Lawmakers have failed to extend a surveillance law that allows US intelligence agencies to monitor targets abroad without a warrant.

Congress rejected a vote to extend Section 702 of the Foreign Intelligence Surveillance Act to July 2, which means, for a few days at least, some surveillance will be put on hold, for the first time since the Act was passed in 2008. The next possible chance for a vote will be June 28.

This has significance for CISOs because they need to be aware of how communication between the US and other countries is being monitored. The Act permits US intelligence agencies to collect texts and emails sent to and from foreigners living outside the US without a warrant — and when those communications are to or from an US citizen, it allows them to scoop them up too.

“For too long, the FBI has been able to piggyback on a major national security tool as an unconstitutional backdoor way of reading Americans’ communications,” Electronic Frontier Foundation Senior Policy Analyst Matthew Guariglia wrote in article about the renewal vote this week.

It is uncertain what will happen next. Some commentators expect things will proceed as if the Act had been extended, possibly through an executive order.  However, the industry may well revolt against this and we could see some tech providers take legal action.

This article first appeared on CSO.

A German court has sparked a legal controversy by ruling that Google is responsible for defamatory comments generated by its own AI system. The search giant had argued that it couldn’t be blamed for the false results, but a Munich court has deemed that not to be the case and has ruled in favor of the two unnamed plaintiffs, both publishing companies, who the Google AI Overview inaccurately said engaged in shady business practices.

Google is required to remove the comments and ensure that they are not repeated. The case is certainly going to raise some questions globally. Will this mean that other courts are going to rule against AI vendors?

Bernhard Buchner, a partner at Lausen Rechtsanwälte, the legal firm that acted for the plaintiffs, said, “I believe it shows that online providers such as Google cannot hide behind the fact that a statement was generated by AI, but rather that they can be held liable for its output. It is an important step towards ensuring that providers of AI systems have to take responsibility for their outputs.”

So, does this mean that the decision could be replicated in the US or elsewhere? Alex Shahrestani, managing partner at Austin-based Promise Legal, said, “the short answer is ‘yes’:  the Munich ruling travels, because US courts are already making the same move.”

He explained that Section 230 of the US Communications Decency Act, which has been applied to protect online service providers like social media companies from lawsuits based on their decisions to transmit or take down user-generated content, was built for computer bulletin boards, “not for a model that writes its own answers. Once the AI is the author, the company is the publisher.”

This means, he said, “businesses now need named humans at accountability nodes, verification gates before AI output ships, and audit trails that survive discovery, because ‘the model recommended it’ is a legally empty sentence.”

Does the decision mean that other AI providers could find themselves in the same position? Buchner believes it’s possible, although, he said, the situation in this case is unusual; it does not involve a classic chatbot scenario, but one where the AI-generated statements are published as an ‘AI overview’ of a search query.

“Google’s liability here is based not so much on the fact that it operates the underlying AI, but rather on the publication of its output. However, it seems entirely conceivable to me that this could also be applied generally to inaccurate or defamatory AI,” he pointed out.

Nonetheless, said Carolyn Shelby, head of SEO at Yoast, the German ruling should ensure that companies will be more circumspect in how they handle AI in the future, to protect themselves from any legal action. The first thing they should do  is to separate low-risk use of AI from major decision-making.

“Using AI to summarize meeting notes, brainstorm campaign ideas, or create a first draft of something is very different from using it to make decisions about customers, employees, finance, compliance, health, legal claims, competitive positioning, or public communications,” she noted.

She pointed out that the effects of AI use could be devastating for companies. “The consequences could include customer complaints, reputational damage, regulatory attention, legal claims, correction costs, loss of trust, and internal disruption,” she said. “Even when a mistake does not become a lawsuit, the operational cost of correcting bad information can be significant.”

However, she noted, things may not change immediately.  “Many companies will wait until there is a high-profile court case, regulatory action, or major corporate embarrassment before they take this seriously. That is usually how governance catches up with technology. But the better-run organizations will start treating AI governance as part of normal business risk management now.”

And, said Shahrestani, after the Google decision, everything has changed. It will become more important to ensure that employees remain part of the process.

Years ago, right-wingers coined the phrase “Trump Derangement Syndrome” (TDS) to describe people who hate US President Donald J. Trump. (I think it better describes the president’s outlandish, truth-challenged statements and the followers who think he can do no wrong.) What’s really deranged is his recent AI executive order.

First, a little history. As you may recall, Trump often (and loudly) trashed his predecessor’s Executive Order 14110, which had demanded “safe, secure, and trustworthy” AI. That Biden Administration order was replaced last year by Trump’s own “Removing Barriers to American Leadership in Artificial Intelligence” directive; it basically let US AI companies do whatever they wanted in the name of innovation.

Then, a little thing called Anthropic Mythos came along — and scared the pants off even AI’s biggest fans. Seemingly in response, someone in the federal government decided that letting AI companies do whatever they want might not be the brightest policy. 

Or, did they?

True, the new order creates a process under which AI companies can give US  government access to “covered frontier models” for up to 30 days before public release so experts can probe for vulnerabilities and test how the systems could be abused. It also directs agencies to set evaluation standards, establish an “AI cybersecurity clearinghouse,” and harden federal networks against rapidly advancing AI‑enabled attacks. 

Some people, like Graham Brookie, vice president for technology programs and strategy at the Atlantic Council, think the order is great. “The administration’s executive order on Advanced AI Innovation and Security is a serious policy with support from necessary stakeholders across party lines and industry to ensure the government is evaluating the cybersecurity risks posed by frontier AI models. It’s a policy that can be built on.”

Really? I’m not sure Brookie read the same document I did — if, indeed, he read it at all.

I quote:

“Nothing in this section shall be construed to authorize the creation of a mandatory governmental licensing, preclearance, or permitting requirement for the development, publication, release, or distribution of new AI models, including frontier models.

“In addition, ‘This order is not intended to, and does not, create any right or benefit, substantive or procedural, enforceable at law or in equity by any party against the United States, its departments, agencies, or entities, its officers, employees, or agents, or any other person.’”

In other words, AI companies won’t be required to do much of anything. And if they do  submit a project for review, get the government’s blessing for it, and something goes badly wrong, it’s not the government’s fault. 

So, exactly why would AI companies even mess with this performative AI security theater?

Beyond those concerns, who exactly will be judging AI projects in 30 days? In theory, it would be a cybersecurity clearinghouse made up of people from the National Security Agency, the US Treasury Department, and the Cybersecurity and Infrastructure Security Agency (CISA). Most likely, CISA would do the bulk of the heavy-lifting — it’s their job, after all. But there’s this wee problem; Trump’s so-called Department of Government Efficiency (DOGE) last year gutted CISA. There’s virtually no one left to do the work, and certainly not in 30 days.

There’s also the question of funding for the new initiative.  According to the order, “The Director of OMB, in coordination with the National Cyber Director and the Director of CISA, shall determine whether any Federal grant programs have available and relevant funding that can be directed toward applicants developing advanced AI vulnerability detection.”

Spoiler: There’s no money set aside for this purpose.

Leaving aside whether the Executive Order has any teeth at all — the Brennan Center for Justice argued that under the Constitution, it doesn’t; the closer you look at the document, the less substance you’ll find.

Besides, in an industry where success is all about releasing the latest Large Language Model (LLM) as fast as possible to garner attention and investor dollars, who exactly would want to put their AI models on ice for even 30 days? (Short answer: No one.) These companies are always going to be focused first on getting the word out about their latest model as fast as humanly — Uh, AI-ly — possible. 

Still, some people seem to think this executive order really will make a difference. For example, Paul Benda, the American Bankers Association executive vice president for risk, fraud, and cybersecurity, sees it “as a constructive step toward strengthening the nation’s approach to managing the cybersecurity risks and opportunities associated with advanced artificial intelligence [because it ] can help better protect critical infrastructure, including the financial sector.”

Oh, please. I’m so tired of people who skim the titles of Trump’s executive orders and then assume there’s anything real about them. 

This AI order is meaningless garbage, and anyone telling you otherwise is either lying or wants to be on the Trump regime’s good (?) side. Or, both — it could always be both. 

The European Commission published its tech sovereignty package last week, including the clearest signal yet of its intention to strengthen European cloud sovereignty and reduce its dependence on US hyperscalers.

It’s a response to growing concerns among European organizations and regulators about the reliance on US tech firms and legislation such as the US CLOUD Act, which could give US officials access to data — even if it is stored in Europe.

But any shift toward local, sovereign cloud providers will necessarily be gradual, analysts, said as the Cloud and AI Development Act (CADA) proposals leave plenty of room for US providers to continue supplying cloud computing services to European public sector customers.

“The direction is right. The execution will be slow,” said Fernando Pereiro, senior director analyst at Gartner.

While the Commission has correctly identified areas where the EU is most dependent on foreign providers, delivering on its ambitions is another challenge, he said. Scaling alternatives to US suppliers “takes time, capital, and coordination at a level that is difficult to sustain in Europe.”

Dario Maisto, senior analyst at Forrester, played down the prospect of a major short-term shift towards European cloud providers as a result of the CADA proposals, even after recent interest in local European vendors for mission-critical workloads and highly sensitive data.

“I do not expect an immediate impact on the cloud infrastructure market,” Maisto said. “Full-blown migrations are costly and take several years. They are not going to happen in the near future.”

Instead, Pereiro expects the gradual emergence of “sovereign enclaves” or controlled environments for sensitive workloads, particularly in government and regulated sectors. “Outside of those areas, the market will remain global, but increasingly shaped by European rules,” he said.

Nevertheless, the three US hyperscalers that account for around 70% of the European cloud market – Amazon Web Services (AWS), Google, and Microsoft —  will likely see a more competitive environment.

“The real shift is symbolic and structural: hyperscalers move from being the default choice to one option among others, and their competitiveness will increasingly depend on how well they align with European control requirements, not just on technology or price,” said Pereiro.

What is CADA and what could it mean for Europe’s cloud market? 

CADA is part of a range of policy and legislative proposals — known as the Tech Sovereignty Package — published by the Commission, alongside Chips Act 2.0, the Open Source Strategy, and Strategic Roadmap for Digitalization and AI in Energy.

CADA includes measures to boost European tech sovereignty. Among other things, it aims to triple data center capacity in the next five to seven years by easing restrictions on new infrastructure projects across the EU, as well as efforts to support research and development of cloud and AI technologies.

It also includes a sovereignty framework that, if enacted, would require EU public bodies to assess sovereignty risks and procure cloud services that meet four assurance levels.

The various levels portray “a political vision with many open questions,” said Maisto. In more detail:

• Level 1 requirements are achievable by hyperscalers, Maisto said, with requirements focused mostly on data residency. 
• Level 2 is “more controversial,” he said, as it includes requirements around third-country access to data and disruption of services.
• Level 3 leaves room for US providers to win procurement contracts — particularly where they enter a joint venture with a European cloud provider such as S3NS, a Thales subsidiary that has partnered with Google.
• Level 4 applies to only a small proportion (1%) of the most sensitive workloads.

The first two levels could be open to US hyperscalers, said Maisto, with 70% of existing EU public sector workloads falling under Level 1 and 20% at Level 2, according to Commission’s own impact assessment. Just 9% of the workloads would require Level 3. 

The most stringent Level 4 would require cloud providers that “have full transparency and control over their software supply chain and no interference from a third country,” the Commission said.

For public sector organizations, the CADA rules could create more clarity around procurement, said Pereiro. “Today, the concept of ‘sovereign cloud’ is often vague and inconsistently applied in providers’ marketing and messaging,” he said. “This package standardizes what sovereignty must look like in practice, effectively ending the era of ‘sovereign washing.’”

The proposals give public sector organizations a “stronger set of requirements with which to assess risk, especially around jurisdiction and access to data,” he said.

“For enterprises, it’s less about regulation and more about leverage,” said Pereiro. “They gain clearer benchmarks and more viable alternatives, particularly through open source and emerging European providers.”

European cloud industry sees ‘a step in the right direction’

The Cloud Infrastructure Services Providers in Europe (CISPE) — a nonprofit trade group — welcomed the “strong definitions” of Levels 3 and 4, and said that, if implemented well, the proposed rules could “help to challenge the commercial dominance of established foreign cloud and AI vendors.”

However CISPE also called the current Level 1 and 2 criteria “confusing and non-sensical,” and said they should not be designated as “sovereign” since US hyperscalers can meet the requirements. “This will continue to confuse the market, both public and private customers, and encourage more sovereignty washing attempts,” CISPE said in a blog post Thursday.

CISPE also said the proposals fail to require public authorities to check whether a European service exists before opting for a foreign supplier. “We see a significant risk that assessments become a ‘rubber-stamp’ exercise that allow IT departments to continue to buy non-sovereign services out of convenience,” the organization said.

French firm OVHcloud — one of the leading European cloud computing and web hosting companies — welcomed the proposals, though it said any rules must be carefully scoped to ensure they are effective.

“This text is a step in the right direction and represents an opportunity to strengthen European strategic autonomy — something unthinkable just a few years ago,” an OVHcloud spokesperson said. “It provides a useful framework, but one that must not leave too much room for exceptions and workarounds. 

“Europe must and can move much faster, with very clear rules and a genuine European preference. Beyond this text, the Commission has demonstrated with its sovereign procurement call that it is possible to act right now to reduce critical dependencies. The time for waiting is over. We must accelerate. We must clarify. We must own it. 

“Europe has the players and the expertise,” the spokesperson said. “It is time to turn political ambition into European industrial capability.”

The overall tech sovereignty package “marks the overdue shift from diagnosis to treatment,” said a spokesperson at Ionos, a German cloud and hosting company. Ionos pointed to the EC’s claims that more than 80% of digital products, services and infrastructures in the EU originate from non-European providers, while 264 billion euros flow from EU organizations into predominantly US-based IT products.

“This is a strategic failure that must now be corrected,” the spokesperson said. While the company applauded the Commission’s focus on “secure and sovereign cloud and AI infrastructure for highly critical use cases,” it argued the CADA proposals fall short. “The central weakness of the package: the approach remains predominantly supply-side. The decisive lever — the demand side – is missing. Public procurement is the most powerful instrument for digital sovereignty. The public sector as anchor customer is critical for scaling sovereign cloud and AI solutions.

“Europe will remain dependent on Nvidia and AMD for GPU computing, the spokesperson said. “What matters is not whether to cooperate, but on what terms: data under European law, operations by European providers, no extraterritorial access. …If EU funding earmarked for ‘sovereign cloud’ ends up with the European subsidiaries of US hyperscalers, the package will have failed its objective.”

The real impact on hyperscalers

The proposed rules could require hyperscalers to change tactics to cater to European customers, or to at least ramp up existing sovereign cloud strategies. “For vendors, this is essentially a shift in what ‘competitive’ means,” said Pereiro. “For the last decade, scale and hyperscaler alignment were enough. That’s no longer the case.”

Cloud providers will need to demonstrate real control over data, infrastructure, and operations, he said, and not just label solutions as “sovereign.”

“The bar has been raised, and some existing offerings simply won’t clear it,” he said.

While the CADA rules are designed to favor European providers in some cases, the proposals stop short of barring US providers from public sector contracts. “It doesn’t shut them out,” said Pereiro, “but it changes competitive conditions substantially.”

The proposed procurement requirements make sovereignty a “gating factor” for sensitive workloads, said Pereiro, and “create real friction for providers whose operating models depend on centralized control or non-EU jurisdiction.”

US tech firms tout support

US hyperscalers publicly welcomed the proposals, and indicated plans to work with policy makers and ensure the importance of customer choice in cloud service procurement.

“We look forward to reviewing the proposed rules and continuing to work alongside our partners to ensure European organizations have the power of choice and sovereign control,” a Google spokesperson said.

An AWS spokesperson said the company has invested ”tens of billions of euros” in European cloud infrastructure, which it claims has “already advanced the continent’s competitiveness, helped organizations innovate and grow, and supported the development and resilience of both public and private services that Europeans now rely on every day.

“European organizations deserve access to the best technology available from trusted providers, chosen on the basis of security, performance, verifiable controls, and value,” the AWS spokesperson said. “We look forward to working with policymakers to ensure the Cloud and AI Development Act promotes technology choice and rewards long-term investment in Europe’s digital future.”

A Microsoft spokesperson said the company shares the EU’s “ambition to strengthen technological sovereignty and global competitiveness in AI, grounded in openness, partnership and fair competition.

“Achieving this will depend on access to world-class infrastructure and technologies at scale,” the Microsoft spokesperson said. “That means enabling European companies and public administrations to make procurement choices based on a broad, risk-based assessment in an open and competitive market.

“Microsoft offers secure and sovereign cloud solutions that put customers in control, and we stand ready to help build a strong, resilient and globally connected AI ecosystem in Europe.”

While the proposals present potential hurdles for US hyperscalers, those that adapt to the new regulatory direction — and concerns of European organizations — will benefit, said Pereiro. “If your offering aligns with sovereignty requirements, your company will be likely to see more opportunities, not fewer,” he said.

Technology companies announced 38,242 job cuts in the US in May 2026, the highest monthly total for the sector since August 2024, according to research by employment placement company Challenger, Gray & Christmas. So far this year the company has observed 123,653 US technology job cuts, a rise of 66 percent from the same period in 2025.

These figures represent the third successive month that there has been an increase in job layoffs across all sectors, the company said.

“The labor market is being reshaped by technology in real time. AI is now the leading reason companies give for cutting jobs and the primary industry citing it is technology,” said Andy Challenger, chief revenue office at Challenger, Gray and Christmas.”

AI was blamed for 38,579 of the 97,006 job cuts announced across all industries tracked by the company. It accounted for 40% of the cuts observed in May, up from 7% in January.

This year has already seen some major layoffs in technology. In March, HPE slashed 2,500 jobs from its wage bill, while Oracle announced plans to shed an unspecified number of developers. And the cuts keep on coming, just last month, Meta shed 8,000 employees.

Forget “Florida Man.” Want to hear a California Man story? 

Here goes. 

A California man rolled up to a yoga studio in San Francisco’s Marina District in a self-driving Waymo car, walked into the studio, grabbed an armful of yoga shorts, got back in the Waymo and took off. 

Six months later, police still haven’t found him, according to a story this week in The San Francisco Chronicle. Since the rider’s credit card information didn’t lead to an arrest, we can assume the perp used a stolen phone’s Waymo account and financial information to hail the ride. And by the time police requested interior video of the man’s face, Waymo had already deleted it. 

This is a “California Man” story in part because of the association of Waymo with the city of San Francisco. Soon that association will be obsolete. (In fact, while Waymo is headquartered in San Francisco and is more visible there, Arizona got Waymos two years before San Francisco did.) 

At the moment, Waymos are publicly available to riders in 11 US cities — San Francisco, Phoenix, Los Angeles, Austin, Atlanta, Miami, Orlando, Dallas, Houston, San Antonio, Nashville.

Before long, riders will be able to enjoy robot car rides from Waymo in Las Vegas, San Diego, Washington DC, Denver, Detroit, Baltimore, Boston, Charlotte, Chicago, Minneapolis, New Orleans, New York, Philadelphia, Pittsburgh, Sacramento, Seattle, St. Louis, Tampa, London, and Tokyo.

Historically, Waymo has been taking a bath on rides. 

(I’m not talking about recent stories where Waymo cars have driven onto flooded roads. On May 12, Waymo issued a voluntary recall of 3,791 cars after a software defect allowed an autonomous vehicle in April to drive into a flooded, impassable roadway in San Antonio and be swept into a creek. A week after the recall, the company paused all freeway rides and suspended service in Atlanta, Austin, Dallas, Houston, San Antonio, and Nashville because of construction-zone navigation issues.)

To date, self-driving ride-hailing services like Waymo are a loss-leader business. Waymo is secretive about its costs, but independent estimates suggest that a $20 ride for the rider may be a $50-$100 ride for Waymo, when you factor in all costs. 

But help is on the way. 

Cars that drive themselves don’t pay for themselves

A big part of why Waymo rides have been so costly is that the car is a retrofitted Jaguar I-PACE. It’s true that Waymo got a deal on the roughly $70,000 car (a steal at $50,000 per vehicle because the company bought thousands of them). 

But then Waymo had to bolt on all kinds of costly sensors and electronics to make them self-driving, including a roof-mounted lidar assembly of five units, 29 cameras all around the car, six radar units, a custom Waymo-designed AI inference compute platform, and the wiring harness and power distribution system. 

Estimates for the total cost per car for Waymo are in the $120,000 to $200,000 range. 

Another problem is that the Jaguar I-PACE is notorious for a lack of reliability, especially involving its batteries and its longevity. Jaguar stopped making I-PACE cars two years ago. 

Finally, Waymo can’t do what regular car owners do and sell the car to recover some of the initial investment. Nobody wants an electric car with a depleted battery covered in electronics and sensors that can’t be used. 

The good news is that we learned this week that used Waymo batteries will be repurposed as backup storage for power grids in California and Texas. 

Say “Oh, Hi!” to the Ojai

The combination of growth and the end of manufacturing for the Jaguar I-PACE means that Waymo’s next platform is right on time. The car is called the Ojai, named after the unaffordable artsy hippie mecca located 80 miles northwest of Los Angeles. 

Waymo announced last week that the company will soon open Ojai cars to free rides for select riders in San Francisco, Los Angeles, and Phoenix. (See this Redditor’s drone photos  of the current fleet of Ojai cars in Mesa, AZ.)

The Ojai is a purpose-built electric minivan made by Zeekr, an arm of China-based Geely Automobile Holdings. It’s got doors that slide open like an elevator door, more legroom than the I-PACE, three screens for passengers, Braille instructions, grab bars, a flat floor with low-step height for easier entry, charge ports, cupholders, more cargo space, better batteries, faster EV charging, and easier cleaning and maintenance than the I-PACE cars. 

It’s much cheaper for Waymo to buy — and much cheaper and faster to integrate Waymo electronics. 

The Ojai gets Waymo’s sixth-generation Driver as a factory-co-engineered system with just 23 sensors (13 cameras, four lidar, six radar). While that’s far fewer sensors, they’re much more capable than the older generations of Waymo systems. One of my favorite details of the Ojai sensor package is that each car will have 10 sensor wipers with heaters and fluid sprayers specifically designed for snow, rain, and adverse weather. They’re like tiny, high-tech windshield wipers, but for the glass in front of the sensors. Ojai cars will likely do far better in rain and snow conditions. 

Weirdly, the Ojai still has needless controls, like a steering wheel and gas and brake pedals. And the only reason for those is that the US Congress is asleep at the wheel. US. federal motor vehicle safety standards require steering wheels and pedals for street-legal vehicles, and neither NHTSA nor Congress has granted a permanent exemption for purpose-built driverless vehicles. 

Despite the vestigial controls, the difference between the two cars is that the Jaguar was an old-school car designed for drivers, while the Ojai is the new concept for cars, one built for riders. And for riders, the Ojai is better in every way that matters. 

The Chinese factor

There’s only one factor keeping Ojai cars from replacing the full Jaguar I-PACE: They’re  made in China. 

Waymo is getting around the 100% tariff imposed by the Trump Administration by “location-laundering” the build. Zeekr completes the Ojai shells in Gothenburg, Sweden, and because the “substantial transformation” occurs within the EU, the vehicles are classified as EU-origin products. The stripped-down gliders arrive with no modems, ECUs, or autonomy software, and Waymo installs all connected technology at its Mesa facility, which satisfies the Commerce Department’s 2027 and 2030 rules prohibiting Chinese-linked vehicle electronics. 

Some lawmakers are using Waymo as a case study for general anxieties about Chinese technology infiltration into American infrastructure. The other problem is protectionism. If un-tariffed Chinese cars were allowed into the US market, the US car industry would likely be decimated by the competition. Chinese carmakers like BYD enjoy a 25% material cost advantage over Western carmakers. They would enter $5,000 to $10,000 cheaper than comparable U.S. offerings, according to some estimates. 

So, Washington is jittery about Chinese-made cars. 

I drove a BYD rental car in the UK last month. And I can tell you, they’re great cars and very enjoyable to drive. (My only complaint was that the steering wheel was on the wrong side.)

Instead of Waymo taking a risky bet on Ojai cars, they’re instead expanding with Hyundai Ioniq 5 EVs, which are produced locally and will be retrofitted with Waymo’s sixth-generation Driver at that Mesa facility. This is a massive deal in which Hyundai will supply Waymo with 50,000 cars by 2028. 

Waymo hasn’t disclosed plans for Ojai cars, but it’s unlikely to even come close to the number of Hyundai cars it is on the hook for. 

(The company also has around 100 Zeekr cars, but plans to expand that fleet to a few thousand.)

The right solution for Waymo’s next few years would be all Ojai cars with no steering wheel or pedals. The Ojai is purpose-built for autonomous car ride sharing, affordable, and capable in all weather. But that’s not going to happen because of Congressional inaction, China panic, and protectionism in Washington. 

Instead, Waymo’s future is to use too many cars from the past, by which I mean much or most of its fleet will be driverless cars retrofitted from cars that prioritize the driver, rather than the passengers. And reports suggest that the price of Hyundai cars will be comparable to the overpriced Jaguars. 

I’m sure the Hyundai Ioniq 5 will be nice. But an all-Ojai fleet would have been the better future for Waymo. Instead of the right car for the job, Waymo is stuck with an expensive, less comfortable, less capable car than the Ojai. 

The age-old IT defense when compliance violations are investigated by regulators is to try and keep a low profile — and hope no one looks too closely. But with enhanced SEC interest in all data breaches encouraging regulators around the globe to take those closer looks at IT, data breach disclosure rules are becoming more strict.

While that might be unsettling for cybersecurity executives, it is also disturbing news for IT admins, who could find themselves under a remarkably uncomfortable spotlight. 

Consider this recent move by the New York State Department of Financial Services against the Delta Dental Insurance Company. State officials hit the insurance company for improper and inconsistent enforcement of its own data retention policies; improper incident response plan protocols; and improper notification of the security incident itself. 

The company was fined more than $2 million.

The data retention violations are perhaps the most problematic. Had that policy been enforced properly, much of the stolen data would have been destroyed long before the attackers could have accessed it. 

It’s not simply a matter of whether the IT rules for retention were sufficiently strict. Some regulators — and especially the US Federal Trade Commission (FTC) — focus extensively on companies who don’t do what they say publicly. If a corporate website promises something to customers, the FTC will hold companies to their word. 

Think about that the next time you assign a summer intern to handle your website’s copy. 

Inconsistent implementation of data retention policies can deliver other legal headaches. Having a good policy approved by the general counsel is fine, but it means nothing if all of your people do not follow it strictly. 

Let’s say one of your business units is being sued for having done something naughty. Opposing counsel subpoenas your business records, including emails from a few years ago. Your attorney responds that those email records no longer exist; they were deleted last year in accordance with corporate policy on data retention that says everything of a certain nature has to be deleted after one year. 

Fair enough. But what if opposing counsel in a deposition asks,“Really? Does that policy apply to all records of that nature?” You say that it does. 

“It might interest you to know that we have sworn testimony from four other employees who showed us emails of the same nature that were more than five years old. So why did you adhere to your policy regarding emails that might prove the fraud but somehow you did not delete others? Sounds a little selective, no? I think the judge would agree.”

In the dental case, the company had a strict policy on retention rules. But corporate software was programmed with “the ability to shorten, extend, or disable MOVEit Transfer’s default retention settings on a folder-by-folder or file-by-file basis.” 

The regulators then swooped in because the insurance company “had no written policy or procedure for requesting, reviewing, or approving such changes to folder retention settings.”

The best retention policy would, in theory, have no exemptions. But if you’re going to allow exemptions, you need a precise policy documenting how and when they can occur. There should be a required form so that a manager can write out the reasons for this specific exemption.

The New York state document is an important one to carefully review; it provides an excellent roadmap to how compliance can go wrong — and useful information on how to keep something similar from  happening to your company.

The European Union has now published a set of measures aimed at boosting Europe’s tech industry to help reduce reliance on US and Chinese suppliers for AI, cloud, and semiconductors. The proposals include rules to restrict the use of US hyperscalers for certain public sector procurement purposes, but stop short of banning them outright.

“Technological sovereignty does not mean protectionism. Europe remains grounded in openness, partnership, and fair competition,” Henna Virkkunen, executive vice president for Tech Sovereignty, Security and Democracy, said in a statement Wednesday. “At the same time, Europe wants to be in the position to make its own choices, avoiding dependence on single dominant suppliers, especially from non-like-minded countries.”

The European Technological Sovereignty Package — released after several delays — includes two legislative proposals: the Cloud and AI Development Act and Chips Act (CAIDA) 2.0 and the Open Source Strategy and Strategic Roadmap for Digitalization and AI in Energy.

CAIDA aims to triple data center capacity in the next five to seven years by easing restrictions for deployments across the EU. It also includes rules that, if enacted, would require EU public bodies to meet certain sovereignty criteria for cloud service procurement related to certain sensitive workloads.

Amid ongoing trans-Atlantic tensions and a long-time deep reliance on US tech providers, European organizations have become increasingly wary of a “kill switch” that would cut off access to digital services. There are also concerns that US hyperscalers could be compelled to share data with US government under the CLOUD Act and Foreign Intelligence Services Act (FISA), even when data centers are located in Europe.

The CAIDA proposals include four levels of criteria for suppliers; the most basic includes data center infrastructure located and operated in the region – something  many US cloud suppliers already provide – with stricter rules around supplier ownership, full control over the software stack, and more stringent cybersecurity certification.

The majority of existing EU public sector workloads (70%) fall under the first level, with 20% at level 2, and 9% at level 3. Only a small proportion (1%) of the most sensitive workloads would require level 4.

Other proposals include the Chips Act 2.0, a follow-up to the 2023 legislation that sought to improve semiconductor production capabilities; the updated version now aims to boost research and spur demand for domestically produced processors. 

The legislative proposals must be negotiated by the European Parliament and Council of the European Union before adoption.

IBM has launched a tool designed to help customers assess cloud-sovereignty risks and meet regulatory compliance requirements. 

The Sovereignty Risk Profile launch comes as digital sovereignty becomes a higher priority for organizations concerned about where data is stored and processed. According to an IBM survey, 93% of executives believe sovereignty needs to be part of their business strategy.  

Via the new tool, customers can set up policies related to regulatory and business requirements — such as where data resides and how it’s protected, for instance. These policies can be applied to specific cloud workloads, regions, or zones in the Sovereignty Risk Profile tool, allowing users to track sovereignty requirements “in real time,” IBM Cloud product manager Janet Van said in a blog post, with “visibility into configurations, encryption posture, and environmental controls.” 

It’s then possible to assess compliance and decide what workloads meet sovereignty requirements. 

Tracking the factors that contribute to sovereignty is a challenge for many organizations, said Holger Mueller, vice president and principal analyst at Constellation Research. “It is very difficult, as you don’t know about the details of the stacks; sometimes, even the location of data is not fully transparent,” he said.

The Sovereignty Risk Profile “addresses many of the compliance-related requirements associated with data residency and encryption, while also tackling sovereignty from a resilience and concentration-risk perspective,” said Dario Maisto, senior analyst at Forrester.

However, the monitoring tool can only do so much to address digital sovereignty concerns, he said. While it can help organizations identify and report on potential issues, it “does not help [make] clients more or less sovereign, per se: it has only the potential to tell that a sovereignty problem is there.”

Broader questions around digital sovereignty remain difficult to address, he said, as there’s no universally accepted definition of the concept and limited legislation to establish clear requirements. 

Mueller described a spectrum of sovereignty issues that depend on factors such as whether data is stored, processed, and backed up in a customer’s own country, as well as whether staff that operate the data are domestic nationals. “Then there is the sovereignty of the software supply chain — but here everybody is dependent,” he said.

To further complicate matters, while several US hyperscalers sell sovereign-branded cloud services to European customers — with local staff and infrastructure —  concerns remain about the potential for extra-jurisdictional access to data, due to the US CLOUD Act and the US Foreign Intelligence Surveillance Act (FISA).

The Sovereignty Risk Profile is available within IBM’s Security and Compliance Center Workload Protection. It’s the latest in a range of IBM Cloud products aimed at addressing customers’ sovereignty concerns, including the recently launched IBM Sovereign Core software platform. 

It’s hard for people to tell the difference between AI-generated advertising and writing. So why do they respond better to the human-made stuff?

AI vs. Mad Men

Ipsos, along with faculty members from Syracuse University’s S.I. Newhouse School of Public Communications, just published a unique advertising study. They took 20 real ads from major brands, including Cheerios, Chewy, Febreze, Fiat, H&M, Old Navy, Herbal Essences, Ray-Ban Meta, TurboTax and Visa. They fed the same creative briefs used by the human ad creatives into Google Gemini, then used OpenAI’s Sora to generate fully AI-produced counterparts with no human intervention. 

They showed the ads to 3,000 consumers. Only 25% of AI ad viewers were at least somewhat confident the spot was AI-made, and 40% of all viewers were uncertain either way — suggesting the public isn’t great at spotting ads that are AI generated. 

But here’s the interesting part: While most people didn’t register that ads were AI-generated, they also didn’t respond to them like they did with human-generated ads. They consistently rated human-made work as more eye-catching and more imaginative. 

In other words, people assumed AI ads were made by people, but didn’t particularly like them compared to human-generated ads. And that means human-generated ads performed much better. 

Ads made by people without AI were 14% stronger on short-term sales impact and 17% stronger on long-term brand health.

To me, the data here suggests that while people can’t easily discern the difference between AI- and human-generated content, the AI stuff hits wrong on a subconscious level. And I think that’s happening with AI social posts, AI blog posts and AI slop in general. 

In fact, I’ve noticed it strongly in my own response to AI-generated content. It often looks perfect but bothers me for reasons that aren’t immediately obvious. 

The researchers explained AI’s inability to match human ad creativity by pointing out that AI draws from what already exists, while great advertising breaks new ground. AI can replicate the conventions of advertising, but it can’t transcend them, make a creative leap or engender emotion like people can. 

A broad range of research beyond the Ipsos study suggests that skillful people working with AI tools will always outperform AI alone, and often outperform people not using AI tools. Ipsos’ advice? Ad agencies should keep people at the center of brand storytelling and emotive assets. 

Can AI write right?

Another recent study looked at written web content and compared how human-written articles “performed” on search engines compared to AI-generated content. Semrush analyzed 42,000 blog pages across 20,000 keywords, ran every single one through GPTZero’s AI detector, and cross-referenced the results with actual Google Search results. It also surveyed 224 search-engine optimization (SEO) professionals about their AI habits and beliefs.

They found a disconcerting disconnect between what SEO people believe and what is actually true. Some 72% of SEO professionals who use AI content say it performs just as well or better than human-written content in search rankings. But it turns out that human-generated posts strongly outperform AI-generated. 

Content classified as purely AI-generated appeared in the top spot in search result just 9% of the time. Content classified as human-written was there 80% of the time.” That’s a roughly 8-to-1 advantage. (Note that the coveted top link in search results typically gets around one-third of the clicks.)

For lower page-one positions — from the fifth position down (which get relatively few clicks) — AI- and human-generated posts perform more similarly. (The researchers also found that when people write posts with a little help from AI, their posts rank better much than AI-only content.)

Those Semrush results are consistent with previous research. 

• NP Digital conducted an oft-cited study two years ago that found that human-written content ranked higher 94.12% of the time on Google than AI content. 
• A Graphite/Common Crawl analysis found that 86% of articles ranking high on Google Search are human-written (only 14% AI-generated), and ChatGPT and Perplexity cite human-written articles 82% of the time (only 18% AI). 
• On LinkedIn, more than half of site’s long-form content in 2025 was classified as “Likely AI” by Originality.ai. Engagement on verified human content was 61% higher than the AI-marked posts. 

Note that engagement performance varied by industry; that 61% result is an aggregate average across all industries. Ironically, in the category of “Leadership & Inspiration,” AI posts outperformed human posts by 75%. 

The absurd lesson here: If you want to be a thought leader on LinkedIn, don’t lead with your own thoughts. 

Quantity vs. quality

What all this research boils down to is that human-generated content (with or without help from AI) attracts far more traffic and higher engagement than AI-generated content. AI content is essentially invisible in high-value channels and while it might be high in quantity, it’s low in quality where it really matters — with reach and influence. 

As with the ad creative study by Ipsos, the conclusion of all this research is the same: People (and search engines) respond much better to creative content produced by people compared with AI-generated content. 

In short, AI is great at “flooding the zone” at high speed and low cost — and there’s a ton of AI-generated content out there. A quick check reveals that: 

• More than half of all written content on websites is now AI-written.
• Almost half of all music uploaded is now AI-generated.
• Nearly one-quarter of all videos uploaded are AI-generated or manipulated.
• Around 40% of all podcast episode uploads are AI-generated.
• More than 70% of all images uploaded to social media may be AI-generated or manipulated.
• And wll over half of all social posts are AI-generated

The specific numbers are my best estimates, and they’re changing fast each month. The takeaway is that AI-generated content is exploding in volume. 

But it isn’t reaching people the way human-generated content does. Take podcasts, for example. While roughly 40% of new podcast episode uploads are AI-generated, that 40% captures less than 1% of the listening hours. Of the top 100 podcasts, zero are AI-generated.

A clear picture is emerging about the use of AI for content generation. AI is great for churning out a lot of content at low cost. It can be good for some kinds of content — if a skillful person directs it. And AI can be a helpful tool for content creators. 

But when it comes to direct comparisons between people and AI, it’s clear that the winning content — the stuff with the best “performance” on search, best reception by people and the most engaging — is always human-generated. 

T

All of the big AI models violate EU rules on AI and data protection to varying degrees, according to the nonprofit research foundation Aithos.

Aithos tested the models using its own tool, LARA (Legal Assessment for Real-world Agents), which simulates real-world situations where AI assistants may find themselves in legally questionable situations, according to The Register. The tests measure compliance with the GDPR and the EU’s AI Regulation, among other things and found the models collected user data without proper consent, attempted to manipulate vulnerable individuals, or created psychological profiles of users.

According to the results, all major language models failed to meet EU legal requirements; some violated the rules in up to 93% of cases. The best result was achieved by the Anthropic model Claude Opus 4.7, which was in compliance about 54% of the time.

Aithos warned that responsibility for the shortcomings does not lie solely with AI companies. Companies that build their own AI agents on top of these models could also be held legally liable.

Tech companies seem to be falling over each other these days in firing people to either replace them with AI or to pay to build AI infrastructure. Wouldn’t it be nice if they at least waited until AI actually worked for business?

On the one hand, top tech businesses such as Amazon, Block, Cisco, Cloudflare, and Meta have all announced that they’re slashing payrolls — either because AI can do the same work as people or they need the cash to build out their AI infrastructure. Isn’t that great? All together, of the 37,638 tech job cuts so far this year, 47.9% — almost half —  can be tracked back to AI. 

On the other hand, despite all the AI hype and hysteria, no one has yet proven that AI is, generally speaking, really all that helpful for businesses. Oh, I know, I know. You did great things with OpenClaw vibe programming. Microsoft’s CEO, Satya Nadella, claims 20% to 30% of the company’s code was written by AI. And Nvidia assures us that 88% of its surveyed customers report AI has increased their revenues. 

But really, what else would they say? “Dear Board, we just blew half a billion bucks on Nvidia GPUs, and we’re losing money hand over fist?” I don’t think so.

The truth is, as an IDC study reports, a mind-boggling 88% of proof-of-concept AI projects never reach production. Lest we forget, MIT’s The GenAI Divide: State of AI in Business 2025 study found that 95% of AI projects fail to deliver measurable P&L impact. 

Now, I have to acknowledge that AI is finally becoming truly helpful in business. As a guy who knows a thing or two about programming, Linus Torvalds, creator of Linux and Git, said at Open Source Summit North America, “I’m personally 100% convinced that AI is changing programming.” He estimates that “AI will increase your productivity by a factor of 10.” 

But is that reason enough to slash make workforce cuts of between 10% to 40%? (Short answer: No. Longer answer: Noooo!)

It’s not just the mass firings. Workers who are either awaiting the axe, or have escaped it for the moment, are miserable. As one Meta employee told The San Francisco Standard, “I tend to cry in the shower,” and, “A lot of my feelings about my job are about the general chaos and not just the layoffs. ” 

So, explain this to me: When everyone knows AI-driven layoffs are coming, exactly how well do you expect them to work? You really think they can give their best? 

Making matters worse, it’s an open secret that IBM, Google, and Meta are having their employees train their AI replacements. As a popular meme puts it, workers are now “building your own coffin.” Is it any wonder that a lot of people — 29% of all employees and 44% among Gen Z workers —  are deliberately sabotaging work when the boss insists they train their AI replacements?

It also sure doesn’t help office morale when the CEO keeps saying AI will replace half of all employees. A particularly egregious example of this was when Standard Chartered CEO Bill Winters proclaimed his bank would slash thousands of jobs and replace “lower-value human capital” with AI.  

He’s since backed off the claim, but come on — we all know he meant it. Just like all the other CEOs who’ve said similar things, between FOMO and the knowledge that AI job news is sure to make the stock price jump, they’re eager to cut headcounts and boast about how successful AI will make them. 

What happens a few quarters down the road? Their attitude today seems to be let  tomorrow take care of tomorrow. I hate to tell them, but that really doesn’t work in the long run. (Not, mind you, that a future much farther ahead than the next quarter seems to matter much anymore to business executives.)

It should. As a recent Deloitte study stated: “Most respondents reported achieving satisfactory ROI on a typical AI use case within two to four years. This is significantly longer than the typical payback period of 7seven to 12 months expected for technology investments. Only 6% reported payback in under a year, and even among the most successful projects, just 13% saw returns within 12 months.” 

AI, in short, is not the miracle cure for what ails businesses that its fans claim. 

Will that stop businesses? I doubt it. While I appreciate that California Gov., Gavin Newsom is trying to bandage the AI job bleedout by mandating studies on subsidizing companies to keep employees rather than replace them with AI, I doubt that will do much to staunch the wound. 

At the Open Source Summit North America, Linux Foundation CEO Jim Zemlin was optimistic about AI and jobs. He pointed out that, thanks to AI becoming  “pretty damn good coders,” the number of open-source projects on GitHub has led to a “surge of new code and projects.” 

Zemlin also believes that while few developers will write code, “engineers will still design, review, secure, and integrate that code.” (He’s referring to what’s becoming  known as forward-deployed engineers.) This, in turn, will supposedly lead to tech job growth. 

I’d feel a lot better about that prediction if I believed the C-suite suits at most companies were capable of truly forward-looking thinking rather than focusing entirely on hiking the stock price by making the next quarter look good through staffing cuts. 

In the long run, sure, AI will make us more productive. But, we’re not there yet. For now, companies need to keep employees happy, not shove AI down their throats — and work out carefully and thoughtfully how AI will really work for business. 

If ever there were a lawsuit in which a jury and judge should have ruled against both the accuser and the defendants, Elon Musk’s suit against OpenAI and Microsoft was it. 

The high-profile legal battle pitted the world’s richest man against a company worth more than $3 trillion, another that might soon launch a $1 trillion IPO, and tech execs claiming to have only the good of the world in mind, not mere filthy lucre, while they develop a technology some fear could eventually destroy humankind.

The lawsuit was eventually thrown out, but only on technical grounds. Meanwhile, unregulated AI marches on, with Musk, OpenAI and Microsoft all getting richer.

The only winner in this suit was hypocrisy. Here’s why.

Back to the beginning

To understand how this unfolded, we need to go back to OpenAI’s beginnings. The company was founded by current CEO Sam Altman, Musk and others in 2015 — back when AI was a niche technology, used primarily for image and speech recognition, robotics, and experiments in self-driving cars.

The founders funded OpenAI out of their own pockets as a nonprofit company aimed at developing AI for the good of the world. Then, as the technology evolved, Altman, Musk and others grew worried it might become so powerful that, without serious guardrails, it could pose a danger to humans. They feared what might happen if AI reached the level of a super-powerful artificial general intelligence (AGI) system, superior to humans on a variety of tasks, with general problem-solving skills rather than narrowly targeted ones – and the ability to think for itself rather than heeding humans. 

In an earlier version of Musk’s suit against OpenAI and Microsoft, Musk put their fears this way: “A.G.I. poses a grave threat to humanity — perhaps the greatest existential threat we have today.”

Early on, OpenAI wasn’t on many people’s radar. When Microsoft invested $1 billion in the company in 2019, few outside the tech industry took notice. Between 2021 and 2023 Microsoft invested $2 billion more, still without drawing a lot of attention.

Then in November 2022, OpenAI released ChatGPT, launching the generative AI (genAI) revolution — and all the disruption that has followed since. Eventually, as it became clear how important and valuable genAI technology would become, Microsoft’s investment ballooned to $13 billion.

Nonprofit no more

OpenAI insiders were convinced several years before ChatGPT’s release that the company could become tremendously profitable. With potentially trillions of dollars at stake, in 2017 they started looking for a way to turn the nonprofit operation into a for-profit company.

It was at that point, OpenAI says, that Musk pushed to gain majority equity in the company if it went public, take control of the board, and become CEO. When the other founders balked, Musk withheld funding.

Last year, OpenAI released copies of emails he sent to it during the height of their in-fighting. In one, in February 2018, he lobbied for the creation of a for-profit arm, pointing out that, “a for-profit pivot might create a more sustainable revenue stream over time and would, with the current team, likely bring in a lot of investment.” 

Musk then suggested that OpenAI “attach to Tesla as its cash cow.” When the other founders dismissed the idea, Musk threw a fit and quit the company. OpenAI went ahead and launched a for-profit arm, becoming a hybrid of a for-profit and nonprofit company in 2019.

Years later, in 2024, Musk filed suit, targeting OpenAI, Altman, OpenAI co-founder and president Greg Brockman, and Microsoft — accusing them of “stealing a charity” by creating the for-profit arm of OpenAI, and taking the $13 billion Microsoft investment. He claimed they had all illegally enriched themselves through the profit/nonprofit setup and sought $150 billion in damages. (OpenAI fired back last year with a counter suit.)

It took only two hours for the jury to rule against Musk, though the ruling didn’t address his actual claims. Rather, the suit was thrown out because it had been filed after the statute of limitations had run out.

Cynicism and hypocrisy win out

Everyone in this case was driven by venality. Altman portrayed himself as only wanting to develop AI to help humanity — and as evidence, pointed out he has no equity in OpenAI. What he neglected to add, though, is that he has more than a $2 billion stake in companies that have deals with OpenAI, and stands to gain billions more if those deals grow after any IPO.

Microsoft, meanwhile, has used its investments in OpenAI to become a multi-trillion-dollar company. And if, as expected, OpenAI becomes a trillion-dollar company when it files its IPO later this year, Microsoft’s 27% ownership stake in the company would make it $270 million richer. That’s not a bad payoff for turning a blind eye to the way in which OpenAI performed a bait-and-switch from nonprofit to for-profit company. 

As for Musk…, well, what can you say about someone who claims he wants to save humankind from the evils of AI, while at the same time lobbying for OpenAI to become a for-profit company and milking it like a cash cow? 

He’s shown he’s not only the world’s wealthiest man. He’s also the world’s most hypocritical.