BURT CONSULTANTS
← All sectors Security & Governance

AI Security, Governance & Regulation

Risk, compliance, regulation, and safe AI deployment.

39 briefings

Security & Governance

Microsoft Build 2026: a CIO's guide to the new agent stack.

Microsoft Build 2026 unveiled a full agent stack: Agent Platform, Work IQ, Agent 365 governance and Scout always-on agents. CIOs now have to decide how these pieces fit into an enterprise architecture.

aigovernancemicrosoftenterprise
3 min read
Security & Governance

A practical AI security checklist for SMEs adopting ChatGPT-style tools.

Data leakage, prompt injection, shadow AI and AI-powered phishing are growing risks for SMEs. A short, practical checklist helps keep adoption safe.

aisecuritysmegovernance
3 min read
Security & Governance

AI-powered security audits: faster discovery, same human accountability.

Anthropic used Claude to inspect Firefox source code and identify 22 vulnerabilities over two weeks, showing how AI can accelerate security review without removing the need for expert judgment.

aisecurityvulnerability researchgovernance
2 min read
Security & Governance

Agentic AI is reshaping spans of control: a manager playbook.

Gartner warns that managers will be held accountable for autonomous agents' behaviour. With 75% of CHROs saying managers are more overwhelmed than ever, the organisational load is about to increase.

aigovernanceleadershiphr
3 min read
AI Governance

AI Hallucinations Are Becoming a State Regulatory Problem

Pennsylvania has sued Character.AI over a chatbot that posed as a licensed psychiatrist. State AG action signals AI hallucinations are becoming an enforceable consumer-protection issue mid-market firms must plan for.

AIGovernanceRegulatoryRisk
4 min read
AI Implementation

Reading OpenAI's '52% Fewer Hallucinations' Claim

OpenAI says GPT-5.5 Instant has 52.5% fewer hallucinated claims on high-stakes prompts. The number is credible. The reason it doesn't tell you whether to deploy is more interesting.

AIEvaluationVendorRisk
3 min read
Security & Governance

Microsoft's Legal Agent in Word: what it means for UK legal teams.

Microsoft is adding an AI Legal Agent inside Word that reviews contracts clause-by-clause. For UK legal teams, the question is where it fits between efficiency and professional responsibility.

ailegalmicrosoftgovernance
3 min read
Security & Governance

UK AI safety testing is becoming voluntary — but still expected

The UK government plans to set AI deployment standards through AI Security Institutes rather than binding rules. For businesses, voluntary does not mean optional.

ai governanceukai safetystandards
2 min read
Security & Governance

Autonomous agents in operations: opportunity or workforce risk?

Autonomous AI agents are moving into procurement, supply-chain, HR onboarding and compliance reporting. The opportunity is real, but so are the workforce and governance risks.

aigovernanceoperationsworkforce
2 min read
Security & Governance

Selling AI to the US? The 2026-27 state compliance deadlines to know.

The Colorado AI Act takes effect in June 2026 and is part of a growing patchwork of US state AI laws. UK vendors need to understand the obligations before they sell across the Atlantic.

airegulationuscompliance
2 min read
Security & Governance

Global AI compliance: a jurisdiction-by-jurisdiction checklist for 2026

From UKRI strategy and Ofcom chatbot guidance to Singapore's framework, South Korea's AI Basic Act and US state laws, AI governance is fragmenting fast. Here is a practical checklist by jurisdiction.

ai governanceglobal regulationcompliancerisk
3 min read
Security & Governance

OWASP's GenAI exploit roundup: a secure AI agent architecture checklist.

OWASP catalogued eight major AI and agentic security incidents in Q1 2026, including a Claude-assisted breach of Mexican government systems and a Flowise RCE.

aisecurityowaspagents
2 min read
Security & Governance

NIST's critical-infrastructure AI risk profile: what operators should review

NIST has published a concept note for an AI RMF Profile on Trustworthy AI in Critical Infrastructure. Operators in energy, transport, water, telecoms and healthcare should review the proposed scope now.

ai governancenistcritical infrastructurerisk management
2 min read
Security & Governance

The 11 AI security risks every board should discuss in Q3 2026.

Cycode has identified 11 critical AI security risks, while most organisations still lack visibility into how AI is being used. Boards need to move AI security from IT to enterprise risk.

aisecuritygovernancerisk
2 min read
Security & Governance

How to operationalise AI-native security auditing without losing trust.

Trail of Bits has standardised on Claude Code, written an AI usage policy and created an AI Maturity Matrix, while AI-augmented auditors report finding around 200 bugs a week.

aisecurityauditinggovernance
2 min read
Security & Governance

A 'debt ceiling' governance model for SaaS security debt.

Veracode reports that 49% of applications carry security debt and flaws in third-party code take 358 days on average to halve in number.

security debtapplication securitygovernancesaas
2 min read
Security & Governance

EU AI Act transparency code: what providers and deployers must finalise

The European Commission's second draft Article 50 Code of Practice sets the practical rules for marking and labelling AI-generated content. Providers and deployers should treat it as the likely final benchmark.

ai governanceeu ai acttransparencycompliance
3 min read
Security & Governance

The White House national AI framework: six objectives to track

The Trump Administration's national AI legislative framework sets out six objectives for federal AI policy, from deregulation and infrastructure to export controls and public-sector adoption.

airegulationuspolicy
2 min read
Security & Governance

Designing a hybrid AI-plus-human code review policy.

Sonar positions deterministic static analysis as the trust layer between AI-generated code and production, complementing rather than replacing human review.

ai code reviewstatic analysiscode qualitydevsecops
2 min read
Security & Governance

Prompt injection and the agentic browser threat

Trail of Bits used threat modelling and prompt injection to audit Perplexity's Comet browser, demonstrating how an agentic browser could be manipulated into exfiltrating Gmail data.

aisecurityprompt injectiongovernance
3 min read
Security & Governance

Security debt as a board-level risk: a remediation playbook.

Veracode's 2026 State of Software Security report finds security debt affects 82% of organisations, with critical debt affecting 60% and high-risk vulnerabilities rising 36%.

securitytechnical debtgovernanceapplication security
2 min read
Security & Governance

US Treasury's 230-control AI risk framework for financial services

The US Treasury's Financial Services AI Risk Management Framework adapts the NIST AI RMF into 230 controls for banks, insurers and financial institutions.

ai governancefinancial servicesnistrisk management
2 min read
Security & Governance

OWASP's Agentic Skills Top 10: secure-by-design principles.

The OWASP Top 10 for agentic skills highlights prompt injection, tool misuse, supply chain compromise and human-agent trust exploitation as key risks.

owaspagentic aisecuritysecure by design
2 min read
Security & Governance

Don't fire your team for AI's potential — build a human-AI operating model first

A Harvard Business Review survey of 1,006 global executives finds AI is already cited as a cause of layoffs. In most cases the cuts are anticipatory, not driven by proven productivity gains.

aigovernanceleadershipworkforce
3 min read
Security & Governance

EU AI Act: what UK service providers selling into Europe must do before August.

The EU AI Act's August 2026 deadline for high-risk AI systems is approaching. UK providers selling into Europe need to act now on conformity, documentation and local representation.

airegulationeugovernance
2 min read
Security & Governance

What enterprise buyers actually want from AI vendors in 2026

ETR.ai's 2026 buyer data shows enterprise technology investment is concentrating on agentic AI, automation, data governance, real-time analytics and AI-powered development.

aisaasprocurementgovernance
2 min read
Security & Governance

Ten platform engineering predictions and a pragmatic UK roadmap.

The Platform Engineering community's 2026 outlook points to agentic infrastructure, AI code safety nets, self-architecting systems, FinOps gates and governance-by-default.

platform engineeringdevopsai infrastructurefinops
2 min read
Security & Governance

Agentic browsers are a new, unsolved attack surface

Wiz's year-end review of agentic browser security catalogues several practical attack techniques, from indirect prompt injection to CometJacking and Tainted Memories.

aisecuritybrowsergovernance
3 min read
Security & Governance

A governance-first roadmap for customer-engagement agents.

Gartner predicts 60% of brands will use agentic AI for one-to-one customer interactions by 2028. Before building the agent, firms need a governance layer that keeps customer trust intact.

aigovernancecustomer experiencemarketing
3 min read
Security & Governance

When EU AI Act compliance collides with GDPR reform

The EU AI Act is now fully operational, while UK ICO guidance on automated decision-making and wider GDPR reform are moving at the same time. Multinational firms need a joined-up compliance plan.

ai governanceeu ai actgdprautomated decision-making
3 min read
Security & Governance

Why the UK's light-touch AI regime is an opportunity — and a risk.

The UK is unlikely to pass a dedicated AI Bill in 2026, focusing instead on AI Growth Zones and sandboxes. That creates space for innovation, but also uncertainty for firms and their customers.

airegulationukpolicy
2 min read
Security & Governance

The trust gap in AI-generated code: why quality gates matter.

Sonar reports AI now accounts for 42% of committed code and could reach 65% by 2027, yet 96% of developers do not fully trust AI-generated code.

aicode qualityengineeringgovernance
2 min read
Security & Governance

UK AI regulation: what the delay means for your compliance timeline

The anticipated UK AI Bill is now unlikely before May 2026, with the government focusing on regulatory sandboxes and AI Growth Zones instead.

airegulationukpolicy
2 min read
Security & Governance

When AI chatbots fall under the UK Online Safety Act

Ofcom has clarified that AI chatbots on user-to-user or search services can be in scope of the Online Safety Act. Platform operators need to assess chatbot-generated content in their safety plans.

airegulationukgovernance
2 min read
Security & Governance

AI-generated code must pass the same bars as human code.

Trail of Bits argues that code produced by large language models should be reviewed with the same scepticism applied to a first-time contributor's pull request.

ai codingcode reviewsecuritysoftware engineering
2 min read
Security & Governance

US federal preemption of state AI laws: what it means for operators

Executive Order 14365 directs the US Attorney General to challenge state AI laws that conflict with the national AI policy framework, sharpening the preemption debate for UK and international operators.

airegulationusgovernance
2 min read
Security & Governance

A role-based strategy for adopting AI-assisted coding.

Real-world productivity gains from AI-assisted coding are typically 20–30% and are concentrated in mid-market teams, but security practices often lag behind.

ai codingdeveloper productivitymid-marketsecurity
2 min read
Security & Governance

Why MCP's move to neutral governance matters for UK firms

Anthropic has donated its Model Context Protocol to the Linux Foundation's new Agentic AI Foundation. For UK businesses adopting agentic AI, neutral governance reduces platform risk.

aigovernanceinfrastructurestandards
2 min read
Security & Governance

Global AI regulation watchlist: a jurisdiction-by-jurisdiction checklist

From the EU AI Act to proposed US federal preemption and the UK's delayed Bill, global AI regulation is fragmenting. A jurisdiction-by-jurisdiction checklist helps firms keep track.

airegulationglobalgovernance
2 min read

Browse all sectors →