August 28, 2026
Professional secrecy in AI practice has become a design question
CCBE and CNIL/CIANum make clear that professional secrecy in AI is a matter of architecture, contracts and traceable workflows, not of cautious prompts.
Blog
Insights on verified AI
Articles on multi-model verification, privacy-aware document workflows and inspectable AI for professionals.
August 28, 2026
Separation of duties in autonomous AI has become a design question
New governance frameworks and the CNIL/CIANum note show that separation of duties in agentic AI is a hard safety and accountability requirement.
August 27, 2026
The AI Act after the Digital Omnibus: postponement for high-risk, firm obligations from August 2026
The Digital Omnibus shifts high-risk deadlines to 2027-2028, but transparency obligations under article 50 already apply from 2 August 2026 for organisations.
August 27, 2026
When your benchmark itself becomes a risk
GuardianAgentBench and an OpenAI audit of SWE-Bench Pro show that evaluations for business-critical AI have themselves become a layer of risk.
August 27, 2026
Incident Response for AI Systems After the Hugging Face Breach
Following the autonomous AI-agent attack on Hugging Face, demand grows for an AI-specific incident playbook with observability, containment and verifiable evidence.
August 26, 2026
Human oversight of AI becomes a design requirement, not a signature
Article 14 of the EU AI Act makes human oversight of AI decisions testable: understand, detect deviations, override and emergency stop, all demonstrably logged.
August 25, 2026
Cross-border data routes in AI become an explicit risk layer
In July 2026, cross-border data routes in AI services shift from invisible infrastructure to a governance topic that must be explicitly accounted for.
August 25, 2026
Exit and fallback for AI services: what the July 2026 OpenAI outage exposes
After the 17-day OpenAI outage of July 2026, exit rights, data portability and tested failover prove to be a governance layer, not a contractual detail.
August 25, 2026
The hidden data layer in AI terms: what Usage Data really means
Major AI providers quietly claim ownership and training rights over Usage Data outside visible customer data. What this means for high-trust workflows.
August 24, 2026
AI literacy after the Digital Omnibus: from threshold to demonstrable measures
Since 27 July 2026 Regulation (EU) 2026/1744 amends Article 4 of the AI Act. AI literacy remains an organisation-wide duty, but as a demonstrable effort.
August 24, 2026
Anonymised data is no longer an end state after EDPB Guidelines 02/2026
The EDPB Guidelines 02/2026 make re-identifiability after anonymisation a testable, ongoing standard. What does that mean for high-trust data processing?
August 23, 2026
From logging obligation to reconstruction obligation: why autonomous AI agents need a verifiable timeline
Article 12 of the AI Act and a real agent intrusion at Hugging Face show why logging of autonomous AI actions must be a verifiable agent timeline.
August 21, 2026
Why accuracy is not reliability for business-critical AI
New 2026 studies show accuracy scores fall short for business-critical AI. How evaluation is shifting towards reliability, safety and governance.
August 21, 2026
Knowledge bases as an attack surface: why RAG poisoning is an architectural problem
A new study on medical multimodal RAG shows that poisoned knowledge bases can hijack retrieval. What that means for high-trust organisations.
August 20, 2026
Who Is Accountable for AI Decisions? Regulators Draw the Line
The EDPB and EDPS warn that simplifying the AI Act must not hollow out accountability. What does that mean for governance responsibility around AI?
August 20, 2026
Prompt injection in AI agents is an architecture flaw, not a model bug
New research and NIST frameworks from 2026 show that prompt injection in AI agents is a structural architecture problem, from memory to tool permissions.
August 20, 2026
Threshold values for AI decisions are becoming a legal design variable
China's agent rules and the AI Act make thresholds for AI-assisted decisions explicit. What does that mean for high-trust workflows?
August 19, 2026
AI memory is the new data-leak vector
Why memory features in AI assistants have become a data-leak risk of their own, and how to treat memory as an explicit, securable data layer.
August 19, 2026
DPIAs for generative AI and AI agents become a living risk map
Guidance from the CNIL, EDPS and the EDPB template turns DPIAs for generative AI and AI agents into a design and verification tool, not a tick-box document.
August 19, 2026
Why verification with a single AI model reaches its limits
Recent studies show that a single AI model is not a reliable self-verifier. What does that mean for professionals handling high-trust information?
August 18, 2026
AI and the GDPR in 2026: why scraping and anonymisation must now demonstrably hold up
The EDPB clarifies with Guidelines 03/2026 and 02/2026 how the GDPR applies to AI training, web scraping and anonymisation. What does that mean for your AI setup?
August 18, 2026
Explainability is not an audit trail: why AI transparency needs two layers
Research from 2026 shows that chain-of-thought is not a reliable audit trail. Why explainability and auditability are two distinct requirements.
August 18, 2026
AI answers are time-bound: why outdated source data is a risk in its own right
Studies from 2026 show that outdated and incomplete source data is the biggest driver of AI hallucinations. What does that mean for high-trust work?
August 17, 2026
Why a model name is not a version: change management for AI agents
Model updates, prompts, tools and policies together form a behaviour bundle. Why change management for AI in production must be versionable and auditable.
August 17, 2026
Privacy-sensitive data in AI: from being allowed to demonstrable control
The EDPB and EU transparency rules of July 2026 make clear that AI with personal data is not only allowed, but must be demonstrably limited and visible.
August 16, 2026
Tool Use by AI Systems as Its Own Risk Layer
BFCL V4 and a new jailbreak study show that AI function calls are not a simple feature but a verifiable chain that requires control.
August 14, 2026
Multilingual AI verification: why every translation is a separate claim
New benchmarks and EU rules show multilingual AI output must be verified per language. What does that mean for professionals with sensitive data?
August 14, 2026
Setting up and maintaining a practical AI risk register in 2026
In 2026 the AI risk register is the demonstrable core of AI risk management. What NIST, the EDPS and the EU AI Act ask, and how to maintain it in practice.
August 13, 2026
Kill switches for AI agents: from bill to concrete design
The AI Kill Switch Act makes emergency-stop capability for agentic AI concrete. What do a kill switch, rollback and circuit breaker really require of organisations?
August 13, 2026
Subprocessors in the AI chain: why an AI Bill of Materials is no longer a luxury
NSA guidance and CSA research make subprocessors in the AI chain visible. Why an AI Bill of Materials and chain control are now required.
August 12, 2026
When AI Agents Started Breaking In: The Hugging Face Incident as a Turning Point for Data Breaches
The autonomous breach at Hugging Face shows that AI tools and agents themselves become an attack path. What this means for organisations with confidential data.
August 11, 2026
Least privilege for AI agents becomes a design question in its own right
New guidance from Microsoft, CSA and OWASP describes how least privilege for AI agents requires its own identity, tool and audit architecture.
August 11, 2026
Why long AI summaries call for claim-by-claim verification
Several ACL 2026 studies describe how AI summaries of long documents can miss key claims and hallucinate. Why a visible verification process helps.
August 10, 2026
Numbers from AI are claims, not facts: why schema checks are not enough
New studies from 2026 show that AI structurally makes mistakes with numbers and tables. Why validating figures requires a layered, visible chain.
August 10, 2026
Same prompt, different answer: why reproducibility must be designed
Research from 2026 describes how identical prompts can produce different AI answers. Reproducibility is not a given but a measurable design question.
August 8, 2026
When Hallucinations Travel: How Fabricated AI Claims Steer Your Decisions
New research describes how AI hallucinations shift human decision-making. Why hallucinations are a decision risk and what verification can contribute.
August 6, 2026
Local or cloud: why AI privacy becomes a design question in 2026
Apple's WWDC 2026 and new research show that local AI is not automatically safer than cloud. Privacy becomes a verifiable architecture decision.
August 6, 2026
Safe AI use for lawyers and notaries requires a verification layer, not cautious prompts
New CCBE guides and national advisories show that AI use by lawyers aligns with a verifiable confidentiality and verification approach for legal practice.
August 5, 2026
Why AI confidence scores give a false sense of certainty
New 2026 studies show AI sounds just as confident when wrong as when right. Why confidence is a risk signal you must measure and calibrate.
August 5, 2026
Retention Periods for AI Prompts, Outputs and Audit Logs Under the AI Act
New guidance on Articles 12 and 19 of the AI Act sets retention periods for AI logs, while the GDPR demands shorter retention for prompts with personal data.
August 4, 2026
Right to erasure now reaches into model memory
EDPB guidelines on web scraping and unlearning research show that deletion requests in 2026 reach into model memory and demand demonstrable policy.
August 4, 2026
Secrets management for AI workflows becomes a primary security layer
After the June 2026 LiteLLM vulnerabilities, secrets management in AI workflows proves core architecture rather than detail. What that means for professionals.
August 3, 2026
AI procurement terms become hard selection criteria
The DOE and DOI tie AI procurement to bias tests, data provenance and logging. What does this shift mean for selecting AI services handling sensitive data?
August 3, 2026
Shadow AI in 2026: from quietly tolerated habit to visible governance problem
Recent studies from Teramind, PagerDuty, Lenovo and Verizon show that shadow AI is mainly a visibility and data problem. What does that mean for control?
August 2, 2026
EU AI Act: why postponement is not a postponement of homework
The political agreement on the Digital Omnibus delays the EU AI Act's high-risk rules, but transparency and classification already require action now.
August 1, 2026
Data leaks between users and sessions are a design problem
A session-isolation flaw at Writer shows that leakage between users, projects and sessions in AI is an architecture problem, not just a prompt issue.
July 31, 2026
Indirect prompt injection via documents and websites in 2026
Hidden instructions in websites and documents can mislead AI systems. What NIST, Google, arXiv and OWASP report and what it means for workflows.
July 31, 2026
Red teaming of AI agents becomes a continuous process
Microsoft's External Red Team Alliance and new research show that red teaming of generative AI and AI agents is shifting to an ongoing, ecosystemic process.
July 30, 2026
Multi-model verification in 2026: where models correct each other and jointly miss
Recent benchmarks and studies show multi-model verification reduces errors but does not fully solve them. Why differences between model judgements matter.
July 27, 2026
AI Output Validation in 2026: From Transparency Rules to a Verifiable Chain
The EU transparency rules of July 2026, the NIST framework and new hallucination research turn AI output validation into a chain of provenance and source control.
July 27, 2026
EU transparency rules mandate AI output validation from August 2026
The European Commission published AI transparency guidelines that apply from August 2026. What does that mean for output validation and verification?
July 27, 2026
Privacy-sensitive information and AI: why responsibility stays with the user
New guidelines from Singapore and AI court cases show organisations remain responsible for privacy-sensitive data, even with external AI models.
July 24, 2026
Prompt injection in AI agents: why architecture matters more than the model
Prompt injection in AI agents is an architecture and compliance problem. Why separated privileges, controlled memory and visible logs are needed.
July 23, 2026
AI agents as auditable actors under the EU AI Act
From 2 August 2026 strict logging and traceability duties apply to high-risk AI agents. What does this mean for agents with internal access?
July 23, 2026
AI Training Data Fall Fully Under the GDPR: What the New EDPB Guidelines Mean
The EDPB guidelines on web scraping for generative AI make clear that training data fall under the GDPR. What this means for organisations.
July 22, 2026
AI hallucinations as a governance problem: what the NIST guidelines and the 2026 incidents reveal
NIST publications and 2026 incidents show AI hallucinations affect decision integrity and data leaks. What this means for monitoring and output verification.
July 22, 2026
AI output validation: from governance requirements to concrete technique
How NIST and EDPS guidelines, together with recent hallucination benchmarks, show that AI output validation must combine governance and technique.
July 21, 2026
AI Agents with Internal Access: Prompt Injection as an Insider Threat
Why AI agents with access to internal systems resemble an insider threat in 2026, and how architecture, least privilege and verifiable logs limit damage.
July 21, 2026
AI hallucinations: from vague error to measurable risk in decision-making
Recent benchmarks and documented court cases show that AI hallucinations are highly context-dependent. What does this mean for professionals?
July 17, 2026
AI and professional secrecy: why confidential files call for controlled walls
Recent guidance from the BSB, CCBE, ABA and the EU AI Act shows that generative AI touches professional secrecy. What does that mean for lawyers using AI?
July 17, 2026
AI verification remains an architecture question — even as the AI Act deadline moves
The Digital Omnibus shifts the EU AI Act's high-risk obligations to 2027 and 2028. Why verification, logging and human oversight remain an architecture question.
July 16, 2026
AI Agents and Sensitive Data: Why Visible Access and Logging Are Becoming Indispensable
Research in 2026 shows that AI agents are a major source of data breaches. Why least-privilege, logging and verification are now indispensable.
July 16, 2026
What the first major AI-agent incidents teach us about building safely
Peer-reviewed research dissects the first major AI-agent incidents: 900+ exposed gateways, 32,000 leaked keys. What this means for building safely with AI.
July 16, 2026
The EU AI Act and confidential documents: what the high-risk rules require
How the EU AI Act's high-risk rules change working with AI on confidential documents, and why logging, oversight and verifiability now matter.
July 16, 2026
The EU AI Act makes recruitment AI high-risk: what HR must do now
AI tools for CV screening and candidate assessment count as high-risk under the EU AI Act. What this means for safe AI use in HR processes.