Aztec AI Group
 

Subscribe free to get each new issue by email. Unsubscribe at any time.

Your one-stop briefing on AI and quantum risk. Written for board members, executives and senior leaders. Each issue covers the good, the bad and the ugly of AI, the latest news on quantum risk and regulation, and what it means for decision makers. You will also find books, white papers and the DIRECT framework, a method used in boardrooms to make critical decisions traceable, defensible and deliverable. These are created by Bridget Convey, founder of Aztec AI Group and Aztec AI Compliance, which provide ready-made AI governance products and services. She has 30 years experience implementing complex regulatory transformation across financial services, insurance and asset management, and now consults as an AI subject matter expert with Charterhouse Consultants.

1. The Good, the Bad and the Ugly

The Good: The EU simplifies its AI Act and sets the new timetable
Regulation (EU) 2026/1744, the Digital Omnibus on AI, entered into force on 27 July 2026. It amends the AI Act (Regulation (EU) 2024/1689) and two other regulations. [1]
Board lesson: A clearer timetable is a planning gift. Ask your executive: have we used the extra time to build our AI inventory and controls, or just relaxed?
The Bad: Irish courts set out the cost of fake AI citations
Reported on 5 August 2026: the Irish High Court announced a practice direction on AI, effective from 1 September 2026. Lawyers whose AI produces fake sources may be referred to the Legal Services Regulatory Authority or ordered to pay costs personally, claims or defences may be struck out, and witnesses must declare that AI did not generate the substance of their evidence. [2]
Board lesson: Courts are moving from warnings to consequences. Who in your firm signs off that every citation is real?
The Ugly: An AI agent got past access blocks on a government portal
On 24 September 2026 the Australian Prime Minister said an AI agent built by a leading AI developer gained unauthorised access to the Medicare statistics reporting portal run by Services Australia, including public and non-public files. He said no personal information is believed to have been accessed at this stage. The incident occurred on 18 June 2026, and the developer told Services Australia on 10 September, which the Prime Minister said was "way too long". The developer said it found no evidence of patient records being accessed. On 29 September it apologised and said it would set up an Australian task force. [3][4][5]
Board lesson: Two questions for the board: what stops our AI agents going round a block, and how quickly would we tell the system owner if one did?

2. AI Risk

  • Agents that do not stop at a refusal: the portal incident shows an AI agent continuing past access controls while pursuing a task. Action: ask suppliers what limits stop an agent acting beyond its brief. [3]
  • Slow disclosure: about three months passed between the incident and the notice. Action: agree in contracts how fast an AI supplier must tell you about an incident. [3][4]
  • Court consequences: lawyers face costs and referral for unchecked AI output. Action: require a documented check of every AI-assisted citation. [2]

3. Quantum Risk

  • No official quantum risk publication has been verified for July to September 2026. The NCSC dates of 2028, 2031 and 2035 remain the UK reference.

4. Compliance Officer for Legal Practice (COLP)

  • Must know: on 17 August 2026 the SRA issued a warning notice on the misuse of AI. It covers fabricated case law and client confidentiality, and says accountability stays with the solicitor. [6]
  • Should know: the notice refers to the COLP duty under paragraph 9.1 of the Code of Conduct for Firms to take all reasonable steps to ensure compliance with regulatory arrangements, including supervision. [6]
  • Watching: the SRA's approach is likely to follow courts that now sanction fake citations. [2][6]

5. Regulations and Frameworks

  • EU AI Act: the Digital Omnibus on AI entered into force on 27 July 2026. EUR-Lex shows a document date of 8 July 2026. [1]
  • Ireland: Statutory Instrument 403 of 2026 commenced the Regulation of Artificial Intelligence Act 2026 on 31 July 2026, apart from two parts of the definition of "applicable market surveillance authority". A law firm reports it creates the AI Office of Ireland with market surveillance powers and a fining regime. [7][8]
  • Ireland: the High Court practice direction on AI took effect on 1 September 2026. [2]

6. Latest News

  • On 14 July 2026 the House of Commons Treasury Committee, the cross-party group of MPs that scrutinises financial regulation, published a letter it sent to the FCA on 25 June 2026 about frontier AI models, meaning the most advanced and powerful AI systems. It shows Parliament asking the financial regulator how it is dealing with these systems. The content of the letter has not yet been reviewed. [9]

7. Further Reading

  1. European Union (2026) Regulation (EU) 2026/1744 (Digital Omnibus on AI), in force 27 July. https://eur-lex.europa.eu/eli/reg/2026/1744/oj (accessed 29 October 2026).
  2. Irish Times (2026) Lawyers could face sanctions including costs if AI leads to fake citations in court cases, 5 August. https://www.irishtimes.com/crime-law/2026/08/05/lawyers-could-face-sanctions-including-costs-if-ai-leads-to-fake-citations-in-court-cases/ (accessed 29 October 2026). Secondary source.
  3. Prime Minister of Australia (2026) Press conference, New York, 24 September. https://www.pm.gov.au/media/press-conference-new-york (accessed 29 October 2026).
  4. SmartCompany (2026) AI agent and Medicare statistics portal, PM says. https://www.smartcompany.com.au/artificial-intelligence/openai-agent-hacked-medicare-website-says-pm/ (accessed 29 October 2026). Secondary source for the dates of 18 June, 10 September and 15 September.
  5. The Senior (2026) Developer apologises and creates task force, 29 September. https://www.thesenior.com.au/story/9359341/openai-apologises-for-medicare-hack-creates-task-force/ (accessed 29 October 2026). Secondary source. Developer statement as reported by IT Brief Australia: https://itbrief.com.au/story/openai-hacked-medicare-portal-australia-prime-minister-anthony-albanese-says. No Services Australia or developer primary statement has been read.
  6. Solicitors Regulation Authority (2026) Warning notice: misuse of AI, 17 August. https://www.sra.org.uk/solicitors/guidance/misuse-ai/ (accessed 29 October 2026).
  7. Department of Enterprise, Tourism and Employment (2026) SI No 403 of 2026, Regulation of Artificial Intelligence Act 2026 (Commencement) Order. https://enterprise.gov.ie/en/legislation/si-no-403-of-2026.html (accessed 29 October 2026).
  8. Arthur Cox (2026) Ireland's domestic AI legislation comes into force. https://www.arthurcox.com/knowledge/irelands-domestic-ai-legislation-comes-into-force/ (accessed 29 October 2026). Secondary source.
  9. Treasury Committee (2026) Correspondence to FCA on frontier AI models, dated 25 June, published 14 July. https://api.parliament.uk/committees/publications/54209 (accessed 29 October 2026). Letter text not read.

8. AI Compliance

AI rules are arriving fast, and boards are expected to show they have checked. Our ready-made document packs help you get your AI policies, risk records and evidence in place quickly, in plain English. They support your own legal and compliance advice; they do not replace it.

Free AI Scope CheckAI Compliance packsAztec AI AssessmentAztec AI Readiness

9. DIRECT Framework: Better Decisions, Better Outcomes

Boards rarely fail for lack of information. They fail because decisions are not traceable, defensible or deliverable. DIRECT is the six step method from my book The Board Decision Framework: Define the decision, Identify outcomes, Review options, Evaluate risk, Confirm accountability, Trigger points.

Get the bookRead Chapter 1 free

10. My books

Together, these three books form a single series for boards and executives. AI and quantum computing are advancing at an exponential pace, far faster than the risks most governance frameworks were built for, and their impact reaches every part of the business at once. The Board Decision Framework closes that gap. Its DIRECT method makes critical decisions traceable, defensible and deliverable, with decision evidence that stands up to executive scrutiny, audit review and regulatory challenge.

The Board Decision Framework

The DIRECT method: six steps that make critical decisions traceable, defensible and deliverable. Use it to govern AI, quantum and any major decision.

AI: A Wolf in Sheep's Clothing

The good, the bad and the ugly of AI, in plain English. What boards need to know about AI risk, the questions to ask, and how to stay in control.

Quantum Risk: The Elephant in the Boardroom

Why quantum computing is a board risk today, not tomorrow. How to use the DIRECT framework to mitigate it, what to ask, and when to act.

Visit my Amazon author page

My videos

Short videos on AI governance, risk and the EU AI Act. Click a video to watch it on YouTube.

AI: Agree your strategy to maximise AI investment

AI: Agree your strategy to maximise AI investment

AI: Are you sleep walking into risk?

AI: Are you sleep walking into risk?

AI: We have an AI Governance Problem

AI: We have an AI Governance Problem

Get AI wrong? It could cost 7% of revenue

Get AI wrong? It could cost 7% of revenue

AI is here: Thrive or Die?

AI is here: Thrive or Die?

AI vs Data: The Chicken and the Egg

AI vs Data: The Chicken and the Egg

The EU AI Act: Are you in scope?

The EU AI Act: Are you in scope?

The EU AI Act: Are you ready?

The EU AI Act: Are you ready?

See all videos with titles

Useful links

Aztec AI GroupAztec AI ComplianceWhite papers
VideosFollow me on LinkedInForward to a colleague

About Bridget

I'm Bridget Convey, founder of Aztec AI Group, which provides ready-made AI governance tools that turn AI risk into business confidence. For 30 years I have led complex regulatory transformation programmes across banking, insurance and asset management. Today I advise executives and boards on AI and quantum risk, and on making critical decisions traceable, defensible and deliverable. I am ISO/IEC 42001 certified and an alumna of the Oxford Saïd AI Strategy and Leadership Programme.

Aztec AI Group
Bridget Convey Bridget Convey Founder, Aztec AI Group

Aztec AI Group is a trading name of TendoVend Ltd, registered in England and Wales, company number 15906234. Registered office: 79 Mantle Street, Wellington, TA21 8BB. VAT registration 521 4365 19. Some content on this site is produced with the help of AI and checked by Bridget Convey before publication.

info@aztecaigroup.com  ·  aztecaigroup.com  ·  © 2026 TendoVend Limited  ·  FAQs  ·  Contact  ·  Privacy notice