Taiwan confirmed AI agent-assisted attacks on government agencies in July. A security vendor separately documented one campaign built from open-source frameworks. No frontier model gate was crossed, which is why vendor safety cases were never going to cover it.
A joint Five Eyes statement reframes AI cyber risk as an immediate leadership responsibility on a months-not-years horizon. The defence is unglamorous basic hygiene plus AI-aware threat modelling. We translate it into the EU frame of NIS2, DORA and the AI Act, and the questions a board should ask now.
The European Commission awarded €180 million in sovereign cloud contracts assessed against its new Cloud Sovereignty Framework and SEAL levels. A working reference for procurement teams.
