And clearly the author hasn't read the AI act, where there are explicit carve-outs for security and defence applications (as there are in basically every EU law).