CIPC is deregistering close corporations over unfiled returns, a water-use deadline passed in July without most businesses noticing, and Koeberg went dark. Everything in a business expires on a date somebody has to own.

A water-use registration deadline passed in July and almost nobody noticed. Government Notice 7408 required every unregistered water user to register within 90 days of 24 April 2026. Registration was free inside that window and is reported at about R300 a property after it, with criminal liability of up to five years for non-compliance. It covers abstraction and stream-flow reduction, and belonging to a water user association does not cover a commercial borehole. (Infrastructure News)

CIPC is deregistering close corporations and companies over unfiled annual returns. Publication 2026-1508 is a final section 82 deregistration notice. Separately, eServices now rejects an email address or cellphone number already attached to another customer profile, which breaks the common arrangement where one accountant's address is the registered contact on a dozen entities. (CIPC)

Treasury and SARS amended the VAT Export Regulations, and no report carries the effective date. Delivery of movable goods to a terminal operator, rather than only the port authority, now qualifies for zero-rating. It was gazetted on 26 August as GN 7847 in RG 12038, and the trigger was privately owned terminal infrastructure sitting inside a state harbour. Three outlets covered it and none printed a commencement date. (Gov.za notices, Freight News, Bizcommunity Logistics)

Maersk added a R24,000 surcharge on dry cargo imports. An emergency contingency surcharge, given as R24,000 or US$1,500. The report gives no effective date, no lane and no expiry. Whether it lands on you or on your customer was decided by the quote you sent before it was announced. (Freight News)

Koeberg is completely offline and there is no return-to-service date. Unit 1 came off after a turbine trip, taking the station to zero. The three reports differ on the trigger, and none of them carries a date for the units coming back. Nothing here says load shedding returns, but it removes the margin that made that unlikely. (BusinessTech, Daily Investor, MyBroadband)

Employment equity reporting opens on Tuesday, and the snapshot is taken on Monday. The measurement period closes 31 August, so the workforce you report on is the one that exists at the end of the month. The line that is usually wrong is disability, because it depends on what staff disclosed rather than on what is true, and the record set behind it is either a field in a system or it is nowhere: functional impact, essential job functions, the accommodation considered, the consultation. (Labour Guide)

Nvidia's quarter says AI hardware gets more expensive, not less. Revenue of $96.2 billion, more than double a year ago, with $89 billion of it in data centre and guidance of $108 billion next quarter on demand outpacing supply. Behind it sits the notice to major customers of AI server price increases above 15% on Vera Rubin and Grace Blackwell machines, effective early next year. That reaches a South African subscription price on a lag rather than immediately. (TLDR IT, TLDR)

A security company was phished by a phone call. Attackers ran a phishing campaign on lookalike domains, then telephoned staff at ReliaQuest posing as its own security team and walked them onto a fake single sign-on page. One employee entered a password and approved the push notification. The company says the session was view-only and nothing further was reached. The control that failed is the one your staff also have. (TLDR InfoSec)

Two maximum-severity patches landed on things most offices never update. Ubiquiti patched three CVSS 10 flaws across UniFi Protect, UniFi Talk and UniFi OS Server, which are the camera and phone systems in a great many South African offices. Separately, CVE-2026-18963 lets an unauthenticated attacker take over any Keycloak account through the password-reset endpoint, with the advice to patch and disable "Forgot password" in every realm until you have. (TLDR InfoSec)

AI agents have started holding live logins on your behalf. ChatGPT Work's new sign-in flow pauses at a login page and takes the username, password and second factor in a separate widget, passing them to a cloud browser rather than into the chat. The session then stays signed in for later tasks. In the same week, Reuters reported that Russian-speaking attackers used the Cursor AI coding assistant to help break into a Belgian chemical company and at least six other firms. (ben's Bites, Daily Maverick)

Salesforce put its CRM inside Claude. Live CRM data and Salesforce workflows now run inside the assistant, with 37 sales skills for pipeline analysis, account research and deal reviews. The capability being sold is a model reading a structured customer record, which quietly makes having one the entry requirement. (TLDR IT)

Pricing AI by the token is falling out of favour, and that matters when you are quoted. The argument is that applications should charge for a unit of work a buyer already understands rather than for compute, because a token price asks the customer to forecast context length, retries and reasoning time. In a survey of 50 technical AI buyers, 27 preferred credits tied to recognisable work and 14 preferred tokens. If a quote meters something you cannot predict, you cannot budget it. (a16z)

WhatsApp added passkeys, stronger two-step verification, and context on calls from strangers. Three security changes: support for more than one passkey, an improved two-step verification flow, and information attached to calls from numbers that are not in your contacts. A WhatsApp account takeover is the thing that lets somebody message your customers as you, and more than one passkey is what keeps the account recoverable when a phone is lost, without falling back to an SMS code. (MyBroadband)

DeepSeek released an experimental model that reads screenshots, diagrams and scanned text. V4-Flash-Vision-Exp adds image understanding, pulls text out of screenshots, reads diagrams, and speaks both OpenAI's and Anthropic's API endpoints, so it drops into whatever a developer already built against. This is the capability underneath reading a supplier invoice or a delivery note without anyone typing it. It is labelled experimental, which makes it worth a test and not worth a process yet. (TLDR AI)

Ramp turned its internal model router into a product, and published what it saved. The routing layer Ramp runs across more than a hundred of its own AI use cases now picks a model per request on cost, quality, latency and availability. Ramp says it cut its own model spend by roughly 30%. The useful part is the question it hands you: when a vendor quotes a price against one named model, ask which model, and who decides when a cheaper one would have done. (TLDR IT)

Atlassian shipped Code Context, and kept the permissions attached to it. It lets people and AI agents search connected GitHub and Bitbucket repositories alongside Jira, Confluence and Loom, with access still governed by the repository permissions that were already there. Atlassian's own benchmark claims 44% more accurate results on 48% fewer tokens, which is their figure and not an independent one. The part that matters is the permissions. Anything reading across your systems has to inherit who may see what, or it is a leak with a search box. (TLDR IT)

GitLab 19.3 added spending caps on agentic AI. The release covers single-tenant deployment of its agent platform and secrets management beyond pipelines, but the cap is the line to read. An agent that can call a model in a loop is an unbounded invoice until somebody bounds it, and a usage ceiling is the only control that works before the month ends rather than after. (TLDR IT)

Perplexity and Nvidia released an agent that runs on the machine instead of in the cloud. Portable Computer runs agent workloads locally on Nvidia DGX Spark and RTX-powered Linux machines, keeps tasks on the device by default, avoids token charges for anything done locally, and moves to cloud models only when asked. It is the first credible answer to whether this can run where the data already sits. It needs particular hardware, so treat it as a direction rather than something to buy this quarter. (TLDR IT)

OpenAI's GPT-5.6 models reached Amazon Bedrock, with a 90% discount on repeated context. Terra and Luna are generally available through Bedrock with million-token context windows and prompt caching at a stated 90% discount on repeated context. The release is into AWS GovCloud, a United States government region, so it is not something you can buy from here. The number still travels: caching is the one AI cost lever a small buyer can pull, because a price list or a policy sent with every single request should be paid for once rather than a thousand times. Ask anyone quoting you whether they cache. (TLDR IT)

What happened. A year of measurement rather than a product. Across hundreds of brands under continuous monitoring, the companies themselves and their existing partners found about 9% of the confirmed fakes aimed at them in the first 90 days. Ninety-four per cent of brands caught fewer than half of their impersonators and the median brand caught none at all. Brand impersonation is the one theft where nothing of yours leaves the building.

What it costs. In the United States, the FTC recorded $3.5 billion of reported imposter-scam losses in 2025, up about 19% on the year before, and imposter scams were the single most-reported fraud category. That figure is in dollars because it is a US number and converting it would invent precision nobody has. The local end of the same machinery is SABRIC's R2.4 billion of digital banking fraud losses.

What it means for forty staff here. It means a copy of your quote template, your letterhead and your banking details is a plausible weekend's work for someone, and your customer is the one who pays. Over 80% of impersonated brands were hit on two or more surfaces at once: a lookalike domain, a social account and a paid ad. Watching only one of them is watching almost none of it.

What blocks it locally. Two things. Most businesses this size have no security function, so nobody owns the job of searching for fakes of themselves. And the clock does not belong to you: the takedown request goes to whoever hosts the fake, and roughly 60% of taken-down domains carry a new confirmed fake within 24 hours.

What to do about it. Accept that you will not find them and defend the transaction instead. Every change of banking details is confirmed on a number already on your file, never the number on the document requesting it. Register the obvious misspellings of your own domain while they are cheap. And search your own company name, monthly, the way a customer would.

1. Open one sheet, four columns. What it is, the number on it, the date it expires, who renews it. Resist adding a fifth.

2. Statutory rows first. Annual return, tax clearance, letter of good standing, VAT and PAYE registrations, and any sector licence or registration you hold.

3. Then the ones that arrive by post. Public liability and asset insurance, vehicle licences, the lease, industry body or council registrations.

4. Then the ones that renew silently. Domain names, hosting, SSL certificates, every software subscription, and the card that pays for each of them.

5. Add water. If you draw from a borehole, a river or a dam for anything beyond reasonable domestic use, find your registration number. If there is no number, that is the row that matters most on the sheet.

6. Write a person in the owner column. Not a department, not "finance". A name. A row with no name against it is the row that lapses.

7. Put every date in a shared calendar, six weeks out. Six weeks, not one. A lapsed registration takes considerably longer to undo than a renewal takes to do.

8. Look at the rows with no date. Those are the phone calls for next week, and they are the entire point of the exercise. You cannot renew something whose expiry you have never established.

Give every entity its own mailbox. CIPC's eServices now rejects an email address or cellphone number already attached to another customer profile. One accountant's address sitting on twenty companies has stopped being a convenience and become a filing failure.

Verify banking details on a number you already had. Never the number printed on the document asking for the change. In most small businesses the person who edits supplier bank details is also the person who releases payment, and this call is the only thing standing between those two facts.

Register the obvious lookalikes of your own domain. The common misspellings, and the pair your customers confuse. It costs a fraction of a takedown, and takedowns on domains do not hold. Most taken-down domains are serving a new fake within a day.

Put a validity period on every quote, with a pass-through clause under it. A R24,000 surcharge announced with no effective date is only your problem if the quote you sent three weeks ago says it is. This is a field in your quoting system, not something a salesperson remembers.

Patch the things nobody thinks of as computers. The camera recorder, the desk phone system, the access controller. Three maximum-severity flaws were patched in UniFi Protect, UniFi Talk and UniFi OS Server this week, on firmware most offices have not touched since the installer left.