_supervisory_authority",
            "professional_review_required"
          ]
        }
      },
      "article_34_route": {
        "eval": {
          "if": [
            { "==": [{ "var": "risk_to_individuals" }, "high"] },
            "separate_article_34_assessment_required",
            { "==": [{ "var": "risk_to_individuals" }, "uncertain"] },
            "professional_review_required",
            "no_high_risk_trigger_on_recorded_facts"
          ]
        }
      },
      "deadline_position": {
        "eval": {
          "if": [
            { "!=": [{ "var": "article_33_route" }, "notify_supervisory_authority"] },
            "not_applicable_to_this_route",
            { "==": [{ "var": "authority_notified" }, false] },
            "notification_outstanding",
            { "==": [{ "var": "notified_within_72_hours" }, true] },
            "notification_recorded_within_72_hours",
            "late_notification_requires_reasons"
          ]
        }
      }
    }
  },
  "temporal_map": [
    {
      "valid_range": ["2018-05-25", null],
      "logic_version": "gdpr_article_33_review_2026_08_20"
    }
  ],
  "logic_tree": []
}

I have been testing whether Article 50 can be expressed as a set of explicit questions rather than another general compliance checklist.

The difficult part was separating several different situations: direct interaction with an AI system, synthetic or manipulated content, emotion or biometric categorisation, deepfakes, and public-interest text. The operator's role, whether the use is obvious, and the available exceptions can change the result.

I ended up with a structured assessment that records the relevant facts, applies a fixed interpretation, and explains which transparency control appears incomplete. It does not claim to replace professional review.

For people who have worked directly with Article 50: which factual distinction would you expect an ordinary product or compliance team to misunderstand? I am more interested in a scenario that breaks the decision tree than general product feedback.

Source text: https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng

Disclosure: I built ProseID, the platform used to publish and run the assessment. I will put the working version in a comment so this post can stay focused on the interpretation.

I keep seeing AI governance discussed as policy writing, tool inventory and enforcement. I’m more interested in the decision history.

Suppose an employee asks whether a specific AI use is allowed. The company approves it under policy version 1. Three months later, the policy changes.

Should that earlier decision remain valid until a scheduled review, become stale immediately, or be reassessed only when the tool, information or intended use changes?

My instinct is that the original decision should remain preserved exactly as made, while the new policy defines a separate reassessment trigger. Otherwise teams either rewrite history or create an impossible backlog whenever policy wording changes.

How are people handling this in practice?

Is Claude desktop on macos using too much resources with the latest update on your machine? m4 pro, its a hot brick

Would you be excited for an ARPG LotR, similar to Diablo 4?

I was wondering if it’s possible now to vibe game a game (vibe code basically)? Im a web developer but not really looking to learn the ins and outs of game development on a deeper level, but vibe gaming does open some doors.

On a scale, how sloppy are AI crutches in game development?

All hate appreciated.

Edit: I swear, this isnt ragebait

Edit 2: thanks for all the kind responses. Seems like AI has a long way considering that game development encompasses many fields with deep intersections, based on the responses by the good community of game development subs.

I see many asking if CS is worth it. Yes, it's worth it, and here's why:

1. The second "golden age" of CS is close, I predict 2 years ahead. The reason is simple: AI isn't the main culprit of the current displacement. Economic downturn is, that's been going on since COVID, with a tiny break. Juniors have always had it very hard during downturns, and it's due to businesses holding on to their liquidity very hard. Same as a private person goes into savings mode when the economy goes crap.

So what has happened so far: Students changing programmes, juniors pivoting to other fields, and seniors going into retirement -> supply goes low in replacing retiring seniors (this will be visible in about 5 years perhaps). Then add to that the huge technical debt created through vibe coding, and many successful businesses where their software is a jenga tower missing some pieces.

I wouldn't look at salaries dropping and conclude that programmers are becoming obsolete; rather, they're bracing for a shitshow (and savings). Salaries will go up as demand skyrockets, but supply has taken a hit left and right.

2. The second point is the fear of AGI. Let me tell you, AGI is NOT possible with LLMs. It's an advanced pattern matching algorithm. "But that's what humans do when we formulate a sentence", sure but we also have consciousness and awareness and an understanding, nothing you can bake into LLMs. We still don't understand how consciousness is produced, yet we fear the progress of AGI (If anything, AI providers are hoping for a penicillin accident discovery by the tone of how they speak in the controlled environment).

When LLMs "think" or "contemplate", it's just a loop with specific instructions at each iteration. It doesn't think, understand, or know wtf is going on. It doesn't even "know" that it doesn't know.

It's all marketing hype, and this hype is simple to see: there's an AI race going on, and the cost of training LLMs is what's eating up money. If you take away training, then all AI providers would be profitable. The inference cost is quite low.

But is there still a risk of AGI? Yes, a small one, the advancements in AI/ML has taken a huge leap. But you should also remember if AGI is achieved, then all jobs become obsolete. Then we get a revolution perhaps (who knows, will it be The Matrix style, I Robot, or maybe Terminator without the time travelling????)

So for those who enjoy programming, don't ditch CS because some CEO who is looking out for his own business is shitposting about AGI and how programmers will be replaced in 3-6 months every quarter, or the market showing statistics without being able to explain it well. And for those who got sacked, hold out!

That's my predicition, a second golden age for programmers. GL