 | | | |
Subscribe free to get each new issue by email. Unsubscribe at any time.
Thank you for subscribing Welcome to the Aztec AI Group newsletter. You will receive each new issue by email. | | Your one-stop briefing on AI and quantum risk. Written for board members, executives and senior leaders. Each issue covers the good, the bad and the ugly of AI, the latest news on quantum risk and regulation, and what it means for decision makers. You will also find books, white papers and the DIRECT framework, a method used in boardrooms to make critical decisions traceable, defensible and deliverable. These are created by Bridget Convey, founder of Aztec AI Group and Aztec AI Compliance, which provide ready-made AI governance products and services. She has 30 years experience implementing complex regulatory transformation across financial services, insurance and asset management, and now consults as an AI subject matter expert with Charterhouse Consultants. | 1. The Good, the Bad and the Ugly The Good: Europe publishes a voluntary code for the makers of the biggest AI models
On 10 July 2025 the European Commission published the General-Purpose AI Code of Practice, a voluntary tool that providers of general-purpose AI models can use to show they meet their AI Act duties. [1]
Board lesson: Ask your suppliers: have your AI providers signed the code, and what does it say they must show you? The Bad: A representative did not know AI could invent cases
On 11 August 2025 the Upper Tribunal (Immigration and Asylum Chamber) found that a representative had used a public AI chatbot to draft grounds of appeal that cited a case that does not exist. The tribunal found he did not know the chatbot could fabricate authorities, and referred him to the Bar Standards Board. [2]
Board lesson: Do not assume your people understand the limits of the tools they use. Training on what AI gets wrong is a control, not a courtesy. The Ugly: Attackers used an AI coding tool to run most of an intrusion campaign
On 13 November 2025 Anthropic reported that attackers had used its Claude Code tool to carry out intrusions with little human involvement. By its own account, the AI did roughly 80 to 90% of the work against about 30 targets, and a small number succeeded. Anthropic says it assesses with high confidence that a Chinese state-sponsored group was responsible. It also reports that it detected the activity in mid September, banned the accounts, notified affected organisations and coordinated with authorities. This is Anthropic's own account and has not been independently verified. [3]
Board lesson: AI lets attackers work at a speed and scale that people cannot match by hand. Is your defence and your reporting set up for that? | 2. AI Risk - Supplier assurance: the voluntary code gives you a question to ask AI providers about the models you depend on. Action: add it to supplier reviews. [1]
- Competence gap: unchecked AI output is reaching tribunals because users did not know its limits. Action: brief staff on what AI gets wrong, and record that you did. [2]
- Automated attacks: AI is already being used to run attacks end to end. Action: ask how quickly your security team can detect and contain activity at machine speed. [3]
| 3. Quantum Risk - On 18 September 2025 NIST published final SP 800-227, Recommendations for Key-Encapsulation Mechanisms, guidance on a building block of post-quantum encryption. [4]
- On 14 October 2025 the NCSC Annual Review restated the UK target dates: a migration plan by 2028, priority services by 2031 and completion by 2035. It also reported that a pilot consultancy scheme had onboarded its first eight companies. [5]
- Board question: has anyone been asked to own our cryptography inventory?
| 4. Compliance Officer for Legal Practice (COLP) - No new SRA item has been verified for this period. The tribunal finding above is a reminder that supervisors need to know how staff are using AI. [2]
| 5. Regulations and Frameworks - EU AI Act: on 18 July 2025 the Commission published guidelines for providers of general-purpose AI models. The page states the obligations for these providers apply from 2 August 2025, and defines such models as trained with more than 10^23 FLOP. [6]
- FCA: on 9 September 2025 the FCA published Feedback Statement FS25/5, confirming that its AI Live Testing service would launch. It received 67 responses, and applications for the first cohort closed on 15 September 2025. [7]
| 6. Latest News - On 18 December 2025 the UK AI Security Institute published its first Frontier AI Trends Report, an analysis of its evaluations of frontier AI systems since November 2023. [8]
| 7. Further Reading - European Commission (2025) General-Purpose AI Code of Practice, 10 July. https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai (accessed 29 October 2026).
- MS (Bangladesh) [2025] UKUT 00305 (IAC), 11 August. https://tribunalsdecisions.service.gov.uk/utiac/2025-ukut-00305 (accessed 29 October 2026).
- Anthropic (2025) Disrupting the first reported AI-orchestrated cyber espionage campaign, 13 November. https://www.anthropic.com/news/disrupting-AI-espionage (accessed 29 October 2026). Vendor self-report.
- National Institute of Standards and Technology (2025) NIST publishes SP 800-227, 18 September. https://csrc.nist.gov/news/2025/nist-publishes-sp-800-227 (accessed 29 October 2026).
- National Cyber Security Centre (2025) NCSC Annual Review 2025: migrating to post-quantum cryptography, 14 October. https://www.ncsc.gov.uk/collection/ncsc-annual-review-2025/chapter-03-keeping-pace-with-evolving-technology/migrating-to-post-quantum-cryptography (accessed 29 October 2026).
- European Commission (2025) Commission publishes guidelines for providers of general-purpose AI models, 18 July. https://digital-strategy.ec.europa.eu/en/news/commission-publishes-guidelines-providers-general-purpose-ai-models (accessed 29 October 2026).
- Financial Conduct Authority (2025) FS25/5 AI Live Testing, 9 September. https://www.fca.org.uk/publications/feedback-statements/fs25-5-ai-live-testing (accessed 29 October 2026).
- AI Security Institute (2025) Frontier AI Trends Report, 18 December. https://www.aisi.gov.uk/research/aisi-frontier-ai-trends-report-2025 (accessed 29 October 2026). Key findings not read.
| 8. AI Compliance AI rules are arriving fast, and boards are expected to show they have checked. Our ready-made document packs help you get your AI policies, risk records and evidence in place quickly, in plain English. They support your own legal and compliance advice; they do not replace it. | 9. DIRECT Framework: Better Decisions, Better Outcomes Boards rarely fail for lack of information. They fail because decisions are not traceable, defensible or deliverable. DIRECT is the six step method from my book The Board Decision Framework: Define the decision, Identify outcomes, Review options, Evaluate risk, Confirm accountability, Trigger points. Get the bookRead Chapter 1 free | 10. My books Together, these three books form a single series for boards and executives. AI and quantum computing are advancing at an exponential pace, far faster than the risks most governance frameworks were built for, and their impact reaches every part of the business at once. The Board Decision Framework closes that gap. Its DIRECT method makes critical decisions traceable, defensible and deliverable, with decision evidence that stands up to executive scrutiny, audit review and regulatory challenge.  The Board Decision Framework The DIRECT method: six steps that make critical decisions traceable, defensible and deliverable. Use it to govern AI, quantum and any major decision. |  AI: A Wolf in Sheep's Clothing The good, the bad and the ugly of AI, in plain English. What boards need to know about AI risk, the questions to ask, and how to stay in control. |  Quantum Risk: The Elephant in the Boardroom Why quantum computing is a board risk today, not tomorrow. How to use the DIRECT framework to mitigate it, what to ask, and when to act. |
Visit my Amazon author page | My videos Short videos on AI governance, risk and the EU AI Act. Click a video to watch it on YouTube.  AI: Agree your strategy to maximise AI investment |  AI: Are you sleep walking into risk? |  AI: We have an AI Governance Problem |  Get AI wrong? It could cost 7% of revenue |  AI is here: Thrive or Die? |  AI vs Data: The Chicken and the Egg |  The EU AI Act: Are you in scope? |  The EU AI Act: Are you ready? |
| Useful links |  | About Bridget I'm Bridget Convey, founder of Aztec AI Group, which provides ready-made AI governance tools that turn AI risk into business confidence. For 30 years I have led complex regulatory transformation programmes across banking, insurance and asset management. Today I advise executives and boards on AI and quantum risk, and on making critical decisions traceable, defensible and deliverable. I am ISO/IEC 42001 certified and an alumna of the Oxford Saïd AI Strategy and Leadership Programme. |
|
|
Bridget Convey
Founder, Aztec AI Group
|
|
Aztec AI Group is a trading name of TendoVend Ltd, registered in England and Wales, company number 15906234. Registered office: 79 Mantle Street, Wellington, TA21 8BB. VAT registration 521 4365 19. Some content on this site is produced with the help of AI and checked by Bridget Convey before publication.
info@aztecaigroup.com · aztecaigroup.com · © 2026 TendoVend Limited · FAQs · Contact · Privacy notice
|
|