Spain's data protection agency has received the first notification of a personal-data breach in which the intruder was an AI agent rather than a person. By the notifying company's account, the agent searched for vulnerabilities, achieved a valid login, explored the application on its own, altered personal data and accessed invoices. The regulator's response is not a new rule but four changes to how every company must think about risk, response time, credentials and human oversight, with its own caveat that AI creates no new threats; it removes the time you had to respond to the old ones.

In the same week, two London bodies retired the other two point-in-time assumptions: give AI a learner's permit and monitor it for life, and stop passing liability from the companies that build AI to the companies that use it.

In this episode, Steph ...