Regulation, Compliance and Security for AI Automation

Key takeaways

• India's real build deadline is 13 May 2027, not 13 November 2026. The Gazette puts only the consent-manager provisions on 13 November 2026. Notice, consent, security safeguards, the 72-hour breach report and one-year log retention start on 13 May 2027, and so do the penalty provisions (up to ₹250 crore).
• India's AI-specific duties come from content rules and from regulators acting as buyers. The IT Rules amendment in force since 20 February 2026 requires labels on synthetic audio-visual content and action on government or court orders within 3 hours (previously 36). RBI FREE-AI and CERT-In's AI guidance reach vendors through procurement contracts, but CERT-In's 2022 Directions are binding: service providers and body corporates must report listed cyber incidents, including attacks on AI/ML systems, within 6 hours.
• In the US, the states set the duties while Washington contests them. EO 14365 targets state AI laws, but Colorado's ADMT law (SB 26-189), its Chatbot Safety Act and California's ADMT compliance deadline all fall on 1 January 2027. A federal court order of 27 April 2026 in X.AI LLC v. Weiser bars Colorado's Attorney General from beginning enforcement of SB 24-205, or of its same-session replacement, until 14 days after a preliminary-injunction ruling; whether it reaches SB 26-189 is arguable. Comments on Colorado's draft rules are due by 26 October 2026. Texas TRAIGA and NYC Local Law 144 already apply.
• The EU moved its high-risk deadlines, not its transparency rules. The AI Omnibus, Regulation (EU) 2026/1744, has been in force since 27 July 2026. Standalone high-risk duties move to 2 December 2027, but Article 50 transparency and Article 4 literacy already apply.
• Day to day, agent security is a larger risk than regulation. Most serious 2025-2026 incidents in the sources reviewed followed one pattern: an agent read untrusted text and then acted with real credentials or sent data out. Classifier defences were bypassed; those sources record no bypass of deterministic limits on egress, privileges or sandboxes.
• Use free standards for different jobs. Use the OWASP Agentic Top 10 for design reviews, MITRE ATLAS to label findings, CSA's AI Controls Matrix for questionnaires, and the Five Eyes and Singapore agentic guidance for governance. Pursue ISO/IEC 42001 only if your customers require it, because cloud certificates are not inherited.
• Vendor promises are narrower than the headlines. IP indemnities exclude customer inputs, combinations and disabled filters, which are exactly the parts your own team or implementation partner builds. Zero data retention needs vendor approval and has carve-outs: OpenAI's managed Agents API and vector stores are not eligible. No vendor's own API processes requests in India (OpenAI's India option is storage at rest only). AWS Bedrock does offer India-only routing (Mumbai and Hyderabad) for the previous Claude generation (Opus 5, Sonnet 5, Haiku 4.5), Kimi K3 and GPT-5.6 Terra/Luna; the newest models (Claude 5.5, GPT-6, Gemini 3.6 and later) have no documented India processing on any cloud read.
• Access to a model is itself a regulatory risk. A US export-control directive switched off two frontier models for all customers from 12 June to 1 July 2026.
• Proportionate governance for a small or mid-sized business fits on a page: six policies, four roles, one AI inventory, one risk register, a tested kill switch and AI-specific clauses in vendor and partner contracts.

Scope, evidence labels and the legal-advice caveat

This page covers the law, standards and security risks that apply to building and deploying AI automation and agents. Facts are as of 12 October 2026 and come only from the sources cited in this research. The most decision-critical dates and terms were re-read on their primary pages on 11 October 2026; legal texts and cloud residency pages were re-checked against primary sources on 12 October 2026. This is research, not legal advice. Whether a business counts as developer or deployer, provider or deployer, or fiduciary or processor depends on facts and contracts, so check each obligation with qualified counsel before relying on it. The page describes no particular company and implies no certification or compliance status for anyone.

Evidence labels: [P] primary (a gazette, legislature, regulator, court-appointed administrator, standards body or the vendor's own page); [S] secondary (law-firm commentary, news or Wikipedia); [U] unconfirmed (a search summary, a headline listing, or a single secondary source that could not be opened). Where sources disagreed, the page follows the most recent primary text, and says so where it matters. Recommendations are written for a business adopting AI automation, whether it builds in-house or with an implementation partner, with most detail on India, the US and the EU.

Related pages: India, Americas and Europe, Asia-Pacific, Middle East and Africa and Countries for country context; Claude, OpenAI, Gemini, Grok and DeepSeek for vendors; Frameworks, Tool stack and Playbook for building blocks; Timeline and Glossary for dates and terms.

India sets the nearest deadlines through data protection, not AI law

G.S.R. 843(E), in the Extraordinary Gazette issue dated 13 November 2025 (some summaries say 14 November), brought the Data Protection Board provisions into force on publication. It put only the consent-manager provisions, s.6(9) and s.27(1)(d), on 13 November 2026, and deferred the operative duties to 13 May 2027: notice, consent, security, breach notification, rights and cross-border rules (G.S.R. 843(E)). The DPDP Rules match: Rule 4 (consent managers) from 13 November 2026, and Rules 3, 5-16, 22 and 23 from 13 May 2027 (G.S.R. 846(E); DPDP Rules 2025; Hogan Lovells). For most businesses and their processors, November 2026 matters only where a registered consent manager is used. The build deadline is May 2027.

The 2027 duties bite hard on AI pipelines.

• Consent must be "free, specific, informed, unambiguous, and unconditional", limited to the stated purpose and as easy to withdraw as to give. The Act has no "legitimate interests" or "contractual necessity" ground (Hogan Lovells). Reusing customer chats to prompt, evaluate or fine-tune models beyond the notice therefore probably needs fresh consent (an inference from the Act).
• Breach: Rule 7 requires notice to affected individuals as well as the Board. Under Rule 7(2) the fiduciary tells the Board "without delay" and files a fuller report within 72 hours (DPDP Rules 2025).
• Security safeguards include encryption or masking, access controls, monitoring, one-year log retention (Rule 6(1)(e)) and security terms in processor contracts. Rule 8(3) separately requires keeping personal data, associated traffic data and processing logs for at least one year for Seventh Schedule purposes (both from 13 May 2027) (DPDP Rules 2025; G.S.R. 846(E), Gazette; AZB & Partners). Processors have no direct duties; the duties reach them through data processing agreements.
• Cross-border: Rule 15 only sets conditions: transfers abroad are "subject to" requirements the Central Government specifies "by general or special order" about making data available to a foreign State. The power to restrict transfers to notified countries is Act s.16(1). Both apply from 13 May 2027; no s.16 notification or Rule 15 order was found (MeitY's index was unreadable, so absence is not confirmed). Under Rule 13, Significant Data Fiduciaries may be barred from transferring specified categories and must run annual DPIAs and audits and check that their algorithmic software does not put data principals' rights at risk ("algorithmic due diligence"); the gazette does not say which entities are SDFs (G.S.R. 846(E); DPDP Act; Hogan Lovells).

The Act's Schedule sets maxima, not minimums: up to ₹250 crore for security-safeguard failures, ₹200 crore each for breach notification and children's-data duties, ₹150 crore for SDF duties and ₹50 crore for breaches of any other provision or rule (DPDP Act). The penalty section itself (s.33) is in the 13 May 2027 phase (G.S.R. 843(E)). A secondary claim that ₹50 crore is a minimum is wrong.

AI-specific content rules. The IT Rules amendment on "synthetically generated information" (G.S.R. 120(E)) was notified on 10 February 2026 and took effect on 20 February 2026. It requires a prominent label on synthetic audio-visual content (sources differ on whether the metadata or provenance duty applies "where technically feasible" or is "permanent") and proactive detection by intermediaries. Intermediaries get 3 hours (previously 36) to act on court or government orders (amended Rule 3(1)(d)) and 2 hours for complaints about non-consensual intimate imagery, including morphed or deepfake nudity (amended Rule 3(2)(b)) (Hogan Lovells; Business Today; iPleaders; Gala Law; secondary, gazette not read). A draft of 21 April 2026 requiring labels for the full duration of the content remains a draft (comments closed 7 May 2026; no final notification found) (S.S. Rana & Co.). Enforcement runs through safe harbour: on 2 January 2026 MeitY's Cyber Laws Division asked X's India Chief Compliance Officer for an action-taken report within 72 hours on Grok-generated obscene images, warning of the loss of s.79 protection. Around 11 January, "government sources" said about 3,500 items had been blocked and 600 accounts deleted; no published report or enforcement decision was found (Business Today; exchange4media; secondary, several outlets). MeitY's AI Governance Guidelines (5 November 2025) favour existing law over a new statute (Indian Infrastructure, secondary). Courts add pressure too: in March 2026 the Supreme Court reportedly criticised a judge for citing AI-invented orders (BBC, headline only).

Sector regulators act through procurement. RBI's FREE-AI committee report (13 August 2025) has seven "Sutras" and 26 recommendations under six pillars (RBI press release, primary). It is a committee report, not a direction; RBI's notifications list (first page) shows no AI direction. The recommendations include an inventory of deployed AI systems, periodic audits, annual-report disclosures, and AI in incident reporting and security testing (Outlook Money, secondary; the report PDF could not be loaded). A law-firm reading calls it "not yet a binding regulation" intended for Master Directions, and expects duties to "flow down" by contract to the vendors of banks, NBFCs, payment operators and fintechs (Bar and Bench). SEBI's AI/ML consultation (20 June 2025) has no final guideline yet (Lakshmisri). CERT-In has issued:

• binding Directions under s.70B(6) of the IT Act (28 April 2022): service providers, intermediaries, data centres, body corporates and government bodies must report listed cyber incidents within 6 hours of noticing them; Annexure I item (xx) lists attacks on "systems/servers/software/applications related to Artificial Intelligence and Machine Learning"; logs are kept for 180 days within India (CERT-In Directions, primary). Businesses that run AI systems, and the software and AI service firms that build them, fall within that scope (inference from the text);
• a generative-AI best-practice advisory (26 March 2025; S.S. Rana & Co.);
• Technical Guidelines v2.0 on SBOM, QBOM, CBOM, AIBOM and HBOM (9 July 2025, with MeitY), including an AI Bill of Materials of training-data sources, licences and known vulnerabilities. Its language is "recommended" and "encouraged", and it is not a s.70B direction: treat it as non-binding guidance that shapes procurement (CERT-In guidelines v2.0, primary; commentary: Medianama; AZB & Partners; Mondaq);
• a high-severity advisory to organisations and MSMEs on AI-accelerated attacks (late April 2026; OECD.AI);
• a "Blueprint for Reducing Exposure and Defending against AI-Assisted Vulnerabilities Exploitation", version 1.0, dated 25 May 2026 (CERT-In PDF, primary; binding status not stated);
• "Guidelines regarding AI-Accelerated Vulnerability Protection and Response Requirements for OEMs and Technology Providers" (CISG-2026-03, 10 June 2026): title and date are on CERT-In's listing, but the body was not read and its binding status is unknown. A secondary summary says they require a secure development lifecycle, "both traditional and AI-assisted security testing", SBOMs, faster patching and disclosure (TeamLease RegTech). Whether service firms count as "technology providers" is unverified.

Automated calls. Comments hosted by TRAI (April 2026) on the draft TCCCPR Third Amendment Regulations 2026 describe a new A2P call category with pre-declaration and termination charges, a lower complaint threshold for suspending senders and operator "AI-flagging" (TRAI-hosted comments); a fully automated voice agent appears to count as A2P (inference). Final rules were reported notified on 18 September 2026 (Policy Edge, secondary; official text not read). No explicit AI-voice rule is confirmed.

United States: state laws set the duties while Washington contests them

No federal AI statute was found, and federal policy now pushes against the states. EO 14365, "Ensuring a National Policy Framework for Artificial Intelligence", was signed on 11 December 2025 (Federal Register). It directs the DOJ to build an AI Litigation Task Force to challenge state laws and Commerce to list "onerous" ones, with broadband (BEAD) funds cited as leverage (Axios). DOJ announced the task force on 9 January 2026, about when the order required (Wikipedia, single-source; search summaries agree). The Commerce list and BEAD notice (both due about 11 March 2026), the FTC policy statement and the FCC proceeding were not found in the Federal Register. No court has ruled a state AI law invalid, but a stipulated federal order has paused Colorado's enforcement (below), and xAI (SpaceXAI LLC) seeks an injunction pending appeal against Minnesota's Attorney General (8th Cir. No. 26-2806; filings only read; CourtListener). On this research's reading, an executive order does not itself preempt state law, so state duties keep binding while challenges proceed.

Two later orders add security and naming measures. EO 14409 (signed 2 June 2026; 91 FR 34565) tasks CISA, Treasury and the NSA with frontier-model cyber defence, a classified cyber-capability benchmark and a voluntary framework giving the government up to 30 days of pre-release access; Sec. 3(c) rules out mandatory licensing or preclearance, and no implementation outputs were found (Federal Register). EO 14434 (signed 29 September 2026; 91 FR 63129) has agencies write "Super Intelligence" (SI) for "AI" in official communications where the law allows and asks the APST for a federal SI definition within 60 days (about 28 November 2026) (Federal Register). Federal agent rules exist only as discussion drafts: Senator Warner's AI AGENT Act of 29 June 2026 (Wikipedia, secondary) and a broader Obernolte–Trahan bipartisan preemption draft (June 2026) that reportedly stalled (CASRAI, single-source secondary).

Colorado matters most to businesses that automate decisions about people. SB 26-189 repeals and re-enacts its 2024 AI Act as an automated decision-making technology (ADMT) law, which became law on 14 May 2026 (Colorado General Assembly). From 1 January 2027, developers must give deployers documentation of intended uses, training-data categories, known limitations, and instructions for appropriate use and human review, and must notify deployers of material updates. Both developers and deployers keep compliance records for at least three years. Deployers must give notice "at the point of interaction". After an adverse decision they must explain the ADMT's role within 30 days and offer "meaningful human review and reconsideration". The Attorney General enforces, with a 60-day cure period before 1 January 2030 and no new private right of action. The Chatbot Safety Act (HB 26-1263, signed 1 July 2026) also starts on 1 January 2027. It requires age estimation, AI disclosure, teen safeguards, self-harm response protocols and an annual report to the AG. Written comments on the AG's draft ADMT and chatbot rules are due by 26 October 2026, the hearing date, or later if the hearing continues (Colorado AG). In X.AI LLC v. Weiser (D. Colo., No. 1:26-cv-01515), filed 9 April 2026 over SB 24-205 and joined by the United States as a plaintiff on 24 April, a minute order of 27 April 2026 (ECF 24) bars the AG from beginning enforcement of SB 24-205, or of legislation replacing or amending it enacted that session, until 14 days after a ruling on xAI's preliminary-injunction motion (due within 28 days after final implementing rules); other deadlines are stayed. Whether this reaches SB 26-189 is arguable from the order's wording, not confirmed (CourtListener docket, primary, entries to 27 April 2026). A reasonable inference is that whoever builds a hiring, lending, housing or insurance screen for Colorado users, whether your own team or an implementation partner, will usually be the "developer", and that a standard model card plus a human-review guide covers that role; if a partner builds it, ask for that package. Confirm both points with counsel once the final rules appear.

Other states.

• California's CCPA regulations matter more to businesses using AI than its frontier-model law. They took effect on 1 January 2026. A business using ADMT for a significant decision before 1 January 2027 must comply by 1 January 2027 (later users, from first use). Risk assessments conducted in 2026 and 2027 go to the CPPA by 1 April 2028 (later ones by 1 April of the following year), and a separate rule requires completing risk assessments for certain processing "no later than December 31, 2027". First cybersecurity audits fall due on 1 April 2028, 2029 or 2030 for revenue over $100M, $50-100M and under $50M (CPPA approved text, primary; commentary: National Law Review).
• California SB 53 binds frontier developers above 10^26 operations from 1 January 2026, with penalties of up to $1 million per violation. Critical safety incidents go to Cal OES within 15 days (Clifford Chance). From 1 January 2027, Cal OES publishes an annual anonymised report on those incidents (Goodwin). The law concerns model vendors, not the businesses that build on their models.
• Texas TRAIGA (1 January 2026) bars developers and deployers from intentionally using AI to incite harm, discriminate unlawfully or make certain deepfakes (Wikipedia). The enrolled HB 149 sets civil penalties of $80,000-200,000 per uncurable violation and up to $40,000 a day for continuing ones, after notice and cure, plus a regulatory sandbox (ch. 553) and preemption of local rules (s.552.003) (Texas HB 149, enrolled, primary); the 1 January 2026 effective date comes from earlier sources and was not found in that text.
• NYC Local Law 144, enforced since July 2023, requires an independent bias audit within a year before using a hiring tool, covering selection rates and impact ratios by sex and race/ethnicity, plus 10 business days' notice (NYC DCWP; DCWP FAQ).
• New York's RAISE Act was signed on 19 December 2025 (Wikipedia). Its chapter amendments (A9449/S8828) were reported passed on 11 March and signed on 27 March 2026 (SecurePrivacy, secondary), but Wikipedia (February 2026) still shows them in committee. Reported terms: effective 1 January 2027; a DFS office; 72-hour incident reports; penalties up to $1M, then $3M; no private right of action; thresholds of $500M revenue and 10^26 FLOP. Illinois HB 3773 could not be verified.
• The FTC's fake-reviews rule (21 October 2024) covers AI-written testimonials (Sidley, secondary).

European Union: high-risk duties slipped, transparency and literacy did not

The AI Omnibus is Regulation (EU) 2026/1744. It was published on 24 July 2026 and entered into force on 27 July 2026 (NatLawReview, K&L Gates). The Commission confirms the in-force date and says the AI Act "became applicable on 2 August 2026, with some exceptions" (European Commission). That page links the Omnibus to Official Journal reference L 2026/1744, confirming the number; the 24 July publication date rests on several law firms, because the EUR-Lex text could not be read. The Omnibus makes four changes that matter here:

• Annex III standalone high-risk duties (employment, education, credit, critical infrastructure) move to 2 December 2027, and Annex I product-embedded duties to 2 August 2028.
• Two new prohibitions, on AI systems generating non-consensual sexual deepfakes and child sexual abuse material, apply from 2 December 2026 (AI Act Service Desk timeline, primary).
• The AI Office gains exclusive supervision of certain systems built on general-purpose models, backed by periodic penalties of up to 5% of average daily turnover (NatLawReview).
• Transparency is not delayed. Article 50 duties, including AI-interaction disclosure, deepfake labels and machine-readable marking of AI-generated content (Art. 50(2)), apply from 2 August 2026. Only generative systems already on the market before 2 August 2026 get a grace period for the marking duty, to 2 December 2026 (Addleshaw Goddard).

The separate Digital Omnibus, which would amend the GDPR, NIS2 and the Data Act, was still at Parliament committee stage in October 2026 (draft report 22 June, amendments 27 July 2026, "awaiting committee decision"), per the OEIL file 2025/0360(COD) read through an automated page summary (secondary).

Article 50(1) requires AI systems that interact with people to tell them so, unless it is obvious (artificialintelligenceact.eu, secondary). That covers nearly every customer-facing chatbot or voice agent. Article 4 AI literacy is the easiest duty to miss. It has applied since 2 February 2025. "No specific – or 'sufficient' – level is mandated", "there is no need for a certificate", and internal training records suffice. National authorities enforce it from 2 August 2026; the Commission page also says 3 August (AI literacy Q&A). GDPR Article 22 bars decisions "based solely on automated processing" with significant effects unless an exception applies. Even then it guarantees human intervention and a way to contest the decision (GDPR Art. 22).

Three facts matter for vendor due diligence where EU users are involved:

• The Commission's General-Purpose AI Code of Practice page confirms that xAI "signed up to the Safety and Security Chapter" only; Meta does not appear on it (12 Oct 2026). The count of 22 signatories and names such as Amazon, Anthropic, Google, IBM, Microsoft, Mistral AI and OpenAI come from an automated summary of the page, so re-check them before relying on them (European Commission, secondary for the list).
• The Commission opened a Digital Services Act proceeding against X over Grok on 26 January 2026; fines can reach 6% of turnover (Anadolu Agency).
• Italy's own AI law (No. 132/2025) has applied since 10 October 2025 (Gazzetta Ufficiale).

Demand is uneven. 19.95% of EU enterprises with 10 or more staff used AI in 2025, ranging from 42.03% in Denmark to 5.21% in Romania (Eurostat). Customer and partner questionnaires about AI literacy and transparency are likely to arrive first from the high-adoption northern markets.

UK, China, Asia-Pacific, Brazil and Canada: from binding labels to voluntary frameworks

UK. The Data (Use and Access) Act 2025 allows solely automated significant decisions under "a more permissive framework" with safeguards (GOV.UK). Section 80, which inserts UK GDPR Articles 22A-22D, has been in force since 5 February 2026 under S.I. 2026/82, reg. 2(j) (legislation.gov.uk, primary). Ofcom opened a Grok investigation on 12 January 2026 (Wikipedia, secondary).

China regulates outputs and registrations. Its labelling measures (signed 7 March 2025 and published by the CAC on 14 March 2025; CAC, primary) and the mandatory standard GB 45438-2025, in force since 1 September 2025, require both visible labels and labels embedded in metadata (Loeb & Loeb). 988 generative AI services had filed with the CAC by 30 June 2026 (Digital Policy Alert). An AI article added to the Cybersecurity Law has applied since 1 January 2026 (Caixin Global).

Singapore has the most useful agent document in Asia. IMDA's voluntary Model AI Governance Framework for Agentic AI (22 January 2026) holds organisations legally accountable for agents they build or buy (Bird & Bird). It covers controls on planning and tool use, pre-deployment testing, gradual rollout and monitoring (CMS).

Japan's AI Promotion Act (largely effective since 4 June 2025) "contains no explicit penalties" beyond possible public naming (FPF). Its first AI Basic Plan was adopted by Cabinet on 23 December 2025, for annual updates (Jiji via Adnkronos, secondary). A revision dated 14 July 2026 is cited (Cabinet Office; file not readable; approval date unverified). Numeric targets (public AI use from 50% to 80%; about ¥1 trillion of private investment) appear only in the 6 December 2025 draft.

South Korea's AI Basic Act (in force since 22 January 2026) fines up to KRW 30 million for failing to tell users about AI use, failing to appoint a local representative, or ignoring corrective orders. Enhanced duties apply above 10^26 FLOPs (Cooley). Its enforcement decree was promulgated on 21 January 2026. The latest reporting (the November 2025 draft decree and MSIT statements) gives a fine-free grace of at least one year, so fines start about January 2027; corrective orders are not suspended (Presencis, secondary). IAPP's "multi-year" description predates this. IAPP also says the local-representative duty reaches only foreign firms above revenue or user thresholds, such as more than 1 million domestic users (IAPP).

Taiwan's AI Basic Act passed its third reading on 23 December 2025 and takes effect on promulgation, whose date was not found, so the often-cited 14 January 2026 is unverified (a February 2026 blog says it is in effect). The NSTC is the competent authority and MODA builds the risk-classification framework. Baker McKenzie reads the Act as providing for labelling of high-risk AI but imposing no immediate private-sector duties (Baker McKenzie, secondary).

Vietnam's Law on AI (No. 134/2025/QH15, in force since 1 March 2026) covers foreign entities operating in Vietnam (Digital Policy Alert). It allows 18 months of transition for health, education and finance systems and 12 months for other existing systems (Baker McKenzie). An implementing decree on AI authority governance entered into force on 1 May 2026, and sibling decrees (risk classes, design requirements, data protection, monitoring, quality of service, procurement) appear in the same tracker series; their texts were not read (Digital Policy Alert, secondary).

Australia's National AI Plan (2 December 2025) paused mandatory guardrails and ruled out a standalone AI Act (MinterEllison, secondary).

Brazil has no AI law. PL 2338/2023 is awaiting a rapporteur's opinion in a Chamber special committee (Câmara dos Deputados; Senado Federal).

Canada's AIDA died with Bill C-27 on 6 January 2025 (LEGISinfo). Its "AI for All" strategy relies on "modern privacy and online safety laws" (ISED), and the Privacy Commissioner used privacy law against Grok's image generation in June 2026 (Wikipedia, secondary).

Compliance calendar, October 2026 to 2028

Standards: which framework does which job

Free frameworks cover most of a small or mid-sized business's needs if each does its own job. The OWASP Top 10 for Agentic Applications 2026 (December 2025) is the design-review checklist. It runs from ASI01 Agent Goal Hijack to ASI10 Rogue Agents, makes "Least-Agency" a principle and recommends version pins "to avoid tool alias collisions or typo squatted tools" (OWASP PDF). OWASP LLM06:2025 Excessive Agency gives the most practical advice on permissions: narrow tools rather than open shells, read-only identities, minimum OAuth scopes, human approval for high-impact actions and authorisation enforced downstream (OWASP LLM06). MITRE ATLAS v2026.09 (14 September 2026) labels findings, with 120 techniques and 73 case studies; agent-specific techniques include AI Agent Tool Credential Harvesting and Data Destruction via AI Agent Tool Invocation (ATLAS changelog). The CSA AI Controls Matrix answers questionnaires: it has 243 controls in 18 domains, maps to ISO 42001 and the NIST AI RMF, and has guidance for an "Application Provider" that "builds end-user AI applications that leverage models", which describes most businesses building their own AI automation, and their implementation partners (CSA AICM). The Five Eyes guidance "Careful Adoption of Agentic AI Services" (1 May 2026) recommends starting with "clearly defined, low-risk tasks" and treats governance, monitoring and human oversight as "essential prerequisites" (Mayer Brown).

ISO/IEC 42001 is the certifiable option, specifying an AI management system (Microsoft Learn). Certification does not flow down: AWS says customers are "not automatically certified by association" with its certificate (AWS). A reasonable inference is that for most SMEs, CSA AICM answers plus an ISO-style inventory and risk register will satisfy customer and partner questionnaires at a fraction of the cost.

SAIF's 15 risks include Prompt Injection, Insecure Integrated Component and Rogue Actions (SAIF risks). Its control names, such as Agent Permissions, Agent Observability, Red Teaming, and Model and Data Inventory Management, are reused in the checklist below (SAIF controls). No AI-specific SOC 2 criteria were verified.

Agent threat model mapped to the OWASP Agentic Top 10

Most of the 2025-2026 incidents share one mechanism, which Invariant Labs calls a "toxic agent flow": one agent combines untrusted input (an email, issue, web page or tool description), access to private data and an outbound channel (Invariant Labs). Microsoft lists indirect prompt injection among the techniques most often reported to it (Microsoft MSRC). OpenAI's CISO called it "a frontier, unsolved security problem" (Simon Willison). Anthropic's computer-use documentation warns that the model "will follow commands found in content even when they conflict with your instructions" (Anthropic docs). So do not rely on the model to resist injection; design so that a hijacked agent can do little damage. The mapping of incidents to OWASP items below is this page's analysis, not OWASP's.

Incident ledger, 2025-2026: what actually went wrong

Three lessons cut against intuition.

• Approval classifiers are not a security boundary. In Anthropic's own test, only 13.6% of 1,053 paid testers refused a swapped dangerous command, while auto mode would have blocked 89%. Within three weeks of auto mode becoming the default, a researcher bypassed it about 80% of the time (Simon Willison; the 13.6% and 89% figures are Anthropic's own).
• Deterministic limits have held so far. OpenAI's Lockdown Mode (June 2026) limits outbound requests to block the exfiltration step, and no bypass of it was found in the sources reviewed. In a public challenge, 6,000 emailed attacks failed to leak secrets from an OpenClaw test instance (same source; its defences are not described).
• Self-hosted automation tools are named attack surfaces. MITRE's 2026 case studies cite n8n, Langflow and exposed agent consoles. Anthropic built Enterprise Frontier Safeguards in response to "credential theft and autonomous destructive agent behaviour" (Anthropic).

Controls checklist for agent deployments

The minimum bars below are suggestions drawn from the cited sources. A small or mid-sized business should apply all of them, directly or by requiring them of its implementation partner, to any agent that can write, send, delete, pay or run code, and the first eight to every deployment.

Some vendors now ship parts of this natively, such as hard spend caps per agent session and per-agent region pinning on Anthropic's managed agent service (Claude release notes), and identity-provider-managed authorisation for MCP servers, a stable extension since 18 June 2026 (MCP blog). Native features help, but they do not remove the need for your own controls. Tool stack and Frameworks cover the tooling.

Vendor terms: retention, zero data retention and indemnity are narrower than headlines

Indemnities protect the vendor's piece, not your whole solution. Anthropic covers third-party IP claims about paid use, "which includes data Anthropic has used to train a model", and about authorised outputs. It excludes customer inputs, modifications, combinations with other technology and knowing infringement, and caps liability at 12 months' fees (Anthropic Commercial Terms). AWS excludes infringing inputs and failures "to enable available filters" (AWS Service Terms). Microsoft's Customer Copyright Commitment for Azure OpenAI requires a copyright-protective metaprompt and a testing and evaluation report, which the customer must keep and hand over if it makes a claim (Microsoft Learn). The excluded parts are exactly what your team or implementation partner adds: prompts, retrieval over your data, extra tools and wrapper code. So do not treat a model vendor's indemnity, or a partner contract that passes it through, as cover for the whole system. On cloud marketplaces, the model chosen decides the cover: Google and AWS list their own models, not third-party ones (Google Cloud; Amazon Bedrock FAQs).

Zero data retention (ZDR) is approval-based and has carve-outs.

• OpenAI keeps abuse-monitoring logs "for up to 30 days", and ZDR is "subject to prior approval". Its managed Agents API (/v1/agents), Assistants, threads and vector stores keep application state until deleted and are not ZDR-eligible (OpenAI data controls).
• Anthropic's ZDR also needs approval and "still retains User Safety classifier results" (Anthropic Privacy Center). Fable 5/5.1 and Mythos 5/5.1 are "Covered Models" that require 30-day retention, so ZDR is unavailable on them without Anthropic's express authorisation (requests otherwise return a 400); Opus 5 is ZDR-eligible, and the 5.5 models are not on the covered list (no per-model statement). Batch (29-day retention), the Files API, code execution, programmatic tool calling, the MCP connector, Agent Skills and Managed Agents are never ZDR-eligible, and flagged chats may be kept up to 2 years (Anthropic API and data retention, primary). The managed agent service is also not HIPAA-BAA-eligible (Managed Agents).
• xAI keeps API traffic for 30 days, and its ZDR switches off batch, file and stateful features (xAI docs).

No vendor's own API processes requests in India. OpenAI lists India (in.api.openai.com) for storage at rest only. Its in-region processing covers only the US, the EU and the UAE, and regions outside the US need approved abuse-monitoring controls and a Modified Retention amendment (OpenAI data controls). Anthropic's inference_geo setting is "global" or "us" only (US 1.1x) and does not apply on Bedrock, Google Cloud or Foundry (Claude data residency). Its compliance page, read on 11 October 2026, listed India for residency via cloud partners without naming a region, and could not be re-read on 12 October (Claude regional compliance). xAI's only regional option is a US endpoint, 10% dearer, serving grok-4.7 and grok-4.6 only (xAI regional endpoints).

On the clouds the answer depends on the model generation (details in the table below). AWS Bedrock's India geography profiles (in. prefix) route only to Mumbai and Hyderabad, for Claude Opus 5, Sonnet 5 and Haiku 4.5, Kimi K3 and GPT-5.6 Terra and Luna; Claude 5.5, Fable, Mythos, GPT-5.6 Sol, GPT-6 and Grok 4.6/4.7 are global-only from India (AWS regional availability; Sonnet 5 model card). AWS's availability page also lists Opus 5 and Sonnet 5 In-Region in Mumbai on bedrock-mantle, but the model cards omit it (confirm in the console). AWS warns not to rely on the prefix alone (call GetInferenceProfile) and that prompts and outputs may be stored in opt-in Regions for abuse detection (Hyderabad is opt-in, so still India). Azure lists only South India, where GPT-5.6 and GPT-6 deploy only as Global types (Azure); Google Cloud's Mumbai region processes only Gemini 3.5 Flash, Gemini 2.5 Flash and text-embedding-005, and no Claude model (Google Cloud). Checked on 11 and 12 October 2026.

Certifications and legal holds. Anthropic's compliance page lists SOC 2 Type 2, ISO/IEC 27001, 27017 and 27018, HIPAA and GDPR, but not ISO/IEC 42001 (Anthropic regional compliance). Microsoft lists ISO/IEC 42001 scope for its Copilot services (Microsoft Learn). A 2025 preservation order in the New York Times case required OpenAI to keep output logs "that would otherwise be deleted"; ZDR endpoints were reported as unaffected, and the order's 2026 status is unknown (eWeek, secondary).

Model-specific risks belong in due diligence.

• DeepSeek. NIST CAISI found that DeepSeek R1-0528 agents were 12 times likelier to follow hijacking instructions (CAISI). Cisco reported a 100% attack success rate on 50 HarmBench prompts against R1 (Cisco), and NowSecure found insecure storage and unencrypted traffic in the iOS app (NowSecure). CAISI's May 2026 review of V4-Pro made no security finding (CAISI V4 Pro), so re-test rather than assume either way.
• Grok. Indonesia (10 January to 1 February 2026), Malaysia (11-23 January) and the Philippines (about 16-21 January) temporarily blocked the chatbot (Wikipedia, secondary). Whether API customers were affected is unknown.
• Export controls. A US directive of 12 June 2026 suspended foreign-national access to Fable 5 and Mythos 5. Anthropic disabled both for every customer until 1 July (Anthropic; Al Jazeera).
• Gated access. GPT-6 Astra is OpenAI's first model rated "Critical" for cybersecurity capability, a level its Preparedness Framework ties to required safeguards (system card). Expect staged or restricted access to the most capable models for security-adjacent work.
• Public-sector buyers. The US Department of Defense stopped using Anthropic products after a supply-chain designation (BBC).

The practical rule is that every production system needs a tested fallback model and an architecture that keeps the vendor swappable. Costs and the vendor pages cover the price side.

Copyright cases that shape output and training-data risk

For a business using AI, the takeaway is to separate two risks. Training-data risk sits mainly with model vendors, and vendor indemnities increasingly cover it, as Google's training-data indemnity and Anthropic's cover for training data show. Output and input risk remains with you and whoever builds your system. That includes infringing material you supply, outputs used to imitate protected characters, and fabricated reviews.

A lightweight governance operating model for a small or mid-sized business

Many organisations still lack the basics: an ISACA poll of more than 3,400 respondents (May 2026) found 25% with no AI policy (ISACA). The model below is a suggested design for a business of 10-50 people, or one business unit of a larger company, built from the requirements cited above rather than from one standard. It maps to ISO 42001, CSA AICM and the NIST AI RMF if certification is ever needed.

Six short policies

Four named roles

AI inventory: one register, one row per deployed component

Each row records: business owner and use case; implementation partner, if any; model vendor, version, region and ZDR status; agents, tools and MCP servers with pinned versions; identities and OAuth scopes; data categories; decisions about people; outbound channels; disclosure method; eval suite and last red-team date; kill-switch owner; and vendor-term renewal dates. The same register meets RBI FREE-AI's inventory expectation (Outlook Money), feeds a CERT-In-style AI bill of materials (Medianama) and satisfies SAIF's inventory control.

Risk register: score each deployment on five factors

A suggested rule: a total of 11 or more, or any 3 on impact or authority, makes a deployment Tier 1. Tier 1 needs all 22 controls, a second approver for releases, a quarterly red-team and the business owner's sign-off on human-review design. Lower tiers apply controls 1-8 and 11-15. Review the register every quarter, and whenever a model, tool or vendor term changes. Vendors now ship model releases roughly monthly, and deprecations follow (Claude release notes).

Incident response that fits CERT-In's 6 hours and DPDP's 72 hours

Your business is usually the fiduciary and must notify the Board "without delay" and report within 72 hours, so the contractual notice you get from any vendor or implementation partner should be far shorter: for example 24 hours, with a written update by 48 (suggested figures). Separately, CERT-In's binding 2022 Directions require service providers and body corporates to report listed cyber incidents, including attacks on AI/ML systems, within 6 hours of noticing them and to keep logs for 180 days in India (CERT-In Directions), so the runbook needs a 6-hour CERT-In path alongside the DPDP notice. The runbook: trigger the kill switch (revoke tokens, disable tools, end sessions); preserve logs; rotate every credential the agent touched, treating support-channel text as sensitive (Cloudflare); notify the people and authorities the law requires and, where relevant, your implementation partner and the model vendor; then update the injection test set and threat model.

Contract clauses to ask vendors and implementation partners for

What this means for your business

Treat agent security as the main risk, and compliance as the paperwork that proves you manage it. For businesses in India serving Indian or US customers, regulation is less urgent than headlines suggest and security is more urgent. No regulation in the sources reviewed would have prevented the Meta support-bot takeover or the Replit deletion; least privilege, approval gates and environment separation would have.

Now, because it already applies.

• Set up a 6-hour CERT-In reporting path (attacks on AI/ML systems included) and keep 180 days of logs in India.
• Decide where your data may be processed. In India, the documented routes are Bedrock's in. profiles (Claude Opus 5, Sonnet 5, Haiku 4.5, Kimi K3, GPT-5.6 Terra/Luna) and open-weight models In-Region in Mumbai; the newest models and every vendor's own API process elsewhere. Record the region in each contract, and budget about 10% extra where vendors charge for regional processing.

Before 13 November 2026.

• Build the AI inventory and risk register, run the OWASP agentic review on every live agent, and sandbox code-running agents with egress allowlists.
• Get any ZDR arrangement confirmed in writing before relying on it.
• Migrate off the OpenAI snapshots retiring on 23 October and off Claude Sonnet 4.5 (30 November).
• Comments on Colorado's draft rules are due by 26 October 2026. The X.AI v. Weiser stay is not a ruling on the law, so plan for 1 January 2027.

Before 1 January 2027.

• For consequential decisions about Colorado consumers, get the developer documentation package from whoever builds the tool, and set up notices, explanations and human review.
• Add chatbot disclosure and age-related safeguards where Colorado users may be reached.
• Hiring tools used for NYC roles need a bias audit from the past year.
• CCPA-covered businesses already using ADMT for significant decisions must comply.

Before 13 May 2027.

• Make notice and consent purpose-specific wherever AI touches personal data.
• Put DPDP-grade processor terms into vendor and partner contracts.
• Keep logs for a year; rehearse the breach runbook against the 72-hour DPDP and 6-hour CERT-In clocks.
• Banks, NBFCs and their suppliers should prepare for RBI FREE-AI flow-down and SBOM and AIBOM requests, though neither is yet binding on vendors.

EU users. Article 50 transparency and Article 4 literacy records are needed now. Hiring, education and credit tools have until 2 December 2027; design for them from the start.

What to test. An injection test set on every release and new model, regression evals near 100%, a fallback model, and the kill switch each quarter.

Ask any vendor or implementation partner:

• which models, regions and sub-processors will handle your data, and whether ZDR is approved in writing;
• which of the 22 controls above it applies, with eval, red-team and log evidence;
• how fast it will notify you of an incident;
• what its indemnity covers once inputs, combinations and wrapper code are excluded;
• whether any ISO/IEC 42001 certificate is its own rather than its cloud provider's.

Playbook and Use cases cover delivery, and Future outlook covers where this is heading.

Open questions and unverified items

• EU: The 24 July 2026 OJ date rests on several law firms, not EUR-Lex. The provider and deployer duty text was not verified. The Digital Omnibus status and the GPAI Code's 22-name signatory list come from automated page summaries; re-check both on the official pages.
• India:
  • No s.16 country notification, Rule 15 order or 2026 DPDP amendment was found, but MeitY's gazette index was unreadable, so absence is not confirmed.
  • The G.S.R. 120(E) gazette text was not read, sources differ on the metadata duty, and no final notification of the 21 April 2026 label draft was found.
  • RBI FREE-AI recommendation details remain secondary (the report PDF timed out); only the first page of RBI's notifications list was checked.
  • CERT-In: the body and binding status of CISG-2026-03 (10 Jun 2026), the binding status of the Blueprint v1.0 (25 May 2026), and whether service firms count as "technology providers".
  • TRAI's TCCCPR Third Amendment 2026: reported notified on 18 September 2026 (secondary); official text not read.
  • No final SEBI AI/ML guideline was found.
• US:
  • No court ruling on EO 14365, and none of its Commerce, BEAD, FTC or FCC outputs, was found. EO 14409 has no implementation outputs found; EO 14434's SI definition proposal is due about 28 November 2026.
  • X.AI v. Weiser has no merits ruling; whether the stay reaches SB 26-189 is open (docket entries read end on 27 April 2026). Colorado's final rules come after 26 October 2026.
  • SpaceXAI LLC / X.AI LLC v. Ellison (8th Cir. No. 26-2806): injunction pending appeal undecided; district-court ruling not read.
  • RAISE chapter amendments: reported signed on 27 March 2026 (secondary) but in committee per Wikipedia (February 2026); New York's official sites could not be reached.
  • Texas TRAIGA's effective date was not found in the enrolled text. Illinois HB 3773 is unverified.
• Other jurisdictions:
  • Korea's fine start (about January 2027) rests on secondary reporting; the passage date (December 2024 per IAPP) conflicts across sources.
  • Taiwan's promulgation (in-force) date was not found.
  • Japan's 14 July 2026 Basic Plan revision could not be read, so its approval date is unverified.
• Standards: The ISO/IEC 42001 clauses and the exact 42005 and 42006 dates were not read. The Five Eyes primary text and its fifth risk category were not read. OWASP's Agent Control Standard, CSA AICM v1.1 and any AI-specific SOC 2 criteria were not verified.
• Incidents:
  • The EchoLeak attribution to Aim Security is unconfirmed.
  • The auto-mode bypass is dated 27 August 2026 (updated 30 August) from the date order of Simon Willison's tag page; an earlier reading of 17 September belongs to a different entry.
  • Most 2026 cases come from Simon Willison's summaries rather than the primary reports.
  • The OpenAI and Hugging Face item rests on Wikipedia and a BBC report. A reported May 2026 test in which Gemini hacked three companies rests on Wikipedia.
  • A headline about attacks on South Korean banks was never opened. The Replit account is one user's report.
• Vendors:
  • OpenAI's indemnity terms and Microsoft's commitment caps were not read. Anthropic's general API retention default, and Microsoft's and Google's defaults, were not captured.
  • AWS pages conflict on Mumbai In-Region for Opus 5 and Sonnet 5 (regional-availability page vs model cards). Google's residency page lists Singapore processing for Claude Opus 5.5, Sonnet 5.5, Sonnet 5, Opus 5, Fable 5.1 and Fable 5; its locations page does not.
  • Anthropic's compliance page could not be re-read on 12 October; Bedrock Mumbai prices were not captured.
  • The 2026 status of the OpenAI preservation order is unknown. xAI's SOC 2 claim is unverified.
• Copyright: The Bartz per-work amount and the judge's name conflict across sources. Thomson Reuters v. Ross and Kadrey v. Meta were not verified.

Sources

1. Gazette of India, G.S.R. 843(E), DPDP Act commencement, 13 Nov 2025
2. Gazette of India, G.S.R. 846(E), DPDP Rules 2025
3. MeitY, DPDP Rules 2025, G.S.R. 846(E)
4. Gazette of India, Digital Personal Data Protection Act 2023
5. Hogan Lovells, India's DPDP Act brought into force, 17 Nov 2025
6. AZB & Partners, DPDP framework comes into effect
7. Hogan Lovells, India mandatory AI labelling and 3-hour takedown
8. Business Today, labels and faster takedowns, 10 Feb 2026
9. S.S. Rana & Co., IT Rules oversight of AI content
10. iPleaders, IT Rules 2026 amendment
11. Gala Law, 2026 IT Rules amendment
12. exchange4media, MeitY notice to X over Grok (secondary)
13. Business Today, MeitY notice to X over Grok, 2 Jan 2026
14. Indian Infrastructure, MeitY AI Governance Guidelines, 7 Nov 2025
15. BBC, India Supreme Court and fake AI-generated orders
16. Outlook Money, RBI FREE-AI framework
17. RBI, FREE-AI report press release, 13 Aug 2025
18. Bar and Bench, RBI FREE-AI legal landscape, 18 Sep 2025
19. Lakshmisri, SEBI AI/ML consultation paper
20. CERT-In, s.70B Directions, 28 Apr 2022 (PDF)
21. S.S. Rana & Co., CERT-In generative AI advisory
22. CERT-In, SBOM/AIBOM Technical Guidelines v2.0 (PDF)
23. Medianama, CERT-In AI Bill of Materials guidelines
24. AZB & Partners, CERT-In BOM guidelines
25. Mondaq, CERT-In BOM guidelines
26. OECD.AI incident monitor, CERT-In AI advisory, Apr 2026
27. CERT-In, AI-assisted exploitation Blueprint v1.0 (PDF)
28. CERT-In, CISG-2026-03 listing
29. TeamLease RegTech, CERT-In AI-accelerated vulnerability guidelines, Jun 2026
30. TRAI-hosted comments on draft TCCCPR Third Amendment (PDF)
31. Policy Edge, TRAI spam rules
32. Federal Register, EO 14365, Ensuring a National Policy Framework for AI
33. Axios, executive order on state AI laws, 11 Dec 2025
34. CourtListener, SpaceXAI v. Ellison (8th Cir.)
35. Federal Register, EO 14409
36. Federal Register, EO 14434
37. Wikipedia, Regulation of artificial intelligence
38. CASRAI, state preemption fight, 2026
39. Colorado General Assembly, SB26-189
40. Colorado Attorney General, ADMT and Chatbot Safety rulemaking
41. CourtListener, X.AI LLC v. Weiser (D. Colo.)
42. Clifford Chance, California SB 53
43. National Law Review, California ADMT, cybersecurity audits and risk assessments
44. CPPA, approved ADMT, audit and risk-assessment text (PDF)
45. Wikipedia, TRAIGA
46. Texas HB 149, enrolled text
47. NYC DCWP, Automated Employment Decision Tools
48. NYC DCWP, AEDT FAQ (PDF)
49. Wikipedia, Responsible AI Safety and Education Act
50. SecurePrivacy, New York AI law guide
51. Sidley, FTC rule on fake and AI-generated reviews
52. NatLawReview (K&L Gates), the AI Omnibus enters into force
53. European Commission, AI Act regulatory framework
54. Addleshaw Goddard, AI Omnibus formally adopted, 1 Jul 2026
55. AI Act Service Desk, timeline
56. OEIL, Digital Omnibus file 2025/0360(COD)
57. artificialintelligenceact.eu, Article 50
58. artificialintelligenceact.eu, Article 99
59. artificialintelligenceact.eu, Article 101
60. European Commission, AI literacy Q&A
61. gdpr-info.eu, Article 22 GDPR
62. European Commission, GPAI Code of Practice signatories
63. Anadolu Agency, EU opens formal probe into Grok
64. Gazzetta Ufficiale, Law No. 132 of 23 Sep 2025
65. Eurostat, enterprises using AI, 2025 (API)
66. GOV.UK, Data (Use and Access) Act 2025 data protection changes
67. legislation.gov.uk, DUAA 2025 s.80
68. Wikipedia, Grok sexual deepfake scandal
69. Loeb & Loeb, China AI labelling measures
70. CAC, labelling measures, 14 Mar 2025
71. Digital Policy Alert, CAC generative AI filings May-June 2026
72. Caixin Global, China amends Cybersecurity Law with AI clause
73. Bird & Bird, Singapore Model AI Governance Framework for Agentic AI
74. CMS, Singapore agentic AI framework
75. FPF, Japan's AI Promotion Act
76. Jiji via Adnkronos, first AI Basic Plan, 23 Dec 2025
77. Cabinet Office of Japan, AI Basic Plan revision dated 14 Jul 2026 (file not readable; approval date unverified)
78. Cooley, South Korea's AI Basic Act
79. IAPP, South Korea's AI Act
80. Presencis, Korea AI Basic Act timeline
81. Baker McKenzie, Taiwan AI Basic Act
82. Baker McKenzie, Vietnam AI law
83. Digital Policy Alert, Vietnam AI decree, 1 May 2026
84. Câmara dos Deputados, PL 2338/2023
85. Senado Federal, PL 2338/2023
86. LEGISinfo, Bill C-27 (44-1)
87. ISED, Canada's National AI Strategy
88. OWASP Agentic Top 10 2026 (PDF)
89. OWASP Top 10 for Agentic Applications for 2026
90. OWASP Top 10 for LLM Applications 2025
91. OWASP LLM06:2025 Excessive Agency
92. MITRE ATLAS data changelog
93. Cloud Security Alliance, AI Controls Matrix
94. Mayer Brown, multi-agency guidance on securing agentic AI, Jun 2026
95. Microsoft Learn, ISO/IEC 42001 offering
96. AWS, ISO 42001 FAQs
97. NIST, AI RMF Generative AI Profile
98. NIST CAISSI (formerly CAISI)
99. BSI, ISO/IEC 42001 certification
100. Standards Council of Canada, ISO/IEC 42005 listing
101. ISO, ISO/IEC 42006
102. Google SAIF, Secure AI Framework
103. Google SAIF, risks
104. Google SAIF, controls
105. Invariant Labs, GitHub MCP exploit, 26 May 2025
106. Microsoft MSRC, defending against indirect prompt injection, Jul 2025
107. Simon Willison, OpenAI CISO on Atlas, 22 Oct 2025
108. Anthropic, computer use tool documentation
109. Invariant Labs, MCP tool poisoning, 1 Apr 2025
110. arXiv 2509.10540, EchoLeak (CVE-2025-32711)
111. The Register, Replit deleted production database, Jul 2025
112. Wiz, malware invoking AI (s1ngularity, Amazon Q)
113. Brave, indirect prompt injection in Perplexity Comet, 20 Aug 2025
114. Cloudflare, response to Salesloft Drift incident, 2 Sep 2025
115. BleepingComputer, s1ngularity hit 2,180 GitHub accounts
116. NIST CAISI, evaluation of DeepSeek AI models, Sep 2025 (PDF)
117. Brave, unseeable prompt injections in screenshots, Oct 2025
118. Anthropic, disrupting AI-orchestrated espionage, 13 Nov 2025
119. Simon Willison, prompt-injection tag
120. ABC News, AI agent accessed Australian government site, 24 Sep 2026
121. BBC, OpenAI releases and agent incidents, Sep 2026
122. Wikipedia, 2026 in artificial intelligence
123. Anthropic, Enterprise Frontier Safeguards
124. Anthropic, Demystifying evals for AI agents
125. Claude Platform release notes
126. MCP blog, Enterprise-Managed Authorization
127. Anthropic Commercial Terms
128. AWS Service Terms
129. Microsoft Learn, Customer Copyright Commitment required mitigations
130. Google Cloud, Generative AI Indemnified Services
131. Amazon Bedrock FAQs
132. OpenAI, data controls in the OpenAI platform
133. Anthropic Privacy Center, zero data retention
134. Claude Platform, Managed Agents overview
135. Claude Platform, API and data retention
136. xAI docs, security FAQ
137. Claude Platform, data residency
138. AWS, Bedrock regional availability
139. AWS, Bedrock model card, Claude Sonnet 5
140. Microsoft Learn, Foundry region availability
141. Microsoft Learn, Foundry deployment types
142. Google Cloud, data residency
143. Google Cloud, locations
144. Claude, regional compliance
145. OpenAI API pricing
146. Google Cloud, protecting customers with generative AI indemnification, 13 Oct 2023
147. xAI docs, llms-full.txt
148. DeepSeek API, Anthropic API guide
149. DeepSeek, privacy policy
150. DeepSeek, Open Platform terms
151. eWeek, OpenAI preservation order appeal
152. Cisco, evaluating security risk in DeepSeek
153. NowSecure, DeepSeek iOS app flaws, 6 Feb 2025
154. NIST CAISI, evaluation of DeepSeek V4 Pro, May 2026
155. Anthropic, Fable 5 and Mythos 5 access statement, 12 Jun 2026
156. Al Jazeera, US lifts restrictions on Fable and Mythos, 1 Jul 2026
157. OpenAI, GPT-6 Astra system card
158. BBC, US Department of Defense ceases use of Anthropic products
159. OpenAI API deprecations
160. Anthropic, 2026 Usage Policy update
161. Sidley, EU provisional agreement to delay AI Act obligations, 22 Jun 2026
162. Anthropic copyright settlement website
163. Wikipedia, 2025 in artificial intelligence
164. Bloomberg Law, Anthropic authors' $1.5 billion deal receives final approval
165. Wikipedia, The New York Times v. Microsoft and OpenAI
166. Wikipedia, Stability AI
167. ISACA, 2026 AI Pulse Poll
168. Digital Policy Alert, Vietnam Law on AI
169. MinterEllison, Australia's National AI Plan
170. Goodwin, California moves to regulate frontier AI (SB 53), Nov 2025
171. xAI docs, regional endpoints