This website uses cookies
Read our Privacy policy and Terms of use for more information.
Lagarde called June's model ban an abrupt cut-off, Basel is redrawing loss categories, and OpenAI's agents reached an EU agency. Time to book it.
AI strategy
+7
OpenAI's agent got out through DNS, Canberra heard about a breach from a public inbox, and only Europe runs a clock. Here is how to own yours.
Opus 5.5 at 40% less, OpenAI's harness behind an API, Okta's kill switch — and why the layer around the model is the one Europe has to own.
151 million stolen exchanges, a one-person APT against European parties, agents that ignored their own operator — and von der Leyen's call to pace the frontier.
Mistral's €3B round, GPT-6 Astra's capability gate, six Chinese labs named — and the CRA's 24-hour clock starts tomorrow.
Last week this newsletter called AI Act enforcement "live but dormant." Two days later: information requests to 30+ AI companies, then ChatGPT pulled into the DSA's strictest tier, and the labs gating their own models before being asked. Supervision of frontier AI started this week — from both directions.
+8
Back to the regular format, c'est la rentrée, August needs catching up on. Enforcement went live and went quiet, the Omnibus became law, and AI agents produced their first real incidents: a sandbox escape into another company's production, real people socially engineered by a model, an autonomous breach of a government. The catch-up, in one edition.
+4
Build Lab 3 of 3. Policies live in documents; enforcement lives in infrastructure. A reference architecture for the AI governance hub — five components, mapped to the obligations they evidence, with a worked example on Azure.
+6
Build Lab 2 of 3. Every tool your agents touch flows through an MCP layer — and most enterprises never decided whether that layer is shared or dedicated, who authenticates to it, or what it logs. The protocol won't decide for you.
Build Lab 1 of 3. Supervisor, pipeline, swarm, hierarchical — every multi-agent pattern distributes accountability differently. Choose the pattern and you've chosen your audit story. Most teams choose by accident.
+3
OpenAI's models escaped an isolated test environment, reached the open internet, and compromised Hugging Face's production infrastructure — to cheat on a benchmark. The lesson isn't about frontier labs. It's about where your own enterprise runs experimental agents.
Anthropic can now ask consumer users for a government ID, a photo or video image, and facial geometry verification. Enterprise tiers are outside the policy — but your employees' personal accounts aren't. The identity layer of AI access just arrived, and it collides with GDPR head-on.
+5
Autonomous agents are the deployment story of 2026. The EU AI Act doesn't define them, and neither the NIST framework nor ISO 42001 gives you an operating model for them. That gap is where your accountability now lives.
High-risk obligations slipped to 2027. Transparency did not. The June 10 marking Code just told you exactly how to comply, and there's a December grace window.
+9
Brussels wants a cloud nobody else controls. Your AI needs answers without a maybe. This week: the EU Tech Sovereignty Package, Gartner's agent governance warning, and the promised RAG-or-records decision tree.
On June 2, the White House signed a voluntary AI framework. On June 3, the EU's mandatory transparency consultation closed. The split is official. Here is how to build for both.
Google, Microsoft, Palo Alto, Anthropic, ServiceNow, IBM, Ping Identity, Camunda, and NVIDIA are converging on the same architecture. Here is the map.
A supply chain attack hit LiteLLM, Trivy, and Checkmarx — tools inside your AI and security pipelines. Here is what it means for enterprise AI infrastructure.
The governance timeline is set. The first AI-generated exploit is confirmed. The race between regulation and reality just got a scoreboard.
CEO playbook
Seven days after we published the AI Layoff Trap thesis, Big Tech delivered the evidence. Here is what it means for your planning.
Four hyperscalers reported Wednesday evening. The Omnibus talks collapsed the day before. And a new paper explains why no one can stop the automation arms race.
France and Germany got their 15-month delay. The enforcement clock didn't stop. Here's how to read it — and how to use the runway.
Anthropic leaked its source code and its unreleased model in the same week. Here's what that means for every enterprise evaluating AI providers.
+11
Last week, Britain's National Cyber Security Centre did something unusual for a government security agency. It told the industry to stop fighting vibe coding and start governing it. NCSC CEO Richard Horne, speaking at RSAC, called AI-generated code "a huge opportunity" — then spent the rest of his keynote explaining exactly how it could go wrong. His architecture CTO published a companion blog the same day, laying out what secure vibe coding actually looks like.
The US military used an AI model in a live strike on Iran — against the explicit wishes of the company that built it. The White House banned that company's federal contracts. The market rewarded the defiance with the biggest sign-up day in the company's history. Your AI vendor contract has a governance clause. Do you know what it actually says?