The Briefing

What happened, why it matters, and what to do about it. Analysis, not rewritten press releases.

Showing 1 to 36 of 64 briefings

Today

A dark desk. A stack of blank off white paper record sleeves with one black vinyl single leaning on them, a thick blank slate blue bound document with an empty label well, and an open laptop whose screen shows blank grey chat bubbles. The left of the picture is empty dark navy with the headline drawn over it: Alleged: Anthropic copied the lyrics of 274 Elvis songs. 274 songs.

Compliance and Regulation26 Oct 2026

Elvis rights holders allege Anthropic copied lyrics of 274 songs and stripped credits, seeking $41.1m for the copying

What the 28 page complaint alleges, what it prints and leaves out, the arithmetic behind $41.1m and the statute's floor, what two earlier courts said, the technical artifacts it names, and a ranked checklist for AI product, legal and rights holder teams. Allegations only.

Two matte black rack servers stacked in a short open aluminium frame on a dark bench, each with a blank recessed label plate, and a pale cable looping to the bench. In front lie two blank paper strips, one about twice the length of the other. The left half is dark blue with the headline DNSSEC risk is forgery, Signature 2,420 bytes, and the figure 2,420 bytes.

Compliance and Regulation26 Oct 2026

ICANN's CTO says DNS quantum work is speeding up; the DNSSEC risk is forgery, and an ML-DSA-44 signature is 2,420 bytes

What The Register's ICANN interview claims, what the IANA registry, the IETF drafts, ICANN's own papers and the root zone show, the two threats the headline blurs, the packet size arithmetic, a dated deployment record, five friendly names audited, and a ranked checklist.

Yesterday

A dark editorial scene for the briefing, with its headline and key figure drawn over it.

Compliance and Regulation25 Oct 2026

FCC blocks a dashcam and a wireless video transmitter in first enforcement of its Covered List component rules

What the FCC said about its first enforcement under the Covered List component rules, what the Third Report and Order requires, and what the FCC left unstated.

Saturday 24 October

Compliance and Regulation24 Oct 2026

Google's privacy policy now says Search may use data you connect from Gmail and Photos to personalise ads

What Google's revised privacy policy says about connected Gmail, Drive and Photos data and ads, what its help pages add, and which countries are excluded from Personal Intelligence.

Friday 23 October

Compliance and Regulation23 Oct 2026

UK White Paper proposes up to 14 years for deliberate subsea cable and pipeline damage

What the UK White Paper of 22 October 2026 proposes for subsea cables and pipelines: new offences replacing parts of the 1885 Act, a three-tier penalty structure topping out at 14 years, new duties for telecoms providers, and a consultation closing on 14 January 2027.

Monday 19 October

Compliance and Regulation19 Oct 2026

Meta's 30 October crawler clause exists in two texts; the UK edition contained 'train' on 19 October

The crawler clause word for word, how the UK and US-English texts differ, what Meta's other terms already allowed, what its robots.txt page does and does not promise, what UK law and ICO pages say, and a ranked checklist for 11 days.

An ivory stack of blank share-certificate-style documents on a dark walnut desk beside a window in soft morning light. The top certificate has an engraved-style border, empty rounded panels, an empty round seal and a blank signature line. A plain black fountain pen and its cap lie beside the stack. The left half is dark and carries the headline and a stat drawn over it: up to 15% or 41%.

Compliance and Regulation19 Oct 2026

Anthropic's fund: 5% plus 2% per 50% rise reads as up to 15% or 41% at 10x, no baseline or owner stated

What Anthropic's 18 October post establishes about its Public Benefit Fund, the two readings of its escalator, what Delaware and IRS pages say about the forms involved, how it compares with OpenAI's Foundation and Anthropic's own Trust, what UK pages cover, and what to ask for.

Saturday 17 October

A dark open-plan office. Six identical pale grey desks recede in a row, each with one blank white visitor badge on a grey lanyard and an empty charcoal chair. A tall grey steel cabinet stands shut and locked beside the end of the row. The left half is empty dark blue, with the headline and a stat drawn over it: 27 HOURS.

Compliance and Regulation17 Oct 2026

Anthropic's METR arrangement: six staff, no veto, and a redaction clause rewritten 27 hours after publication

What Anthropic's 15 October post on METR and other evaluators establishes, what changed on 16 October, who pays whom, what the White House Accord requires, how the bank analogy maps onto UK law, and what a UK buyer can ask.

Thursday 15 October

Four plain brass padlocks of different ages stand in a row on a dark bench, from an old tarnished lock to a slim modern one with a faint cyan glow at the shackle. Each has a blank oval plate and a keyhole. The left half is empty dark blue with the headline Post-quantum TLS profiles are in. Still no date. and the figure 2031.

Compliance and Regulation15 Oct 2026

NCSC's new TLS guidance adds post-quantum profiles but prints no year; the blog beside it prints one, 2031

What changed between versions 1.1 and 1.2 of the NCSC's TLS guidance, how many recommendations carry a date or a test, how far the 2028, 2031 and 2035 milestones are, which groups are on by default, what the UK instruments say, and a ranked checklist.

A dark committee room. A thick printed Bill lies open on a polished walnut table, its pages showing rows of blank grey bars where text would be, with a pale cyan paper slip between them. Beside it stands an empty clear name-card holder on a steel foot. A row of empty teal leather chairs recedes into shadow. The left half is empty dark blue, with the headline and a stat drawn over it: 0 of 47.

Compliance and Regulation15 Oct 2026

UK Cyber Bill: AI appears 0 times in the text; 0 of 47 amendments on the 13 October list are the Government's

What the Bill, its amendment list, Hansard and the Government's three 12 October texts establish about AI in the Cyber Security and Resilience Bill, what they leave out, the calendar in days, which department owns it, what binds UK organisations now, and a ranked checklist.

Eight identical blank slate-blue bound court files stand in a row on a pale oak records-office counter, with a tablet computer leaning against them showing blank grey chat bubbles. The left of the picture is dark navy with the headline: Eight states. Eight courts. Allegations, not findings. 27 counts.

Compliance and Regulation15 Oct 2026

Eight states filed eight separate suits against OpenAI: of 27 counts in six read, 6 concern AI agents

What the eight state filings plead about children, what they do not establish, where OpenAI's own pages agree and differ, what UK rules cover a chatbot children use, and a checklist for a school, a parent-facing organisation and a company.

A dark police station front counter in cool blue light. A rugged black tablet on a stand shows an empty grid of six blank dark frames beside a column of blank pills. A stack of clear evidence bags and blank white tags lies in front, a plain black shop basket holding two unmarked boxes stands to the right, and a small blue lantern glows behind. The left half is empty dark blue, with the headline and a stat drawn over it: 179 people.

Compliance and Regulation15 Oct 2026

ICO: about 500 Met accounts on Auror, 179 people uploaded, no DPIA, and a control gap it dates to May 2018

What the ICO's reprimand and enforcement notice to the Met establish about the Auror platform, what they leave out, the dates and deadlines worked out, which UK regime governs police and retailer flows, and ordered checklists for a force DPO, a retailer and a vendor.

Page 2

Wednesday 14 October

A dark strongroom in cool steel light. A closed round vault door with a five-spoke wheel stands at the back right. In front of it a stack of six slate-blue ledger books is bound in a steel chain and held by one padlock, with three blank grey tags hanging from it. The left half is empty dark blue, with the headline and a stat drawn over it: 4 names, 1 entry.

Compliance and Regulation14 Oct 2026

UK lists Cryptomus and Heleket as one entity on a Russia ground, and the notice never mentions ransomware

What the UK notice states and does not, the arithmetic behind the Canadian fine and the 900 illicit counterparties a month, why a rebrand is not a control, what OFSI, the FCA, the NCSC and the ICO say as read, where the ransomware payment proposals stand, and an ordered checklist.

A dark navy desk seen from high above. A very tall stack of blank white paper stands on the right, a small blank cream card lies in front of it, and a straight row of identical blank cream cards runs across the foreground with a small black-stand magnifying loupe over one of them. The left third is empty dark space carrying the headline and a stat drawn over it: 45 of 203.

Compliance and Regulation14 Oct 2026

Home Office asylum summaries: 45 of 203 failed first review, and omissions are not a stated failure test

What the Home Office's FOI counts, DPIA, ministerial letters and ATRS hub show about two AI tools in asylum casework: the arithmetic behind 45 of 203, what a checked sample cannot say about the rest, UK controls as read, and two ordered checklists.

A dark room. A small vintage glass-domed ticker machine stands on a wooden table beside a smartphone with its screen switched off. A pale paper ribbon rises from the machine and splits into many thin strands that reach a tall wall of several hundred identical small pigeonholes, a few holding curls of blank paper. The left half is empty dark blue, with the headline and a stat drawn over it: 627 days.

Compliance and Regulation14 Oct 2026

Norway fines Xandr NOK 92 million over Grindr data: assumed consent rejected, user count not established

What the Xandr decision establishes and redacts, the arithmetic behind the fine, how it differs from the Grindr case, what the ICO, UK GDPR Article 26, PECR and the 2025 Act say, and an ordered checklist for UK app publishers and ad buyers.

Monday 12 October

A dark government briefing room. A slim graphite lectern with a pale ash-wood top stands right of centre, with a closed pale grey document folder and a darker elastic band lying on it, its label well empty. Behind it hangs a large wall display, switched off and completely blank. The left half is empty dark blue, carrying the headline and a stat drawn over it: 407 of 1,000+.

Compliance and Regulation12 Oct 2026

AI minister: breach 'likely, if not inevitable'. One pilot account shows 407 of 'over 1,000'; nothing new dated

The speech transcript, press release and Bill read for what is committed, dated, funded and binding: what the 1,000 counts, whether the Bill carries AI incident reporting (not today), what AISI is, and a UK checklist.

Friday 9 October

A regulator's desk at dusk with a row of identical pale grey-blue folders, some with a blank sheet sliding out, a printed checklist with empty boxes, a pen and an open laptop showing a blank response form. No people. Overlaid text reads ICO details changes at 8 of 10 AI developers, and dates none of them, plus 8 of 10, developers with a line of their own: 3 done, 3 promised, 2 both.

Compliance and Regulation9 Oct 2026

ICO details changes at 8 of 10 AI developers: 3 done, 3 promised, 2 both, and none dated

What the ICO's 8 October report prints for each of ten AI developers, what it leaves out, what the call for evidence on agentic AI asks, and the register a UK organisation using these tools should keep before 20 November.

A compliance desk at dusk with a thin and a thick printed policy document, a printed checklist with empty boxes, a blank approval card, an open laptop showing a blank document viewer and a small red emergency-stop button. No people. Overlaid text reads Usage Policy: 79% longer, effective 12 November, plus 79%, our word count 4,424 against 2,473.

Compliance and Regulation9 Oct 2026

Anthropic's new Usage Policy is 79% longer and takes effect 35 days after it was posted

Anthropic's Usage Policy takes effect 12 November: 4,424 words against 2,473. What changed in substance, what the texts do not establish, and what a UK organisation building on Claude should record before the date.

A back-office desk at dusk with a handheld card terminal beside an open laptop whose screen shows a chat window and a small approval card with two blank buttons, a blank card, a plain security key and an emergency stop button. No people. Overlaid text reads One 'must', 130 'should' in PCI SSC's AI guidance, 130 : 1.

Compliance and Regulation9 Oct 2026

PCI SSC's AI guidance has one 'must' and 130 'should', and asks for explicit human approval in one example

PCI SSC's advisory AI guidance, dated September 2026, has one 'must' against 130 'should'. What it ties to PCI DSS, what is new, what it leaves undefined, and what UK merchants and suppliers can check.

Thursday 8 October

A school desk at dusk with an open laptop showing a chat window with a rounded reminder card, an open study planner with one highlighted row, a stack of blank flashcards and a sand timer. No people. Overlaid text reads 2.7 million more messages, no group size or method stated.

Compliance and Regulation8 Oct 2026

OpenAI's teen figures: 2.7 million more messages, with no group size, period or method stated

OpenAI's 7 October teen post gives no group size, period or method for its figures, and its social media comparison sets a survey against logs. What UK schools, parents and providers can check under Ofcom, ICO and DfE rules.

A dark desk with an open silver laptop and a plain graphite call-centre headset lying in front of it. The laptop screen shows a tall list of eight blank rounded rows, each with a small dot at the left and a small blank pill at the right, with no writing anywhere. Nobody is in the room.

Compliance and Regulation8 Oct 2026

Guardian: AI scores Co-op Legal Services calls on more than 50 aspects; the Co-op calls it a support tool

Monitoring is not unlawful in itself, and a score is not a decision. The Guardian's account leaves open whether callers were told, whether an impact assessment came first, and what managers do with a fail score.

Tuesday 6 October

Compliance and Regulation6 Oct 2026

OpenAI's own test: its text watermark falls from about 92% to 17% detection when 25% of words are replaced

In OpenAI's own test, its textGrain watermark was found in about 92% of unedited 400-token passages and 17% after 25% of words were replaced. What that means for the EU rule behind it and for UK universities, employers and publishers.

Monday 5 October

A general practitioner's consulting-room desk at night: an open laptop shows a patient-records table drawn as rows of blank pills, with a plain stethoscope coiled beside it and an examination couch dim in the background.

Compliance and Regulation5 Oct 2026

Italy fines IQVIA €7 million after finding its 'anonymous' database of one million patients was not

A €7.00-a-head fine, one patient on 34 rows, and a patient code that followed people for years. What the Garante stated, what it did not, why the SRB defence failed, and what a UK data protection lead should check.

A dark desk with a monitor showing a blank statistics dashboard of empty rounded tiles and two plain bars beside one hollow amber outline, and a closed navy statute book with blank paper page flags in front of it. No people and no writing.

Compliance and Regulation5 Oct 2026

IWF: 6,310 AI child sexual abuse images assessed in six months, 40% above all of 2025

What 6,310 against 4,512 counts and cannot show, why six months set against twelve flatters nothing and hides nothing, which UK legal tools are in force today, and a checklist for anyone who builds, hosts or deploys image tools.

Page 3

Wednesday 30 September

Editorial illustration for the briefing: 808,000 UK businesses were not confident at one or more of nine tasks, and that measures confidence, not skill

Compliance and Regulation30 Sept 2026

808,000 UK businesses were not confident at one or more of nine tasks, and that measures confidence, not skill

The 57 per cent is a share of 1.42 million businesses with staff, mostly micro firms, counted if any one of nine tasks failed a confidence question. Only three of the nine tasks rose since the 2025 report.

Tuesday 29 September

Compliance and Regulation29 Sept 2026

Ofcom is examining an Apple age signal 140 days after go-live: the duty stays with the site

Ofcom's case CW/01358/09/26 examines Aylo's due diligence and testing, not Apple's system. A reading of Ofcom's case page, guidance and the Act on what an investigation is, what highly effective means, and what to ask of any third-party age check.

Saturday 26 September

Compliance and Regulation26 Sept 2026

Eleven days from identifying the incident to telling anyone. The 72 hour clock is a different clock

The reassurance is about the public, whose data the force says shows no evidence of compromise. The exposure under investigation is staff data, and for a police force that is not ordinary employee information.

Friday 25 September

Compliance and Regulation25 Sept 2026

The EDPB's new fining guidelines make a fine the default: not minor means a strong presumption to fine

Minor infringements generally get a reprimand. Anything else carries a strong presumption that a fine should be imposed. The guidelines are open to consultation until 13 November.

Thursday 24 September

Compliance and Regulation24 Sept 2026

Sweden fined a processor six pence a head for a breach that reached a fifth of the country

The Swedish regulator's sanction against Miljodata works out at roughly six pence per affected person. Reading the decision in full shows why that figure is real, why it is not evidence of leniency, and what it tells a UK board about budgeting security against expected fines.

Wednesday 23 September

Compliance and Regulation23 Sept 2026

The EU AI Act names agentic AI once, in a list of filing codes for notified bodies

An agent is an AI system under Article 3(1), so the system duties attach. The strain is in Article 14 human oversight, the provider and deployer split, purpose-based classification and what Article 12 actually requires you to log.

Compliance and Regulation23 Sept 2026

GOV.UK One Login opens passkeys to 23 million users and keeps the phishable route open beside them

Passkeys on GOV.UK One Login genuinely end credential phishing for the credential they protect. The published guidance also keeps a password and a one time code available on the same page, and lets that weaker pair delete the passkey.

Tuesday 22 September

Compliance and Regulation22 Sept 2026

Spain fines Securitas Direct €100,000 for routing data rights to a premium rate 902 number

A Spanish decision signed in February 2023 and published in September 2026 holds that every channel a controller offers for data rights must be easy to use, not just the best one.

Editorial illustration for the briefing: China is investigating DeepSeek and Moonshot over routing to Claude, on evidence only Anthropic holds

Compliance and Regulation22 Sept 2026

China is investigating DeepSeek and Moonshot over routing to Claude, on evidence only Anthropic holds

What the reported Cyberspace Administration investigation covers, which Chinese rules could bite, why 12.1 million exchanges is not 12.1 million people, and the routing questions UK buyers should put to every AI supplier.

Compliance and Regulation22 Sept 2026

Bessent says OpenAI's managers answer for its agents, but names no law that would charge them

Bessent rejects a liability shield for AI labs, but his remarks name no offence, bill or prosecutor. We read the transcript, correct a misattributed quote, and test UK failure to prevent fraud and the new senior manager rule against AI agents.

Compliance and Regulation22 Sept 2026

British Columbia sues OpenAI over Tumbler Ridge on a duty to warn police that no court has yet tested

British Columbia's complaint against OpenAI repeats, heading for heading, the eight claims the victims' families filed in April, and rests on California common law rather than a provincial statute. What it alleges, what OpenAI has said on the record, and what UK deployers should check.

Compliance and Regulation22 Sept 2026

MPs invited four AI labs to answer ten safety questions that no UK law currently answers

Four identical letters, ten questions, seven days to confirm. What the committee's papers actually say, what it can and cannot compel, and where UK AI and cyber law really stand before the 13 October hearing.

Show 12 more