Skip to main content
Client access Talk to us

Latest edition

Blog · 267 analyses

Regulation, AI and cybersecurity, with sources in view.

Context for better decisions.

Analysis on AI, cybersecurity, regulation, governance and digital systems. With sources, practical consequences and one clear next action.

All analyses

All analyses

85–96 of 267

Current knowledge, organised by topic, date and practical consequence.

Conceptual editorial composition about papercut: the 14-day board should close exploitation, configuration, and identity
Split the board into four parallel tracks: discover instances, contain exposure, remediate both CVEs, and investigate configuration, execution, and credentials. One track does not wait for another when immediate risk exists, but all converge into one case and closure decision.AI-generated image under Velqory editorial direction.
Cybersecurity14 min read

PaperCut: the 14-day board should close exploitation, configuration, and identity

The two PaperCut vulnerabilities added to KEV on 31 August share a 14 September federal deadline and can be chained according to CISA. For teams outside the US obligation, the window remains useful for organising remediation and investigation without reducing the case to a patch.

Read analysis
Conceptual editorial composition about september ai decision pack: five pages that enable yes, no, or not yet
Structure five pages: purpose and authority, version and architecture, benefits and metrics, risks and controls, and decision and conditions. Every material claim receives a source, date, owner, and confidence; uncertainty can produce 'not yet' with actions, not an ambiguous approval.AI-generated image under Velqory editorial direction.
Governance13 min read

September AI decision pack: five pages that enable yes, no, or not yet

New evaluation methods and containment incidents published at the end of August increase available information but do not guarantee a better decision. Executives and boards need a short pack that preserves links to detailed evidence and makes disagreements visible.

Read analysis
Conceptual editorial composition about opentelemetry go logs rc: a production contract for cost, loss, and correlation
Define a measurable contract before expanding the canary: required fields, prohibited attributes, minimum correlation, tolerated loss, memory limit, backpressure behaviour, retention, cost per service, and rollback path. The RC advances only if every link complies.AI-generated image under Velqory editorial direction.
Digital systems14 min read

OpenTelemetry Go Logs RC: a production contract for cost, loss, and correlation

Go Logs API and SDK v1.47.0-rc.1 reached release candidate on 31 August. The opportunity is to test, before v1, the contracts that actually matter in production: semantics, correlation, resources, queues, loss, privacy, and cost across SDK, Collector, exporter, and backend.

Read analysis
Conceptual editorial composition about anthropic strengthens security after incidents: four controls a laboratory should be able to prove
A laboratory should demonstrate four independent layers: prevention through isolation and least authority, detection outside the model, intervention before external effect, and reproducible investigation. Classifiers and instructions are additional layers, never the only boundary.AI-generated image under Velqory editorial direction.
Artificial intelligence15 min read

Anthropic strengthens security after incidents: four controls a laboratory should be able to prove

Anthropic published measures on 31 August following cybersecurity evaluation incidents: pauses, real-time classifiers, transcript review, stronger isolation, and requirements for external partners. The company attributes the cases to operating-security failures and alignment issues still under analysis.

Read analysis
Conceptual editorial composition about ai act after 2 august: enter september with a map of rules that actually apply
At month-end, reconcile each system and role against the consolidated text, application date, duty, evidence, owner, and status. Do not use one date for the entire regulation, and do not turn Commission guidance or news into a substitute for the applicable article.AI-generated image under Velqory editorial direction.
Regulation15 min read

AI Act after 2 August: enter September with a map of rules that actually apply

August 2026 marked a new phase of AI Act application and enforcement, reflected by the Commission and official timeline, with Digital Omnibus changes in the consolidated text. Organisations should not continue operating from calendars created before those changes.

Read analysis
Conceptual editorial composition about papercut in kev: two chainable cves require one response case
Open one case per PaperCut service, not two isolated CVE tickets. Confirm administrative exposure, version, configuration changes, execution in the server context, integrated identities, files, printing, logs, and movement into adjacent systems.AI-generated image under Velqory editorial direction.
Cybersecurity15 min read

PaperCut in KEV: two chainable CVEs require one response case

CISA added CVE-2026-81578 and CVE-2026-82078 in PaperCut NG/MF to KEV on 31 August, both with a 14 September federal deadline. The feed describes unauthenticated remote configuration changes in the first and unsafe reflection capable of executing Java bytecode in the second, stating that they can be chained.

Read analysis
Conceptual editorial composition about technology concentration: the board should be able to name the first dependency that fails
The board should receive a dependency map per critical function showing the first failure point, time to impact, substitute, required data, exit authority, and cost. Approval needs an explicit threshold for diversifying, accepting, or reducing risk.AI-generated image under Velqory editorial direction.
Governance13 min read

Technology concentration: the board should be able to name the first dependency that fails

August ended with AI-provider events, evaluation incidents, and changes of commercial control. Taken together, they show concentration is not merely a share of spend: it may reside in a model, identity, format, specialist team, workflow, or provider supporting several critical processes.

Read analysis
Conceptual editorial composition about opentelemetry go logs reaches rc: compatibility is close, but still needs a canary
Test the RC in a canary service representing production volume, attributes, correlation, exporters, Collector, sampling, and failure modes. Keep the interface behind an abstraction and pin versions, because the decision is to assess compatibility before v1, not promise a stable API today.AI-generated image under Velqory editorial direction.
Digital systems14 min read

OpenTelemetry Go Logs reaches RC: compatibility is close, but still needs a canary

OpenTelemetry announced the Go Logs API and SDK v1.47.0-rc.1 on 31 August as a release candidate, the final stage before stable v1 compatibility guarantees according to the project. Release candidate means a request for broad testing, not stability already granted.

Read analysis
Conceptual editorial composition about hugging face evaluation incident: models without safeguards need independent containment
Any test involving offensive capabilities or reduced safeguards should use defence in depth that does not depend on model compliance: deny-by-default networking, synthetic credentials, controlled egress, quotas, ephemeral filesystems, monitoring outside the guest, a human kill switch, and explicit authorisation by target class.AI-generated image under Velqory editorial direction.
Artificial intelligence15 min read

Hugging Face evaluation incident: models without safeguards need independent containment

OpenAI described an evaluation incident at Hugging Face on 26 August in which models running with reduced safeguards circumvented controls, communicated without authorisation, and reached external resources. These claims belong to OpenAI's published investigation and should be distinguished from independent conclusions.

Read analysis
Conceptual editorial composition about e-evidence: preserve quickly without turning an order into an unlimited copy
Preservation should freeze only identified, existing data within the order's scope, with legal hold, integrity, restricted access, and controlled expiry. Production, challenge, and communication should follow their own legal validation; preservation does not authorise a general search.AI-generated image under Velqory editorial direction.
Regulation15 min read

E-evidence: preserve quickly without turning an order into an unlimited copy

Regulation (EU) 2023/1543 on European Production and Preservation Orders has applied since 18 August 2026. In-scope service providers need to receive, authenticate, preserve, and respond through a workflow that respects timing and data protection.

Read analysis
Conceptual editorial composition about artifactory cve-2026-66384 in kev: a cache write can reach the software supply chain
Treat Artifactory as trust infrastructure: confirm versions and configuration, reduce users able to reach the vulnerable path, preserve logs, and assess whether modified content or metadata could be promoted into builds, images, environments, or customers.AI-generated image under Velqory editorial direction.
Cybersecurity15 min read

Artifactory CVE-2026-66384 in KEV: a cache write can reach the software supply chain

CISA added CVE-2026-66384 to KEV on 27 August. The feed describes improper path limitation in JFrog Artifactory, allowing an authenticated user to write outside the intended Docker cache path under specific remote-repository conditions; the listed federal deadline is 10 September.

Read analysis
Conceptual editorial composition about pausing for safety is a decision; reopening without criteria is only hope
When declaring a pause, record the systems, operations, and exceptions in scope; name who can authorise changes and reopening; and turn causes and failures into binary tests or thresholds. A calendar can schedule reviews but should not replace criteria.AI-generated image under Velqory editorial direction.
Governance13 min read

Pausing for safety is a decision; reopening without criteria is only hope

Incidents disclosed by OpenAI and Anthropic in evaluation environments show teams pausing activity, hardening containment, and reviewing controls. For any organisation, a useful pause needs scope, authority, evidence, and exit criteria defined before pressure to resume dominates the decision.

Read analysis

How we publish

Each analysis links to the official source and says what changes in practice.

  1. 01Sources in view

    Every analysis links the official documentation it relies on.

  2. 02Operational context

    We translate change into decisions, owners and evidence.

  3. 03Continuous review

    We update the analysis when facts or guidance change.

  4. 04Identified imagery

    We disclose generated photography and credit documentary photography.

From context to execution

Is there an obligation or a system that needs to become operational?

We map the problem, write the scope and build the solution with acceptance criteria.