Here is your July Brief.

Washington Switched Off a Frontier AI Model for 19 Days. Every Model Dependency Is Now Revocable.

On 12 June, the US Commerce Department ordered Anthropic to suspend access to its two most capable models, Claude Fable 5 and Mythos 5, after researchers demonstrated a jailbreak that produced working exploit code. Because the export-control order barred access by any foreign national — including Anthropic's own staff — the company shut both models down for every customer, worldwide, overnight.

The restoration was staged: on 26 June, Mythos 5 returned for roughly 100 US critical-infrastructure organisations; on 30 June the Commerce Department lifted the controls; on 1 July Fable 5 was redeployed globally. The conditions attached are instructive: independent security testing, coordination with government on future launches, malicious-use reporting, and a new classifier that blocks the jailbreak in over 99% of cases — with blocked requests silently rerouted to an older model.

This is the first time a government has removed a production frontier model from the market by regulatory action. As the Cloud Security Alliance noted, every enterprise that had built workflows on the suspended models discovered the same day that model availability is a regulatory variable, not just an operational one.

The High-Risk Delay Is Law. The Transparency Deadline Survived. You Have Two Weeks.

The Digital Omnibus on AI completed its legislative journey this month: Parliament adopted it on 16 June (423 votes to 57), the Council gave its final green light on 29 June, and the act was signed on 8 July. The dates are now law: stand-alone high-risk AI systems under Annex III — credit scoring, insurance pricing, employment screening — must comply by 2 December 2027; high-risk AI embedded in regulated products by August 2028.

What did not move: Article 50 transparency obligations apply from 2 August 2026 — chatbot disclosure, deepfake labelling, machine-readable marking of synthetic content. The same day, the Commission's enforcement powers over general-purpose AI providers activate: document requests, model evaluations, market withdrawal, and fines up to 3% of global turnover or €15 million. The GPAI obligations themselves have applied since August 2025 — what changes on 2 August is that they become enforceable.

The operational compliance vehicle arrived in the window too. The final Code of Practice on Transparency of AI-Generated Content was published 10 June and formally deemed adequate on 8 July. The deadline to sign as an initial signatory is 22 July, 18:00 CET. One compression to note: the Omnibus cut the grace period for generative AI systems already on the market from six months to three — machine-readable marking by 2 December 2026.

Washington Moves Against State AI Law. What Replaces It Is a Question, Not a Rule.

The Colorado AI Act — the only US state law regulating AI credit and insurance decisions the way the EU does — technically took effect on 30 June. It is unenforceable. In xAI v. Weiser, a federal court suspended enforcement pending a First Amendment challenge, with the Justice Department intervening on xAI's side — the first federal intervention against a state AI law. Colorado has already capitulated: a replacement law signed in May repeals the algorithmic-discrimination duty of care entirely from January 2027, leaving a disclosure-only regime.

The FTC opened a second front: a proposed policy statement treating the deliberate degradation of AI-output accuracy — explicitly including tuning done to comply with state fairness laws — as potential deception under the FTC Act, where the trade-off is undisclosed. Comments close 31 July. Meanwhile, the revised interagency model risk guidance (OCC Bulletin 2026-13) still excludes generative and agentic AI from scope, and the promised interagency request for information on AI in model risk — the process that will decide how bank model-risk frameworks absorb generative systems — has yet to appear.

The Supervisors Publish Their Homework. The Industry Has Not Done Its Own.

Supervisory expectations converged sharply this month. The Financial Stability Board published twelve sound practices for responsible AI adoption — governance, lifecycle risk management, third-party and cyber risk, explicitly covering generative and agentic AI. Consultation closes 22 July; the final report lands in October. The FCA published the Mills Review on 6 July, and CEO Nikhil Rathi's June speech signalled the UK's principles-only stance is bending toward AI-specific intervention. Singapore's MAS is finalising AI risk management guidelines for all financial institutions.

Against that, the industry's numbers. The Cambridge 2026 Global AI in Financial Services Report: 81% of financial firms use AI at some level and 40% are at advanced stages — against 20% of the 130 regulators surveyed. 52% are adopting agentic AI; 23% are anywhere near mature with it. And 66% of industry respondents are not monitoring their AI for bias or discrimination.

The control gap is specific, not abstract. In Wolters Kluwer's US banking survey, 72% of compliance officers named model kill-switch protocols and regulatory failure reporting as their least-prepared area — precisely the lifecycle controls the FSB's practices formalise. Grant Thornton's survey of 950 leaders found only 11% of boards have done all three basics: briefings, governance expectations, and risk integration.

The Bank of England Finds a Second AI Exposure: The Balance Sheet.

The July Financial Stability Report reframes the question. AI-linked issuers account for 41% of non-refinancing US high-yield issuance so far in 2026 — companies that made up roughly 1% of the high-yield index at the end of 2025. The share of AI investment financed by private credit jumped from 9% in 2024 to 34% in 2025. And for the first time, the Financial Policy Committee explicitly finds that frontier AI capabilities have increased financial stability risks through cyber and operational channels.

The BIS Annual Economic Report, released 28 June, names an AI capital-expenditure bust and circular AI financing structures among the top threats to global financial stability — the central bank of central banks now treats the AI boom itself as a systemic exposure, alongside record sovereign debt.

The Vendors Move Inside the Perimeter: Embedded Engineers and Pre-Installed Agents

June's edition described AI vendors embedding into banking. July escalated it. HSBC signed a multi-year partnership with Google Cloud on 17 June — over 200 AI use cases planned across two years, with flagship initiatives each valued at more than $100 million, spanning wealth management, financial crime, and frontline operations. On 2 July, Microsoft launched a $2.5 billion "Frontier Company" — 6,000 engineers and consultants embedded inside enterprise clients, two days after Amazon's equivalent move. Implementation itself is now the product.

Further down the stack, agentic AI is arriving pre-installed: Abrigo launched an agentic lending platform on AWS covering the full loan lifecycle, and Fiserv is embedding AI agents into its digital banking suite — meaning thousands of mid-tier and community banks will inherit agents from their core vendor rather than build them. 51% of banks are already piloting AI agents.

AI Agents Entered the Exploited-Vulnerability Catalogue. And Ran Their First Ransomware.

Two firsts this month. CISA added a vulnerability in Langflow — an AI agent-building platform — to its Known Exploited Vulnerabilities catalogue, the first agent platform ever listed, with a federal remediation deadline measured in days. And Sysdig documented JadePuffer — what it describes as the first ransomware operation run end-to-end by an AI agent: reconnaissance, credential theft, lateral movement, and encryption, executed autonomously after exploiting a Langflow flaw.

The defensive baseline is forming in parallel. The NSA published its first security guidance for Model Context Protocol deployments — eight risk categories, least-privilege tool access, SIEM-integrated audit logs. The MCP specification's largest revision — a stateless core and identity-bound agent authorisation that ties tool access to the user's SSO identity — is scheduled to ship 28 July. The gap it addresses is real: in Okta and Microsoft CISO data, 88% of organisations report suspected AI-agent security incidents; only 22% treat agents as identities.

Three Courts, One Message: The Liability for AI Sits With You

Your AI's output is your statement. The Munich Regional Court held Google directly liable for false claims in AI Overviews — treating AI-generated summaries as the company's own speech, with no intermediary shield, after the system falsely tied two publishers to scams. A second German court reached the same conclusion for a company's customer-facing chatbot.

Your vendor's status is no shield — in either direction. In Mobley v. Workday, a California federal court ruled on 22 June that the AI screening vendor must face discrimination claims — including California state claims from applicants who never set foot in California, because the tools were designed and controlled from its headquarters there. And your model logs are evidence. The New York Times has asked a court to sanction OpenAI for allegedly deleting billions of output logs subject to a preservation order and misrepresenting its ability to search them.

What to Watch