Announcing Agent Commander - The First Integrated solution from Veeam + Securiti.ai enabling the scaling of safe AI agents
View
August 3, 2026
United States
A coalition of 15 U.S. state Attorneys General, led by Iowa Attorney General Brenna Bird, has sent a joint letter to OpenAI CEO Sam Altman demanding greater transparency and accountability following an incident involving an experimental OpenAI model.
According to the coalition, the experimental AI model gained unauthorized access to several computer networks during testing, culminating in a multi-day cyber intrusion involving AI company Hugging Face. The Attorneys General raised concerns regarding OpenAI’s oversight and safety controls and requested that the company preserve potentially relevant documents, data, and information. The coalition also called on OpenAI to cease the testing activities that led to the incident until it can demonstrate that such testing can be conducted in a controlled and responsible manner.
The action highlights growing regulatory scrutiny around AI safety, cybersecurity, transparency, consumer protection, and data privacy as organizations develop and test increasingly capable AI systems.
August 2, 2026
California, United States
The California AI Transparency Act became operative on August 2, 2026.
The Act applies to covered providers that create, code, or otherwise produce generative AI (GenAI) systems with more than one million monthly visitors or users that are publicly accessible in California. Covered providers must make available a free, publicly accessible AI detection tool that allows users to assess whether image, video, or audio content was created or altered by their GenAI systems, including through content uploads, URLs, and API access.
Covered providers must also include machine-readable latent disclosures containing specified provenance information in qualifying AI-generated content and offer users the option to include clear and conspicuous manifest disclosures identifying content as AI-generated.
Additional requirements will apply to qualifying large online platforms and GenAI system hosting platforms beginning January 1, 2027, with requirements for capture device manufacturers taking effect January 1, 2028.
August 18, 2026
Greece
Greece has enacted Law 5321/2026 to implement key aspects of the EU AI Act, designating the Hellenic Data Protection Authority (HDPA) as the competent market surveillance authority for prohibited AI practices, high-risk AI systems under Annex III, and systems subject to the transparency obligations under Article 50.
The HDPA will also serve as Greece's single point of contact with the European Commission and the relevant national authorities, and as the competent authority for receiving and handling complaints concerning infringements of the AI Act. In addition, the HDPA has been designated as a notified body for the conformity assessment of specific high-risk AI systems and, together with the Hellenic Telecommunications and Post Commission (EETT), as the competent authority for the operation of Greece's national AI regulatory sandbox.
The announcement follows the application of the AI Act's prohibited AI practice provisions as of February 2, 2026, and its Article 50 transparency obligations as of August 2, 2026.
August 17, 2026
Netherlands
The Dutch Data Protection Authority (AP) has called on organizations to begin preparing for the EU AI Act's Fundamental Rights Impact Assessment (FRIA) requirements and has launched a national pilot to help organizations gain practical experience in conducting and reporting FRIAs.
According to the AP, starting in December 2027, government and private organizations that provide public services and deploy certain high-risk AI systems, as well as public or private organizations that use financial risk assessment systems, will be required to assess the potential impact of such systems on fundamental rights before deployment. The assessment must identify potential impacts on rights such as equal treatment, human dignity, privacy, and access to essential services, describe measures to mitigate identified risks, and be reported to the supervisory authority.
The AP's pilot will allow participating organizations to gain experience using the European FRIA reporting template and receive feedback on their approach. The pilot is intended solely for learning purposes and will not constitute an audit, inspection, or enforcement process. Organizations may register to participate until September 21, 2026, with the pilot scheduled to begin in early October.
August 11, 2026
Malta
The Malta Financial Services Authority (MFSA) has issued a circular highlighting the evolving cybersecurity risks associated with Frontier Artificial Intelligence Models (FAIMs) and their implications for financial institutions.
According to the MFSA, increasingly capable AI models may enable cyberattacks to be conducted with greater speed and sophistication, including by accelerating vulnerability discovery and the development and weaponization of exploits. This could reduce the time available for institutions to identify, patch, and mitigate vulnerabilities.
The MFSA has not introduced separate FAIM-specific requirements. Instead, license holders are encouraged to consider these risks within existing ICT risk management and operational resilience frameworks, including vulnerability management, incident detection and response, resilience testing, and third-party risk management. The MFSA also highlights risks arising from reliance on common technology, cloud, AI, and data providers. For license holders within its scope, DORA remains the regulatory anchor for digital operational resilience.
August 1, 2026
Poland
The Polish Data Protection Authority (UODO) has published a set of initial questions to help organizations assess data protection and regulatory considerations before developing or deploying AI systems.
The guidance follows a UODO survey indicating that many organizations do not recognize the connection between AI tools and personal data processing, while 95.9% of respondents did not consider themselves prepared to implement AI in compliance with the GDPR. UODO has developed separate question sets for SMEs that use ready-made AI systems, public-sector entities, and other organizations, including those that develop or train their own AI models. An extended version also addresses relevant AI Act requirements, including AI risk classification and fundamental rights impact assessments.
The questions are intended as an initial assessment tool and do not replace formal risk assessments, Data Protection Impact Assessments (DPIAs), or Fundamental Rights Impact Assessments (FRIAs), nor do they constitute a binding interpretation of GDPR requirements.
August 1, 2026
Key transparency requirements under the EU AI Act became applicable on August 2, 2026. These include obligations to inform individuals when they are interacting with certain AI systems, ensure AI-generated or manipulated content is identifiable in machine-readable form, and clearly disclose certain deepfake and AI-generated content.
The same date also marked the application of the AI Office’s enforcement powers for general-purpose AI (GPAI) models. GPAI providers are subject to obligations, including maintaining technical documentation, providing information to downstream providers, implementing a copyright compliance policy, and publishing a sufficiently detailed summary of training content. Providers of GPAI models presenting systemic risks face additional risk assessment and mitigation obligations.
The AI Office oversees GPAI obligations, while national competent authorities are responsible for the enforcement of other AI Act requirements at the Member State level. The Commission has also introduced dedicated channels for complaints, whistleblowing, and reporting potential infringements by GPAI providers.
August 11, 2026
Australia
The Australian Signals Directorate (ASD) has highlighted the cybersecurity and operational risks associated with agentic AI following reports that an AI assistant made unauthorized changes to an Australian gym-booking system while attempting to complete a user-requested booking.
The AI agent reportedly bypassed booking restrictions and removed another customer from a waiting list, demonstrating how autonomous AI systems may take unintended actions to achieve assigned objectives. ASD linked the incident to “specification gaming,” where an AI agent identifies shortcuts or loopholes that technically achieve a goal but conflict with the user's actual intentions.
ASD recommends limiting agentic AI to low-risk, non-sensitive tasks, restricting agents’ access and decision-making authority, and maintaining human oversight to review and approve actions. Organizations providing online services are also encouraged to strengthen security controls and account for the potential for AI agents to identify and exploit vulnerabilities at greater speed and scale.
August 11, 2026
Philippines
The Philippines National Privacy Commission (NPC) has issued a public notice addressing the use of real persons’ faces and likenesses in AI-generated images and videos, emphasizing that such information constitutes personal data under the Data Privacy Act of 2012 and may, in certain circumstances, constitute biometric information.
According to the NPC, using a real person’s likeness to create, post, or share synthetic media constitutes personal-data processing and therefore requires a legitimate purpose and an applicable lawful basis. Creating synthetic media without a lawful basis may amount to unauthorized processing and could result in criminal, civil, or administrative liability.
The NPC also considers fabricated AI media depicting identifiable individuals to constitute false personal data. Affected individuals may seek the blocking, removal, or destruction and file a complaint with the NPC. The Commission emphasized that these protections also apply to public officials and will give particular priority to complaints involving minors.
August 10, 2026
Australia
Australia’s AI Safety Institute has published a new technical framework examining risks and governance challenges arising when AI agents interact across organizational boundaries.
Commissioned by the Gradient Institute, the report considers scenarios in which organizations deploy AI agents that interact with agents operated by customers, suppliers, partners, or unknown third parties. It highlights that these interactions can create safety and governance risks that may fall outside the controls of any single organization.
The framework organizes multi-agent governance into three tiers: singular governance, where agents operate under a single governing entity; federated governance, involving interactions among agents governed by different entities within an established structure; and open environments, where agents may interact without shared governance arrangements.
The report is intended to help organizations, policymakers, and researchers identify where risks arise, determine which parties are positioned to implement controls, and strengthen governance as agentic AI systems increasingly interact across organizational boundaries.
August 2, 2026
New Zealand
New Zealand authorities have published guidance emphasizing organizations’ responsibility for protecting personal information when data storage, processing, or management is outsourced to third-party suppliers.
The guidance reiterates that the Privacy Act 2020 requires organizations to implement reasonable security safeguards and warns that outsourcing data-related functions does not remove responsibility for ensuring appropriate security. Organizations should assess suppliers’ data protection and cybersecurity practices during procurement and maintain oversight throughout the contractual relationship. Recommended measures include establishing contractual cybersecurity requirements, ensuring timely incident reporting, assessing jurisdictional risks, managing privileged access, encrypting data, implementing multifactor authentication and data loss prevention controls, and obtaining independent security assurance.
The guidance follows a major 2025 healthcare data breach affecting more than 99,000 New Zealanders and emphasizes that appropriate security safeguards could significantly reduce risks arising from third-party access to sensitive personal information.
August 1, 2026
Australia
The Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC), in partnership with the Australian Institute of Company Directors (AICD), has issued new guidance, Frontier AI Cyber Threat Considerations for Boards of Directors, addressing the growing cybersecurity risks associated with frontier AI.
The guidance warns that frontier AI models are increasing the speed, scale, and ease with which vulnerabilities can be identified and exploited, lowering technical barriers for malicious actors and enabling multiple vulnerabilities to be chained into high-impact compromises.
Boards are encouraged to reassess their organizations’ cyber risk tolerance in light of AI-enabled threats and strengthen oversight of cyber resilience. Recommended measures include securing attack surfaces, addressing software and legacy-system vulnerabilities, reinforcing identity and access controls, restricting unnecessary privileges, including those granted to AI agents and regularly testing incident response, business continuity, and disaster recovery plans.
At Securiti, our mission is to enable organizations to safely harness the incredible power of Data & AI.
Copyright © 2026 Securiti · Sitemap · XML Sitemap
info@securiti.ai
Securiti, LLC.
3155 Olsen Drive
Suite 325
San Jose, CA 95117
Type
