Aztec AI Group
 

Subscribe free to get each new issue by email. Unsubscribe at any time.

Your one-stop briefing on AI and quantum risk. Written for board members, executives and senior leaders. Each issue covers the good, the bad and the ugly of AI, the latest news on quantum risk and regulation, and what it means for decision makers. You will also find books, white papers and the DIRECT framework, a method used in boardrooms to make critical decisions traceable, defensible and deliverable. These are created by Bridget Convey, founder of Aztec AI Group and Aztec AI Compliance, which provide ready-made AI governance products and services. She has 30 years experience implementing complex regulatory transformation across financial services, insurance and asset management, and now consults as an AI subject matter expert with Charterhouse Consultants.

1. The Good, the Bad and the Ugly

The Good: More than 100 experts set out what we know about AI risk
On 3 February 2026 the International AI Safety Report 2026 was published, led by Yoshua Bengio with over 100 experts and backed by more than 30 countries and international organisations. It says AI capabilities are advancing quickly but unevenly, that harms are already appearing, and that risk management remains immature and mostly voluntary. [1]
Board lesson: Voluntary is not the same as governed. Ask your executive: which AI risk controls do we have because we chose to, and which could we show a regulator?
The Bad: A trial stopped over invented cases
Reported on 11 June 2026: a US federal judge in Mississippi cancelled a trial after lawyers on both sides filed documents that cited cases which did not exist. Neither side had checked the AI output. The judge sanctioned all four lawyers, including barring two from appearing before the court for two years. [2]
Board lesson: AI output is a draft, never evidence. Someone named must check it before it leaves the building.
The Ugly: An AI coding agent deleted a company's database and its backups in seconds
Reported on 30 April 2026: a software company's founder said an AI coding agent working inside a developer tool deleted the company's production database and the backups stored with it in about nine seconds, losing about three months of data. The hosting provider's chief executive said the backups were restored about 30 minutes after contact, and that the agent had used a fully permissioned access token. This is the founder's account as reported by the press and has not been independently verified. [3]
Board lesson: Who gave the AI agent its permissions, and could it reach both your data and your backups?

2. AI Risk

  • Voluntary controls: the International AI Safety Report says risk management is mostly voluntary. Action: list which of your AI controls are mandatory and which depend on goodwill. [1]
  • Excess permissions: see The Ugly. Action: give agents the least access they need, and keep backups out of their reach. [3]
  • Confidentiality: a tribunal warned that putting client documents into a public AI tool could breach confidentiality. Action: set and publish which tools staff may use for client material. [4]

3. Quantum Risk

  • On 30 March 2026 researchers at Google Quantum AI and others posted a preprint estimating that Shor's algorithm could break 256-bit elliptic curve cryptography, the kind used by many cryptocurrencies, with under 1,200 logical qubits and under 90 million Toffoli gates. It is a resource estimate in a preprint, not a working machine. [5]
  • No new NIST, NCSC, Europol or ENISA publication has been verified for this period. The NCSC dates of 2028, 2031 and 2035 remain the UK reference. [6]

4. Compliance Officer for Legal Practice (COLP)

  • Must know: on 12 June 2026 the SRA expanded its effective supervision guidance after the Court of Appeal judgment in Mazur and Others. The SRA says the requirement for effective supervision "is not new" and expects a risk-based approach. [7]
  • Should know: reported on 25 February 2026, the Upper Tribunal found one solicitor's supervision inadequate and referred him to the SRA. Judicial review claim forms now carry a statement of truth that cited authorities exist. [4][8]
  • Watching: a consultation on continuing competence changes closed on 15 July 2026, and the SRA is pursuing client money reforms that separate roles within firms. [9]

5. Regulations and Frameworks

  • EU AI Act: on 7 May 2026 the Council and Parliament reached a provisional agreement on the AI Omnibus, and on 16 June 2026 the Parliament adopted it as Regulation (EU) 2026/1744. As reported by Sidley, high-risk rules move to 2 December 2027 for stand-alone systems and 2 August 2028 for those embedded in products. [10][11]
  • EU AI Act: on 19 May 2026 the Commission published draft guidelines on classifying high-risk AI systems, with consultation closing on 23 June 2026, as reported by the IAPP. [12]
  • FCA: the AI Input Zone, reopened on 14 May 2026, closed to comments on 19 June 2026 and will inform a good and poor practice publication later in 2026. [13]
  • NIST: on 7 April 2026 NIST published a concept note for an AI RMF Profile on trustworthy AI in critical infrastructure. [14]

6. Latest News

  • On 27 January 2026 the FCA launched the Mills Review on the long-term impact of AI on retail financial services, looking at 2030 and beyond. The launch date is taken from a law firm briefing, not the FCA. [15]
  • On 25 June 2026 the House of Commons Treasury Committee wrote to the FCA and to the Bank of England about frontier AI models. The letters were published on 14 July 2026. [16]
  • SRA Update issue 151 (June 2026): the SRA is joining the government-funded Advisory AI Growth Lab. [9]

7. Further Reading

  1. International AI Safety Report (2026) International AI Safety Report 2026, 3 February. https://internationalaisafetyreport.org/publication/international-ai-safety-report-2026 (accessed 29 October 2026).
  2. Legal Cheek (2026) US judge stops case after lawyers on both sides cite AI-fabricated cases, 11 June. https://www.legalcheek.com/2026/06/us-judge-stops-case-after-lawyers-on-both-sides-cite-ai-fabricated-cases/ (accessed 29 October 2026). Secondary source: the court order has not been read.
  3. ABC News (2026) Rogue AI agent goes haywire, deletes company's entire database, 30 April, via 6abc. https://6abc.com/19008099/ (accessed 29 October 2026). Secondary source.
  4. UK v Secretary of State for the Home Department (AI hallucinations; supervision; Hamid) [2026] UKUT 81 (IAC), judgment of 17 November 2025. https://caselaw.nationalarchives.gov.uk/ukut/iac/2026/81 (accessed 29 October 2026).
  5. Babbush, R. et al. (2026) Securing elliptic curve cryptocurrencies against quantum vulnerabilities, arXiv:2603.28846, 30 March. https://arxiv.org/abs/2603.28846v1 (accessed 29 October 2026). Preprint.
  6. National Cyber Security Centre (2025) Timelines for migration to post-quantum cryptography, 20 March. https://www.ncsc.gov.uk/pdfs/guidance/pqc-migration-timelines.pdf (accessed 29 October 2026).
  7. Solicitors Regulation Authority (2026) Supervision guidance updated, 12 June. https://www.sra.org.uk/news/news/releases/supervision-guidance-updated/ (accessed 29 October 2026).
  8. Law Society of Ireland Gazette (2026) Solicitors under probe after false citations, 25 February. https://lawsociety.ie/gazette/top-stories/2026/feb/solicitors-under-probe-after-false-citations (accessed 29 October 2026). Secondary source.
  9. Solicitors Regulation Authority (2026) SRA Update, issue 151, June. https://www.sra.org.uk/news/sra-update/sra-update-issue-151-june-2026/ (accessed 29 October 2026).
  10. European Parliament (2026) Digital Omnibus on AI, legislative resolution, 16 June. https://data.europarl.europa.eu/distribution/doc/TA-10-2026-0198_en.pdf (accessed 29 October 2026).
  11. Sidley Austin (2026) EU lawmakers reach provisional agreement to delay key EU AI Act obligations, 22 June. https://datamatters.sidley.com/2026/06/22/eu-lawmakers-reach-provisional-agreement-to-delay-key-eu-ai-act-obligations/ (accessed 29 October 2026). Secondary source for the dates.
  12. IAPP (2026) European Commission delivers draft high-risk AI guidelines after delays, 19 May. https://iapp.org/news/a/european-commission-delivers-draft-high-risk-ai-guidelines-after-delays (accessed 29 October 2026). Secondary source.
  13. Regulation Tomorrow (2026) FCA AI Input Zone re-opens, 14 May. https://www.regulationtomorrow.com/2026/05/fca-ai-input-zone-re-opens/ (accessed 29 October 2026). Secondary source.
  14. National Institute of Standards and Technology (2026) Concept note: AI RMF Profile on trustworthy AI in critical infrastructure, 7 April. https://www.nist.gov/programs-projects/concept-note-ai-rmf-profile-trustworthy-ai-critical-infrastructure (accessed 29 October 2026).
  15. Freshfields (2026) The FCA launches Mills Review on AI in retail financial services, January. https://www.freshfields.com/en/our-thinking/blogs/risk-and-compliance/the-fca-launches-mills-review-on-ai-in-retail-financial-services-102miaa (accessed 29 October 2026). Secondary source.
  16. Treasury Committee (2026) Correspondence to FCA on frontier AI models, dated 25 June. https://api.parliament.uk/committees/publications/54209 (accessed 29 October 2026). Letter text not read.

8. AI Compliance

AI rules are arriving fast, and boards are expected to show they have checked. Our ready-made document packs help you get your AI policies, risk records and evidence in place quickly, in plain English. They support your own legal and compliance advice; they do not replace it.

Free AI Scope CheckAI Compliance packsAztec AI AssessmentAztec AI Readiness

9. DIRECT Framework: Better Decisions, Better Outcomes

Boards rarely fail for lack of information. They fail because decisions are not traceable, defensible or deliverable. DIRECT is the six step method from my book The Board Decision Framework: Define the decision, Identify outcomes, Review options, Evaluate risk, Confirm accountability, Trigger points.

Get the bookRead Chapter 1 free

10. My books

Together, these three books form a single series for boards and executives. AI and quantum computing are advancing at an exponential pace, far faster than the risks most governance frameworks were built for, and their impact reaches every part of the business at once. The Board Decision Framework closes that gap. Its DIRECT method makes critical decisions traceable, defensible and deliverable, with decision evidence that stands up to executive scrutiny, audit review and regulatory challenge.

The Board Decision Framework

The DIRECT method: six steps that make critical decisions traceable, defensible and deliverable. Use it to govern AI, quantum and any major decision.

AI: A Wolf in Sheep's Clothing

The good, the bad and the ugly of AI, in plain English. What boards need to know about AI risk, the questions to ask, and how to stay in control.

Quantum Risk: The Elephant in the Boardroom

Why quantum computing is a board risk today, not tomorrow. How to use the DIRECT framework to mitigate it, what to ask, and when to act.

Visit my Amazon author page

My videos

Short videos on AI governance, risk and the EU AI Act. Click a video to watch it on YouTube.

AI: Agree your strategy to maximise AI investment

AI: Agree your strategy to maximise AI investment

AI: Are you sleep walking into risk?

AI: Are you sleep walking into risk?

AI: We have an AI Governance Problem

AI: We have an AI Governance Problem

Get AI wrong? It could cost 7% of revenue

Get AI wrong? It could cost 7% of revenue

AI is here: Thrive or Die?

AI is here: Thrive or Die?

AI vs Data: The Chicken and the Egg

AI vs Data: The Chicken and the Egg

The EU AI Act: Are you in scope?

The EU AI Act: Are you in scope?

The EU AI Act: Are you ready?

The EU AI Act: Are you ready?

See all videos with titles

Useful links

Aztec AI GroupAztec AI ComplianceWhite papers
VideosFollow me on LinkedInForward to a colleague

About Bridget

I'm Bridget Convey, founder of Aztec AI Group, which provides ready-made AI governance tools that turn AI risk into business confidence. For 30 years I have led complex regulatory transformation programmes across banking, insurance and asset management. Today I advise executives and boards on AI and quantum risk, and on making critical decisions traceable, defensible and deliverable. I am ISO/IEC 42001 certified and an alumna of the Oxford Saïd AI Strategy and Leadership Programme.

Aztec AI Group
Bridget Convey Bridget Convey Founder, Aztec AI Group

Aztec AI Group is a trading name of TendoVend Ltd, registered in England and Wales, company number 15906234. Registered office: 79 Mantle Street, Wellington, TA21 8BB. VAT registration 521 4365 19. Some content on this site is produced with the help of AI and checked by Bridget Convey before publication.

info@aztecaigroup.com  ·  aztecaigroup.com  ·  © 2026 TendoVend Limited  ·  FAQs  ·  Contact  ·  Privacy notice