AI policy under commercial pressure

❗Enterprise AI Assurance: The Market Is Moving Faster Than Regulation❗ AI governance isn’t waiting for regulators to catch up. Enterprise adoption of ISO42001 is proving that market-driven AI assurance will outpace regulatory mandates. AWS and Google Cloud have both achieved ISO42001 certification for their AIMS. Microsoft has gone a step further, integrating ISO42001-based AI governance requirements into its supplier security and privacy program (SSPADPR v10). These aren’t just compliance exercises, they’re market-driven moves to standardize AI risk management across global supply chains. The distinction is critical. Regulations create a baseline, but markets set the standard. ➡️Regulatory vs. Market Pressure: What’s Driving AI Assurance? 🔹Regulatory Pressure: Governments are defining AI laws, but enforcement is staggered. The EU AI Act is rolling out compliance deadlines over the next two years. California is introducing AI audit requirements. Other regions are still debating how far they’ll go. 🔹 Market Pressure: Enterprise customers aren’t waiting for laws to dictate AI assurance. Major cloud providers are already making ISO42001 a prerequisite for AI services and vendor relationships. Companies that want to sell into enterprise markets will need structured AI governance whether regulations require it or not. The reality? Market-driven AI assurance will extend beyond regulatory borders. ISO42001 isn’t tied to a single country’s AI laws, it’s a globally recognized framework. That means a company operating outside the EU AI Act’s jurisdiction will still feel the pressure to align with ISO42001 if it wants to do business inside enterprise ecosystems. ➡️Why Market Pressure Influences More Than Regulation ✔ Regulations define legal obligations. Market expectations define operational reality. Enterprise customers expect AI governance beyond minimum legal thresholds, they need consistent, certifiable AI assurance frameworks across regions. ✔ Market-driven AI governance moves faster than legislation. The EU AI Act was first proposed in 2021. It took three years to pass. Meanwhile, AWS, Google, and Microsoft have already made ISO42001 a working standard for AI assurance. ✔ Market adoption scales globally. A company that achieves ISO42001 certification isn’t just proving compliance in one region, it’s building AI assurance into its business model. That makes it easier to sell into regulated and unregulated markets alike. ➡️What This Means for AI Vendors, Suppliers, and Enterprises Companies that provide, produce, or use AI in enterprise environments will need structured AI governance. 🔸Suppliers: If your customers require ISO42001 compliance, you won’t be able to sidestep AI assurance. 🔸AI Service Providers: Offering ISO42001-certified AI solutions is a competitive advantage. 🔸Enterprises: Market-driven AI governance reduces business risk beyond regulatory mandates, you should expect to see ISO42001 in procurement requirements soon.

Yesterday, the open internet got its first toll booth. Not from courts or Congress, but from Cloudflare. The company, whose infrastructure touches roughly 20% of all global internet traffic, announced a significant shift: All new customer domains will now block AI bots by default. That means crawlers like OpenAI's GPTBot, Anthropic's ClaudeBot, and Google's Extended bot can no longer freely help themselves to your content. Unless you, the website owner, explicitly allow it, they’re cut off. Cloudflare also announced a Pay‑Per‑Crawl marketplace, where publishers can set terms for access - turning content into a licensed input, not a free good. With one product update, Cloudflare rewrote the default terms of engagement between AI and the web. From open to closed. From assumed permission to enforced consent. From passive scraping to active negotiation. Cloudflare has forced the question that’s been dodged for years: If AI systems are built on the backs of human expression, who owns the value they create? ▪️ For 20+ years, the internet operated on a basic exchange: Publish freely → Get discovered via search → Monetize attention. But AI broke that contract. Users now ask Claude or ChatGPT for answers. The models reply using human-created content - with no credit, no clickthrough, and no compensation. When publishing stops being a path to discovery - and starts being a donation to model training - incentives collapse. What Cloudflare did was reintroduce friction. Not to break the web. But to rebalance it. ▪️ What makes this moment so interesting is that the solution isn’t coming from regulators. It’s not the result of a moral awakening or a philosophical reckoning. It’s a default setting in a SaaS dashboard. But because of Cloudflare’s scale, it might as well be policy. This is capitalism at its best. You don’t always need top-down regulation to enforce guardrails. Sometimes market incentives create their own form of governance. In a world where governments often lag behind technology, infrastructure becomes policy. ▪️ Cloudflare may not have intended to reshape digital economics, but they’ve done exactly that. By forcing AI firms to ask, license, or walk away, Cloudflare has built the bones of a content licensing infrastructure, without ever saying the word “copyright”. ▪️ Let’s be clear: Cloudflare didn’t do this because it’s noble. They did it because it’s profitable. Their customers - TIME, Condé Nast, Reddit, News Corp - are tired of being strip-mined for training data without so much as a backlink. And Cloudflare is in the perfect position to intervene. I won’t be surprised if Fastly, Akamai, maybe even AWS follow. For 30 years, we assumed the internet had no gatekeepers. But it did. We just didn’t notice them until they started saying no. The principle is planted: Scraping without consent is not neutral. It’s extraction. We could see a more cohesive consent layer for the web emerge - driven not by altruism, but by incentive alignment.

This week JPMorganChase pulled Anthropic's Claude from the approved tools list for its Hong Kong staff. Bankers in New York, London and Singapore are still using it. In Hong Kong, it's gone. The interesting part is why. The model didn't get worse, and nobody complained about how it performs. The block came down to the wording of a usage term in Anthropic's licensing agreement, language that doesn't cover that region. The bank reviewed the latest terms, found the restriction and acted on it. And JPMorganChase isn't first. Goldman Sachs did the same thing for its Hong Kong bankers back in April. When two of the biggest banks in the world reach the same decision about the same vendor in the same city within weeks, it starts to look less like a one-off and more like the beginning of an industry norm. The wider context makes it bigger. Washington has been tightening the rules on where America's most capable models can go and who's allowed to use them, and that pressure is now showing up inside individual companies. Export policy and licensing clauses are quietly doing the job that benchmarks used to do, deciding which AI gets used and where. If you're building an AI strategy, that shift matters. Whether a model can legally and contractually run in your market is becoming just as important as capability, and that question belongs in the vendor conversation early...not after the pilot is already underway. The map of where frontier AI can actually operate is being redrawn right now. Hong Kong is just the first place the new lines became easy to see. Read the full piece on State of AI here: https://lnkd.in/gHiFE2Ru

BT’s decision to anchor an additional 40,000-plus job reductions to the “full potential” of AI is a striking marker of where executive pressure now sits. Announcing a technology-led transformation before its feasibility is proven can appear courageous, yet history reminds us that the line between foresight and overreach is often drawn only in hindsight. In this week’s article, I step back from the headline and examine the strategic calculus behind such public commitments. How much real evidence justifies going all-in, and how much is the product of boardroom tension, investor impatience and policy theatre? I look at the AI hype cycle, the hidden costs to organisational resilience and the lessons still echoing from past tech waves that promised more than they could deliver. If you are weighing how publicly to position your own AI ambitions, or whether to firmly temper them, I hope the piece offers a useful lens. Read the full analysis, and please share your perspective. #ArtificialIntelligence #AI #DigitalTransformation #Leadership #FutureOfWork #BusinessStrategy #Innovation #TechLeadership

This week the most powerful customer on earth tried to force an AI company to drop its usage policy. It lost, in federal court. If you build anything on frontier models, that ruling is about you, not about politics. The Pentagon labeled Anthropic a supply-chain risk, a tag reserved for foreign adversaries, after Anthropic refused to let Claude run autonomous weapons and mass surveillance. A federal judge ruled it unlawful retaliation and ordered the label removed. Her line: a vendor does not become an adversary because it insists on its own contracting terms. Everyone is reading this as a fight with the administration, or a win for AI safety. Read it as an operator instead. Anthropic's usage policy, the clause you scrolled past when you signed up, just survived contact with the Department of Defense. It held. Which means something most teams never sat with. Build on a frontier model and you are not only renting capability. You are adopting the vendor's values, and their willingness to enforce them against anyone, including the buyer. I run more than a third of my company as agents on these vendors' terms. That policy is not fine print to me. It is part of my operating system, and I do not own it. It cuts both ways. It can protect you, refusing uses that would land you in a courtroom. It can also forbid something your roadmap needs, and the vendor can tighten it next quarter with no vote and no warning. Most companies cannot tell you what their model provider's usage policy forbids. It governs their product anyway. So read it like a contract clause that can break you, not boilerplate. What does it forbid that you might need. What could they add. What is your recourse if they do. The honest answer is none. The most important line in your AI stack is one you did not write and cannot change. A court just made it enforceable. Go read it. https://lnkd.in/eTpapi8t #AI #Stack #Enterprise #Supply

AUSTRALIAN AI REGULATORY ALERT. Australia is pausing, and possibly abandoning, AI-specific regulation. Not long ago, I suggested the backlash against the EU AI Act, and the shift in the US and UK towards lighter, innovation-first frameworks, would shape Australia’s path. It looks like I was right. We’ve had a change in minister and a serious productivity challenge, so the focus on productivity has only sharpened. We have had the Productivity Commission’s report and now a national roundtable where AI was centre stage. The Commission's view? AI-specific laws should be a last resort. And that’s what emerged from the roundtable. The government’s message is clear: a standalone regime is on hold. Instead, a regulatory gap analysis will test if existing laws can carry the load. I understand the impulse. Productivity is a genuine challenge, and AI is central to lifting it. But I see a consistent undervaluing of the dividend that good laws deliver. Well-structured, ex ante, risk-based frameworks are enablers of adoption, investment, and competitiveness: 1️⃣ Certainty: guardrails give boards and investors confidence to commit capital and scale. 2️⃣ Quality: governance, testing, and oversight improve reliability and reduce bias, making AI outputs more resilient. 3️⃣ Confidence: proportionate guardrails ensure innovation isn’t dominated by incumbents exploiting fragmented rules. 4️⃣ Credibility: clear frameworks attract global partners, data access, and research opportunities. Productivity gains materialise when adoption and investment scale. And they scale when markets have confidence in the rules. Existing regimes alone may not be enough. Privacy, consumer, and sectoral laws are largely ex post, they only act once harm has occurred. With AI’s scale, opacity, and autonomy, it’s too reactive. A failure in healthcare, key decision making, or financial modelling can cascade before regulators even know. I’ve said before we cannot “lift and shift” the EU AI Act or any other regime. Australia needs an approach that works for our economy, our legal system, and our regulatory capacity. No doubt the solution will be a combination of existing frameworks and new measures. The ACTU is right that outcomes matter most, and I’ll reserve judgment until the review of existing laws is complete. But I stand by my position: the best way to achieve real outcomes is a streamlined, flexible ex ante regime for high-risk AI, rules that evolve without waiting on slow legislative change. We don’t need “perfect” rules from day one. Perfect is the enemy of progress, and chasing it only delays the certainty that business and the community need. A clear, adaptable framework can start with lighter rules, scale as risks evolve, and provide confidence sooner. Without it, we risk undermining the adoption and investment needed to deliver productivity. https://lnkd.in/g-DV_QTH #ArtificialIntelligence #AI #AIGovernance #Productivity #Innovation

Your AI policy is probably not your AI governance strategy. Your contracts are. Think about it. When a company buys AI, the real decisions are not buried in a policy document somewhere on the intranet. They're negotiated. Can the vendor train on your data? Who owns the outputs? What happens if the model gets something wrong? What disclosures are required? What audit rights exist? Who is responsible when things go sideways? Those answers live in contracts. That's why I've become increasingly convinced that AI governance is moving out of policy documents and into agreements. Policies explain what organizations hope will happen. Contracts determine what actually happens. Attached is a short article exploring that idea and why the contractual layer is becoming increasingly important as AI moves into production. Curious whether others are seeing the same thing. Are AI conversations in your organization still primarily at the policy level, or are they increasingly appearing in contracts? #AI #AIGovernance #LegalOps #Contracts #Procurement — Olga V. Mack I build legal systems for real life.

So... how many of us saw the shots fired from Anthropic during the Super Bowl last night? While the ad mocking the overly helpful AI hawking shoe inserts for a user to gain 6-pack abs was memorable and funny, it signals a deeper rift in the industry's economic foundations. Anthropic is already defending against a monetization model that many other providers will likely pursue. This recent a16z piece argues that ads are a "public good" necessary for broad access. But, is this about democratizing intelligence, or is it a pragmatic response to the reality that AI, unlike traditional SaaS, carries significant marginal costs every time a user hits 'enter'? Moreover, what are the long-term consequences if premium subscribers gain access to "neutral" reasoning while the rest of the world relies on an agent optimized for affiliate conversion? Does this dynamic fundamentally grow the gap between those with objective information and those steered by a sponsor's margin? If we use ads to recoup massive R&D spend, the model's primary objective shifts from providing a neutral answer to facilitating a transaction. Broad access is only a meaningful utility if the quality of the insight remains uncompromised by the sponsor... https://lnkd.in/eXuxtKFu

Most boards cannot answer one basic question about their AI strategy: Where does the training data actually come from? AI strategies are being approved without visibility into their most critical upstream input: the information supply chain. This is no longer just a copyright issue. It’s a strategic risk. Most foundation models are trained on massive volumes of scraped web content - while the economic and legal foundations of that practice remain unresolved, especially for high-quality media and knowledge content. That creates a fragile system: - AI systems need more data - Much data is taken, not sourced - Incentives for original content are shrinking - Media and knowledge models are weakening - Law was not designed for industrial-scale text and data mining High-quality information is to AI what semiconductors are to hardware: a critical upstream input that is currently under-priced and weakly governed. An extensive new analysis by RTR (Rundfunk und Telekom Regulierungs-GmbH (RTR)) reinforces what many CIOs and boards are starting to see: If we do not build lawful and scalable data markets for AI training, we will end up with: - declining model quality (more synthetic, less original data) - rising regulatory and litigation exposure - fragile AI strategies built on unstable inputs - long-term damage to media and knowledge ecosystems There will be two kinds of AI strategies: 1. Built on scraped, legally ambiguous data. 2. Built on licensed, traceable, high-quality information. The second will outperform - economically, legally, and reputationally. For CEOs and CIOs, the strategic question is no longer only: Which model should we deploy? It is now: What information supply chain are we depending on? The full RTR study is worth reading — this debate is moving from policy to core digital infrastructure strategy. cc: Klaus, Wolfgang Struber, Thomas Schreiber, Timo Steyer, Philipp Homar, Lukas Moormann.