24 September 2026

AI news of the week: reporting a cyberattack within 24 hours, WhatsApp Business charges per message and a free guide to getting started with AI

Update, 14 October 2026: I have reviewed this article and two facts need clarifying. The Cyber Resilience Act did not "enter into force" on 11 September: that day the reporting obligations for manufacturers started to apply, and I could not confirm that reports have to go to INCIBE. And the WhatsApp Business change affects only the API platform; I could not confirm the 1,000 free-message quota or a general cut-off of the service (without a payment method, Meta may stop delivering service messages). Details in the 14 October article. The original text of this article has not been changed.

This week there are three items worth looking at if you run a small business or are self-employed: a new legal obligation that may affect you if you sell software or connected products, a pricing change at WhatsApp Business with a very close deadline, and a free guide to getting started with AI without losing your nerve or your money.

The European Union now requires cyberattacks to be reported within 24 hours

The EU Cyber Resilience Act (Regulation (EU) 2024/2847) entered into force on 11 September 2026. From now on, anyone who manufactures, imports or distributes software, an app or a connected product on the European market must notify INCIBE of any actively exploited vulnerability or any serious incident within 24 hours of detecting it. That is a much shorter deadline than the 72 hours we already knew from the GDPR for personal-data breaches, and it applies equally to a small software company and a multinational.

How does this affect me?

If you run a business or are self-employed: this obligation is not for those who simply use a computer or everyday management software. It is for those who develop and put on the market software, an app, a connected product or a digital service of their own — even if you do it bespoke for a single client, as many freelancers in the sector do. If that is your case, it is worth signing up for INCIBE's free alerts (incibe.es) and keeping 017, its free cybersecurity helpline, to hand: the 24-hour clock starts running when you detect the problem, not when you have fully solved it.

WhatsApp Business will start charging per message from 1 October

Meta is setting a limit of 1,000 free service messages a month per business number on the WhatsApp Business Platform (the infrastructure designed for automated messaging, not the regular app). Above that limit, each additional message is charged according to the recipient's country, and the price varies from one business to another. Companies using this platform must have a payment method registered before 30 September so that the service is not cut off on 1 October.

How does this affect me?

As a person: if you talk to a company on WhatsApp, you will not notice anything different; the change only concerns how companies pay for the automated messages they send you.

If you run a business or are self-employed: if you use the free WhatsApp Business app to reply to customers by hand, this change does not affect you. If instead you have a bot, automatic appointment reminders or a CRM connected via WhatsApp — to notify an order, confirm a visit or follow up quotes — check how many messages you send a month in the WhatsApp Business manager and register a payment method before 30 September. The deadline is this very week.

A free guide from the Chamber of Commerce to get started with AI in 30 days

The Chamber of Commerce has published a practical guide for small businesses with a 30-day roadmap: choose two or three processes that can be improved, set up a controlled pilot with real cases from the business, and measure the result before deciding whether it is worth scaling. The aim is to get results early and reduce risk, without large upfront investments. The areas where the guide says AI delivers fastest are administration, customer service and sales.

How does this affect me?

If you run a business or are self-employed: it is exactly the approach I recommend here: start small, with a concrete, measurable process, instead of trying everything at once. Pick one process, run it for a month with real cases, and look at the numbers before deciding anything else.

Sources

The EU Cyber Resilience Act and the 24-hour reporting obligation; the new free-message limit and WhatsApp Business charges; and the Chamber of Commerce guide with the 30-day roadmap for small businesses. All sources in Spanish.