Looking Back 2025 First Half

Subscribe free to get each new issue by email. Unsubscribe at any time.

Your one-stop briefing on AI and quantum risk. Written for board members, executives and senior leaders. Each issue covers the good, the bad and the ugly of AI, the latest news on quantum risk and regulation, and what it means for decision makers. You will also find books, white papers and the DIRECT framework, a method used in boardrooms to make critical decisions traceable, defensible and deliverable. These are created by Bridget Convey, founder of Aztec AI Group and Aztec AI Compliance, which provide ready-made AI governance products and services. She has 30 years experience implementing complex regulatory transformation across financial services, insurance and asset management, and now consults as an AI subject matter expert with Charterhouse Consultants.

1. The Good, the Bad and the Ugly

The Good: A regulator approves an AI-only legal firm, with humans accountable
On 6 May 2025 the Solicitors Regulation Authority authorised Garfield.Law Ltd, which it described as the first purely AI-based firm approved to provide regulated legal services in England and Wales. The SRA says named regulated solicitors remain accountable for the outputs, the tool does not suggest case law, and each step needs client approval. ^[1]
Board lesson: Using AI is a governance design choice. Ask your executive: where is a named person accountable, and where does the client or a person approve?

The Bad: Invented cases reach the High Court
On 6 June 2025 the Divisional Court gave judgment in two linked cases where lawyers had cited authorities that did not exist: five in one case, and 18 of 45 in the other. The court referred the lawyers involved to their regulators and said guidance alone is not enough. ^[2]
Board lesson: AI output is a draft, never evidence. Someone named must check every citation before it leaves the building.

The Ugly: A workplace AI assistant that could be tricked into leaking data
Researchers disclosed a flaw, tracked as CVE-2025-32711 with a severity score of 9.3, in an AI assistant built into a widely used office software suite. A specially crafted email could make the assistant leak internal data without the user clicking anything. The supplier fixed it on its own servers in May 2025, no customer action was needed, and no exploitation in the wild was reported. ^[3]
Board lesson: If staff use AI assistants connected to email and files, who has tested whether a hostile message can steer them?

2. AI Risk

Accountability gaps: the Garfield.Law approval shows regulators expect a named person accountable for AI output. Action: name the owner for each AI use in your firm. ^[1]
Verification failures: courts are now referring lawyers to regulators over unchecked AI work. Action: require a documented check for any AI-assisted filing. ^[2]
Hidden attack routes: an AI tool with access to email can be a way in. Action: ask suppliers how they test for prompt injection. ^[3]

3. Quantum Risk

On 20 March 2025 the UK National Cyber Security Centre published its migration timelines: by 2028 define goals, complete discovery and build an initial plan; by 2031 complete the highest priority migration; by 2035 complete migration. ^[4]
On 11 March 2025 NIST selected HQC as a backup to ML-KEM. It is code-based rather than lattice-based, and NIST still recommends migrating to its 2024 standards. ^[5]
On 21 May 2025 a Google researcher posted a preprint estimating that fewer than one million noisy qubits could factor a 2048-bit RSA integer in under a week, against about 20 million in a 2019 estimate. It is a preprint and an estimate, not a working machine. ^[6]

4. Compliance Officer for Legal Practice (COLP)

Must know: the SRA states that named regulated solicitors remain accountable for the outputs of an AI-based service, whatever the technology. ^[1]
Should know: the Divisional Court judgment of 6 June 2025 refers lawyers to their regulators for unchecked AI citations. Review how your firm checks AI-assisted work. ^[2]

5. Regulations and Frameworks

EU AI Act: on 4 February 2025 the Commission published guidelines on prohibited AI practices, covering harmful manipulation, social scoring and real-time remote biometric identification. They are not binding. ^[7]
EU AI Act: Article 4, the AI literacy duty for providers and deployers, applied from 2 February 2025. ^[8]
NIST published AI 100-2 E2025 on 24 March 2025, a taxonomy of attacks on machine learning systems and how to mitigate them. ^[9]

6. Latest News

On 29 April 2025 the FCA proposed a live AI testing service within its AI Lab, running 12 to 18 months, with a planned launch in September 2025. ^[10]

7. Further Reading

Solicitors Regulation Authority (2025) SRA approves first AI-driven law firm, 6 May. https://www.sra.org.uk/sra/news/press/garfield-ai-authorised/ (accessed 29 October 2026).
High Court, Divisional Court (2025) Judgment on fabricated citations in two cases, [2025] EWHC 1383 (Admin), 6 June. https://caselaw.nationalarchives.gov.uk/ewhc/admin/2025/1383 (accessed 29 October 2026).
Aim Security researchers (2025) EchoLeak: the first real-world zero-click prompt injection exploit in a production LLM system, arXiv:2509.10540. https://arxiv.org/html/2509.10540v1 (accessed 29 October 2026). Disclosure dated 11 June 2025. Supplier advisory not read.
National Cyber Security Centre (2025) PQC migration timelines, 20 March. https://www.ncsc.gov.uk/guidance/pqc-migration-timelines (accessed 29 October 2026).
National Institute of Standards and Technology (2025) NIST selects HQC as fifth algorithm for post-quantum encryption, 11 March. https://www.nist.gov/news-events/news/2025/03/nist-selects-hqc-fifth-algorithm-post-quantum-encryption (accessed 29 October 2026).
Gidney, C. (2025) How to factor 2048 bit RSA integers with less than a million noisy qubits, arXiv:2505.15917, 21 May. https://arxiv.org/abs/2505.15917v1 (accessed 29 October 2026). Preprint.
European Commission (2025) Commission publishes guidelines on prohibited AI practices defined by the AI Act, 4 February. https://digital-strategy.ec.europa.eu/en/library/commission-publishes-guidelines-prohibited-artificial-intelligence-ai-practices-defined-ai-act (accessed 29 October 2026).
European Commission (2025) AI literacy questions and answers. https://digital-strategy.ec.europa.eu/en/faqs/ai-literacy-questions-answers (accessed 29 October 2026).
National Institute of Standards and Technology (2025) AI 100-2 E2025 Adversarial machine learning, 24 March. https://csrc.nist.gov/pubs/ai/100/2/e2025/final (accessed 29 October 2026).
Financial Conduct Authority (2025) FCA set to launch live AI testing service, 29 April. https://www.fca.org.uk/news/press-releases/fca-set-launch-live-ai-testing-service (accessed 29 October 2026).

8. AI Compliance

AI rules are arriving fast, and boards are expected to show they have checked. Our ready-made document packs help you get your AI policies, risk records and evidence in place quickly, in plain English. They support your own legal and compliance advice; they do not replace it.

9. DIRECT Framework: Better Decisions, Better Outcomes

Boards rarely fail for lack of information. They fail because decisions are not traceable, defensible or deliverable. DIRECT is the six step method from my book The Board Decision Framework: Define the decision, Identify outcomes, Review options, Evaluate risk, Confirm accountability, Trigger points.

Get the bookRead Chapter 1 free

10. My books

Together, these three books form a single series for boards and executives. AI and quantum computing are advancing at an exponential pace, far faster than the risks most governance frameworks were built for, and their impact reaches every part of the business at once. The Board Decision Framework closes that gap. Its DIRECT method makes critical decisions traceable, defensible and deliverable, with decision evidence that stands up to executive scrutiny, audit review and regulatory challenge.

The Board Decision Framework

The DIRECT method: six steps that make critical decisions traceable, defensible and deliverable. Use it to govern AI, quantum and any major decision.

AI: A Wolf in Sheep's Clothing

The good, the bad and the ugly of AI, in plain English. What boards need to know about AI risk, the questions to ask, and how to stay in control.

Quantum Risk: The Elephant in the Boardroom

Why quantum computing is a board risk today, not tomorrow. How to use the DIRECT framework to mitigate it, what to ask, and when to act.

Visit my Amazon author page

My videos

Short videos on AI governance, risk and the EU AI Act. Click a video to watch it on YouTube.

AI: Agree your strategy to maximise AI investment	AI: Are you sleep walking into risk?	AI: We have an AI Governance Problem	Get AI wrong? It could cost 7% of revenue
AI is here: Thrive or Die?	AI vs Data: The Chicken and the Egg	The EU AI Act: Are you in scope?	The EU AI Act: Are you ready?

See all videos with titles

Useful links

Aztec AI Group	Aztec AI Compliance	White papers
Videos	Follow me on LinkedIn	Forward to a colleague

About Bridget

I'm Bridget Convey, founder of Aztec AI Group, which provides ready-made AI governance tools that turn AI risk into business confidence. For 30 years I have led complex regulatory transformation programmes across banking, insurance and asset management. Today I advise executives and boards on AI and quantum risk, and on making critical decisions traceable, defensible and deliverable. I am ISO/IEC 42001 certified and an alumna of the Oxford Saïd AI Strategy and Leadership Programme.

Bridget Convey Founder, Aztec AI Group

Aztec AI Group is a trading name of TendoVend Ltd, registered in England and Wales, company number 15906234. Registered office: 79 Mantle Street, Wellington, TA21 8BB. VAT registration 521 4365 19. Some content on this site is produced with the help of AI and checked by Bridget Convey before publication.

Questions? Email info@aztecaigroup.com. Unsubscribe.