ai risk today logo svg bl font
Menu
SUBSCRIBE
SUBSCRIBE
ai risk today logo svg bl font
Menu

airisktoday

About airisktoday

https://airisktoday.wpenginepowered.com

Posts by :

New York State Capitol building in Albany viewed from the plaza in daylight

New York Amends The RAISE Act With Expanded Disclosure And Safety Requirements

, ,

The amendments update the requirements for reporting, incident disclosure, and safety documentation for developers of large AI systems operating in New York State.

 

New York Governor Kathy Hochul signed NY Senate bill 8858 that amended the Responsible AI Safety and Education Act (RAISE Act), expanding disclosure and safety requirements for companies developing or deploying large-scale AI systems.

Under the revised law, “frontier” developers must now submit more detailed public disclosures about their models. Specifically – 

  1. Detailed product documentation – This includes training methods, system capabilities, known limitations, and material updates to the product. 
  2. Pre-deployment safety testing – Companies must test their models to ensure they’re safe enough for internal use at scale or for public release. Results must be reported.
  3. Incident reporting – Developers must report “safety incidents” to the state within 72 hours. These include cases where an AI system causes or materially contributes to unauthorized system access, data exposure, or other harmful outcomes. Companies must provide details on what occurred, how it was detected, and what corrective actions occurred.
  4. Internal safety and risk management documentation – Companies must document how they identify, evaluate, and mitigate risks throughout the AI system’s lifecycle. 
  5. Testing documentation – The law requires companies to describe how they test systems for harmful or unintended behavior and what safeguards are in place to reduce those risks.
  6. Show compliance – Retain records demonstrating compliance with the law’s requirements.

The amendments clarify that these obligations apply to developers of “frontier” AI systems, defined based on computational scale and advanced capabilities. Covered entities must ensure that disclosures remain current when material changes are made to the system.

The amendments go into effect January 1, 2027.

Illustration of AI agents performing business tasks inside a corporate office environment

Palo Alto Networks Acquires Koi To Secure Agentic Endpoints

, , ,

The company said the acquisition will expand its ability to secure AI-driven systems operating autonomously across enterprise environments.

 

Palo Alto Networks completed its acquisition of Koi, a cybersecurity company providing endpoint security for all systems, including autonomous AI models.

The company said the acquisition is intended to strengthen its ability to protect endpoints where AI agents act independently, including systems that can execute tasks, make decisions, and interact with other software without direct human input. These systems are increasingly used in enterprise workflows, creating new security exposures.

Palo Alto Networks said Koi’s technology is designed to monitor and control how AI agents operate, including how they access data, interact with applications, and execute tasks across enterprise systems. This capability will be integrated into Palo Alto Networks’ broader security platform to provide visibility into agent behavior and enforce security policies.

The announcement highlights a shift in enterprise security needs as organizations deploy AI systems that can act autonomously. Unlike traditional software, agentic systems can initiate actions across multiple environments, increasing the risk of unauthorized access, data exposure, or unintended system changes.

Palo Alto Networks said the integration of Koi’s technology will allow organizations to track agent activity, apply access controls, and limit how AI systems interact with sensitive environments. The company said that this approach is intended to reduce the risk of misuse while enabling continued use of AI-driven automation.

Abstract visualization of AI-driven cybersecurity testing with a central digital shield and flowing data streams representing controlled access to security tools

OpenAI Expands Trusted Access Program For Cyber Defense AI Tools

, , ,

The company will allow vetted users to access GPT-5.4-Cyber for controlled cybersecurity testing under its Trusted Access for Cyber program.

 

OpenAI is expanding access to its latest cybersecurity AI model,  GPT-5.4-Cyber, through a formal vetting program, allowing qualified users to test and strengthen cyber defenses while restricting broader use.

In a blog post, the company said that cybersecurity teams can access GPT-5.4-Cyber via its Trusted Access for Cyber (TAC) program, which vets parties by evaluating their intended use, security controls, and alignment with defensive objectives. 

The statement said that GPT-5.4-Cyber can accelerate vulnerability discovery, but noted that similar capabilities could also be used to identify and exploit software weaknesses. The company said the TAC program is designed to reduce misuse by limiting access to vetted users.

OpenAI will monitor usage and apply restrictions to prevent the system from being used for offensive or unauthorized activities.

OpenAI’s announcement follows Anthropic’s recent launch of Project Glasswing, a partnership initiative with 40 companies from the AI and cybersecurity industries to sandbox Anthropic’s Mythos agent. Anthropic said that Mythos was so effective at finding cyber vulnerabilities that access had to be limited and the product thoroughly vetted before considering giving general access. 

OpenAI is positioning the initiative as striking a balance between providing cybersecurity tools and giving access to potential bad actors.

Connecticut State Capitol building where lawmakers are considering regulation of AI systems used in employment decisions

Connecticut Bill Would Regulate AI Tools Used In Hiring And Employment Decisions

, ,

The legislation seeks to regulate “automated employment-related decision systems,” defined as AI tools used in hiring, evaluation, and termination decisions.

 

The State of Connecticut’s General Assembly’s Labor and Public Employees Committee introduced Senate Bill 435 to establish requirements for the use of AI in employment decisions.

The legislation would prevent the use of AI systems in ways that result in unlawful employment discrimination and require oversight of their use. It applies specifically to “automated employment-related decision systems,” which the bill defines as computational processes, including AI and machine learning, that make or materially assist in making decisions about employment hiring, evaluation, and termination.

The bill would require employers to conduct impact assessments before using these systems. These assessments must evaluate whether the system creates a disparate impact based on protected characteristics, including race, color, religion, sex, sexual orientation, gender identity, national origin, age, or disability. Employers must also document how the system works, what data it uses, and how risks are identified and addressed.

It also mandates ongoing testing and auditing of these systems after deployment. Employers would need to self-monitor outcomes and take corrective action if they identify discriminatory patterns.

The legislation also requires transparency, requiring employers to notify employees and job applicants when using an automated system in connection with an employment decision. Employers would also provide candidates and employees with information about how the system contributed to decisions that affect them.

The bill outlaws automated systems that lead to unlawful discrimination, regardless of whether the discrimination was intentional.

For AI companies, the bill indirectly forces compliance requirements. Companies that sell AI hiring or workforce management tools would need to ensure their systems can be tested for bias, audited for outcomes, and explained to end users, since employers would be required to meet those standards in practice.

The bill has been referred to committee and remains under consideration in the Connecticut General Assembly.

Abstract cyber risk visualization showing a laptop with warning alert overlooking a digital cityscape, representing large-scale AI system risks and regulatory oversigh

OpenAI Backs Illinois Bill Limiting AI Liability For “Critical Harms”

, , ,

The proposed legislation would shield large AI developers from liability for catastrophic harm.


OpenAI has endorsed Illinois Senate Bill 3444, known as the Artificial Intelligence Safety Act, a proposed law that would limit when AI developers can be held liable for large-scale harms. 

The bill, sponsored by state Senator Bill Cunningham (D-Springfield), establishes liability protections for developers of “frontier” AI models. These are defined as systems trained using more than $100 million in computational resources or exceeding 10²⁶ computational operations.

The protections would only apply in cases of “critical harms,” which the legislation defines as large-scale incidents, including those resulting in the death or injury of at least 100 people, damages exceeding $1 billion, or harms arising from the use of AI in developing or enabling chemical, biological, radiological, or nuclear (CBRN) weapons or similar high-risk scenarios.

Under the proposal, developers are not liable for such harms if they did not act intentionally or recklessly and published a safety and security protocol and a transparency report detailing how risks are assessed, mitigated, and addressed.

The bill also provides an alternative way for developers to meet requirements. It states that a developer that produced a safety and security protocol “in a manner substantially similar to this Act” will be deemed compliant if it either “agrees to be bound by the safety and security requirements adopted under Article 56 of the European Union’s Artificial Intelligence Act” or “enters into an agreement with an agency of the federal government” to enable access to frontier models for research and evaluation, facilitate assessments of risks such as cyber and biological threats, and allow the government to release information related to those evaluations.

Niedermeyer warned against “a patchwork of inconsistent state requirements that could create friction without meaningfully improving safety,” calling for alignment with a federal framework. Separately, OpenAI spokesperson Jamie Radice said, “We support approaches like this because they focus on what matters most: Reducing the risk of serious harm from the most advanced AI systems while still allowing this technology to get into the hands of the people and businesses.” [Source: Wired]

OpenAI has previously opposed legislative efforts to expand liability for AI developers, largely adopting a defensive stance against stricter accountability measures.

IT service provider team reviewing AI governance dashboards and compliance metrics for multiple client environments

Governance And Compliance Are The #1 Barrier To AI Adoption

, ,

A new report finds service providers are offering AI governance solutions, but lack the resources and structures to implement them at scale.

 

Key Takeaways

    • 51% of managed service providers (MSPs) say governance/compliance is the top barrier to AI adoption for their clients.
    • 64% of MSPs include AI governance in their service offerings.
    • However, only 29% say they can fully implement AI governance frameworks for clients.
    • 40% cite the complexity of customer environments as a barrier to delivering automated governance/compliance solutions.
    • 63% of MSPs say better automation tools can close the service gap.

According to the report, The Road to AI Readiness: Unlocking the MSP AI Opportunity Through Governance, governance and compliance are the primary barriers to AI adoption, but the challenge is not a lack of intent. It is a gap in execution and capability, according to the study by Omdia and EvaPoint.

The report found that 51% of managed service providers (MSPs) identified governance and compliance as the top obstacle preventing their clients from fully integrating AI systems into their day-to-day businesses with proper protections and standard work policies. 

At the same time, 64% of MSPs said they already package AI governance and compliance services in their offerings. Despite this, only 29% of MSPs said they are capable of fully implementing governance frameworks for clients. This gap highlights a bottleneck between selling governance solutions and delivering them. Clients are seeing the value of governance solutions, but MSPs are struggling to deliver.

The report identifies several reasons for this disconnect. 

  • 40% cite complexity of customer environments – i.e., the uniqueness of each business they serve and the lack of ability to standardize across companies. One respondent highlighted the problem succinctly – “We could build automations for every single one of our clients, but we’d have to do it 700 times.”
  • 18% say it’s financial, citing a limited budget or competing priorities.
  • 16% don’t have the skill set. They lack expertise and automation know-how to deliver to clients.
  • 9% are unclear about who owns data governance and compliance tasks.

The report identifies several solutions to help MSPs close the gap. 

  • Standardization – MSPs need baseline structures they can apply across clients.
  • Multi-client visibility – MSPs need the ability to automatically monitor client compliance, detect drift, and enforce policy changes. 
  • Systemic integration – Workflows should be integrated across policy enforcement, reporting, remediation, and documentation.
  • Invest resources – MSPs have to invest both time and money to deliver the infrastructure to scale AI governance across their client base.

To close the service gap, MSPs identified better automation tools, improved integrations, and holistic solutions that integrate with current tools as what they need from outside vendors. 

The study included 333 global MSPs across North America, EMEA, and Asia & Oceania.

U.S. courthouse building with columns and American flag representing federal legal challenge to Colorado AI law

Musk’s xAI Sues Colorado Over AI Law Citing Free Speech Concerns

, , , , ,

The lawsuit challenges a newly enacted state law that would impose disclosure and risk management requirements on “high-risk” AI developers.

 

xAI filed a lawsuit against Colorado’s Attorney General, Philip Weiser, challenging Senate Bill 24-205, a law that mandates disclosure and risk-mitigation rules on developers of high-risk AI systems used in decision-making areas such as education, employment, financial services, and health care. 

The company said in its complaint that the law violates the First Amendment by limiting how its AI systems generate responses. xAI argued that the measure would require it to actively monitor and adjust its systems to avoid outcomes the state considers discriminatory, such as differences in results tied to factors like race, gender, or age. 

xAI flatly stated that its flagship AI tool, Grok, would have to “conform to a controversial, highly politicized viewpoint” rather than remain objective.

Further, the company stated that the law conflicts with federal authority and places burdens on interstate commerce. The company said the requirements are “preempted by federal law and violate the Constitution,” and asked the court to block enforcement before the law takes effect on June 30th.

The Colorado Attorney General’s website says the law is intended to “protect consumers from algorithmic discrimination in consequential decisions made by high-risk artificial intelligence systems.”

The measure also requires developers to conduct impact assessments evaluating potential risks to individuals, including the likelihood of discriminatory outputs, and to document steps taken to address those risks. In addition, companies would be required to provide consumers with disclosures when AI systems are used to make or support consequential decisions, including information about how the system functions and how individuals may appeal or correct decisions.

Enforcement authority would be granted to the Colorado attorney general, who would be able to seek civil penalties for violations.

Abstract visualization of thousands of cyber threats being detected across global systems by Anthropic Mythos AI

Anthropic’s Mythos Too Powerful For Public Use

, , , ,

After identifying vulnerabilities across ALL major software platforms, Anthropic says Mythos will be tested in partnership with several industry partners.

Anthropic said in a statement that its new AI technology, Claude Mythos2 Preview, or “Mythos,” was recently tested to identify security vulnerabilities. It worked so well that it found thousands of cyber vulnerabilities, including those in “every major operating system and web browser.” Some of the exposed vulnerabilities go back over 25 years. 

According to Anthropic, the findings show that AI systems can significantly accelerate the process of identifying exploitable flaws, including those that could be used in cyberattacks. The company stated that making Mythos broadly accessible could enable cybercriminals and other bad actors to find and exploit vulnerabilities at scale.

Project Glasswing

Instead, Anthropic is giving Mythos access to some of the tech industry’s largest companies to “find and fix vulnerabilities or weaknesses in their foundational systems – systems that represent a very large portion of the world’s shared cyberattack surface.” This partnership, called Project Glasswing, includes the top five most valuable companies –  NVIDIA, Apple, Google, Microsoft, and Amazon, as well as cybersecurity giants such as CrowdStrike and Palo Alto Networks.

The company will also give access to an additional 40 companies that “build or maintain critical software infrastructure so they can use the model to scan and secure first-party and open-source systems.” 

Further, Anthropic committed $100M in usage credits earmarked for Mythos testing and $4M in donations to open-source security organizations.

The company expressed hope that Glasswing marks the beginning of large-scale collaborations with more private and public-sector entities to address AI’s impact on security.

Modern research institute interior representing AI safety and policy development

The Anthropic Institute Launches To Study AI Safety And Policy

,

The AI company introduced a new standalone research initiative focused on the societal impact of AI.

 

Anthropic launched the Anthropic Institute, a new initiative designed to track the societal impact of AI based on research from across the company. The institute’s goal is to identify and raise awareness of potential or realized societal problems created by AI, and to work with external parties to address these risks. The research and findings provided by the institute will be made public. 

The institute will monitor and study risks related to evolving AI models, including misuse, loss of control, and broader systemic impacts. The institute will also examine how AI systems behave in real-world environments and evaluate methods to improve reliability and safety.

The day-to-day team is drawn from three internal departments, each serving different functions:

The Frontier Red Team – stress-test AI systems 

Societal Impacts – monitor AI use in the real world

Economic Research – tracks AI’s impact on jobs and the economy generally

Co-founder Jack Clark will serve as Head of Public Benefit.

Concurrently, Anthropic announced the expansion of its Public Policy team to “help inform and shape AI governance around the world.” The Public Policy team will be opening its first office in Washington, D.C., and is rapidly hiring. Sarah Heck, formerly Head of External Affairs for the company, heads the Public Policy team. She was previously Senior Director for Global Engagement at the National Security Council under the 2nd Obama administration.

European Union flags displayed outside an EU institutional building in Brussels

EU Council Backs Ban On AI Nudification Tools In EU AI Act Update

, ,

The proposal would prohibit AI systems that create non-consensual nude or sexually explicit images as part of the “Omnibus” amendments to the EU AI Act.

 

The Council of the European Union agreed to add a ban on certain AI systems capable of generating non-consensual nude or sexually explicit images, often referred to as “nudification” tools, as part of ongoing amendments to the EU AI Act.

According to the Council’s official release and legislative text, the proposal would prohibit AI practices that generate “non-consensual sexual and intimate content.”

The restriction would apply to developers, providers, and users of AI systems operating within the European Union, including those that place AI tools on the market or make them available to users. The measure targets systems that manipulate or generate realistic images depicting individuals in sexual or intimate contexts without their consent.

The Council stated that the amendment is intended to address gaps in the current law, which does not explicitly ban such tools.

In its official statement, the Council said the updated framework is designed to “streamline the application of the rules” while maintaining protections tied to safety and fundamental rights.

The Council’s position now serves as its negotiating mandate in discussions with the European Parliament, which is considering a similar, less specific prohibition under which “nudification” tools would be banned under the “prohibited practices” (Article 5) section on non-consensual intimate AI-generated content.

The proposal has not yet been adopted into law. Any final changes to the AI Act will require agreement between the Council and Parliament before entering into force.

Load More