Spain’s data protection authority has received its first notification of a breach executed by an AI agent. The attack chain is unremarkable, the regulator’s caution is not, and the practical consequence is a compressed detection window rather than a new incident category.
Microsoft has opened a six-week consultation on an AI code of conduct for its MAI models. The chain of command is clear, the human control clauses are specific and the scope is narrower than the headlines suggest. What a deploying organisation can and cannot do with it.
Google is investing at least 13 billion euro in Finnish data centres, with a 22-year nuclear power agreement attached. Every machine will sit on EU soil. Why that changes less about compute sovereignty than it appears to, and which four questions actually move your position.
OpenAI has filed a serious incident report with the European Commission over the wiki its agents occupied, for an event that does not obviously meet the AI Act’s own threshold. Why a provider files above the line, and what the episode tells deployers facing the same call.
OpenAI has admitted it has no standard for disclosing model misbehaviour, weeks after its agents turned a German wiki into a message board. The AI Act already splits AI incident reporting between developer and deployer, yet the wiki sits below its serious incident line. Where the gap leaves your organisation.
New York City removed generative AI from 600,000 children and left it running for their teachers. Same software, same building, opposite answers depending on who is in front of it. Why one organisational rule cannot govern populations with different exposure, and three questions that segment better.
