 | | | |
Subscribe free to get each new issue by email. Unsubscribe at any time.
Thank you for subscribing Welcome to the Aztec AI Group newsletter. You will receive each new issue by email. | | Your one-stop briefing on AI and quantum risk. Written for board members, executives and senior leaders. Each issue covers the good, the bad and the ugly of AI, the latest news on quantum risk and regulation, and what it means for decision makers. You will also find books, white papers and the DIRECT framework, a method used in boardrooms to make critical decisions traceable, defensible and deliverable. These are created by Bridget Convey, founder of Aztec AI Group and Aztec AI Compliance, which provide ready-made AI governance products and services. She has 30 years experience implementing complex regulatory transformation across financial services, insurance and asset management, and now consults as an AI subject matter expert with Charterhouse Consultants. | 1. The Good, the Bad and the Ugly The Good: The EU AI Act becomes law
On 1 August 2024 the EU AI Act entered into force. It scales obligations by the level of risk and bans practices such as social scoring. [1]
Board lesson: The clock started on 1 August 2024. Ask your executive: have we listed our AI uses by risk level, and who owns that list? The Bad: US regulator acts against deceptive AI claims
On 25 September 2024 the US Federal Trade Commission announced five actions against deceptive AI claims and schemes. One concerned a service marketed as a "robot lawyer", with a proposed order to pay $193,000 and to tell subscribers about the limits of the service. These are FTC allegations and proposed orders, not court findings. [2]
Board lesson: If you say AI does something, can you prove it? Claims about AI capability are now a regulatory risk in their own right. The Ugly: Sexually explicit deepfakes prompt a new criminal law
On 26 September 2024 South Korea's National Assembly passed a bill making it a crime to possess or watch sexually explicit deepfakes, punishable by up to three years in prison or a fine. CBS News cited police data of 387 deepfake sex crime arrests in 2024 to that point, about 80% of them teenagers. The bill still needed the president's signature. [3]
Board lesson: AI misuse harms people, and the law is moving. Do your policies cover staff and customers misusing AI to create harmful images? | 2. AI Risk - Regulatory timeline: the AI Act is now law, so planning can no longer wait. Action: confirm an owner and a timetable for AI Act readiness. [1]
- Overclaiming: the FTC actions target AI capability claims. Action: have marketing claims about AI reviewed against evidence before publication. [2]
- Misuse: governments are criminalising harmful uses of generative AI. Action: check your acceptable use policy covers image and voice generation. [3]
| 3. Quantum Risk - On 13 August 2024 NIST released the first three finalised post-quantum encryption standards: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA). [4]
- On 12 November 2024 NIST opened draft IR 8547, Transition to Post-Quantum Cryptography Standards, for comment until 10 January 2025. [5]
- Board question: has anyone been asked to list where we use encryption that these standards will replace?
| 4. Compliance Officer for Legal Practice (COLP) - No SRA publication has been verified for July to December 2024. The FTC action above is a reminder that regulators expect AI claims to be evidenced, including claims made about legal services.
| 5. Regulations and Frameworks - Council of Europe: its Framework Convention on AI opened for signature in Vilnius on 5 September 2024, with signatories including the UK, the US and the EU. [6]
- Bank of England and FCA: the third survey on AI in UK financial services, published on 21 November 2024, found 75% of firms use AI and a further 10% plan to within three years. 46% reported only a partial understanding of the AI they use, and 84% had an accountable person for their AI framework. [7]
- NIST: on 26 July 2024 NIST released the Generative AI Profile (NIST AI 600-1) of its AI Risk Management Framework. [8]
| 6. Latest News - The comment period for NIST draft IR 8547 ran to 10 January 2025, so firms had a window to shape the transition guidance. [5]
| 7. Further Reading - European Commission (2024) AI Act enters into force, 1 August. https://commission.europa.eu/news/ai-act-enters-force-2024-08-01_en (accessed 29 October 2026).
- Federal Trade Commission (2024) FTC announces crackdown on deceptive AI claims and schemes, 25 September. https://www.ftc.gov/news-events/news/press-releases/2024/09/ftc-announces-crackdown-deceptive-ai-claims-schemes (accessed 29 October 2026).
- CBS News (2024) South Korea set to criminalize possessing or watching sexually explicit deepfakes, 27 September. https://www.cbsnews.com/amp/news/south-korea-deepfake-porn-law-ban-sexually-explicit-video-images (accessed 29 October 2026). Secondary source.
- National Institute of Standards and Technology (2024) NIST releases first 3 finalized post-quantum encryption standards, 13 August. https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards (accessed 29 October 2026).
- NIST Computer Security Resource Center (2024) Draft NIST IR 8547 is available for comment, 12 November. https://csrc.nist.gov/News/2024/draft-nist-ir-8547-is-available-for-comment (accessed 29 October 2026).
- Council of Europe (2024) Council of Europe opens first-ever global treaty on AI for signature, 5 September. https://www.coe.int/en/web/portal/-/council-of-europe-opens-first-ever-global-treaty-on-ai-for-signature (accessed 29 October 2026).
- Bank of England (2024) Artificial intelligence in UK financial services 2024, 21 November. https://www.bankofengland.co.uk/report/2024/artificial-intelligence-in-uk-financial-services-2024 (accessed 29 October 2026).
- National Institute of Standards and Technology (2024) AI Risk Management Framework, Generative AI Profile released 26 July. https://www.nist.gov/itl/ai-risk-management-framework (accessed 29 October 2026).
| 8. AI Compliance AI rules are arriving fast, and boards are expected to show they have checked. Our ready-made document packs help you get your AI policies, risk records and evidence in place quickly, in plain English. They support your own legal and compliance advice; they do not replace it. | 9. DIRECT Framework: Better Decisions, Better Outcomes Boards rarely fail for lack of information. They fail because decisions are not traceable, defensible or deliverable. DIRECT is the six step method from my book The Board Decision Framework: Define the decision, Identify outcomes, Review options, Evaluate risk, Confirm accountability, Trigger points. Get the bookRead Chapter 1 free | 10. My books Together, these three books form a single series for boards and executives. AI and quantum computing are advancing at an exponential pace, far faster than the risks most governance frameworks were built for, and their impact reaches every part of the business at once. The Board Decision Framework closes that gap. Its DIRECT method makes critical decisions traceable, defensible and deliverable, with decision evidence that stands up to executive scrutiny, audit review and regulatory challenge.  The Board Decision Framework The DIRECT method: six steps that make critical decisions traceable, defensible and deliverable. Use it to govern AI, quantum and any major decision. |  AI: A Wolf in Sheep's Clothing The good, the bad and the ugly of AI, in plain English. What boards need to know about AI risk, the questions to ask, and how to stay in control. |  Quantum Risk: The Elephant in the Boardroom Why quantum computing is a board risk today, not tomorrow. How to use the DIRECT framework to mitigate it, what to ask, and when to act. |
Visit my Amazon author page | My videos Short videos on AI governance, risk and the EU AI Act. Click a video to watch it on YouTube.  AI: Agree your strategy to maximise AI investment |  AI: Are you sleep walking into risk? |  AI: We have an AI Governance Problem |  Get AI wrong? It could cost 7% of revenue |  AI is here: Thrive or Die? |  AI vs Data: The Chicken and the Egg |  The EU AI Act: Are you in scope? |  The EU AI Act: Are you ready? |
| Useful links |  | About Bridget I'm Bridget Convey, founder of Aztec AI Group, which provides ready-made AI governance tools that turn AI risk into business confidence. For 30 years I have led complex regulatory transformation programmes across banking, insurance and asset management. Today I advise executives and boards on AI and quantum risk, and on making critical decisions traceable, defensible and deliverable. I am ISO/IEC 42001 certified and an alumna of the Oxford Saïd AI Strategy and Leadership Programme. |
|
|
Bridget Convey
Founder, Aztec AI Group
|
|
Aztec AI Group is a trading name of TendoVend Ltd, registered in England and Wales, company number 15906234. Registered office: 79 Mantle Street, Wellington, TA21 8BB. VAT registration 521 4365 19. Some content on this site is produced with the help of AI and checked by Bridget Convey before publication.
info@aztecaigroup.com · aztecaigroup.com · © 2026 TendoVend Limited · FAQs · Contact · Privacy notice
|
|